commit 610a9b8f49fbcf1100716370d3b5f6f884a2835a Author: Linus Torvalds Date: Sun Dec 31 12:51:25 2023 -0800 Linux 6.7-rc8 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2639772a11c860628c5f7007842eca52a1c34d78 Author: Alvin Šipraga Date: Tue Dec 19 02:25:15 2023 +0100 get_maintainer: remove stray punctuation when cleaning file emails When parsing emails from .yaml files in particular, stray punctuation such as a leading '-' can end up in the name. For example, consider a common YAML section such as: maintainers: - devicetree@vger.kernel.org This would previously be processed by get_maintainer.pl as: - Make the logic in clean_file_emails more robust by deleting any sub-names which consist of common single punctuation marks before proceeding to the best-effort name extraction logic. The output is then correct: devicetree@vger.kernel.org Some additional comments are added to the function to make things clearer to future readers. Link: https://lore.kernel.org/all/0173e76a36b3a9b4e7f324dd3a36fd4a9757f302.camel@perches.com/ Suggested-by: Joe Perches Signed-off-by: Alvin Šipraga Signed-off-by: Linus Torvalds scripts/get_maintainer.pl | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) commit 9c334eb9ce886247567573074b13c5ac29d1a41a Author: Alvin Šipraga Date: Tue Dec 19 02:25:14 2023 +0100 get_maintainer: correctly parse UTF-8 encoded names in files While the script correctly extracts UTF-8 encoded names from the MAINTAINERS file, the regular expressions damage my name when parsing from .yaml files. Fix this by replacing the Latin-1-compatible regular expressions with the unicode property matcher \p{L}, which matches on any letter according to the Unicode General Category of letters. The proposed solution only works if the script uses proper string encoding from the outset, so instruct Perl to unconditionally open all files with UTF-8 encoding. This should be safe, as the entire source tree is either UTF-8 or ASCII encoded anyway. See [1] for a detailed analysis. Furthermore, to prevent the \w expression from matching non-ASCII when checking for whether a name should be escaped with quotes, add the /a flag to the regular expression. The escaping logic was duplicated in two places, so it has been factored out into its own function. The original issue was also identified on the tools mailing list [2]. This should solve the observed side effects there as well. Link: https://lore.kernel.org/all/dzn6uco4c45oaa3ia4u37uo5mlt33obecv7gghj2l756fr4hdh@mt3cprft3tmq/ [1] Link: https://lore.kernel.org/tools/20230726-gush-slouching-a5cd41@meerkat/ [2] Signed-off-by: Alvin Šipraga Signed-off-by: Linus Torvalds scripts/get_maintainer.pl | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-) commit 453f5db0619e2ad64076aab16ff5a00e0f7c53a2 Merge: b106bcf0f99a d05cb470663a Author: Linus Torvalds Date: Sat Dec 30 11:37:35 2023 -0800 Merge tag 'trace-v6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix readers that are blocked on the ring buffer when buffer_percent is 100%. They are supposed to wake up when the buffer is full, but because the sub-buffer that the writer is on is never considered "dirty" in the calculation, dirty pages will never equal nr_pages. Add +1 to the dirty count in order to count for the sub-buffer that the writer is on. - When a reader is blocked on the "snapshot_raw" file, it is to be woken up when a snapshot is done and be able to read the snapshot buffer. But because the snapshot swaps the buffers (the main one with the snapshot one), and the snapshot reader is waiting on the old snapshot buffer, it was not woken up (because it is now on the main buffer after the swap). Worse yet, when it reads the buffer after a snapshot, it's not reading the snapshot buffer, it's reading the live active main buffer. Fix this by forcing a wakeup of all readers on the snapshot buffer when a new snapshot happens, and then update the buffer that the reader is reading to be back on the snapshot buffer. - Fix the modification of the direct_function hash. There was a race when new functions were added to the direct_function hash as when it moved function entries from the old hash to the new one, a direct function trace could be hit and not see its entry. This is fixed by allocating the new hash, copy all the old entries onto it as well as the new entries, and then use rcu_assign_pointer() to update the new direct_function hash with it. This also fixes a memory leak in that code. - Fix eventfs ownership * tag 'trace-v6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ftrace: Fix modification of direct_function hash while in use tracing: Fix blocked reader of snapshot buffer ring-buffer: Fix wake ups when buffer_percent is set to 100 eventfs: Fix file and directory uid and gid ownership commit b106bcf0f99ae0459f3c8c2f0af575ef9f5d9bde Author: David Laight Date: Fri Dec 29 20:56:03 2023 +0000 locking/osq_lock: Clarify osq_wait_next() Directly return NULL or 'next' instead of breaking out of the loop. Signed-off-by: David Laight [ Split original patch into two independent parts - Linus ] Link: https://lore.kernel.org/lkml/7c8828aec72e42eeb841ca0ee3397e9a@AcuMS.aculab.com/ Signed-off-by: Linus Torvalds kernel/locking/osq_lock.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit 563adbfc351b2af9f1406b809ba60b9f1673a882 Author: David Laight Date: Fri Dec 29 20:56:03 2023 +0000 locking/osq_lock: Clarify osq_wait_next() calling convention osq_wait_next() is passed 'prev' from osq_lock() and NULL from osq_unlock() but only needs the 'cpu' value to write to lock->tail. Just pass prev->cpu or OSQ_UNLOCKED_VAL instead. Should have no effect on the generated code since gcc manages to assume that 'prev != NULL' due to an earlier dereference. Signed-off-by: David Laight [ Changed 'old' to 'old_cpu' by request from Waiman Long - Linus ] Signed-off-by: Linus Torvalds kernel/locking/osq_lock.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) commit 7c223098212957a1ecd8768e8e747ae2cf88e880 Author: David Laight Date: Fri Dec 29 20:53:49 2023 +0000 locking/osq_lock: Move the definition of optimistic_spin_node into osq_lock.c struct optimistic_spin_node is private to the implementation. Move it into the C file to ensure nothing is accessing it. Signed-off-by: David Laight Acked-by: Waiman Long Signed-off-by: Linus Torvalds include/linux/osq_lock.h | 5 ----- kernel/locking/osq_lock.c | 7 +++++++ 2 files changed, 7 insertions(+), 5 deletions(-) commit d05cb470663a2a1879277e544f69e660208f08f2 Author: Steven Rostedt (Google) Date: Fri Dec 29 11:51:34 2023 -0500 ftrace: Fix modification of direct_function hash while in use Masami Hiramatsu reported a memory leak in register_ftrace_direct() where if the number of new entries are added is large enough to cause two allocations in the loop: for (i = 0; i < size; i++) { hlist_for_each_entry(entry, &hash->buckets[i], hlist) { new = ftrace_add_rec_direct(entry->ip, addr, &free_hash); if (!new) goto out_remove; entry->direct = addr; } } Where ftrace_add_rec_direct() has: if (ftrace_hash_empty(direct_functions) || direct_functions->count > 2 * (1 << direct_functions->size_bits)) { struct ftrace_hash *new_hash; int size = ftrace_hash_empty(direct_functions) ? 0 : direct_functions->count + 1; if (size < 32) size = 32; new_hash = dup_hash(direct_functions, size); if (!new_hash) return NULL; *free_hash = direct_functions; direct_functions = new_hash; } The "*free_hash = direct_functions;" can happen twice, losing the previous allocation of direct_functions. But this also exposed a more serious bug. The modification of direct_functions above is not safe. As direct_functions can be referenced at any time to find what direct caller it should call, the time between: new_hash = dup_hash(direct_functions, size); and direct_functions = new_hash; can have a race with another CPU (or even this one if it gets interrupted), and the entries being moved to the new hash are not referenced. That's because the "dup_hash()" is really misnamed and is really a "move_hash()". It moves the entries from the old hash to the new one. Now even if that was changed, this code is not proper as direct_functions should not be updated until the end. That is the best way to handle function reference changes, and is the way other parts of ftrace handles this. The following is done: 1. Change add_hash_entry() to return the entry it created and inserted into the hash, and not just return success or not. 2. Replace ftrace_add_rec_direct() with add_hash_entry(), and remove the former. 3. Allocate a "new_hash" at the start that is made for holding both the new hash entries as well as the existing entries in direct_functions. 4. Copy (not move) the direct_function entries over to the new_hash. 5. Copy the entries of the added hash to the new_hash. 6. If everything succeeds, then use rcu_pointer_assign() to update the direct_functions with the new_hash. This simplifies the code and fixes both the memory leak as well as the race condition mentioned above. Link: https://lore.kernel.org/all/170368070504.42064.8960569647118388081.stgit@devnote2/ Link: https://lore.kernel.org/linux-trace-kernel/20231229115134.08dd5174@gandalf.local.home Cc: stable@vger.kernel.org Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Jiri Olsa Cc: Alexei Starovoitov Cc: Daniel Borkmann Acked-by: Masami Hiramatsu (Google) Fixes: 763e34e74bb7d ("ftrace: Add register_ftrace_direct()") Signed-off-by: Steven Rostedt (Google) kernel/trace/ftrace.c | 100 ++++++++++++++++++++++++-------------------------- 1 file changed, 47 insertions(+), 53 deletions(-) commit f016f7547aeedefed9450499d002ba983b8fce15 Merge: e543d0b5ecf2 ad5575eb6278 Author: Linus Torvalds Date: Fri Dec 29 11:57:26 2023 -0800 Merge tag 'gpio-fixes-for-v6.7-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - Andy steps down as GPIO reviewer - Kent becomes a reviewer for GPIO uAPI - add missing intel file to the relevant MAINTAINERS section * tag 'gpio-fixes-for-v6.7-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: MAINTAINERS: Add a missing file to the INTEL GPIO section MAINTAINERS: Remove Andy from GPIO maintainers MAINTAINERS: split out the uAPI into a new section commit e543d0b5ecf28f69b5fca94ea770b802c32d884f Merge: 09c57a762e79 70681aa0746a Author: Linus Torvalds Date: Fri Dec 29 11:50:47 2023 -0800 Merge tag 'platform-drivers-x86-v6.7-6' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - Intel PMC GBE LTR regression - P2SB / PCI deadlock fix * tag 'platform-drivers-x86-v6.7-6' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86/intel/pmc: Move GBE LTR ignore to suspend callback platform/x86/intel/pmc: Allow reenabling LTRs platform/x86/intel/pmc: Add suspend callback platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe commit 09c57a762e797a55f6336c9798f576c889658ba5 Merge: 8735c7c84d1b 02d374f3418d Author: Linus Torvalds Date: Fri Dec 29 11:41:40 2023 -0800 Merge tag 'block-6.7-2023-12-29' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "Fix for a badly numbered flag, and a regression fix for the badblocks updates from this merge window" * tag 'block-6.7-2023-12-29' of git://git.kernel.dk/linux: block: renumber QUEUE_FLAG_HW_WC badblocks: avoid checking invalid range in badblocks_check() commit 39a7dc23a1ed0fe81141792a09449d124c5953bd Author: Steven Rostedt (Google) Date: Thu Dec 28 09:51:49 2023 -0500 tracing: Fix blocked reader of snapshot buffer If an application blocks on the snapshot or snapshot_raw files, expecting to be woken up when a snapshot occurs, it will not happen. Or it may happen with an unexpected result. That result is that the application will be reading the main buffer instead of the snapshot buffer. That is because when the snapshot occurs, the main and snapshot buffers are swapped. But the reader has a descriptor still pointing to the buffer that it originally connected to. This is fine for the main buffer readers, as they may be blocked waiting for a watermark to be hit, and when a snapshot occurs, the data that the main readers want is now on the snapshot buffer. But for waiters of the snapshot buffer, they are waiting for an event to occur that will trigger the snapshot and they can then consume it quickly to save the snapshot before the next snapshot occurs. But to do this, they need to read the new snapshot buffer, not the old one that is now receiving new data. Also, it does not make sense to have a watermark "buffer_percent" on the snapshot buffer, as the snapshot buffer is static and does not receive new data except all at once. Link: https://lore.kernel.org/linux-trace-kernel/20231228095149.77f5b45d@gandalf.local.home Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Cc: Mark Rutland Acked-by: Masami Hiramatsu (Google) Fixes: debdd57f5145f ("tracing: Make a snapshot feature available from userspace") Signed-off-by: Steven Rostedt (Google) kernel/trace/ring_buffer.c | 3 ++- kernel/trace/trace.c | 20 +++++++++++++++++--- 2 files changed, 19 insertions(+), 4 deletions(-) commit 623b1f896fa8a669a277ee5a258307a16c7377a3 Author: Steven Rostedt (Google) Date: Tue Dec 26 12:59:02 2023 -0500 ring-buffer: Fix wake ups when buffer_percent is set to 100 The tracefs file "buffer_percent" is to allow user space to set a water-mark on how much of the tracing ring buffer needs to be filled in order to wake up a blocked reader. 0 - is to wait until any data is in the buffer 1 - is to wait for 1% of the sub buffers to be filled 50 - would be half of the sub buffers are filled with data 100 - is not to wake the waiter until the ring buffer is completely full Unfortunately the test for being full was: dirty = ring_buffer_nr_dirty_pages(buffer, cpu); return (dirty * 100) > (full * nr_pages); Where "full" is the value for "buffer_percent". There is two issues with the above when full == 100. 1. dirty * 100 > 100 * nr_pages will never be true That is, the above is basically saying that if the user sets buffer_percent to 100, more pages need to be dirty than exist in the ring buffer! 2. The page that the writer is on is never considered dirty, as dirty pages are only those that are full. When the writer goes to a new sub-buffer, it clears the contents of that sub-buffer. That is, even if the check was ">=" it would still not be equal as the most pages that can be considered "dirty" is nr_pages - 1. To fix this, add one to dirty and use ">=" in the compare. Link: https://lore.kernel.org/linux-trace-kernel/20231226125902.4a057f1d@gandalf.local.home Cc: stable@vger.kernel.org Cc: Mark Rutland Cc: Mathieu Desnoyers Acked-by: Masami Hiramatsu (Google) Fixes: 03329f9939781 ("tracing: Add tracefs file buffer_percentage") Signed-off-by: Steven Rostedt (Google) kernel/trace/ring_buffer.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 70681aa0746ae61d7668b9f651221fad5e30c71e Author: David E. Box Date: Fri Dec 22 19:25:45 2023 -0800 platform/x86/intel/pmc: Move GBE LTR ignore to suspend callback Commit 804951203aa5 ("platform/x86:intel/pmc: Combine core_init() and core_configure()") caused a network performance regression due to the GBE LTR ignore that it added at probe. This was needed in order to allow the SoC to enter the deepest Package C state. To fix the regression and at least support PC10 during suspend, move the LTR ignore from probe to the suspend callback, and enable it again on resume. This solution will allow PC10 during suspend but restrict Package C entry at runtime to no deeper than PC8/9 while a network cable it attach to the PCH LAN. Fixes: 804951203aa5 ("platform/x86:intel/pmc: Combine core_init() and core_configure()") Signed-off-by: "David E. Box" Link: https://lore.kernel.org/r/20231223032548.1680738-6-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/intel/pmc/adl.c | 9 +++------ drivers/platform/x86/intel/pmc/cnp.c | 26 ++++++++++++++++++++------ drivers/platform/x86/intel/pmc/core.h | 3 +++ drivers/platform/x86/intel/pmc/mtl.c | 9 +++------ drivers/platform/x86/intel/pmc/tgl.c | 9 ++++----- 5 files changed, 33 insertions(+), 23 deletions(-) commit 6f9cc5c1f94daa98846b2073733d03ced709704b Author: David E. Box Date: Fri Dec 22 19:25:44 2023 -0800 platform/x86/intel/pmc: Allow reenabling LTRs Commit 804951203aa5 ("platform/x86:intel/pmc: Combine core_init() and core_configure()") caused a network performance regression due to the GBE LTR ignore that it added during probe. The fix will move the ignore to occur at suspend-time (so as to not affect suspend power). This will require the ability to enable the LTR again on resume. Modify pmc_core_send_ltr_ignore() to allow enabling an LTR. Fixes: 804951203aa5 ("platform/x86:intel/pmc: Combine core_init() and core_configure()") Signed-off-by: "David E. Box" Link: https://lore.kernel.org/r/20231223032548.1680738-5-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/intel/pmc/adl.c | 2 +- drivers/platform/x86/intel/pmc/cnp.c | 2 +- drivers/platform/x86/intel/pmc/core.c | 9 ++++++--- drivers/platform/x86/intel/pmc/core.h | 2 +- drivers/platform/x86/intel/pmc/mtl.c | 2 +- drivers/platform/x86/intel/pmc/tgl.c | 2 +- 6 files changed, 11 insertions(+), 8 deletions(-) commit 7c13f365aee68b01e7e68ee293a71fdc7571c111 Author: David E. Box Date: Fri Dec 22 19:25:43 2023 -0800 platform/x86/intel/pmc: Add suspend callback Add a suspend callback to struct pmc for performing platform specific tasks before device suspend. This is needed in order to perform GBE LTR ignore on certain platforms at suspend-time instead of at probe-time and replace the GBE LTR ignore removal that was done in order to fix a bug introduced by commit 804951203aa5 ("platform/x86:intel/pmc: Combine core_init() and core_configure()"). Fixes: 804951203aa5 ("platform/x86:intel/pmc: Combine core_init() and core_configure()") Signed-off-by: "David E. Box" Link: https://lore.kernel.org/r/20231223032548.1680738-4-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/intel/pmc/core.c | 3 +++ drivers/platform/x86/intel/pmc/core.h | 2 ++ 2 files changed, 5 insertions(+) commit b28ff7a7c3245d7f62acc20f15b4361292fe4117 Author: Shin'ichiro Kawasaki Date: Fri Dec 29 15:39:11 2023 +0900 platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe p2sb_bar() unhides P2SB device to get resources from the device. It guards the operation by locking pci_rescan_remove_lock so that parallel rescans do not find the P2SB device. However, this lock causes deadlock when PCI bus rescan is triggered by /sys/bus/pci/rescan. The rescan locks pci_rescan_remove_lock and probes PCI devices. When PCI devices call p2sb_bar() during probe, it locks pci_rescan_remove_lock again. Hence the deadlock. To avoid the deadlock, do not lock pci_rescan_remove_lock in p2sb_bar(). Instead, do the lock at fs_initcall. Introduce p2sb_cache_resources() for fs_initcall which gets and caches the P2SB resources. At p2sb_bar(), refer the cache and return to the caller. Suggested-by: Andy Shevchenko Fixes: 9745fb07474f ("platform/x86/intel: Add Primary to Sideband (P2SB) bridge support") Cc: stable@vger.kernel.org Signed-off-by: Shin'ichiro Kawasaki Reviewed-by: Andy Shevchenko Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/linux-pci/6xb24fjmptxxn5js2fjrrddjae6twex5bjaftwqsuawuqqqydx@7cl3uik5ef6j/ Link: https://lore.kernel.org/r/20231229063912.2517922-2-shinichiro.kawasaki@wdc.com Signed-off-by: Ilpo Järvinen drivers/platform/x86/p2sb.c | 172 +++++++++++++++++++++++++++++++++----------- 1 file changed, 131 insertions(+), 41 deletions(-) commit 8735c7c84d1bc5c3e481c02b6b6163bdefe4132f Merge: 505e701c0b2c d10c77873ba1 Author: Linus Torvalds Date: Thu Dec 28 16:12:23 2023 -0800 Merge tag '6.7rc7-smb3-srv-fix' of git://git.samba.org/ksmbd Pull ksmbd server fix from Steve French: - address possible slab out of bounds in parsing of open requests * tag '6.7rc7-smb3-srv-fix' of git://git.samba.org/ksmbd: ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() commit 505e701c0b2cfa9e34811020829759b7663a604c Merge: eeec2599630a 753547de0dae Author: Linus Torvalds Date: Thu Dec 28 12:09:53 2023 -0800 Merge tag 'kbuild-fixes-v6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Revive proper alignment for the ksymtab and kcrctab sections - Fix gen_compile_commands.py tool to resolve symbolic links - Fix symbolic links to installed debug VDSO files - Update MAINTAINERS * tag 'kbuild-fixes-v6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: linux/export: Ensure natural alignment of kcrctab array kbuild: fix build ID symlinks to installed debug VDSO files gen_compile_commands.py: fix path resolve with symlinks in it MAINTAINERS: Add scripts/clang-tools to Kbuild section linux/export: Fix alignment for 64-bit ksymtab entries commit eeec2599630ac1ac03db98f3ba976975c72a1427 Merge: f5837722ffec 7b474c77dadd Author: Linus Torvalds Date: Thu Dec 28 11:55:20 2023 -0800 Merge tag 'bcachefs-2023-12-27' of https://evilpiepirate.org/git/bcachefs Pull bcachefs fixes from Kent Overstreet: "Just a few fixes: besides a few one liners, we have a fix for snapshots + compression where the extent update path didn't account for the fact that with snapshots, we might split an existing extent into three, not just two; and a small fixup for promotes which were broken by the recent changes in the data update path to correctly take into account device durability" * tag 'bcachefs-2023-12-27' of https://evilpiepirate.org/git/bcachefs: bcachefs: Fix promotes bcachefs: Fix leakage of internal error code bcachefs: Fix insufficient disk reservation with compression + snapshots bcachefs: fix BCH_FSCK_ERR enum commit 753547de0daecbdbd1af3618987ddade325d9aaa Author: Helge Deller Date: Thu Dec 28 11:36:03 2023 +0100 linux/export: Ensure natural alignment of kcrctab array The ___kcrctab section holds an array of 32-bit CRC values. Add a .balign 4 to tell the linker the correct memory alignment. Fixes: f3304ecd7f06 ("linux/export: use inline assembler to populate symbol CRCs") Signed-off-by: Helge Deller Signed-off-by: Masahiro Yamada include/linux/export-internal.h | 1 + 1 file changed, 1 insertion(+) commit d10c77873ba1e9e6b91905018e29e196fd5f863d Author: Namjae Jeon Date: Wed Dec 20 15:52:11 2023 +0900 ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() If ->NameOffset/Length is bigger than ->CreateContextsOffset/Length, ksmbd_check_message doesn't validate request buffer it correctly. So slab-out-of-bounds warning from calling smb_strndup_from_utf16() in smb2_open() could happen. If ->NameLength is non-zero, Set the larger of the two sums (Name and CreateContext size) as the offset and length of the data area. Reported-by: Yang Chaoming Cc: stable@vger.kernel.org Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2misc.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) commit f5837722ffecbbedf1b1dbab072a063565f0dad1 Merge: 1997b3cb4217 1803d0c5ee1a Author: Linus Torvalds Date: Wed Dec 27 16:14:41 2023 -0800 Merge tag 'mm-hotfixes-stable-2023-12-27-15-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "11 hotfixes. 7 are cc:stable and the other 4 address post-6.6 issues or are not considered backporting material" * tag 'mm-hotfixes-stable-2023-12-27-15-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mailmap: add an old address for Naoya Horiguchi mm/memory-failure: cast index to loff_t before shifting it mm/memory-failure: check the mapcount of the precise page mm/memory-failure: pass the folio and the page to collect_procs() selftests: secretmem: floor the memory size to the multiple of page_size mm: migrate high-order folios in swap cache correctly maple_tree: do not preallocate nodes for slot stores mm/filemap: avoid buffered read/write race to read inconsistent data kunit: kasan_test: disable fortify string checker on kmalloc_oob_memset kexec: select CRYPTO from KEXEC_FILE instead of depending on it kexec: fix KEXEC_FILE dependencies commit ad5575eb6278892aa25a5d249c5009860d6d8bbc Author: Andy Shevchenko Date: Fri Dec 22 16:11:17 2023 +0200 MAINTAINERS: Add a missing file to the INTEL GPIO section When gpio-tangier was split the new born headers had been missed in the MAINTAINERS. Add it there. Fixes: d2c19e89e03c ("gpio: tangier: Introduce Intel Tangier GPIO driver") Signed-off-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit d4c139ca7cfeea490e5b8e9a7d4247aa706fd30a Author: Andy Shevchenko Date: Fri Dec 22 16:00:17 2023 +0200 MAINTAINERS: Remove Andy from GPIO maintainers Too many things are going on, and reviewing GPIO related code seems not the best I can do, hence I step down as a reviewer of the GPIO subsystem. Signed-off-by: Andy Shevchenko Acked-by: Linus Walleij Signed-off-by: Bartosz Golaszewski MAINTAINERS | 1 - 1 file changed, 1 deletion(-) commit 7cf4e6831502f992faa6d1253c09728065884c1f Author: Bartosz Golaszewski Date: Fri Dec 22 15:19:52 2023 +0100 MAINTAINERS: split out the uAPI into a new section Kent Gibson is the author of the character device uAPI v2 and should be Cc'ed on all patches aimed for it. Unfortunately this is not the case as he's not listed in MAINTAINERS. Split the uAPI files into their own section and make Kent the reviewer. Signed-off-by: Bartosz Golaszewski Acked-by: Andy Shevchenko Reviewed-by: Linus Walleij MAINTAINERS | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit 7b474c77daddaf89bbb72594737538f4e0dce2fd Author: Kent Overstreet Date: Sat Dec 23 23:29:05 2023 -0500 bcachefs: Fix promotes The recent work to fix data moves w.r.t. durability broke promotes, because the caused us to bail out when the extent minus pointers being dropped still has enough pointers to satisfy the current number of replicas. Disable this check when we're adding cached replicas. Signed-off-by: Kent Overstreet fs/bcachefs/data_update.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 1997b3cb4217b09e49659b634c94da47f0340409 Author: Edward Adam Davis Date: Sun Dec 24 00:02:49 2023 +0000 keys, dns: Fix missing size check of V1 server-list header The dns_resolver_preparse() function has a check on the size of the payload for the basic header of the binary-style payload, but is missing a check for the size of the V1 server-list payload header after determining that's what we've been given. Fix this by getting rid of the the pointer to the basic header and just assuming that we have a V1 server-list payload and moving the V1 server list pointer inside the if-statement. Dealing with other types and versions can be left for when such have been defined. This can be tested by doing the following with KASAN enabled: echo -n -e '\x0\x0\x1\x2' | keyctl padd dns_resolver foo @p and produces an oops like the following: BUG: KASAN: slab-out-of-bounds in dns_resolver_preparse+0xc9f/0xd60 net/dns_resolver/dns_key.c:127 Read of size 1 at addr ffff888028894084 by task syz-executor265/5069 ... Call Trace: dns_resolver_preparse+0xc9f/0xd60 net/dns_resolver/dns_key.c:127 __key_create_or_update+0x453/0xdf0 security/keys/key.c:842 key_create_or_update+0x42/0x50 security/keys/key.c:1007 __do_sys_add_key+0x29c/0x450 security/keys/keyctl.c:134 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x62/0x6a This patch was originally by Edward Adam Davis, but was modified by Linus. Fixes: b946001d3bb1 ("keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry") Reported-and-tested-by: syzbot+94bbb75204a05da3d89f@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/0000000000009b39bc060c73e209@google.com/ Suggested-by: Linus Torvalds Signed-off-by: Edward Adam Davis Signed-off-by: David Howells Tested-by: David Howells Cc: Edward Adam Davis Cc: Jarkko Sakkinen Cc: Jeffrey E Altman Cc: Wang Lei Cc: Jeff Layton Cc: Steve French Cc: Marc Dionne Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Reviewed-by: Simon Horman Signed-off-by: Linus Torvalds net/dns_resolver/dns_key.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) commit 02d374f3418df577c850f0cd45c3da9245ead547 Author: Christoph Hellwig Date: Tue Dec 26 08:15:24 2023 +0000 block: renumber QUEUE_FLAG_HW_WC For the QUEUE_FLAG_HW_WC to actually work, it needs to have a separate number from QUEUE_FLAG_FUA, doh. Fixes: 43c9835b144c ("block: don't allow enabling a cache on devices that don't support it") Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20231226081524.180289-1-hch@lst.de Signed-off-by: Jens Axboe include/linux/blkdev.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fbafc3e621c3f4ded43720fdb1d6ce1728ec664e Merge: 861deac3b092 b8e079244992 Author: Linus Torvalds Date: Mon Dec 25 13:50:46 2023 -0800 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "A couple of bugfixes: one for a regression" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio_blk: fix snprintf truncation compiler warning virtio_ring: fix syncs DMA memory with different direction commit 146e843f6b09271233c021b1677e561b7dc16303 Author: Coly Li Date: Sun Dec 24 08:28:20 2023 +0800 badblocks: avoid checking invalid range in badblocks_check() If prev_badblocks() returns '-1', it means no valid badblocks record before the checking range. It doesn't make sense to check whether the input checking range is overlapped with the non-existed invalid front range. This patch checkes whether 'prev >= 0' is true before calling overlap_front(), to void such invalid operations. Fixes: 3ea3354cb9f0 ("badblocks: improve badblocks_check() for multiple ranges handling") Reported-and-tested-by: Ira Weiny Signed-off-by: Coly Li Link: https://lore.kernel.org/nvdimm/3035e75a-9be0-4bc3-8d4a-6e52c207f277@leemhuis.info/ Cc: Dan Williams Cc: Geliang Tang Cc: Hannes Reinecke Cc: Jens Axboe Cc: NeilBrown Cc: Vishal L Verma Cc: Xiao Ni Link: https://lore.kernel.org/r/20231224002820.20234-1-colyli@suse.de Signed-off-by: Jens Axboe block/badblocks.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 861deac3b092f37b2c5e6871732f3e11486f7082 Author: Linus Torvalds Date: Sat Dec 23 16:25:56 2023 -0800 Linux 6.7-rc7 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3f82f1c3a03694800a4104ca6b6d3282bd4e213d Merge: f969c91482e1 d5a10b976ecb Author: Linus Torvalds Date: Sat Dec 23 12:13:28 2023 -0800 Merge tag 'x86-urgent-2023-12-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Fix a secondary CPUs enumeration regression caused by creative MADT APIC table entries on certain systems. - Fix a race in the NOP-patcher that can spuriously trigger crashes on bootup. - Fix a bootup failure regression caused by the parallel bringup code, caused by firmware inconsistency between the APIC initialization states of the boot and secondary CPUs, on certain systems. * tag 'x86-urgent-2023-12-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/acpi: Handle bogus MADT APIC tables gracefully x86/alternatives: Disable interrupts and sync when optimizing NOPs in place x86/alternatives: Sync core before enabling interrupts x86/smpboot/64: Handle X2APIC BIOS inconsistency gracefully commit f969c91482e1dedbb35aee4e7d32d13ed17f9e13 Merge: 4b2ee6d2b33d 04c116e2bdfc Author: Linus Torvalds Date: Sat Dec 23 11:58:53 2023 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Four small fixes, three in drivers with the core one adding a batch indicator (for drivers which use it) to the error handler" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Let the sq_lock protect sq_tail_slot access scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in ufs_qcom_clk_scale_notify() scsi: core: Always send batch on reset or error handling command scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() commit 4b2ee6d2b33d56e36da552a26e817eeed637e76e Merge: a0652eb205b7 ab241a0ab5ab Author: Linus Torvalds Date: Sat Dec 23 11:48:05 2023 -0800 Merge tag 'usb-6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt fixes from Greg KH: "Here are some small bugfixes and new device ids for USB and Thunderbolt drivers for 6.7-rc7. Included in here are: - new usb-serial device ids - thunderbolt driver fixes - typec driver fix - usb-storage driver quirk added - fotg210 driver fix All of these have been in linux-next with no reported issues" * tag 'usb-6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: serial: option: add Quectel EG912Y module support USB: serial: ftdi_sio: update Actisense PIDs constant names usb: fotg210-hcd: delete an incorrect bounds test usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3 usb: typec: ucsi: fix gpio-based orientation detection net: usb: ax88179_178a: avoid failed operations when device is disconnected USB: serial: option: add Quectel RM500Q R13 firmware support USB: serial: option: add Foxconn T99W265 with new baseline thunderbolt: Fix minimum allocated USB 3.x and PCIe bandwidth thunderbolt: Fix memory leak in margining_port_remove() commit a0652eb205b7ac13429d63bcc42806115d393632 Merge: fa655abe42c6 159f5bdadcdd Author: Linus Torvalds Date: Sat Dec 23 11:29:12 2023 -0800 Merge tag 'char-misc-6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc driver fixes from Greg KH: "Here are a small number of various driver fixes for 6.7-rc7 that normally come through the char-misc tree, and one debugfs fix as well. Included in here are: - iio and hid sensor driver fixes for a number of small things - interconnect driver fixes - brcm_nvmem driver fixes - debugfs fix for previous fix - guard() definition in device.h so that many subsystems can start using it for 6.8-rc1 (requested by Dan Williams to make future merges easier) All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (21 commits) debugfs: initialize cancellations earlier Revert "iio: hid-sensor-als: Add light color temperature support" Revert "iio: hid-sensor-als: Add light chromaticity support" nvmem: brcm_nvram: store a copy of NVRAM content dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp driver core: Add a guard() definition for the device_lock() interconnect: qcom: icc-rpm: Fix peak rate calculation iio: adc: MCP3564: fix hardware identification logic iio: adc: MCP3564: fix calib_bias and calib_scale range checks iio: adc: meson: add separate config for axg SoC family iio: adc: imx93: add four channels for imx93 adc iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma() interconnect: qcom: sm8250: Enable sync_state iio: triggered-buffer: prevent possible freeing of wrong buffer iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw iio: imu: adis16475: use bit numbers in assign_bit() iio: imu: adis16475: add spi_device_id table iio: tmag5273: fix temperature offset interconnect: Treat xlate() returning NULL node as an error iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table ... commit fa655abe42c65e7e4ad52baf280dadfb571c110e Merge: 5254c0cbc92d ea3715941a9b Author: Linus Torvalds Date: Sat Dec 23 11:16:58 2023 -0800 Merge tag 'input-for-v6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - a quirk to AT keyboard driver to skip issuing "GET ID" command when 8042 is in translated mode and the device is a laptop/portable, because the "GET ID" command makes a bunch of recent laptops unhappy - a quirk to i8042 to disable multiplexed mode on Acer P459-G2-M which causes issues on resume - psmouse will activate native RMI4 protocol support for touchpad on ThinkPad L14 G1 - addition of Razer Wolverine V2 ID to xpad gamepad driver - mapping for airplane mode button in soc_button_array driver for TUXEDO laptops - improved error handling in ipaq-micro-keys driver - amimouse being prepared for platform remove callback returning void * tag 'input-for-v6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: soc_button_array - add mapping for airplane mode button Input: xpad - add Razer Wolverine V2 support Input: ipaq-micro-keys - add error handling for devm_kmemdup Input: amimouse - convert to platform remove callback returning void Input: i8042 - add nomux quirk for Acer P459-G2-M Input: atkbd - skip ATKBD_CMD_GETID in translated mode Input: psmouse - enable Synaptics InterTouch for ThinkPad L14 G1 commit c1a8627164dbe8b92958aea10c7c0848105a3d7f Author: Masahiro Yamada Date: Wed Dec 20 17:18:33 2023 +0900 kbuild: fix build ID symlinks to installed debug VDSO files Commit 56769ba4b297 ("kbuild: unify vdso_install rules") accidentally dropped the '.debug' suffix from the build ID symlinks. Fixes: 56769ba4b297 ("kbuild: unify vdso_install rules") Signed-off-by: Masahiro Yamada scripts/Makefile.vdsoinst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 880946158b01138c06e93e4aa4255ffbfe70e1c8 Author: Jialu Xu Date: Sun Dec 10 15:05:34 2023 +0800 gen_compile_commands.py: fix path resolve with symlinks in it When a path contains relative symbolic links, os.path.abspath() might not follow the symlinks and instead return the absolute path with just the relative paths resolved, resulting in an incorrect path. 1. Say "drivers/hdf/" has some symlinks: # ls -l drivers/hdf/ total 364 drwxrwxr-x 2 ... 4096 ... evdev lrwxrwxrwx 1 ... 44 ... framework -> ../../../../../../drivers/hdf_core/framework -rw-rw-r-- 1 ... 359010 ... hdf_macro_test.h lrwxrwxrwx 1 ... 55 ... inner_api -> ../../../../../../drivers/hdf_core/interfaces/inner_api lrwxrwxrwx 1 ... 53 ... khdf -> ../../../../../../drivers/hdf_core/adapter/khdf/linux -rw-r--r-- 1 ... 74 ... Makefile drwxrwxr-x 3 ... 4096 ... wifi 2. One .cmd file records that: # head -1 ./framework/core/manager/src/.devmgr_service.o.cmd cmd_drivers/hdf/khdf/manager/../../../../framework/core/manager/src/devmgr_service.o := ... \ /path/to/src/drivers/hdf/khdf/manager/../../../../framework/core/manager/src/devmgr_service.c 3. os.path.abspath returns "/path/to/src/framework/core/manager/src/devmgr_service.c", not correct: # ./scripts/clang-tools/gen_compile_commands.py INFO: Could not add line from ./framework/core/manager/src/.devmgr_service.o.cmd: File \ /path/to/src/framework/core/manager/src/devmgr_service.c not found Use os.path.realpath(), which resolves the symlinks and normalizes the paths correctly. # cat compile_commands.json ... { "command": ... "directory": ... "file": "/path/to/bla/drivers/hdf_core/framework/core/manager/src/devmgr_service.c" }, ... Also fix it in parse_arguments(). Signed-off-by: Jialu Xu Signed-off-by: Masahiro Yamada scripts/clang-tools/gen_compile_commands.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit c134abc9b8e1b9c77ee4ac8cf55da2a9240cc41d Author: Nathan Chancellor Date: Tue Dec 5 10:05:57 2023 -0700 MAINTAINERS: Add scripts/clang-tools to Kbuild section Masahiro has always applied scripts/clang-tools patches but it is not included in the Kbuild section, so neither he nor linux-kbuild get cc'd on patches that touch those files. Signed-off-by: Nathan Chancellor Acked-by: Nicolas Schier Signed-off-by: Masahiro Yamada MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit f6847807c22f6944c71c981b630b9fff30801e73 Author: Helge Deller Date: Wed Nov 22 23:18:11 2023 +0100 linux/export: Fix alignment for 64-bit ksymtab entries An alignment of 4 bytes is wrong for 64-bit platforms which don't define CONFIG_HAVE_ARCH_PREL32_RELOCATIONS (which then store 64-bit pointers). Fix their alignment to 8 bytes. Fixes: ddb5cdbafaaa ("kbuild: generate KSYMTAB entries by modpost") Signed-off-by: Helge Deller Signed-off-by: Masahiro Yamada include/linux/export-internal.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit ea3715941a9b7d816a1e9096ac0577900af2a69e Author: Christoffer Sandberg Date: Fri Dec 22 23:25:38 2023 -0800 Input: soc_button_array - add mapping for airplane mode button This add a mapping for the airplane mode button on the TUXEDO Pulse Gen3. While it is physically a key it behaves more like a switch, sending a key down on first press and a key up on 2nd press. Therefor the switch event is used here. Besides this behaviour it uses the HID usage-id 0xc6 (Wireless Radio Button) and not 0xc8 (Wireless Radio Slider Switch), but since neither 0xc6 nor 0xc8 are currently implemented at all in soc_button_array this not to standard behaviour is not put behind a quirk for the moment. Signed-off-by: Christoffer Sandberg Signed-off-by: Werner Sembach Link: https://lore.kernel.org/r/20231215171718.80229-1-wse@tuxedocomputers.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov drivers/input/misc/soc_button_array.c | 5 +++++ 1 file changed, 5 insertions(+) commit 5254c0cbc92d2a08e75443bdb914f1c4839cdf5a Merge: 867583b39919 13d822bf1cba Author: Linus Torvalds Date: Fri Dec 22 19:36:48 2023 -0800 Merge tag 'block-6.7-2023-12-22' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "Just an NVMe pull request this time, with a fix for bad sleeping context, and a revert of a patch that caused some trouble" * tag 'block-6.7-2023-12-22' of git://git.kernel.dk/linux: nvme-pci: fix sleeping function called from interrupt context Revert "nvme-fc: fix race between error recovery and creating association" commit 867583b3991929aeea3844874fba598243c54240 Merge: c0f65a7c112b ef5b28372c56 Author: Linus Torvalds Date: Fri Dec 22 19:22:20 2023 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "RISC-V: - Fix a race condition in updating external interrupt for trap-n-emulated IMSIC swfile - Fix print_reg defaults in get-reg-list selftest ARM: - Ensure a vCPU's redistributor is unregistered from the MMIO bus if vCPU creation fails - Fix building KVM selftests for arm64 from the top-level Makefile x86: - Fix breakage for SEV-ES guests that use XSAVES Selftests: - Fix bad use of strcat(), by not using strcat() at all" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: SEV: Do not intercept accesses to MSR_IA32_XSS for SEV-ES guests KVM: selftests: Fix dynamic generation of configuration names RISCV: KVM: update external interrupt atomically for IMSIC swfile KVM: riscv: selftests: Fix get-reg-list print_reg defaults KVM: selftests: Ensure sysreg-defs.h is generated at the expected path KVM: Convert comment into an assertion in kvm_io_bus_register_dev() KVM: arm64: vgic: Ensure that slots_lock is held in vgic_register_all_redist_iodevs() KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy() KVM: arm64: vgic: Simplify kvm_vgic_destroy() commit ef5b28372c565128bdce7a59bc78402a8ce68e1b Merge: 5c2b2176ead1 4ad9843e1ea0 Author: Paolo Bonzini Date: Fri Dec 22 18:05:07 2023 -0500 Merge tag 'kvm-riscv-fixes-6.7-1' of https://github.com/kvm-riscv/linux into kvm-master KVM/riscv fixes for 6.7, take #1 - Fix a race condition in updating external interrupt for trap-n-emulated IMSIC swfile - Fix print_reg defaults in get-reg-list selftest commit 5c2b2176ead1911d652b8848169bb44bdde75ca8 Merge: a26b7cd22546 0c12e6c8267f Author: Paolo Bonzini Date: Fri Dec 22 18:03:54 2023 -0500 Merge tag 'kvmarm-fixes-6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into kvm-master KVM/arm64 fixes for 6.7, part #2 - Ensure a vCPU's redistributor is unregistered from the MMIO bus if vCPU creation fails - Fix building KVM selftests for arm64 from the top-level Makefile commit c0f65a7c112b3cfa691cead54bcf24d6cc2182b5 Merge: 5414aea7b750 5c47251e8c49 Author: Linus Torvalds Date: Fri Dec 22 13:41:29 2023 -0800 Merge tag 'printk-for-6.8' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk fix from Petr Mladek: - Prevent refcount warning from code releasing a fwnode * tag 'printk-for-6.8' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: lib/vsprintf: Fix %pfwf when current node refcount == 0 commit 5414aea7b7508d01235ea0c95064ad66395c3239 Merge: 2618280dedb2 916d051730ae Author: Linus Torvalds Date: Fri Dec 22 08:46:44 2023 -0800 Merge tag 'sound-6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Apparently there were so many kids wishing bug fixes that made Santa busy; here we have lots of fixes although it's a bit late. But all changes are device-specific, hence it should be relatively safe to apply. Most of changes are for Cirrus codecs (for both ASoC and HD-audio), while the remaining are fixes for TI codecs, HD-audio and USB-audio quirks" * tag 'sound-6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (24 commits) ALSA: hda: cs35l41: Only add SPI CS GPIO if SPI is enabled in kernel ALSA: hda: cs35l41: Do not allow uninitialised variables to be freed ASoC: fsl_sai: Fix channel swap issue on i.MX8MP ASoC: hdmi-codec: fix missing report for jack initial status ALSA: hda/realtek: Add quirks for ASUS Zenbook 2023 Models ALSA: hda: cs35l41: Support additional ASUS Zenbook 2023 Models ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models ALSA: hda: cs35l41: Support additional ASUS Zenbook 2022 Models ALSA: hda/realtek: Add quirks for ASUS ROG 2023 models ALSA: hda: cs35l41: Support additional ASUS ROG 2023 models ALSA: hda: cs35l41: Add config table to support many laptops without _DSD ASoC: Intel: bytcr_rt5640: Add new swapped-speakers quirk ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346 kselftest: alsa: fixed a print formatting warning ALSA: usb-audio: Increase delay in MOTU M quirk ASoC: tas2781: check the validity of prm_no/cfg_no ALSA: hda/tas2781: select program 0, conf 0 by default ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA ASoC: cs42l43: Don't enable bias sense during type detect ASoC: Intel: soc-acpi-intel-mtl-match: Change CS35L56 prefixes to AMPn ... commit 2618280dedb2f3a35e51c158d31859276a8832b9 Merge: a9ca0330d222 b4cc1cbba519 Author: Linus Torvalds Date: Fri Dec 22 08:42:55 2023 -0800 Merge tag 'i2c-for-6.7-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - error path fixes (qcom-geni) - polling mode fix (rk3x) - target mode state machine fix (aspeed) * tag 'i2c-for-6.7-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: aspeed: Handle the coalesced stop conditions with the start conditions. i2c: rk3x: fix potential spinlock recursion on poll i2c: qcom-geni: fix missing clk_disable_unprepare() and geni_se_resources_off() commit a9ca0330d222ae6c32ba5519f5a2f04dc97b7d8b Merge: b7bc7bce88bd 1cc3542c76ac Author: Linus Torvalds Date: Fri Dec 22 08:41:04 2023 -0800 Merge tag 'gpio-fixes-for-v6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: "Here's another round of fixes from the GPIO subsystem for this release cycle. There's one commit adding synchronization to an ioctl() we overlooked previously and another synchronization changeset for one of the drivers: - add protection against GPIO device removal to an overlooked ioctl() - synchronize the interrupt mask register manually in gpio-dwapb" * tag 'gpio-fixes-for-v6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: dwapb: mask/unmask IRQ when disable/enale it gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl() commit b7bc7bce88bdf52ec2b47c576fb51269a521bd9a Merge: 8afe6f0e0e25 93cd05976498 Author: Linus Torvalds Date: Fri Dec 22 08:37:48 2023 -0800 Merge tag 'for-linus-6.7a-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fix from Juergen Gross: "A single patch fixing a build issue for x86 32-bit configurations with CONFIG_XEN, which was introduced in the 6.7 development cycle" * tag 'for-linus-6.7a-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: x86/xen: add CPU dependencies for 32-bit build commit 8afe6f0e0e257bf7f79f5996c037e8977dcc8cc1 Merge: 93a165cb9a4c d4b6e7f582e2 Author: Linus Torvalds Date: Fri Dec 22 07:59:25 2023 -0800 Merge tag 'drm-fixes-2023-12-22' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Pretty quiet for this week, just i915 and amdgpu fixes, I think the misc tree got lost this week, but didn't seem to have too much in it, so it can wait. I've also got a bunch of nouveau GSP fixes sailing around that'll probably land next time as well. amdgpu: - DCN 3.5 fixes - DCN 3.2 SubVP fix - GPUVM fix amdkfd: - SVM fix for APUs i915: - Fix state readout and check for DSC and bigjoiner combo - Fix a potential integer overflow - Reject async flips with bigjoiner - Fix MTL HDMI/DP PLL clock selection - Fix various issues by disabling pipe DMC events" * tag 'drm-fixes-2023-12-22' of git://anongit.freedesktop.org/drm/drm: drm/amdgpu: re-create idle bo's PTE during VM state machine reset drm/amd/display: dereference variable before checking for zero drm/amd/display: get dprefclk ss info from integration info table drm/amd/display: Add case for dcn35 to support usb4 dmub hpd event drm/amd/display: disable FPO and SubVP for older DMUB versions on DCN32x drm/amdkfd: svm range always mapped flag not working on APU drm/amd/display: Revert " drm/amd/display: Use channel_width = 2 for vram table 3.0" drm/i915/dmc: Don't enable any pipe DMC events drm/i915/mtl: Fix HDMI/DP PLL clock selection drm/i915: Reject async flips with bigjoiner drm/i915/hwmon: Fix static analysis tool reported issues drm/i915/display: Get bigjoiner config before dsc config during readout commit 93a165cb9a4c7bf517db07abdfafde742c7dc234 Merge: 24e0d2e527a3 ff49bf186757 Author: Linus Torvalds Date: Fri Dec 22 07:50:34 2023 -0800 Merge tag '9p-for-6.7-rc7' of https://github.com/martinetd/linux Pull 9p fixes from Dominique Martinet: "Two small fixes scheduled for stable trees: A tracepoint fix that's been reading past the end of messages forever, but semi-recently also went over the end of the buffer. And a potential incorrectly freeing garbage in pdu parsing error path" * tag '9p-for-6.7-rc7' of https://github.com/martinetd/linux: net: 9p: avoid freeing uninit memory in p9pdu_vreadf 9p: prevent read overrun in protocol dump tracepoint commit 7e8358edf503e87236c8d07f69ef0ed846dd5112 Author: Steven Rostedt (Google) Date: Thu Dec 21 19:07:57 2023 -0500 eventfs: Fix file and directory uid and gid ownership It was reported that when mounting the tracefs file system with a gid other than root, the ownership did not carry down to the eventfs directory due to the dynamic nature of it. A fix was done to solve this, but it had two issues. (a) if the attr passed into update_inode_attr() was NULL, it didn't do anything. This is true for files that have not had a chown or chgrp done to itself or any of its sibling files, as the attr is allocated for all children when any one needs it. # umount /sys/kernel/tracing # mount -o rw,seclabel,relatime,gid=1000 -t tracefs nodev /mnt # ls -ld /mnt/events/sched drwxr-xr-x 28 root rostedt 0 Dec 21 13:12 /mnt/events/sched/ # ls -ld /mnt/events/sched/sched_switch drwxr-xr-x 2 root rostedt 0 Dec 21 13:12 /mnt/events/sched/sched_switch/ But when checking the files: # ls -l /mnt/events/sched/sched_switch total 0 -rw-r----- 1 root root 0 Dec 21 13:12 enable -rw-r----- 1 root root 0 Dec 21 13:12 filter -r--r----- 1 root root 0 Dec 21 13:12 format -r--r----- 1 root root 0 Dec 21 13:12 hist -r--r----- 1 root root 0 Dec 21 13:12 id -rw-r----- 1 root root 0 Dec 21 13:12 trigger (b) When the attr does not denote the UID or GID, it defaulted to using the parent uid or gid. This is incorrect as changing the parent uid or gid will automatically change all its children. # chgrp tracing /mnt/events/timer # ls -ld /mnt/events/timer drwxr-xr-x 2 root tracing 0 Dec 21 14:34 /mnt/events/timer # ls -l /mnt/events/timer total 0 -rw-r----- 1 root root 0 Dec 21 14:35 enable -rw-r----- 1 root root 0 Dec 21 14:35 filter drwxr-xr-x 2 root tracing 0 Dec 21 14:35 hrtimer_cancel drwxr-xr-x 2 root tracing 0 Dec 21 14:35 hrtimer_expire_entry drwxr-xr-x 2 root tracing 0 Dec 21 14:35 hrtimer_expire_exit drwxr-xr-x 2 root tracing 0 Dec 21 14:35 hrtimer_init drwxr-xr-x 2 root tracing 0 Dec 21 14:35 hrtimer_start drwxr-xr-x 2 root tracing 0 Dec 21 14:35 itimer_expire drwxr-xr-x 2 root tracing 0 Dec 21 14:35 itimer_state drwxr-xr-x 2 root tracing 0 Dec 21 14:35 tick_stop drwxr-xr-x 2 root tracing 0 Dec 21 14:35 timer_cancel drwxr-xr-x 2 root tracing 0 Dec 21 14:35 timer_expire_entry drwxr-xr-x 2 root tracing 0 Dec 21 14:35 timer_expire_exit drwxr-xr-x 2 root tracing 0 Dec 21 14:35 timer_init drwxr-xr-x 2 root tracing 0 Dec 21 14:35 timer_start At first it was thought that this could be easily fixed by just making the default ownership of the superblock when it was mounted. But this does not handle the case of: # chgrp tracing instances # mkdir instances/foo If the superblock was used, then the group ownership would be that of what it was when it was mounted, when it should instead be "tracing". Instead, set a flag for the top level eventfs directory ("events") to flag which eventfs_inode belongs to it. Since the "events" directory's dentry and inode are never freed, it does not need to use its attr field to restore its mode and ownership. Use the this eventfs_inode's attr as the default ownership for all the files and directories underneath it. When the events eventfs_inode is created, it sets its ownership to its parent uid and gid. As the events directory is created at boot up before it gets mounted, this will always be uid=0 and gid=0. If it's created via an instance, then it will take the ownership of the instance directory. When the file system is mounted, it will update all the gids if one is specified. This will have a callback to update the events evenfs_inode's default entries. When a file or directory is created under the events directory, it will walk the ei->dentry parents until it finds the evenfs_inode that belongs to the events directory to retrieve the default uid and gid values. Link: https://lore.kernel.org/all/CAHk-=wiwQtUHvzwyZucDq8=Gtw+AnwScyLhpFswrQ84PjhoGsg@mail.gmail.com/ Link: https://lore.kernel.org/linux-trace-kernel/20231221190757.7eddbca9@gandalf.local.home Cc: stable@vger.kernel.org Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Dongliang Cui Cc: Hongyu Jin Fixes: 0dfc852b6fe3 ("eventfs: Have event files and directories default to parent uid and gid") Reviewed-by: Masami Hiramatsu (Google) Tested-by: Masami Hiramatsu (Google) Reported-by: Linus Torvalds Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 105 ++++++++++++++++++++++++++++++++++++++++++----- fs/tracefs/inode.c | 6 +++ fs/tracefs/internal.h | 2 + 3 files changed, 103 insertions(+), 10 deletions(-) commit ab241a0ab5abd70036c3d959146e534a02447d17 Merge: 7fbcd195e2b8 6d79d9434c69 Author: Greg Kroah-Hartman Date: Fri Dec 22 09:59:30 2023 +0100 Merge tag 'usb-serial-6.7-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial device ids for 6.7-rc6 Here are some new modem device ids and a rename of a few ftdi product id defines. All have been in linux-next with no reported issues. * tag 'usb-serial-6.7-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add Quectel EG912Y module support USB: serial: ftdi_sio: update Actisense PIDs constant names USB: serial: option: add Quectel RM500Q R13 firmware support USB: serial: option: add Foxconn T99W265 with new baseline commit 159f5bdadcdda638aad5a234b58d6031aa4ef8aa Author: Johannes Berg Date: Thu Dec 21 15:04:45 2023 +0100 debugfs: initialize cancellations earlier Tetsuo Handa pointed out that in the (now reverted) lockdep commit I initialized the data too late. The same is true for the cancellation data, it must be initialized before the cmpxchg(), otherwise it may be done twice and possibly even overwriting data in there already when there's a race. Fix that, which also requires destroying the mutex in case we lost the race. Fixes: 8c88a474357e ("debugfs: add API to allow debugfs operations cancellation") Reported-by: Tetsuo Handa Signed-off-by: Johannes Berg Link: https://lore.kernel.org/r/20231221150444.1e47a0377f80.If7e8ba721ba2956f12c6e8405e7d61e154aa7ae7@changeid Signed-off-by: Greg Kroah-Hartman fs/debugfs/file.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit c8296d730f19b3916c11aa7b8c47a2b3e5a7ca9c Author: Kent Overstreet Date: Thu Dec 21 23:17:00 2023 -0500 bcachefs: Fix leakage of internal error code Signed-off-by: Kent Overstreet fs/bcachefs/journal_io.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 01db5e5f2f6e01cbea01872850223e58075baf63 Author: Kent Overstreet Date: Thu Dec 21 21:05:07 2023 -0500 bcachefs: Fix insufficient disk reservation with compression + snapshots When overwriting and splitting existing extents, we weren't correctly accounting for a 3 way split of a compressed extent. Signed-off-by: Kent Overstreet fs/bcachefs/btree_update.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) commit d4b6e7f582e29acac17bcaf7f7771138d72f89d2 Merge: b7ef7caff63a 49e0a85ec344 Author: Dave Airlie Date: Fri Dec 22 13:11:08 2023 +1000 Merge tag 'drm-intel-fixes-2023-12-21' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v6.7-rc7: - Fix state readout and check for DSC and bigjoiner combo - Fix a potential integer overflow - Reject async flips with bigjoiner - Fix MTL HDMI/DP PLL clock selection - Fix various issues by disabling pipe DMC events Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87plyzsnxi.fsf@intel.com commit b7ef7caff63a55d3a1b77fce80fcbd22d93bbc51 Merge: ceb6a6f023fd 4a0057afa358 Author: Dave Airlie Date: Fri Dec 22 11:19:26 2023 +1000 Merge tag 'amd-drm-fixes-6.7-2023-12-20' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.7-2023-12-20: amdgpu: - DCN 3.5 fixes - DCN 3.2 SubVP fix - GPUVM fix amdkfd: - SVM fix for APUs Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20231220164845.4975-1-alexander.deucher@amd.com commit 24e0d2e527a39f64caeb2e6be39ad5396fb2da5e Merge: 9a6b294ab496 14694179e561 Author: Linus Torvalds Date: Thu Dec 21 16:19:27 2023 -0800 Merge tag 'pinctrl-v6.7-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Some driver fixes for v6.7, all are in drivers, the most interesting one is probably the AMD laptop suspend bug which really needs fixing. Freedestop org has the bug description: https://gitlab.freedesktop.org/drm/amd/-/issues/2812 Summary: - Ignore disabled device tree nodes in the Starfive 7100 and 7100 drivers. - Mask non-wake source pins with interrupt enabled at suspend in the AMD driver, this blocks unnecessary wakeups from misc interrupts. This can be power consuming because in many cases the system doesn't really suspend, it just wakes right back up. - Fix a typo breaking compilation of the cy8c95x0 driver, and fix up bugs in the get/set config callbacks. - Use a dedicated lock class for the PIO4 drivers IRQ. This fixes a crash on suspend" * tag 'pinctrl-v6.7-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: at91-pio4: use dedicated lock class for IRQ pinctrl: cy8c95x0: Fix get_pincfg pinctrl: cy8c95x0: Fix regression pinctrl: cy8c95x0: Fix typo pinctrl: amd: Mask non-wake source pins with interrupt enabled at suspend pinctrl: starfive: jh7100: ignore disabled device tree nodes pinctrl: starfive: jh7110: ignore disabled device tree nodes commit 13d822bf1cba78612b22a65b91cd6d4d443b6254 Merge: c6d3ab9e76dc f6fe0b2d3545 Author: Jens Axboe Date: Thu Dec 21 14:32:35 2023 -0700 Merge tag 'nvme-6.7-2023-12-21' of git://git.infradead.org/nvme into block-6.7 Pull NVMe fixes from Keith: "nvme fixes for Linux 6.7 - Revert a commit with improper sleep context (Keith) - Fix async event handling sleep context (Maurizio)" * tag 'nvme-6.7-2023-12-21' of git://git.infradead.org/nvme: nvme-pci: fix sleeping function called from interrupt context Revert "nvme-fc: fix race between error recovery and creating association" commit 9a6b294ab496650e9f270123730df37030911b55 Author: David Howells Date: Thu Dec 21 13:57:31 2023 +0000 afs: Fix use-after-free due to get/remove race in volume tree When an afs_volume struct is put, its refcount is reduced to 0 before the cell->volume_lock is taken and the volume removed from the cell->volumes tree. Unfortunately, this means that the lookup code can race and see a volume with a zero ref in the tree, resulting in a use-after-free: refcount_t: addition on 0; use-after-free. WARNING: CPU: 3 PID: 130782 at lib/refcount.c:25 refcount_warn_saturate+0x7a/0xda ... RIP: 0010:refcount_warn_saturate+0x7a/0xda ... Call Trace: afs_get_volume+0x3d/0x55 afs_create_volume+0x126/0x1de afs_validate_fc+0xfe/0x130 afs_get_tree+0x20/0x2e5 vfs_get_tree+0x1d/0xc9 do_new_mount+0x13b/0x22e do_mount+0x5d/0x8a __do_sys_mount+0x100/0x12a do_syscall_64+0x3a/0x94 entry_SYSCALL_64_after_hwframe+0x62/0x6a Fix this by: (1) When putting, use a flag to indicate if the volume has been removed from the tree and skip the rb_erase if it has. (2) When looking up, use a conditional ref increment and if it fails because the refcount is 0, replace the node in the tree and set the removal flag. Fixes: 20325960f875 ("afs: Reorganise volume and server trees to be rooted on the cell") Signed-off-by: David Howells Reviewed-by: Jeffrey Altman cc: Marc Dionne cc: linux-afs@lists.infradead.org Signed-off-by: Linus Torvalds fs/afs/internal.h | 2 ++ fs/afs/volume.c | 26 +++++++++++++++++++++++--- 2 files changed, 25 insertions(+), 3 deletions(-) commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a Author: Matthew Wilcox (Oracle) Date: Thu Dec 21 16:53:57 2023 +0000 ida: Fix crash in ida_free when the bitmap is empty The IDA usually detects double-frees, but that detection failed to consider the case when there are no nearby IDs allocated and so we have a NULL bitmap rather than simply having a clear bit. Add some tests to the test-suite to be sure we don't inadvertently reintroduce this problem. Unfortunately they're quite noisy so include a message to disregard the warnings. Reported-by: Zhenghan Wang Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Linus Torvalds lib/idr.c | 2 +- lib/test_ida.c | 40 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 1 deletion(-) commit a9e01ac8c5ff32669119c40dfdc9e80eb0b7d7aa Author: David Howells Date: Thu Dec 21 15:09:31 2023 +0000 afs: Fix overwriting of result of DNS query In afs_update_cell(), ret is the result of the DNS lookup and the errors are to be handled by a switch - however, the value gets clobbered in between by setting it to -ENOMEM in case afs_alloc_vlserver_list() fails. Fix this by moving the setting of -ENOMEM into the error handling for OOM failure. Further, only do it if we don't have an alternative error to return. Found by Linux Verification Center (linuxtesting.org) with SVACE. Based on a patch from Anastasia Belova [1]. Fixes: d5c32c89b208 ("afs: Fix cell DNS lookup") Signed-off-by: David Howells Reviewed-by: Jeffrey Altman cc: Anastasia Belova cc: Marc Dionne cc: linux-afs@lists.infradead.org cc: lvc-project@linuxtesting.org Link: https://lore.kernel.org/r/20231221085849.1463-1-abelova@astralinux.ru/ [1] Link: https://lore.kernel.org/r/1700862.1703168632@warthog.procyon.org.uk/ # v1 Signed-off-by: Linus Torvalds fs/afs/cell.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 937fd403380023d065fd0509caa7eff639b144a0 Merge: 13b734465a9d 39299bdd2546 Author: Linus Torvalds Date: Thu Dec 21 09:53:25 2023 -0800 Merge tag 'afs-fixes-20231221' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull AFS fixes from David Howells: "Improve the interaction of arbitrary lookups in the AFS dynamic root that hit DNS lookup failures [1] where kafs behaves differently from openafs and causes some applications to fail that aren't expecting that. Further, negative DNS results aren't getting removed and are causing failures to persist. - Always delete unused (particularly negative) dentries as soon as possible so that they don't prevent future lookups from retrying. - Fix the handling of new-style negative DNS lookups in ->lookup() to make them return ENOENT so that userspace doesn't get confused when stat succeeds but the following open on the looked up file then fails. - Fix key handling so that DNS lookup results are reclaimed almost as soon as they expire rather than sitting round either forever or for an additional 5 mins beyond a set expiry time returning EKEYEXPIRED. They persist for 1s as /bin/ls will do a second stat call if the first fails" Link: https://bugzilla.kernel.org/show_bug.cgi?id=216637 [1] Reviewed-by: Jeffrey Altman * tag 'afs-fixes-20231221' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry afs: Fix dynamic root lookup DNS check afs: Fix the dynamic root's d_delete to always delete unused dentries commit 13b734465a9d1cd09551d52eb5faf5fe55e6a9ea Merge: 7c5e046bdcb2 88b30c7f5d27 Author: Linus Torvalds Date: Thu Dec 21 09:31:45 2023 -0800 Merge tag 'trace-v6.7-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix another kerneldoc warning - Fix eventfs files to inherit the ownership of its parent directory. The dynamic creation of dentries in eventfs did not take into account if the tracefs file system was mounted with a gid/uid, and would still default to the gid/uid of root. This is a regression. - Fix warning when synthetic event testing is enabled along with startup event tracing testing is enabled * tag 'trace-v6.7-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing / synthetic: Disable events after testing in synth_event_gen_test_init() eventfs: Have event files and directories default to parent uid and gid tracing/synthetic: fix kernel-doc warnings commit 7c5e046bdcb2513f9decb3765d8bf92d604279cf Merge: a4aebe936554 74769d810ead Author: Linus Torvalds Date: Thu Dec 21 09:15:37 2023 -0800 Merge tag 'net-6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from WiFi and bpf. Current release - regressions: - bpf: syzkaller found null ptr deref in unix_bpf proto add - eth: i40e: fix ST code value for clause 45 Previous releases - regressions: - core: return error from sk_stream_wait_connect() if sk_wait_event() fails - ipv6: revert remove expired routes with a separated list of routes - wifi rfkill: - set GPIO direction - fix crash with WED rx support enabled - bluetooth: - fix deadlock in vhci_send_frame - fix use-after-free in bt_sock_recvmsg - eth: mlx5e: fix a race in command alloc flow - eth: ice: fix PF with enabled XDP going no-carrier after reset - eth: bnxt_en: do not map packet buffers twice Previous releases - always broken: - core: - check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() - check dev->gso_max_size in gso_features_check() - mptcp: fix inconsistent state on fastopen race - phy: skip LED triggers on PHYs on SFP modules - eth: mlx5e: - fix double free of encap_header - fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list()" * tag 'net-6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (69 commits) net: check dev->gso_max_size in gso_features_check() kselftest: rtnetlink.sh: use grep_fail when expecting the cmd fail net/ipv6: Revert remove expired routes with a separated list of routes net: avoid build bug in skb extension length calculation net: ethernet: mtk_wed: fix possible NULL pointer dereference in mtk_wed_wo_queue_tx_clean() net: stmmac: fix incorrect flag check in timestamp interrupt selftests: add vlan hw filter tests net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() net: hns3: add new maintainer for the HNS3 ethernet driver net: mana: select PAGE_POOL net: ks8851: Fix TX stall caused by TX buffer overrun ice: Fix PF with enabled XDP going no-carrier after reset ice: alter feature support check for SRIOV and LAG ice: stop trashing VF VSI aggregator node ID information mailmap: add entries for Geliang Tang mptcp: fill in missing MODULE_DESCRIPTION() mptcp: fix inconsistent state on fastopen race selftests: mptcp: join: fix subflow_send_ack lookup net: phy: skip LED triggers on PHYs on SFP modules bpf: Add missing BPF_LINK_TYPE invocations ... commit 6d79d9434c69bb8ffa8a631050eb0ad6b83d3e90 Author: Alper Ak Date: Tue Aug 8 13:51:58 2023 +0300 USB: serial: option: add Quectel EG912Y module support Add Quectel EG912Y "DIAG, AT, MODEM" 0x6001: ECM / RNDIS + DIAG + AT + MODEM T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=6001 Rev= 3.18 S: Manufacturer=Android S: Product=Android S: SerialNumber=0000 C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Alper Ak Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+) commit 88b30c7f5d27e1594d70dc2bd7199b18f2b57fa9 Author: Steven Rostedt (Google) Date: Wed Dec 20 11:15:25 2023 -0500 tracing / synthetic: Disable events after testing in synth_event_gen_test_init() The synth_event_gen_test module can be built in, if someone wants to run the tests at boot up and not have to load them. The synth_event_gen_test_init() function creates and enables the synthetic events and runs its tests. The synth_event_gen_test_exit() disables the events it created and destroys the events. If the module is builtin, the events are never disabled. The issue is, the events should be disable after the tests are run. This could be an issue if the rest of the boot up tests are enabled, as they expect the events to be in a known state before testing. That known state happens to be disabled. When CONFIG_SYNTH_EVENT_GEN_TEST=y and CONFIG_EVENT_TRACE_STARTUP_TEST=y a warning will trigger: Running tests on trace events: Testing event create_synth_test: Enabled event during self test! ------------[ cut here ]------------ WARNING: CPU: 2 PID: 1 at kernel/trace/trace_events.c:4150 event_trace_self_tests+0x1c2/0x480 Modules linked in: CPU: 2 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc2-test-00031-gb803d7c664d5-dirty #276 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:event_trace_self_tests+0x1c2/0x480 Code: bb e8 a2 ab 5d fc 48 8d 7b 48 e8 f9 3d 99 fc 48 8b 73 48 40 f6 c6 01 0f 84 d6 fe ff ff 48 c7 c7 20 b6 ad bb e8 7f ab 5d fc 90 <0f> 0b 90 48 89 df e8 d3 3d 99 fc 48 8b 1b 4c 39 f3 0f 85 2c ff ff RSP: 0000:ffffc9000001fdc0 EFLAGS: 00010246 RAX: 0000000000000029 RBX: ffff88810399ca80 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffffb9f19478 RDI: ffff88823c734e64 RBP: ffff88810399f300 R08: 0000000000000000 R09: fffffbfff79eb32a R10: ffffffffbcf59957 R11: 0000000000000001 R12: ffff888104068090 R13: ffffffffbc89f0a0 R14: ffffffffbc8a0f08 R15: 0000000000000078 FS: 0000000000000000(0000) GS:ffff88823c700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001f6282001 CR4: 0000000000170ef0 Call Trace: ? __warn+0xa5/0x200 ? event_trace_self_tests+0x1c2/0x480 ? report_bug+0x1f6/0x220 ? handle_bug+0x6f/0x90 ? exc_invalid_op+0x17/0x50 ? asm_exc_invalid_op+0x1a/0x20 ? tracer_preempt_on+0x78/0x1c0 ? event_trace_self_tests+0x1c2/0x480 ? __pfx_event_trace_self_tests_init+0x10/0x10 event_trace_self_tests_init+0x27/0xe0 do_one_initcall+0xd6/0x3c0 ? __pfx_do_one_initcall+0x10/0x10 ? kasan_set_track+0x25/0x30 ? rcu_is_watching+0x38/0x60 kernel_init_freeable+0x324/0x450 ? __pfx_kernel_init+0x10/0x10 kernel_init+0x1f/0x1e0 ? _raw_spin_unlock_irq+0x33/0x50 ret_from_fork+0x34/0x60 ? __pfx_kernel_init+0x10/0x10 ret_from_fork_asm+0x1b/0x30 This is because the synth_event_gen_test_init() left the synthetic events that it created enabled. By having it disable them after testing, the other selftests will run fine. Link: https://lore.kernel.org/linux-trace-kernel/20231220111525.2f0f49b0@gandalf.local.home Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Cc: Tom Zanussi Fixes: 9fe41efaca084 ("tracing: Add synth event generation test module") Acked-by: Masami Hiramatsu (Google) Reported-by: Alexander Graf Tested-by: Alexander Graf Signed-off-by: Steven Rostedt (Google) kernel/trace/synth_event_gen_test.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 0dfc852b6fe3cbecbea67332a0dce2bebeba540d Author: Steven Rostedt (Google) Date: Wed Dec 20 10:50:17 2023 -0500 eventfs: Have event files and directories default to parent uid and gid Dongliang reported: I found that in the latest version, the nodes of tracefs have been changed to dynamically created. This has caused me to encounter a problem where the gid I specified in the mounting parameters cannot apply to all files, as in the following situation: /data/tmp/events # mount | grep tracefs tracefs on /data/tmp type tracefs (rw,seclabel,relatime,gid=3012) gid 3012 = readtracefs /data/tmp # ls -lh total 0 -r--r----- 1 root readtracefs 0 1970-01-01 08:00 README -r--r----- 1 root readtracefs 0 1970-01-01 08:00 available_events ums9621_1h10:/data/tmp/events # ls -lh total 0 drwxr-xr-x 2 root root 0 2023-12-19 00:56 alarmtimer drwxr-xr-x 2 root root 0 2023-12-19 00:56 asoc It will prevent certain applications from accessing tracefs properly, I try to avoid this issue by making the following modifications. To fix this, have the files created default to taking the ownership of the parent dentry unless the ownership was previously set by the user. Link: https://lore.kernel.org/linux-trace-kernel/1703063706-30539-1-git-send-email-dongliang.cui@unisoc.com/ Link: https://lore.kernel.org/linux-trace-kernel/20231220105017.1489d790@gandalf.local.home Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Cc: Hongyu Jin Fixes: 28e12c09f5aa0 ("eventfs: Save ownership and mode") Acked-by: Masami Hiramatsu (Google) Reported-by: Dongliang Cui Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit 39299bdd2546688d92ed9db4948f6219ca1b9542 Author: David Howells Date: Sat Dec 9 00:41:55 2023 +0000 keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry If a key has an expiration time, then when that time passes, the key is left around for a certain amount of time before being collected (5 mins by default) so that EKEYEXPIRED can be returned instead of ENOKEY. This is a problem for DNS keys because we want to redo the DNS lookup immediately at that point. Fix this by allowing key types to be marked such that keys of that type don't have this extra period, but are reclaimed as soon as they expire and turn this on for dns_resolver-type keys. To make this easier to handle, key->expiry is changed to be permanent if TIME64_MAX rather than 0. Furthermore, give such new-style negative DNS results a 1s default expiry if no other expiry time is set rather than allowing it to stick around indefinitely. This shouldn't be zero as ls will follow a failing stat call immediately with a second with AT_SYMLINK_NOFOLLOW added. Fixes: 1a4240f4764a ("DNS: Separate out CIFS DNS Resolver code") Signed-off-by: David Howells Tested-by: Markus Suvanto cc: Wang Lei cc: Jeff Layton cc: Steve French cc: Marc Dionne cc: Jarkko Sakkinen cc: "David S. Miller" cc: Eric Dumazet cc: Jakub Kicinski cc: Paolo Abeni cc: linux-afs@lists.infradead.org cc: linux-cifs@vger.kernel.org cc: linux-nfs@vger.kernel.org cc: ceph-devel@vger.kernel.org cc: keyrings@vger.kernel.org cc: netdev@vger.kernel.org include/linux/key-type.h | 1 + net/dns_resolver/dns_key.c | 10 +++++++++- security/keys/gc.c | 31 +++++++++++++++++++++---------- security/keys/internal.h | 11 ++++++++++- security/keys/key.c | 15 +++++---------- security/keys/proc.c | 2 +- 6 files changed, 47 insertions(+), 23 deletions(-) commit 74769d810ead7e7af1a481f07a4d890861a6a4cc Merge: 24ab059d2ebd 117211aa739a Author: Paolo Abeni Date: Thu Dec 21 12:27:28 2023 +0100 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2023-12-21 Hi David, hi Jakub, hi Paolo, hi Eric, The following pull-request contains BPF updates for your *net* tree. We've added 3 non-merge commits during the last 5 day(s) which contain a total of 4 files changed, 45 insertions(+). The main changes are: 1) Fix a syzkaller splat which triggered an oob issue in bpf_link_show_fdinfo(), from Jiri Olsa. 2) Fix another syzkaller-found issue which triggered a NULL pointer dereference in BPF sockmap for unconnected unix sockets, from John Fastabend. bpf-for-netdev * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Add missing BPF_LINK_TYPE invocations bpf: sockmap, test for unconnected af_unix sock bpf: syzkaller found null ptr deref in unix_bpf proto add ==================== Link: https://lore.kernel.org/r/20231221104844.1374-1-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit 1cc3542c76acb5f59001e3e562eba672f1983355 Author: xiongxin Date: Wed Dec 20 10:29:01 2023 +0800 gpio: dwapb: mask/unmask IRQ when disable/enale it In the hardware implementation of the I2C HID driver based on DesignWare GPIO IRQ chip, when the user continues to use the I2C HID device in the suspend process, the I2C HID interrupt will be masked after the resume process is finished. This is because the disable_irq()/enable_irq() of the DesignWare GPIO driver does not synchronize the IRQ mask register state. In normal use of the I2C HID procedure, the GPIO IRQ irq_mask()/irq_unmask() functions are called in pairs. In case of an exception, i2c_hid_core_suspend() calls disable_irq() to disable the GPIO IRQ. With low probability, this causes irq_unmask() to not be called, which causes the GPIO IRQ to be masked and not unmasked in enable_irq(), raising an exception. Add synchronization to the masked register state in the dwapb_irq_enable()/dwapb_irq_disable() function. mask the GPIO IRQ before disabling it. After enabling the GPIO IRQ, unmask the IRQ. Fixes: 7779b3455697 ("gpio: add a driver for the Synopsys DesignWare APB GPIO block") Cc: stable@kernel.org Co-developed-by: Riwen Lu Signed-off-by: Riwen Lu Signed-off-by: xiongxin Acked-by: Serge Semin Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski drivers/gpio/gpio-dwapb.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 1d656bd259edb89dc1d9938ec5c5389867088546 Author: Kent Gibson Date: Thu Dec 21 09:20:36 2023 +0800 gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl() While the GPIO cdev gpio_ioctl() call is in progress, the kernel can call gpiochip_remove() which will set gdev->chip to NULL, after which any subsequent access will cause a crash. gpio_ioctl() was overlooked by the previous fix to protect syscalls (bdbbae241a04), so add protection for that. Fixes: bdbbae241a04 ("gpiolib: protect the GPIO device against being dropped while in use by user-space") Fixes: d7c51b47ac11 ("gpio: userspace ABI for reading/writing GPIO lines") Fixes: 3c0d9c635ae2 ("gpiolib: cdev: support GPIO_V2_GET_LINE_IOCTL and GPIO_V2_LINE_GET_VALUES_IOCTL") Fixes: aad955842d1c ("gpiolib: cdev: support GPIO_V2_GET_LINEINFO_IOCTL and GPIO_V2_GET_LINEINFO_WATCH_IOCTL") Signed-off-by: Kent Gibson Signed-off-by: Bartosz Golaszewski drivers/gpio/gpiolib-cdev.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) commit 24ab059d2ebd62fdccc43794796f6ffbabe49ebc Author: Eric Dumazet Date: Tue Dec 19 12:53:31 2023 +0000 net: check dev->gso_max_size in gso_features_check() Some drivers might misbehave if TSO packets get too big. GVE for instance uses a 16bit field in its TX descriptor, and will do bad things if a packet is bigger than 2^16 bytes. Linux TCP stack honors dev->gso_max_size, but there are other ways for too big packets to reach an ndo_start_xmit() handler : virtio_net, af_packet, GRO... Add a generic check in gso_features_check() and fallback to GSO when needed. gso_max_size was added in the blamed commit. Fixes: 82cc1a7a5687 ("[NET]: Add per-connection option to set max TSO frame size") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20231219125331.4127498-1-edumazet@google.com Signed-off-by: Paolo Abeni net/core/dev.c | 3 +++ 1 file changed, 3 insertions(+) commit b8056f2ce07f27c43b9488dd1bc8bfbb60d0779d Author: Hangbin Liu Date: Tue Dec 19 14:57:37 2023 +0800 kselftest: rtnetlink.sh: use grep_fail when expecting the cmd fail run_cmd_grep_fail should be used when expecting the cmd fail, or the ret will be set to 1, and the total test return 1 when exiting. This would cause the result report to fail if run via run_kselftest.sh. Before fix: # ./rtnetlink.sh -t kci_test_addrlft PASS: preferred_lft addresses have expired # echo $? 1 After fix: # ./rtnetlink.sh -t kci_test_addrlft PASS: preferred_lft addresses have expired # echo $? 0 Fixes: 9c2a19f71515 ("kselftest: rtnetlink.sh: add verbose flag") Signed-off-by: Hangbin Liu Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20231219065737.1725120-1-liuhangbin@gmail.com Signed-off-by: Paolo Abeni tools/testing/selftests/net/rtnetlink.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 916d051730ae48aef8b588fd096fefca4bc0590a Author: Stefan Binding Date: Tue Dec 19 16:22:32 2023 +0000 ALSA: hda: cs35l41: Only add SPI CS GPIO if SPI is enabled in kernel If CONFIG_SPI is not set in the kernel, there is no point in trying to set the chip selects. We can selectively compile it. Fixes: 8c4c216db8fb ("ALSA: hda: cs35l41: Add config table to support many laptops without _DSD") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202312192256.lJelQEoZ-lkp@intel.com/ Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231219162232.790358-3-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda_property.c | 3 +++ 1 file changed, 3 insertions(+) commit ed7326a24a1a9af65fafefd86b505e7c3b968f6d Author: Stefan Binding Date: Tue Dec 19 16:22:31 2023 +0000 ALSA: hda: cs35l41: Do not allow uninitialised variables to be freed Initialise the variables to NULL so that they cannot be uninitialised when devm_kfree is called. Found by static analysis. Fixes: 8c4c216db8fb ("ALSA: hda: cs35l41: Add config table to support many laptops without _DSD") Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231219162232.790358-2-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda_property.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 092a1362470937e46947ccdc6fe4c8a9b72f3f49 Merge: ae53e2198cb8 8f0f01647550 Author: Takashi Iwai Date: Thu Dec 21 09:22:47 2023 +0100 Merge tag 'asoc-fix-v6.7-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.7 Quite a big collection of fixes, as ever mostly in drivers. There's one framework fix for the HDMI CODEC where it wasn't handling startup properly for some controllers, and one new x86 quirk, but otherwise all local fixes or dropping things we don't want to see in a release. commit 14694179e561b5f2f7e56a0f590e2cb49a9cc7ab Author: Alexis Lothoré Date: Fri Dec 15 22:34:24 2023 +0100 pinctrl: at91-pio4: use dedicated lock class for IRQ Trying to suspend to RAM on SAMA5D27 EVK leads to the following lockdep warning: ============================================ WARNING: possible recursive locking detected 6.7.0-rc5-wt+ #532 Not tainted -------------------------------------------- sh/92 is trying to acquire lock: c3cf306c (&irq_desc_lock_class){-.-.}-{2:2}, at: __irq_get_desc_lock+0xe8/0x100 but task is already holding lock: c3d7c46c (&irq_desc_lock_class){-.-.}-{2:2}, at: __irq_get_desc_lock+0xe8/0x100 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&irq_desc_lock_class); lock(&irq_desc_lock_class); *** DEADLOCK *** May be due to missing lock nesting notation 6 locks held by sh/92: #0: c3aa0258 (sb_writers#6){.+.+}-{0:0}, at: ksys_write+0xd8/0x178 #1: c4c2df44 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x138/0x284 #2: c32684a0 (kn->active){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x148/0x284 #3: c232b6d4 (system_transition_mutex){+.+.}-{3:3}, at: pm_suspend+0x13c/0x4e8 #4: c387b088 (&dev->mutex){....}-{3:3}, at: __device_suspend+0x1e8/0x91c #5: c3d7c46c (&irq_desc_lock_class){-.-.}-{2:2}, at: __irq_get_desc_lock+0xe8/0x100 stack backtrace: CPU: 0 PID: 92 Comm: sh Not tainted 6.7.0-rc5-wt+ #532 Hardware name: Atmel SAMA5 unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x34/0x48 dump_stack_lvl from __lock_acquire+0x19ec/0x3a0c __lock_acquire from lock_acquire.part.0+0x124/0x2d0 lock_acquire.part.0 from _raw_spin_lock_irqsave+0x5c/0x78 _raw_spin_lock_irqsave from __irq_get_desc_lock+0xe8/0x100 __irq_get_desc_lock from irq_set_irq_wake+0xa8/0x204 irq_set_irq_wake from atmel_gpio_irq_set_wake+0x58/0xb4 atmel_gpio_irq_set_wake from irq_set_irq_wake+0x100/0x204 irq_set_irq_wake from gpio_keys_suspend+0xec/0x2b8 gpio_keys_suspend from dpm_run_callback+0xe4/0x248 dpm_run_callback from __device_suspend+0x234/0x91c __device_suspend from dpm_suspend+0x224/0x43c dpm_suspend from dpm_suspend_start+0x9c/0xa8 dpm_suspend_start from suspend_devices_and_enter+0x1e0/0xa84 suspend_devices_and_enter from pm_suspend+0x460/0x4e8 pm_suspend from state_store+0x78/0xe4 state_store from kernfs_fop_write_iter+0x1a0/0x284 kernfs_fop_write_iter from vfs_write+0x38c/0x6f4 vfs_write from ksys_write+0xd8/0x178 ksys_write from ret_fast_syscall+0x0/0x1c Exception stack(0xc52b3fa8 to 0xc52b3ff0) 3fa0: 00000004 005a0ae8 00000001 005a0ae8 00000004 00000001 3fc0: 00000004 005a0ae8 00000001 00000004 00000004 b6c616c0 00000020 0059d190 3fe0: 00000004 b6c61678 aec5a041 aebf1a26 This warning is raised because pinctrl-at91-pio4 uses chained IRQ. Whenever a wake up source configures an IRQ through irq_set_irq_wake, it will lock the corresponding IRQ desc, and then call irq_set_irq_wake on "parent" IRQ which will do the same on its own IRQ desc, but since those two locks share the same class, lockdep reports this as an issue. Fix lockdep false positive by setting a different class for parent and children IRQ Fixes: 776180848b57 ("pinctrl: introduce driver for Atmel PIO4 controller") Signed-off-by: Alexis Lothoré Link: https://lore.kernel.org/r/20231215-lockdep_warning-v1-1-8137b2510ed5@bootlin.com Signed-off-by: Linus Walleij drivers/pinctrl/pinctrl-at91-pio4.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 513d88a88e0203188a38f4647dd08170aebd85df Author: Mark Glover Date: Wed Dec 20 13:57:40 2023 +0000 USB: serial: ftdi_sio: update Actisense PIDs constant names Update the constant names for unused USB PIDs (product identifiers) to reflect the new products now using the PIDs. Signed-off-by: Mark Glover Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold drivers/usb/serial/ftdi_sio.c | 6 +++--- drivers/usb/serial/ftdi_sio_ids.h | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) commit dade3f6a1e4e35a5ae916d5e78b3229ec34c78ec Author: David Ahern Date: Mon Dec 18 20:02:43 2023 -0700 net/ipv6: Revert remove expired routes with a separated list of routes This reverts commit 3dec89b14d37ee635e772636dad3f09f78f1ab87. The commit has some race conditions given how expires is managed on a fib6_info in relation to gc start, adding the entry to the gc list and setting the timer value leading to UAF. Revert the commit and try again in a later release. Fixes: 3dec89b14d37 ("net/ipv6: Remove expired routes with a separated list of routes") Cc: Kui-Feng Lee Signed-off-by: David Ahern Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20231219030243.25687-1-dsahern@kernel.org Signed-off-by: Paolo Abeni include/net/ip6_fib.h | 64 +++++++++++---------------------------------------- net/ipv6/ip6_fib.c | 55 +++++-------------------------------------- net/ipv6/route.c | 6 ++--- 3 files changed, 22 insertions(+), 103 deletions(-) commit b414020fed42b274946aae28becf45ff156bbd2e Merge: d6e5794b06c0 f5728a418945 Author: Paolo Abeni Date: Thu Dec 21 08:34:08 2023 +0100 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-12-18 (ice) This series contains updates to ice driver only. Jakes stops clearing of needed aggregator information. Dave adds a check for LAG device support before initializing the associated event handler. Larysa restores accounting of XDP queues in TC configurations. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: Fix PF with enabled XDP going no-carrier after reset ice: alter feature support check for SRIOV and LAG ice: stop trashing VF VSI aggregator node ID information ==================== Link: https://lore.kernel.org/r/20231218192708.3397702-1-anthony.l.nguyen@intel.com Signed-off-by: Paolo Abeni commit 93cd0597649844a0fe7989839a3202735fb3ae67 Author: Arnd Bergmann Date: Mon Dec 4 09:47:01 2023 +0100 x86/xen: add CPU dependencies for 32-bit build Xen only supports modern CPUs even when running a 32-bit kernel, and it now requires a kernel built for a 64 byte (or larger) cache line: In file included from : In function 'xen_vcpu_setup', inlined from 'xen_vcpu_setup_restore' at arch/x86/xen/enlighten.c:111:3, inlined from 'xen_vcpu_restore' at arch/x86/xen/enlighten.c:141:3: include/linux/compiler_types.h:435:45: error: call to '__compiletime_assert_287' declared with attribute error: BUILD_BUG_ON failed: sizeof(*vcpup) > SMP_CACHE_BYTES arch/x86/xen/enlighten.c:166:9: note: in expansion of macro 'BUILD_BUG_ON' 166 | BUILD_BUG_ON(sizeof(*vcpup) > SMP_CACHE_BYTES); | ^~~~~~~~~~~~ Enforce the dependency with a whitelist of CPU configurations. In normal distro kernels, CONFIG_X86_GENERIC is enabled, and this works fine. When this is not set, still allow Xen to be built on kernels that target a 64-bit capable CPU. Fixes: db2832309a82 ("x86/xen: fix percpu vcpu_info allocation") Signed-off-by: Arnd Bergmann Reviewed-by: Juergen Gross Tested-by: Alyssa Ross Link: https://lore.kernel.org/r/20231204084722.3789473-1-arnd@kernel.org Signed-off-by: Juergen Gross arch/x86/xen/Kconfig | 1 + 1 file changed, 1 insertion(+) commit d6e5794b06c0fab74fe6e4fa55d508a5ceb14735 Author: Thomas Weißschuh Date: Mon Dec 18 18:06:54 2023 +0100 net: avoid build bug in skb extension length calculation GCC seems to incorrectly fail to evaluate skb_ext_total_length() at compile time under certain conditions. The issue even occurs if all values in skb_ext_type_len[] are "0", ruling out the possibility of an actual overflow. As the patch has been in mainline since v6.6 without triggering the problem it seems to be a very uncommon occurrence. As the issue only occurs when -fno-tree-loop-im is specified as part of CFLAGS_GCOV, disable the BUILD_BUG_ON() only when building with coverage reporting enabled. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202312171924.4FozI5FG-lkp@intel.com/ Suggested-by: Arnd Bergmann Link: https://lore.kernel.org/lkml/487cfd35-fe68-416f-9bfd-6bb417f98304@app.fastmail.com/ Fixes: 5d21d0a65b57 ("net: generalize calculation of skb extensions length") Cc: Signed-off-by: Thomas Weißschuh Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20231218-net-skbuff-build-bug-v1-1-eefc2fb0a7d3@weissschuh.net Signed-off-by: Paolo Abeni net/core/skbuff.c | 2 ++ 1 file changed, 2 insertions(+) commit 7cb8cd4daacfea646cf8b5925ca2c66c98b18480 Author: Lorenzo Bianconi Date: Sun Dec 17 16:37:40 2023 +0100 net: ethernet: mtk_wed: fix possible NULL pointer dereference in mtk_wed_wo_queue_tx_clean() In order to avoid a NULL pointer dereference, check entry->buf pointer before running skb_free_frag in mtk_wed_wo_queue_tx_clean routine. Fixes: 799684448e3e ("net: ethernet: mtk_wed: introduce wed wo support") Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/3c1262464d215faa8acebfc08869798c81c96f4a.1702827359.git.lorenzo@kernel.org Signed-off-by: Paolo Abeni drivers/net/ethernet/mediatek/mtk_wed_wo.c | 3 +++ 1 file changed, 3 insertions(+) commit a4aebe936554dac6a91e5d091179c934f8325708 Author: Linus Torvalds Date: Tue Dec 19 15:26:59 2023 -0800 posix-timers: Get rid of [COMPAT_]SYS_NI() uses Only the posix timer system calls use this (when the posix timer support is disabled, which does not actually happen in any normal case), because they had debug code to print out a warning about missing system calls. Get rid of that special case, and just use the standard COND_SYSCALL interface that creates weak system call stubs that return -ENOSYS for when the system call does not exist. This fixes a kCFI issue with the SYS_NI() hackery: CFI failure at int80_emulation+0x67/0xb0 (target: sys_ni_posix_timers+0x0/0x70; expected type: 0xb02b34d9) WARNING: CPU: 0 PID: 48 at int80_emulation+0x67/0xb0 Reported-by: kernel test robot Reviewed-by: Sami Tolvanen Tested-by: Sami Tolvanen Cc: Thomas Gleixner Cc: Dave Hansen Cc: Borislav Petkov Signed-off-by: Linus Torvalds arch/arm64/include/asm/syscall_wrapper.h | 4 --- arch/riscv/include/asm/syscall_wrapper.h | 5 ---- arch/s390/include/asm/syscall_wrapper.h | 13 +-------- arch/x86/include/asm/syscall_wrapper.h | 34 +++--------------------- kernel/sys_ni.c | 14 ++++++++++ kernel/time/posix-stubs.c | 45 -------------------------------- 6 files changed, 19 insertions(+), 96 deletions(-) commit eee7f5b48e20c585dc8069b3ab8abdcabd0afded Merge: 1bf5c8925609 12d1e301bdfd Author: Linus Torvalds Date: Wed Dec 20 21:09:47 2023 -0800 Merge tag '6.7-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - two multichannel reconnect fixes, one fixing an important refcounting problem that can lead to umount problems - atime fix - five fixes for various potential OOB accesses, including a CVE fix, and two additional fixes for problems pointed out by Robert Morris's fuzzing investigation * tag '6.7-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: do not let cifs_chan_update_iface deallocate channels cifs: fix a pending undercount of srv_count fs: cifs: Fix atime update check smb: client: fix potential OOB in smb2_dump_detail() smb: client: fix potential OOB in cifs_dump_detail() smb: client: fix OOB in smbCalcSize() smb: client: fix OOB in SMB2_query_info_init() smb: client: fix OOB in cifsd when receiving compounded resps commit 1bf5c8925609425fe0ff7270fe8fb14246c01694 Merge: 87c71dd604e5 3d940bb18183 Author: Linus Torvalds Date: Wed Dec 20 16:12:39 2023 -0800 Merge tag 's390-6.7-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Alexander Gordeev: - Fix virtual vs physical address confusion in Storage Class Memory (SCM) block device driver. - Fix saving and restoring of FPU kernel context, which could lead to corruption of vector registers 8-15 - Update defconfigs * tag 's390-6.7-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: update defconfigs s390/vx: fix save/restore of fpu kernel context s390/scm: fix virtual vs physical address confusion commit 87c71dd604e54b412db09b74cb67ebce09c57cd5 Merge: 1bddd45b5cbc fa3d6c718310 Author: Linus Torvalds Date: Wed Dec 20 16:06:40 2023 -0800 Merge tag 'soc-fixes-6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "There are only a handful of bugfixes this time, which feels almost too small, so I hope we are not missing something important. - One more mediatek dts warning fix after the previous larger set, this should finally result in a clean defconfig build. - TI OMAP dts fixes for a spurious hang on am335x and invalid data on DTA7 - One DTS fix for ethernet on Oriange Pi Zero (Allwinner H616) - A regression fix for ti-sysc interconnect target module driver to not access registers after reset if srst_udelay quirk is needed - Reset controller driver fixes for a crash during error handling and a build warning" * tag 'soc-fixes-6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: arm64: dts: mediatek: mt8395-genio-1200-evk: add interrupt-parent for mt6360 ARM: dts: Fix occasional boot hang for am3 usb reset: Fix crash when freeing non-existent optional resets ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init ARM: dts: dra7: Fix DRA7 L3 NoC node register size bus: ti-sysc: Flush posted write only after srst_udelay reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning arm64: dts: allwinner: h616: update emac for Orange Pi Zero 3 commit 1bddd45b5cbc0dd278ea7c568d60dc399bc4d3cc Merge: 1a44b0073b92 a55bdad5dfd1 Author: Linus Torvalds Date: Wed Dec 20 15:58:18 2023 -0800 Merge tag 'platform-drivers-x86-v6.7-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform drivers fixes from Ilpo Järvinen: - Fan reporting on some ThinkPads - Laptop 13 spurious keypresses while suspended - Intel PMC correction to avoid crash * tag 'platform-drivers-x86-v6.7-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86/amd/pmc: Disable keyboard wakeup on AMD Framework 13 platform/x86/amd/pmc: Move keyboard wakeup disablement detection to pmc-quirks platform/x86/amd/pmc: Only run IRQ1 firmware version check on Cezanne platform/x86/amd/pmc: Move platform defines to header platform/x86/intel/pmc: Fix hang in pmc_core_send_ltr_ignore() platform/x86: thinkpad_acpi: fix for incorrect fan reporting on some ThinkPad systems commit 1803d0c5ee1a3bbee23db2336e21add067824f02 Author: Matthew Wilcox (Oracle) Date: Mon Dec 18 14:03:28 2023 +0000 mailmap: add an old address for Naoya Horiguchi This address now bounces, remap it to a current address. Link: https://lkml.kernel.org/r/20231218140328.3313474-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Dan Williams Cc: Naoya Horiguchi Signed-off-by: Andrew Morton .mailmap | 1 + 1 file changed, 1 insertion(+) commit 39ebd6dce62d8cfe3864e16148927a139f11bc9a Author: Matthew Wilcox (Oracle) Date: Mon Dec 18 13:58:37 2023 +0000 mm/memory-failure: cast index to loff_t before shifting it On 32-bit systems, we'll lose the top bits of index because arithmetic will be performed in unsigned long instead of unsigned long long. This affects files over 4GB in size. Link: https://lkml.kernel.org/r/20231218135837.3310403-4-willy@infradead.org Fixes: 6100e34b2526 ("mm, memory_failure: Teach memory_failure() about dev_pagemap pages") Signed-off-by: Matthew Wilcox (Oracle) Cc: Dan Williams Cc: Naoya Horiguchi Cc: Signed-off-by: Andrew Morton mm/memory-failure.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c79c5a0a00a9457718056b588f312baadf44e471 Author: Matthew Wilcox (Oracle) Date: Mon Dec 18 13:58:36 2023 +0000 mm/memory-failure: check the mapcount of the precise page A process may map only some of the pages in a folio, and might be missed if it maps the poisoned page but not the head page. Or it might be unnecessarily hit if it maps the head page, but not the poisoned page. Link: https://lkml.kernel.org/r/20231218135837.3310403-3-willy@infradead.org Fixes: 7af446a841a2 ("HWPOISON, hugetlb: enable error handling path for hugepage") Signed-off-by: Matthew Wilcox (Oracle) Cc: Dan Williams Cc: Naoya Horiguchi Cc: Signed-off-by: Andrew Morton mm/memory-failure.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 376907f3a0b34a17e80417825f8cc1c40fcba81b Author: Matthew Wilcox (Oracle) Date: Mon Dec 18 13:58:35 2023 +0000 mm/memory-failure: pass the folio and the page to collect_procs() Patch series "Three memory-failure fixes". I've been looking at the memory-failure code and I believe I have found three bugs that need fixing -- one going all the way back to 2010! I'll have more patches later to use folios more extensively but didn't want these bugfixes to get caught up in that. This patch (of 3): Both collect_procs_anon() and collect_procs_file() iterate over the VMA interval trees looking for a single pgoff, so it is wrong to look for the pgoff of the head page as is currently done. However, it is also wrong to look at page->mapping of the precise page as this is invalid for tail pages. Clear up the confusion by passing both the folio and the precise page to collect_procs(). Link: https://lkml.kernel.org/r/20231218135837.3310403-1-willy@infradead.org Link: https://lkml.kernel.org/r/20231218135837.3310403-2-willy@infradead.org Fixes: 415c64c1453a ("mm/memory-failure: split thp earlier in memory error handling") Signed-off-by: Matthew Wilcox (Oracle) Cc: Dan Williams Cc: Naoya Horiguchi Cc: Signed-off-by: Andrew Morton mm/memory-failure.c | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) commit 0aac13add26d546ac74c89d2883b3a5f0fbea039 Author: Muhammad Usama Anjum Date: Thu Dec 14 15:19:30 2023 +0500 selftests: secretmem: floor the memory size to the multiple of page_size The "locked-in-memory size" limit per process can be non-multiple of page_size. The mmap() fails if we try to allocate locked-in-memory with same size as the allowed limit if it isn't multiple of the page_size because mmap() rounds off the memory size to be allocated to next multiple of page_size. Fix this by flooring the length to be allocated with mmap() to the previous multiple of the page_size. This was getting triggered on KernelCI regularly because of different ulimit settings which wasn't multiple of the page_size. Find logs here: https://linux.kernelci.org/test/plan/id/657654bd8e81e654fae13532/ The bug in was present from the time test was first added. Link: https://lkml.kernel.org/r/20231214101931.1155586-1-usama.anjum@collabora.com Fixes: 76fe17ef588a ("secretmem: test: add basic selftest for memfd_secret(2)") Signed-off-by: Muhammad Usama Anjum Reported-by: "kernelci.org bot" Closes: https://linux.kernelci.org/test/plan/id/657654bd8e81e654fae13532/ Cc: "James E.J. Bottomley" Cc: Mike Rapoport (IBM) Cc: Shuah Khan Cc: Signed-off-by: Andrew Morton tools/testing/selftests/mm/memfd_secret.c | 3 +++ 1 file changed, 3 insertions(+) commit fc346d0a70a13d52fe1c4bc49516d83a42cd7c4c Author: Charan Teja Kalla Date: Thu Dec 14 04:58:41 2023 +0000 mm: migrate high-order folios in swap cache correctly Large folios occupy N consecutive entries in the swap cache instead of using multi-index entries like the page cache. However, if a large folio is re-added to the LRU list, it can be migrated. The migration code was not aware of the difference between the swap cache and the page cache and assumed that a single xas_store() would be sufficient. This leaves potentially many stale pointers to the now-migrated folio in the swap cache, which can lead to almost arbitrary data corruption in the future. This can also manifest as infinite loops with the RCU read lock held. [willy@infradead.org: modifications to the changelog & tweaked the fix] Fixes: 3417013e0d18 ("mm/migrate: Add folio_migrate_mapping()") Link: https://lkml.kernel.org/r/20231214045841.961776-1-willy@infradead.org Signed-off-by: Charan Teja Kalla Signed-off-by: Matthew Wilcox (Oracle) Reported-by: Charan Teja Kalla Closes: https://lkml.kernel.org/r/1700569840-17327-1-git-send-email-quic_charante@quicinc.com Cc: David Hildenbrand Cc: Johannes Weiner Cc: Kirill A. Shutemov Cc: Naoya Horiguchi Cc: Shakeel Butt Cc: Signed-off-by: Andrew Morton mm/migrate.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 4249f13c11be8b8b7bf93204185e150c3bdc968d Author: Sidhartha Kumar Date: Wed Dec 13 12:50:57 2023 -0800 maple_tree: do not preallocate nodes for slot stores mas_preallocate() defaults to requesting 1 node for preallocation and then ,depending on the type of store, will update the request variable. There isn't a check for a slot store type, so slot stores are preallocating the default 1 node. Slot stores do not require any additional nodes, so add a check for the slot store case that will bypass node_count_gfp(). Update the tests to reflect that slot stores do not require allocations. User visible effects of this bug include increased memory usage from the unneeded node that was allocated. Link: https://lkml.kernel.org/r/20231213205058.386589-1-sidhartha.kumar@oracle.com Fixes: 0b8bb544b1a7 ("maple_tree: update mas_preallocate() testing") Signed-off-by: Sidhartha Kumar Cc: Liam R. Howlett Cc: Matthew Wilcox (Oracle) Cc: Peng Zhang Cc: [6.6+] Signed-off-by: Andrew Morton lib/maple_tree.c | 11 +++++++++++ tools/testing/radix-tree/maple.c | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) commit e2c27b803bb664748e090d99042ac128b3f88d92 Author: Baokun Li Date: Wed Dec 13 14:23:24 2023 +0800 mm/filemap: avoid buffered read/write race to read inconsistent data The following concurrency may cause the data read to be inconsistent with the data on disk: cpu1 cpu2 ------------------------------|------------------------------ // Buffered write 2048 from 0 ext4_buffered_write_iter generic_perform_write copy_page_from_iter_atomic ext4_da_write_end ext4_da_do_write_end block_write_end __block_commit_write folio_mark_uptodate // Buffered read 4096 from 0 smp_wmb() ext4_file_read_iter set_bit(PG_uptodate, folio_flags) generic_file_read_iter i_size_write // 2048 filemap_read unlock_page(page) filemap_get_pages filemap_get_read_batch folio_test_uptodate(folio) ret = test_bit(PG_uptodate, folio_flags) if (ret) smp_rmb(); // Ensure that the data in page 0-2048 is up-to-date. // New buffered write 2048 from 2048 ext4_buffered_write_iter generic_perform_write copy_page_from_iter_atomic ext4_da_write_end ext4_da_do_write_end block_write_end __block_commit_write folio_mark_uptodate smp_wmb() set_bit(PG_uptodate, folio_flags) i_size_write // 4096 unlock_page(page) isize = i_size_read(inode) // 4096 // Read the latest isize 4096, but without smp_rmb(), there may be // Load-Load disorder resulting in the data in the 2048-4096 range // in the page is not up-to-date. copy_page_to_iter // copyout 4096 In the concurrency above, we read the updated i_size, but there is no read barrier to ensure that the data in the page is the same as the i_size at this point, so we may copy the unsynchronized page out. Hence adding the missing read memory barrier to fix this. This is a Load-Load reordering issue, which only occurs on some weak mem-ordering architectures (e.g. ARM64, ALPHA), but not on strong mem-ordering architectures (e.g. X86). And theoretically the problem doesn't only happen on ext4, filesystems that call filemap_read() but don't hold inode lock (e.g. btrfs, f2fs, ubifs ...) will have this problem, while filesystems with inode lock (e.g. xfs, nfs) won't have this problem. Link: https://lkml.kernel.org/r/20231213062324.739009-1-libaokun1@huawei.com Signed-off-by: Baokun Li Reviewed-by: Jan Kara Cc: Andreas Dilger Cc: Christoph Hellwig Cc: Dave Chinner Cc: Matthew Wilcox (Oracle) Cc: Ritesh Harjani (IBM) Cc: Theodore Ts'o Cc: yangerkun Cc: Yu Kuai Cc: Zhang Yi Cc: Signed-off-by: Andrew Morton mm/filemap.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit b2325bf860faa2f304a7e188f00cf9f7dc9b5ee8 Author: Nico Pache Date: Tue Dec 12 16:26:59 2023 -0700 kunit: kasan_test: disable fortify string checker on kmalloc_oob_memset Similar to commit 09c6304e38e4 ("kasan: test: fix compatibility with FORTIFY_SOURCE") the kernel is panicing in kmalloc_oob_memset_*. This is due to the `ptr` not being hidden from the optimizer which would disable the runtime fortify string checker. kernel BUG at lib/string_helpers.c:1048! Call Trace: [<00000000272502e2>] fortify_panic+0x2a/0x30 ([<00000000272502de>] fortify_panic+0x26/0x30) [<001bffff817045c4>] kmalloc_oob_memset_2+0x22c/0x230 [kasan_test] Hide the `ptr` variable from the optimizer to fix the kernel panic. Also define a memset_size variable and hide that as well. This cleans up the code and follows the same convention as other tests. [npache@redhat.com: address review comments from Andrey] Link: https://lkml.kernel.org/r/20231214164423.6202-1-npache@redhat.com Link: https://lkml.kernel.org/r/20231212232659.18839-1-npache@redhat.com Signed-off-by: Nico Pache Reviewed-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Vincenzo Frascino Signed-off-by: Andrew Morton mm/kasan/kasan_test.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) commit e63bde3d9417f8318d6dd0d0fafa35ebf307aabd Author: Arnd Bergmann Date: Mon Oct 23 13:01:55 2023 +0200 kexec: select CRYPTO from KEXEC_FILE instead of depending on it All other users of crypto code use 'select' instead of 'depends on', so do the same thing with KEXEC_FILE for consistency. In practice this makes very little difference as kernels with kexec support are very likely to also include some other feature that already selects both crypto and crypto_sha256, but being consistent here helps for usability as well as to avoid potential circular dependencies. This reverts the dependency back to what it was originally before commit 74ca317c26a3f ("kexec: create a new config option CONFIG_KEXEC_FILE for new syscall"), which changed changed it with the comment "This should be safer as "select" is not recursive", but that appears to have been done in error, as "select" is indeed recursive, and there are no other dependencies that prevent CRYPTO_SHA256 from being selected here. Link: https://lkml.kernel.org/r/20231023110308.1202042-2-arnd@kernel.org Fixes: 74ca317c26a3f ("kexec: create a new config option CONFIG_KEXEC_FILE for new syscall") Signed-off-by: Arnd Bergmann Reviewed-by: Eric DeVolder Tested-by: Eric DeVolder Acked-by: Baoquan He Cc: Herbert Xu Cc: "David S. Miller" Cc: Albert Ou Cc: Alexander Gordeev Cc: Ard Biesheuvel Cc: Borislav Petkov Cc: Christian Borntraeger Cc: Christophe Leroy Cc: Conor Dooley Cc: Dave Hansen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sven Schnelle Cc: Thomas Gleixner Cc: Vasily Gorbik Signed-off-by: Andrew Morton kernel/Kconfig.kexec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c1ad12ee0efc07244be37f69311e6f7c4ac98e62 Author: Arnd Bergmann Date: Mon Oct 23 13:01:54 2023 +0200 kexec: fix KEXEC_FILE dependencies The cleanup for the CONFIG_KEXEC Kconfig logic accidentally changed the 'depends on CRYPTO=y' dependency to a plain 'depends on CRYPTO', which causes a link failure when all the crypto support is in a loadable module and kexec_file support is built-in: x86_64-linux-ld: vmlinux.o: in function `__x64_sys_kexec_file_load': (.text+0x32e30a): undefined reference to `crypto_alloc_shash' x86_64-linux-ld: (.text+0x32e58e): undefined reference to `crypto_shash_update' x86_64-linux-ld: (.text+0x32e6ee): undefined reference to `crypto_shash_final' Both s390 and x86 have this problem, while ppc64 and riscv have the correct dependency already. On riscv, the dependency is only used for the purgatory, not for the kexec_file code itself, which may be a bit surprising as it means that with CONFIG_CRYPTO=m, it is possible to enable KEXEC_FILE but then the purgatory code is silently left out. Move this into the common Kconfig.kexec file in a way that is correct everywhere, using the dependency on CRYPTO_SHA256=y only when the purgatory code is available. This requires reversing the dependency between ARCH_SUPPORTS_KEXEC_PURGATORY and KEXEC_FILE, but the effect remains the same, other than making riscv behave like the other ones. On s390, there is an additional dependency on CRYPTO_SHA256_S390, which should technically not be required but gives better performance. Remove this dependency here, noting that it was not present in the initial Kconfig code but was brought in without an explanation in commit 71406883fd357 ("s390/kexec_file: Add kexec_file_load system call"). [arnd@arndb.de: fix riscv build] Link: https://lkml.kernel.org/r/67ddd260-d424-4229-a815-e3fcfb864a77@app.fastmail.com Link: https://lkml.kernel.org/r/20231023110308.1202042-1-arnd@kernel.org Fixes: 6af5138083005 ("x86/kexec: refactor for kernel/Kconfig.kexec") Signed-off-by: Arnd Bergmann Reviewed-by: Eric DeVolder Tested-by: Eric DeVolder Cc: Albert Ou Cc: Alexander Gordeev Cc: Ard Biesheuvel Cc: Borislav Petkov Cc: Christian Borntraeger Cc: Christophe Leroy Cc: Conor Dooley Cc: Dave Hansen Cc: David S. Miller Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sven Schnelle Cc: Thomas Gleixner Cc: Vasily Gorbik Signed-off-by: Andrew Morton arch/powerpc/Kconfig | 4 ++-- arch/riscv/Kconfig | 4 +--- arch/s390/Kconfig | 4 ++-- arch/x86/Kconfig | 4 ++-- kernel/Kconfig.kexec | 1 + 5 files changed, 8 insertions(+), 9 deletions(-) commit 1a44b0073b9235521280e19d963b6dfef7888f18 Merge: 74d8fc2b868a 413ba91089c7 Author: Linus Torvalds Date: Wed Dec 20 12:04:03 2023 -0800 Merge tag 'ovl-fixes-6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs Pull overlayfs fix from Amir Goldstein: "Fix a regression from this merge window" * tag 'ovl-fixes-6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs: ovl: fix dentry reference leak after changes to underlying layers commit 74d8fc2b868ae156dcbd33132029561a8341d659 Merge: ac1c13e257c7 247ce5f1bb3e Author: Linus Torvalds Date: Wed Dec 20 11:24:28 2023 -0800 Merge tag 'bcachefs-2023-12-19' of https://evilpiepirate.org/git/bcachefs Pull more bcachefs fixes from Kent Overstreet: - Fix a deadlock in the data move path with nocow locks (vs. update in place writes); when trylock failed we were incorrectly waiting for in flight ios to flush. - Fix reporting of NFS file handle length - Fix early error path in bch2_fs_alloc() - list head wasn't being initialized early enough - Make sure correct (hardware accelerated) crc modules get loaded - Fix a rare overflow in the btree split path, when the packed bkey format grows and all the keys have no value (LRU btree). - Fix error handling in the sector allocator This was causing writes to spuriously fail in multidevice setups, and another bug meant that the errors weren't being logged, only reported via fsync. * tag 'bcachefs-2023-12-19' of https://evilpiepirate.org/git/bcachefs: bcachefs: Fix bch2_alloc_sectors_start_trans() error handling bcachefs; guard against overflow in btree node split bcachefs: btree_node_u64s_with_format() takes nr keys bcachefs: print explicit recovery pass message only once bcachefs: improve modprobe support by providing softdeps bcachefs: fix invalid memory access in bch2_fs_alloc() error path bcachefs: Fix determining required file handle length bcachefs: Fix nocow locks deadlock commit ac1c13e257c798510a60559c2cd50f1828f89c4e Merge: 0a7a93d96d12 bd018b98ba84 Author: Linus Torvalds Date: Wed Dec 20 11:16:50 2023 -0800 Merge tag 'nfsd-6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - Address a few recently-introduced issues * tag 'nfsd-6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: SUNRPC: Revert 5f7fc5d69f6e92ec0b38774c387f5cf7812c5806 NFSD: Revert 738401a9bd1ac34ccd5723d69640a4adbb1a4bc0 NFSD: Revert 6c41d9a9bd0298002805758216a9c44e38a8500d nfsd: hold nfsd_mutex across entire netlink operation nfsd: call nfsd_last_thread() before final nfsd_put() commit 0a7a93d96d124bf252430090b15feb4239bcf752 Merge: 55cb5f43689d 5d6f447b07d5 Author: Linus Torvalds Date: Wed Dec 20 11:01:28 2023 -0800 Merge tag 'dm-6.7/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - DM raid target (and MD raid) fix for reconfig_mutex MD deadlock that should have been merged along with recent v6.7-rc6 MD fixes (see MD related commits: f2d87a759f68^..b39113349de6) - DM integrity target fix to avoid modifying immutable biovec in the integrity_metadata() edge case where kmalloc fails. - Fix drivers/md/Kconfig so DM_AUDIT depends on BLK_DEV_DM. - Update DM entry in MAINTAINERS to remove stale info. * tag 'dm-6.7/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: MAINTAINERS: remove stale info for DEVICE-MAPPER dm audit: fix Kconfig so DM_AUDIT depends on BLK_DEV_DM dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() dm-raid: delay flushing event_work() after reconfig_mutex is released commit 7beb82b7d590e51f698b1cf590b0e2785db1c498 Author: Randy Dunlap Date: Tue Dec 19 22:12:26 2023 -0800 tracing/synthetic: fix kernel-doc warnings scripts/kernel-doc warns about using @args: for variadic arguments to functions. Documentation/doc-guide/kernel-doc.rst says that this should be written as @...: instead, so update the source code to match that, preventing the warnings. trace_events_synth.c:1165: warning: Excess function parameter 'args' description in '__synth_event_gen_cmd_start' trace_events_synth.c:1714: warning: Excess function parameter 'args' description in 'synth_event_trace' Link: https://lore.kernel.org/linux-trace-kernel/20231220061226.30962-1-rdunlap@infradead.org Cc: Mathieu Desnoyers Fixes: 35ca5207c2d11 ("tracing: Add synthetic event command generation functions") Fixes: 8dcc53ad956d2 ("tracing: Add synth_event_trace() and related functions") Acked-by: Masami Hiramatsu (Google) Signed-off-by: Randy Dunlap Signed-off-by: Steven Rostedt (Google) kernel/trace/trace_events_synth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit fa3d6c7183106a187a8d399216db3f088a6aab81 Author: Macpaul Lin Date: Fri Dec 15 15:32:52 2023 +0800 arm64: dts: mediatek: mt8395-genio-1200-evk: add interrupt-parent for mt6360 This patch fix the warning introduced by mt6360 node in mt8395-genio-1200-evk.dts. arch/arm64/boot/dts/mediatek/mt8195.dtsi:464.4-27: Warning (interrupts_property): /soc/i2c@11d01000/pmic@34:#interrupt-cells: size is (8), expected multiple of 16 Add a missing 'interrupt-parent' to fix this warning. Fixes: f2b543a191b6 ("arm64: dts: mediatek: add device-tree for Genio 1200 EVK board") Reported-by: Arnd Bergmann Link: https://lore.kernel.org/linux-devicetree/20231212214737.230115-1-arnd@kernel.org/ Signed-off-by: Macpaul Lin Signed-off-by: Arnd Bergmann arch/arm64/boot/dts/mediatek/mt8395-genio-1200-evk.dts | 1 + 1 file changed, 1 insertion(+) commit 02350805eeb9b8d0d4587e2ccf0ecc305bfacc4f Merge: 2096d3ec469f 9b6a51aab5f5 Author: Arnd Bergmann Date: Wed Dec 20 12:04:38 2023 +0000 Merge tag 'am3-usb-hang-fix-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Fix for occasional boot hang for am335x USB A fix for occasional boot hang for am335x USB that I've only recently started noticing. This can be merged naturally whenever suitable. This issue has been seen with other similar SoCs earlier and has clearly existed for a long time. * tag 'am3-usb-hang-fix-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: Fix occasional boot hang for am3 usb Link: https://lore.kernel.org/r/pull-1703071616-395333@atomide.com Signed-off-by: Arnd Bergmann commit 2096d3ec469f9b7ed1a369da6c4f27cc3ea1aff8 Merge: d73ad797c83b c72b9c33ef96 Author: Arnd Bergmann Date: Wed Dec 20 12:02:25 2023 +0000 Merge tag 'omap-for-v6.7/fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Fixes for omaps A few fixes for omaps: - A regression fix for ti-sysc interconnect target module driver to not access registers after reset if srst_udelay quirk is needed - DRA7 L3 NoC node register size fix * tag 'omap-for-v6.7/fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init ARM: dts: dra7: Fix DRA7 L3 NoC node register size bus: ti-sysc: Flush posted write only after srst_udelay Link: https://lore.kernel.org/r/pull-1702037799-781982@atomide.com Signed-off-by: Arnd Bergmann commit 94c71705cc49092cef60ece13a28680809096fd4 Author: Patrick Rudolph Date: Tue Dec 19 13:51:18 2023 +0100 pinctrl: cy8c95x0: Fix get_pincfg Invert the register value for PIN_CONFIG_OUTPUT_ENABLE to return the opposite of PIN_CONFIG_INPUT_ENABLE. Signed-off-by: Patrick Rudolph Link: https://lore.kernel.org/r/20231219125120.4028862-3-patrick.rudolph@9elements.com Signed-off-by: Linus Walleij drivers/pinctrl/pinctrl-cy8c95x0.c | 2 ++ 1 file changed, 2 insertions(+) commit 04dfca968cf7349773126340991b68a83378aca2 Author: Patrick Rudolph Date: Tue Dec 19 13:51:17 2023 +0100 pinctrl: cy8c95x0: Fix regression Commit 1fa3df901f2c ("pinctrl: cy8c95x0: Remove custom ->set_config()") removed support for PIN_CONFIG_INPUT_ENABLE and PIN_CONFIG_OUTPUT. Add the following options to restore functionality: - PIN_CONFIG_INPUT_ENABLE - PIN_CONFIG_OUTPUT_ENABLE Signed-off-by: Patrick Rudolph Link: https://lore.kernel.org/r/20231219125120.4028862-2-patrick.rudolph@9elements.com Signed-off-by: Linus Walleij drivers/pinctrl/pinctrl-cy8c95x0.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 47b1fa48116238208c1b1198dba10f56fc1b6eb2 Author: Patrick Rudolph Date: Tue Dec 19 13:51:16 2023 +0100 pinctrl: cy8c95x0: Fix typo Fix typo to make pinctrl-cy8c95x compile again. Signed-off-by: Patrick Rudolph Link: https://lore.kernel.org/r/20231219125120.4028862-1-patrick.rudolph@9elements.com Signed-off-by: Linus Walleij drivers/pinctrl/pinctrl-cy8c95x0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 74cef6872ceaefb5b6c5c60641371ea28702d358 Author: David Howells Date: Mon Dec 11 15:15:02 2023 +0000 afs: Fix dynamic root lookup DNS check In the afs dynamic root directory, the ->lookup() function does a DNS check on the cell being asked for and if the DNS upcall reports an error it will report an error back to userspace (typically ENOENT). However, if a failed DNS upcall returns a new-style result, it will return a valid result, with the status field set appropriately to indicate the type of failure - and in that case, dns_query() doesn't return an error and we let stat() complete with no error - which can cause confusion in userspace as subsequent calls that trigger d_automount then fail with ENOENT. Fix this by checking the status result from a valid dns_query() and returning an error if it indicates a failure. Fixes: bbb4c4323a4d ("dns: Allow the dns resolver to retrieve a server set") Reported-by: Markus Suvanto Closes: https://bugzilla.kernel.org/show_bug.cgi?id=216637 Signed-off-by: David Howells Tested-by: Markus Suvanto cc: Marc Dionne cc: linux-afs@lists.infradead.org fs/afs/dynroot.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) commit 71f8b55bc30e82d6355e07811213d847981a32e2 Author: David Howells Date: Mon Dec 11 15:08:57 2023 +0000 afs: Fix the dynamic root's d_delete to always delete unused dentries Fix the afs dynamic root's d_delete function to always delete unused dentries rather than only deleting them if they're positive. With things as they stand upstream, negative dentries stemming from failed DNS lookups stick around preventing retries. Fixes: 66c7e1d319a5 ("afs: Split the dynroot stuff out and give it its own ops tables") Signed-off-by: David Howells Tested-by: Markus Suvanto cc: Marc Dionne cc: linux-afs@lists.infradead.org fs/afs/dynroot.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) commit bd7f77dae69532ffc027ee50ff99e3792dc30b7f Author: Lai Peter Jun Ann Date: Mon Dec 18 15:51:32 2023 +0800 net: stmmac: fix incorrect flag check in timestamp interrupt The driver should continue get the timestamp if STMMAC_FLAG_EXT_SNAPSHOT_EN flag is set. Fixes: aa5513f5d95f ("net: stmmac: replace the ext_snapshot_en field with a flag") Cc: # 6.6 Signed-off-by: Song Yoong Siang Signed-off-by: Lai Peter Jun Ann Reviewed-by: Jacob Keller Reviewed-by: Serge Semin Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 498444e390b48134e550c9d65b5a1b1f56745acd Merge: 8353c2abc02c 2e07e8348ea4 Author: David S. Miller Date: Wed Dec 20 11:12:12 2023 +0000 Merge tag 'for-net-2023-12-15' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Add encryption key size check when acting as peripheral - Shut up false-positive build warning - Send reject if L2CAP command request is corrupted - Fix Use-After-Free in bt_sock_recvmsg - Fix not notifying when connection encryption changes - Fix not checking if HCI_OP_INQUIRY has been sent - Fix address type send over to the MGMT interface - Fix deadlock in vhci_send_frame ==================== Signed-off-by: David S. Miller commit b0c279ff6cc97a34d8caaf28381e72bb111b5e16 Author: Kent Overstreet Date: Wed Dec 13 00:44:34 2023 -0500 bcachefs: fix BCH_FSCK_ERR enum Signed-off-by: Kent Overstreet fs/bcachefs/error.h | 2 +- fs/bcachefs/sb-errors.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 247ce5f1bb3ea90879e8552b8edf4885b9a9f849 Author: Kent Overstreet Date: Tue Dec 19 17:16:34 2023 -0500 bcachefs: Fix bch2_alloc_sectors_start_trans() error handling When we fail to allocate because of insufficient open buckets, we don't want to retry from the full set of devices - we just want to retry in blocking mode. But if the retry in blocking mode fails with a different error code, we end up squashing the -BCH_ERR_open_buckets_empty error with an error that makes us thing we won't be able to allocate (insufficient_devices) - which is incorrect when we didn't try to allocate from the full set of devices, and causes the write to fail. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_foreground.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit 7ba1f6ec97c7afec5787ab8e92a6a7e24f0459aa Author: Kent Overstreet Date: Sun Dec 17 23:31:26 2023 -0500 bcachefs; guard against overflow in btree node split Signed-off-by: Kent Overstreet fs/bcachefs/btree_update_interior.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 0fa3b97767019be4556a8f081b742aaaabd2bd9e Author: Kent Overstreet Date: Sun Dec 17 23:20:59 2023 -0500 bcachefs: btree_node_u64s_with_format() takes nr keys Signed-off-by: Kent Overstreet fs/bcachefs/btree_update_interior.c | 27 ++++++++++++++------------- fs/bcachefs/btree_update_interior.h | 4 ---- 2 files changed, 14 insertions(+), 17 deletions(-) commit b4cc1cbba5195a4dd497cf2f8f09e7807977d543 Author: Quan Nguyen Date: Mon Dec 11 17:22:16 2023 +0700 i2c: aspeed: Handle the coalesced stop conditions with the start conditions. Some masters may drive the transfers with low enough latency between the nak/stop phase of the current command and the start/address phase of the following command that the interrupts are coalesced by the time we process them. Handle the stop conditions before processing SLAVE_MATCH to fix the complaints that sometimes occur below. "aspeed-i2c-bus 1e78a040.i2c-bus: irq handled != irq. Expected 0x00000086, but was 0x00000084" Fixes: f9eb91350bb2 ("i2c: aspeed: added slave support for Aspeed I2C driver") Signed-off-by: Quan Nguyen Reviewed-by: Andrew Jeffery Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-aspeed.c | 48 +++++++++++++++++++++++++++-------------- 1 file changed, 32 insertions(+), 16 deletions(-) commit f6fe0b2d35457c10ec37acc209d19726bdc16dbd Author: Maurizio Lombardi Date: Tue Dec 19 17:48:23 2023 +0100 nvme-pci: fix sleeping function called from interrupt context the nvme_handle_cqe() interrupt handler calls nvme_complete_async_event() but the latter may call nvme_auth_stop() which is a blocking function. Sleeping functions can't be called in interrupt context BUG: sleeping function called from invalid context in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/15 Call Trace: __cancel_work_timer+0x31e/0x460 ? nvme_change_ctrl_state+0xcf/0x3c0 [nvme_core] ? nvme_change_ctrl_state+0xcf/0x3c0 [nvme_core] nvme_complete_async_event+0x365/0x480 [nvme_core] nvme_poll_cq+0x262/0xe50 [nvme] Fix the bug by moving nvme_auth_stop() to fw_act_work (executed by the nvme_wq workqueue) Fixes: f50fff73d620 ("nvme: implement In-Band authentication") Signed-off-by: Maurizio Lombardi Reviewed-by: Jens Axboe Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch drivers/nvme/host/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 4a0057afa35872a5f2e65576785844688dd9fa5e Author: ZhenGuo Yin Date: Tue Dec 19 14:39:42 2023 +0800 drm/amdgpu: re-create idle bo's PTE during VM state machine reset Idle bo's PTE needs to be re-created when resetting VM state machine. Set idle bo's vm_bo as moved to mark it as invalid. Fixes: 55bf196f60df ("drm/amdgpu: reset VM when an error is detected") Signed-off-by: ZhenGuo Yin Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 + 1 file changed, 1 insertion(+) commit 55cb5f43689d7a9ea5bf35ef050f12334f197347 Merge: 9c749e61a110 b803d7c664d5 Author: Linus Torvalds Date: Tue Dec 19 12:25:43 2023 -0800 Merge tag 'trace-v6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fix from Steven Rostedt: "While working on the ring buffer, I found one more bug with the timestamp code, and the fix for this removed the need for the final 64-bit cmpxchg! The ring buffer events hold a "delta" from the previous event. If it is determined that the delta can not be calculated, it falls back to adding an absolute timestamp value. The way to know if the delta can be used is via two stored timestamps in the per-cpu buffer meta data: before_stamp and write_stamp The before_stamp is written by every event before it tries to allocate its space on the ring buffer. The write_stamp is written after it allocates its space and knows that nothing came in after it read the previous before_stamp and write_stamp and the two matched. A previous fix dd9394257078 ("ring-buffer: Do not try to put back write_stamp") removed putting back the write_stamp to match the before_stamp so that the next event could use the delta, but races were found where the two would match, but not be for of the previous event. It was determined to allow the event reservation to not have a valid write_stamp when it is finished, and this fixed a lot of races. The last use of the 64-bit timestamp cmpxchg depended on the write_stamp being valid after an interruption. But this is no longer the case, as if an event is interrupted by a softirq that writes an event, and that event gets interrupted by a hardirq or NMI and that writes an event, then the softirq could finish its reservation without a valid write_stamp. In the slow path of the event reservation, a delta can still be used if the write_stamp is valid. Instead of using a cmpxchg against the write stamp, the before_stamp needs to be read again to validate the write_stamp. The cmpxchg is not needed. This updates the slowpath to validate the write_stamp by comparing it to the before_stamp and removes all rb_time_cmpxchg() as there are no more users of that function. The removal of the 32-bit updates of rb_time_t will be done in the next merge window" * tag 'trace-v6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Fix slowpath of interrupted event commit 81b9aeb7b995f3870d691ec5ea95518d5b169203 Author: Josip Pavic Date: Tue Dec 5 16:57:27 2023 -0500 drm/amd/display: dereference variable before checking for zero [Why] Driver incorrectly checks if pointer variable OutBpp is null instead of if the value being pointed to is zero. [How] Dereference OutBpp before checking for a value of zero. Reviewed-by: Chaitanya Dhere Acked-by: Wayne Lin Signed-off-by: Josip Pavic Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 51e7b64690776a9981355428b537af9048308a95 Author: Charlene Liu Date: Wed Dec 6 17:14:48 2023 -0500 drm/amd/display: get dprefclk ss info from integration info table [why & how] we have two SSC_En: we get ssc_info from dce_info for MPLL_SSC_EN. we used to call VBIOS cmdtbl's smu_info's SS persentage for DPRECLK SS info, is used for DP AUDIO and VBIOS' smu_info table was from systemIntegrationInfoTable. since dcn35 VBIOS removed smu_info, driver need to use integrationInfotable directly. Reviewed-by: Nicholas Kazlauskas Acked-by: Wayne Lin Signed-off-by: Charlene Liu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 19 ++++++++++++++----- .../drm/amd/display/include/grph_object_ctrl_defs.h | 2 ++ 2 files changed, 16 insertions(+), 5 deletions(-) commit 989824589f793120833bef13aa4e21f5a836a707 Author: Wayne Lin Date: Tue Dec 5 14:55:31 2023 +0800 drm/amd/display: Add case for dcn35 to support usb4 dmub hpd event [Why & how] Refactor dc_is_dmub_outbox_supported() a bit and add case for dcn35 to register dmub outbox notification irq to handle usb4 relevant hpd event. Reviewed-by: Roman Li Reviewed-by: Jun Lei Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) commit 3248211dd971ed2b614307eb42cecee3e6feecff Author: Hamza Mahfooz Date: Fri Dec 15 10:37:39 2023 -0500 drm/amd/display: disable FPO and SubVP for older DMUB versions on DCN32x There have recently been changes that break backwards compatibility, that were introduced into DMUB firmware (for DCN32x) concerning FPO and SubVP. So, since those are just power optimization features, we can just disable them unless the user is using a new enough version of DMUB firmware. Cc: stable@vger.kernel.org Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2870 Fixes: ed6e2782e974 ("drm/amd/display: For cursor P-State allow for SubVP") Reported-by: Mikhail Gavrilov Closes: https://lore.kernel.org/r/CABXGCsNRb0QbF2pKLJMDhVOKxyGD6-E+8p-4QO6FOWa6zp22_A@mail.gmail.com/ Reviewed-by: Harry Wentland Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 6 ++++++ 1 file changed, 6 insertions(+) commit ebab8c3eb6a6515dc14cd93fc29dd287709da6d3 Author: Philip Yang Date: Thu Dec 14 09:42:03 2023 -0500 drm/amdkfd: svm range always mapped flag not working on APU On gfx943 APU there is no VRAM and page migration, queue CWSR area, svm range with always mapped flag, is not mapped to GPU correctly. This works fine if retry fault on CWSR area can be recovered, but could cause deadlock if there is another retry fault recover waiting for CWSR to finish. Fix this by mapping svm range with always mapped flag to GPU with ACCESS attribute if XNACK ON. There is side effect, because all GPUs have ACCESS attribute by default on new svm range with XNACK on, the CWSR area will be mapped to all GPUs after this change. This side effect will be fixed with Thunk change to set CWSR svm range with ACCESS_IN_PLACE attribute on the GPU that user queue is created. Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) commit 9c749e61a1104ba9cf00519e723a7fa8ac55db0d Merge: 3f10e214a9de 9a733dc4fbee Author: Linus Torvalds Date: Tue Dec 19 12:19:25 2023 -0800 Merge tag 'arc-6.7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes from Vineet Gupta: - build error for hugetlb, sparse and smatch fixes - removal of VIPT aliasing cache code * tag 'arc-6.7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: add hugetlb definitions ARC: fix smatch warning ARC: fix spare error ARC: mm: retire support for aliasing VIPT D$ ARC: entry: move ARCompact specific bits out of entry.h ARC: entry: SAVE_ABI_CALLEE_REG: ISA/ABI specific helper commit 9dda0c07f00f511c112af135aa1ee349345037fa Author: Alvin Lee Date: Mon Dec 4 15:19:34 2023 -0500 drm/amd/display: Revert " drm/amd/display: Use channel_width = 2 for vram table 3.0" [Description] Revert commit fec05adc40c2 ("drm/amd/display: Use channel_width = 2 for vram table 3.0") Because the issue is being fixed from VBIOS side. Reviewed-by: Samson Tam Acked-by: Wayne Lin Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit 19cde9c92b8d3b7ee555d0da3bcb0232d3a784f4 Author: Jensen Huang Date: Thu Dec 7 16:21:59 2023 +0800 i2c: rk3x: fix potential spinlock recursion on poll Possible deadlock scenario (on reboot): rk3x_i2c_xfer_common(polling) -> rk3x_i2c_wait_xfer_poll() -> rk3x_i2c_irq(0, i2c); --> spin_lock(&i2c->lock); ... -> rk3x_i2c_irq(0, i2c); --> spin_lock(&i2c->lock); (deadlock here) Store the IRQ number and disable/enable it around the polling transfer. This patch has been tested on NanoPC-T4. Signed-off-by: Jensen Huang Reviewed-by: Heiko Stuebner Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-rk3x.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit 043465b66506e8c647cdd38a2db1f2ee0f369a1b Author: Yang Yingliang Date: Thu Nov 30 09:43:24 2023 +0800 i2c: qcom-geni: fix missing clk_disable_unprepare() and geni_se_resources_off() Add missing clk_disable_unprepare() and geni_se_resources_off() in the error path in geni_i2c_probe(). Fixes: 14d02fbadb5d ("i2c: qcom-geni: add desc struct to prepare support for I2C Master Hub variant") Signed-off-by: Yang Yingliang Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-qcom-geni.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 12d1e301bdfd1f2e2f371432dedef7cce8f01c4a Author: Shyam Prasad N Date: Fri Dec 15 17:16:56 2023 +0000 cifs: do not let cifs_chan_update_iface deallocate channels cifs_chan_update_iface is meant to check and update the server interface used for a channel when the existing server interface is no longer available. So far, this handler had the code to remove an interface entry even if a new candidate interface is not available. Allowing this leads to several corner cases to handle. This change makes the logic much simpler by not deallocating the current channel interface entry if a new interface is not found to replace it with. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/sess.c | 50 +++++++++++++++++++------------------------------- 1 file changed, 19 insertions(+), 31 deletions(-) commit f30bbc38704e279c06d073ecb18fea376791ecab Author: Shyam Prasad N Date: Fri Dec 15 17:16:55 2023 +0000 cifs: fix a pending undercount of srv_count The following commit reverted the changes to ref count the server struct while scheduling a reconnect work: 823342524868 Revert "cifs: reconnect work should have reference on server struct" However, a following change also introduced scheduling of reconnect work, and assumed ref counting. This change fixes that as well. Fixes umount problems like: [73496.157838] CPU: 5 PID: 1321389 Comm: umount Tainted: G W OE 6.7.0-060700rc6-generic #202312172332 [73496.157841] Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET67W (1.50 ) 12/15/2022 [73496.157843] RIP: 0010:cifs_put_tcp_session+0x17d/0x190 [cifs] [73496.157906] Code: 5d 31 c0 31 d2 31 f6 31 ff c3 cc cc cc cc e8 4a 6e 14 e6 e9 f6 fe ff ff be 03 00 00 00 48 89 d7 e8 78 26 b3 e5 e9 e4 fe ff ff <0f> 0b e9 b1 fe ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 [73496.157908] RSP: 0018:ffffc90003bcbcb8 EFLAGS: 00010286 [73496.157911] RAX: 00000000ffffffff RBX: ffff8885830fa800 RCX: 0000000000000000 [73496.157913] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [73496.157915] RBP: ffffc90003bcbcc8 R08: 0000000000000000 R09: 0000000000000000 [73496.157917] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [73496.157918] R13: ffff8887d56ba800 R14: 00000000ffffffff R15: ffff8885830fa800 [73496.157920] FS: 00007f1ff0e33800(0000) GS:ffff88887ba80000(0000) knlGS:0000000000000000 [73496.157922] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [73496.157924] CR2: 0000115f002e2010 CR3: 00000003d1e24005 CR4: 00000000003706f0 [73496.157926] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [73496.157928] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [73496.157929] Call Trace: [73496.157931] [73496.157933] ? show_regs+0x6d/0x80 [73496.157936] ? __warn+0x89/0x160 [73496.157939] ? cifs_put_tcp_session+0x17d/0x190 [cifs] [73496.157976] ? report_bug+0x17e/0x1b0 [73496.157980] ? handle_bug+0x51/0xa0 [73496.157983] ? exc_invalid_op+0x18/0x80 [73496.157985] ? asm_exc_invalid_op+0x1b/0x20 [73496.157989] ? cifs_put_tcp_session+0x17d/0x190 [cifs] [73496.158023] ? cifs_put_tcp_session+0x1e/0x190 [cifs] [73496.158057] __cifs_put_smb_ses+0x2b5/0x540 [cifs] [73496.158090] ? tconInfoFree+0xc2/0x120 [cifs] [73496.158130] cifs_put_tcon.part.0+0x108/0x2b0 [cifs] [73496.158173] cifs_put_tlink+0x49/0x90 [cifs] [73496.158220] cifs_umount+0x56/0xb0 [cifs] [73496.158258] cifs_kill_sb+0x52/0x60 [cifs] [73496.158306] deactivate_locked_super+0x32/0xc0 [73496.158309] deactivate_super+0x46/0x60 [73496.158311] cleanup_mnt+0xc3/0x170 [73496.158314] __cleanup_mnt+0x12/0x20 [73496.158330] task_work_run+0x5e/0xa0 [73496.158333] exit_to_user_mode_loop+0x105/0x130 [73496.158336] exit_to_user_mode_prepare+0xa5/0xb0 [73496.158338] syscall_exit_to_user_mode+0x29/0x60 [73496.158341] do_syscall_64+0x6c/0xf0 [73496.158344] ? syscall_exit_to_user_mode+0x37/0x60 [73496.158346] ? do_syscall_64+0x6c/0xf0 [73496.158349] ? exit_to_user_mode_prepare+0x30/0xb0 [73496.158353] ? syscall_exit_to_user_mode+0x37/0x60 [73496.158355] ? do_syscall_64+0x6c/0xf0 Reported-by: Robert Morris Fixes: 705fc522fe9d ("cifs: handle when server starts supporting multichannel") Signed-off-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/smb2pdu.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit d3e8b1858734bf46cda495be4165787b9a3981a6 Author: Keith Busch Date: Mon Dec 18 08:19:39 2023 -0800 Revert "nvme-fc: fix race between error recovery and creating association" The commit was identified to might sleep in invalid context and is blocking regression testing. This reverts commit ee6fdc5055e916b1dd497f11260d4901c4c1e55e. Link: https://lore.kernel.org/linux-nvme/hkhl56n665uvc6t5d6h3wtx7utkcorw4xlwi7d2t2bnonavhe6@xaan6pu43ap6/ Link: https://lists.infradead.org/pipermail/linux-nvme/2023-December/043756.html Reported-by: Daniel Wagner Reported-by: Maurizio Lombardi Cc: Michael Liang Tested-by: Daniel Wagner Reviewed-by: Daniel Wagner Reviewed-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch drivers/nvme/host/fc.c | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-) commit 3d940bb1818325142e6764bff788cbf95b9afb54 Author: Heiko Carstens Date: Thu Dec 7 15:24:34 2023 +0100 s390: update defconfigs Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev arch/s390/configs/debug_defconfig | 9 +++++---- arch/s390/configs/defconfig | 9 +++++---- arch/s390/configs/zfcpdump_defconfig | 3 +-- 3 files changed, 11 insertions(+), 10 deletions(-) commit 01fe654f78fd1ea4df046ef76b07ba92a35f8dbe Author: Zizhi Wo Date: Wed Dec 13 10:23:53 2023 +0800 fs: cifs: Fix atime update check Commit 9b9c5bea0b96 ("cifs: do not return atime less than mtime") indicates that in cifs, if atime is less than mtime, some apps will break. Therefore, it introduce a function to compare this two variables in two places where atime is updated. If atime is less than mtime, update it to mtime. However, the patch was handled incorrectly, resulting in atime and mtime being exactly equal. A previous commit 69738cfdfa70 ("fs: cifs: Fix atime update check vs mtime") fixed one place and forgot to fix another. Fix it. Fixes: 9b9c5bea0b96 ("cifs: do not return atime less than mtime") Cc: stable@vger.kernel.org Signed-off-by: Zizhi Wo Signed-off-by: Steve French fs/smb/client/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 567320c46a60a3c39b69aa1df802d753817a3f86 Author: Paulo Alcantara Date: Tue Dec 19 13:10:31 2023 -0300 smb: client: fix potential OOB in smb2_dump_detail() Validate SMB message with ->check_message() before calling ->calc_smb_size(). This fixes CVE-2023-6610. Reported-by: j51569436@gmail.com Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218219 Cc; stable@vger.kernel.org Signed-off-by: Paulo Alcantara Signed-off-by: Steve French fs/smb/client/smb2misc.c | 30 +++++++++++++++--------------- fs/smb/client/smb2ops.c | 6 ++++-- 2 files changed, 19 insertions(+), 17 deletions(-) commit 8f0f01647550daf9cd8752c1656dcb0136d79ce1 Author: Shengjiu Wang Date: Tue Dec 19 10:30:57 2023 +0800 ASoC: fsl_sai: Fix channel swap issue on i.MX8MP When flag mclk_with_tere and mclk_direction_output enabled, The SAI transmitter or receiver will be enabled in very early stage, that if FSL_SAI_xMR is set by previous case, for example previous case is one channel, current case is two channels, then current case started with wrong xMR in the beginning, then channel swap happen. The patch is to clear xMR in hw_free() to avoid such channel swap issue. Fixes: 3e4a82612998 ("ASoC: fsl_sai: MCLK bind with TX/RX enable bit") Signed-off-by: Shengjiu Wang Reviewed-by: Daniel Baluta Link: https://msgid.link/r/1702953057-4499-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown sound/soc/fsl/fsl_sai.c | 3 +++ 1 file changed, 3 insertions(+) commit 025222a9d6d25eee2ad9a1bb5a8b29b34b5ba576 Author: Jerome Brunet Date: Mon Dec 18 15:56:52 2023 +0100 ASoC: hdmi-codec: fix missing report for jack initial status This fixes a problem introduced while fixing ELD reporting with no jack set. Most driver using the hdmi-codec will call the 'plugged_cb' callback directly when registered to report the initial state of the HDMI connector. With the commit mentionned, this occurs before jack is ready and the initial report is lost for platforms actually providing a jack for HDMI. Fix this by storing the hdmi connector status regardless of jack being set or not and report the last status when jack gets set. With this, the initial state is reported correctly even if it is disconnected. This was not done initially and is also a fix. Fixes: 15be353d55f9 ("ASoC: hdmi-codec: register hpd callback on component probe") Reported-by: Zhengqiao Xia Closes: https://lore.kernel.org/alsa-devel/CADYyEwTNyY+fR9SgfDa-g6iiDwkU3MUdPVCYexs2_3wbcM8_vg@mail.gmail.com/ Cc: Hsin-Yi Wang Tested-by: Zhengqiao Xia Signed-off-by: Jerome Brunet Link: https://msgid.link/r/20231218145655.134929-1-jbrunet@baylibre.com Signed-off-by: Mark Brown sound/soc/codecs/hdmi-codec.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit 8353c2abc02cf8302d5e6177b706c1879e7b833c Merge: fa94a0c8424a 2258b666482d Author: Paolo Abeni Date: Tue Dec 19 13:13:59 2023 +0100 Merge branch 'check-vlan-filter-feature-in-vlan_vids_add_by_dev-and-vlan_vids_del_by_dev' Liu Jian says: ==================== check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() v2->v3: Filter using vlan_hw_filter_capable(). Add one basic test. ==================== Link: https://lore.kernel.org/r/20231216075219.2379123-1-liujian56@huawei.com Signed-off-by: Paolo Abeni commit 2258b666482d3326aec8b72ec3e009a2aad9582c Author: Liu Jian Date: Sat Dec 16 15:52:19 2023 +0800 selftests: add vlan hw filter tests Add one basic vlan hw filter test. Signed-off-by: Liu Jian Reviewed-by: Hangbin Liu Signed-off-by: Paolo Abeni tools/testing/selftests/net/Makefile | 1 + tools/testing/selftests/net/vlan_hw_filter.sh | 29 +++++++++++++++++++++++++++ 2 files changed, 30 insertions(+) commit 01a564bab4876007ce35f312e16797dfe40e4823 Author: Liu Jian Date: Sat Dec 16 15:52:18 2023 +0800 net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() I got the below warning trace: WARNING: CPU: 4 PID: 4056 at net/core/dev.c:11066 unregister_netdevice_many_notify CPU: 4 PID: 4056 Comm: ip Not tainted 6.7.0-rc4+ #15 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:unregister_netdevice_many_notify+0x9a4/0x9b0 Call Trace: rtnl_dellink rtnetlink_rcv_msg netlink_rcv_skb netlink_unicast netlink_sendmsg __sock_sendmsg ____sys_sendmsg ___sys_sendmsg __sys_sendmsg do_syscall_64 entry_SYSCALL_64_after_hwframe It can be repoduced via: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode 0 ip netns exec ns1 ip link add bond_slave_1 type veth peer veth2 ip netns exec ns1 ip link set bond_slave_1 master bond0 [1] ip netns exec ns1 ethtool -K bond0 rx-vlan-filter off [2] ip netns exec ns1 ip link add link bond_slave_1 name bond_slave_1.0 type vlan id 0 [3] ip netns exec ns1 ip link add link bond0 name bond0.0 type vlan id 0 [4] ip netns exec ns1 ip link set bond_slave_1 nomaster [5] ip netns exec ns1 ip link del veth2 ip netns del ns1 This is all caused by command [1] turning off the rx-vlan-filter function of bond0. The reason is the same as commit 01f4fd270870 ("bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves"). Commands [2] [3] add the same vid to slave and master respectively, causing command [4] to empty slave->vlan_info. The following command [5] triggers this problem. To fix this problem, we should add VLAN_FILTER feature checks in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() to prevent incorrect addition or deletion of vlan_vid information. Fixes: 348a1443cc43 ("vlan: introduce functions to do mass addition/deletion of vids by another device") Signed-off-by: Liu Jian Signed-off-by: Paolo Abeni net/8021q/vlan_core.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit fa94a0c8424a5e1bd184bf1f05fbcd5914ce283d Author: Jijie Shao Date: Sat Dec 16 15:04:13 2023 +0800 net: hns3: add new maintainer for the HNS3 ethernet driver Jijie Shao will be responsible for maintaining the hns3 driver's code in the future, so add Jijie to the hns3 driver's matainer list. Signed-off-by: Jijie Shao Link: https://lore.kernel.org/r/20231216070413.233668-1-shaojijie@huawei.com Signed-off-by: Paolo Abeni MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit 340943fbff3d8faa44d2223ca04917df28786a07 Author: Yury Norov Date: Fri Dec 15 12:33:53 2023 -0800 net: mana: select PAGE_POOL Mana uses PAGE_POOL API. x86_64 defconfig doesn't select it: ld: vmlinux.o: in function `mana_create_page_pool.isra.0': mana_en.c:(.text+0x9ae36f): undefined reference to `page_pool_create' ld: vmlinux.o: in function `mana_get_rxfrag': mana_en.c:(.text+0x9afed1): undefined reference to `page_pool_alloc_pages' make[3]: *** [/home/yury/work/linux/scripts/Makefile.vmlinux:37: vmlinux] Error 1 make[2]: *** [/home/yury/work/linux/Makefile:1154: vmlinux] Error 2 make[1]: *** [/home/yury/work/linux/Makefile:234: __sub-make] Error 2 make[1]: Leaving directory '/home/yury/work/build-linux-x86_64' make: *** [Makefile:234: __sub-make] Error 2 So we need to select it explicitly. Signed-off-by: Yury Norov Reviewed-by: Simon Horman Tested-by: Simon Horman # build-tested Fixes: ca9c54d2 ("net: mana: Add a driver for Microsoft Azure Network Adapter") Link: https://lore.kernel.org/r/20231215203353.635379-1-yury.norov@gmail.com Signed-off-by: Paolo Abeni drivers/net/ethernet/microsoft/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 3dc5d44545453de1de9c53cc529cc960a85933da Author: Ronald Wahl Date: Thu Dec 14 19:11:12 2023 +0100 net: ks8851: Fix TX stall caused by TX buffer overrun There is a bug in the ks8851 Ethernet driver that more data is written to the hardware TX buffer than actually available. This is caused by wrong accounting of the free TX buffer space. The driver maintains a tx_space variable that represents the TX buffer space that is deemed to be free. The ks8851_start_xmit_spi() function adds an SKB to a queue if tx_space is large enough and reduces tx_space by the amount of buffer space it will later need in the TX buffer and then schedules a work item. If there is not enough space then the TX queue is stopped. The worker function ks8851_tx_work() dequeues all the SKBs and writes the data into the hardware TX buffer. The last packet will trigger an interrupt after it was send. Here it is assumed that all data fits into the TX buffer. In the interrupt routine (which runs asynchronously because it is a threaded interrupt) tx_space is updated with the current value from the hardware. Also the TX queue is woken up again. Now it could happen that after data was sent to the hardware and before handling the TX interrupt new data is queued in ks8851_start_xmit_spi() when the TX buffer space had still some space left. When the interrupt is actually handled tx_space is updated from the hardware but now we already have new SKBs queued that have not been written to the hardware TX buffer yet. Since tx_space has been overwritten by the value from the hardware the space is not accounted for. Now we have more data queued then buffer space available in the hardware and ks8851_tx_work() will potentially overrun the hardware TX buffer. In many cases it will still work because often the buffer is written out fast enough so that no overrun occurs but for example if the peer throttles us via flow control then an overrun may happen. This can be fixed in different ways. The most simple way would be to set tx_space to 0 before writing data to the hardware TX buffer preventing the queuing of more SKBs until the TX interrupt has been handled. I have chosen a slightly more efficient (and still rather simple) way and track the amount of data that is already queued and not yet written to the hardware. When new SKBs are to be queued the already queued amount of data is honoured when checking free TX buffer space. I tested this with a setup of two linked KS8851 running iperf3 between the two in bidirectional mode. Before the fix I got a stall after some minutes. With the fix I saw now issues anymore after hours. Fixes: 3ba81f3ece3c ("net: Micrel KS8851 SPI network driver") Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Ben Dooks Cc: Tristram Ha Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org # 5.10+ Signed-off-by: Ronald Wahl Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20231214181112.76052-1-rwahl@gmx.de Signed-off-by: Paolo Abeni drivers/net/ethernet/micrel/ks8851.h | 3 +++ drivers/net/ethernet/micrel/ks8851_common.c | 20 +++++++------- drivers/net/ethernet/micrel/ks8851_spi.c | 42 ++++++++++++++++++----------- 3 files changed, 40 insertions(+), 25 deletions(-) commit d4005431673929a1259ad791db87408fcf85d2cc Author: Srinivas Pandruvada Date: Sun Dec 17 12:07:03 2023 -0800 Revert "iio: hid-sensor-als: Add light color temperature support" This reverts commit 5f05285df691b1e82108eead7165feae238c95ef. This commit assumes that every HID descriptor for ALS sensor has presence of usage id ID HID_USAGE_SENSOR_LIGHT_COLOR_TEMPERATURE. When the above usage id is absent, driver probe fails. This breaks ALS sensor functionality on many platforms. Till we have a good solution, revert this commit. Reported-by: Thomas Weißschuh Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218223 Signed-off-by: Srinivas Pandruvada Cc: Acked-by: Jonathan Cameron Link: https://lore.kernel.org/r/20231217200703.719876-3-srinivas.pandruvada@linux.intel.com Signed-off-by: Greg Kroah-Hartman drivers/iio/light/hid-sensor-als.c | 37 ++----------------------------------- include/linux/hid-sensor-ids.h | 1 - 2 files changed, 2 insertions(+), 36 deletions(-) commit b9670ee2e975e1cb6751019d5dc5c193aecd8ba2 Author: Srinivas Pandruvada Date: Sun Dec 17 12:07:02 2023 -0800 Revert "iio: hid-sensor-als: Add light chromaticity support" This reverts commit ee3710f39f9d0ae5137a866138d005fe1ad18132. This commit assumes that every HID descriptor for ALS sensor has presence of usage id ID HID_USAGE_SENSOR_LIGHT_CHROMATICITY_X and HID_USAGE_SENSOR_LIGHT_CHROMATICITY_Y. When the above usage ids are absent, driver probe fails. This breaks ALS sensor functionality on many platforms. Till we have a good solution, revert this commit. Reported-by: Thomas Weißschuh Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218223 Signed-off-by: Srinivas Pandruvada Cc: Acked-by: Jonathan Cameron Link: https://lore.kernel.org/r/20231217200703.719876-2-srinivas.pandruvada@linux.intel.com Signed-off-by: Greg Kroah-Hartman drivers/iio/light/hid-sensor-als.c | 63 -------------------------------------- include/linux/hid-sensor-ids.h | 3 -- 2 files changed, 66 deletions(-) commit b803d7c664d55705831729d2f2e29c874bcd62ea Author: Steven Rostedt (Google) Date: Mon Dec 18 23:07:12 2023 -0500 ring-buffer: Fix slowpath of interrupted event To synchronize the timestamps with the ring buffer reservation, there are two timestamps that are saved in the buffer meta data. 1. before_stamp 2. write_stamp When the two are equal, the write_stamp is considered valid, as in, it may be used to calculate the delta of the next event as the write_stamp is the timestamp of the previous reserved event on the buffer. This is done by the following: /*A*/ w = current position on the ring buffer before = before_stamp after = write_stamp ts = read current timestamp if (before != after) { write_stamp is not valid, force adding an absolute timestamp. } /*B*/ before_stamp = ts /*C*/ write = local_add_return(event length, position on ring buffer) if (w == write - event length) { /* Nothing interrupted between A and C */ /*E*/ write_stamp = ts; delta = ts - after /* * If nothing interrupted again, * before_stamp == write_stamp and write_stamp * can be used to calculate the delta for * events that come in after this one. */ } else { /* * The slow path! * Was interrupted between A and C. */ This is the place that there's a bug. We currently have: after = write_stamp ts = read current timestamp /*F*/ if (write == current position on the ring buffer && after < ts && cmpxchg(write_stamp, after, ts)) { delta = ts - after; } else { delta = 0; } The assumption is that if the current position on the ring buffer hasn't moved between C and F, then it also was not interrupted, and that the last event written has a timestamp that matches the write_stamp. That is the write_stamp is valid. But this may not be the case: If a task context event was interrupted by softirq between B and C. And the softirq wrote an event that got interrupted by a hard irq between C and E. and the hard irq wrote an event (does not need to be interrupted) We have: /*B*/ before_stamp = ts of normal context ---> interrupted by softirq /*B*/ before_stamp = ts of softirq context ---> interrupted by hardirq /*B*/ before_stamp = ts of hard irq context /*E*/ write_stamp = ts of hard irq context /* matches and write_stamp valid */ <---- /*E*/ write_stamp = ts of softirq context /* No longer matches before_stamp, write_stamp is not valid! */ <--- w != write - length, go to slow path // Right now the order of events in the ring buffer is: // // |-- softirq event --|-- hard irq event --|-- normal context event --| // after = write_stamp (this is the ts of softirq) ts = read current timestamp if (write == current position on the ring buffer [true] && after < ts [true] && cmpxchg(write_stamp, after, ts) [true]) { delta = ts - after [Wrong!] The delta is to be between the hard irq event and the normal context event, but the above logic made the delta between the softirq event and the normal context event, where the hard irq event is between the two. This will shift all the remaining event timestamps on the sub-buffer incorrectly. The write_stamp is only valid if it matches the before_stamp. The cmpxchg does nothing to help this. Instead, the following logic can be done to fix this: before = before_stamp ts = read current timestamp before_stamp = ts after = write_stamp if (write == current position on the ring buffer && after == before && after < ts) { delta = ts - after } else { delta = 0; } The above will only use the write_stamp if it still matches before_stamp and was tested to not have changed since C. As a bonus, with this logic we do not need any 64-bit cmpxchg() at all! This means the 32-bit rb_time_t workaround can finally be removed. But that's for a later time. Link: https://lore.kernel.org/linux-trace-kernel/20231218175229.58ec3daf@gandalf.local.home/ Link: https://lore.kernel.org/linux-trace-kernel/20231218230712.3a76b081@gandalf.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Linus Torvalds Fixes: dd93942570789 ("ring-buffer: Do not try to put back write_stamp") Signed-off-by: Steven Rostedt (Google) kernel/trace/ring_buffer.c | 79 ++++++++++++++-------------------------------- 1 file changed, 24 insertions(+), 55 deletions(-) commit 04c116e2bdfc3969f9819d2cebfdf678353c354c Author: Can Guo Date: Mon Dec 18 07:32:17 2023 -0800 scsi: ufs: core: Let the sq_lock protect sq_tail_slot access When accessing sq_tail_slot without protection from sq_lock, a race condition can cause multiple SQEs to be copied to duplicate SQE slots. This can lead to multiple stability issues. Fix this by moving the *dest initialization in ufshcd_send_command() back under protection from the sq_lock. Fixes: 3c85f087faec ("scsi: ufs: mcq: Use pointer arithmetic in ufshcd_send_command()") Signed-off-by: Can Guo Link: https://lore.kernel.org/r/1702913550-20631-1-git-send-email-quic_cang@quicinc.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 9264fd61e628ce180a168e6b90bde134dd49ec28 Author: ChanWoo Lee Date: Fri Dec 15 09:38:12 2023 +0900 scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in ufs_qcom_clk_scale_notify() In commit 031312dbc695 ("scsi: ufs: ufs-qcom: Remove unnecessary goto statements") the error handling was accidentally changed, resulting in the error of ufs_qcom_clk_scale_*() calls not being returned. This is the case I checked: ufs_qcom_clk_scale_notify -> 'ufs_qcom_clk_scale_up_/down_pre_change' error -> return 0; Make sure those errors are properly returned. Fixes: 031312dbc695 ("scsi: ufs: ufs-qcom: Remove unnecessary goto statements") Reviewed-by: Manivannan Sadhasivam Signed-off-by: ChanWoo Lee Link: https://lore.kernel.org/r/20231215003812.29650-1-cw9316.lee@samsung.com Reviewed-by: Andrew Halaney Signed-off-by: Martin K. Petersen drivers/ufs/host/ufs-qcom.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 066c5b46b6eaf2f13f80c19500dbb3b84baabb33 Author: Alexander Atanasov Date: Fri Dec 15 14:10:08 2023 +0200 scsi: core: Always send batch on reset or error handling command In commit 8930a6c20791 ("scsi: core: add support for request batching") the block layer bd->last flag was mapped to SCMD_LAST and used as an indicator to send the batch for the drivers that implement this feature. However, the error handling code was not updated accordingly. scsi_send_eh_cmnd() is used to send error handling commands and request sense. The problem is that request sense comes as a single command that gets into the batch queue and times out. As a result the device goes offline after several failed resets. This was observed on virtio_scsi during a device resize operation. [ 496.316946] sd 0:0:4:0: [sdd] tag#117 scsi_eh_0: requesting sense [ 506.786356] sd 0:0:4:0: [sdd] tag#117 scsi_send_eh_cmnd timeleft: 0 [ 506.787981] sd 0:0:4:0: [sdd] tag#117 abort To fix this always set SCMD_LAST flag in scsi_send_eh_cmnd() and scsi_reset_ioctl(). Fixes: 8930a6c20791 ("scsi: core: add support for request batching") Cc: Signed-off-by: Alexander Atanasov Link: https://lore.kernel.org/r/20231215121008.2881653-1-alexander.atanasov@virtuozzo.com Reviewed-by: Ming Lei Signed-off-by: Martin K. Petersen drivers/scsi/scsi_error.c | 2 ++ 1 file changed, 2 insertions(+) commit 08c94d80b2da481652fb633e79cbc41e9e326a91 Author: Wei Yongjun Date: Mon Nov 14 11:06:26 2022 +0000 scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() skb_share_check() already drops the reference to the skb when returning NULL. Using kfree_skb() in the error handling path leads to an skb double free. Fix this by removing the variable tmp_skb, and return directly when skb_share_check() returns NULL. Fixes: 01a4cc4d0cd6 ("bnx2fc: do not add shared skbs to the fcoe_rx_list") Signed-off-by: Wei Yongjun Link: https://lore.kernel.org/r/20221114110626.526643-1-weiyongjun@huaweicloud.com Signed-off-by: Martin K. Petersen drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit 3f10e214a9de738832b357a58b605c2fbd23aa96 Merge: 2cf4f94d8e86 6eb04ca8c52e Author: Linus Torvalds Date: Mon Dec 18 16:47:21 2023 -0800 Merge tag 'hid-for-linus-2023121901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - fix for division by zero in Nintendo driver when generic joycon is attached, reported and fixed by SteamOS folks (Guilherme G. Piccoli) - GCC-7 build fix (which is a good cleanup anyway) for Nintendo driver (Ryan McClelland) * tag 'hid-for-linus-2023121901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: nintendo: Prevent divide-by-zero on code HID: nintendo: fix initializer element is not constant error commit bd018b98ba84ca0c80abac1ef23ce726a809e58c Author: Chuck Lever Date: Mon Dec 18 17:05:40 2023 -0500 SUNRPC: Revert 5f7fc5d69f6e92ec0b38774c387f5cf7812c5806 Guillaume says: > I believe commit 5f7fc5d69f6e ("SUNRPC: Resupply rq_pages from > node-local memory") in Linux 6.5+ is incorrect. It passes > unconditionally rq_pool->sp_id as the NUMA node. > > While the comment in the svc_pool declaration in sunrpc/svc.h says > that sp_id is also the NUMA node id, it might not be the case if > the svc is created using svc_create_pooled(). svc_created_pooled() > can use the per-cpu pool mode therefore in this case sp_id would > be the cpu id. Fix this by reverting now. At a later point this minor optimization, and the deceptive labeling of the sp_id field, can be revisited. Reported-by: Guillaume Morin Closes: https://lore.kernel.org/linux-nfs/ZYC9rsno8qYggVt9@bender.morinfr.org/T/#u Fixes: 5f7fc5d69f6e ("SUNRPC: Resupply rq_pages from node-local memory") Signed-off-by: Chuck Lever net/sunrpc/svc_xprt.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 6eb04ca8c52e3f8c8ea7102ade81d642eee87f4a Author: Guilherme G. Piccoli Date: Tue Dec 5 18:15:51 2023 -0300 HID: nintendo: Prevent divide-by-zero on code It was reported [0] that adding a generic joycon to the system caused a kernel crash on Steam Deck, with the below panic spew: divide error: 0000 [#1] PREEMPT SMP NOPTI [...] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0119 10/24/2023 RIP: 0010:nintendo_hid_event+0x340/0xcc1 [hid_nintendo] [...] Call Trace: [...] ? exc_divide_error+0x38/0x50 ? nintendo_hid_event+0x340/0xcc1 [hid_nintendo] ? asm_exc_divide_error+0x1a/0x20 ? nintendo_hid_event+0x307/0xcc1 [hid_nintendo] hid_input_report+0x143/0x160 hidp_session_run+0x1ce/0x700 [hidp] Since it's a divide-by-0 error, by tracking the code for potential denominator issues, we've spotted 2 places in which this could happen; so let's guard against the possibility and log in the kernel if the condition happens. This is specially useful since some data that fills some denominators are read from the joycon HW in some cases, increasing the potential for flaws. [0] https://github.com/ValveSoftware/SteamOS/issues/1070 Signed-off-by: Guilherme G. Piccoli Tested-by: Sam Lantinga Signed-off-by: Jiri Kosina drivers/hid/hid-nintendo.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) commit 2cf4f94d8e8646803f8fb0facf134b0cd7fb691a Merge: 26d6084791bb 77a672556096 Author: Linus Torvalds Date: Mon Dec 18 11:11:09 2023 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two medium sized fixes, both in drivers. The UFS one adds parsing of clock info structures, which is required by some host drivers and the aacraid one reverts the IRQ affinity mapping patch which has been causing regressions noted in kernel bugzilla 217599" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Store min and max clk freq from OPP table Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity" commit 26d6084791bb2cce41b83cb09b4cfdd9fa0c28f1 Merge: ceb6a6f023fd fc70d643a2f6 Author: Linus Torvalds Date: Mon Dec 18 10:59:57 2023 -0800 Merge tag 'spi-fix-v6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few bigger things here, the main one being that there were changes to the atmel driver in this cycle which made it possible to kill transfers being used for filesystem I/O which turned out to be very disruptive, the series of patches here undoes that and hardens things up further. There's also a few smaller driver specific changes, the main one being to revert a change that duplicted delays" * tag 'spi-fix-v6.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: atmel: Fix clock issue when using devices with different polarities spi: spi-imx: correctly configure burst length when using dma spi: cadence: revert "Add SPI transfer delays" spi: atmel: Prevent spi transfers from being killed spi: atmel: Drop unused defines spi: atmel: Do not cancel a transfer upon any signal commit 5d6f447b07d5432686ba69183af6e96ac58069c9 Author: Mike Snitzer Date: Wed Dec 13 14:49:12 2023 -0500 MAINTAINERS: remove stale info for DEVICE-MAPPER Signed-off-by: Mike Snitzer MAINTAINERS | 2 -- 1 file changed, 2 deletions(-) commit 6849302fdff126997765d16df355b73231f130d4 Author: Mike Snitzer Date: Wed Dec 13 14:46:19 2023 -0500 dm audit: fix Kconfig so DM_AUDIT depends on BLK_DEV_DM Signed-off-by: Mike Snitzer drivers/md/Kconfig | 1 + 1 file changed, 1 insertion(+) commit b86f4b790c998afdbc88fe1aa55cfe89c4068726 Author: Mikulas Patocka Date: Tue Dec 5 16:39:16 2023 +0100 dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() __bio_for_each_segment assumes that the first struct bio_vec argument doesn't change - it calls "bio_advance_iter_single((bio), &(iter), (bvl).bv_len)" to advance the iterator. Unfortunately, the dm-integrity code changes the bio_vec with "bv.bv_len -= pos". When this code path is taken, the iterator would be out of sync and dm-integrity would report errors. This happens if the machine is out of memory and "kmalloc" fails. Fix this bug by making a copy of "bv" and changing the copy instead. Fixes: 7eada909bfd7 ("dm: add integrity target") Cc: stable@vger.kernel.org # v4.12+ Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-integrity.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit db29d79b34d9593179de5f868be45c650923e7b4 Author: Yu Kuai Date: Fri Nov 24 15:59:53 2023 +0800 dm-raid: delay flushing event_work() after reconfig_mutex is released After commit db5e653d7c9f ("md: delay choosing sync action to md_start_sync()"), md_start_sync() will hold 'reconfig_mutex', however, in order to make sure event_work is done, __md_stop() will flush workqueue with reconfig_mutex grabbed, hence if sync_work is still pending, deadlock will be triggered. Fortunately, former pacthes to fix stopping sync_thread already make sure all sync_work is done already, hence such deadlock is not possible anymore. However, in order not to cause confusions for people by this implicit dependency, delay flushing event_work to dm-raid where 'reconfig_mutex' is not held, and add some comments to emphasize that the workqueue can't be flushed with 'reconfig_mutex'. Fixes: db5e653d7c9f ("md: delay choosing sync action to md_start_sync()") Depends-on: f52f5c71f3d4 ("md: fix stopping sync thread") Signed-off-by: Yu Kuai Acked-by: Xiao Ni Signed-off-by: Mike Snitzer drivers/md/dm-raid.c | 3 +++ drivers/md/md.c | 11 ++++++++--- 2 files changed, 11 insertions(+), 3 deletions(-) commit ae53e2198cb811f7ee7c5cd4580bf42e88086fa5 Author: Stefan Binding Date: Mon Dec 18 15:12:21 2023 +0000 ALSA: hda/realtek: Add quirks for ASUS Zenbook 2023 Models These models use 2xCS35L41amps with HDA using SPI and I2C. Models use internal and external boost. All models require DSD support to be added inside cs35l41_hda_property.c Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231218151221.388745-8-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 4 ++++ 1 file changed, 4 insertions(+) commit 2b35b66d82dc4641ba60f7f3c36c0040eedb74e2 Author: Stefan Binding Date: Mon Dec 18 15:12:20 2023 +0000 ALSA: hda: cs35l41: Support additional ASUS Zenbook 2023 Models Add new model entries into configuration table. Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231218151221.388745-7-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda_property.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 51d976079976c800ef19ed1b542602fcf63f0edb Author: Stefan Binding Date: Mon Dec 18 15:12:19 2023 +0000 ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models These models use 2xCS35L41amps with HDA using SPI and I2C. Models use internal and external boost. All models require DSD support to be added inside cs35l41_hda_property.c Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231218151221.388745-6-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit b257187bcff4bccc9e7a8f1b8a1a5526ff815af1 Author: Stefan Binding Date: Mon Dec 18 15:12:18 2023 +0000 ALSA: hda: cs35l41: Support additional ASUS Zenbook 2022 Models Add new model entries into configuration table. Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231218151221.388745-5-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda_property.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit a40ce9f4bdbebfbf55fdd83a5284fbaaf222f0b9 Author: Stefan Binding Date: Mon Dec 18 15:12:17 2023 +0000 ALSA: hda/realtek: Add quirks for ASUS ROG 2023 models These models use 2xCS35L41amps with HDA using SPI and I2C. All models use Internal Boost. Some models also use Realtek Speakers in conjunction with CS35L41. All models require DSD support to be added inside cs35l41_hda_property.c Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231218151221.388745-4-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) commit b592ed2e1d78a475f781802e441c499ab446975b Author: Stefan Binding Date: Mon Dec 18 15:12:16 2023 +0000 ALSA: hda: cs35l41: Support additional ASUS ROG 2023 models Add new model entries into configuration table. Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231218151221.388745-3-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda_property.c | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) commit 8c4c216db8fb84be9c4ca60d72b88882066cf28f Author: Stefan Binding Date: Mon Dec 18 15:12:15 2023 +0000 ALSA: hda: cs35l41: Add config table to support many laptops without _DSD This make use of the CS35L41 HDA Property framework, which supports laptops which do not have the _DSD properties in their ACPI. Add configuration table to be able to use a generic function which allows laptops to be supported just by adding an entry into the table. Use configuration table function for existing system 103C89C6. Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231218151221.388745-2-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda.c | 2 + sound/pci/hda/cs35l41_hda.h | 5 +- sound/pci/hda/cs35l41_hda_property.c | 304 ++++++++++++++++++++++++++++++----- 3 files changed, 269 insertions(+), 42 deletions(-) commit f5728a418945ba53e2fdf38a6e5c5a2670965e85 Author: Larysa Zaremba Date: Tue Dec 12 10:29:01 2023 +0100 ice: Fix PF with enabled XDP going no-carrier after reset Commit 6624e780a577fc596788 ("ice: split ice_vsi_setup into smaller functions") has refactored a bunch of code involved in PFR. In this process, TC queue number adjustment for XDP was lost. Bring it back. Lack of such adjustment causes interface to go into no-carrier after a reset, if XDP program is attached, with the following message: ice 0000:b1:00.0: Failed to set LAN Tx queue context, error: -22 ice 0000:b1:00.0 ens801f0np0: Failed to open VSI 0x0006 on switch 0x0001 ice 0000:b1:00.0: enable VSI failed, err -22, VSI index 0, type ICE_VSI_PF ice 0000:b1:00.0: PF VSI rebuild failed: -22 ice 0000:b1:00.0: Rebuild failed, unload and reload driver Fixes: 6624e780a577 ("ice: split ice_vsi_setup into smaller functions") Reviewed-by: Przemek Kitszel Signed-off-by: Larysa Zaremba Reviewed-by: Simon Horman Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_lib.c | 3 +++ 1 file changed, 3 insertions(+) commit 4d50fcdc2476eef94c14c6761073af5667bb43b6 Author: Dave Ertman Date: Mon Dec 11 13:19:28 2023 -0800 ice: alter feature support check for SRIOV and LAG Previously, the ice driver had support for using a handler for bonding netdev events to ensure that conflicting features were not allowed to be activated at the same time. While this was still in place, additional support was added to specifically support SRIOV and LAG together. These both utilized the netdev event handler, but the SRIOV and LAG feature was behind a capabilities feature check to make sure the current NVM has support. The exclusion part of the event handler should be removed since there are users who have custom made solutions that depend on the non-exclusion of features. Wrap the creation/registration and cleanup of the event handler and associated structs in the probe flow with a feature check so that the only systems that support the full implementation of LAG features will initialize support. This will leave other systems unhindered with functionality as it existed before any LAG code was added. Fixes: bb52f42acef6 ("ice: Add driver support for firmware changes for LAG") Reviewed-by: Jesse Brandeburg Signed-off-by: Dave Ertman Reviewed-by: Simon Horman Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_lag.c | 2 ++ 1 file changed, 2 insertions(+) commit 7d881346121a97756f34e00e6296a5d63f001f7f Author: Jacob Keller Date: Wed Dec 6 12:19:05 2023 -0800 ice: stop trashing VF VSI aggregator node ID information When creating new VSIs, they are assigned into an aggregator node in the scheduler tree. Information about which aggregator node a VSI is assigned into is maintained by the vsi->agg_node structure. In ice_vsi_decfg(), this information is being destroyed, by overwriting the valid flag and the agg_id field to zero. For VF VSIs, this breaks the aggregator node configuration replay, which depends on this information. This results in VFs being inserted into the default aggregator node. The resulting configuration will have unexpected Tx bandwidth sharing behavior. This was broken by commit 6624e780a577 ("ice: split ice_vsi_setup into smaller functions"), which added the block to reset the agg_node data. The vsi->agg_node structure is not managed by the scheduler code, but is instead a wrapper around an aggregator node ID that is tracked at the VSI layer. Its been around for a long time, and its primary purpose was for handling VFs. The SR-IOV VF reset flow does not make use of the standard VSI rebuild/replay logic, and uses vsi->agg_node as part of its handling to rebuild the aggregator node configuration. The logic for aggregator nodes stretches back to early ice driver code from commit b126bd6bcd67 ("ice: create scheduler aggregator node config and move VSIs") The logic in ice_vsi_decfg() which trashes the ice_agg_node data is clearly wrong. It destroys information that is necessary for handling VF reset,. It is also not the correct way to actually remove a VSI from an aggregator node. For that, we need to implement logic in the scheduler code. Further, non-VF VSIs properly replay their aggregator configuration using existing scheduler replay logic. To fix the VF replay logic, remove this broken aggregator node cleanup logic. This is the simplest way to immediately fix this. This ensures that VFs will have proper aggregate configuration after a reset. This is especially important since VFs often perform resets as part of their reconfiguration flows. Without fixing this, VFs will be placed in the default aggregator node and Tx bandwidth will not be shared in the expected and configured manner. Fixes: 6624e780a577 ("ice: split ice_vsi_setup into smaller functions") Signed-off-by: Jacob Keller Reviewed-by: Przemek Kitszel Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_lib.c | 4 ---- 1 file changed, 4 deletions(-) commit 1227561c2ffb81ab09ead21cce6438f59276aa6e Author: Chuck Lever Date: Sat Dec 16 12:12:50 2023 -0500 NFSD: Revert 738401a9bd1ac34ccd5723d69640a4adbb1a4bc0 There's nothing wrong with this commit, but this is dead code now that nothing triggers a CB_GETATTR callback. It can be re-introduced once the issues with handling conflicting GETATTRs are resolved. Signed-off-by: Chuck Lever fs/nfsd/nfs4callback.c | 97 +------------------------------------------------- fs/nfsd/state.h | 14 -------- fs/nfsd/xdr4cb.h | 18 ---------- 3 files changed, 1 insertion(+), 128 deletions(-) commit 862bee84d77fa01cc8929656ae77781abf917863 Author: Chuck Lever Date: Sat Dec 16 11:57:43 2023 -0500 NFSD: Revert 6c41d9a9bd0298002805758216a9c44e38a8500d For some reason, the wait_on_bit() in nfsd4_deleg_getattr_conflict() is waiting forever, preventing a clean server shutdown. The requesting client might also hang waiting for a reply to the conflicting GETATTR. Invoking wait_on_bit() in an nfsd thread context is a hazard. The correct fix is to replace this wait_on_bit() call site with a mechanism that defers the conflicting GETATTR until the CB_GETATTR completes or is known to have failed. That will require some surgery and extended testing and it's late in the v6.7-rc cycle, so I'm reverting now in favor of trying again in a subsequent kernel release. This is my fault: I should have recognized the ramifications of calling wait_on_bit() in here before accepting this patch. Thanks to Dai Ngo for diagnosing the issue. Reported-by: Wolfgang Walter Closes: https://lore.kernel.org/linux-nfs/e3d43ecdad554fbdcaa7181833834f78@stwm.de/ Signed-off-by: Chuck Lever fs/nfsd/nfs4state.c | 114 +++++----------------------------------------------- fs/nfsd/nfs4xdr.c | 7 +--- fs/nfsd/state.h | 11 +---- 3 files changed, 14 insertions(+), 118 deletions(-) commit b1b6131bca35a55a69fadc39d51577968fa2ee97 Author: Hans de Goede Date: Sun Dec 17 22:32:21 2023 +0100 ASoC: Intel: bytcr_rt5640: Add new swapped-speakers quirk Some BYTCR x86 tablets with a rt5640 codec have the left and right channels of their speakers swapped. Add a new BYT_RT5640_SWAPPED_SPEAKERS quirk for this which sets cfg-spk:swapped in the components string to let userspace know about the swapping so that the UCM profile can configure the mixer to correct this. Enable this new quirk on the Medion Lifetab S10346 which has its speakers swapped. Signed-off-by: Hans de Goede Acked-by: Pierre-Louis Bossart Link: https://msgid.link/r/20231217213221.49424-2-hdegoede@redhat.com Signed-off-by: Mark Brown sound/soc/intel/boards/bytcr_rt5640.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) commit 99c7bb44f5749373bc01b73af02b50b69bcbf43d Author: Hans de Goede Date: Sun Dec 17 22:32:20 2023 +0100 ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346 Add a quirk for the Medion Lifetab S10346, this BYTCR tablet has no CHAN package in its ACPI tables and uses SSP0-AIF1 rather then SSP0-AIF2 which is the default for BYTCR devices. Signed-off-by: Hans de Goede Acked-by: Pierre-Louis Bossart Link: https://msgid.link/r/20231217213221.49424-1-hdegoede@redhat.com Signed-off-by: Mark Brown sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 49e0a85ec3441edc6c77aa40206d6e5ee4597efc Author: Ville Syrjälä Date: Mon Dec 11 23:37:47 2023 +0200 drm/i915/dmc: Don't enable any pipe DMC events The pipe DMC seems to be making a mess of things in ADL. Various weird symptoms have been observed such as missing vblank irqs, typicalle happening when using multiple displays. Keep all pipe DMC event handlers disabled until needed (which is never atm). This is also what Windows does on ADL+. We can also drop DG2 from disable_all_flip_queue_events() since on DG2 the pipe DMC is the one that handles the flip queue events. Cc: stable@vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8685 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20231211213750.27109-2-ville.syrjala@linux.intel.com Reviewed-by: Imre Deak (cherry picked from commit 648d7be8ecf47b0556e32550145c70db153b16fb) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/intel_dmc.c | 43 ++++++++++++++++++++++++++++++-- 1 file changed, 41 insertions(+), 2 deletions(-) commit dbcab554f777390d9bb6a808ed0cd90ee59bb44e Author: Imre Deak Date: Thu Dec 14 00:05:26 2023 +0200 drm/i915/mtl: Fix HDMI/DP PLL clock selection Select the HDMI specific PLL clock only for HDMI outputs. Fixes: 62618c7f117e ("drm/i915/mtl: C20 PLL programming") Cc: Mika Kahola Cc: Radhakrishna Sripada Reviewed-by: Radhakrishna Sripada Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20231213220526.1828827-1-imre.deak@intel.com (cherry picked from commit 937d02cc79c6828fef28a4d80d8d0ad2f7bf2b62) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/intel_cx0_phy.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 88a173e5dd05e788068e8fa20a8c37c44bd8f416 Author: Ville Syrjälä Date: Mon Dec 11 10:11:34 2023 +0200 drm/i915: Reject async flips with bigjoiner Currently async flips are busted when bigjoiner is in use. As a short term fix simply reject async flips in that case. Cc: stable@vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/9769 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20231211081134.2698-1-ville.syrjala@linux.intel.com Reviewed-by: Stanislav Lisovskiy (cherry picked from commit e93bffc2ac0a833b42841f31fff955549d38ce98) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/intel_display.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 768f17fd25e4a98bf5166148629ecf6f647d5efc Author: Karthik Poosa Date: Mon Dec 4 20:18:09 2023 +0530 drm/i915/hwmon: Fix static analysis tool reported issues Updated i915 hwmon with fixes for issues reported by static analysis tool. Fixed integer overflow with upcasting. v2: - Added Fixes tag (Badal). - Updated commit message as per review comments (Anshuman). Fixes: 4c2572fe0ae7 ("drm/i915/hwmon: Expose power1_max_interval") Reviewed-by: Badal Nilawar Reviewed-by: Anshuman Gupta Signed-off-by: Karthik Poosa Signed-off-by: Anshuman Gupta Link: https://patchwork.freedesktop.org/patch/msgid/20231204144809.1518704-1-karthik.poosa@intel.com (cherry picked from commit ac3420d3d428443a08b923f9118121c170192b62) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_hwmon.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6bf3549384033102986a3514744e080d3bfca7cf Author: Ankit Nautiyal Date: Wed Nov 22 12:16:27 2023 +0530 drm/i915/display: Get bigjoiner config before dsc config during readout Currently we get bigjoiner config after the dsc get config, during HW readout. Since dsc_get_config now uses bigjoiner flags/pipes to compute DSC PPS parameter pic_width, this results in a state mismatch when Bigjoiner and DSC are used together. So call get bigjoiner config before calling dsc get config function. Fixes: 8b70b5691704 ("drm/i915/vdsc: Fill the intel_dsc_get_pps_config function") Cc: Suraj Kandpal Cc: Ankit Nautiyal Cc: Animesh Manna Cc: Jani Nikula Signed-off-by: Ankit Nautiyal Reviewed-by: Suraj Kandpal Link: https://patchwork.freedesktop.org/patch/msgid/20231122064627.905828-1-ankit.k.nautiyal@intel.com (cherry picked from commit baf31a20fa7f3538d68ffa5262a715eb1d699cdd) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/intel_display.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d5a10b976ecb77fa49b95f3f1016ca2997c122cb Author: Thomas Gleixner Date: Fri Dec 15 15:19:32 2023 +0100 x86/acpi: Handle bogus MADT APIC tables gracefully The recent fix to ignore invalid x2APIC entries inadvertently broke systems with creative MADT APIC tables. The affected systems have APIC MADT tables where all entries have invalid APIC IDs (0xFF), which means they register exactly zero CPUs. But the condition to ignore the entries of APIC IDs < 255 in the X2APIC MADT table is solely based on the count of MADT APIC table entries. As a consequence, the affected machines enumerate no secondary CPUs at all because the APIC table has entries and therefore the X2APIC table entries with APIC IDs < 255 are ignored. Change the condition so that the APIC table preference for APIC IDs < 255 only becomes effective when the APIC table has valid APIC ID entries. IOW, an APIC table full of invalid APIC IDs is considered to be empty which in consequence enables the X2APIC table entries with a APIC ID < 255 and restores the expected behaviour. Fixes: ec9aedb2aa1a ("x86/acpi: Ignore invalid x2APIC entries") Reported-by: John Sperbeck Reported-by: Andres Freund Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/169953729188.3135.6804572126118798018.tip-bot2@tip-bot2 arch/x86/kernel/acpi/boot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a55bdad5dfd1efd4ed9ffe518897a21ca8e4e193 Author: Mario Limonciello Date: Mon Dec 11 22:50:06 2023 -0600 platform/x86/amd/pmc: Disable keyboard wakeup on AMD Framework 13 The Laptop 13 (AMD Ryzen 7040Series) BIOS 03.03 has a workaround included in the EC firmware that will cause the EC to emit a "spurious" keypress during the resume from s0i3 [1]. This series of keypress events can be observed in the kernel log on resume. ``` atkbd serio0: Unknown key pressed (translated set 2, code 0x6b on isa0060/serio0). atkbd serio0: Use 'setkeycodes 6b ' to make it known. atkbd serio0: Unknown key released (translated set 2, code 0x6b on isa0060/serio0). atkbd serio0: Use 'setkeycodes 6b ' to make it known. ``` In some user flows this is harmless, but if a user has specifically suspended the laptop and then closed the lid it will cause the laptop to wakeup. The laptop wakes up because the ACPI SCI triggers when the lid is closed and when the kernel sees that IRQ1 is "also" active. The kernel can't distinguish from a real keyboard keypress and wakes the system. Add the model into the list of quirks to disable keyboard wakeup source. This is intentionally only matching the production BIOS version in hopes that a newer EC firmware included in a newer BIOS can avoid this behavior. Cc: Kieran Levin Link: https://github.com/FrameworkComputer/EmbeddedController/blob/lotus-zephyr/zephyr/program/lotus/azalea/src/power_sequence.c#L313 [1] Link: https://community.frame.work/t/amd-wont-sleep-properly/41755 Link: https://community.frame.work/t/tracking-framework-amd-ryzen-7040-series-lid-wakeup-behavior-feedback/39128 Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20231212045006.97581-5-mario.limonciello@amd.com Reviewed-by: Hans de Goede Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/amd/pmc/pmc-quirks.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) commit b614a4bd73efeddc2b20d9e6deb6c2710373802b Author: Mario Limonciello Date: Mon Dec 11 22:50:05 2023 -0600 platform/x86/amd/pmc: Move keyboard wakeup disablement detection to pmc-quirks Other platforms may need to disable keyboard wakeup besides Cezanne, so move the detection into amd_pmc_quirks_init() where it may be applied to multiple platforms. Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20231212045006.97581-4-mario.limonciello@amd.com Reviewed-by: Hans de Goede Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/amd/pmc/pmc-quirks.c | 3 +++ drivers/platform/x86/amd/pmc/pmc.c | 2 +- drivers/platform/x86/amd/pmc/pmc.h | 1 + 3 files changed, 5 insertions(+), 1 deletion(-) commit 2d53c0ab61e62302d7b62d660fe76de2bff6bf45 Author: Mario Limonciello Date: Mon Dec 11 22:50:04 2023 -0600 platform/x86/amd/pmc: Only run IRQ1 firmware version check on Cezanne amd_pmc_wa_czn_irq1() only runs on Cezanne platforms currently but may be extended to other platforms in the future. Rename the function and only check platform firmware version when it's called for a Cezanne based platform. Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20231212045006.97581-3-mario.limonciello@amd.com Reviewed-by: Hans de Goede Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/amd/pmc/pmc.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) commit 85980669a863514dd47761efd6c1bc4677a2ae08 Author: Mario Limonciello Date: Mon Dec 11 22:50:03 2023 -0600 platform/x86/amd/pmc: Move platform defines to header The platform defines will be used by the quirks in the future, so move them to the common header to allow use by both source files. Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20231212045006.97581-2-mario.limonciello@amd.com Reviewed-by: Hans de Goede Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/amd/pmc/pmc.c | 10 ---------- drivers/platform/x86/amd/pmc/pmc.h | 11 +++++++++++ 2 files changed, 11 insertions(+), 10 deletions(-) commit fbcf67ce5a9e2831c14bdfb895be05213e611724 Author: Rajvi Jingar Date: Fri Dec 15 17:16:50 2023 -0800 platform/x86/intel/pmc: Fix hang in pmc_core_send_ltr_ignore() For input value 0, PMC stays unassigned which causes crash while trying to access PMC for register read/write. Include LTR index 0 in pmc_index and ltr_index calculation. Fixes: 2bcef4529222 ("platform/x86:intel/pmc: Enable debugfs multiple PMC support") Signed-off-by: Rajvi Jingar Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20231216011650.1973941-1-rajvi.jingar@linux.intel.com Signed-off-by: Ilpo Järvinen drivers/platform/x86/intel/pmc/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 66e92e23a72761f5b53f970aeb1badc5fd92fc74 Author: Vishnu Sankar Date: Thu Dec 14 22:47:02 2023 +0900 platform/x86: thinkpad_acpi: fix for incorrect fan reporting on some ThinkPad systems Some ThinkPad systems ECFW use non-standard addresses for fan control and reporting. This patch adds support for such ECFW so that it can report the correct fan values. Tested on Thinkpads L13 Yoga Gen 2 and X13 Yoga Gen 2. Suggested-by: Mark Pearson Signed-off-by: Vishnu Sankar Reviewed-by: Hans de Goede Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20231214134702.166464-1-vishnuocv@gmail.com Signed-off-by: Ilpo Järvinen drivers/platform/x86/thinkpad_acpi.c | 98 +++++++++++++++++++++++++++++++----- 1 file changed, 85 insertions(+), 13 deletions(-) commit e6b2dab41888332bf83f592131e7ea07756770a4 Author: Heiko Carstens Date: Fri Dec 8 15:03:15 2023 +0100 s390/vx: fix save/restore of fpu kernel context The KERNEL_FPR mask only contains a flag for the first eight vector registers. However floating point registers overlay parts of the first sixteen vector registers. This could lead to vector register corruption if a kernel fpu context uses any of the vector registers 8 to 15 and is interrupted or calls a KERNEL_FPR context. If that context uses also vector registers 8 to 15, their contents will be corrupted on return. Luckily this is currently not a real bug, since the kernel has only one KERNEL_FPR user with s390_adjust_jiffies() and it is only using floating point registers 0 to 2. Fix this by using the correct bits for KERNEL_FPR. Fixes: 7f79695cc1b6 ("s390/fpu: improve kernel_fpu_[begin|end]") Signed-off-by: Heiko Carstens Reviewed-by: Hendrik Brueckner Signed-off-by: Alexander Gordeev arch/s390/include/asm/fpu/api.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0b7dd38c1c520b650a889a81919838671b689eb9 Author: Ryan McClelland Date: Thu Dec 14 09:25:41 2023 -0800 HID: nintendo: fix initializer element is not constant error With gcc-7 builds, an error happens with the controller button values being defined as const. Change to a define. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202312141227.C2h1IzfI-lkp@intel.com/ Signed-off-by: Ryan McClelland Reviewed-by: Daniel J. Ogorchock Signed-off-by: Jiri Kosina drivers/hid/hid-nintendo.c | 44 ++++++++++++++++++++++---------------------- 1 file changed, 22 insertions(+), 22 deletions(-) commit 13d605e32e4cfdedcecdf3d98d21710ffe887708 Author: Ghanshyam Agrawal Date: Sun Dec 17 13:30:19 2023 +0530 kselftest: alsa: fixed a print formatting warning A statement used %d print formatter where %s should have been used. The same has been fixed in this commit. Signed-off-by: Ghanshyam Agrawal Link: 5aaf9efffc57 ("kselftest: alsa: Add simplistic test for ALSA mixer controls kselftest") Link: https://lore.kernel.org/r/20231217080019.1063476-1-ghanshyam1898@gmail.com Signed-off-by: Takashi Iwai tools/testing/selftests/alsa/mixer-test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 48d6b91798a6694fdd6edb62799754b9d3fe0792 Author: Jeremie Knuesel Date: Sun Dec 17 12:22:43 2023 +0100 ALSA: usb-audio: Increase delay in MOTU M quirk Increase the quirk delay from 2 seconds to 4 seconds. This reflects a change in the Windows driver in which the delay was increased to about 3.7 seconds. The larger delay fixes an issue where the device fails to work unless it was powered up early during boot. Also clarify in the quirk comment that the quirk is only applied to older devices (USB ID 07fd:0008). Signed-off-by: Jeremie Knuesel Suggested-by: Alexander Tsoy Cc: Link: https://bugzilla.kernel.org/show_bug.cgi?id=211975 Link: https://lore.kernel.org/r/20231217112243.33409-1-knuesel@gmail.com Signed-off-by: Takashi Iwai sound/usb/quirks.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e8c7692718bb001505602aa0eb48f142c389c27a Author: Kent Overstreet Date: Sun Dec 17 15:41:03 2023 -0500 bcachefs: print explicit recovery pass message only once Signed-off-by: Kent Overstreet fs/bcachefs/recovery.h | 3 +++ 1 file changed, 3 insertions(+) commit b50492b05fd02887b46aef079592207fb5c97a4c Author: Paulo Alcantara Date: Sat Dec 16 01:10:04 2023 -0300 smb: client: fix potential OOB in cifs_dump_detail() Validate SMB message with ->check_message() before calling ->calc_smb_size(). Signed-off-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org Signed-off-by: Steve French fs/smb/client/cifs_debug.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit b35858b3786ddbb56e1c35138ba25d6adf8d0bef Author: Paulo Alcantara Date: Fri Dec 15 19:59:14 2023 -0300 smb: client: fix OOB in smbCalcSize() Validate @smb->WordCount to avoid reading off the end of @smb and thus causing the following KASAN splat: BUG: KASAN: slab-out-of-bounds in smbCalcSize+0x32/0x40 [cifs] Read of size 2 at addr ffff88801c024ec5 by task cifsd/1328 CPU: 1 PID: 1328 Comm: cifsd Not tainted 6.7.0-rc5 #9 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 Call Trace: dump_stack_lvl+0x4a/0x80 print_report+0xcf/0x650 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? __phys_addr+0x46/0x90 kasan_report+0xd8/0x110 ? smbCalcSize+0x32/0x40 [cifs] ? smbCalcSize+0x32/0x40 [cifs] kasan_check_range+0x105/0x1b0 smbCalcSize+0x32/0x40 [cifs] checkSMB+0x162/0x370 [cifs] ? __pfx_checkSMB+0x10/0x10 [cifs] cifs_handle_standard+0xbc/0x2f0 [cifs] ? srso_alias_return_thunk+0x5/0xfbef5 cifs_demultiplex_thread+0xed1/0x1360 [cifs] ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] ? srso_alias_return_thunk+0x5/0xfbef5 ? lockdep_hardirqs_on_prepare+0x136/0x210 ? __pfx_lock_release+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? mark_held_locks+0x1a/0x90 ? lockdep_hardirqs_on_prepare+0x136/0x210 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? __kthread_parkme+0xce/0xf0 ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] kthread+0x18d/0x1d0 ? kthread+0xdb/0x1d0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 This fixes CVE-2023-6606. Reported-by: j51569436@gmail.com Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218218 Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/misc.c | 4 ++++ 1 file changed, 4 insertions(+) commit 33eae65c6f49770fec7a662935d4eb4a6406d24b Author: Paulo Alcantara Date: Wed Dec 13 12:25:57 2023 -0300 smb: client: fix OOB in SMB2_query_info_init() A small CIFS buffer (448 bytes) isn't big enough to hold SMB2_QUERY_INFO request along with user's input data from CIFS_QUERY_INFO ioctl. That is, if the user passed an input buffer > 344 bytes, the client will memcpy() off the end of @req->Buffer in SMB2_query_info_init() thus causing the following KASAN splat: BUG: KASAN: slab-out-of-bounds in SMB2_query_info_init+0x242/0x250 [cifs] Write of size 1023 at addr ffff88801308c5a8 by task a.out/1240 CPU: 1 PID: 1240 Comm: a.out Not tainted 6.7.0-rc4 #5 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 Call Trace: dump_stack_lvl+0x4a/0x80 print_report+0xcf/0x650 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? __phys_addr+0x46/0x90 kasan_report+0xd8/0x110 ? SMB2_query_info_init+0x242/0x250 [cifs] ? SMB2_query_info_init+0x242/0x250 [cifs] kasan_check_range+0x105/0x1b0 __asan_memcpy+0x3c/0x60 SMB2_query_info_init+0x242/0x250 [cifs] ? __pfx_SMB2_query_info_init+0x10/0x10 [cifs] ? srso_alias_return_thunk+0x5/0xfbef5 ? smb_rqst_len+0xa6/0xc0 [cifs] smb2_ioctl_query_info+0x4f4/0x9a0 [cifs] ? __pfx_smb2_ioctl_query_info+0x10/0x10 [cifs] ? __pfx_cifsConvertToUTF16+0x10/0x10 [cifs] ? kasan_set_track+0x25/0x30 ? srso_alias_return_thunk+0x5/0xfbef5 ? __kasan_kmalloc+0x8f/0xa0 ? srso_alias_return_thunk+0x5/0xfbef5 ? cifs_strndup_to_utf16+0x12d/0x1a0 [cifs] ? __build_path_from_dentry_optional_prefix+0x19d/0x2d0 [cifs] ? __pfx_smb2_ioctl_query_info+0x10/0x10 [cifs] cifs_ioctl+0x11c7/0x1de0 [cifs] ? __pfx_cifs_ioctl+0x10/0x10 [cifs] ? srso_alias_return_thunk+0x5/0xfbef5 ? rcu_is_watching+0x23/0x50 ? srso_alias_return_thunk+0x5/0xfbef5 ? __rseq_handle_notify_resume+0x6cd/0x850 ? __pfx___schedule+0x10/0x10 ? blkcg_iostat_update+0x250/0x290 ? srso_alias_return_thunk+0x5/0xfbef5 ? ksys_write+0xe9/0x170 __x64_sys_ioctl+0xc9/0x100 do_syscall_64+0x47/0xf0 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f893dde49cf Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 18 48 8b 44 24 18 64 48 2b 04 25 28 00 00 RSP: 002b:00007ffc03ff4160 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffc03ff4378 RCX: 00007f893dde49cf RDX: 00007ffc03ff41d0 RSI: 00000000c018cf07 RDI: 0000000000000003 RBP: 00007ffc03ff4260 R08: 0000000000000410 R09: 0000000000000001 R10: 00007f893dce7300 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc03ff4388 R14: 00007f893df15000 R15: 0000000000406de0 Fix this by increasing size of SMB2_QUERY_INFO request buffers and validating input length to prevent other callers from overflowing @req in SMB2_query_info_init() as well. Fixes: f5b05d622a3e ("cifs: add IOCTL for QUERY_INFO passthrough to userspace") Cc: stable@vger.kernel.org Reported-by: Robert Morris Signed-off-by: Paulo Alcantara Signed-off-by: Steve French fs/smb/client/smb2pdu.c | 29 ++++++++++++++++++++++------- 1 file changed, 22 insertions(+), 7 deletions(-) commit a8f68b11158f09754418de62e6b3e7b9b7a50cc9 Author: Paulo Alcantara Date: Wed Dec 13 12:25:56 2023 -0300 smb: client: fix OOB in cifsd when receiving compounded resps Validate next header's offset in ->next_header() so that it isn't smaller than MID_HEADER_SIZE(server) and then standard_receive3() or ->receive() ends up writing off the end of the buffer because 'pdu_length - MID_HEADER_SIZE(server)' wraps up to a huge length: BUG: KASAN: slab-out-of-bounds in _copy_to_iter+0x4fc/0x840 Write of size 701 at addr ffff88800caf407f by task cifsd/1090 CPU: 0 PID: 1090 Comm: cifsd Not tainted 6.7.0-rc4 #5 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 Call Trace: dump_stack_lvl+0x4a/0x80 print_report+0xcf/0x650 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? __phys_addr+0x46/0x90 kasan_report+0xd8/0x110 ? _copy_to_iter+0x4fc/0x840 ? _copy_to_iter+0x4fc/0x840 kasan_check_range+0x105/0x1b0 __asan_memcpy+0x3c/0x60 _copy_to_iter+0x4fc/0x840 ? srso_alias_return_thunk+0x5/0xfbef5 ? hlock_class+0x32/0xc0 ? srso_alias_return_thunk+0x5/0xfbef5 ? __pfx__copy_to_iter+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_is_held_type+0x90/0x100 ? srso_alias_return_thunk+0x5/0xfbef5 ? __might_resched+0x278/0x360 ? __pfx___might_resched+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 __skb_datagram_iter+0x2c2/0x460 ? __pfx_simple_copy_to_iter+0x10/0x10 skb_copy_datagram_iter+0x6c/0x110 tcp_recvmsg_locked+0x9be/0xf40 ? __pfx_tcp_recvmsg_locked+0x10/0x10 ? mark_held_locks+0x5d/0x90 ? srso_alias_return_thunk+0x5/0xfbef5 tcp_recvmsg+0xe2/0x310 ? __pfx_tcp_recvmsg+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_acquire+0x14a/0x3a0 ? srso_alias_return_thunk+0x5/0xfbef5 inet_recvmsg+0xd0/0x370 ? __pfx_inet_recvmsg+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? do_raw_spin_trylock+0xd1/0x120 sock_recvmsg+0x10d/0x150 cifs_readv_from_socket+0x25a/0x490 [cifs] ? __pfx_cifs_readv_from_socket+0x10/0x10 [cifs] ? srso_alias_return_thunk+0x5/0xfbef5 cifs_read_from_socket+0xb5/0x100 [cifs] ? __pfx_cifs_read_from_socket+0x10/0x10 [cifs] ? __pfx_lock_release+0x10/0x10 ? do_raw_spin_trylock+0xd1/0x120 ? _raw_spin_unlock+0x23/0x40 ? srso_alias_return_thunk+0x5/0xfbef5 ? __smb2_find_mid+0x126/0x230 [cifs] cifs_demultiplex_thread+0xd39/0x1270 [cifs] ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] ? __pfx_lock_release+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? mark_held_locks+0x1a/0x90 ? lockdep_hardirqs_on_prepare+0x136/0x210 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? __kthread_parkme+0xce/0xf0 ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] kthread+0x18d/0x1d0 ? kthread+0xdb/0x1d0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 Fixes: 8ce79ec359ad ("cifs: update multiplex loop to handle compounded responses") Cc: stable@vger.kernel.org Reported-by: Robert Morris Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/cifsglob.h | 3 ++- fs/smb/client/connect.c | 7 ++++++- fs/smb/client/smb2ops.c | 19 ++++++++++++------- 3 files changed, 20 insertions(+), 9 deletions(-) commit ceb6a6f023fd3e8b07761ed900352ef574010bcb Author: Linus Torvalds Date: Sun Dec 17 15:19:28 2023 -0800 Linux 6.7-rc6 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 177c2ffe69555dde28fad5ddb62a6d806982e53f Merge: 0e389834672c 7e2c1e4b34f0 Author: Linus Torvalds Date: Sun Dec 17 14:03:11 2023 -0800 Merge tag 'perf_urgent_for_v6.7_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Borislav Petkov: - Avoid iterating over newly created group leader event's siblings because there are none, and thus prevent a lockdep splat * tag 'perf_urgent_for_v6.7_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Fix perf_event_validate_size() lockdep splat commit 979e90173af8d2f52f671d988189aab98c6d1be6 Merge: b1dfc0f76231 356c71c46169 Author: David S. Miller Date: Sun Dec 17 20:54:22 2023 +0000 Merge branch 'mptcp-misc-fixes' Matthieu Baerts says: ==================== mptcp: misc. fixes for v6.7 Here are a few fixes related to MPTCP: Patch 1 avoids skipping some subtests of the MPTCP Join selftest by mistake when using older versions of GCC. This fixes a patch introduced in v6.4, backported up to v6.1. Patch 2 fixes an inconsistent state when using MPTCP + FastOpen. A fix for v6.2. Patch 3 adds a description for MPTCP Kunit test modules to avoid a warning. Patch 4 adds an entry to the mailmap file for Geliang's email addresses. ==================== Signed-off-by: David S. Miller Signed-off-by: Matthieu Baerts commit 356c71c46169d5f3ff7f9ae939d73aceb3b2e514 Author: Geliang Tang Date: Fri Dec 15 17:04:27 2023 +0100 mailmap: add entries for Geliang Tang Map Geliang's old mail addresses to his @linux.dev one. Suggested-by: Mat Martineau Signed-off-by: Geliang Tang Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller .mailmap | 4 ++++ 1 file changed, 4 insertions(+) commit a8f570b247972775f710375125ebabfc47b1e518 Author: Matthieu Baerts Date: Fri Dec 15 17:04:26 2023 +0100 mptcp: fill in missing MODULE_DESCRIPTION() W=1 builds warn on missing MODULE_DESCRIPTION, add them here in MPTCP. Only two were missing: two modules with different KUnit tests for MPTCP. Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller net/mptcp/crypto_test.c | 1 + net/mptcp/token_test.c | 1 + 2 files changed, 2 insertions(+) commit 4fd19a30701659af5839b7bd19d1f05f05933ebe Author: Paolo Abeni Date: Fri Dec 15 17:04:25 2023 +0100 mptcp: fix inconsistent state on fastopen race The netlink PM can race with fastopen self-connect attempts, shutting down the first subflow via: MPTCP_PM_CMD_DEL_ADDR -> mptcp_nl_remove_id_zero_address -> mptcp_pm_nl_rm_subflow_received -> mptcp_close_ssk and transitioning such subflow to FIN_WAIT1 status before the syn-ack packet is processed. The MPTCP code does not react to such state change, leaving the connection in not-fallback status and the subflow handshake uncompleted, triggering the following splat: WARNING: CPU: 0 PID: 10630 at net/mptcp/subflow.c:1405 subflow_data_ready+0x39f/0x690 net/mptcp/subflow.c:1405 Modules linked in: CPU: 0 PID: 10630 Comm: kworker/u4:11 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 Workqueue: bat_events batadv_nc_worker RIP: 0010:subflow_data_ready+0x39f/0x690 net/mptcp/subflow.c:1405 Code: 18 89 ee e8 e3 d2 21 f7 40 84 ed 75 1f e8 a9 d7 21 f7 44 89 fe bf 07 00 00 00 e8 0c d3 21 f7 41 83 ff 07 74 07 e8 91 d7 21 f7 <0f> 0b e8 8a d7 21 f7 48 89 df e8 d2 b2 ff ff 31 ff 89 c5 89 c6 e8 RSP: 0018:ffffc90000007448 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888031efc700 RCX: ffffffff8a65baf4 RDX: ffff888043222140 RSI: ffffffff8a65baff RDI: 0000000000000005 RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000007 R10: 000000000000000b R11: 0000000000000000 R12: 1ffff92000000e89 R13: ffff88807a534d80 R14: ffff888021c11a00 R15: 000000000000000b FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa19a0ffc81 CR3: 000000007a2db000 CR4: 00000000003506f0 DR0: 000000000000d8dd DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: tcp_data_ready+0x14c/0x5b0 net/ipv4/tcp_input.c:5128 tcp_data_queue+0x19c3/0x5190 net/ipv4/tcp_input.c:5208 tcp_rcv_state_process+0x11ef/0x4e10 net/ipv4/tcp_input.c:6844 tcp_v4_do_rcv+0x369/0xa10 net/ipv4/tcp_ipv4.c:1929 tcp_v4_rcv+0x3888/0x3b30 net/ipv4/tcp_ipv4.c:2329 ip_protocol_deliver_rcu+0x9f/0x480 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2e4/0x510 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip_local_deliver+0x1b6/0x550 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:461 [inline] ip_rcv_finish+0x1c4/0x2e0 net/ipv4/ip_input.c:449 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip_rcv+0xce/0x440 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core+0x115/0x180 net/core/dev.c:5527 __netif_receive_skb+0x1f/0x1b0 net/core/dev.c:5641 process_backlog+0x101/0x6b0 net/core/dev.c:5969 __napi_poll.constprop.0+0xb4/0x540 net/core/dev.c:6531 napi_poll net/core/dev.c:6600 [inline] net_rx_action+0x956/0xe90 net/core/dev.c:6733 __do_softirq+0x21a/0x968 kernel/softirq.c:553 do_softirq kernel/softirq.c:454 [inline] do_softirq+0xaa/0xe0 kernel/softirq.c:441 __local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:381 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_nc_purge_paths+0x1ce/0x3c0 net/batman-adv/network-coding.c:471 batadv_nc_worker+0x9b1/0x10e0 net/batman-adv/network-coding.c:722 process_one_work+0x884/0x15c0 kernel/workqueue.c:2630 process_scheduled_works kernel/workqueue.c:2703 [inline] worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 To address the issue, catch the racing subflow state change and use it to cause the MPTCP fallback. Such fallback is also used to cause the first subflow state propagation to the msk socket via mptcp_set_connected(). After this change, the first subflow can additionally propagate the TCP_FIN_WAIT1 state, so rename the helper accordingly. Finally, if the state propagation is delayed to the msk release callback, the first subflow can change to a different state in between. Cache the relevant target state in a new msk-level field and use such value to update the msk state at release time. Fixes: 1e777f39b4d7 ("mptcp: add MSG_FASTOPEN sendmsg flag support") Cc: stable@vger.kernel.org Reported-by: Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/458 Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller net/mptcp/protocol.c | 6 +++--- net/mptcp/protocol.h | 9 ++++++--- net/mptcp/subflow.c | 28 +++++++++++++++++----------- 3 files changed, 26 insertions(+), 17 deletions(-) commit c8f021eec5817601dbd25ab7e3ad5c720965c688 Author: Geliang Tang Date: Fri Dec 15 17:04:24 2023 +0100 selftests: mptcp: join: fix subflow_send_ack lookup MPC backups tests will skip unexpected sometimes (For example, when compiling kernel with an older version of gcc, such as gcc-8), since static functions like mptcp_subflow_send_ack also be listed in /proc/kallsyms, with a 't' in front of it, not 'T' ('T' is for a global function): > grep "mptcp_subflow_send_ack" /proc/kallsyms 0000000000000000 T __pfx___mptcp_subflow_send_ack 0000000000000000 T __mptcp_subflow_send_ack 0000000000000000 t __pfx_mptcp_subflow_send_ack 0000000000000000 t mptcp_subflow_send_ack In this case, mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$" will be false, MPC backups tests will skip. This is not what we expected. The correct logic here should be: if mptcp_subflow_send_ack is not a global function in /proc/kallsyms, do these MPC backups tests. So a 'T' must be added in front of mptcp_subflow_send_ack. Fixes: 632978f0a961 ("selftests: mptcp: join: skip MPC backups tests if not supported") Cc: stable@vger.kernel.org Signed-off-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller tools/testing/selftests/net/mptcp/mptcp_join.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 0e389834672c723435a44818ed2cabc4dad24429 Merge: accc98aff5c3 a8892fd71933 Author: Linus Torvalds Date: Sun Dec 17 09:27:36 2023 -0800 Merge tag 'for-6.7-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fix from David Sterba: "One more fix that verifies that the snapshot source is a root, same check is also done in user space but should be done by the ioctl as well" * tag 'for-6.7-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: do not allow non subvolume root targets for snapshot commit accc98aff5c39fdc63bf0bac471b9c601aaf4755 Merge: 7f499ec27ca2 393cae5f32d6 Author: Linus Torvalds Date: Sun Dec 17 09:24:06 2023 -0800 Merge tag 'soundwire-6.7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire fixes from Vinod Koul: - Null pointer dereference for mult link in core - AC timing fix in intel driver * tag 'soundwire-6.7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: intel_ace2x: fix AC timing setting for ACE2.x soundwire: stream: fix NULL pointer dereference for multi_link commit 7f499ec27ca25c7faad74e15a6e2c72a1ea3e63c Merge: 6d04b70ea48b 2a9c713825b3 Author: Linus Torvalds Date: Sun Dec 17 09:19:27 2023 -0800 Merge tag 'phy-fixes-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy fixes from Vinod Koul: - register offset fix for TI driver - mediatek driver minimal supported frequency fix - negative error code in probe fix for sunplus driver * tag 'phy-fixes-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: phy: sunplus: return negative error code in sp_usb_phy_probe phy: mediatek: mipi: mt8183: fix minimal supported frequency phy: ti: gmii-sel: Fix register offset when parent is not a syscon node commit 6d04b70ea48b2d84ebf6cd9ad9b01ba50a58542e Merge: 134fdb80bc13 4ee632c82d2d Author: Linus Torvalds Date: Sun Dec 17 09:11:32 2023 -0800 Merge tag 'dmaengine-fix-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine fixes from Vinod Koul: - SPI PDMA data fix for TI k3-psil drivers - suspend fix, pointer check, logic for arbitration fix and channel leak fix in fsl-edma driver - couple of fixes in idxd driver for GRPCFG descriptions and int_handle field handling - single fix for stm32 driver for bitfield overflow * tag 'dmaengine-fix-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dmaengine: fsl-edma: fix DMA channel leak in eDMAv4 dmaengine: fsl-edma: fix wrong pointer check in fsl_edma3_attach_pd() dmaengine: idxd: Fix incorrect descriptions for GRPCFG register dmaengine: idxd: Protect int_handle field in hw descriptor dmaengine: stm32-dma: avoid bitfield overflow assertion dmaengine: fsl-edma: Add judgment on enabling round robin arbitration dmaengine: fsl-edma: Do not suspend and resume the masked dma channel when the system is sleeping dmaengine: ti: k3-psil-am62a: Fix SPI PDMA data dmaengine: ti: k3-psil-am62: Fix SPI PDMA data commit 134fdb80bc130dba429295ac64358b16b695628c Merge: ef6a7c27db54 ef3d5cf9c59c Author: Linus Torvalds Date: Sun Dec 17 09:07:34 2023 -0800 Merge tag 'cxl-fixes-6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull CXL (Compute Express Link) fixes from Dan Williams: "A collection of CXL fixes. The touch outside of drivers/cxl/ is for a helper that allocates physical address space. Device hotplug tests showed that the driver failed to utilize (skipped over) valid capacity when allocating a new memory region. Outside of that, new tests uncovered a small crop of lockdep reports. There is also some miscellaneous error path and leak fixups that are not urgent, but useful to cleanup now. - Fix alloc_free_mem_region()'s scan for address space, prevent false negative out-of-space events - Fix sleeping lock acquisition from CXL trace event (atomic context) - Fix put_device() like for the new CXL PMU driver - Fix wrong pointer freed on error path - Fixup several lockdep reports (missing lock hold) from new assertion in cxl_num_decoders_committed() and new tests" * tag 'cxl-fixes-6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl/pmu: Ensure put_device on pmu devices cxl/cdat: Free correct buffer on checksum error cxl/hdm: Fix dpa translation locking kernel/resource: Increment by align value in get_free_mem_region() cxl: Add cxl_num_decoders_committed() usage to cxl_test cxl/memdev: Hold region_rwsem during inject and clear poison ops cxl/core: Always hold region_rwsem while reading poison lists cxl/hdm: Fix a benign lockdep splat commit ef6a7c27db54f06cc5c79f5a756d649828d42f3d Merge: 5ef3720d9128 9483aa44912f Author: Linus Torvalds Date: Sun Dec 17 09:02:20 2023 -0800 Merge tag 'edac_urgent_for_v6.7_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - A single fix for the EDAC Versal driver to read out register fields properly * tag 'edac_urgent_for_v6.7_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/versal: Read num_csrows and num_chans using the correct bitfield macro commit 5ef3720d91285f7ebc49d17366b366818516b768 Merge: dde0672bfa3e d2441d3e8c0c Author: Linus Torvalds Date: Sun Dec 17 08:50:00 2023 -0800 Merge tag 'powerpc-6.7-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix a bug where heavy VAS (accelerator) usage could race with partition migration and prevent the migration from completing. - Update MAINTAINERS to add Aneesh & Naveen. Thanks to Haren Myneni. * tag 'powerpc-6.7-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: MAINTAINERS: powerpc: Add Aneesh & Naveen powerpc/pseries/vas: Migration suspend waits for no in-progress open windows commit 413ba91089c74207313b315e04cf381ffb5b20e4 Author: Amir Goldstein Date: Sun Dec 17 11:08:52 2023 +0200 ovl: fix dentry reference leak after changes to underlying layers syzbot excercised the forbidden practice of moving the workdir under lowerdir while overlayfs is mounted and tripped a dentry reference leak. Fixes: c63e56a4a652 ("ovl: do not open/llseek lower file with upper sb_writers held") Reported-and-tested-by: syzbot+8608bb4553edb8c78f41@syzkaller.appspotmail.com Signed-off-by: Amir Goldstein fs/overlayfs/copy_up.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit dde0672bfa3e5c5e8530ebb45518408acb91b083 Merge: 3b8a9b2e6809 8defec031c40 Author: Linus Torvalds Date: Sat Dec 16 16:57:55 2023 -0800 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A handful of clk fixes, mostly in the rockchip clk driver: - Fix a clk name, clk parent, and a register for a clk gate in the Rockchip rk3128 clk driver - Add a PLL frequency on Rockchip rk3568 to fix some display artifacts - Fix a kbuild dependency for Qualcomm's SM_CAMCC_8550 symbol so that it isn't possible to select the associated GCC driver" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: rockchip: rk3128: Fix SCLK_SDMMC's clock name clk: rockchip: rk3128: Fix aclk_peri_src's parent clk: qcom: Fix SM_CAMCC_8550 dependencies clk: rockchip: rk3128: Fix HCLK_OTG gate register clk: rockchip: rk3568: Add PLL rate for 292.5MHz commit 3b8a9b2e6809d281890dd0a1102dc14d2cd11caf Merge: c8e97fc6b4c0 712292308af2 Author: Linus Torvalds Date: Sat Dec 16 10:40:51 2023 -0800 Merge tag 'trace-v6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix eventfs to check creating new files for events with names greater than NAME_MAX. The eventfs lookup needs to check the return result of simple_lookup(). - Fix the ring buffer to check the proper max data size. Events must be able to fit on the ring buffer sub-buffer, if it cannot, then it fails to be written and the logic to add the event is avoided. The code to check if an event can fit failed to add the possible absolute timestamp which may make the event not be able to fit. This causes the ring buffer to go into an infinite loop trying to find a sub-buffer that would fit the event. Luckily, there's a check that will bail out if it looped over a 1000 times and it also warns. The real fix is not to add the absolute timestamp to an event that is starting at the beginning of a sub-buffer because it uses the sub-buffer timestamp. By avoiding the timestamp at the start of the sub-buffer allows events that pass the first check to always find a sub-buffer that it can fit on. - Have large events that do not fit on a trace_seq to print "LINE TOO BIG" like it does for the trace_pipe instead of what it does now which is to silently drop the output. - Fix a memory leak of forgetting to free the spare page that is saved by a trace instance. - Update the size of the snapshot buffer when the main buffer is updated if the snapshot buffer is allocated. - Fix ring buffer timestamp logic by removing all the places that tried to put the before_stamp back to the write stamp so that the next event doesn't add an absolute timestamp. But each of these updates added a race where by making the two timestamp equal, it was validating the write_stamp so that it can be incorrectly used for calculating the delta of an event. - There's a temp buffer used for printing the event that was using the event data size for allocation when it needed to use the size of the entire event (meta-data and payload data) - For hardening, use "%.*s" for printing the trace_marker output, to limit the amount that is printed by the size of the event. This was discovered by development that added a bug that truncated the '\0' and caused a crash. - Fix a use-after-free bug in the use of the histogram files when an instance is being removed. - Remove a useless update in the rb_try_to_discard of the write_stamp. The before_stamp was already changed to force the next event to add an absolute timestamp that the write_stamp is not used. But the write_stamp is modified again using an unneeded 64-bit cmpxchg. - Fix several races in the 32-bit implementation of the rb_time_cmpxchg() that does a 64-bit cmpxchg. - While looking at fixing the 64-bit cmpxchg, I noticed that because the ring buffer uses normal cmpxchg, and this can be done in NMI context, there's some architectures that do not have a working cmpxchg in NMI context. For these architectures, fail recording events that happen in NMI context. * tag 'trace-v6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI ring-buffer: Have rb_time_cmpxchg() set the msb counter too ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg() ring-buffer: Fix a race in rb_time_cmpxchg() for 32 bit archs ring-buffer: Remove useless update to write_stamp in rb_try_to_discard() ring-buffer: Do not try to put back write_stamp tracing: Fix uaf issue when open the hist or hist_debug file tracing: Add size check when printing trace_marker output ring-buffer: Have saved event hold the entire event ring-buffer: Do not update before stamp when switching sub-buffers tracing: Update snapshot buffer on resize if it is allocated ring-buffer: Fix memory leak of free page eventfs: Fix events beyond NAME_MAX blocking tasks tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing ring-buffer: Fix writing to the buffer with max_data_size commit c8e97fc6b4c057a350a9e9a1ad625e10cc9c39ee Merge: 2e3f280b24ea 3c0696076aad Author: Linus Torvalds Date: Fri Dec 15 19:59:03 2023 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Arm CMN perf: fix the DTC allocation failure path which can end up erroneously clearing live counters - arm64/mm: fix hugetlb handling of the dirty page state leading to a continuous fault loop in user on hardware without dirty bit management (DBM). That's caused by the dirty+writeable information not being properly preserved across a series of mprotect(PROT_NONE), mprotect(PROT_READ|PROT_WRITE) * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify perf/arm-cmn: Fail DTC counter allocation correctly commit 2e3f280b24ea89f6f061c8b56771b06351c7745d Merge: ae1914174a63 5df12742b7e3 Author: Linus Torvalds Date: Fri Dec 15 19:48:47 2023 -0800 Merge tag 'pci-v6.7-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Limit Max_Read_Request_Size (MRRS) on some MIPS Loongson systems because they don't all support MRRS > 256, and firmware doesn't always initialize it correctly, which meant some PCIe devices didn't work (Jiaxun Yang) - Add and use pci_enable_link_state_locked() to prevent potential deadlocks in vmd and qcom drivers (Johan Hovold) - Revert recent (v6.5) acpiphp resource assignment changes that fixed issues with hot-adding devices on a root bus or with large BARs, but introduced new issues with GPU initialization and hot-adding SCSI disks in QEMU VMs and (Bjorn Helgaas) * tag 'pci-v6.7-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: Revert "PCI: acpiphp: Reassign resources on bridge if necessary" PCI/ASPM: Add pci_disable_link_state_locked() lockdep assert PCI/ASPM: Clean up __pci_disable_link_state() 'sem' parameter PCI: qcom: Clean up ASPM comment PCI: qcom: Fix potential deadlock when enabling ASPM PCI: vmd: Fix potential deadlock when enabling ASPM PCI/ASPM: Add pci_enable_link_state_locked() PCI: loongson: Limit MRRS to 256 commit b1dfc0f76231bbf395c59d20a2070684620d5d0f Author: Daniel Golle Date: Tue Dec 12 00:05:35 2023 +0000 net: phy: skip LED triggers on PHYs on SFP modules Calling led_trigger_register() when attaching a PHY located on an SFP module potentially (and practically) leads into a deadlock. Fix this by not calling led_trigger_register() for PHYs localted on SFP modules as such modules actually never got any LEDs. ====================================================== WARNING: possible circular locking dependency detected 6.7.0-rc4-next-20231208+ #0 Tainted: G O ------------------------------------------------------ kworker/u8:2/43 is trying to acquire lock: ffffffc08108c4e8 (triggers_list_lock){++++}-{3:3}, at: led_trigger_register+0x4c/0x1a8 but task is already holding lock: ffffff80c5c6f318 (&sfp->sm_mutex){+.+.}-{3:3}, at: cleanup_module+0x2ba8/0x3120 [sfp] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&sfp->sm_mutex){+.+.}-{3:3}: __mutex_lock+0x88/0x7a0 mutex_lock_nested+0x20/0x28 cleanup_module+0x2ae0/0x3120 [sfp] sfp_register_bus+0x5c/0x9c sfp_register_socket+0x48/0xd4 cleanup_module+0x271c/0x3120 [sfp] platform_probe+0x64/0xb8 really_probe+0x17c/0x3c0 __driver_probe_device+0x78/0x164 driver_probe_device+0x3c/0xd4 __driver_attach+0xec/0x1f0 bus_for_each_dev+0x60/0xa0 driver_attach+0x20/0x28 bus_add_driver+0x108/0x208 driver_register+0x5c/0x118 __platform_driver_register+0x24/0x2c init_module+0x28/0xa7c [sfp] do_one_initcall+0x70/0x2ec do_init_module+0x54/0x1e4 load_module+0x1b78/0x1c8c __do_sys_init_module+0x1bc/0x2cc __arm64_sys_init_module+0x18/0x20 invoke_syscall.constprop.0+0x4c/0xdc do_el0_svc+0x3c/0xbc el0_svc+0x34/0x80 el0t_64_sync_handler+0xf8/0x124 el0t_64_sync+0x150/0x154 -> #2 (rtnl_mutex){+.+.}-{3:3}: __mutex_lock+0x88/0x7a0 mutex_lock_nested+0x20/0x28 rtnl_lock+0x18/0x20 set_device_name+0x30/0x130 netdev_trig_activate+0x13c/0x1ac led_trigger_set+0x118/0x234 led_trigger_write+0x104/0x17c sysfs_kf_bin_write+0x64/0x80 kernfs_fop_write_iter+0x128/0x1b4 vfs_write+0x178/0x2a4 ksys_write+0x58/0xd4 __arm64_sys_write+0x18/0x20 invoke_syscall.constprop.0+0x4c/0xdc do_el0_svc+0x3c/0xbc el0_svc+0x34/0x80 el0t_64_sync_handler+0xf8/0x124 el0t_64_sync+0x150/0x154 -> #1 (&led_cdev->trigger_lock){++++}-{3:3}: down_write+0x4c/0x13c led_trigger_write+0xf8/0x17c sysfs_kf_bin_write+0x64/0x80 kernfs_fop_write_iter+0x128/0x1b4 vfs_write+0x178/0x2a4 ksys_write+0x58/0xd4 __arm64_sys_write+0x18/0x20 invoke_syscall.constprop.0+0x4c/0xdc do_el0_svc+0x3c/0xbc el0_svc+0x34/0x80 el0t_64_sync_handler+0xf8/0x124 el0t_64_sync+0x150/0x154 -> #0 (triggers_list_lock){++++}-{3:3}: __lock_acquire+0x12a0/0x2014 lock_acquire+0x100/0x2ac down_write+0x4c/0x13c led_trigger_register+0x4c/0x1a8 phy_led_triggers_register+0x9c/0x214 phy_attach_direct+0x154/0x36c phylink_attach_phy+0x30/0x60 phylink_sfp_connect_phy+0x140/0x510 sfp_add_phy+0x34/0x50 init_module+0x15c/0xa7c [sfp] cleanup_module+0x1d94/0x3120 [sfp] cleanup_module+0x2bb4/0x3120 [sfp] process_one_work+0x1f8/0x4ec worker_thread+0x1e8/0x3d8 kthread+0x104/0x110 ret_from_fork+0x10/0x20 other info that might help us debug this: Chain exists of: triggers_list_lock --> rtnl_mutex --> &sfp->sm_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sfp->sm_mutex); lock(rtnl_mutex); lock(&sfp->sm_mutex); lock(triggers_list_lock); *** DEADLOCK *** 4 locks held by kworker/u8:2/43: #0: ffffff80c000f938 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x150/0x4ec #1: ffffffc08214bde8 ((work_completion)(&(&sfp->timeout)->work)){+.+.}-{0:0}, at: process_one_work+0x150/0x4ec #2: ffffffc0810902f8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x18/0x20 #3: ffffff80c5c6f318 (&sfp->sm_mutex){+.+.}-{3:3}, at: cleanup_module+0x2ba8/0x3120 [sfp] stack backtrace: CPU: 0 PID: 43 Comm: kworker/u8:2 Tainted: G O 6.7.0-rc4-next-20231208+ #0 Hardware name: Bananapi BPI-R4 (DT) Workqueue: events_power_efficient cleanup_module [sfp] Call trace: dump_backtrace+0xa8/0x10c show_stack+0x14/0x1c dump_stack_lvl+0x5c/0xa0 dump_stack+0x14/0x1c print_circular_bug+0x328/0x430 check_noncircular+0x124/0x134 __lock_acquire+0x12a0/0x2014 lock_acquire+0x100/0x2ac down_write+0x4c/0x13c led_trigger_register+0x4c/0x1a8 phy_led_triggers_register+0x9c/0x214 phy_attach_direct+0x154/0x36c phylink_attach_phy+0x30/0x60 phylink_sfp_connect_phy+0x140/0x510 sfp_add_phy+0x34/0x50 init_module+0x15c/0xa7c [sfp] cleanup_module+0x1d94/0x3120 [sfp] cleanup_module+0x2bb4/0x3120 [sfp] process_one_work+0x1f8/0x4ec worker_thread+0x1e8/0x3d8 kthread+0x104/0x110 ret_from_fork+0x10/0x20 Signed-off-by: Daniel Golle Fixes: 01e5b728e9e4 ("net: phy: Add a binding for PHY LEDs") Link: https://lore.kernel.org/r/102a9dce38bdf00215735d04cd4704458273ad9c.1702339354.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski drivers/net/phy/phy_device.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 117211aa739a926e6555cfea883be84bee6f1695 Author: Jiri Olsa Date: Sat Dec 16 00:05:02 2023 +0100 bpf: Add missing BPF_LINK_TYPE invocations Pengfei Xu reported [1] Syzkaller/KASAN issue found in bpf_link_show_fdinfo. The reason is missing BPF_LINK_TYPE invocation for uprobe multi link and for several other links, adding that. [1] https://lore.kernel.org/bpf/ZXptoKRSLspnk2ie@xpf.sh.intel.com/ Fixes: 89ae89f53d20 ("bpf: Add multi uprobe link") Fixes: e420bed02507 ("bpf: Add fd-based tcx multi-prog infra with link support") Fixes: 84601d6ee68a ("bpf: add bpf_link support for BPF_NETFILTER programs") Fixes: 35dfaad7188c ("netkit, bpf: Add bpf programmable net device") Reported-by: Pengfei Xu Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Tested-by: Pengfei Xu Acked-by: Hou Tao Link: https://lore.kernel.org/bpf/20231215230502.2769743-1-jolsa@kernel.org include/linux/bpf_types.h | 4 ++++ 1 file changed, 4 insertions(+) commit a8892fd71933126ebae3d60aec5918d4dceaae76 Author: Josef Bacik Date: Fri Dec 15 10:01:44 2023 -0500 btrfs: do not allow non subvolume root targets for snapshot Our btrfs subvolume snapshot utility enforces that is the root of the subvolume, however this isn't enforced in the kernel. Update the kernel to also enforce this limitation to avoid problems with other users of this ioctl that don't have the appropriate checks in place. Reported-by: Martin Michaelis CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Neal Gompa Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ioctl.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit ae1914174a63a558113e80d24ccac2773f9f7b2b Author: Jens Axboe Date: Fri Dec 15 13:40:57 2023 -0700 cred: get rid of CONFIG_DEBUG_CREDENTIALS This code is rarely (never?) enabled by distros, and it hasn't caught anything in decades. Let's kill off this legacy debug code. Suggested-by: Linus Torvalds Signed-off-by: Jens Axboe Signed-off-by: Linus Torvalds arch/powerpc/configs/skiroot_defconfig | 1 - arch/s390/configs/debug_defconfig | 1 - fs/nfsd/auth.c | 4 - fs/nfsd/nfssvc.c | 1 - fs/nfsd/vfs.c | 9 +- fs/open.c | 3 - include/linux/cred.h | 50 ------- kernel/cred.c | 231 +++--------------------------- kernel/exit.c | 3 - lib/Kconfig.debug | 15 -- net/sunrpc/auth.c | 3 - security/selinux/hooks.c | 6 - tools/objtool/noreturns.h | 1 - tools/testing/selftests/bpf/config.x86_64 | 1 - tools/testing/selftests/hid/config.common | 1 - 15 files changed, 17 insertions(+), 313 deletions(-) commit f8fa5d76925991976b3e7076f9d1052515ec1fca Author: Jens Axboe Date: Fri Dec 15 13:24:10 2023 -0700 cred: switch to using atomic_long_t There are multiple ways to grab references to credentials, and the only protection we have against overflowing it is the memory required to do so. With memory sizes only moving in one direction, let's bump the reference count to 64-bit and move it outside the realm of feasibly overflowing. Signed-off-by: Jens Axboe Signed-off-by: Linus Torvalds include/linux/cred.h | 8 +++---- kernel/cred.c | 64 ++++++++++++++++++++++++++-------------------------- 2 files changed, 36 insertions(+), 36 deletions(-) commit 5df12742b7e3aae2594a30a9d14d5d6e9e7699f4 Author: Bjorn Helgaas Date: Thu Dec 14 09:08:56 2023 -0600 Revert "PCI: acpiphp: Reassign resources on bridge if necessary" This reverts commit 40613da52b13fb21c5566f10b287e0ca8c12c4e9 and the subsequent fix to it: cc22522fd55e ("PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root bus") 40613da52b13 fixed a problem where hot-adding a device with large BARs failed if the bridge windows programmed by firmware were not large enough. cc22522fd55e ("PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root bus") fixed a problem with 40613da52b13: an ACPI hot-add of a device on a PCI root bus (common in the virt world) or firmware sending ACPI Bus Check to non-existent Root Ports (e.g., on Dell Inspiron 7352/0W6WV0) caused a NULL pointer dereference and suspend/resume hangs. Unfortunately the combination of 40613da52b13 and cc22522fd55e caused other problems: - Fiona reported that hot-add of SCSI disks in QEMU virtual machine fails sometimes. - Dongli reported a similar problem with hot-add of SCSI disks. - Jonathan reported a console freeze during boot on bare metal due to an error in radeon GPU initialization. Revert both patches to avoid adding these problems. This means we will again see the problems with hot-adding devices with large BARs and the NULL pointer dereferences and suspend/resume issues that 40613da52b13 and cc22522fd55e were intended to fix. Fixes: 40613da52b13 ("PCI: acpiphp: Reassign resources on bridge if necessary") Fixes: cc22522fd55e ("PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root bus") Reported-by: Fiona Ebner Closes: https://lore.kernel.org/r/9eb669c0-d8f2-431d-a700-6da13053ae54@proxmox.com Reported-by: Dongli Zhang Closes: https://lore.kernel.org/r/3c4a446a-b167-11b8-f36f-d3c1b49b42e9@oracle.com Reported-by: Jonathan Woithe Closes: https://lore.kernel.org/r/ZXpaNCLiDM+Kv38H@marvin.atrad.com.au Signed-off-by: Bjorn Helgaas Acked-by: Michael S. Tsirkin Acked-by: Igor Mammedov Cc: drivers/pci/hotplug/acpiphp_glue.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit 3bd7d748816927202268cb335921f7f68b3ca723 Merge: a62aa88ba1a3 1ba0e9d69b20 Author: Linus Torvalds Date: Fri Dec 15 12:20:14 2023 -0800 Merge tag 'io_uring-6.7-2023-12-15' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "Just two minor fixes: - Fix for the io_uring socket option commands using the wrong value on some archs (Al) - Tweak to the poll lazy wake enable (me)" * tag 'io_uring-6.7-2023-12-15' of git://git.kernel.dk/linux: io_uring/cmd: fix breakage in SOCKET_URING_OP_SIOC* implementation io_uring/poll: don't enable lazy wake for POLLEXCLUSIVE commit a62aa88ba1a386e9b6953083b1ceb2fe027238b9 Merge: 26e7a301419d 4376807bf2d5 Author: Linus Torvalds Date: Fri Dec 15 12:00:54 2023 -0800 Merge tag 'mm-hotfixes-stable-2023-12-15-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "17 hotfixes. 8 are cc:stable and the other 9 pertain to post-6.6 issues" * tag 'mm-hotfixes-stable-2023-12-15-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/mglru: reclaim offlined memcgs harder mm/mglru: respect min_ttl_ms with memcgs mm/mglru: try to stop at high watermarks mm/mglru: fix underprotected page cache mm/shmem: fix race in shmem_undo_range w/THP Revert "selftests: error out if kernel header files are not yet built" crash_core: fix the check for whether crashkernel is from high memory x86, kexec: fix the wrong ifdeffery CONFIG_KEXEC sh, kexec: fix the incorrect ifdeffery and dependency of CONFIG_KEXEC mips, kexec: fix the incorrect ifdeffery and dependency of CONFIG_KEXEC m68k, kexec: fix the incorrect ifdeffery and build dependency of CONFIG_KEXEC loongarch, kexec: change dependency of object files mm/damon/core: make damon_start() waits until kdamond_fn() starts selftests/mm: cow: print ksft header before printing anything else mm: fix VMA heap bounds checking riscv: fix VMALLOC_START definition kexec: drop dependency on ARCH_SUPPORTS_KEXEC from CRASH_DUMP commit 26e7a301419d2ef4696e581109c61b4e772e1fb8 Merge: 595609b2ad02 315deab28992 Author: Linus Torvalds Date: Fri Dec 15 11:35:55 2023 -0800 Merge tag 'sound-6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of HD-audio quirks for TAS2781 codec and device-specific workarounds" * tag 'sound-6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/tas2781: reset the amp before component_add ALSA: hda/tas2781: call cleanup functions only once ALSA: hda/tas2781: handle missing EFI calibration data ALSA: hda/tas2781: leave hda_component in usable state ALSA: hda/realtek: Apply mute LED quirk for HP15-db ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB commit 595609b2ad023088dfd0ae74abb4602ea267e739 Merge: 3f7168591ebf 7ba84cbf18c7 Author: Linus Torvalds Date: Fri Dec 15 11:07:13 2023 -0800 Merge tag 'drm-fixes-2023-12-15' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "More regular fixes, amdgpu, i915, mediatek and nouveau are most of them this week. Nothing too major, then a few misc bits and pieces in core, panel and ivpu. drm: - fix uninit problems in crtc - fix fd ownership check - edid: add modes in fallback paths panel: - move LG panel into DSI yaml - ltk050h3146w: set burst mode mediatek: - mtk_disp_gamma: Fix breakage due to merge issue - fix kernel oops if no crtc is found - Add spinlock for setting vblank event in atomic_begin - Fix access violation in mtk_drm_crtc_dma_dev_get i915: - Fix selftest engine reset count storage for multi-tile - Fix out-of-bounds reads for engine reset counts - Fix ADL+ remapped stride with CCS - Fix intel_atomic_setup_scalers() plane_state handling - Fix ADL+ tiled plane stride when the POT stride is smaller than the original - Fix eDP 1.4 rate select method link configuration amdgpu: - Fix suspend fix that got accidently mangled last week - Fix OD regression - PSR fixes - OLED Backlight regression fix - JPEG 4.0.5 fix - Misc display fixes - SDMA 5.2 fix - SDMA 2.4 regression fix - GPUVM race fix nouveau: - fix gk20a instobj hierarchy - fix headless iors inheritance regression ivpu: - fix WA initialisation" * tag 'drm-fixes-2023-12-15' of git://anongit.freedesktop.org/drm/drm: (31 commits) drm/nouveau/kms/nv50-: Don't allow inheritance of headless iors drm/nouveau: Fixup gk20a instobj hierarchy drm/amdgpu: warn when there are still mappings when a BO is destroyed v2 drm/amdgpu: fix tear down order in amdgpu_vm_pt_free drm/amd: Fix a probing order problem on SDMA 2.4 drm/amdgpu/sdma5.2: add begin/end_use ring callbacks drm/panel: ltk050h3146w: Set burst mode for ltk050h3148w dt-bindings: panel-simple-dsi: move LG 5" HD TFT LCD panel into DSI yaml drm/amd/display: Disable PSR-SU on Parade 0803 TCON again drm/amd/display: Populate dtbclk from bounding box drm/amd/display: Revert "Fix conversions between bytes and KB" drm/amdgpu/jpeg: configure doorbell for each playback drm/amd/display: Restore guard against default backlight value < 1 nit drm/amd/display: fix hw rotated modes when PSR-SU is enabled drm/amd/pm: fix pp_*clk_od typo drm/amdgpu: fix buffer funcs setting order on suspend harder drm/mediatek: Fix access violation in mtk_drm_crtc_dma_dev_get drm/edid: also call add modes in EDID connector update fallback drm/i915/edp: don't write to DP_LINK_BW_SET when using rate select drm/i915: Fix ADL+ tiled plane stride when the POT stride is smaller than the original ... commit 2dc4196138055eb0340231aecac4d78c2ec2bea5 Author: Thomas Gleixner Date: Thu Dec 7 20:49:26 2023 +0100 x86/alternatives: Disable interrupts and sync when optimizing NOPs in place apply_alternatives() treats alternatives with the ALT_FLAG_NOT flag set special as it optimizes the existing NOPs in place. Unfortunately, this happens with interrupts enabled and does not provide any form of core synchronization. So an interrupt hitting in the middle of the update and using the affected code path will observe a half updated NOP and crash and burn. The following 3 NOP sequence was observed to expose this crash halfway reliably under QEMU 32bit: 0x90 0x90 0x90 which is replaced by the optimized 3 byte NOP: 0x8d 0x76 0x00 So an interrupt can observe: 1) 0x90 0x90 0x90 nop nop nop 2) 0x8d 0x90 0x90 undefined 3) 0x8d 0x76 0x90 lea -0x70(%esi),%esi 4) 0x8d 0x76 0x00 lea 0x0(%esi),%esi Where only #1 and #4 are true NOPs. The same problem exists for 64bit obviously. Disable interrupts around this NOP optimization and invoke sync_core() before re-enabling them. Fixes: 270a69c4485d ("x86/alternative: Support relocations in alternatives") Reported-by: Paul Gortmaker Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Acked-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/ZT6narvE%2BLxX%2B7Be@windriver.com arch/x86/kernel/alternative.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) commit 3ea1704a92967834bf0e64ca1205db4680d04048 Author: Thomas Gleixner Date: Thu Dec 7 20:49:24 2023 +0100 x86/alternatives: Sync core before enabling interrupts text_poke_early() does: local_irq_save(flags); memcpy(addr, opcode, len); local_irq_restore(flags); sync_core(); That's not really correct because the synchronization should happen before interrupts are re-enabled to ensure that a pending interrupt observes the complete update of the opcodes. It's not entirely clear whether the interrupt entry provides enough serialization already, but moving the sync_core() invocation into interrupt disabled region does no harm and is obviously correct. Fixes: 6fffacb30349 ("x86/alternatives, jumplabel: Use text_poke_early() before mm_init()") Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Acked-by: Peter Zijlstra (Intel) Cc: Link: https://lore.kernel.org/r/ZT6narvE%2BLxX%2B7Be@windriver.com arch/x86/kernel/alternative.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 69a7386c1ec25476a0c78ffeb59de08a2a08f495 Author: Thomas Gleixner Date: Fri Dec 15 09:58:58 2023 +0100 x86/smpboot/64: Handle X2APIC BIOS inconsistency gracefully Chris reported that a Dell PowerEdge T340 system stopped to boot when upgrading to a kernel which contains the parallel hotplug changes. Disabling parallel hotplug on the kernel command line makes it boot again. It turns out that the Dell BIOS has x2APIC enabled and the boot CPU comes up in X2APIC mode, but the APs come up inconsistently in xAPIC mode. Parallel hotplug requires that the upcoming CPU reads out its APIC ID from the local APIC in order to map it to the Linux CPU number. In this particular case the readout on the APs uses the MMIO mapped registers because the BIOS failed to enable x2APIC mode. That readout results in a page fault because the kernel does not have the APIC MMIO space mapped when X2APIC mode was enabled by the BIOS on the boot CPU and the kernel switched to X2APIC mode early. That page fault can't be handled on the upcoming CPU that early and results in a silent boot failure. If parallel hotplug is disabled the system boots because in that case the APIC ID read is not required as the Linux CPU number is provided to the AP in the smpboot control word. When the kernel uses x2APIC mode then the APs are switched to x2APIC mode too slightly later in the bringup process, but there is no reason to do it that late. Cure the BIOS bogosity by checking in the parallel bootup path whether the kernel uses x2APIC mode and if so switching over the APs to x2APIC mode before the APIC ID readout. Fixes: 0c7ffa32dbd6 ("x86/smpboot/64: Implement arch_cpuhp_init_parallel_bringup() and enable it") Reported-by: Chris Lindee Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Ashok Raj Tested-by: Chris Lindee Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/CA%2B2tU59853R49EaU_tyvOZuOTDdcU0RshGyydccp9R1NX9bEeQ@mail.gmail.com arch/x86/kernel/head_64.S | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 23c93c3b6275a59f2a685f4a693944b53c31df4e Author: Andy Gospodarek Date: Thu Dec 14 13:31:38 2023 -0800 bnxt_en: do not map packet buffers twice Remove double-mapping of DMA buffers as it can prevent page pool entries from being freed. Mapping is managed by page pool infrastructure and was previously managed by the driver in __bnxt_alloc_rx_page before allowing the page pool infrastructure to manage it. Fixes: 578fcfd26e2a ("bnxt_en: Let the page pool manage the DMA mapping") Reviewed-by: Somnath Kotur Signed-off-by: Andy Gospodarek Signed-off-by: Michael Chan Reviewed-by: David Wei Link: https://lore.kernel.org/r/20231214213138.98095-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) commit 2e07e8348ea454615e268222ae3fc240421be768 Author: Hyunwoo Kim Date: Sat Dec 9 05:55:18 2023 -0500 Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg This can cause a race with bt_sock_ioctl() because bt_sock_recvmsg() gets the skb from sk->sk_receive_queue and then frees it without holding lock_sock. A use-after-free for a skb occurs with the following flow. ``` bt_sock_recvmsg() -> skb_recv_datagram() -> skb_free_datagram() bt_sock_ioctl() -> skb_peek() ``` Add lock_sock to bt_sock_recvmsg() to fix this issue. Cc: stable@vger.kernel.org Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Hyunwoo Kim Signed-off-by: Luiz Augusto von Dentz net/bluetooth/af_bluetooth.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 04a342cc49a8522e99c9b3346371c329d841dcd2 Author: Alex Lu Date: Tue Dec 12 10:30:34 2023 +0800 Bluetooth: Add more enc key size check When we are slave role and receives l2cap conn req when encryption has started, we should check the enc key size to avoid KNOB attack or BLUFFS attack. From SIG recommendation, implementations are advised to reject service-level connections on an encrypted baseband link with key strengths below 7 octets. A simple and clear way to achieve this is to place the enc key size check in hci_cc_read_enc_key_size() The btmon log below shows the case that lacks enc key size check. > HCI Event: Connect Request (0x04) plen 10 Address: BB:22:33:44:55:99 (OUI BB-22-33) Class: 0x480104 Major class: Computer (desktop, notebook, PDA, organizers) Minor class: Desktop workstation Capturing (Scanner, Microphone) Telephony (Cordless telephony, Modem, Headset) Link type: ACL (0x01) < HCI Command: Accept Connection Request (0x01|0x0009) plen 7 Address: BB:22:33:44:55:99 (OUI BB-22-33) Role: Peripheral (0x01) > HCI Event: Command Status (0x0f) plen 4 Accept Connection Request (0x01|0x0009) ncmd 2 Status: Success (0x00) > HCI Event: Connect Complete (0x03) plen 11 Status: Success (0x00) Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33) Link type: ACL (0x01) Encryption: Disabled (0x00) ... > HCI Event: Encryption Change (0x08) plen 4 Status: Success (0x00) Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33) Encryption: Enabled with E0 (0x01) < HCI Command: Read Encryption Key Size (0x05|0x0008) plen 2 Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33) > HCI Event: Command Complete (0x0e) plen 7 Read Encryption Key Size (0x05|0x0008) ncmd 2 Status: Success (0x00) Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33) Key size: 6 // We should check the enc key size ... > ACL Data RX: Handle 1 flags 0x02 dlen 12 L2CAP: Connection Request (0x02) ident 3 len 4 PSM: 25 (0x0019) Source CID: 64 < ACL Data TX: Handle 1 flags 0x00 dlen 16 L2CAP: Connection Response (0x03) ident 3 len 8 Destination CID: 64 Source CID: 64 Result: Connection pending (0x0001) Status: Authorization pending (0x0002) > HCI Event: Number of Completed Packets (0x13) plen 5 Num handles: 1 Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33) Count: 1 #35: len 16 (25 Kb/s) Latency: 5 msec (2-7 msec ~4 msec) < ACL Data TX: Handle 1 flags 0x00 dlen 16 L2CAP: Connection Response (0x03) ident 3 len 8 Destination CID: 64 Source CID: 64 Result: Connection successful (0x0000) Status: No further information available (0x0000) Cc: stable@vger.kernel.org Signed-off-by: Alex Lu Signed-off-by: Max Chou Signed-off-by: Luiz Augusto von Dentz net/bluetooth/hci_event.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) commit 59b047bc98084f8af2c41483e4d68a5adf2fa7f7 Author: Xiao Yao Date: Tue Dec 12 00:27:18 2023 +0800 Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE If two Bluetooth devices both support BR/EDR and BLE, and also support Secure Connections, then they only need to pair once. The LTK generated during the LE pairing process may be converted into a BR/EDR link key for BR/EDR transport, and conversely, a link key generated during the BR/EDR SSP pairing process can be converted into an LTK for LE transport. Hence, the link type of the link key and LTK is not fixed, they can be either an LE LINK or an ACL LINK. Currently, in the mgmt_new_irk/ltk/crsk/link_key functions, the link type is fixed, which could lead to incorrect address types being reported to the application layer. Therefore, it is necessary to add link_type/addr_type to the smp_irk/ltk/crsk and link_key, to ensure the generation of the correct address type. SMP over BREDR: Before Fix: > ACL Data RX: Handle 11 flags 0x02 dlen 12 BR/EDR SMP: Identity Address Information (0x09) len 7 Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) @ MGMT Event: New Identity Resolving Key (0x0018) plen 30 Random address: 00:00:00:00:00:00 (Non-Resolvable) LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) @ MGMT Event: New Long Term Key (0x000a) plen 37 LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) Key type: Authenticated key from P-256 (0x03) After Fix: > ACL Data RX: Handle 11 flags 0x02 dlen 12 BR/EDR SMP: Identity Address Information (0x09) len 7 Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) @ MGMT Event: New Identity Resolving Key (0x0018) plen 30 Random address: 00:00:00:00:00:00 (Non-Resolvable) BR/EDR Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) @ MGMT Event: New Long Term Key (0x000a) plen 37 BR/EDR Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) Key type: Authenticated key from P-256 (0x03) SMP over LE: Before Fix: @ MGMT Event: New Identity Resolving Key (0x0018) plen 30 Random address: 5F:5C:07:37:47:D5 (Resolvable) LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) @ MGMT Event: New Long Term Key (0x000a) plen 37 LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) Key type: Authenticated key from P-256 (0x03) @ MGMT Event: New Link Key (0x0009) plen 26 BR/EDR Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) Key type: Authenticated Combination key from P-256 (0x08) After Fix: @ MGMT Event: New Identity Resolving Key (0x0018) plen 30 Random address: 5E:03:1C:00:38:21 (Resolvable) LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) @ MGMT Event: New Long Term Key (0x000a) plen 37 LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) Key type: Authenticated key from P-256 (0x03) @ MGMT Event: New Link Key (0x0009) plen 26 Store hint: Yes (0x01) LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) Key type: Authenticated Combination key from P-256 (0x08) Cc: stable@vger.kernel.org Signed-off-by: Xiao Yao Signed-off-by: Luiz Augusto von Dentz include/net/bluetooth/hci_core.h | 5 +++++ net/bluetooth/mgmt.c | 25 ++++++++++++++++++------- net/bluetooth/smp.c | 7 +++++++ 3 files changed, 30 insertions(+), 7 deletions(-) commit 78b99eb1faa7371bf9c534690f26a71b6996622d Author: Frédéric Danis Date: Fri Dec 8 18:41:50 2023 +0100 Bluetooth: L2CAP: Send reject on command corrupted request L2CAP/COS/CED/BI-02-C PTS test send a malformed L2CAP signaling packet with 2 commands in it (a connection request and an unknown command) and expect to get a connection response packet and a command reject packet. The second is currently not sent. Cc: stable@vger.kernel.org Signed-off-by: Frédéric Danis Signed-off-by: Luiz Augusto von Dentz net/bluetooth/l2cap_core.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) commit 50efc63d1a7a7b9a6ed21adae1b9a7123ec8abc0 Author: Luiz Augusto von Dentz Date: Fri Dec 8 17:22:29 2023 -0500 Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis hci_conn_hash_lookup_cis shall always match the requested CIG and CIS ids even when they are unset as otherwise it result in not being able to bind/connect different sockets to the same address as that would result in having multiple sockets mapping to the same hci_conn which doesn't really work and prevents BAP audio configuration such as AC 6(i) when CIG and CIS are left unset. Fixes: c14516faede3 ("Bluetooth: hci_conn: Fix not matching by CIS ID") Signed-off-by: Luiz Augusto von Dentz include/net/bluetooth/hci_core.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a5812c68d849505ea657f653446512b85887f813 Author: Arnd Bergmann Date: Wed Nov 22 23:17:44 2023 +0100 Bluetooth: hci_event: shut up a false-positive warning Turning on -Wstringop-overflow globally exposed a misleading compiler warning in bluetooth: net/bluetooth/hci_event.c: In function 'hci_cc_read_class_of_dev': net/bluetooth/hci_event.c:524:9: error: 'memcpy' writing 3 bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=] 524 | memcpy(hdev->dev_class, rp->dev_class, 3); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The problem here is the check for hdev being NULL in bt_dev_dbg() that leads the compiler to conclude that hdev->dev_class might be an invalid pointer access. Add another explicit check for the same condition to make sure gcc sees this cannot happen. Fixes: a9de9248064b ("[Bluetooth] Switch from OGF+OCF to using only opcodes") Fixes: 1b56c90018f0 ("Makefile: Enable -Wstringop-overflow globally") Signed-off-by: Arnd Bergmann Signed-off-by: Luiz Augusto von Dentz net/bluetooth/hci_event.c | 3 +++ 1 file changed, 3 insertions(+) commit 99e67d46e5ff3c7c901af6009edec72d3d363be8 Author: Luiz Augusto von Dentz Date: Mon Nov 20 10:04:39 2023 -0500 Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent Before setting HCI_INQUIRY bit check if HCI_OP_INQUIRY was really sent otherwise the controller maybe be generating invalid events or, more likely, it is a result of fuzzing tools attempting to test the right behavior of the stack when unexpected events are generated. Cc: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=218151 Signed-off-by: Luiz Augusto von Dentz net/bluetooth/hci_event.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 769bf60e17ee1a56a81e7c031192c3928312c52e Author: Ying Hsu Date: Fri Nov 10 01:46:05 2023 +0000 Bluetooth: Fix deadlock in vhci_send_frame syzbot found a potential circular dependency leading to a deadlock: -> #3 (&hdev->req_lock){+.+.}-{3:3}: __mutex_lock_common+0x1b6/0x1bc2 kernel/locking/mutex.c:599 __mutex_lock kernel/locking/mutex.c:732 [inline] mutex_lock_nested+0x17/0x1c kernel/locking/mutex.c:784 hci_dev_do_close+0x3f/0x9f net/bluetooth/hci_core.c:551 hci_rfkill_set_block+0x130/0x1ac net/bluetooth/hci_core.c:935 rfkill_set_block+0x1e6/0x3b8 net/rfkill/core.c:345 rfkill_fop_write+0x2d8/0x672 net/rfkill/core.c:1274 vfs_write+0x277/0xcf5 fs/read_write.c:594 ksys_write+0x19b/0x2bd fs/read_write.c:650 do_syscall_x64 arch/x86/entry/common.c:55 [inline] do_syscall_64+0x51/0xba arch/x86/entry/common.c:93 entry_SYSCALL_64_after_hwframe+0x61/0xcb -> #2 (rfkill_global_mutex){+.+.}-{3:3}: __mutex_lock_common+0x1b6/0x1bc2 kernel/locking/mutex.c:599 __mutex_lock kernel/locking/mutex.c:732 [inline] mutex_lock_nested+0x17/0x1c kernel/locking/mutex.c:784 rfkill_register+0x30/0x7e3 net/rfkill/core.c:1045 hci_register_dev+0x48f/0x96d net/bluetooth/hci_core.c:2622 __vhci_create_device drivers/bluetooth/hci_vhci.c:341 [inline] vhci_create_device+0x3ad/0x68f drivers/bluetooth/hci_vhci.c:374 vhci_get_user drivers/bluetooth/hci_vhci.c:431 [inline] vhci_write+0x37b/0x429 drivers/bluetooth/hci_vhci.c:511 call_write_iter include/linux/fs.h:2109 [inline] new_sync_write fs/read_write.c:509 [inline] vfs_write+0xaa8/0xcf5 fs/read_write.c:596 ksys_write+0x19b/0x2bd fs/read_write.c:650 do_syscall_x64 arch/x86/entry/common.c:55 [inline] do_syscall_64+0x51/0xba arch/x86/entry/common.c:93 entry_SYSCALL_64_after_hwframe+0x61/0xcb -> #1 (&data->open_mutex){+.+.}-{3:3}: __mutex_lock_common+0x1b6/0x1bc2 kernel/locking/mutex.c:599 __mutex_lock kernel/locking/mutex.c:732 [inline] mutex_lock_nested+0x17/0x1c kernel/locking/mutex.c:784 vhci_send_frame+0x68/0x9c drivers/bluetooth/hci_vhci.c:75 hci_send_frame+0x1cc/0x2ff net/bluetooth/hci_core.c:2989 hci_sched_acl_pkt net/bluetooth/hci_core.c:3498 [inline] hci_sched_acl net/bluetooth/hci_core.c:3583 [inline] hci_tx_work+0xb94/0x1a60 net/bluetooth/hci_core.c:3654 process_one_work+0x901/0xfb8 kernel/workqueue.c:2310 worker_thread+0xa67/0x1003 kernel/workqueue.c:2457 kthread+0x36a/0x430 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain kernel/locking/lockdep.c:3787 [inline] __lock_acquire+0x2d32/0x77fa kernel/locking/lockdep.c:5011 lock_acquire+0x273/0x4d5 kernel/locking/lockdep.c:5622 __flush_work+0xee/0x19f kernel/workqueue.c:3090 hci_dev_close_sync+0x32f/0x1113 net/bluetooth/hci_sync.c:4352 hci_dev_do_close+0x47/0x9f net/bluetooth/hci_core.c:553 hci_rfkill_set_block+0x130/0x1ac net/bluetooth/hci_core.c:935 rfkill_set_block+0x1e6/0x3b8 net/rfkill/core.c:345 rfkill_fop_write+0x2d8/0x672 net/rfkill/core.c:1274 vfs_write+0x277/0xcf5 fs/read_write.c:594 ksys_write+0x19b/0x2bd fs/read_write.c:650 do_syscall_x64 arch/x86/entry/common.c:55 [inline] do_syscall_64+0x51/0xba arch/x86/entry/common.c:93 entry_SYSCALL_64_after_hwframe+0x61/0xcb This change removes the need for acquiring the open_mutex in vhci_send_frame, thus eliminating the potential deadlock while maintaining the required packet ordering. Fixes: 92d4abd66f70 ("Bluetooth: vhci: Fix race when opening vhci device") Signed-off-by: Ying Hsu Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/hci_vhci.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit f67eabffb57d0bee379994a18ec5f462b2cbdf86 Author: Luiz Augusto von Dentz Date: Mon Oct 23 16:26:23 2023 -0700 Bluetooth: Fix not notifying when connection encryption changes Some layers such as SMP depend on getting notified about encryption changes immediately as they only allow certain PDU to be transmitted over an encrypted link which may cause SMP implementation to reject valid PDUs received thus causing pairing to fail when it shouldn't. Fixes: 7aca0ac4792e ("Bluetooth: Wait for HCI_OP_WRITE_AUTH_PAYLOAD_TO to complete") Signed-off-by: Luiz Augusto von Dentz net/bluetooth/hci_event.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit 1bd773b4f0c90123af19a853244be61518ae0556 Author: NeilBrown Date: Fri Dec 15 11:56:33 2023 +1100 nfsd: hold nfsd_mutex across entire netlink operation Rather than using svc_get() and svc_put() to hold a stable reference to the nfsd_svc for netlink lookups, simply hold the mutex for the entire time. The "entire" time isn't very long, and the mutex is not often contented. This makes way for us to remove the refcounts of svc, which is more confusing than useful. Reported-by: Jeff Layton Closes: https://lore.kernel.org/linux-nfs/5d9bbb599569ce29f16e4e0eef6b291eda0f375b.camel@kernel.org/T/#u Fixes: bd9d6a3efa97 ("NFSD: add rpc_status netlink support") Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever fs/nfsd/nfsctl.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit 2a501f55cd641eb4d3c16a2eab0d678693fac663 Author: NeilBrown Date: Fri Dec 15 11:56:31 2023 +1100 nfsd: call nfsd_last_thread() before final nfsd_put() If write_ports_addfd or write_ports_addxprt fail, they call nfsd_put() without calling nfsd_last_thread(). This leaves nn->nfsd_serv pointing to a structure that has been freed. So remove 'static' from nfsd_last_thread() and call it when the nfsd_serv is about to be destroyed. Fixes: ec52361df99b ("SUNRPC: stop using ->sv_nrthreads as a refcount") Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Cc: Signed-off-by: Chuck Lever fs/nfsd/nfsctl.c | 9 +++++++-- fs/nfsd/nfsd.h | 1 + fs/nfsd/nfssvc.c | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) commit 712292308af2265cd9b126aedfa987f10f452a33 Author: Steven Rostedt (Google) Date: Wed Dec 13 17:54:03 2023 -0500 ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI As the ring buffer recording requires cmpxchg() to work, if the architecture does not support cmpxchg in NMI, then do not do any recording within an NMI. Link: https://lore.kernel.org/linux-trace-kernel/20231213175403.6fc18540@gandalf.local.home Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Signed-off-by: Steven Rostedt (Google) kernel/trace/ring_buffer.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 0aa0e5289cfe984a8a9fdd79ccf46ccf080151f7 Author: Steven Rostedt (Google) Date: Fri Dec 15 08:41:14 2023 -0500 ring-buffer: Have rb_time_cmpxchg() set the msb counter too The rb_time_cmpxchg() on 32-bit architectures requires setting three 32-bit words to represent the 64-bit timestamp, with some salt for synchronization. Those are: msb, top, and bottom The issue is, the rb_time_cmpxchg() did not properly salt the msb portion, and the msb that was written was stale. Link: https://lore.kernel.org/linux-trace-kernel/20231215084114.20899342@rorschach.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Fixes: f03f2abce4f39 ("ring-buffer: Have 32 bit time stamps use all 64 bits") Signed-off-by: Steven Rostedt (Google) kernel/trace/ring_buffer.c | 2 ++ 1 file changed, 2 insertions(+) commit dec890089bf79a4954b61482715ee2d084364856 Author: Mathieu Desnoyers Date: Tue Dec 12 14:30:49 2023 -0500 ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg() The following race can cause rb_time_read() to observe a corrupted time stamp: rb_time_cmpxchg() [...] if (!rb_time_read_cmpxchg(&t->msb, msb, msb2)) return false; if (!rb_time_read_cmpxchg(&t->top, top, top2)) return false; __rb_time_read() [...] do { c = local_read(&t->cnt); top = local_read(&t->top); bottom = local_read(&t->bottom); msb = local_read(&t->msb); } while (c != local_read(&t->cnt)); *cnt = rb_time_cnt(top); /* If top and msb counts don't match, this interrupted a write */ if (*cnt != rb_time_cnt(msb)) return false; ^ this check fails to catch that "bottom" is still not updated. So the old "bottom" value is returned, which is wrong. Fix this by checking that all three of msb, top, and bottom 2-bit cnt values match. The reason to favor checking all three fields over requiring a specific update order for both rb_time_set() and rb_time_cmpxchg() is because checking all three fields is more robust to handle partial failures of rb_time_cmpxchg() when interrupted by nested rb_time_set(). Link: https://lore.kernel.org/lkml/20231211201324.652870-1-mathieu.desnoyers@efficios.com/ Link: https://lore.kernel.org/linux-trace-kernel/20231212193049.680122-1-mathieu.desnoyers@efficios.com Fixes: f458a1453424e ("ring-buffer: Test last update in 32bit version of __rb_time_read()") Signed-off-by: Mathieu Desnoyers Signed-off-by: Steven Rostedt (Google) kernel/trace/ring_buffer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit fff88fa0fbc7067ba46dde570912d63da42c59a9 Author: Steven Rostedt (Google) Date: Tue Dec 12 11:53:01 2023 -0500 ring-buffer: Fix a race in rb_time_cmpxchg() for 32 bit archs Mathieu Desnoyers pointed out an issue in the rb_time_cmpxchg() for 32 bit architectures. That is: static bool rb_time_cmpxchg(rb_time_t *t, u64 expect, u64 set) { unsigned long cnt, top, bottom, msb; unsigned long cnt2, top2, bottom2, msb2; u64 val; /* The cmpxchg always fails if it interrupted an update */ if (!__rb_time_read(t, &val, &cnt2)) return false; if (val != expect) return false; <<<< interrupted here! cnt = local_read(&t->cnt); The problem is that the synchronization counter in the rb_time_t is read *after* the value of the timestamp is read. That means if an interrupt were to come in between the value being read and the counter being read, it can change the value and the counter and the interrupted process would be clueless about it! The counter needs to be read first and then the value. That way it is easy to tell if the value is stale or not. If the counter hasn't been updated, then the value is still good. Link: https://lore.kernel.org/linux-trace-kernel/20231211201324.652870-1-mathieu.desnoyers@efficios.com/ Link: https://lore.kernel.org/linux-trace-kernel/20231212115301.7a9c9a64@gandalf.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Fixes: 10464b4aa605e ("ring-buffer: Add rb_time_t 64 bit operations for speeding up 32 bit") Reported-by: Mathieu Desnoyers Reviewed-by: Mathieu Desnoyers Signed-off-by: Steven Rostedt (Google) kernel/trace/ring_buffer.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 083e9f65bd215582bf8f6a920db729fadf16704f Author: Steven Rostedt (Google) Date: Fri Dec 15 08:18:10 2023 -0500 ring-buffer: Remove useless update to write_stamp in rb_try_to_discard() When filtering is enabled, a temporary buffer is created to place the content of the trace event output so that the filter logic can decide from the trace event output if the trace event should be filtered out or not. If it is to be filtered out, the content in the temporary buffer is simply discarded, otherwise it is written into the trace buffer. But if an interrupt were to come in while a previous event was using that temporary buffer, the event written by the interrupt would actually go into the ring buffer itself to prevent corrupting the data on the temporary buffer. If the event is to be filtered out, the event in the ring buffer is discarded, or if it fails to discard because another event were to have already come in, it is turned into padding. The update to the write_stamp in the rb_try_to_discard() happens after a fix was made to force the next event after the discard to use an absolute timestamp by setting the before_stamp to zero so it does not match the write_stamp (which causes an event to use the absolute timestamp). But there's an effort in rb_try_to_discard() to put back the write_stamp to what it was before the event was added. But this is useless and wasteful because nothing is going to be using that write_stamp for calculations as it still will not match the before_stamp. Remove this useless update, and in doing so, we remove another cmpxchg64()! Also update the comments to reflect this change as well as remove some extra white space in another comment. Link: https://lore.kernel.org/linux-trace-kernel/20231215081810.1f4f38fe@rorschach.local.home Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Joel Fernandes Cc: Vincent Donnefort Fixes: b2dd797543cf ("ring-buffer: Force absolute timestamp on discard of event") Signed-off-by: Steven Rostedt (Google) kernel/trace/ring_buffer.c | 47 +++++++++++----------------------------------- 1 file changed, 11 insertions(+), 36 deletions(-) commit dd939425707898da992e59ab0fcfae4652546910 Author: Steven Rostedt (Google) Date: Thu Dec 14 22:29:21 2023 -0500 ring-buffer: Do not try to put back write_stamp If an update to an event is interrupted by another event between the time the initial event allocated its buffer and where it wrote to the write_stamp, the code try to reset the write stamp back to the what it had just overwritten. It knows that it was overwritten via checking the before_stamp, and if it didn't match what it wrote to the before_stamp before it allocated its space, it knows it was overwritten. To put back the write_stamp, it uses the before_stamp it read. The problem here is that by writing the before_stamp to the write_stamp it makes the two equal again, which means that the write_stamp can be considered valid as the last timestamp written to the ring buffer. But this is not necessarily true. The event that interrupted the event could have been interrupted in a way that it was interrupted as well, and can end up leaving with an invalid write_stamp. But if this happens and returns to this context that uses the before_stamp to update the write_stamp again, it can possibly incorrectly make it valid, causing later events to have in correct time stamps. As it is OK to leave this function with an invalid write_stamp (one that doesn't match the before_stamp), there's no reason to try to make it valid again in this case. If this race happens, then just leave with the invalid write_stamp and the next event to come along will just add a absolute timestamp and validate everything again. Bonus points: This gets rid of another cmpxchg64! Link: https://lore.kernel.org/linux-trace-kernel/20231214222921.193037a7@gandalf.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Joel Fernandes Cc: Vincent Donnefort Fixes: a389d86f7fd09 ("ring-buffer: Have nested events still record running time stamp") Signed-off-by: Steven Rostedt (Google) kernel/trace/ring_buffer.c | 29 ++++++----------------------- 1 file changed, 6 insertions(+), 23 deletions(-) commit f32c80d34249e1cfb2e647ab3c8ef38a460c787f Author: Gergo Koteles Date: Thu Dec 14 23:04:44 2023 +0100 ASoC: tas2781: check the validity of prm_no/cfg_no Add additional checks for program/config numbers to avoid loading from invalid addresses. If prm_no/cfg_no is negative, skip uploading program/config. The tas2781-hda driver caused a NULL pointer dereference after loading module, and before first runtime_suspend. the state was: tas_priv->cur_conf = -1; tas_priv->tasdevice[i].cur_conf = 0; program = &(tas_fmw->programs[-1]); BUG: kernel NULL pointer dereference, address: 0000000000000010 Call Trace: ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? vprintk_emit+0x175/0x2b0 ? exc_page_fault+0x7f/0x180 ? asm_exc_page_fault+0x26/0x30 ? tasdevice_load_block_kernel+0x21/0x310 [snd_soc_tas2781_fmwlib] tasdevice_select_tuningprm_cfg+0x268/0x3a0 [snd_soc_tas2781_fmwlib] tasdevice_tuning_switch+0x69/0x710 [snd_soc_tas2781_fmwlib] tas2781_hda_playback_hook+0xd4/0x110 [snd_hda_scodec_tas2781_i2c] Fixes: 915f5eadebd2 ("ASoC: tas2781: firmware lib") CC: Signed-off-by: Gergo Koteles Link: https://msgid.link/r/523780155bfdca9bc0acd39efc79ed039454818d.1702591356.git.soyer@irl.hu Signed-off-by: Mark Brown sound/soc/codecs/tas2781-fmwlib.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) commit 7fbcd195e2b8cc952e4aeaeb50867b798040314c Author: Dan Carpenter Date: Wed Dec 13 16:22:43 2023 +0300 usb: fotg210-hcd: delete an incorrect bounds test Here "temp" is the number of characters that we have written and "size" is the size of the buffer. The intent was clearly to say that if we have written to the end of the buffer then stop. However, for that to work the comparison should have been done on the original "size" value instead of the "size -= temp" value. Not only will that not trigger when we want to, but there is a small chance that it will trigger incorrectly before we want it to and we break from the loop slightly earlier than intended. This code was recently changed from using snprintf() to scnprintf(). With snprintf() we likely would have continued looping and passed a negative size parameter to snprintf(). This would have triggered an annoying WARN(). Now that we have converted to scnprintf() "size" will never drop below 1 and there is no real need for this test. We could change the condition to "if (temp <= 1) goto done;" but just deleting the test is cleanest. Fixes: 7d50195f6c50 ("usb: host: Faraday fotg210-hcd driver") Cc: stable Signed-off-by: Dan Carpenter Reviewed-by: Linus Walleij Reviewed-by: Lee Jones Link: https://lore.kernel.org/r/ZXmwIwHe35wGfgzu@suswa Signed-off-by: Greg Kroah-Hartman drivers/usb/fotg210/fotg210-hcd.c | 3 --- 1 file changed, 3 deletions(-) commit 772685c14743ad565bb271041ad3c262298cd6fc Author: Tasos Sahanidis Date: Thu Dec 7 15:44:41 2023 +0200 usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3 This flash drive reports write protect during the first mode sense. In the past this was not an issue as the kernel called revalidate twice, thus asking the device for its write protect status twice, with write protect being disabled in the second mode sense. However, since commit 1e029397d12f ("scsi: sd: Reorganize DIF/DIX code to avoid calling revalidate twice") that is no longer the case, thus the device shows up read only. [490891.289495] sd 12:0:0:0: [sdl] Write Protect is on [490891.289497] sd 12:0:0:0: [sdl] Mode Sense: 2b 00 80 08 This does not appear to be a timing issue, as enabling the usbcore quirk USB_QUIRK_DELAY_INIT has no effect on write protect. Fixes: 1e029397d12f ("scsi: sd: Reorganize DIF/DIX code to avoid calling revalidate twice") Cc: stable Signed-off-by: Tasos Sahanidis Acked-by: Alan Stern Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20231207134441.298131-1-tasos@tasossah.com Signed-off-by: Greg Kroah-Hartman drivers/usb/storage/unusual_devs.h | 11 +++++++++++ 1 file changed, 11 insertions(+) commit c994cb596bf7ef5928f06331c76f46e071b16f09 Author: Johan Hovold Date: Fri Dec 8 13:36:02 2023 +0100 usb: typec: ucsi: fix gpio-based orientation detection Fix the recently added connector sanity check which was off by one and prevented orientation notifications from being handled correctly for the second port when using GPIOs to determine orientation. Fixes: c6165ed2f425 ("usb: ucsi: glink: use the connector orientation GPIO to provide switch events") Cc: stable Cc: Neil Armstrong Signed-off-by: Johan Hovold Reviewed-by: Dmitry Baryshkov Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20231208123603.29957-1-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/ucsi/ucsi_glink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit aef05e349bfd81c95adb4489639413fadbb74a83 Author: Jose Ignacio Tornos Martinez Date: Thu Dec 7 18:50:07 2023 +0100 net: usb: ax88179_178a: avoid failed operations when device is disconnected When the device is disconnected we get the following messages showing failed operations: Nov 28 20:22:11 localhost kernel: usb 2-3: USB disconnect, device number 2 Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3: unregister 'ax88179_178a' usb-0000:02:00.0-3, ASIX AX88179 USB 3.0 Gigabit Ethernet Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3: Failed to read reg index 0x0002: -19 Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3: Failed to write reg index 0x0002: -19 Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3 (unregistered): Failed to write reg index 0x0002: -19 Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3 (unregistered): Failed to write reg index 0x0001: -19 Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3 (unregistered): Failed to write reg index 0x0002: -19 The reason is that although the device is detached, normal stop and unbind operations are commanded from the driver. These operations are not necessary in this situation, so avoid these logs when the device is detached if the result of the operation is -ENODEV and if the new flag informing about the disconnecting status is enabled. cc: Fixes: e2ca90c276e1f ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver") Signed-off-by: Jose Ignacio Tornos Martinez Acked-by: Alan Stern Link: https://lore.kernel.org/r/20231207175007.263907-1-jtornosm@redhat.com Signed-off-by: Greg Kroah-Hartman drivers/net/usb/ax88179_178a.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) commit 1e37bf84afacd5ba17b7a13a18ca2bc78aff05c0 Author: Rafał Miłecki Date: Fri Dec 15 11:13:58 2023 +0000 nvmem: brcm_nvram: store a copy of NVRAM content This driver uses MMIO access for reading NVRAM from a flash device. Underneath there is a flash controller that reads data and provides mapping window. Using MMIO interface affects controller configuration and may break real controller driver. It was reported by multiple users of devices with NVRAM stored on NAND. Modify driver to read & cache NVRAM content during init and use that copy to provide NVMEM data when requested. On NAND flashes due to their alignment NVRAM partitions can be quite big (1 MiB and more) while actual NVRAM content stays quite small (usually 16 to 32 KiB). To avoid allocating so much memory check for actual data length. Link: https://lore.kernel.org/linux-mtd/CACna6rwf3_9QVjYcM+847biTX=K0EoWXuXcSMkJO1Vy_5vmVqA@mail.gmail.com/ Fixes: 3fef9ed0627a ("nvmem: brcm_nvram: new driver exposing Broadcom's NVRAM") Cc: Cc: Arınç ÜNAL Cc: Florian Fainelli Cc: Scott Branden Signed-off-by: Rafał Miłecki Acked-by: Arınç ÜNAL Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20231215111358.316727-3-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman drivers/nvmem/brcm_nvram.c | 134 +++++++++++++++++++++++++++++++-------------- 1 file changed, 94 insertions(+), 40 deletions(-) commit a2a8aefecbd0f87d6127951cef33b3def8439057 Author: Fabio Estevam Date: Fri Dec 15 11:13:57 2023 +0000 dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp Both imx23.dtsi and imx28.dtsi describe the OCOTP nodes in the format: compatible = "fsl,imx28-ocotp", "fsl,ocotp"; Document the "fsl,ocotp" entry to fix the following schema warning: efuse@8002c000: compatible: ['fsl,imx23-ocotp', 'fsl,ocotp'] is too long from schema $id: http://devicetree.org/schemas/nvmem/mxs-ocotp.yaml# Fixes: 2c504460f502 ("dt-bindings: nvmem: Convert MXS OCOTP to json-schema") Cc: Signed-off-by: Fabio Estevam Acked-by: Conor Dooley Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20231215111358.316727-2-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 134c6eaa6087d78c0e289931ca15ae7a5007670d Author: Dan Williams Date: Wed Dec 13 15:02:35 2023 -0800 driver core: Add a guard() definition for the device_lock() At present there are ~200 usages of device_lock() in the kernel. Some of those usages lead to "goto unlock;" patterns which have proven to be error prone. Define a "device" guard() definition to allow for those to be cleaned up and prevent new ones from appearing. Link: http://lore.kernel.org/r/657897453dda8_269bd29492@dwillia2-mobl3.amr.corp.intel.com.notmuch Link: http://lore.kernel.org/r/6577b0c2a02df_a04c5294bb@dwillia2-xfh.jf.intel.com.notmuch Cc: Vishal Verma Cc: Ira Weiny Cc: Peter Zijlstra Cc: Greg Kroah-Hartman Cc: Andrew Morton Signed-off-by: Dan Williams Reviewed-by: Ira Weiny Reviewed-by: Dave Jiang Reviewed-by: Vishal Verma Link: https://lore.kernel.org/r/170250854466.1522182.17555361077409628655.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Greg Kroah-Hartman include/linux/device.h | 2 ++ 1 file changed, 2 insertions(+) commit 9483aa44912f26da2b69dade6099c2bf4b50a8c3 Author: Shubhrajyoti Datta Date: Fri Dec 15 11:03:52 2023 +0530 EDAC/versal: Read num_csrows and num_chans using the correct bitfield macro Fix the extraction of num_csrows and num_chans. The extraction of the num_rows is wrong. Instead of extracting using the FIELD_GET it is calling FIELD_PREP. The issue was masked as the default design has the rows as 0. Fixes: 6f15b178cd63 ("EDAC/versal: Add a Xilinx Versal memory controller driver") Closes: https://lore.kernel.org/all/60ca157e-6eff-d12c-9dc0-8aeab125edda@linux-m68k.org/ Reported-by: Geert Uytterhoeven Signed-off-by: Shubhrajyoti Datta Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20231215053352.8740-1-shubhrajyoti.datta@amd.com drivers/edac/versal_edac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 64b8bc7d5f1434c636a40bdcfcd42b278d1714be Author: Eric Dumazet Date: Thu Dec 14 15:27:47 2023 +0000 net/rose: fix races in rose_kill_by_device() syzbot found an interesting netdev refcounting issue in net/rose/af_rose.c, thanks to CONFIG_NET_DEV_REFCNT_TRACKER=y [1] Problem is that rose_kill_by_device() can change rose->device while other threads do not expect the pointer to be changed. We have to first collect sockets in a temporary array, then perform the changes while holding the socket lock and rose_list_lock spinlock (in this order) Change rose_release() to also acquire rose_list_lock before releasing the netdev refcount. [1] [ 1185.055088][ T7889] ref_tracker: reference already released. [ 1185.061476][ T7889] ref_tracker: allocated in: [ 1185.066081][ T7889] rose_bind+0x4ab/0xd10 [ 1185.070446][ T7889] __sys_bind+0x1ec/0x220 [ 1185.074818][ T7889] __x64_sys_bind+0x72/0xb0 [ 1185.079356][ T7889] do_syscall_64+0x40/0x110 [ 1185.083897][ T7889] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1185.089835][ T7889] ref_tracker: freed in: [ 1185.094088][ T7889] rose_release+0x2f5/0x570 [ 1185.098629][ T7889] __sock_release+0xae/0x260 [ 1185.103262][ T7889] sock_close+0x1c/0x20 [ 1185.107453][ T7889] __fput+0x270/0xbb0 [ 1185.111467][ T7889] task_work_run+0x14d/0x240 [ 1185.116085][ T7889] get_signal+0x106f/0x2790 [ 1185.120622][ T7889] arch_do_signal_or_restart+0x90/0x7f0 [ 1185.126205][ T7889] exit_to_user_mode_prepare+0x121/0x240 [ 1185.131846][ T7889] syscall_exit_to_user_mode+0x1e/0x60 [ 1185.137293][ T7889] do_syscall_64+0x4d/0x110 [ 1185.141783][ T7889] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1185.148085][ T7889] ------------[ cut here ]------------ WARNING: CPU: 1 PID: 7889 at lib/ref_tracker.c:255 ref_tracker_free+0x61a/0x810 lib/ref_tracker.c:255 Modules linked in: CPU: 1 PID: 7889 Comm: syz-executor.2 Not tainted 6.7.0-rc4-syzkaller-00162-g65c95f78917e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:ref_tracker_free+0x61a/0x810 lib/ref_tracker.c:255 Code: 00 44 8b 6b 18 31 ff 44 89 ee e8 21 62 f5 fc 45 85 ed 0f 85 a6 00 00 00 e8 a3 66 f5 fc 48 8b 34 24 48 89 ef e8 27 5f f1 05 90 <0f> 0b 90 bb ea ff ff ff e9 52 fd ff ff e8 84 66 f5 fc 4c 8d 6d 44 RSP: 0018:ffffc90004917850 EFLAGS: 00010202 RAX: 0000000000000201 RBX: ffff88802618f4c0 RCX: 0000000000000000 RDX: 0000000000000202 RSI: ffffffff8accb920 RDI: 0000000000000001 RBP: ffff8880269ea5b8 R08: 0000000000000001 R09: fffffbfff23e35f6 R10: ffffffff91f1afb7 R11: 0000000000000001 R12: 1ffff92000922f0c R13: 0000000005a2039b R14: ffff88802618f4d8 R15: 00000000ffffffff FS: 00007f0a720ef6c0(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f43a819d988 CR3: 0000000076c64000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: netdev_tracker_free include/linux/netdevice.h:4127 [inline] netdev_put include/linux/netdevice.h:4144 [inline] netdev_put include/linux/netdevice.h:4140 [inline] rose_kill_by_device net/rose/af_rose.c:195 [inline] rose_device_event+0x25d/0x330 net/rose/af_rose.c:218 notifier_call_chain+0xb6/0x3b0 kernel/notifier.c:93 call_netdevice_notifiers_info+0xbe/0x130 net/core/dev.c:1967 call_netdevice_notifiers_extack net/core/dev.c:2005 [inline] call_netdevice_notifiers net/core/dev.c:2019 [inline] __dev_notify_flags+0x1f5/0x2e0 net/core/dev.c:8646 dev_change_flags+0x122/0x170 net/core/dev.c:8682 dev_ifsioc+0x9ad/0x1090 net/core/dev_ioctl.c:529 dev_ioctl+0x224/0x1090 net/core/dev_ioctl.c:786 sock_do_ioctl+0x198/0x270 net/socket.c:1234 sock_ioctl+0x22e/0x6b0 net/socket.c:1339 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl fs/ioctl.c:857 [inline] __x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f0a7147cba9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0a720ef0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f0a7159bf80 RCX: 00007f0a7147cba9 RDX: 0000000020000040 RSI: 0000000000008914 RDI: 0000000000000004 RBP: 00007f0a714c847a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f0a7159bf80 R15: 00007ffc8bb3a5f8 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Bernard Pidoux Signed-off-by: David S. Miller net/rose/af_rose.c | 39 ++++++++++++++++++++++++++++++++++----- 1 file changed, 34 insertions(+), 5 deletions(-) commit 7e2c1e4b34f07d9aa8937fab88359d4a0fce468e Author: Mark Rutland Date: Fri Dec 15 11:24:50 2023 +0000 perf: Fix perf_event_validate_size() lockdep splat When lockdep is enabled, the for_each_sibling_event(sibling, event) macro checks that event->ctx->mutex is held. When creating a new group leader event, we call perf_event_validate_size() on a partially initialized event where event->ctx is NULL, and so when for_each_sibling_event() attempts to check event->ctx->mutex, we get a splat, as reported by Lucas De Marchi: WARNING: CPU: 8 PID: 1471 at kernel/events/core.c:1950 __do_sys_perf_event_open+0xf37/0x1080 This only happens for a new event which is its own group_leader, and in this case there cannot be any sibling events. Thus it's safe to skip the check for siblings, which avoids having to make invasive and ugly changes to for_each_sibling_event(). Avoid the splat by bailing out early when the new event is its own group_leader. Fixes: 382c27f4ed28f803 ("perf: Fix perf_event_validate_size()") Closes: https://lore.kernel.org/lkml/20231214000620.3081018-1-lucas.demarchi@intel.com/ Closes: https://lore.kernel.org/lkml/ZXpm6gQ%2Fd59jGsuW@xpf.sh.intel.com/ Reported-by: Lucas De Marchi Reported-by: Pengfei Xu Signed-off-by: Mark Rutland Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20231215112450.3972309-1-mark.rutland@arm.com kernel/events/core.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 309fdb1c33fe726d92d0030481346f24e1b01f07 Author: Zhipeng Lu Date: Thu Dec 14 21:04:04 2023 +0800 ethernet: atheros: fix a memleak in atl1e_setup_ring_resources In the error handling of 'offset > adapter->ring_size', the tx_ring->tx_buffer allocated by kzalloc should be freed, instead of 'goto failed' instantly. Fixes: a6a5325239c2 ("atl1e: Atheros L1E Gigabit Ethernet driver") Signed-off-by: Zhipeng Lu Reviewed-by: Suman Ghosh Signed-off-by: David S. Miller drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 19391a2ca98baa7b80279306cdf7dd43f81fa595 Author: Eric Dumazet Date: Thu Dec 14 11:30:38 2023 +0000 net: sched: ife: fix potential use-after-free ife_decode() calls pskb_may_pull() two times, we need to reload ifehdr after the second one, or risk use-after-free as reported by syzbot: BUG: KASAN: slab-use-after-free in __ife_tlv_meta_valid net/ife/ife.c:108 [inline] BUG: KASAN: slab-use-after-free in ife_tlv_meta_decode+0x1d1/0x210 net/ife/ife.c:131 Read of size 2 at addr ffff88802d7300a4 by task syz-executor.5/22323 CPU: 0 PID: 22323 Comm: syz-executor.5 Not tainted 6.7.0-rc3-syzkaller-00804-g074ac38d5b95 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xc4/0x620 mm/kasan/report.c:475 kasan_report+0xda/0x110 mm/kasan/report.c:588 __ife_tlv_meta_valid net/ife/ife.c:108 [inline] ife_tlv_meta_decode+0x1d1/0x210 net/ife/ife.c:131 tcf_ife_decode net/sched/act_ife.c:739 [inline] tcf_ife_act+0x4e3/0x1cd0 net/sched/act_ife.c:879 tc_act include/net/tc_wrapper.h:221 [inline] tcf_action_exec+0x1ac/0x620 net/sched/act_api.c:1079 tcf_exts_exec include/net/pkt_cls.h:344 [inline] mall_classify+0x201/0x310 net/sched/cls_matchall.c:42 tc_classify include/net/tc_wrapper.h:227 [inline] __tcf_classify net/sched/cls_api.c:1703 [inline] tcf_classify+0x82f/0x1260 net/sched/cls_api.c:1800 hfsc_classify net/sched/sch_hfsc.c:1147 [inline] hfsc_enqueue+0x315/0x1060 net/sched/sch_hfsc.c:1546 dev_qdisc_enqueue+0x3f/0x230 net/core/dev.c:3739 __dev_xmit_skb net/core/dev.c:3828 [inline] __dev_queue_xmit+0x1de1/0x3d30 net/core/dev.c:4311 dev_queue_xmit include/linux/netdevice.h:3165 [inline] packet_xmit+0x237/0x350 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x24aa/0x5200 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7fe9acc7cae9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe9ada450c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007fe9acd9bf80 RCX: 00007fe9acc7cae9 RDX: 000000000000fce0 RSI: 00000000200002c0 RDI: 0000000000000003 RBP: 00007fe9accc847a R08: 0000000020000140 R09: 0000000000000014 R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fe9acd9bf80 R15: 00007ffd5427ae78 Allocated by task 22323: kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:383 kasan_kmalloc include/linux/kasan.h:198 [inline] __do_kmalloc_node mm/slab_common.c:1007 [inline] __kmalloc_node_track_caller+0x5a/0x90 mm/slab_common.c:1027 kmalloc_reserve+0xef/0x260 net/core/skbuff.c:582 __alloc_skb+0x12b/0x330 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1298 [inline] alloc_skb_with_frags+0xe4/0x710 net/core/skbuff.c:6331 sock_alloc_send_pskb+0x7e4/0x970 net/core/sock.c:2780 packet_alloc_skb net/packet/af_packet.c:2930 [inline] packet_snd net/packet/af_packet.c:3024 [inline] packet_sendmsg+0x1e2a/0x5200 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Freed by task 22323: kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:522 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x15b/0x1b0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1800 [inline] slab_free_freelist_hook+0x114/0x1e0 mm/slub.c:1826 slab_free mm/slub.c:3809 [inline] __kmem_cache_free+0xc0/0x180 mm/slub.c:3822 skb_kfree_head net/core/skbuff.c:950 [inline] skb_free_head+0x110/0x1b0 net/core/skbuff.c:962 pskb_expand_head+0x3c5/0x1170 net/core/skbuff.c:2130 __pskb_pull_tail+0xe1/0x1830 net/core/skbuff.c:2655 pskb_may_pull_reason include/linux/skbuff.h:2685 [inline] pskb_may_pull include/linux/skbuff.h:2693 [inline] ife_decode+0x394/0x4f0 net/ife/ife.c:82 tcf_ife_decode net/sched/act_ife.c:727 [inline] tcf_ife_act+0x43b/0x1cd0 net/sched/act_ife.c:879 tc_act include/net/tc_wrapper.h:221 [inline] tcf_action_exec+0x1ac/0x620 net/sched/act_api.c:1079 tcf_exts_exec include/net/pkt_cls.h:344 [inline] mall_classify+0x201/0x310 net/sched/cls_matchall.c:42 tc_classify include/net/tc_wrapper.h:227 [inline] __tcf_classify net/sched/cls_api.c:1703 [inline] tcf_classify+0x82f/0x1260 net/sched/cls_api.c:1800 hfsc_classify net/sched/sch_hfsc.c:1147 [inline] hfsc_enqueue+0x315/0x1060 net/sched/sch_hfsc.c:1546 dev_qdisc_enqueue+0x3f/0x230 net/core/dev.c:3739 __dev_xmit_skb net/core/dev.c:3828 [inline] __dev_queue_xmit+0x1de1/0x3d30 net/core/dev.c:4311 dev_queue_xmit include/linux/netdevice.h:3165 [inline] packet_xmit+0x237/0x350 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x24aa/0x5200 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b The buggy address belongs to the object at ffff88802d730000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 164 bytes inside of freed 8192-byte region [ffff88802d730000, ffff88802d732000) The buggy address belongs to the physical page: page:ffffea0000b5cc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2d730 head:ffffea0000b5cc00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000840 ffff888013042280 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 22323, tgid 22320 (syz-executor.5), ts 950317230369, free_ts 950233467461 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1544 prep_new_page mm/page_alloc.c:1551 [inline] get_page_from_freelist+0xa28/0x3730 mm/page_alloc.c:3319 __alloc_pages+0x22e/0x2420 mm/page_alloc.c:4575 alloc_pages_mpol+0x258/0x5f0 mm/mempolicy.c:2133 alloc_slab_page mm/slub.c:1870 [inline] allocate_slab mm/slub.c:2017 [inline] new_slab+0x283/0x3c0 mm/slub.c:2070 ___slab_alloc+0x979/0x1500 mm/slub.c:3223 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3322 __slab_alloc_node mm/slub.c:3375 [inline] slab_alloc_node mm/slub.c:3468 [inline] __kmem_cache_alloc_node+0x131/0x310 mm/slub.c:3517 __do_kmalloc_node mm/slab_common.c:1006 [inline] __kmalloc_node_track_caller+0x4a/0x90 mm/slab_common.c:1027 kmalloc_reserve+0xef/0x260 net/core/skbuff.c:582 __alloc_skb+0x12b/0x330 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1298 [inline] alloc_skb_with_frags+0xe4/0x710 net/core/skbuff.c:6331 sock_alloc_send_pskb+0x7e4/0x970 net/core/sock.c:2780 packet_alloc_skb net/packet/af_packet.c:2930 [inline] packet_snd net/packet/af_packet.c:3024 [inline] packet_sendmsg+0x1e2a/0x5200 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1144 [inline] free_unref_page_prepare+0x53c/0xb80 mm/page_alloc.c:2354 free_unref_page+0x33/0x3b0 mm/page_alloc.c:2494 __unfreeze_partials+0x226/0x240 mm/slub.c:2655 qlink_free mm/kasan/quarantine.c:168 [inline] qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x18e/0x1d0 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0x65/0x90 mm/kasan/common.c:305 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:763 [inline] slab_alloc_node mm/slub.c:3478 [inline] slab_alloc mm/slub.c:3486 [inline] __kmem_cache_alloc_lru mm/slub.c:3493 [inline] kmem_cache_alloc_lru+0x219/0x6f0 mm/slub.c:3509 alloc_inode_sb include/linux/fs.h:2937 [inline] ext4_alloc_inode+0x28/0x650 fs/ext4/super.c:1408 alloc_inode+0x5d/0x220 fs/inode.c:261 new_inode_pseudo fs/inode.c:1006 [inline] new_inode+0x22/0x260 fs/inode.c:1032 __ext4_new_inode+0x333/0x5200 fs/ext4/ialloc.c:958 ext4_symlink+0x5d7/0xa20 fs/ext4/namei.c:3398 vfs_symlink fs/namei.c:4464 [inline] vfs_symlink+0x3e5/0x620 fs/namei.c:4448 do_symlinkat+0x25f/0x310 fs/namei.c:4490 __do_sys_symlinkat fs/namei.c:4506 [inline] __se_sys_symlinkat fs/namei.c:4503 [inline] __x64_sys_symlinkat+0x97/0xc0 fs/namei.c:4503 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 Fixes: d57493d6d1be ("net: sched: ife: check on metadata length") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Jamal Hadi Salim Cc: Alexander Aring Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller net/ife/ife.c | 1 + 1 file changed, 1 insertion(+) commit cac23b7d7627915d967ce25436d7aae26e88ed06 Author: Shigeru Yoshida Date: Thu Dec 14 14:09:22 2023 +0900 net: Return error from sk_stream_wait_connect() if sk_wait_event() fails The following NULL pointer dereference issue occurred: BUG: kernel NULL pointer dereference, address: 0000000000000000 <...> RIP: 0010:ccid_hc_tx_send_packet net/dccp/ccid.h:166 [inline] RIP: 0010:dccp_write_xmit+0x49/0x140 net/dccp/output.c:356 <...> Call Trace: dccp_sendmsg+0x642/0x7e0 net/dccp/proto.c:801 inet_sendmsg+0x63/0x90 net/ipv4/af_inet.c:846 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x83/0xe0 net/socket.c:745 ____sys_sendmsg+0x443/0x510 net/socket.c:2558 ___sys_sendmsg+0xe5/0x150 net/socket.c:2612 __sys_sendmsg+0xa6/0x120 net/socket.c:2641 __do_sys_sendmsg net/socket.c:2650 [inline] __se_sys_sendmsg net/socket.c:2648 [inline] __x64_sys_sendmsg+0x45/0x50 net/socket.c:2648 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x43/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b sk_wait_event() returns an error (-EPIPE) if disconnect() is called on the socket waiting for the event. However, sk_stream_wait_connect() returns success, i.e. zero, even if sk_wait_event() returns -EPIPE, so a function that waits for a connection with sk_stream_wait_connect() may misbehave. In the case of the above DCCP issue, dccp_sendmsg() is waiting for the connection. If disconnect() is called in concurrently, the above issue occurs. This patch fixes the issue by returning error from sk_stream_wait_connect() if sk_wait_event() fails. Fixes: 419ce133ab92 ("tcp: allow again tcp_disconnect() when threads are waiting") Signed-off-by: Shigeru Yoshida Reviewed-by: Kuniyuki Iwashima Reported-by: syzbot+c71bc336c5061153b502@syzkaller.appspotmail.com Reviewed-by: Eric Dumazet Reported-by: syzbot Reported-by: syzkaller Signed-off-by: David S. Miller net/core/stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8c97ab5448f2096daba11edf8d18a44e1eb6f31d Author: Suman Ghosh Date: Wed Dec 13 23:40:44 2023 +0530 octeontx2-pf: Fix graceful exit during PFC configuration failure During PFC configuration failure the code was not handling a graceful exit. This patch fixes the same and add proper code for a graceful exit. Fixes: 99c969a83d82 ("octeontx2-pf: Add egress PFC support") Signed-off-by: Suman Ghosh Signed-off-by: David S. Miller drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) commit 738b54b9b6236f573eed2453c4cbfa77326793e2 Author: duanqiangwen Date: Thu Dec 14 10:33:37 2023 +0800 net: libwx: fix memory leak on free page ifconfig ethx up, will set page->refcount larger than 1, and then ifconfig ethx down, calling __page_frag_cache_drain() to free pages, it is not compatible with page pool. So deleting codes which changing page->refcount. Fixes: 3c47e8ae113a ("net: libwx: Support to receive packets in NAPI") Signed-off-by: duanqiangwen Signed-off-by: David S. Miller drivers/net/ethernet/wangxun/libwx/wx_lib.c | 82 ++-------------------------- drivers/net/ethernet/wangxun/libwx/wx_type.h | 1 - 2 files changed, 6 insertions(+), 77 deletions(-) commit 06f22cd6635bdae7d73566fca9879b2026a08e00 Author: Reinhard Speyerer Date: Tue Dec 12 18:15:38 2023 +0100 USB: serial: option: add Quectel RM500Q R13 firmware support Add support for Quectel RM500Q R13 firmware which uses Prot=40 for the NMEA port: T: Bus=02 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 8 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2c7c ProdID=0800 Rev= 4.14 S: Manufacturer=Quectel S: Product=RM500Q-AE S: SerialNumber=xxxxxxxx C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=896mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms Signed-off-by: Reinhard Speyerer Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold drivers/usb/serial/option.c | 1 + 1 file changed, 1 insertion(+) commit 13fde9ac23ca8c6d1ac13cc9eefe1f1ac3ee30a4 Author: Slark Xiao Date: Fri Dec 1 10:09:50 2023 +0800 USB: serial: option: add Foxconn T99W265 with new baseline This ID was added based on latest SDX12 code base line, and we made some changes with previous 0489:e0db. Test evidence as below: T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 2 P: Vendor=0489 ProdID=e0da Rev=05.04 S: Manufacturer=Qualcomm S: Product=Qualcomm Snapdragon X12 S: SerialNumber=2bda65fb C: #Ifs= 6 Cfg#= 2 Atr=a0 MxPwr=896mA I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) 0&1: MBIM, 2: Modem, 3:GNSS, 4:Diag, 5:ADB Signed-off-by: Slark Xiao Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+) commit ec1de5c214eb5a892fdb7c450748249d5e2840f5 Author: Gergo Koteles Date: Fri Dec 15 00:33:27 2023 +0100 ALSA: hda/tas2781: select program 0, conf 0 by default Currently, cur_prog/cur_conf remains at the default value (-1), while program 0 has been loaded into the amplifiers. In the playback hook, tasdevice_tuning_switch tries to restore the cur_prog/cur_conf. In the runtime_resume/system_resume, tasdevice_prmg_load tries to load the cur_prog as well. Set cur_prog and cur_conf to 0 if available in the firmware. Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver") CC: stable@vger.kernel.org Signed-off-by: Gergo Koteles Link: https://lore.kernel.org/r/038add0bdca1f979cc7abcce8f24cbcd3544084b.1702596646.git.soyer@irl.hu Signed-off-by: Takashi Iwai sound/pci/hda/tas2781_hda_i2c.c | 4 ++++ 1 file changed, 4 insertions(+) commit 02a460adfc4920d4da775fb59ab3e54036daef22 Author: Clément Villeret Date: Thu Dec 14 21:36:32 2023 +0100 ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA Asus ROG Flowx13 (GV302XA) seems require same patch as others asus products Signed-off-by: Clément Villeret Cc: Link: https://lore.kernel.org/r/0a27bf4b-3056-49ac-9651-ebd7f3e36328@gmail.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit ef3d5cf9c59cccb012aa6b93d99f4c6eb5d6648e Author: Ira Weiny Date: Mon Oct 16 16:25:05 2023 -0700 cxl/pmu: Ensure put_device on pmu devices The following kmemleaks were detected when removing the cxl module stack: unreferenced object 0xffff88822616b800 (size 1024): ... backtrace: [<00000000bedc6f83>] kmalloc_trace+0x26/0x90 [<00000000448d1afc>] devm_cxl_pmu_add+0x3a/0x110 [cxl_core] [<00000000ca3bfe16>] 0xffffffffa105213b [<00000000ba7f78dc>] local_pci_probe+0x41/0x90 [<000000005bb027ac>] pci_device_probe+0xb0/0x1c0 ... unreferenced object 0xffff8882260abcc0 (size 16): ... hex dump (first 16 bytes): 70 6d 75 5f 6d 65 6d 30 2e 30 00 26 82 88 ff ff pmu_mem0.0.&.... backtrace: ... [<00000000152b5e98>] dev_set_name+0x43/0x50 [<00000000c228798b>] devm_cxl_pmu_add+0x102/0x110 [cxl_core] [<00000000ca3bfe16>] 0xffffffffa105213b [<00000000ba7f78dc>] local_pci_probe+0x41/0x90 [<000000005bb027ac>] pci_device_probe+0xb0/0x1c0 ... unreferenced object 0xffff8882272af200 (size 256): ... backtrace: [<00000000bedc6f83>] kmalloc_trace+0x26/0x90 [<00000000a14d1813>] device_add+0x4ea/0x890 [<00000000a3f07b47>] devm_cxl_pmu_add+0xbe/0x110 [cxl_core] [<00000000ca3bfe16>] 0xffffffffa105213b [<00000000ba7f78dc>] local_pci_probe+0x41/0x90 [<000000005bb027ac>] pci_device_probe+0xb0/0x1c0 ... devm_cxl_pmu_add() correctly registers a device remove function but it only calls device_del() which is only part of device unregistration. Properly call device_unregister() to free up the memory associated with the device. Fixes: 1ad3f701c399 ("cxl/pci: Find and register CXL PMU devices") Cc: Jonathan Cameron Signed-off-by: Ira Weiny Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20231016-pmu-unregister-fix-v1-1-1e2eb2fa3c69@intel.com Signed-off-by: Dan Williams drivers/cxl/core/pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7ba84cbf18c7a53107c64880d9c90f18fa68b481 Author: Lyude Paul Date: Wed Dec 13 19:43:57 2023 -0500 drm/nouveau/kms/nv50-: Don't allow inheritance of headless iors Turns out we made a silly mistake when coming up with OR inheritance on nouveau. On pre-DCB 4.1, iors are statically routed to output paths via the DCB. On later generations iors are only routed to an output path if they're actually being used. Unfortunately, it appears with NVIF_OUTP_INHERIT_V0 we make the mistake of assuming the later is true on all generations, which is currently leading us to return bogus ior -> head assignments through nvif, which causes WARN_ON(). So - fix this by verifying that we actually know that there's a head assigned to an ior before allowing it to be inherited through nvif. This -should- hopefully fix the WARN_ON on GT218 reported by Borislav. Signed-off-by: Lyude Paul Cc: Borislav Petkov Reported-by: Borislav Petkov (AMD) Tested-by: Borislav Petkov (AMD) Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20231214004359.1028109-1-lyude@redhat.com drivers/gpu/drm/nouveau/nvkm/engine/disp/uoutp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 46dec61643d7047c9b5929f98a2b7fa4fa93a7dc Author: Thierry Reding Date: Fri Dec 8 11:46:53 2023 +0100 drm/nouveau: Fixup gk20a instobj hierarchy Commit 12c9b05da918 ("drm/nouveau/imem: support allocations not preserved across suspend") uses container_of() to cast from struct nvkm_memory to struct nvkm_instobj, assuming that all instance objects are derived from struct nvkm_instobj. For the gk20a family that's not the case and they are derived from struct nvkm_memory instead. This causes some subtle data corruption (nvkm_instobj.preserve ends up mapping to gk20a_instobj.vaddr) that causes a NULL pointer dereference in gk20a_instobj_acquire_iommu() (and possibly elsewhere) and also prevents suspend/resume from working. Fix this by making struct gk20a_instobj derive from struct nvkm_instobj instead. Fixes: 12c9b05da918 ("drm/nouveau/imem: support allocations not preserved across suspend") Reported-by: Jonathan Hunter Signed-off-by: Thierry Reding Tested-by: Jon Hunter Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20231208104653.1917055-1-thierry.reding@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/instmem/gk20a.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit 3f7168591ebf7bbdb91797d02b1afaf00a4289b1 Merge: 976600c6da56 3a42709fa909 Author: Linus Torvalds Date: Thu Dec 14 19:57:42 2023 -0800 Merge tag '6.7-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: "Address OOBs and NULL dereference found by Dr. Morris's recent analysis and fuzzing. All marked for stable as well" * tag '6.7-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: fix OOB in smb2_query_reparse_point() smb: client: fix NULL deref in asn1_ber_decoder() smb: client: fix potential OOBs in smb2_parse_contexts() smb: client: fix OOB in receive_encrypted_standard() commit 0225191a769510ed2591e29c5f0dc88f04c7a632 Merge: e9b797dc7af9 3c2a8ebe3fe6 Author: Jakub Kicinski Date: Thu Dec 14 19:04:57 2023 -0800 Merge tag 'wireless-2023-12-14' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== * add (and fix) certificate for regdb handover to Chen-Yu Tsai * fix rfkill GPIO handling * a few driver (iwlwifi, mt76) crash fixes * logic fixes in the stack * tag 'wireless-2023-12-14' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: cfg80211: fix certs build to not depend on file order wifi: mt76: fix crash with WED rx support enabled wifi: iwlwifi: pcie: avoid a NULL pointer dereference wifi: mac80211: mesh_plink: fix matches_local logic wifi: mac80211: mesh: check element parsing succeeded wifi: mac80211: check defragmentation succeeded wifi: mac80211: don't re-add debugfs during reconfig net: rfkill: gpio: set GPIO direction wifi: mac80211: check if the existing link config remains unchanged wifi: cfg80211: Add my certificate wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock wifi: ieee80211: don't require protected vendor action frames ==================== Link: https://lore.kernel.org/r/20231214111515.60626-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit e9b797dc7af995ac237b4c0b3a9463c5c54c0ff7 Merge: 2c1a4185a105 b13559b76157 Author: Jakub Kicinski Date: Thu Dec 14 19:00:30 2023 -0800 Merge tag 'mlx5-fixes-2023-12-13' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2023-12-13 This series provides bug fixes to mlx5 driver. * tag 'mlx5-fixes-2023-12-13' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors net/mlx5e: Correct snprintf truncation handling for fw_version buffer net/mlx5e: Fix error codes in alloc_branch_attr() net/mlx5e: Fix error code in mlx5e_tc_action_miss_mapping_get() net/mlx5: Refactor mlx5_flow_destination->rep pointer to vport num net/mlx5: Fix fw tracer first block check net/mlx5e: XDP, Drop fragmented packets larger than MTU size net/mlx5e: Decrease num_block_tc when unblock tc offload net/mlx5e: Fix overrun reported by coverity net/mlx5e: fix a potential double-free in fs_udp_create_groups net/mlx5e: Fix a race in command alloc flow net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() net/mlx5e: fix double free of encap_header Revert "net/mlx5e: fix double free of encap_header" Revert "net/mlx5e: fix double free of encap_header in update funcs" ==================== Link: https://lore.kernel.org/r/20231214012505.42666-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 2c1a4185a105a252582056b642b2c294bc6ba980 Merge: 70f010da00f9 9b3daf2b0443 Author: Jakub Kicinski Date: Thu Dec 14 18:57:39 2023 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-12-13 (ice, i40e) This series contains updates to ice and i40e drivers. Michal Schmidt prevents possible out-of-bounds access for ice. Ivan Vecera corrects value for MDIO clause 45 on i40e. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: i40e: Fix ST code value for Clause 45 ice: fix theoretical out-of-bounds access in ethtool link modes ==================== Link: https://lore.kernel.org/r/20231213220827.1311772-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit f8678a336808f728ea2e0806cfc10362958ca4e5 Merge: 7beae48301f7 6c9dbee84cd0 Author: Dave Airlie Date: Fri Dec 15 12:47:11 2023 +1000 Merge tag 'drm-misc-fixes-2023-12-14' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v6.7-rc6: - Fix regression for checking if FD is master capable. - Fix uninitialized variables in drm/crtc. - Fix ivpu w/a. - Refresh modes correctly when updating EDID. - Small panel fixes. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/2d46b68f-c5a4-45e5-beb4-411569f4aac8@linux.intel.com commit 7beae48301f7ca214939e522051007b9b4daf178 Merge: 51af5563423c a4236c4b4108 Author: Dave Airlie Date: Fri Dec 15 12:21:42 2023 +1000 Merge tag 'amd-drm-fixes-6.7-2023-12-13' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.7-2023-12-13: amdgpu: - Fix suspend fix that got accidently mangled last week - Fix OD regression - PSR fixes - OLED Backlight regression fix - JPEG 4.0.5 fix - Misc display fixes - SDMA 5.2 fix - SDMA 2.4 regression fix - GPUVM race fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20231213221122.4937-1-alexander.deucher@amd.com commit 70f010da00f90415296f93fb47a561977eae41cb Author: Vladimir Oltean Date: Thu Dec 14 02:09:02 2023 +0200 net: mscc: ocelot: fix pMAC TX RMON stats for bucket 256-511 and above The typo from ocelot_port_rmon_stats_cb() was also carried over to ocelot_port_pmac_rmon_stats_cb() as well, leading to incorrect TX RMON stats for the pMAC too. Fixes: ab3f97a9610a ("net: mscc: ocelot: export ethtool MAC Merge stats for Felix VSC9959") Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20231214000902.545625-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mscc/ocelot_stats.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 52eda4641d041667fa059f4855c5f88dcebd8afe Author: Vladimir Oltean Date: Thu Dec 14 02:09:01 2023 +0200 net: mscc: ocelot: fix eMAC TX RMON stats for bucket 256-511 and above There is a typo in the driver due to which we report incorrect TX RMON counters for the 256-511 octet bucket and all the other buckets larger than that. Bug found with the selftest at https://patchwork.kernel.org/project/netdevbpf/patch/20231211223346.2497157-9-tobias@waldekranz.com/ Fixes: e32036e1ae7b ("net: mscc: ocelot: add support for all sorts of standardized counters present in DSA") Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20231214000902.545625-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mscc/ocelot_stats.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 976600c6da56c488776c9ee2a5733ae9736e2a75 Merge: c7402612e2e6 7bcd032370f8 Author: Linus Torvalds Date: Thu Dec 14 17:15:33 2023 -0800 Merge tag 'platform-drivers-x86-v6.7-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - tablet-mode-switch events fix - kernel-doc warning fixes * tag 'platform-drivers-x86-v6.7-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: intel_ips: fix kernel-doc formatting platform/x86: thinkpad_acpi: fix kernel-doc warnings platform/x86: intel-vbtn: Fix missing tablet-mode-switch events commit 51af5563423c6e8537da8b6bd485b46c2b0d6492 Merge: 2fda61748214 e6861d8264cd Author: Dave Airlie Date: Fri Dec 15 11:12:40 2023 +1000 Merge tag 'drm-intel-fixes-2023-12-13' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v6.7-rc6: - Fix selftest engine reset count storage for multi-tile - Fix out-of-bounds reads for engine reset counts - Fix ADL+ remapped stride with CCS - Fix intel_atomic_setup_scalers() plane_state handling - Fix ADL+ tiled plane stride when the POT stride is smaller than the original - Fix eDP 1.4 rate select method link configuration Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/871qbqw4rw.fsf@intel.com commit 1ba0e9d69b2000e95267c888cbfa91d823388d47 Author: Al Viro Date: Thu Dec 14 21:34:08 2023 +0000 io_uring/cmd: fix breakage in SOCKET_URING_OP_SIOC* implementation In 8e9fad0e70b7 "io_uring: Add io_uring command support for sockets" you've got an include of asm-generic/ioctls.h done in io_uring/uring_cmd.c. That had been done for the sake of this chunk - + ret = prot->ioctl(sk, SIOCINQ, &arg); + if (ret) + return ret; + return arg; + case SOCKET_URING_OP_SIOCOUTQ: + ret = prot->ioctl(sk, SIOCOUTQ, &arg); SIOC{IN,OUT}Q are defined to symbols (FIONREAD and TIOCOUTQ) that come from ioctls.h, all right, but the values vary by the architecture. FIONREAD is 0x467F on mips 0x4004667F on alpha, powerpc and sparc 0x8004667F on sh and xtensa 0x541B everywhere else TIOCOUTQ is 0x7472 on mips 0x40047473 on alpha, powerpc and sparc 0x80047473 on sh and xtensa 0x5411 everywhere else ->ioctl() expects the same values it would've gotten from userland; all places where we compare with SIOC{IN,OUT}Q are using asm/ioctls.h, so they pick the correct values. io_uring_cmd_sock(), OTOH, ends up passing the default ones. Fixes: 8e9fad0e70b7 ("io_uring: Add io_uring command support for sockets") Cc: Signed-off-by: Al Viro Link: https://lore.kernel.org/r/20231214213408.GT1674809@ZenIV Signed-off-by: Jens Axboe io_uring/uring_cmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c7402612e2e61b76177f22e6e7f705adcbecc6fe Merge: bdb2701f0b68 7bb26ea74aa8 Author: Linus Torvalds Date: Thu Dec 14 13:11:49 2023 -0800 Merge tag 'net-6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Current release - regressions: - tcp: fix tcp_disordered_ack() vs usec TS resolution Current release - new code bugs: - dpll: sanitize possible null pointer dereference in dpll_pin_parent_pin_set() - eth: octeon_ep: initialise control mbox tasks before using APIs Previous releases - regressions: - io_uring/af_unix: disable sending io_uring over sockets - eth: mlx5e: - TC, don't offload post action rule if not supported - fix possible deadlock on mlx5e_tx_timeout_work - eth: iavf: fix iavf_shutdown to call iavf_remove instead iavf_close - eth: bnxt_en: fix skb recycling logic in bnxt_deliver_skb() - eth: ena: fix DMA syncing in XDP path when SWIOTLB is on - eth: team: fix use-after-free when an option instance allocation fails Previous releases - always broken: - neighbour: don't let neigh_forced_gc() disable preemption for long - net: prevent mss overflow in skb_segment() - ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX - tcp: remove acked SYN flag from packet in the transmit queue correctly - eth: octeontx2-af: - fix a use-after-free in rvu_nix_register_reporters - fix promisc mcam entry action - eth: dwmac-loongson: make sure MDIO is initialized before use - eth: atlantic: fix double free in ring reinit logic" * tag 'net-6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (62 commits) net: atlantic: fix double free in ring reinit logic appletalk: Fix Use-After-Free in atalk_ioctl net: stmmac: Handle disabled MDIO busses from devicetree net: stmmac: dwmac-qcom-ethqos: Fix drops in 10M SGMII RX dpaa2-switch: do not ask for MDB, VLAN and FDB replay dpaa2-switch: fix size of the dma_unmap net: prevent mss overflow in skb_segment() vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() Revert "tcp: disable tcp_autocorking for socket when TCP_NODELAY flag is set" MIPS: dts: loongson: drop incorrect dwmac fallback compatible stmmac: dwmac-loongson: drop useless check for compatible fallback stmmac: dwmac-loongson: Make sure MDIO is initialized before use tcp: disable tcp_autocorking for socket when TCP_NODELAY flag is set dpll: sanitize possible null pointer dereference in dpll_pin_parent_pin_set() net: ena: Fix XDP redirection error net: ena: Fix DMA syncing in XDP path when SWIOTLB is on net: ena: Fix xdp drops handling due to multibuf packets net: ena: Destroy correct number of xdp queues upon failure net: Remove acked SYN flag from packet in the transmit queue correctly qed: Fix a potential use-after-free in qed_cxt_tables_alloc ... commit d73ad797c83b0777407a2200bbefa3cb82759247 Merge: 81556f228c0e 4a6756f56bcf Author: Arnd Bergmann Date: Thu Dec 14 21:02:22 2023 +0000 Merge tag 'reset-fixes-for-v6.7' of git://git.pengutronix.de/pza/linux into arm/fixes Reset controller fixes for v6.7 Fix a void-pointer-to-enum-cast warning in the hisilicon hi6220 reset driver and fix a NULL pointer dereference when freeing non-existent optional resets requested via the reset_array API in the core. * tag 'reset-fixes-for-v6.7' of git://git.pengutronix.de/pza/linux: reset: Fix crash when freeing non-existent optional resets reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning Link: https://lore.kernel.org/r/20231213152606.231044-1-p.zabel@pengutronix.de Signed-off-by: Arnd Bergmann commit 81556f228c0e7b3681e1002eb182efc4c1410c72 Merge: a39b6ac3781d b9622937d958 Author: Arnd Bergmann Date: Thu Dec 14 21:01:40 2023 +0000 Merge tag 'sunxi-fixes-for-6.7-1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes - Fix ethernet node for Orange Pi Zero 3 board * tag 'sunxi-fixes-for-6.7-1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: h616: update emac for Orange Pi Zero 3 Link: https://lore.kernel.org/r/ZXtVUJ0SG2NRpPG4@archlinux Signed-off-by: Arnd Bergmann commit 85c6db980989ddc119ea1647ad72a4ec5a4e06f2 Author: Daniel Hill Date: Tue Dec 5 19:10:28 2023 +1300 bcachefs: improve modprobe support by providing softdeps We need to help modprobe load architecture specific modules so we don't fall back to generic software implementations, this should help performance when building as a module. Signed-off-by: Daniel Hill Signed-off-by: Kent Overstreet fs/bcachefs/super.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 50a8a732d2db64507ba7cd4ebe66538d9c40bea8 Author: Thomas Bertschinger Date: Thu Dec 14 12:06:41 2023 -0700 bcachefs: fix invalid memory access in bch2_fs_alloc() error path When bch2_fs_alloc() gets an error before calling bch2_fs_btree_iter_init(), bch2_fs_btree_iter_exit() makes an invalid memory access because btree_trans_list is uninitialized. Signed-off-by: Thomas Bertschinger Fixes: 6bd68ec266ad ("bcachefs: Heap allocate btree_trans") Signed-off-by: Kent Overstreet fs/bcachefs/btree_iter.c | 8 ++++++-- fs/bcachefs/btree_iter.h | 1 + fs/bcachefs/super.c | 1 + 3 files changed, 8 insertions(+), 2 deletions(-) commit bdb2701f0b6822d711ec34968ccef70b73a91da7 Merge: 829649443e78 e85a0adacf17 Author: Linus Torvalds Date: Thu Dec 14 11:53:00 2023 -0800 Merge tag 'for-6.7-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Some fixes to quota accounting code, mostly around error handling and correctness: - free reserves on various error paths, after IO errors or transaction abort - don't clear reserved range at the folio release time, it'll be properly cleared after final write - fix integer overflow due to int used when passing around size of freed reservations - fix a regression in squota accounting that missed some cases with delayed refs" * tag 'for-6.7-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: ensure releasing squota reserve on head refs btrfs: don't clear qgroup reserved bit in release_folio btrfs: free qgroup pertrans reserve on transaction abort btrfs: fix qgroup_free_reserved_data int overflow btrfs: free qgroup reserve when ORDERED_IOERR is set commit 7bb26ea74aa86fdf894b7dbd8c5712c5b4187da7 Author: Igor Russkikh Date: Wed Dec 13 10:40:44 2023 +0100 net: atlantic: fix double free in ring reinit logic Driver has a logic leak in ring data allocation/free, where double free may happen in aq_ring_free if system is under stress and driver init/deinit is happening. The probability is higher to get this during suspend/resume cycle. Verification was done simulating same conditions with stress -m 2000 --vm-bytes 20M --vm-hang 10 --backoff 1000 while true; do sudo ifconfig enp1s0 down; sudo ifconfig enp1s0 up; done Fixed by explicitly clearing pointers to NULL on deallocation Fixes: 018423e90bee ("net: ethernet: aquantia: Add ring support code") Reported-by: Linus Torvalds Closes: https://lore.kernel.org/netdev/CAHk-=wiZZi7FcvqVSUirHBjx0bBUZ4dFrMDVLc3+3HCrtq0rBA@mail.gmail.com/ Signed-off-by: Igor Russkikh Link: https://lore.kernel.org/r/20231213094044.22988-1-irusskikh@marvell.com Signed-off-by: Paolo Abeni drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 315deab289924c83ab1ded50022e8db95d6e428b Author: Gergo Koteles Date: Thu Dec 14 00:49:20 2023 +0100 ALSA: hda/tas2781: reset the amp before component_add Calling component_add starts loading the firmware, the callback function writes the program to the amplifiers. If the module resets the amplifiers after component_add, it happens that one of the amplifiers does not work because the reset and program writing are interleaving. Call tas2781_reset before component_add to ensure reliable initialization. Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver") CC: stable@vger.kernel.org Signed-off-by: Gergo Koteles Link: https://lore.kernel.org/r/4d23bf58558e23ee8097de01f70f1eb8d9de2d15.1702511246.git.soyer@irl.hu Signed-off-by: Takashi Iwai sound/pci/hda/tas2781_hda_i2c.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6c6fa2641402e8e753262fb61ed9a15a7cb225ad Author: Gergo Koteles Date: Thu Dec 14 00:28:16 2023 +0100 ALSA: hda/tas2781: call cleanup functions only once If the module can load the RCA but not the firmware binary, it will call the cleanup functions. Then unloading the module causes general protection fault due to double free. Do not call the cleanup functions in tasdev_fw_ready. general protection fault, probably for non-canonical address 0x6f2b8a2bff4c8fec: 0000 [#1] PREEMPT SMP NOPTI Call Trace: ? die_addr+0x36/0x90 ? exc_general_protection+0x1c5/0x430 ? asm_exc_general_protection+0x26/0x30 ? tasdevice_config_info_remove+0x6d/0xd0 [snd_soc_tas2781_fmwlib] tas2781_hda_unbind+0xaa/0x100 [snd_hda_scodec_tas2781_i2c] component_unbind+0x2e/0x50 component_unbind_all+0x92/0xa0 component_del+0xa8/0x140 tas2781_hda_remove.isra.0+0x32/0x60 [snd_hda_scodec_tas2781_i2c] i2c_device_remove+0x26/0xb0 Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver") CC: stable@vger.kernel.org Signed-off-by: Gergo Koteles Link: https://lore.kernel.org/r/1a0885c424bb21172702d254655882b59ef6477a.1702510018.git.soyer@irl.hu Signed-off-by: Takashi Iwai sound/pci/hda/tas2781_hda_i2c.c | 5 ----- 1 file changed, 5 deletions(-) commit 189ff16722ee36ced4d2a2469d4ab65a8fee4198 Author: Hyunwoo Kim Date: Tue Dec 12 23:10:56 2023 -0500 appletalk: Fix Use-After-Free in atalk_ioctl Because atalk_ioctl() accesses sk->sk_receive_queue without holding a sk->sk_receive_queue.lock, it can cause a race with atalk_recvmsg(). A use-after-free for skb occurs with the following flow. ``` atalk_ioctl() -> skb_peek() atalk_recvmsg() -> skb_recv_datagram() -> skb_free_datagram() ``` Add sk->sk_receive_queue.lock to atalk_ioctl() to fix this issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Hyunwoo Kim Link: https://lore.kernel.org/r/20231213041056.GA519680@v4bel-B760M-AORUS-ELITE-AX Signed-off-by: Paolo Abeni net/appletalk/ddp.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit e23c0d21ce9234fbc31ece35663ababbb83f9347 Author: Andrew Halaney Date: Tue Dec 12 16:18:33 2023 -0600 net: stmmac: Handle disabled MDIO busses from devicetree Many hardware configurations have the MDIO bus disabled, and are instead using some other MDIO bus to talk to the MAC's phy. of_mdiobus_register() returns -ENODEV in this case. Let's handle it gracefully instead of failing to probe the MAC. Fixes: 47dd7a540b8a ("net: add support for STMicroelectronics Ethernet controllers.") Signed-off-by: Andrew Halaney Reviewed-by: Serge Semin Link: https://lore.kernel.org/r/20231212-b4-stmmac-handle-mdio-enodev-v2-1-600171acf79f@redhat.com Signed-off-by: Paolo Abeni drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit fc70d643a2f6678cbe0f5c86433c1aeb4d613fcc Author: Louis Chauvet Date: Mon Dec 4 16:49:03 2023 +0100 spi: atmel: Fix clock issue when using devices with different polarities The current Atmel SPI controller driver (v2) behaves incorrectly when using two SPI devices with different clock polarities and GPIO CS. When switching from one device to another, the controller driver first enables the CS and then applies whatever configuration suits the targeted device (typically, the polarities). The side effect of such order is the apparition of a spurious clock edge after enabling the CS when the clock polarity needs to be inverted wrt. the previous configuration of the controller. This parasitic clock edge is problematic when the SPI device uses that edge for internal processing, which is perfectly legitimate given that its CS was asserted. Indeed, devices such as HVS8080 driven by driver gpio-sr in the kernel are shift registers and will process this first clock edge to perform a first register shift. In this case, the first bit gets lost and the whole data block that will later be read by the kernel is all shifted by one. Current behavior: The actual switching of the clock polarity only occurs after the CS when the controller sends the first message: CLK ------------\ /-\ /-\ | | | | | . . . \---/ \-/ \ CS -----\ | \------------------ ^ ^ ^ | | | | | Actual clock of the message sent | | | Change of clock polarity, which occurs with the first | write to the bus. This edge occurs when the CS is | already asserted, and can be interpreted as | the first clock edge by the receiver. | GPIO CS toggle This issue is specific to this controller because while the SPI core performs the operations in the right order, the controller however does not. In practice, the controller only applies the clock configuration right before the first transmission. So this is not a problem when using the controller's dedicated CS, as the controller does things correctly, but it becomes a problem when you need to change the clock polarity and use an external GPIO for the CS. One possible approach to solve this problem is to send a dummy message before actually activating the CS, so that the controller applies the clock polarity beforehand. New behavior: CLK ------\ /-\ /-\ /-\ /-\ | | | ... | | | | ... | | \------/ \- -/ \------/ \- -/ \------ CS -\/-----------------------\ || | \/ \--------------------- ^ ^ ^ ^ ^ | | | | | | | | | Expected clock cycles when | | | | sending the message | | | | | | | Actual GPIO CS activation, occurs inside | | | the driver | | | | | Dummy message, to trigger clock polarity | | reconfiguration. This message is not received and | | processed by the device because CS is low. | | | Change of clock polarity, forced by the dummy message. This | time, the edge is not detected by the receiver. | This small spike in CS activation is due to the fact that the spi-core activates the CS gpio before calling the driver's set_cs callback, which deactivates this gpio again until the clock polarity is correct. To avoid having to systematically send a dummy packet, the driver keeps track of the clock's current polarity. In this way, it only sends the dummy packet when necessary, ensuring that the clock will have the correct polarity when the CS is toggled. There could be two hardware problems with this patch: 1- Maybe the small CS activation peak can confuse SPI devices 2- If on a design, a single wire is used to select two devices depending on its state, the dummy message may disturb them. Fixes: 5ee36c989831 ("spi: atmel_spi update chipselect handling") Cc: Signed-off-by: Louis Chauvet Link: https://msgid.link/r/20231204154903.11607-1-louis.chauvet@bootlin.com Signed-off-by: Mark Brown drivers/spi/spi-atmel.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 81 insertions(+), 1 deletion(-) commit 981d947bcd382c3950a593690e0e13d194d65b1c Author: Sneh Shah Date: Tue Dec 12 14:52:08 2023 +0530 net: stmmac: dwmac-qcom-ethqos: Fix drops in 10M SGMII RX In 10M SGMII mode all the packets are being dropped due to wrong Rx clock. SGMII 10MBPS mode needs RX clock divider programmed to avoid drops in Rx. Update configure SGMII function with Rx clk divider programming. Fixes: 463120c31c58 ("net: stmmac: dwmac-qcom-ethqos: add support for SGMII") Tested-by: Andrew Halaney Signed-off-by: Sneh Shah Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20231212092208.22393-1-quic_snehshah@quicinc.com Signed-off-by: Paolo Abeni drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 3c2a8ebe3fe66a5f77d4c164a0bea8e2ff37b455 Author: Johannes Berg Date: Thu Dec 14 09:08:16 2023 +0100 wifi: cfg80211: fix certs build to not depend on file order The file for the new certificate (Chen-Yu Tsai's) didn't end with a comma, so depending on the file order in the build rule, we'd end up with invalid C when concatenating the (now two) certificates. Fix that. Cc: stable@vger.kernel.org Reported-by: Biju Das Reported-by: Naresh Kamboju Fixes: fb768d3b13ff ("wifi: cfg80211: Add my certificate") Signed-off-by: Johannes Berg net/wireless/certs/wens.hex | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 89e0c6467eefec542e49712d987086cb2a43d7a3 Merge: dc84bb19b5d0 7ae42ef308ed Author: Jakub Kicinski Date: Wed Dec 13 22:03:01 2023 -0800 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-12-12 (iavf) This series contains updates to iavf driver only. Piotr reworks Flow Director states to deal with issues in restoring filters. Slawomir fixes shutdown processing as it was missing needed calls. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: iavf: Fix iavf_shutdown to call iavf_remove instead iavf_close iavf: Handle ntuple on/off based on new state machines for flow director iavf: Introduce new state machines for flow director ==================== Link: https://lore.kernel.org/r/20231212203613.513423-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 1cc111b9cddc71ce161cd388f11f0e9048edffdb Author: Zheng Yejian Date: Thu Dec 14 09:21:53 2023 +0800 tracing: Fix uaf issue when open the hist or hist_debug file KASAN report following issue. The root cause is when opening 'hist' file of an instance and accessing 'trace_event_file' in hist_show(), but 'trace_event_file' has been freed due to the instance being removed. 'hist_debug' file has the same problem. To fix it, call tracing_{open,release}_file_tr() in file_operations callback to have the ref count and avoid 'trace_event_file' being freed. BUG: KASAN: slab-use-after-free in hist_show+0x11e0/0x1278 Read of size 8 at addr ffff242541e336b8 by task head/190 CPU: 4 PID: 190 Comm: head Not tainted 6.7.0-rc5-g26aff849438c #133 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x98/0xf8 show_stack+0x1c/0x30 dump_stack_lvl+0x44/0x58 print_report+0xf0/0x5a0 kasan_report+0x80/0xc0 __asan_report_load8_noabort+0x1c/0x28 hist_show+0x11e0/0x1278 seq_read_iter+0x344/0xd78 seq_read+0x128/0x1c0 vfs_read+0x198/0x6c8 ksys_read+0xf4/0x1e0 __arm64_sys_read+0x70/0xa8 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xb0/0x280 do_el0_svc+0x44/0x60 el0_svc+0x34/0x68 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x168/0x170 Allocated by task 188: kasan_save_stack+0x28/0x50 kasan_set_track+0x28/0x38 kasan_save_alloc_info+0x20/0x30 __kasan_slab_alloc+0x6c/0x80 kmem_cache_alloc+0x15c/0x4a8 trace_create_new_event+0x84/0x348 __trace_add_new_event+0x18/0x88 event_trace_add_tracer+0xc4/0x1a0 trace_array_create_dir+0x6c/0x100 trace_array_create+0x2e8/0x568 instance_mkdir+0x48/0x80 tracefs_syscall_mkdir+0x90/0xe8 vfs_mkdir+0x3c4/0x610 do_mkdirat+0x144/0x200 __arm64_sys_mkdirat+0x8c/0xc0 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xb0/0x280 do_el0_svc+0x44/0x60 el0_svc+0x34/0x68 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x168/0x170 Freed by task 191: kasan_save_stack+0x28/0x50 kasan_set_track+0x28/0x38 kasan_save_free_info+0x34/0x58 __kasan_slab_free+0xe4/0x158 kmem_cache_free+0x19c/0x508 event_file_put+0xa0/0x120 remove_event_file_dir+0x180/0x320 event_trace_del_tracer+0xb0/0x180 __remove_instance+0x224/0x508 instance_rmdir+0x44/0x78 tracefs_syscall_rmdir+0xbc/0x140 vfs_rmdir+0x1cc/0x4c8 do_rmdir+0x220/0x2b8 __arm64_sys_unlinkat+0xc0/0x100 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xb0/0x280 do_el0_svc+0x44/0x60 el0_svc+0x34/0x68 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x168/0x170 Link: https://lore.kernel.org/linux-trace-kernel/20231214012153.676155-1-zhengyejian1@huawei.com Suggested-by: Steven Rostedt Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) kernel/trace/trace.c | 6 ++++++ kernel/trace/trace.h | 1 + kernel/trace/trace_events_hist.c | 12 ++++++++---- 3 files changed, 15 insertions(+), 4 deletions(-) commit 9a733dc4fbeec3f6d99645b845712b035e7440cf Author: Pavel Kozlov Date: Wed Dec 13 19:07:10 2023 +0400 ARC: add hugetlb definitions Add hugetlb definitions if THP enabled. ARC doesn't support HugeTLB FS but it supports THP. Some kernel code such as pagemap uses hugetlb definitions with THP. This patch fixes ARC build issue (HPAGE_SIZE undeclared error) with TRANSPARENT_HUGEPAGE enabled. Signed-off-by: Pavel Kozlov Signed-off-by: Vineet Gupta arch/arc/include/asm/hugepage.h | 7 +++++++ 1 file changed, 7 insertions(+) commit 77a67255609606164e1042f3bf7452a568a700e4 Author: Nitin Rawat Date: Fri Dec 8 18:43:31 2023 +0530 scsi: ufs: core: Store min and max clk freq from OPP table OPP support added by commit 72208ebe181e ("scsi: ufs: core: Add support for parsing OPP") doesn't update the min_freq and max_freq of each clock in 'struct ufs_clk_info'. But these values are used by the host drivers internally for controller configuration. When the OPP support is enabled in devicetree, these values will be 0, causing boot issues on the respective platforms. So add support to parse the min_freq and max_freq of all clocks while parsing the OPP table. Fixes: 72208ebe181e ("scsi: ufs: core: Add support for parsing OPP") Co-developed-by: Manish Pandey Signed-off-by: Manish Pandey Signed-off-by: Nitin Rawat Link: https://lore.kernel.org/r/20231208131331.12596-1-quic_nitirawa@quicinc.com Reviewed-by: Manivannan Sadhasivam Signed-off-by: Martin K. Petersen drivers/ufs/host/ufshcd-pltfrm.c | 54 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) commit dc84bb19b5d074f09f40c83fa68da5b03ad4fbd6 Merge: 23d05d563b7e f24a49a375f6 Author: Jakub Kicinski Date: Wed Dec 13 18:38:56 2023 -0800 Merge branch 'dpaa2-switch-various-fixes' Ioana Ciornei says: ==================== dpaa2-switch: various fixes The first patch fixes the size passed to two dma_unmap_single() calls which was wrongly put as the size of the pointer. The second patch is new to this series and reverts the behavior of the dpaa2-switch driver to not ask for object replay upon offloading so that we avoid the errors encountered when a VLAN is installed multiple times on the same port. ==================== Link: https://lore.kernel.org/r/20231212164326.2753457-1-ioana.ciornei@nxp.com Signed-off-by: Jakub Kicinski commit f24a49a375f65e8e75ee1b19d806f46dbaae57fd Author: Ioana Ciornei Date: Tue Dec 12 18:43:26 2023 +0200 dpaa2-switch: do not ask for MDB, VLAN and FDB replay Starting with commit 4e51bf44a03a ("net: bridge: move the switchdev object replay helpers to "push" mode") the switchdev_bridge_port_offload() helper was extended with the intention to provide switchdev drivers easy access to object addition and deletion replays. This works by calling the replay helpers with non-NULL notifier blocks. In the same commit, the dpaa2-switch driver was updated so that it passes valid notifier blocks to the helper. At that moment, no regression was identified through testing. In the meantime, the blamed commit changed the behavior in terms of which ports get hit by the replay. Before this commit, only the initial port which identified itself as offloaded through switchdev_bridge_port_offload() got a replay of all port objects and FDBs. After this, the newly joining port will trigger a replay of objects on all bridge ports and on the bridge itself. This behavior leads to errors in dpaa2_switch_port_vlans_add() when a VLAN gets installed on the same interface multiple times. The intended mechanism to address this is to pass a non-NULL ctx to the switchdev_bridge_port_offload() helper and then check it against the port's private structure. But since the driver does not have any use for the replayed port objects and FDBs until it gains support for LAG offload, it's better to fix the issue by reverting the dpaa2-switch driver to not ask for replay. The pointers will be added back when we are prepared to ignore replays on unrelated ports. Fixes: b28d580e2939 ("net: bridge: switchdev: replay all VLAN groups") Signed-off-by: Ioana Ciornei Link: https://lore.kernel.org/r/20231212164326.2753457-3-ioana.ciornei@nxp.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) commit 2aad7d4189a923b24efa8ea6ad09059882b1bfe4 Author: Ioana Ciornei Date: Tue Dec 12 18:43:25 2023 +0200 dpaa2-switch: fix size of the dma_unmap The size of the DMA unmap was wrongly put as a sizeof of a pointer. Change the value of the DMA unmap to be the actual macro used for the allocation and the DMA map. Fixes: 1110318d83e8 ("dpaa2-switch: add tc flower hardware offload on ingress traffic") Signed-off-by: Ioana Ciornei Link: https://lore.kernel.org/r/20231212164326.2753457-2-ioana.ciornei@nxp.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 23d05d563b7e7b0314e65c8e882bc27eac2da8e7 Author: Eric Dumazet Date: Tue Dec 12 16:46:21 2023 +0000 net: prevent mss overflow in skb_segment() Once again syzbot is able to crash the kernel in skb_segment() [1] GSO_BY_FRAGS is a forbidden value, but unfortunately the following computation in skb_segment() can reach it quite easily : mss = mss * partial_segs; 65535 = 3 * 5 * 17 * 257, so many initial values of mss can lead to a bad final result. Make sure to limit segmentation so that the new mss value is smaller than GSO_BY_FRAGS. [1] general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 1 PID: 5079 Comm: syz-executor993 Not tainted 6.7.0-rc4-syzkaller-00141-g1ae4cd3cbdd0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597 RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578 R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000002 R12: ffff888063202ac0 R13: 0000000000010000 R14: 000000000000ffff R15: 0000000000000046 FS: 0000555556e7e380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020010000 CR3: 0000000027ee2000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: udp6_ufo_fragment+0xa0e/0xd00 net/ipv6/udp_offload.c:109 ipv6_gso_segment+0x534/0x17e0 net/ipv6/ip6_offload.c:120 skb_mac_gso_segment+0x290/0x610 net/core/gso.c:53 __skb_gso_segment+0x339/0x710 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x36c/0xeb0 net/core/dev.c:3626 __dev_queue_xmit+0x6f3/0x3d60 net/core/dev.c:4338 dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24c6/0x5220 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f8692032aa9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff8d685418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8692032aa9 RDX: 0000000000010048 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00000000000f4240 R08: 0000000020000540 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff8d685480 R13: 0000000000000001 R14: 00007fff8d685480 R15: 0000000000000003 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597 RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578 R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000002 R12: ffff888063202ac0 R13: 0000000000010000 R14: 000000000000ffff R15: 0000000000000046 FS: 0000555556e7e380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020010000 CR3: 0000000027ee2000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 3953c46c3ac7 ("sk_buff: allow segmenting based on frag sizes") Signed-off-by: Eric Dumazet Cc: Marcelo Ricardo Leitner Reviewed-by: Willem de Bruijn Link: https://lore.kernel.org/r/20231212164621.4131800-1-edumazet@google.com Signed-off-by: Jakub Kicinski net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 60316d7f10b17a7ebb1ead0642fee8710e1560e0 Author: Nikolay Kuratov Date: Mon Dec 11 19:23:17 2023 +0300 vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() We need to do signed arithmetic if we expect condition `if (bytes < 0)` to be possible Found by Linux Verification Center (linuxtesting.org) with SVACE Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko") Signed-off-by: Nikolay Kuratov Reviewed-by: Stefano Garzarella Link: https://lore.kernel.org/r/20231211162317.4116625-1-kniv@yandex-team.ru Signed-off-by: Jakub Kicinski net/vmw_vsock/virtio_transport_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b13559b76157de9d74f04d3ca0e49d69de3b5675 Author: Rahul Rameshbabu Date: Tue Nov 21 15:00:22 2023 -0800 net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors snprintf returns the length of the formatted string, excluding the trailing null, without accounting for truncation. This means that is the return value is greater than or equal to the size parameter, the fw_version string was truncated. Link: https://docs.kernel.org/core-api/kernel-api.html#c.snprintf Fixes: 1b2bd0c0264f ("net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors") Signed-off-by: Rahul Rameshbabu Reviewed-by: Simon Horman Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ad436b9c1270c40554e274f067f1b78fcc06a004 Author: Rahul Rameshbabu Date: Tue Nov 21 15:00:21 2023 -0800 net/mlx5e: Correct snprintf truncation handling for fw_version buffer snprintf returns the length of the formatted string, excluding the trailing null, without accounting for truncation. This means that is the return value is greater than or equal to the size parameter, the fw_version string was truncated. Reported-by: David Laight Closes: https://lore.kernel.org/netdev/81cae734ee1b4cde9b380a9a31006c1a@AcuMS.aculab.com/ Link: https://docs.kernel.org/core-api/kernel-api.html#c.snprintf Fixes: 41e63c2baa11 ("net/mlx5e: Check return value of snprintf writing to fw_version buffer") Signed-off-by: Rahul Rameshbabu Reviewed-by: Simon Horman Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d792e5f7f19b95f5ce41ac49df5ead4d280238f4 Author: Dan Carpenter Date: Wed Dec 13 17:08:57 2023 +0300 net/mlx5e: Fix error codes in alloc_branch_attr() Set the error code if set_branch_dest_ft() fails. Fixes: ccbe33003b10 ("net/mlx5e: TC, Don't offload post action rule if not supported") Signed-off-by: Dan Carpenter Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 86d5922679f3b6d02a64df66cdd777fdd4ea5c0d Author: Dan Carpenter Date: Wed Dec 13 17:08:17 2023 +0300 net/mlx5e: Fix error code in mlx5e_tc_action_miss_mapping_get() Preserve the error code if esw_add_restore_rule() fails. Don't return success. Fixes: 6702782845a5 ("net/mlx5e: TC, Set CT miss to the specific ct action instance") Signed-off-by: Dan Carpenter Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 04ad04e4fdd10f92ef4f2b3f6227ec9824682197 Author: Vlad Buslov Date: Fri Oct 6 15:22:22 2023 +0200 net/mlx5: Refactor mlx5_flow_destination->rep pointer to vport num Currently the destination rep pointer is only used for comparisons or to obtain vport number from it. Since it is used both during flow creation and deletion it may point to representor of another eswitch instance which can be deallocated during driver unload even when there are rules pointing to it[0]. Refactor the code to store vport number and 'valid' flag instead of the representor pointer. [0]: [176805.886303] ================================================================== [176805.889433] BUG: KASAN: slab-use-after-free in esw_cleanup_dests+0x390/0x440 [mlx5_core] [176805.892981] Read of size 2 at addr ffff888155090aa0 by task modprobe/27280 [176805.895462] CPU: 3 PID: 27280 Comm: modprobe Tainted: G B 6.6.0-rc3+ #1 [176805.896771] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [176805.898514] Call Trace: [176805.899026] [176805.899519] dump_stack_lvl+0x33/0x50 [176805.900221] print_report+0xc2/0x610 [176805.900893] ? mlx5_chains_put_table+0x33d/0x8d0 [mlx5_core] [176805.901897] ? esw_cleanup_dests+0x390/0x440 [mlx5_core] [176805.902852] kasan_report+0xac/0xe0 [176805.903509] ? esw_cleanup_dests+0x390/0x440 [mlx5_core] [176805.904461] esw_cleanup_dests+0x390/0x440 [mlx5_core] [176805.905223] __mlx5_eswitch_del_rule+0x1ae/0x460 [mlx5_core] [176805.906044] ? esw_cleanup_dests+0x440/0x440 [mlx5_core] [176805.906822] ? xas_find_conflict+0x420/0x420 [176805.907496] ? down_read+0x11e/0x200 [176805.908046] mlx5e_tc_rule_unoffload+0xc4/0x2a0 [mlx5_core] [176805.908844] mlx5e_tc_del_fdb_flow+0x7da/0xb10 [mlx5_core] [176805.909597] mlx5e_flow_put+0x4b/0x80 [mlx5_core] [176805.910275] mlx5e_delete_flower+0x5b4/0xb70 [mlx5_core] [176805.911010] tc_setup_cb_reoffload+0x27/0xb0 [176805.911648] fl_reoffload+0x62d/0x900 [cls_flower] [176805.912313] ? mlx5e_rep_indr_block_unbind+0xd0/0xd0 [mlx5_core] [176805.913151] ? __fl_put+0x230/0x230 [cls_flower] [176805.913768] ? filter_irq_stacks+0x90/0x90 [176805.914335] ? kasan_save_stack+0x1e/0x40 [176805.914893] ? kasan_set_track+0x21/0x30 [176805.915484] ? kasan_save_free_info+0x27/0x40 [176805.916105] tcf_block_playback_offloads+0x79/0x1f0 [176805.916773] ? mlx5e_rep_indr_block_unbind+0xd0/0xd0 [mlx5_core] [176805.917647] tcf_block_unbind+0x12d/0x330 [176805.918239] tcf_block_offload_cmd.isra.0+0x24e/0x320 [176805.918953] ? tcf_block_bind+0x770/0x770 [176805.919551] ? _raw_read_unlock_irqrestore+0x30/0x30 [176805.920236] ? mutex_lock+0x7d/0xd0 [176805.920735] ? mutex_unlock+0x80/0xd0 [176805.921255] tcf_block_offload_unbind+0xa5/0x120 [176805.921909] __tcf_block_put+0xc2/0x2d0 [176805.922467] ingress_destroy+0xf4/0x3d0 [sch_ingress] [176805.923178] __qdisc_destroy+0x9d/0x280 [176805.923741] dev_shutdown+0x1c6/0x330 [176805.924295] unregister_netdevice_many_notify+0x6ef/0x1500 [176805.925034] ? netdev_freemem+0x50/0x50 [176805.925610] ? _raw_spin_lock_irq+0x7b/0xd0 [176805.926235] ? _raw_spin_lock_bh+0xe0/0xe0 [176805.926849] unregister_netdevice_queue+0x1e0/0x280 [176805.927592] ? unregister_netdevice_many+0x10/0x10 [176805.928275] unregister_netdev+0x18/0x20 [176805.928835] mlx5e_vport_rep_unload+0xc0/0x200 [mlx5_core] [176805.929608] mlx5_esw_offloads_unload_rep+0x9d/0xc0 [mlx5_core] [176805.930492] mlx5_eswitch_unload_vf_vports+0x108/0x1a0 [mlx5_core] [176805.931422] ? mlx5_eswitch_unload_sf_vport+0x50/0x50 [mlx5_core] [176805.932304] ? rwsem_down_write_slowpath+0x11f0/0x11f0 [176805.932987] mlx5_eswitch_disable_sriov+0x6f9/0xa60 [mlx5_core] [176805.933807] ? mlx5_core_disable_hca+0xe1/0x130 [mlx5_core] [176805.934576] ? mlx5_eswitch_disable_locked+0x580/0x580 [mlx5_core] [176805.935463] mlx5_device_disable_sriov+0x138/0x490 [mlx5_core] [176805.936308] mlx5_sriov_disable+0x8c/0xb0 [mlx5_core] [176805.937063] remove_one+0x7f/0x210 [mlx5_core] [176805.937711] pci_device_remove+0x96/0x1c0 [176805.938289] device_release_driver_internal+0x361/0x520 [176805.938981] ? kobject_put+0x5c/0x330 [176805.939553] driver_detach+0xd7/0x1d0 [176805.940101] bus_remove_driver+0x11f/0x290 [176805.943847] pci_unregister_driver+0x23/0x1f0 [176805.944505] mlx5_cleanup+0xc/0x20 [mlx5_core] [176805.945189] __x64_sys_delete_module+0x2b3/0x450 [176805.945837] ? module_flags+0x300/0x300 [176805.946377] ? dput+0xc2/0x830 [176805.946848] ? __kasan_record_aux_stack+0x9c/0xb0 [176805.947555] ? __call_rcu_common.constprop.0+0x46c/0xb50 [176805.948338] ? fpregs_assert_state_consistent+0x1d/0xa0 [176805.949055] ? exit_to_user_mode_prepare+0x30/0x120 [176805.949713] do_syscall_64+0x3d/0x90 [176805.950226] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [176805.950904] RIP: 0033:0x7f7f42c3f5ab [176805.951462] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48 [176805.953710] RSP: 002b:00007fff07dc9d08 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [176805.954691] RAX: ffffffffffffffda RBX: 000055b6e91c01e0 RCX: 00007f7f42c3f5ab [176805.955691] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6e91c0248 [176805.956662] RBP: 000055b6e91c01e0 R08: 0000000000000000 R09: 0000000000000000 [176805.957601] R10: 00007f7f42d9eac0 R11: 0000000000000206 R12: 000055b6e91c0248 [176805.958593] R13: 0000000000000000 R14: 000055b6e91bfb38 R15: 0000000000000000 [176805.959599] [176805.960324] Allocated by task 20490: [176805.960893] kasan_save_stack+0x1e/0x40 [176805.961463] kasan_set_track+0x21/0x30 [176805.962019] __kasan_kmalloc+0x77/0x90 [176805.962554] esw_offloads_init+0x1bb/0x480 [mlx5_core] [176805.963318] mlx5_eswitch_init+0xc70/0x15c0 [mlx5_core] [176805.964092] mlx5_init_one_devl_locked+0x366/0x1230 [mlx5_core] [176805.964902] probe_one+0x6f7/0xc90 [mlx5_core] [176805.965541] local_pci_probe+0xd7/0x180 [176805.966075] pci_device_probe+0x231/0x6f0 [176805.966631] really_probe+0x1d4/0xb50 [176805.967179] __driver_probe_device+0x18d/0x450 [176805.967810] driver_probe_device+0x49/0x120 [176805.968431] __driver_attach+0x1fb/0x490 [176805.968976] bus_for_each_dev+0xed/0x170 [176805.969560] bus_add_driver+0x21a/0x570 [176805.970124] driver_register+0x133/0x460 [176805.970684] 0xffffffffa0678065 [176805.971180] do_one_initcall+0x92/0x2b0 [176805.971744] do_init_module+0x22d/0x720 [176805.972318] load_module+0x58c3/0x63b0 [176805.972847] init_module_from_file+0xd2/0x130 [176805.973441] __x64_sys_finit_module+0x389/0x7c0 [176805.974045] do_syscall_64+0x3d/0x90 [176805.974556] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [176805.975566] Freed by task 27280: [176805.976077] kasan_save_stack+0x1e/0x40 [176805.976655] kasan_set_track+0x21/0x30 [176805.977221] kasan_save_free_info+0x27/0x40 [176805.977834] ____kasan_slab_free+0x11a/0x1b0 [176805.978505] __kmem_cache_free+0x163/0x2d0 [176805.979113] esw_offloads_cleanup_reps+0xb8/0x120 [mlx5_core] [176805.979963] mlx5_eswitch_cleanup+0x182/0x270 [mlx5_core] [176805.980763] mlx5_cleanup_once+0x9a/0x1e0 [mlx5_core] [176805.981477] mlx5_uninit_one+0xa9/0x180 [mlx5_core] [176805.982196] remove_one+0x8f/0x210 [mlx5_core] [176805.982868] pci_device_remove+0x96/0x1c0 [176805.983461] device_release_driver_internal+0x361/0x520 [176805.984169] driver_detach+0xd7/0x1d0 [176805.984702] bus_remove_driver+0x11f/0x290 [176805.985261] pci_unregister_driver+0x23/0x1f0 [176805.985847] mlx5_cleanup+0xc/0x20 [mlx5_core] [176805.986483] __x64_sys_delete_module+0x2b3/0x450 [176805.987126] do_syscall_64+0x3d/0x90 [176805.987665] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [176805.988667] Last potentially related work creation: [176805.989305] kasan_save_stack+0x1e/0x40 [176805.989839] __kasan_record_aux_stack+0x9c/0xb0 [176805.990443] kvfree_call_rcu+0x84/0xa30 [176805.990973] clean_xps_maps+0x265/0x6e0 [176805.991547] netif_reset_xps_queues.part.0+0x3f/0x80 [176805.992226] unregister_netdevice_many_notify+0xfcf/0x1500 [176805.992966] unregister_netdevice_queue+0x1e0/0x280 [176805.993638] unregister_netdev+0x18/0x20 [176805.994205] mlx5e_remove+0xba/0x1e0 [mlx5_core] [176805.994872] auxiliary_bus_remove+0x52/0x70 [176805.995490] device_release_driver_internal+0x361/0x520 [176805.996196] bus_remove_device+0x1e1/0x3d0 [176805.996767] device_del+0x390/0x980 [176805.997270] mlx5_rescan_drivers_locked.part.0+0x130/0x540 [mlx5_core] [176805.998195] mlx5_unregister_device+0x77/0xc0 [mlx5_core] [176805.998989] mlx5_uninit_one+0x41/0x180 [mlx5_core] [176805.999719] remove_one+0x8f/0x210 [mlx5_core] [176806.000387] pci_device_remove+0x96/0x1c0 [176806.000938] device_release_driver_internal+0x361/0x520 [176806.001612] unbind_store+0xd8/0xf0 [176806.002108] kernfs_fop_write_iter+0x2c0/0x440 [176806.002748] vfs_write+0x725/0xba0 [176806.003294] ksys_write+0xed/0x1c0 [176806.003823] do_syscall_64+0x3d/0x90 [176806.004357] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [176806.005317] The buggy address belongs to the object at ffff888155090a80 which belongs to the cache kmalloc-64 of size 64 [176806.006774] The buggy address is located 32 bytes inside of freed 64-byte region [ffff888155090a80, ffff888155090ac0) [176806.008773] The buggy address belongs to the physical page: [176806.009480] page:00000000a407e0e6 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155090 [176806.010633] flags: 0x200000000000800(slab|node=0|zone=2) [176806.011352] page_type: 0xffffffff() [176806.011905] raw: 0200000000000800 ffff888100042640 ffffea000422b1c0 dead000000000004 [176806.012949] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 [176806.013933] page dumped because: kasan: bad access detected [176806.014935] Memory state around the buggy address: [176806.015601] ffff888155090980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [176806.016568] ffff888155090a00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [176806.017497] >ffff888155090a80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [176806.018438] ^ [176806.019007] ffff888155090b00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [176806.020001] ffff888155090b80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [176806.020996] ================================================================== Fixes: a508728a4c8b ("net/mlx5e: VF tunnel RX traffic offloading") Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed .../ethernet/mellanox/mlx5/core/en/tc/act/mirred.c | 5 +++-- .../net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 3 ++- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 3 ++- .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 19 +++++++++---------- .../mellanox/mlx5/core/eswitch_offloads_termtbl.c | 4 ++-- 5 files changed, 18 insertions(+), 16 deletions(-) commit 4261edf11cb7c9224af713a102e5616329306932 Author: Moshe Shemesh Date: Thu Nov 30 11:30:34 2023 +0200 net/mlx5: Fix fw tracer first block check While handling new traces, to verify it is not the first block being written, last_timestamp is checked. But instead of checking it is non zero it is verified to be zero. Fix to verify last_timestamp is not zero. Fixes: c71ad41ccb0c ("net/mlx5: FW tracer, events handling") Signed-off-by: Moshe Shemesh Reviewed-by: Feras Daoud Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bcaf109f794744c14da0e9123b31d1f4571b0a35 Author: Carolina Jubran Date: Thu Nov 23 16:11:20 2023 +0200 net/mlx5e: XDP, Drop fragmented packets larger than MTU size XDP transmits fragmented packets that are larger than MTU size instead of dropping those packets. The drop check that checks whether a packet is larger than MTU is comparing MTU size against the linear part length only. Adjust the drop check to compare MTU size against both linear and non-linear part lengths to avoid transmitting fragmented packets larger than MTU size. Fixes: 39a1665d16a2 ("net/mlx5e: Implement sending multi buffer XDP frames") Signed-off-by: Carolina Jubran Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit be86106fd74a145f24c56c9bc18d658e8fe6d4f4 Author: Chris Mi Date: Wed Nov 29 04:53:32 2023 +0200 net/mlx5e: Decrease num_block_tc when unblock tc offload The cited commit increases num_block_tc when unblock tc offload. Actually should decrease it. Fixes: c8e350e62fc5 ("net/mlx5e: Make TC and IPsec offloads mutually exclusive on a netdev") Signed-off-by: Chris Mi Reviewed-by: Jianbo Liu Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit da75fa542873e5f7d7f615566c0b00042d8a0437 Author: Jianbo Liu Date: Tue Nov 14 01:25:21 2023 +0000 net/mlx5e: Fix overrun reported by coverity Coverity Scan reports the following issue. But it's impossible that mlx5_get_dev_index returns 7 for PF, even if the index is calculated from PCI FUNC ID. So add the checking to make coverity slience. CID 610894 (#2 of 2): Out-of-bounds write (OVERRUN) Overrunning array esw->fdb_table.offloads.peer_miss_rules of 4 8-byte elements at element index 7 (byte offset 63) using index mlx5_get_dev_index(peer_dev) (which evaluates to 7). Fixes: 9bee385a6e39 ("net/mlx5: E-switch, refactor FDB miss rule add/remove") Signed-off-by: Jianbo Liu Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit e75efc6466ae289e599fb12a5a86545dff245c65 Author: Dinghao Liu Date: Tue Nov 28 17:40:53 2023 +0800 net/mlx5e: fix a potential double-free in fs_udp_create_groups When kcalloc() for ft->g succeeds but kvzalloc() for in fails, fs_udp_create_groups() will free ft->g. However, its caller fs_udp_create_table() will free ft->g again through calling mlx5e_destroy_flow_table(), which will lead to a double-free. Fix this by setting ft->g to NULL in fs_udp_create_groups(). Fixes: 1c80bd684388 ("net/mlx5e: Introduce Flow Steering UDP API") Signed-off-by: Dinghao Liu Reviewed-by: Tariq Toukan Reviewed-by: Simon Horman Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c | 1 + 1 file changed, 1 insertion(+) commit 8f5100da56b3980276234e812ce98d8f075194cd Author: Shifeng Li Date: Sat Dec 2 00:01:26 2023 -0800 net/mlx5e: Fix a race in command alloc flow Fix a cmd->ent use after free due to a race on command entry. Such race occurs when one of the commands releases its last refcount and frees its index and entry while another process running command flush flow takes refcount to this command entry. The process which handles commands flush may see this command as needed to be flushed if the other process allocated a ent->idx but didn't set ent to cmd->ent_arr in cmd_work_handler(). Fix it by moving the assignment of cmd->ent_arr into the spin lock. [70013.081955] BUG: KASAN: use-after-free in mlx5_cmd_trigger_completions+0x1e2/0x4c0 [mlx5_core] [70013.081967] Write of size 4 at addr ffff88880b1510b4 by task kworker/26:1/1433361 [70013.081968] [70013.082028] Workqueue: events aer_isr [70013.082053] Call Trace: [70013.082067] dump_stack+0x8b/0xbb [70013.082086] print_address_description+0x6a/0x270 [70013.082102] kasan_report+0x179/0x2c0 [70013.082173] mlx5_cmd_trigger_completions+0x1e2/0x4c0 [mlx5_core] [70013.082267] mlx5_cmd_flush+0x80/0x180 [mlx5_core] [70013.082304] mlx5_enter_error_state+0x106/0x1d0 [mlx5_core] [70013.082338] mlx5_try_fast_unload+0x2ea/0x4d0 [mlx5_core] [70013.082377] remove_one+0x200/0x2b0 [mlx5_core] [70013.082409] pci_device_remove+0xf3/0x280 [70013.082439] device_release_driver_internal+0x1c3/0x470 [70013.082453] pci_stop_bus_device+0x109/0x160 [70013.082468] pci_stop_and_remove_bus_device+0xe/0x20 [70013.082485] pcie_do_fatal_recovery+0x167/0x550 [70013.082493] aer_isr+0x7d2/0x960 [70013.082543] process_one_work+0x65f/0x12d0 [70013.082556] worker_thread+0x87/0xb50 [70013.082571] kthread+0x2e9/0x3a0 [70013.082592] ret_from_fork+0x1f/0x40 The logical relationship of this error is as follows: aer_recover_work | ent->work -------------------------------------------+------------------------------ aer_recover_work_func | |- pcie_do_recovery | |- report_error_detected | |- mlx5_pci_err_detected |cmd_work_handler |- mlx5_enter_error_state | |- cmd_alloc_index |- enter_error_state | |- lock cmd->alloc_lock |- mlx5_cmd_flush | |- clear_bit |- mlx5_cmd_trigger_completions| |- unlock cmd->alloc_lock |- lock cmd->alloc_lock | |- vector = ~dev->cmd.vars.bitmask |- for_each_set_bit | |- cmd_ent_get(cmd->ent_arr[i]) (UAF) |- unlock cmd->alloc_lock | |- cmd->ent_arr[ent->idx]=ent The cmd->ent_arr[ent->idx] assignment and the bit clearing are not protected by the cmd->alloc_lock in cmd_work_handler(). Fixes: 50b2412b7e78 ("net/mlx5: Avoid possible free of command entry while timeout comp handler") Reviewed-by: Moshe Shemesh Signed-off-by: Shifeng Li Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit ddb38ddff9c71026bad481b791a94d446ee37603 Author: Shifeng Li Date: Thu Nov 30 01:46:56 2023 -0800 net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() Out_sz that the size of out buffer is calculated using query_nic_vport _context_in structure when driver query the MAC list. However query_nic _vport_context_in structure is smaller than query_nic_vport_context_out. When allowed_list_size is greater than 96, calling ether_addr_copy() will trigger an slab-out-of-bounds. [ 1170.055866] BUG: KASAN: slab-out-of-bounds in mlx5_query_nic_vport_mac_list+0x481/0x4d0 [mlx5_core] [ 1170.055869] Read of size 4 at addr ffff88bdbc57d912 by task kworker/u128:1/461 [ 1170.055870] [ 1170.055932] Workqueue: mlx5_esw_wq esw_vport_change_handler [mlx5_core] [ 1170.055936] Call Trace: [ 1170.055949] dump_stack+0x8b/0xbb [ 1170.055958] print_address_description+0x6a/0x270 [ 1170.055961] kasan_report+0x179/0x2c0 [ 1170.056061] mlx5_query_nic_vport_mac_list+0x481/0x4d0 [mlx5_core] [ 1170.056162] esw_update_vport_addr_list+0x2c5/0xcd0 [mlx5_core] [ 1170.056257] esw_vport_change_handle_locked+0xd08/0x1a20 [mlx5_core] [ 1170.056377] esw_vport_change_handler+0x6b/0x90 [mlx5_core] [ 1170.056381] process_one_work+0x65f/0x12d0 [ 1170.056383] worker_thread+0x87/0xb50 [ 1170.056390] kthread+0x2e9/0x3a0 [ 1170.056394] ret_from_fork+0x1f/0x40 Fixes: e16aea2744ab ("net/mlx5: Introduce access functions to modify/query vport mac lists") Cc: Ding Hui Signed-off-by: Shifeng Li Reviewed-by: Simon Horman Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/vport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8e13cd737cb4fbbb37d448e7e5228a99ae08fdc1 Author: Vlad Buslov Date: Tue Nov 21 14:15:30 2023 +0100 net/mlx5e: fix double free of encap_header Cited commit introduced potential double free since encap_header can be destroyed twice in some cases - once by error cleanup sequence in mlx5e_tc_tun_{create|update}_header_ipv{4|6}(), once by generic mlx5e_encap_put() that user calls as a result of getting an error from tunnel create|update. At the same time the point where e->encap_header is assigned can't be delayed because the function can still return non-error code 0 as a result of checking for NUD_VALID flag, which will cause neighbor update to dereference NULL encap_header. Fix the issue by: - Nulling local encap_header variables in mlx5e_tc_tun_{create|update}_header_ipv{4|6}() to make kfree(encap_header) call in error cleanup sequence noop after that point. - Assigning reformat_params.data from e->encap_header instead of local variable encap_header that was set to NULL pointer by previous step. Also assign reformat_params.size from e->encap_size for uniformity and in order to make the code less error-prone in the future. Fixes: d589e785baf5 ("net/mlx5e: Allow concurrent creation of encap entries") Reported-by: Dust Li Reported-by: Cruz Zhao Reported-by: Tianchen Ding Signed-off-by: Vlad Buslov Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) commit 5d089684dc434a31e08d32f0530066d0025c52e4 Author: Vlad Buslov Date: Tue Nov 21 13:52:28 2023 +0100 Revert "net/mlx5e: fix double free of encap_header" This reverts commit 6f9b1a0731662648949a1c0587f6acb3b7f8acf1. This patch is causing a null ptr issue, the proper fix is in the next patch. Fixes: 6f9b1a073166 ("net/mlx5e: fix double free of encap_header") Signed-off-by: Vlad Buslov Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 66ca8d4deca09bce3fc7bcf8ea7997fa1a51c33c Author: Vlad Buslov Date: Tue Nov 21 13:51:52 2023 +0100 Revert "net/mlx5e: fix double free of encap_header in update funcs" This reverts commit 3a4aa3cb83563df942be49d145ee3b7ddf17d6bb. This patch is causing a null ptr issue, the proper fix is in the next patch. Fixes: 3a4aa3cb8356 ("net/mlx5e: fix double free of encap_header in update funcs") Signed-off-by: Vlad Buslov Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit 2f2fee2bf74a7e31d06fc6cb7ba2bd4dd7753c99 Merge: e307b5a845c5 50d96f05af67 Author: Martin KaFai Lau Date: Wed Dec 13 16:21:53 2023 -0800 Merge branch ' bpf fix for unconnect af_unix socket' John Fastabend says: ==================== Eric reported a syzbot splat from a null ptr deref from recent fix to resolve a use-after-free with af-unix stream sockets and BPF sockmap usage. The issue is I missed is we allow unconnected af_unix STREAM sockets to be added to the sockmap. Fix this by blocking unconnected sockets. v2: change sk_is_unix to sk_is_stream_unix (Eric) and remove duplicate ASSERTS in selftests the xsocket helper already marks FAIL (Jakub) ==================== Signed-off-by: Martin KaFai Lau commit 50d96f05af6787a34b4eca2ee3fc1993289c4c24 Author: John Fastabend Date: Fri Dec 1 10:01:39 2023 -0800 bpf: sockmap, test for unconnected af_unix sock Add test to sockmap_basic to ensure af_unix sockets that are not connected can not be added to the map. Ensure we keep DGRAM sockets working however as these will not be connected typically. Signed-off-by: John Fastabend Acked-by: Jakub Sitnicki Link: https://lore.kernel.org/r/20231201180139.328529-3-john.fastabend@gmail.com Signed-off-by: Martin KaFai Lau .../selftests/bpf/prog_tests/sockmap_basic.c | 34 ++++++++++++++++++++++ 1 file changed, 34 insertions(+) commit 8d6650646ce49e9a5b8c5c23eb94f74b1749f70f Author: John Fastabend Date: Fri Dec 1 10:01:38 2023 -0800 bpf: syzkaller found null ptr deref in unix_bpf proto add I added logic to track the sock pair for stream_unix sockets so that we ensure lifetime of the sock matches the time a sockmap could reference the sock (see fixes tag). I forgot though that we allow af_unix unconnected sockets into a sock{map|hash} map. This is problematic because previous fixed expected sk_pair() to exist and did not NULL check it. Because unconnected sockets have a NULL sk_pair this resulted in the NULL ptr dereference found by syzkaller. BUG: KASAN: null-ptr-deref in unix_stream_bpf_update_proto+0x72/0x430 net/unix/unix_bpf.c:171 Write of size 4 at addr 0000000000000080 by task syz-executor360/5073 Call Trace: ... sock_hold include/net/sock.h:777 [inline] unix_stream_bpf_update_proto+0x72/0x430 net/unix/unix_bpf.c:171 sock_map_init_proto net/core/sock_map.c:190 [inline] sock_map_link+0xb87/0x1100 net/core/sock_map.c:294 sock_map_update_common+0xf6/0x870 net/core/sock_map.c:483 sock_map_update_elem_sys+0x5b6/0x640 net/core/sock_map.c:577 bpf_map_update_value+0x3af/0x820 kernel/bpf/syscall.c:167 We considered just checking for the null ptr and skipping taking a ref on the NULL peer sock. But, if the socket is then connected() after being added to the sockmap we can cause the original issue again. So instead this patch blocks adding af_unix sockets that are not in the ESTABLISHED state. Reported-by: Eric Dumazet Reported-by: syzbot+e8030702aefd3444fb9e@syzkaller.appspotmail.com Fixes: 8866730aed51 ("bpf, sockmap: af_unix stream sockets need to hold ref for pair sock") Acked-by: Jakub Sitnicki Signed-off-by: John Fastabend Link: https://lore.kernel.org/r/20231201180139.328529-2-john.fastabend@gmail.com Signed-off-by: Martin KaFai Lau include/net/sock.h | 5 +++++ net/core/sock_map.c | 2 ++ 2 files changed, 7 insertions(+) commit 8defec031c40913ef10d2f654a5ccc8a2a9730c1 Merge: e8d66d02defd 99fe9ee56bd2 Author: Stephen Boyd Date: Wed Dec 13 15:26:24 2023 -0800 Merge tag 'v6.7-rockchip-clkfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-fixes Pull Rockchip clk driver fixes for the merge window from Heiko Stuebner: Fixes for a wrong clockname, a wrong clock-parent, a wrong clock-gate and finally one new PLL rate for the rk3568 to fix display artifacts on a handheld devices based on that soc. * tag 'v6.7-rockchip-clkfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: clk: rockchip: rk3128: Fix SCLK_SDMMC's clock name clk: rockchip: rk3128: Fix aclk_peri_src's parent clk: rockchip: rk3128: Fix HCLK_OTG gate register clk: rockchip: rk3568: Add PLL rate for 292.5MHz commit a4236c4b410857a70647c410e886c8a0455ec4fb Author: Christian König Date: Mon Dec 4 15:51:50 2023 +0100 drm/amdgpu: warn when there are still mappings when a BO is destroyed v2 This can only happen when there is a reference counting bug. v2: fix typo Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 ++ 1 file changed, 2 insertions(+) commit ceb9a321e7639700844aa3bf234a4e0884f13b77 Author: Christian König Date: Fri Dec 8 13:43:09 2023 +0100 drm/amdgpu: fix tear down order in amdgpu_vm_pt_free When freeing PD/PT with shadows it can happen that the shadow destruction races with detaching the PD/PT from the VM causing a NULL pointer dereference in the invalidation code. Fix this by detaching the the PD/PT from the VM first and then freeing the shadow instead. Signed-off-by: Christian König Fixes: https://gitlab.freedesktop.org/drm/amd/-/issues/2867 Cc: Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 2c7300d357a213d4a4bda691d1d5c06251e552d0 Author: Mario Limonciello Date: Tue Dec 12 01:09:16 2023 -0600 drm/amd: Fix a probing order problem on SDMA 2.4 commit 751e293f2c99 ("drm/amd: Move microcode init from sw_init to early_init for SDMA v2.4") made a fateful mistake in `adev->sdma.num_instances` wasn't declared when sdma_v2_4_init_microcode() was run. This caused probing to fail. Move the declaration to right before sdma_v2_4_init_microcode(). Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3043 Fixes: 751e293f2c99 ("drm/amd: Move microcode init from sw_init to early_init for SDMA v2.4") Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ab4750332dbe535243def5dcebc24ca00c1f98ac Author: Alex Deucher Date: Thu Dec 7 10:14:41 2023 -0500 drm/amdgpu/sdma5.2: add begin/end_use ring callbacks Add begin/end_use ring callbacks to disallow GFXOFF when SDMA work is submitted and allow it again afterward. This should avoid corner cases where GFXOFF is erroneously entered when SDMA is still active. For now just allow/disallow GFXOFF in the begin and end helpers until we root cause the issue. This should not impact power as SDMA usage is pretty minimal and GFXOSS should not be active when SDMA is active anyway, this just makes it explicit. v2: move everything into sdma5.2 code. No reason for this to be generic at this point. v3: Add comments in new code Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2220 Reviewed-by: Mario Limonciello (v1) Tested-by: Mario Limonciello (v1) Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 5.15+ drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) commit 829649443e78d85db0cff0c37cadb28fbb1a5f6f Author: Yusong Gao Date: Wed Dec 13 10:31:10 2023 +0000 sign-file: Fix incorrect return values check There are some wrong return values check in sign-file when call OpenSSL API. The ERR() check cond is wrong because of the program only check the return value is < 0 which ignored the return val is 0. For example: 1. CMS_final() return 1 for success or 0 for failure. 2. i2d_CMS_bio_stream() returns 1 for success or 0 for failure. 3. i2d_TYPEbio() return 1 for success and 0 for failure. 4. BIO_free() return 1 for success and 0 for failure. Link: https://www.openssl.org/docs/manmaster/man3/ Fixes: e5a2e3c84782 ("scripts/sign-file.c: Add support for signing with a raw signature") Signed-off-by: Yusong Gao Reviewed-by: Juerg Haefliger Signed-off-by: David Howells Link: https://lore.kernel.org/r/20231213024405.624692-1-a869920004@gmail.com/ # v5 Signed-off-by: Linus Torvalds scripts/sign-file.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 5bd7ef53ffe5ca580e93e74eb8c81ed191ddc4bd Merge: af2a9c6a83a6 485053bb81c8 Author: Linus Torvalds Date: Wed Dec 13 11:09:58 2023 -0800 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull ufs fix from Al Viro: "ufs got broken this merge window on folio conversion - calling conventions for filemap_lock_folio() are not the same as for find_lock_page()" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fix ufs_get_locked_folio() breakage commit 9702817384aa4a3700643d0b26e71deac0172cfd Author: Jakub Kicinski Date: Wed Dec 13 10:56:29 2023 -0800 Revert "tcp: disable tcp_autocorking for socket when TCP_NODELAY flag is set" This reverts commit f3f32a356c0d2379d4431364e74f101f8f075ce3. Paolo reports that the change disables autocorking even after the userspace sets TCP_CORK. Fixes: f3f32a356c0d ("tcp: disable tcp_autocorking for socket when TCP_NODELAY flag is set") Link: https://lore.kernel.org/r/0d30d5a41d3ac990573016308aaeacb40a9dc79f.camel@redhat.com Signed-off-by: Jakub Kicinski net/ipv4/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit af2a9c6a83a61bcaeb0fa4edc74762448926ef1c Merge: 88035e5694a8 50d7cdf7a9b1 Author: Linus Torvalds Date: Wed Dec 13 10:54:50 2023 -0800 Merge tag 'efi-urgent-for-v6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: - Deal with a regression in the recently refactored x86 EFI stub code on older Dell systems by disabling randomization of the physical load address - Use the correct load address for relocatable Loongarch kernels * tag 'efi-urgent-for-v6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi/x86: Avoid physical KASLR on older Dell systems efi/loongarch: Use load address to calculate kernel entry address commit 9b3daf2b0443eeba23c3888059342aec920dfd53 Author: Ivan Vecera Date: Wed Nov 29 17:17:10 2023 +0100 i40e: Fix ST code value for Clause 45 ST code value for clause 45 that has been changed by commit 8196b5fd6c73 ("i40e: Refactor I40E_MDIO_CLAUSE* macros") is currently wrong. The mentioned commit refactored ..MDIO_CLAUSE??_STCODE_MASK so their value is the same for both clauses. The value is correct for clause 22 but not for clause 45. Fix the issue by adding a parameter to I40E_GLGEN_MSCA_STCODE_MASK macro that specifies required value. Fixes: 8196b5fd6c73 ("i40e: Refactor I40E_MDIO_CLAUSE* macros") Signed-off-by: Ivan Vecera Reviewed-by: Jacob Keller Reviewed-by: Simon Horman Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/i40e/i40e_register.h | 2 +- drivers/net/ethernet/intel/i40e/i40e_type.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) commit 91f9181c738101a276d9da333e0ab665ad806e6d Author: Michal Schmidt Date: Thu Nov 30 17:58:06 2023 +0100 ice: fix theoretical out-of-bounds access in ethtool link modes To map phy types reported by the hardware to ethtool link mode bits, ice uses two lookup tables (phy_type_low_lkup, phy_type_high_lkup). The "low" table has 64 elements to cover every possible bit the hardware may report, but the "high" table has only 13. If the hardware reports a higher bit in phy_types_high, the driver would access memory beyond the lookup table's end. Instead of iterating through all 64 bits of phy_types_{low,high}, use the sizes of the respective lookup tables. Fixes: 9136e1f1e5c3 ("ice: refactor PHY type to ethtool link mode") Signed-off-by: Michal Schmidt Reviewed-by: Przemek Kitszel Reviewed-by: Simon Horman Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_ethtool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8bf771972b8468b6a841d088141ac2960e6927fd Author: Jan Kara Date: Wed Dec 13 17:51:04 2023 +0100 bcachefs: Fix determining required file handle length The ->encode_fh method is responsible for setting amount of space required for storing the file handle if not enough space was provided. bch2_encode_fh() was not setting required length in that case which breaks e.g. fanotify. Fix it. Reported-by: Petr Vorel Signed-off-by: Jan Kara Signed-off-by: Kent Overstreet fs/bcachefs/fs.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) commit a26b7cd2254695f8258cc370f33280db0a9a3813 Author: Michael Roth Date: Mon Oct 16 08:27:32 2023 -0500 KVM: SEV: Do not intercept accesses to MSR_IA32_XSS for SEV-ES guests When intercepts are enabled for MSR_IA32_XSS, the host will swap in/out the guest-defined values while context-switching to/from guest mode. However, in the case of SEV-ES, vcpu->arch.guest_state_protected is set, so the guest-defined value is effectively ignored when switching to guest mode with the understanding that the VMSA will handle swapping in/out this register state. However, SVM is still configured to intercept these accesses for SEV-ES guests, so the values in the initial MSR_IA32_XSS are effectively read-only, and a guest will experience undefined behavior if it actually tries to write to this MSR. Fortunately, only CET/shadowstack makes use of this register on SEV-ES-capable systems currently, which isn't yet widely used, but this may become more of an issue in the future. Additionally, enabling intercepts of MSR_IA32_XSS results in #VC exceptions in the guest in certain paths that can lead to unexpected #VC nesting levels. One example is SEV-SNP guests when handling #VC exceptions for CPUID instructions involving leaf 0xD, subleaf 0x1, since they will access MSR_IA32_XSS as part of servicing the CPUID #VC, then generate another #VC when accessing MSR_IA32_XSS, which can lead to guest crashes if an NMI occurs at that point in time. Running perf on a guest while it is issuing such a sequence is one example where these can be problematic. Address this by disabling intercepts of MSR_IA32_XSS for SEV-ES guests if the host/guest configuration allows it. If the host/guest configuration doesn't allow for MSR_IA32_XSS, leave it intercepted so that it can be caught by the existing checks in kvm_{set,get}_msr_common() if the guest still attempts to access it. Fixes: 376c6d285017 ("KVM: SVM: Provide support for SEV-ES vCPU creation/loading") Cc: Alexey Kardashevskiy Suggested-by: Tom Lendacky Signed-off-by: Michael Roth Message-Id: <20231016132819.1002933-4-michael.roth@amd.com> Signed-off-by: Paolo Bonzini arch/x86/kvm/svm/sev.c | 19 +++++++++++++++++++ arch/x86/kvm/svm/svm.c | 1 + arch/x86/kvm/svm/svm.h | 2 +- 3 files changed, 21 insertions(+), 1 deletion(-) commit 6c9dbee84cd005bed5f9d07b3a2797ae6414b435 Author: Farouk Bouabid Date: Wed Dec 13 15:50:45 2023 +0100 drm/panel: ltk050h3146w: Set burst mode for ltk050h3148w The ltk050h3148w variant expects the horizontal component lane byte clock cycle(lbcc) to be calculated using lane_mbps (burst mode) instead of the pixel clock. Using the pixel clock rate by default for this calculation was introduced in commit ac87d23694f4 ("drm/bridge: synopsys: dw-mipi-dsi: Use pixel clock rate to calculate lbcc") and starting from commit 93e82bb4de01 ("drm/bridge: synopsys: dw-mipi-dsi: Fix hcomponent lbcc for burst mode") only panels that support burst mode can keep using the lane_mbps. So add MIPI_DSI_MODE_VIDEO_BURST as part of the mode_flags for the dsi host. Fixes: 93e82bb4de01 ("drm/bridge: synopsys: dw-mipi-dsi: Fix hcomponent lbcc for burst mode") Signed-off-by: Farouk Bouabid Reviewed-by: Jessica Zhang Signed-off-by: Heiko Stuebner Link: https://patchwork.freedesktop.org/patch/msgid/20231213145045.41020-1-farouk.bouabid@theobroma-systems.com drivers/gpu/drm/panel/panel-leadtek-ltk050h3146w.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 485053bb81c81a122edd982b263277e65d7485c5 Author: Al Viro Date: Wed Dec 13 11:14:09 2023 -0500 fix ufs_get_locked_folio() breakage filemap_lock_folio() returns ERR_PTR(-ENOENT) if the thing is not in cache - not NULL like find_lock_page() used to. Fixes: 5fb7bd50b351 "ufs: add ufs_get_locked_folio and ufs_put_locked_folio" Signed-off-by: Al Viro fs/ufs/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 595e52284d24adc376890d3fc93bdca4707d9aca Author: Jens Axboe Date: Wed Dec 13 08:58:15 2023 -0700 io_uring/poll: don't enable lazy wake for POLLEXCLUSIVE There are a few quirks around using lazy wake for poll unconditionally, and one of them is related the EPOLLEXCLUSIVE. Those may trigger exclusive wakeups, which wake a limited number of entries in the wait queue. If that wake number is less than the number of entries someone is waiting for (and that someone is also using DEFER_TASKRUN), then we can get stuck waiting for more entries while we should be processing the ones we already got. If we're doing exclusive poll waits, flag the request as not being compatible with lazy wakeups. Reported-by: Pavel Begunkov Fixes: 6ce4a93dbb5b ("io_uring/poll: use IOU_F_TWQ_LAZY_WAKE for wakeups") Signed-off-by: Jens Axboe include/linux/io_uring_types.h | 3 +++ io_uring/poll.c | 20 +++++++++++++++++--- 2 files changed, 20 insertions(+), 3 deletions(-) commit e39120ab8a04e5eb304cee3cfb42d628eb1f0d48 Author: Paolo Bonzini Date: Wed Dec 13 07:21:35 2023 -0500 KVM: selftests: Fix dynamic generation of configuration names When we dynamically generate a name for a configuration in get-reg-list we use strcat() to append to a buffer allocated using malloc() but we never initialise that buffer. Since malloc() offers no guarantees regarding the contents of the memory it returns this can lead to us corrupting, and likely overflowing, the buffer: vregs: PASS vregs+pmu: PASS sve: PASS sve+pmu: PASS vregs+pauth_address+pauth_generic: PASS X?vr+gspauth_addre+spauth_generi+pmu: PASS The bug is that strcat() should have been strcpy(), and that replacement would be enough to fix it, but there are other things in the function that leave something to be desired. In particular, an (incorrectly) empty config would cause an out of bounds access to c->name[-1]. Since the strcpy() call relies on c->name[0..len-1] being initialized, enforce that invariant throughout the function. Fixes: 2f9ace5d4557 ("KVM: arm64: selftests: get-reg-list: Introduce vcpu configs") Reviewed-by: Andrew Jones Co-developed-by: Mark Brown Signed-off-by: Mark Brown Message-Id: <20231211-kvm-get-reg-list-str-init-v3-1-6554c71c77b1@kernel.org> Signed-off-by: Paolo Bonzini tools/testing/selftests/kvm/get-reg-list.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit d2441d3e8c0c076d0a2e705fa235c76869a85140 Author: Michael Ellerman Date: Tue Dec 5 16:11:05 2023 +1100 MAINTAINERS: powerpc: Add Aneesh & Naveen Aneesh and Naveen are helping out with some aspects of upstream maintenance, add them as reviewers. Acked-by: "Aneesh Kumar K.V (IBM)" Acked-by: "Naveen N. Rao" Signed-off-by: Michael Ellerman Link: https://msgid.link/20231205051105.736470-1-mpe@ellerman.id.au MAINTAINERS | 2 ++ 1 file changed, 2 insertions(+) commit 0cf72f7f14d12cb065c3d01954cf42fc5638aa69 Author: Haren Myneni Date: Sat Nov 25 15:51:04 2023 -0800 powerpc/pseries/vas: Migration suspend waits for no in-progress open windows The hypervisor returns migration failure if all VAS windows are not closed. During pre-migration stage, vas_migration_handler() sets migration_in_progress flag and closes all windows from the list. The allocate VAS window routine checks the migration flag, setup the window and then add it to the list. So there is possibility of the migration handler missing the window that is still in the process of setup. t1: Allocate and open VAS t2: Migration event window lock vas_pseries_mutex If migration_in_progress set unlock vas_pseries_mutex return open window HCALL unlock vas_pseries_mutex Modify window HCALL lock vas_pseries_mutex setup window migration_in_progress=true Closes all windows from the list // May miss windows that are // not in the list unlock vas_pseries_mutex lock vas_pseries_mutex return if nr_closed_windows == 0 // No DLPAR CPU or migration add window to the list // Window will be added to the // list after the setup is completed unlock vas_pseries_mutex return unlock vas_pseries_mutex Close VAS window // due to DLPAR CPU or migration return -EBUSY This patch resolves the issue with the following steps: - Set the migration_in_progress flag without holding mutex. - Introduce nr_open_wins_progress counter in VAS capabilities struct - This counter tracks the number of open windows are still in progress - The allocate setup window thread closes windows if the migration is set and decrements nr_open_window_progress counter - The migration handler waits for no in-progress open windows. The code flow with the fix is as follows: t1: Allocate and open VAS t2: Migration event window lock vas_pseries_mutex If migration_in_progress set unlock vas_pseries_mutex return open window HCALL nr_open_wins_progress++ // Window opened, but not // added to the list yet unlock vas_pseries_mutex Modify window HCALL migration_in_progress=true setup window lock vas_pseries_mutex Closes all windows from the list While nr_open_wins_progress { unlock vas_pseries_mutex lock vas_pseries_mutex sleep if nr_closed_windows == 0 // Wait if any open window in or migration is not started // progress. The open window // No DLPAR CPU or migration // thread closes the window without add window to the list // adding to the list and return if nr_open_wins_progress-- // the migration is in progress. unlock vas_pseries_mutex return Close VAS window nr_open_wins_progress-- unlock vas_pseries_mutex return -EBUSY lock vas_pseries_mutex } unlock vas_pseries_mutex return Fixes: 37e6764895ef ("powerpc/pseries/vas: Add VAS migration handler") Signed-off-by: Haren Myneni Signed-off-by: Michael Ellerman Link: https://msgid.link/20231125235104.3405008-1-haren@linux.ibm.com arch/powerpc/platforms/pseries/vas.c | 51 +++++++++++++++++++++++++++++++----- arch/powerpc/platforms/pseries/vas.h | 2 ++ 2 files changed, 46 insertions(+), 7 deletions(-) commit 2513974cc3e120bd26ecf43bcc1c40ac32669226 Merge: f3f32a356c0d 4907a3f54b12 Author: David S. Miller Date: Wed Dec 13 10:57:01 2023 +0000 Merge branch 'stmmac-bug-fixes' Yanteng Si says: ==================== stmmac: Some bug fixes * Put Krzysztof's patch into my thread, pick Conor's Reviewed-by tag and Jiaxun's Acked-by tag.(prev version is RFC patch) * I fixed an Oops related to mdio, mainly to ensure that mdio is initialized before use, because it will be used in a series of patches I am working on. see ==================== Signed-off-by: David S. Miller commit 4907a3f54b12b8209864572a312cf967befcae80 Author: Krzysztof Kozlowski Date: Mon Dec 11 18:33:54 2023 +0800 MIPS: dts: loongson: drop incorrect dwmac fallback compatible Device binds to proper PCI ID (LOONGSON, 0x7a03), already listed in DTS, so checking for some other compatible does not make sense. It cannot be bound to unsupported platform. Drop useless, incorrect (space in between) and undocumented compatible. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Yanteng Si Reviewed-by: Conor Dooley Acked-by: Jiaxun Yang Signed-off-by: David S. Miller arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi | 3 +-- arch/mips/boot/dts/loongson/ls7a-pch.dtsi | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) commit 31fea092c6f9f8fb2c40a08137907f5fbeae55dd Author: Krzysztof Kozlowski Date: Mon Dec 11 18:33:53 2023 +0800 stmmac: dwmac-loongson: drop useless check for compatible fallback Device binds to proper PCI ID (LOONGSON, 0x7a03), already listed in DTS, so checking for some other compatible does not make sense. It cannot be bound to unsupported platform. Drop useless, incorrect (space in between) and undocumented compatible. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Yanteng Si Reviewed-by: Conor Dooley Acked-by: Jiaxun Yang Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 5 ----- 1 file changed, 5 deletions(-) commit e87d3a1370ce9f04770d789bcf7cce44865d2e8d Author: Yanteng Si Date: Mon Dec 11 18:33:11 2023 +0800 stmmac: dwmac-loongson: Make sure MDIO is initialized before use Generic code will use mdio. If it is not initialized before use, the kernel will Oops. Fixes: 30bba69d7db4 ("stmmac: pci: Add dwmac support for Loongson") Signed-off-by: Yanteng Si Signed-off-by: Feiyang Chen Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) commit fa97e21e74df5ef63a442e4cfd13fd113fc8196e Author: David Heidelberg Date: Tue Dec 12 21:09:17 2023 +0100 dt-bindings: panel-simple-dsi: move LG 5" HD TFT LCD panel into DSI yaml Originally was in the panel-simple, but belongs to panel-simple-dsi. See arch/arm/boot/dts/nvidia/tegra114-roth.dts for more details. Resolves the following warning: ``` arch/arm/boot/dts/tegra114-roth.dt.yaml: panel@0: 'reg' does not match any of the regexes: 'pinctrl-[0-9]+' From schema: Documentation/devicetree/bindings/display/panel/panel-simple.yaml ``` Fixes: 310abcea76e9 ("dt-bindings: display: convert simple lg panels to DT Schema") Signed-off-by: David Heidelberg Acked-by: Krzysztof Kozlowski Acked-by: Jessica Zhang Link: https://lore.kernel.org/r/20231212200934.99262-1-david@ixit.cz Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20231212200934.99262-1-david@ixit.cz Documentation/devicetree/bindings/display/panel/panel-simple-dsi.yaml | 2 ++ Documentation/devicetree/bindings/display/panel/panel-simple.yaml | 2 -- 2 files changed, 2 insertions(+), 2 deletions(-) commit f3f32a356c0d2379d4431364e74f101f8f075ce3 Author: Salvatore Dipietro Date: Fri Dec 8 10:20:49 2023 -0800 tcp: disable tcp_autocorking for socket when TCP_NODELAY flag is set Based on the tcp man page, if TCP_NODELAY is set, it disables Nagle's algorithm and packets are sent as soon as possible. However in the `tcp_push` function where autocorking is evaluated the `nonagle` value set by TCP_NODELAY is not considered which can trigger unexpected corking of packets and induce delays. For example, if two packets are generated as part of a server's reply, if the first one is not transmitted on the wire quickly enough, the second packet can trigger the autocorking in `tcp_push` and be delayed instead of sent as soon as possible. It will either wait for additional packets to be coalesced or an ACK from the client before transmitting the corked packet. This can interact badly if the receiver has tcp delayed acks enabled, introducing 40ms extra delay in completion times. It is not always possible to control who has delayed acks set, but it is possible to adjust when and how autocorking is triggered. Patch prevents autocorking if the TCP_NODELAY flag is set on the socket. Patch has been tested using an AWS c7g.2xlarge instance with Ubuntu 22.04 and Apache Tomcat 9.0.83 running the basic servlet below: import java.io.IOException; import java.io.OutputStreamWriter; import java.io.PrintWriter; import javax.servlet.ServletException; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; public class HelloWorldServlet extends HttpServlet { @Override protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { response.setContentType("text/html;charset=utf-8"); OutputStreamWriter osw = new OutputStreamWriter(response.getOutputStream(),"UTF-8"); String s = "a".repeat(3096); osw.write(s,0,s.length()); osw.flush(); } } Load was applied using wrk2 (https://github.com/kinvolk/wrk2) from an AWS c6i.8xlarge instance. With the current auto-corking behavior and TCP_NODELAY set an additional 40ms latency from P99.99+ values are observed. With the patch applied we see no occurrences of 40ms latencies. The patch has also been tested with iperf and uperf benchmarks and no regression was observed. # No patch with tcp_autocorking=1 and TCP_NODELAY set on all sockets ./wrk -t32 -c128 -d40s --latency -R10000 http://172.31.49.177:8080/hello/hello' ... 50.000% 0.91ms 75.000% 1.12ms 90.000% 1.46ms 99.000% 1.73ms 99.900% 1.96ms 99.990% 43.62ms <<< 40+ ms extra latency 99.999% 48.32ms 100.000% 49.34ms # With patch ./wrk -t32 -c128 -d40s --latency -R10000 http://172.31.49.177:8080/hello/hello' ... 50.000% 0.89ms 75.000% 1.13ms 90.000% 1.44ms 99.000% 1.67ms 99.900% 1.78ms 99.990% 2.27ms <<< no 40+ ms extra latency 99.999% 3.71ms 100.000% 4.57ms Fixes: f54b311142a9 ("tcp: auto corking") Signed-off-by: Salvatore Dipietro Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2fda61748214c0a3c7f848d68d6edf295bdad819 Merge: a39b6ac3781d b6961d187fcd Author: Dave Airlie Date: Wed Dec 13 17:03:01 2023 +1000 Merge tag 'mediatek-drm-fixes-20231211' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes Mediatek DRM Fixes - 20231211 1. mtk_disp_gamma: Fix breakage due to merge issue 2. fix kernel oops if no crtc is found 3. Add spinlock for setting vblank event in atomic_begin 4. Fix access violation in mtk_drm_crtc_dma_dev_get Signed-off-by: Dave Airlie From: Chun-Kuang Hu Link: https://patchwork.freedesktop.org/patch/msgid/20231211151510.6749-1-chunkuang.hu@kernel.org commit 9b6a51aab5f5f9f71d2fa16e8b4d530e1643dfcb Author: Tony Lindgren Date: Tue Dec 12 15:50:35 2023 +0200 ARM: dts: Fix occasional boot hang for am3 usb With subtle timings changes, we can now sometimes get an external abort on non-linefetch error booting am3 devices at sysc_reset(). This is because of a missing reset delay needed for the usb target module. Looks like we never enabled the delay earlier for am3, although a similar issue was seen earlier with a similar usb setup for dm814x as described in commit ebf244148092 ("ARM: OMAP2+: Use srst_udelay for USB on dm814x"). Cc: stable@vger.kernel.org Fixes: 0782e8572ce4 ("ARM: dts: Probe am335x musb with ti-sysc") Signed-off-by: Tony Lindgren arch/arm/boot/dts/ti/omap/am33xx.dtsi | 1 + 1 file changed, 1 insertion(+) commit 4ad9843e1ea088bd2529290234c6c4c6374836a7 Author: Yong-Xuan Wang Date: Wed Dec 13 06:16:09 2023 +0000 RISCV: KVM: update external interrupt atomically for IMSIC swfile The emulated IMSIC update the external interrupt pending depending on the value of eidelivery and topei. It might lose an interrupt when it is interrupted before setting the new value to the pending status. For example, when VCPU0 sends an IPI to VCPU1 via IMSIC: VCPU0 VCPU1 CSRSWAP topei = 0 The VCPU1 has claimed all the external interrupt in its interrupt handler. topei of VCPU1's IMSIC = 0 set pending in VCPU1's IMSIC topei of VCPU1' IMSIC = 1 set the external interrupt pending of VCPU1 clear the external interrupt pending of VCPU1 When the VCPU1 switches back to VS mode, it exits the interrupt handler because the result of CSRSWAP topei is 0. If there are no other external interrupts injected into the VCPU1's IMSIC, VCPU1 will never know this pending interrupt unless it initiative read the topei. If the interruption occurs between updating interrupt pending in IMSIC and updating external interrupt pending of VCPU, it will not cause a problem. Suppose that the VCPU1 clears the IPI pending in IMSIC right after VCPU0 sets the pending, the external interrupt pending of VCPU1 will not be set because the topei is 0. But when the VCPU1 goes back to VS mode, the pending IPI will be reported by the CSRSWAP topei, it will not lose this interrupt. So we only need to make the external interrupt updating procedure as a critical section to avoid the problem. Fixes: db8b7e97d613 ("RISC-V: KVM: Add in-kernel virtualization of AIA IMSIC") Tested-by: Roy Lin Tested-by: Wayling Chen Co-developed-by: Vincent Chen Signed-off-by: Vincent Chen Signed-off-by: Yong-Xuan Wang Signed-off-by: Anup Patel arch/riscv/kvm/aia_imsic.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 3279f526952f82b2967663c36c12a01f125cbbfd Author: Andrew Jones Date: Thu Dec 7 14:40:13 2023 +0100 KVM: riscv: selftests: Fix get-reg-list print_reg defaults print_reg() will print everything it knows when it encounters a register ID it's unfamiliar with in the default cases of its decoding switches. Fix several issues with these (until now, never tested) paths; missing newlines in printfs, missing complement operator in mask, and missing return in order to avoid continuing to decode. Fixes: 62d0c458f828 ("KVM: riscv: selftests: get-reg-list print_reg should never fail") Signed-off-by: Andrew Jones Reviewed-by: Haibo Xu Signed-off-by: Anup Patel tools/testing/selftests/kvm/riscv/get-reg-list.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit c3d1610345b79cbe29ef6ca04a4780eff0d360c7 Author: Luca Weiss Date: Sat Nov 25 17:22:15 2023 +0100 Input: xpad - add Razer Wolverine V2 support Add the VID and PID of Razer Wolverine V2 to xpad_device. Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20231125-razer-wolverine-v2-v1-1-979fe9f9288e@z3ntu.xyz Signed-off-by: Dmitry Torokhov drivers/input/joystick/xpad.c | 1 + 1 file changed, 1 insertion(+) commit 60be76eeabb3d83858cc6577fc65c7d0f36ffd42 Author: Steven Rostedt (Google) Date: Tue Dec 12 08:44:44 2023 -0500 tracing: Add size check when printing trace_marker output If for some reason the trace_marker write does not have a nul byte for the string, it will overflow the print: trace_seq_printf(s, ": %s", field->buf); The field->buf could be missing the nul byte. To prevent overflow, add the max size that the buf can be by using the event size and the field location. int max = iter->ent_size - offsetof(struct print_entry, buf); trace_seq_printf(s, ": %*.s", max, field->buf); Link: https://lore.kernel.org/linux-trace-kernel/20231212084444.4619b8ce@gandalf.local.home Cc: Mark Rutland Cc: Mathieu Desnoyers Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) kernel/trace/trace_output.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit b049525855fdd0024881c9b14b8fbec61c3f53d3 Author: Steven Rostedt (Google) Date: Tue Dec 12 07:25:58 2023 -0500 ring-buffer: Have saved event hold the entire event For the ring buffer iterator (non-consuming read), the event needs to be copied into the iterator buffer to make sure that a writer does not overwrite it while the user is reading it. If a write happens during the copy, the buffer is simply discarded. But the temp buffer itself was not big enough. The allocation of the buffer was only BUF_MAX_DATA_SIZE, which is the maximum data size that can be passed into the ring buffer and saved. But the temp buffer needs to hold the meta data as well. That would be BUF_PAGE_SIZE and not BUF_MAX_DATA_SIZE. Link: https://lore.kernel.org/linux-trace-kernel/20231212072558.61f76493@gandalf.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Fixes: 785888c544e04 ("ring-buffer: Have rb_iter_head_event() handle concurrent writer") Signed-off-by: Steven Rostedt (Google) kernel/trace/ring_buffer.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 9e45e39dc249c970d99d2681f6bcb55736fd725c Author: Steven Rostedt (Google) Date: Mon Dec 11 11:44:20 2023 -0500 ring-buffer: Do not update before stamp when switching sub-buffers The ring buffer timestamps are synchronized by two timestamp placeholders. One is the "before_stamp" and the other is the "write_stamp" (sometimes referred to as the "after stamp" but only in the comments. These two stamps are key to knowing how to handle nested events coming in with a lockless system. When moving across sub-buffers, the before stamp is updated but the write stamp is not. There's an effort to put back the before stamp to something that seems logical in case there's nested events. But as the current event is about to cross sub-buffers, and so will any new nested event that happens, updating the before stamp is useless, and could even introduce new race conditions. The first event on a sub-buffer simply uses the sub-buffer's timestamp and keeps a "delta" of zero. The "before_stamp" and "write_stamp" are not used in the algorithm in this case. There's no reason to try to fix the before_stamp when this happens. As a bonus, it removes a cmpxchg() when crossing sub-buffers! Link: https://lore.kernel.org/linux-trace-kernel/20231211114420.36dde01b@gandalf.local.home Cc: stable@vger.kernel.org Cc: Mark Rutland Cc: Mathieu Desnoyers Fixes: a389d86f7fd09 ("ring-buffer: Have nested events still record running time stamp") Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) kernel/trace/ring_buffer.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit 4376807bf2d5371c3e00080c972be568c3f8a7d1 Author: Yu Zhao Date: Thu Dec 7 23:14:07 2023 -0700 mm/mglru: reclaim offlined memcgs harder In the effort to reduce zombie memcgs [1], it was discovered that the memcg LRU doesn't apply enough pressure on offlined memcgs. Specifically, instead of rotating them to the tail of the current generation (MEMCG_LRU_TAIL) for a second attempt, it moves them to the next generation (MEMCG_LRU_YOUNG) after the first attempt. Not applying enough pressure on offlined memcgs can cause them to build up, and this can be particularly harmful to memory-constrained systems. On Pixel 8 Pro, launching apps for 50 cycles: Before After Change Zombie memcgs 45 35 -22% [1] https://lore.kernel.org/CABdmKX2M6koq4Q0Cmp_-=wbP0Qa190HdEGGaHfxNS05gAkUtPA@mail.gmail.com/ Link: https://lkml.kernel.org/r/20231208061407.2125867-4-yuzhao@google.com Fixes: e4dde56cd208 ("mm: multi-gen LRU: per-node lru_gen_folio lists") Signed-off-by: Yu Zhao Reported-by: T.J. Mercier Tested-by: T.J. Mercier Cc: Charan Teja Kalla Cc: Hillf Danton Cc: Jaroslav Pulchart Cc: Kairui Song Cc: Kalesh Singh Cc: Signed-off-by: Andrew Morton include/linux/mmzone.h | 8 ++++---- mm/vmscan.c | 24 ++++++++++++++++-------- 2 files changed, 20 insertions(+), 12 deletions(-) commit 8aa420617918d12d1f5d55030a503c9418e73c2c Author: Yu Zhao Date: Thu Dec 7 23:14:06 2023 -0700 mm/mglru: respect min_ttl_ms with memcgs While investigating kswapd "consuming 100% CPU" [1] (also see "mm/mglru: try to stop at high watermarks"), it was discovered that the memcg LRU can breach the thrashing protection imposed by min_ttl_ms. Before the memcg LRU: kswapd() shrink_node_memcgs() mem_cgroup_iter() inc_max_seq() // always hit a different memcg lru_gen_age_node() mem_cgroup_iter() check the timestamp of the oldest generation After the memcg LRU: kswapd() shrink_many() restart: iterate the memcg LRU: inc_max_seq() // occasionally hit the same memcg if raced with lru_gen_rotate_memcg(): goto restart lru_gen_age_node() mem_cgroup_iter() check the timestamp of the oldest generation Specifically, when the restart happens in shrink_many(), it needs to stick with the (memcg LRU) generation it began with. In other words, it should neither re-read memcg_lru->seq nor age an lruvec of a different generation. Otherwise it can hit the same memcg multiple times without giving lru_gen_age_node() a chance to check the timestamp of that memcg's oldest generation (against min_ttl_ms). [1] https://lore.kernel.org/CAK8fFZ4DY+GtBA40Pm7Nn5xCHy+51w3sfxPqkqpqakSXYyX+Wg@mail.gmail.com/ Link: https://lkml.kernel.org/r/20231208061407.2125867-3-yuzhao@google.com Fixes: e4dde56cd208 ("mm: multi-gen LRU: per-node lru_gen_folio lists") Signed-off-by: Yu Zhao Tested-by: T.J. Mercier Cc: Charan Teja Kalla Cc: Hillf Danton Cc: Jaroslav Pulchart Cc: Kairui Song Cc: Kalesh Singh Cc: Signed-off-by: Andrew Morton include/linux/mmzone.h | 30 +++++++++++++++++------------- mm/vmscan.c | 30 ++++++++++++++++-------------- 2 files changed, 33 insertions(+), 27 deletions(-) commit 5095a2b23987d3c3c47dd16b3d4080e2733b8bb9 Author: Yu Zhao Date: Thu Dec 7 23:14:05 2023 -0700 mm/mglru: try to stop at high watermarks The initial MGLRU patchset didn't include the memcg LRU support, and it relied on should_abort_scan(), added by commit f76c83378851 ("mm: multi-gen LRU: optimize multiple memcgs"), to "backoff to avoid overshooting their aggregate reclaim target by too much". Later on when the memcg LRU was added, should_abort_scan() was deemed unnecessary, and the test results [1] showed no side effects after it was removed by commit a579086c99ed ("mm: multi-gen LRU: remove eviction fairness safeguard"). However, that test used memory.reclaim, which sets nr_to_reclaim to SWAP_CLUSTER_MAX. So it can overshoot only by SWAP_CLUSTER_MAX-1 pages, i.e., from nr_reclaimed=nr_to_reclaim-1 to nr_reclaimed=nr_to_reclaim+SWAP_CLUSTER_MAX-1. Compared with the batch size kswapd sets to nr_to_reclaim, SWAP_CLUSTER_MAX is tiny. Therefore that test isn't able to reproduce the worst case scenario, i.e., kswapd overshooting GBs on large systems and "consuming 100% CPU" (see the Closes tag). Bring back a simplified version of should_abort_scan() on top of the memcg LRU, so that kswapd stops when all eligible zones are above their respective high watermarks plus a small delta to lower the chance of KSWAPD_HIGH_WMARK_HIT_QUICKLY. Note that this only applies to order-0 reclaim, meaning compaction-induced reclaim can still run wild (which is a different problem). On Android, launching 55 apps sequentially: Before After Change pgpgin 838377172 802955040 -4% pgpgout 38037080 34336300 -10% [1] https://lore.kernel.org/20221222041905.2431096-1-yuzhao@google.com/ Link: https://lkml.kernel.org/r/20231208061407.2125867-2-yuzhao@google.com Fixes: a579086c99ed ("mm: multi-gen LRU: remove eviction fairness safeguard") Signed-off-by: Yu Zhao Reported-by: Charan Teja Kalla Reported-by: Jaroslav Pulchart Closes: https://lore.kernel.org/CAK8fFZ4DY+GtBA40Pm7Nn5xCHy+51w3sfxPqkqpqakSXYyX+Wg@mail.gmail.com/ Tested-by: Jaroslav Pulchart Tested-by: Kalesh Singh Cc: Hillf Danton Cc: Kairui Song Cc: T.J. Mercier Cc: Signed-off-by: Andrew Morton mm/vmscan.c | 36 ++++++++++++++++++++++++++++-------- 1 file changed, 28 insertions(+), 8 deletions(-) commit 081488051d28d32569ebb7c7a23572778b2e7d57 Author: Yu Zhao Date: Thu Dec 7 23:14:04 2023 -0700 mm/mglru: fix underprotected page cache Unmapped folios accessed through file descriptors can be underprotected. Those folios are added to the oldest generation based on: 1. The fact that they are less costly to reclaim (no need to walk the rmap and flush the TLB) and have less impact on performance (don't cause major PFs and can be non-blocking if needed again). 2. The observation that they are likely to be single-use. E.g., for client use cases like Android, its apps parse configuration files and store the data in heap (anon); for server use cases like MySQL, it reads from InnoDB files and holds the cached data for tables in buffer pools (anon). However, the oldest generation can be very short lived, and if so, it doesn't provide the PID controller with enough time to respond to a surge of refaults. (Note that the PID controller uses weighted refaults and those from evicted generations only take a half of the whole weight.) In other words, for a short lived generation, the moving average smooths out the spike quickly. To fix the problem: 1. For folios that are already on LRU, if they can be beyond the tracking range of tiers, i.e., five accesses through file descriptors, move them to the second oldest generation to give them more time to age. (Note that tiers are used by the PID controller to statistically determine whether folios accessed multiple times through file descriptors are worth protecting.) 2. When adding unmapped folios to LRU, adjust the placement of them so that they are not too close to the tail. The effect of this is similar to the above. On Android, launching 55 apps sequentially: Before After Change workingset_refault_anon 25641024 25598972 0% workingset_refault_file 115016834 106178438 -8% Link: https://lkml.kernel.org/r/20231208061407.2125867-1-yuzhao@google.com Fixes: ac35a4902374 ("mm: multi-gen LRU: minimal implementation") Signed-off-by: Yu Zhao Reported-by: Charan Teja Kalla Tested-by: Kalesh Singh Cc: T.J. Mercier Cc: Kairui Song Cc: Hillf Danton Cc: Jaroslav Pulchart Cc: Signed-off-by: Andrew Morton include/linux/mm_inline.h | 23 ++++++++++++++--------- mm/vmscan.c | 2 +- mm/workingset.c | 6 +++--- 3 files changed, 18 insertions(+), 13 deletions(-) commit 55ac8bbe358bdd2f3c044c12f249fd22d48fe015 Author: David Stevens Date: Tue Apr 18 17:40:31 2023 +0900 mm/shmem: fix race in shmem_undo_range w/THP Split folios during the second loop of shmem_undo_range. It's not sufficient to only split folios when dealing with partial pages, since it's possible for a THP to be faulted in after that point. Calling truncate_inode_folio in that situation can result in throwing away data outside of the range being targeted. [akpm@linux-foundation.org: tidy up comment layout] Link: https://lkml.kernel.org/r/20230418084031.3439795-1-stevensd@google.com Fixes: b9a8a4195c7d ("truncate,shmem: Handle truncates that split large folios") Signed-off-by: David Stevens Cc: Matthew Wilcox (Oracle) Cc: Suleiman Souhlal Cc: Signed-off-by: Andrew Morton mm/shmem.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) commit 43e8832fed08438e2a27afed9bac21acd0ceffe5 Author: John Hubbard Date: Fri Dec 8 18:01:44 2023 -0800 Revert "selftests: error out if kernel header files are not yet built" This reverts commit 9fc96c7c19df ("selftests: error out if kernel header files are not yet built"). It turns out that requiring the kernel headers to be built as a prerequisite to building selftests, does not work in many cases. For example, Peter Zijlstra writes: "My biggest beef with the whole thing is that I simply do not want to use 'make headers', it doesn't work for me. I have a ton of output directories and I don't care to build tools into the output dirs, in fact some of them flat out refuse to work that way (bpf comes to mind)." [1] Therefore, stop erroring out on the selftests build. Additional patches will be required in order to change over to not requiring the kernel headers. [1] https://lore.kernel.org/20231208221007.GO28727@noisy.programming.kicks-ass.net Link: https://lkml.kernel.org/r/20231209020144.244759-1-jhubbard@nvidia.com Fixes: 9fc96c7c19df ("selftests: error out if kernel header files are not yet built") Signed-off-by: John Hubbard Cc: Anders Roxell Cc: Muhammad Usama Anjum Cc: David Hildenbrand Cc: Peter Xu Cc: Jonathan Corbet Cc: Nathan Chancellor Cc: Shuah Khan Cc: Peter Zijlstra Cc: Marcos Paulo de Souza Cc: Signed-off-by: Andrew Morton tools/testing/selftests/Makefile | 21 +-------------------- tools/testing/selftests/lib.mk | 40 +++------------------------------------- 2 files changed, 4 insertions(+), 57 deletions(-) commit 1dd11e977360ad3493812da0b05ffd9adcdd15a1 Author: Yuntao Wang Date: Sat Dec 9 22:14:38 2023 +0800 crash_core: fix the check for whether crashkernel is from high memory If crash_base is equal to CRASH_ADDR_LOW_MAX, it also indicates that the crashkernel memory is allocated from high memory. However, the current check only considers the case where crash_base is greater than CRASH_ADDR_LOW_MAX. Fix it. The runtime effects is that crashkernel high memory is successfully reserved, whereas the crashkernel low memory is bypassed in this case, then kdump kernel bootup will fail because of no low memory under 4G. This patch also includes some minor cleanups. Link: https://lkml.kernel.org/r/20231209141438.77233-1-ytcoode@gmail.com Fixes: 0ab97169aa05 ("crash_core: add generic function to do reservation") Signed-off-by: Yuntao Wang Cc: Baoquan He Cc: Dave Young Cc: Vivek Goyal Cc: Zhen Lei Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton kernel/crash_core.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 69f8ca8d36b5e52360f45c3b63bcb3d075da36df Author: Baoquan He Date: Fri Dec 8 15:30:36 2023 +0800 x86, kexec: fix the wrong ifdeffery CONFIG_KEXEC With the current ifdeffery CONFIG_KEXEC, get_cmdline_acpi_rsdp() is only available when kexec_load interface is taken, while kexec_file_load interface can't make use of it. Now change it to CONFIG_KEXEC_CORE. Link: https://lkml.kernel.org/r/20231208073036.7884-6-bhe@redhat.com Signed-off-by: Baoquan He Cc: Eric DeVolder Cc: Ignat Korchagin Cc: kernel test robot Cc: Stephen Rothwell Signed-off-by: Andrew Morton arch/x86/boot/compressed/acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d70c27b728b8da1ab9c3b7ca117ee1c99dc86d29 Author: Baoquan He Date: Fri Dec 8 15:30:35 2023 +0800 sh, kexec: fix the incorrect ifdeffery and dependency of CONFIG_KEXEC The select of KEXEC for CRASH_DUMP in kernel/Kconfig.kexec will be dropped, then compiling errors will be triggered if below config items are set: === CONFIG_CRASH_CORE=y CONFIG_KEXEC_CORE=y CONFIG_CRASH_DUMP=y === Here, change the dependency of building kexec_core related object files, and the ifdeffery on SuperH from CONFIG_KEXEC to CONFIG_KEXEC_CORE. Link: https://lkml.kernel.org/r/20231208073036.7884-5-bhe@redhat.com Signed-off-by: Baoquan He Cc: Eric DeVolder Cc: Ignat Korchagin Cc: kernel test robot Cc: Stephen Rothwell Signed-off-by: Andrew Morton arch/sh/include/asm/kexec.h | 4 ++-- arch/sh/kernel/Makefile | 2 +- arch/sh/kernel/reboot.c | 4 ++-- arch/sh/kernel/setup.c | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) commit 8cd2accb71f5eb8e92d775fc1978d3779875c2e5 Author: Baoquan He Date: Fri Dec 8 15:30:34 2023 +0800 mips, kexec: fix the incorrect ifdeffery and dependency of CONFIG_KEXEC The select of KEXEC for CRASH_DUMP in kernel/Kconfig.kexec will be dropped, then compiling errors will be triggered if below config items are set: === CONFIG_CRASH_CORE=y CONFIG_KEXEC_CORE=y CONFIG_CRASH_DUMP=y === -------------------------------------------------------------------- mipsel-linux-ld: kernel/kexec_core.o: in function `kimage_free': kernel/kexec_core.c:(.text+0x2200): undefined reference to `machine_kexec_cleanup' mipsel-linux-ld: kernel/kexec_core.o: in function `__crash_kexec': kernel/kexec_core.c:(.text+0x2480): undefined reference to `machine_crash_shutdown' mipsel-linux-ld: kernel/kexec_core.c:(.text+0x2488): undefined reference to `machine_kexec' mipsel-linux-ld: kernel/kexec_core.o: in function `kernel_kexec': kernel/kexec_core.c:(.text+0x29b8): undefined reference to `machine_shutdown' mipsel-linux-ld: kernel/kexec_core.c:(.text+0x29c0): undefined reference to `machine_kexec' -------------------------------------------------------------------- Here, change the dependency of building kexec_core related object files, and the ifdeffery in mips from CONFIG_KEXEC to CONFIG_KEXEC_CORE. Link: https://lkml.kernel.org/r/20231208073036.7884-4-bhe@redhat.com Signed-off-by: Baoquan He Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311302042.sn8cDPIX-lkp@intel.com/ Cc: Eric DeVolder Cc: Ignat Korchagin Cc: Stephen Rothwell Signed-off-by: Andrew Morton arch/mips/cavium-octeon/smp.c | 4 ++-- arch/mips/include/asm/kexec.h | 2 +- arch/mips/include/asm/smp-ops.h | 2 +- arch/mips/include/asm/smp.h | 2 +- arch/mips/kernel/Makefile | 2 +- arch/mips/kernel/smp-bmips.c | 4 ++-- arch/mips/kernel/smp-cps.c | 10 +++++----- arch/mips/loongson64/reset.c | 4 ++-- arch/mips/loongson64/smp.c | 2 +- 9 files changed, 16 insertions(+), 16 deletions(-) commit 9bad6b75fca1b38b08d94e93f49a90cda44702b9 Author: Baoquan He Date: Fri Dec 8 15:30:33 2023 +0800 m68k, kexec: fix the incorrect ifdeffery and build dependency of CONFIG_KEXEC The select of KEXEC for CRASH_DUMP in kernel/Kconfig.kexec will be dropped, then compiling errors will be triggered if below config items are set: === CONFIG_CRASH_CORE=y CONFIG_KEXEC_CORE=y CONFIG_CRASH_DUMP=y === Here, change the dependency of buinding machine_kexec.o relocate_kernel.o and the ifdeffery in asm/kexe.h to CONFIG_KEXEC_CORE. Link: https://lkml.kernel.org/r/20231208073036.7884-3-bhe@redhat.com Signed-off-by: Baoquan He Cc: Eric DeVolder Cc: Ignat Korchagin Cc: kernel test robot Cc: Stephen Rothwell Signed-off-by: Andrew Morton arch/m68k/include/asm/kexec.h | 4 ++-- arch/m68k/kernel/Makefile | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) commit 655fc6cd45521aba4a21c6e607533f1a21e06c2e Author: Baoquan He Date: Fri Dec 8 15:30:32 2023 +0800 loongarch, kexec: change dependency of object files Patch series "kexec: fix the incorrect ifdeffery and dependency of CONFIG_KEXEC". The select of KEXEC for CRASH_DUMP in kernel/Kconfig.kexec will be dropped, then compiling errors will be triggered if below config items are set: === CONFIG_CRASH_CORE=y CONFIG_KEXEC_CORE=y CONFIG_CRASH_DUMP=y === E.g on mips, below link error are seen: -------------------------------------------------------------------- mipsel-linux-ld: kernel/kexec_core.o: in function `kimage_free': kernel/kexec_core.c:(.text+0x2200): undefined reference to `machine_kexec_cleanup' mipsel-linux-ld: kernel/kexec_core.o: in function `__crash_kexec': kernel/kexec_core.c:(.text+0x2480): undefined reference to `machine_crash_shutdown' mipsel-linux-ld: kernel/kexec_core.c:(.text+0x2488): undefined reference to `machine_kexec' mipsel-linux-ld: kernel/kexec_core.o: in function `kernel_kexec': kernel/kexec_core.c:(.text+0x29b8): undefined reference to `machine_shutdown' mipsel-linux-ld: kernel/kexec_core.c:(.text+0x29c0): undefined reference to `machine_kexec' -------------------------------------------------------------------- Here, change the incorrect dependency of building kexec_core related object files, and the ifdeffery on architectures from CONFIG_KEXEC to CONFIG_KEXEC_CORE. Testing: ======== Passed on mips and loognarch with the LKP reproducer. This patch (of 5): Currently, in arch/loongarch/kernel/Makefile, building machine_kexec.o relocate_kernel.o depends on CONFIG_KEXEC. Whereas, since we will drop the select of KEXEC for CRASH_DUMP in kernel/Kconfig.kexec, compiling error will be triggered if below config items are set: === CONFIG_CRASH_CORE=y CONFIG_KEXEC_CORE=y CONFIG_CRASH_DUMP=y === --------------------------------------------------------------- loongarch64-linux-ld: kernel/kexec_core.o: in function `.L209': >> kexec_core.c:(.text+0x1660): undefined reference to `machine_kexec_cleanup' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L287': >> kexec_core.c:(.text+0x1c5c): undefined reference to `machine_crash_shutdown' >> loongarch64-linux-ld: kexec_core.c:(.text+0x1c64): undefined reference to `machine_kexec' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L2^B5': >> kexec_core.c:(.text+0x2090): undefined reference to `machine_shutdown' loongarch64-linux-ld: kexec_core.c:(.text+0x20a0): undefined reference to `machine_kexec' --------------------------------------------------------------- Here, change the dependency of machine_kexec.o relocate_kernel.o to CONFIG_KEXEC_CORE can fix above building error. Link: https://lkml.kernel.org/r/20231208073036.7884-1-bhe@redhat.com Link: https://lkml.kernel.org/r/20231208073036.7884-2-bhe@redhat.com Signed-off-by: Baoquan He Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311300946.kHE9Iu71-lkp@intel.com/ Cc: Eric DeVolder Cc: Ignat Korchagin Cc: Stephen Rothwell Signed-off-by: Andrew Morton arch/loongarch/kernel/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6376a824595607e99d032a39ba3394988b4fce96 Author: SeongJae Park Date: Fri Dec 8 17:50:18 2023 +0000 mm/damon/core: make damon_start() waits until kdamond_fn() starts The cleanup tasks of kdamond threads including reset of corresponding DAMON context's ->kdamond field and decrease of global nr_running_ctxs counter is supposed to be executed by kdamond_fn(). However, commit 0f91d13366a4 ("mm/damon: simplify stop mechanism") made neither damon_start() nor damon_stop() ensure the corresponding kdamond has started the execution of kdamond_fn(). As a result, the cleanup can be skipped if damon_stop() is called fast enough after the previous damon_start(). Especially the skipped reset of ->kdamond could cause a use-after-free. Fix it by waiting for start of kdamond_fn() execution from damon_start(). Link: https://lkml.kernel.org/r/20231208175018.63880-1-sj@kernel.org Fixes: 0f91d13366a4 ("mm/damon: simplify stop mechanism") Signed-off-by: SeongJae Park Reported-by: Jakub Acs Cc: Changbin Du Cc: Jakub Acs Cc: # 5.15.x Signed-off-by: Andrew Morton include/linux/damon.h | 2 ++ mm/damon/core.c | 6 ++++++ 2 files changed, 8 insertions(+) commit a6fcd57cf2df409d35e9225b8dbad6f937b28df0 Author: David Hildenbrand Date: Wed Dec 6 11:35:58 2023 +0100 selftests/mm: cow: print ksft header before printing anything else Doing a ksft_print_msg() before the ksft_print_header() seems to confuse the ksft framework in a strange way: running the test on the cmdline results in the expected output. But piping the output somewhere else, results in some odd output, whereby we repeatedly get the same info printed: # [INFO] detected THP size: 2048 KiB # [INFO] detected hugetlb page size: 2048 KiB # [INFO] detected hugetlb page size: 1048576 KiB # [INFO] huge zeropage is enabled TAP version 13 1..190 # [INFO] Anonymous memory tests in private mappings # [RUN] Basic COW after fork() ... with base page # [INFO] detected THP size: 2048 KiB # [INFO] detected hugetlb page size: 2048 KiB # [INFO] detected hugetlb page size: 1048576 KiB # [INFO] huge zeropage is enabled TAP version 13 1..190 # [INFO] Anonymous memory tests in private mappings # [RUN] Basic COW after fork() ... with base page ok 1 No leak from parent into child # [RUN] Basic COW after fork() ... with swapped out base page # [INFO] detected THP size: 2048 KiB # [INFO] detected hugetlb page size: 2048 KiB # [INFO] detected hugetlb page size: 1048576 KiB # [INFO] huge zeropage is enabled Doing the ksft_print_header() first seems to resolve that and gives us the output we expect: TAP version 13 # [INFO] detected THP size: 2048 KiB # [INFO] detected hugetlb page size: 2048 KiB # [INFO] detected hugetlb page size: 1048576 KiB # [INFO] huge zeropage is enabled 1..190 # [INFO] Anonymous memory tests in private mappings # [RUN] Basic COW after fork() ... with base page ok 1 No leak from parent into child # [RUN] Basic COW after fork() ... with swapped out base page ok 2 No leak from parent into child # [RUN] Basic COW after fork() ... with THP ok 3 No leak from parent into child # [RUN] Basic COW after fork() ... with swapped-out THP ok 4 No leak from parent into child # [RUN] Basic COW after fork() ... with PTE-mapped THP ok 5 No leak from parent into child Link: https://lkml.kernel.org/r/20231206103558.38040-1-david@redhat.com Fixes: f4b5fd6946e2 ("selftests/vm: anon_cow: THP tests") Signed-off-by: David Hildenbrand Reported-by: Nico Pache Signed-off-by: Andrew Morton tools/testing/selftests/mm/cow.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d3bb89ea9c13e5a98d2b7a0ba8e50a77893132cb Author: Kefeng Wang Date: Thu Dec 7 23:25:25 2023 +0800 mm: fix VMA heap bounds checking After converting selinux to VMA heap check helper, the gcl triggers an execheap SELinux denial, which is caused by a changed logic check. Previously selinux only checked that the VMA range was within the VMA heap range, and the implementation checks the intersection between the two ranges, but the corner case (vm_end=start_brk, brk=vm_start) isn't handled correctly. Since commit 11250fd12eb8 ("mm: factor out VMA stack and heap checks") was only a function extraction, it seems that the issue was introduced by commit 0db0c01b53a1 ("procfs: fix /proc//maps heap check"). Let's fix above corner cases, meanwhile, correct the wrong indentation of the stack and heap check helpers. Fixes: 11250fd12eb8 ("mm: factor out VMA stack and heap checks") Signed-off-by: Kefeng Wang Reported-by: Ondrej Mosnacek Closes: https://lore.kernel.org/selinux/CAFqZXNv0SVT0fkOK6neP9AXbj3nxJ61JAY4+zJzvxqJaeuhbFw@mail.gmail.com/ Tested-by: Ondrej Mosnacek Link: https://lkml.kernel.org/r/20231207152525.2607420-1-wangkefeng.wang@huawei.com Cc: David Hildenbrand Cc: Paul Moore Cc: Peter Zijlstra Cc: Stephen Smalley Signed-off-by: Andrew Morton include/linux/mm.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit ac88ff6b9d7dea9f0907c86bdae204dde7d5c0e6 Author: Baoquan He Date: Tue Dec 5 11:02:55 2023 +0800 riscv: fix VMALLOC_START definition When below config items are set, compiler complained: -------------------- CONFIG_CRASH_CORE=y CONFIG_KEXEC_CORE=y CONFIG_CRASH_DUMP=y ...... ----------------------- ------------------------------------------------------------------- arch/riscv/kernel/crash_core.c: In function 'arch_crash_save_vmcoreinfo': arch/riscv/kernel/crash_core.c:11:58: warning: format '%lx' expects argument of type 'long unsigned int', but argument 2 has type 'int' [-Wformat=] 11 | vmcoreinfo_append_str("NUMBER(VMALLOC_START)=0x%lx\n", VMALLOC_START); | ~~^ | | | long unsigned int | %x ---------------------------------------------------------------------- This is because on riscv macro VMALLOC_START has different type when CONFIG_MMU is set or unset. arch/riscv/include/asm/pgtable.h: -------------------------------------------------- Changing it to _AC(0, UL) in case CONFIG_MMU=n can fix the warning. Link: https://lkml.kernel.org/r/ZW7OsX4zQRA3mO4+@MiWiFi-R3L-srv Signed-off-by: Baoquan He Reported-by: Randy Dunlap Acked-by: Randy Dunlap Tested-by: Randy Dunlap # build-tested Cc: Eric DeVolder Cc: Ignat Korchagin Cc: Stephen Rothwell Cc: Paul Walmsley Cc: Palmer Dabbelt Cc: Albert Ou Signed-off-by: Andrew Morton arch/riscv/include/asm/pgtable.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c41bd2514184d75db087fe4c1221237fb7922875 Author: Ignat Korchagin Date: Wed Nov 29 22:04:09 2023 +0000 kexec: drop dependency on ARCH_SUPPORTS_KEXEC from CRASH_DUMP In commit f8ff23429c62 ("kernel/Kconfig.kexec: drop select of KEXEC for CRASH_DUMP") we tried to fix a config regression, where CONFIG_CRASH_DUMP required CONFIG_KEXEC. However, it was not enough at least for arm64 platforms. While further testing the patch with our arm64 config I noticed that CONFIG_CRASH_DUMP is unavailable in menuconfig. This is because CONFIG_CRASH_DUMP still depends on the new CONFIG_ARCH_SUPPORTS_KEXEC introduced in commit 91506f7e5d21 ("arm64/kexec: refactor for kernel/Kconfig.kexec") and on arm64 CONFIG_ARCH_SUPPORTS_KEXEC requires CONFIG_PM_SLEEP_SMP=y, which in turn requires either CONFIG_SUSPEND=y or CONFIG_HIBERNATION=y neither of which are set in our config. Given that we already established that CONFIG_KEXEC (which is a switch for kexec system call itself) is not required for CONFIG_CRASH_DUMP drop CONFIG_ARCH_SUPPORTS_KEXEC dependency as well. The arm64 kernel builds just fine with CONFIG_CRASH_DUMP=y and with both CONFIG_KEXEC=n and CONFIG_KEXEC_FILE=n after f8ff23429c62 ("kernel/Kconfig.kexec: drop select of KEXEC for CRASH_DUMP") and this patch are applied given that the necessary shared bits are included via CONFIG_KEXEC_CORE dependency. [bhe@redhat.com: don't export some symbols when CONFIG_MMU=n] Link: https://lkml.kernel.org/r/ZW03ODUKGGhP1ZGU@MiWiFi-R3L-srv [bhe@redhat.com: riscv, kexec: fix dependency of two items] Link: https://lkml.kernel.org/r/ZW04G/SKnhbE5mnX@MiWiFi-R3L-srv Link: https://lkml.kernel.org/r/20231129220409.55006-1-ignat@cloudflare.com Fixes: 91506f7e5d21 ("arm64/kexec: refactor for kernel/Kconfig.kexec") Signed-off-by: Ignat Korchagin Signed-off-by: Baoquan He Acked-by: Baoquan He Cc: Alexander Gordeev Cc: # 6.6+: f8ff234: kernel/Kconfig.kexec: drop select of KEXEC for CRASH_DUMP Cc: # 6.6+ Signed-off-by: Andrew Morton arch/riscv/Kconfig | 4 ++-- arch/riscv/kernel/crash_core.c | 4 +++- kernel/Kconfig.kexec | 1 - 3 files changed, 5 insertions(+), 4 deletions(-) commit 88035e5694a86a7167d490bb95e9df97a9bb162b Merge: cf52eed70e55 df83a0df820b Author: Linus Torvalds Date: Tue Dec 12 17:02:56 2023 -0800 Merge tag 'hid-for-linus-2023121201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - Lenovo ThinkPad TrackPoint Keyboard II firmware-specific regression fix (Mikhail Khvainitski) - device-specific fixes (various authors) * tag 'hid-for-linus-2023121201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: apple: Add "hfd.cn" and "WKB603" to the list of non-apple keyboards HID: lenovo: Restrict detection of patched firmware only to USB cptkbd HID: Add quirk for Labtec/ODDOR/aikeec handbrake HID: i2c-hid: Add IDEA5002 to i2c_hid_acpi_blacklist[] mailmap: add address mapping for Jiri Kosina commit 65c95f78917ea6fa7ff189a2c19879c4fe161873 Author: Jiri Pirko Date: Mon Dec 11 09:37:58 2023 +0100 dpll: sanitize possible null pointer dereference in dpll_pin_parent_pin_set() User may not pass DPLL_A_PIN_STATE attribute in the pin set operation message. Sanitize that by checking if the attr pointer is not null and process the passed state attribute value only in that case. Reported-by: Xingyuan Mo Fixes: 9d71b54b65b1 ("dpll: netlink: Add DPLL framework base functions") Signed-off-by: Jiri Pirko Acked-by: Vadim Fedorenko Link: https://lore.kernel.org/r/20231211083758.1082853-1-jiri@resnulli.us Signed-off-by: Jakub Kicinski drivers/dpll/dpll_netlink.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 154bb2fa4810e6196561ecc0f0c36ad61c770b6e Merge: f99cd56230f5 4ab138ca0a34 Author: Jakub Kicinski Date: Tue Dec 12 16:07:32 2023 -0800 Merge branch 'ena-driver-xdp-bug-fixes' David Arinzon says: ==================== ENA driver XDP bug fixes This patchset contains multiple XDP-related bug fixes in the ENA driver. ==================== Link: https://lore.kernel.org/r/20231211062801.27891-1-darinzon@amazon.com Signed-off-by: Jakub Kicinski commit 4ab138ca0a340e6d6e7a6a9bd5004bd8f83127ca Author: David Arinzon Date: Mon Dec 11 06:28:01 2023 +0000 net: ena: Fix XDP redirection error When sending TX packets, the meta descriptor can be all zeroes as no meta information is required (as in XDP). This patch removes the validity check, as when `disable_meta_caching` is enabled, such TX packets will be dropped otherwise. Fixes: 0e3a3f6dacf0 ("net: ena: support new LLQ acceleration mode") Signed-off-by: Shay Agroskin Signed-off-by: David Arinzon Link: https://lore.kernel.org/r/20231211062801.27891-5-darinzon@amazon.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/amazon/ena/ena_eth_com.c | 3 --- 1 file changed, 3 deletions(-) commit d760117060cf2e90b5c59c5492cab179a4dbce01 Author: David Arinzon Date: Mon Dec 11 06:28:00 2023 +0000 net: ena: Fix DMA syncing in XDP path when SWIOTLB is on This patch fixes two issues: Issue 1 ------- Description ``````````` Current code does not call dma_sync_single_for_cpu() to sync data from the device side memory to the CPU side memory before the XDP code path uses the CPU side data. This causes the XDP code path to read the unset garbage data in the CPU side memory, resulting in incorrect handling of the packet by XDP. Solution ```````` 1. Add a call to dma_sync_single_for_cpu() before the XDP code starts to use the data in the CPU side memory. 2. The XDP code verdict can be XDP_PASS, in which case there is a fallback to the non-XDP code, which also calls dma_sync_single_for_cpu(). To avoid calling dma_sync_single_for_cpu() twice: 2.1. Put the dma_sync_single_for_cpu() in the code in such a place where it happens before XDP and non-XDP code. 2.2. Remove the calls to dma_sync_single_for_cpu() in the non-XDP code for the first buffer only (rx_copybreak and non-rx_copybreak cases), since the new call that was added covers these cases. The call to dma_sync_single_for_cpu() for the second buffer and on stays because only the first buffer is handled by the newly added dma_sync_single_for_cpu(). And there is no need for special handling of the second buffer and on for the XDP path since currently the driver supports only single buffer packets. Issue 2 ------- Description ``````````` In case the XDP code forwarded the packet (ENA_XDP_FORWARDED), ena_unmap_rx_buff_attrs() is called with attrs set to 0. This means that before unmapping the buffer, the internal function dma_unmap_page_attrs() will also call dma_sync_single_for_cpu() on the whole buffer (not only on the data part of it). This sync is both wasteful (since a sync was already explicitly called before) and also causes a bug, which will be explained using the below diagram. The following diagram shows the flow of events causing the bug. The order of events is (1)-(4) as shown in the diagram. CPU side memory area (3)convert_to_xdp_frame() initializes the headroom with xdpf metadata || \/ ___________________________________ | | 0 | V 4K --------------------------------------------------------------------- | xdpf->data | other xdpf | < data > | tailroom ||...| | | fields | | GARBAGE || | --------------------------------------------------------------------- /\ /\ || || (4)ena_unmap_rx_buff_attrs() calls (2)dma_sync_single_for_cpu() dma_sync_single_for_cpu() on the copies data from device whole buffer page, overwriting side to CPU side memory the xdpf->data with GARBAGE. || 0 4K --------------------------------------------------------------------- | headroom | < data > | tailroom ||...| | GARBAGE | | GARBAGE || | --------------------------------------------------------------------- Device side memory area /\ || (1) device writes RX packet data After the call to ena_unmap_rx_buff_attrs() in (4), the xdpf->data becomes corrupted, and so when it is later accessed in ena_clean_xdp_irq()->xdp_return_frame(), it causes a page fault, crashing the kernel. Solution ```````` Explicitly tell ena_unmap_rx_buff_attrs() not to call dma_sync_single_for_cpu() by passing it the ENA_DMA_ATTR_SKIP_CPU_SYNC flag. Fixes: f7d625adeb7b ("net: ena: Add dynamic recycling mechanism for rx buffers") Signed-off-by: Arthur Kiyanovski Signed-off-by: David Arinzon Link: https://lore.kernel.org/r/20231211062801.27891-4-darinzon@amazon.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/amazon/ena/ena_netdev.c | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) commit 505b1a88d311ff6f8c44a34f94e3be21745cce6f Author: David Arinzon Date: Mon Dec 11 06:27:59 2023 +0000 net: ena: Fix xdp drops handling due to multibuf packets Current xdp code drops packets larger than ENA_XDP_MAX_MTU. This is an incorrect condition since the problem is not the size of the packet, rather the number of buffers it contains. This commit: 1. Identifies and drops XDP multi-buffer packets at the beginning of the function. 2. Increases the xdp drop statistic when this drop occurs. 3. Adds a one-time print that such drops are happening to give better indication to the user. Fixes: 838c93dc5449 ("net: ena: implement XDP drop support") Signed-off-by: Arthur Kiyanovski Signed-off-by: David Arinzon Link: https://lore.kernel.org/r/20231211062801.27891-3-darinzon@amazon.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/amazon/ena/ena_netdev.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) commit 41db6f99b5489a0d2ef26afe816ef0c6118d1d47 Author: David Arinzon Date: Mon Dec 11 06:27:58 2023 +0000 net: ena: Destroy correct number of xdp queues upon failure The ena_setup_and_create_all_xdp_queues() function freed all the resources upon failure, after creating only xdp_num_queues queues, instead of freeing just the created ones. In this patch, the only resources that are freed, are the ones allocated right before the failure occurs. Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action") Signed-off-by: Shahar Itzko Signed-off-by: David Arinzon Link: https://lore.kernel.org/r/20231211062801.27891-2-darinzon@amazon.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/amazon/ena/ena_netdev.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit d06aff1cb13d2a0d52b48e605462518149c98c81 Author: Steven Rostedt (Google) Date: Sun Dec 10 22:54:47 2023 -0500 tracing: Update snapshot buffer on resize if it is allocated The snapshot buffer is to mimic the main buffer so that when a snapshot is needed, the snapshot and main buffer are swapped. When the snapshot buffer is allocated, it is set to the minimal size that the ring buffer may be at and still functional. When it is allocated it becomes the same size as the main ring buffer, and when the main ring buffer changes in size, it should do. Currently, the resize only updates the snapshot buffer if it's used by the current tracer (ie. the preemptirqsoff tracer). But it needs to be updated anytime it is allocated. When changing the size of the main buffer, instead of looking to see if the current tracer is utilizing the snapshot buffer, just check if it is allocated to know if it should be updated or not. Also fix typo in comment just above the code change. Link: https://lore.kernel.org/linux-trace-kernel/20231210225447.48476a6a@rorschach.local.home Cc: stable@vger.kernel.org Cc: Mark Rutland Cc: Mathieu Desnoyers Fixes: ad909e21bbe69 ("tracing: Add internal tracing_snapshot() functions") Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) kernel/trace/trace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 17d801758157bec93f26faaf5ff1a8b9a552d67a Author: Steven Rostedt (Google) Date: Sun Dec 10 22:12:50 2023 -0500 ring-buffer: Fix memory leak of free page Reading the ring buffer does a swap of a sub-buffer within the ring buffer with a empty sub-buffer. This allows the reader to have full access to the content of the sub-buffer that was swapped out without having to worry about contention with the writer. The readers call ring_buffer_alloc_read_page() to allocate a page that will be used to swap with the ring buffer. When the code is finished with the reader page, it calls ring_buffer_free_read_page(). Instead of freeing the page, it stores it as a spare. Then next call to ring_buffer_alloc_read_page() will return this spare instead of calling into the memory management system to allocate a new page. Unfortunately, on freeing of the ring buffer, this spare page is not freed, and causes a memory leak. Link: https://lore.kernel.org/linux-trace-kernel/20231210221250.7b9cc83c@rorschach.local.home Cc: stable@vger.kernel.org Cc: Mark Rutland Cc: Mathieu Desnoyers Fixes: 73a757e63114d ("ring-buffer: Return reader page back into existing ring buffer") Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) kernel/trace/ring_buffer.c | 2 ++ 1 file changed, 2 insertions(+) commit 5eaf7f0589c0d88178f0fbeebe0e0b7108258707 Author: Beau Belgrave Date: Sun Dec 10 21:35:34 2023 +0000 eventfs: Fix events beyond NAME_MAX blocking tasks Eventfs uses simple_lookup(), however, it will fail if the name of the entry is beyond NAME_MAX length. When this error is encountered, eventfs still tries to create dentries instead of skipping the dentry creation. When the dentry is attempted to be created in this state d_wait_lookup() will loop forever, waiting for the lookup to be removed. Fix eventfs to return the error in simple_lookup() back to the caller instead of continuing to try to create the dentry. Link: https://lore.kernel.org/linux-trace-kernel/20231210213534.497-1-beaub@linux.microsoft.com Fixes: 63940449555e ("eventfs: Implement eventfs lookup, read, open functions") Link: https://lore.kernel.org/linux-trace-kernel/20231208183601.GA46-beaub@linux.microsoft.com/ Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 4 ++++ 1 file changed, 4 insertions(+) commit b55b0a0d7c4aa2dac3579aa7e6802d1f57445096 Author: Steven Rostedt (Google) Date: Sat Dec 9 17:10:58 2023 -0500 tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing If a large event was added to the ring buffer that is larger than what the trace_seq can handle, it just drops the output: ~# cat /sys/kernel/tracing/trace # tracer: nop # # entries-in-buffer/entries-written: 2/2 #P:8 # # _-----=> irqs-off/BH-disabled # / _----=> need-resched # | / _---=> hardirq/softirq # || / _--=> preempt-depth # ||| / _-=> migrate-disable # |||| / delay # TASK-PID CPU# ||||| TIMESTAMP FUNCTION # | | | ||||| | | <...>-859 [001] ..... 141.118951: tracing_mark_write <...>-859 [001] ..... 141.148201: tracing_mark_write: 78901234 Instead, catch this case and add some context: ~# cat /sys/kernel/tracing/trace # tracer: nop # # entries-in-buffer/entries-written: 2/2 #P:8 # # _-----=> irqs-off/BH-disabled # / _----=> need-resched # | / _---=> hardirq/softirq # || / _--=> preempt-depth # ||| / _-=> migrate-disable # |||| / delay # TASK-PID CPU# ||||| TIMESTAMP FUNCTION # | | | ||||| | | <...>-852 [001] ..... 121.550551: tracing_mark_write[LINE TOO BIG] <...>-852 [001] ..... 121.550581: tracing_mark_write: 78901234 This now emulates the same output as trace_pipe. Link: https://lore.kernel.org/linux-trace-kernel/20231209171058.78c1a026@gandalf.local.home Cc: Mark Rutland Cc: Mathieu Desnoyers Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) kernel/trace/trace.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit b3ae7b67b87fed771fa5bf95389df06b0433603e Author: Steven Rostedt (Google) Date: Tue Dec 12 11:16:17 2023 -0500 ring-buffer: Fix writing to the buffer with max_data_size The maximum ring buffer data size is the maximum size of data that can be recorded on the ring buffer. Events must be smaller than the sub buffer data size minus any meta data. This size is checked before trying to allocate from the ring buffer because the allocation assumes that the size will fit on the sub buffer. The maximum size was calculated as the size of a sub buffer page (which is currently PAGE_SIZE minus the sub buffer header) minus the size of the meta data of an individual event. But it missed the possible adding of a time stamp for events that are added long enough apart that the event meta data can't hold the time delta. When an event is added that is greater than the current BUF_MAX_DATA_SIZE minus the size of a time stamp, but still less than or equal to BUF_MAX_DATA_SIZE, the ring buffer would go into an infinite loop, looking for a page that can hold the event. Luckily, there's a check for this loop and after 1000 iterations and a warning is emitted and the ring buffer is disabled. But this should never happen. This can happen when a large event is added first, or after a long period where an absolute timestamp is prefixed to the event, increasing its size by 8 bytes. This passes the check and then goes into the algorithm that causes the infinite loop. For events that are the first event on the sub-buffer, it does not need to add a timestamp, because the sub-buffer itself contains an absolute timestamp, and adding one is redundant. The fix is to check if the event is to be the first event on the sub-buffer, and if it is, then do not add a timestamp. This also fixes 32 bit adding a timestamp when a read of before_stamp or write_stamp is interrupted. There's still no need to add that timestamp if the event is going to be the first event on the sub buffer. Also, if the buffer has "time_stamp_abs" set, then also check if the length plus the timestamp is greater than the BUF_MAX_DATA_SIZE. Link: https://lore.kernel.org/all/20231212104549.58863438@gandalf.local.home/ Link: https://lore.kernel.org/linux-trace-kernel/20231212071837.5fdd6c13@gandalf.local.home Link: https://lore.kernel.org/linux-trace-kernel/20231212111617.39e02849@gandalf.local.home Cc: stable@vger.kernel.org Cc: Mark Rutland Cc: Mathieu Desnoyers Fixes: a4543a2fa9ef3 ("ring-buffer: Get timestamp after event is allocated") Fixes: 58fbc3c63275c ("ring-buffer: Consolidate add_timestamp to remove some branches") Reported-by: Kent Overstreet # (on IRC) Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) kernel/trace/ring_buffer.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit f99cd56230f56c8b6b33713c5be4da5d6766be1f Author: Dong Chenchen Date: Sun Dec 10 10:02:00 2023 +0800 net: Remove acked SYN flag from packet in the transmit queue correctly syzkaller report: kernel BUG at net/core/skbuff.c:3452! invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.7.0-rc4-00009-gbee0e7762ad2-dirty #135 RIP: 0010:skb_copy_and_csum_bits (net/core/skbuff.c:3452) Call Trace: icmp_glue_bits (net/ipv4/icmp.c:357) __ip_append_data.isra.0 (net/ipv4/ip_output.c:1165) ip_append_data (net/ipv4/ip_output.c:1362 net/ipv4/ip_output.c:1341) icmp_push_reply (net/ipv4/icmp.c:370) __icmp_send (./include/net/route.h:252 net/ipv4/icmp.c:772) ip_fragment.constprop.0 (./include/linux/skbuff.h:1234 net/ipv4/ip_output.c:592 net/ipv4/ip_output.c:577) __ip_finish_output (net/ipv4/ip_output.c:311 net/ipv4/ip_output.c:295) ip_output (net/ipv4/ip_output.c:427) __ip_queue_xmit (net/ipv4/ip_output.c:535) __tcp_transmit_skb (net/ipv4/tcp_output.c:1462) __tcp_retransmit_skb (net/ipv4/tcp_output.c:3387) tcp_retransmit_skb (net/ipv4/tcp_output.c:3404) tcp_retransmit_timer (net/ipv4/tcp_timer.c:604) tcp_write_timer (./include/linux/spinlock.h:391 net/ipv4/tcp_timer.c:716) The panic issue was trigered by tcp simultaneous initiation. The initiation process is as follows: TCP A TCP B 1. CLOSED CLOSED 2. SYN-SENT --> ... 3. SYN-RECEIVED <-- <-- SYN-SENT 4. ... --> SYN-RECEIVED 5. SYN-RECEIVED --> ... // TCP B: not send challenge ack for ack limit or packet loss // TCP A: close tcp_close tcp_send_fin if (!tskb && tcp_under_memory_pressure(sk)) tskb = skb_rb_last(&sk->tcp_rtx_queue); //pick SYN_ACK packet TCP_SKB_CB(tskb)->tcp_flags |= TCPHDR_FIN; // set FIN flag 6. FIN_WAIT_1 --> ... // TCP B: send challenge ack to SYN_FIN_ACK 7. ... <-- SYN-RECEIVED //challenge ack // TCP A: 8. FIN_WAIT_1 --> ... // retransmit panic __tcp_retransmit_skb //skb->len=0 tcp_trim_head len = tp->snd_una - TCP_SKB_CB(skb)->seq // len=101-100 __pskb_trim_head skb->data_len -= len // skb->len=-1, wrap around ... ... ip_fragment icmp_glue_bits //BUG_ON If we use tcp_trim_head() to remove acked SYN from packet that contains data or other flags, skb->len will be incorrectly decremented. We can remove SYN flag that has been acked from rtx_queue earlier than tcp_trim_head(), which can fix the problem mentioned above. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Co-developed-by: Eric Dumazet Signed-off-by: Eric Dumazet Signed-off-by: Dong Chenchen Link: https://lore.kernel.org/r/20231210020200.1539875-1-dongchenchen2@huawei.com Signed-off-by: Jakub Kicinski net/ipv4/tcp_output.c | 6 ++++++ 1 file changed, 6 insertions(+) commit b65d52ac9c085c0c52dee012a210d4e2f352611b Author: Dinghao Liu Date: Sun Dec 10 12:52:55 2023 +0800 qed: Fix a potential use-after-free in qed_cxt_tables_alloc qed_ilt_shadow_alloc() will call qed_ilt_shadow_free() to free p_hwfn->p_cxt_mngr->ilt_shadow on error. However, qed_cxt_tables_alloc() accesses the freed pointer on failure of qed_ilt_shadow_alloc() through calling qed_cxt_mngr_free(), which may lead to use-after-free. Fix this issue by setting p_mngr->ilt_shadow to NULL in qed_ilt_shadow_free(). Fixes: fe56b9e6a8d9 ("qed: Add module with basic common support") Reviewed-by: Przemek Kitszel Signed-off-by: Dinghao Liu Link: https://lore.kernel.org/r/20231210045255.21383-1-dinghao.liu@zju.edu.cn Signed-off-by: Jakub Kicinski drivers/net/ethernet/qlogic/qed/qed_cxt.c | 1 + 1 file changed, 1 insertion(+) commit ff49bf1867578f23a5ffdd38f927f6e1e16796c4 Author: Fedor Pchelkin Date: Wed Dec 6 23:09:13 2023 +0300 net: 9p: avoid freeing uninit memory in p9pdu_vreadf If some of p9pdu_readf() calls inside case 'T' in p9pdu_vreadf() fails, the error path is not handled properly. *wnames or members of *wnames array may be left uninitialized and invalidly freed. Initialize *wnames to NULL in beginning of case 'T'. Initialize the first *wnames array element to NULL and nullify the failing *wnames element so that the error path freeing loop stops on the first NULL element and doesn't proceed further. Found by Linux Verification Center (linuxtesting.org). Fixes: ace51c4dd2f9 ("9p: add new protocol support code") Signed-off-by: Fedor Pchelkin Message-ID: <20231206200913.16135-1-pchelkin@ispras.ru> Cc: stable@vger.kernel.org Reviewed-by: Simon Horman Reviewed-by: Christian Schoenebeck Signed-off-by: Dominique Martinet net/9p/protocol.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) commit cf52eed70e555e864120cfaf280e979e2a035c66 Merge: eaadbbaaff74 6c02757c9360 Author: Linus Torvalds Date: Tue Dec 12 11:37:04 2023 -0800 Merge tag 'ext4_for_linus-6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Fix various bugs / regressions for ext4, including a soft lockup, a WARN_ON, and a BUG" * tag 'ext4_for_linus-6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: jbd2: fix soft lockup in journal_finish_inode_data_buffers() ext4: fix warning in ext4_dio_write_end_io() jbd2: increase the journal IO's priority jbd2: correct the printing of write_flags in jbd2_write_superblock() ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS commit 7ae42ef308ed0f6250b36f43e4eeb182ebbe6215 Author: Slawomir Laba Date: Wed Nov 29 10:35:26 2023 -0500 iavf: Fix iavf_shutdown to call iavf_remove instead iavf_close Make the flow for pci shutdown be the same to the pci remove. iavf_shutdown was implementing an incomplete version of iavf_remove. It misses several calls to the kernel like iavf_free_misc_irq, iavf_reset_interrupt_capability, iounmap that might break the system on reboot or hibernation. Implement the call of iavf_remove directly in iavf_shutdown to close this gap. Fixes below error messages (dmesg) during shutdown stress tests - [685814.900917] ice 0000:88:00.0: MAC 02:d0:5f:82:43:5d does not exist for VF 0 [685814.900928] ice 0000:88:00.0: MAC 33:33:00:00:00:01 does not exist for VF 0 Reproduction: 1. Create one VF interface: echo 1 > /sys/class/net//device/sriov_numvfs 2. Run live dmesg on the host: dmesg -wH 3. On SUT, script below steps into vf_namespace_assignment.sh <#!/bin/sh> // Remove <>. Git removes # line if= (edit this per VF name) loop=0 while true; do echo test round $loop let loop++ ip netns add ns$loop ip link set dev $if up ip link set dev $if netns ns$loop ip netns exec ns$loop ip link set dev $if up ip netns exec ns$loop ip link set dev $if netns 1 ip netns delete ns$loop done 4. Run the script for at least 1000 iterations on SUT: ./vf_namespace_assignment.sh Expected result: No errors in dmesg. Fixes: 129cf89e5856 ("iavf: rename functions and structs to new name") Signed-off-by: Slawomir Laba Reviewed-by: Michal Swiatkowski Reviewed-by: Ahmed Zaki Reviewed-by: Jesse Brandeburg Co-developed-by: Ranganatha Rao Signed-off-by: Ranganatha Rao Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/iavf/iavf_main.c | 72 +++++++++-------------------- 1 file changed, 21 insertions(+), 51 deletions(-) commit 09d23b8918f9ab0f8114f6b94f2faf8bde3fb52a Author: Piotr Gardocki Date: Tue Nov 21 22:47:16 2023 -0500 iavf: Handle ntuple on/off based on new state machines for flow director ntuple-filter feature on/off: Default is on. If turned off, the filters will be removed from both PF and iavf list. The removal is irrespective of current filter state. Steps to reproduce: ------------------- 1. Ensure ntuple is on. ethtool -K enp8s0 ntuple-filters on 2. Create a filter to receive the traffic into non-default rx-queue like 15 and ensure traffic is flowing into queue into 15. Now, turn off ntuple. Traffic should not flow to configured queue 15. It should flow to default RX queue. Fixes: 0dbfbabb840d ("iavf: Add framework to enable ethtool ntuple filters") Signed-off-by: Piotr Gardocki Reviewed-by: Larysa Zaremba Signed-off-by: Ranganatha Rao Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/iavf/iavf_main.c | 59 +++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) commit 3a0b5a2929fdeda63fc921c2dbed237059acf732 Author: Piotr Gardocki Date: Tue Nov 21 22:47:15 2023 -0500 iavf: Introduce new state machines for flow director New states introduced: IAVF_FDIR_FLTR_DIS_REQUEST IAVF_FDIR_FLTR_DIS_PENDING IAVF_FDIR_FLTR_INACTIVE Current FDIR state machines (SM) are not adequate to handle a few scenarios in the link DOWN/UP event, reset event and ntuple-feature. For example, when VF link goes DOWN and comes back UP administratively, the expectation is that previously installed filters should also be restored. But with current SM, filters are not restored. So with new SM, during link DOWN filters are marked as INACTIVE in the iavf list but removed from PF. After link UP, SM will transition from INACTIVE to ADD_REQUEST to restore the filter. Similarly, with VF reset, filters will be removed from the PF, but marked as INACTIVE in the iavf list. Filters will be restored after reset completion. Steps to reproduce: ------------------- 1. Create a VF. Here VF is enp8s0. 2. Assign IP addresses to VF and link partner and ping continuously from remote. Here remote IP is 1.1.1.1. 3. Check default RX Queue of traffic. ethtool -S enp8s0 | grep -E "rx-[[:digit:]]+\.packets" 4. Add filter - change default RX Queue (to 15 here) ethtool -U ens8s0 flow-type ip4 src-ip 1.1.1.1 action 15 loc 5 5. Ensure filter gets added and traffic is received on RX queue 15 now. Link event testing: ------------------- 6. Bring VF link down and up. If traffic flows to configured queue 15, test is success, otherwise it is a failure. Reset event testing: -------------------- 7. Reset the VF. If traffic flows to configured queue 15, test is success, otherwise it is a failure. Fixes: 0dbfbabb840d ("iavf: Add framework to enable ethtool ntuple filters") Signed-off-by: Piotr Gardocki Reviewed-by: Larysa Zaremba Signed-off-by: Ranganatha Rao Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/iavf/iavf.h | 1 + drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 27 ++++++---- drivers/net/ethernet/intel/iavf/iavf_fdir.h | 15 +++++- drivers/net/ethernet/intel/iavf/iavf_main.c | 48 +++++++++++++---- drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 71 +++++++++++++++++++++++-- 5 files changed, 139 insertions(+), 23 deletions(-) commit eaadbbaaff74ac9a7f84f412fbaac221a04896c1 Merge: 8b8cd4beea4f 3f29f1c336c0 Author: Linus Torvalds Date: Tue Dec 12 11:06:41 2023 -0800 Merge tag 'fuse-fixes-6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse fixes from Miklos Szeredi: - Fix a couple of potential crashes, one introduced in 6.6 and one in 5.10 - Fix misbehavior of virtiofs submounts on memory pressure - Clarify naming in the uAPI for a recent feature * tag 'fuse-fixes-6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: disable FOPEN_PARALLEL_DIRECT_WRITES with FUSE_DIRECT_IO_ALLOW_MMAP fuse: dax: set fc->dax to NULL in fuse_dax_conn_free() fuse: share lookup state between submount and its parent docs/fuse-io: Document the usage of DIRECT_IO_ALLOW_MMAP fuse: Rename DIRECT_IO_RELAX to DIRECT_IO_ALLOW_MMAP commit 8b8cd4beea4f6c68092736c544a797dcd5e094c5 Merge: 26aff849438c 137366544811 Author: Linus Torvalds Date: Tue Dec 12 10:30:10 2023 -0800 Merge tag '6.7-rc5-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Memory leak fix (in lock error path) - Two fixes for create with allocation size - FIx for potential UAF in lease break error path - Five directory lease (caching) fixes found during additional recent testing * tag '6.7-rc5-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE ksmbd: fix wrong allocation size update in smb2_open() ksmbd: avoid duplicate opinfo_put() call on error of smb21_lease_break_ack() ksmbd: lazy v2 lease break on smb2_write() ksmbd: send v2 lease break notification for directory ksmbd: downgrade RWH lease caching state to RH for directory ksmbd: set v2 lease capability ksmbd: set epoch in create context v2 lease ksmbd: fix memory leak in smb2_lock() commit e7ab758741672acb21c5d841a9f0309d30e48a06 Author: Mario Limonciello Date: Mon Jun 19 15:04:24 2023 -0500 drm/amd/display: Disable PSR-SU on Parade 0803 TCON again When screen brightness is rapidly changed and PSR-SU is enabled the display hangs on panels with this TCON even on the latest DCN 3.1.4 microcode (0x8002a81 at this time). This was disabled previously as commit 072030b17830 ("drm/amd: Disable PSR-SU on Parade 0803 TCON") but reverted as commit 1e66a17ce546 ("Revert "drm/amd: Disable PSR-SU on Parade 0803 TCON"") in favor of testing for a new enough microcode (commit cd2e31a9ab93 ("drm/amd/display: Set minimum requirement for using PSR-SU on Phoenix")). As hangs are still happening specifically with this TCON, disable PSR-SU again for it until it can be root caused. Cc: stable@vger.kernel.org Cc: aaron.ma@canonical.com Cc: binli@gnome.org Cc: Marc Rossi Cc: Hamza Mahfooz Signed-off-by: Mario Limonciello Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2046131 Acked-by: Alex Deucher Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/modules/power/power_helpers.c | 2 ++ 1 file changed, 2 insertions(+) commit fb01ab528df324a140058a11e9b25e5efdf9671d Author: Fangzhi Zuo Date: Wed Dec 6 14:52:28 2023 -0500 drm/amd/display: Populate dtbclk from bounding box dtbclk is unavaliable from pmfw. Try to grab the value from bounding box Reviewed-by: Charlene Liu Acked-by: Aurabindo Pillai Signed-off-by: Fangzhi Zuo Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c | 14 +++++++++----- .../gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c | 5 +++-- 2 files changed, 12 insertions(+), 7 deletions(-) commit a409c053b0b0cc0fc1af684d0b23bd5ca010c4cb Author: Taimur Hassan Date: Wed Dec 6 14:52:25 2023 -0500 drm/amd/display: Revert "Fix conversions between bytes and KB" [Why & How] HostVMMinPageSize is expected to be in KB according to spec, the checks later down the line reflect this as well. Reviewed-by: Nicholas Kazlauskas Acked-by: Aurabindo Pillai Signed-off-by: Taimur Hassan Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 19544aa5f5ece80b12315fa68e51fb2ba6f01fa4 Author: Saleemkhan Jamadar Date: Tue Nov 28 17:02:06 2023 +0530 drm/amdgpu/jpeg: configure doorbell for each playback Doorbell is configured during start of each playback. v1 - add comment for the doorbell programming change Signed-off-by: Saleemkhan Jamadar Acked-by: Leo Liu Reviewed-by: Veerabadhran Gopalakrishnan Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) commit 0c12e6c8267f831e491ee64ac6f216601cea3eee Author: Oliver Upton Date: Tue Dec 12 07:04:32 2023 +0000 KVM: selftests: Ensure sysreg-defs.h is generated at the expected path Building the KVM selftests from the main selftests Makefile (as opposed to the kvm subdirectory) doesn't work as OUTPUT is set, forcing the generated header to spill into the selftests directory. Additionally, relative paths do not work when building outside of the srctree, as the canonical selftests path is replaced with 'kselftest' in the output. Work around both of these issues by explicitly overriding OUTPUT on the submake cmdline. Move the whole fragment below the point lib.mk gets included such that $(abs_objdir) is available. Reviewed-by: Cornelia Huck Tested-by: Mark Brown Link: https://lore.kernel.org/r/20231212070431.145544-2-oliver.upton@linux.dev Signed-off-by: Oliver Upton tools/testing/selftests/kvm/Makefile | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) commit 3c0696076aad60a2f04c019761921954579e1b0e Author: James Houghton Date: Mon Dec 4 17:26:46 2023 +0000 arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify It is currently possible for a userspace application to enter an infinite page fault loop when using HugeTLB pages implemented with contiguous PTEs when HAFDBS is not available. This happens because: 1. The kernel may sometimes write PTEs that are sw-dirty but hw-clean (PTE_DIRTY | PTE_RDONLY | PTE_WRITE). 2. If, during a write, the CPU uses a sw-dirty, hw-clean PTE in handling the memory access on a system without HAFDBS, we will get a page fault. 3. HugeTLB will check if it needs to update the dirty bits on the PTE. For contiguous PTEs, it will check to see if the pgprot bits need updating. In this case, HugeTLB wants to write a sequence of sw-dirty, hw-dirty PTEs, but it finds that all the PTEs it is about to overwrite are all pte_dirty() (pte_sw_dirty() => pte_dirty()), so it thinks no update is necessary. We can get the kernel to write a sw-dirty, hw-clean PTE with the following steps (showing the relevant VMA flags and pgprot bits): i. Create a valid, writable contiguous PTE. VMA vmflags: VM_SHARED | VM_READ | VM_WRITE VMA pgprot bits: PTE_RDONLY | PTE_WRITE PTE pgprot bits: PTE_DIRTY | PTE_WRITE ii. mprotect the VMA to PROT_NONE. VMA vmflags: VM_SHARED VMA pgprot bits: PTE_RDONLY PTE pgprot bits: PTE_DIRTY | PTE_RDONLY iii. mprotect the VMA back to PROT_READ | PROT_WRITE. VMA vmflags: VM_SHARED | VM_READ | VM_WRITE VMA pgprot bits: PTE_RDONLY | PTE_WRITE PTE pgprot bits: PTE_DIRTY | PTE_WRITE | PTE_RDONLY Make it impossible to create a writeable sw-dirty, hw-clean PTE with pte_modify(). Such a PTE should be impossible to create, and there may be places that assume that pte_dirty() implies pte_hw_dirty(). Signed-off-by: James Houghton Fixes: 031e6e6b4e12 ("arm64: hugetlb: Avoid unnecessary clearing in huge_ptep_set_access_flags") Cc: Acked-by: Will Deacon Reviewed-by: Ryan Roberts Link: https://lore.kernel.org/r/20231204172646.2541916-3-jthoughton@google.com Signed-off-by: Catalin Marinas arch/arm64/include/asm/pgtable.h | 6 ++++++ 1 file changed, 6 insertions(+) commit 6c02757c936063f0631b4e43fe156f8c8f1f351f Author: Ye Bin Date: Mon Dec 11 19:25:44 2023 +0800 jbd2: fix soft lockup in journal_finish_inode_data_buffers() There's issue when do io test: WARN: soft lockup - CPU#45 stuck for 11s! [jbd2/dm-2-8:4170] CPU: 45 PID: 4170 Comm: jbd2/dm-2-8 Kdump: loaded Tainted: G OE Call trace: dump_backtrace+0x0/0x1a0 show_stack+0x24/0x30 dump_stack+0xb0/0x100 watchdog_timer_fn+0x254/0x3f8 __hrtimer_run_queues+0x11c/0x380 hrtimer_interrupt+0xfc/0x2f8 arch_timer_handler_phys+0x38/0x58 handle_percpu_devid_irq+0x90/0x248 generic_handle_irq+0x3c/0x58 __handle_domain_irq+0x68/0xc0 gic_handle_irq+0x90/0x320 el1_irq+0xcc/0x180 queued_spin_lock_slowpath+0x1d8/0x320 jbd2_journal_commit_transaction+0x10f4/0x1c78 [jbd2] kjournald2+0xec/0x2f0 [jbd2] kthread+0x134/0x138 ret_from_fork+0x10/0x18 Analyzed informations from vmcore as follows: (1) There are about 5k+ jbd2_inode in 'commit_transaction->t_inode_list'; (2) Now is processing the 855th jbd2_inode; (3) JBD2 task has TIF_NEED_RESCHED flag; (4) There's no pags in address_space around the 855th jbd2_inode; (5) There are some process is doing drop caches; (6) Mounted with 'nodioread_nolock' option; (7) 128 CPUs; According to informations from vmcore we know 'journal->j_list_lock' spin lock competition is fierce. So journal_finish_inode_data_buffers() maybe process slowly. Theoretically, there is scheduling point in the filemap_fdatawait_range_keep_errors(). However, if inode's address_space has no pages which taged with PAGECACHE_TAG_WRITEBACK, will not call cond_resched(). So may lead to soft lockup. journal_finish_inode_data_buffers filemap_fdatawait_range_keep_errors __filemap_fdatawait_range while (index <= end) nr_pages = pagevec_lookup_range_tag(&pvec, mapping, &index, end, PAGECACHE_TAG_WRITEBACK); if (!nr_pages) break; --> If 'nr_pages' is equal zero will break, then will not call cond_resched() for (i = 0; i < nr_pages; i++) wait_on_page_writeback(page); cond_resched(); To solve above issue, add scheduling point in the journal_finish_inode_data_buffers(); Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20231211112544.3879780-1-yebin10@huawei.com Signed-off-by: Theodore Ts'o fs/jbd2/commit.c | 1 + 1 file changed, 1 insertion(+) commit cd607f2cbbbec90682b2f6d6b85e1525d0f43b19 Author: Felix Fietkau Date: Fri Dec 8 08:50:04 2023 +0100 wifi: mt76: fix crash with WED rx support enabled If WED rx is enabled, rx buffers are added to a buffer pool that can be filled from multiple page pools. Because buffers freed from rx poll are not guaranteed to belong to the processed queue's page pool, lockless caching must not be used in this case. Cc: stable@vger.kernel.org Fixes: 2f5c3c77fc9b ("wifi: mt76: switch to page_pool allocator") Signed-off-by: Felix Fietkau Acked-by: Lorenzo Bianconi Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20231208075004.69843-1-nbd@nbd.name drivers/net/wireless/mediatek/mt76/dma.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit df83a0df820b9b705e51b9499691b0dafb2f4dcb Author: Yan Jun Date: Sun Dec 3 19:50:58 2023 +0800 HID: apple: Add "hfd.cn" and "WKB603" to the list of non-apple keyboards JingZao(京造) WKB603 keyboard is a rebranded product of Jamesdonkey RS2 keyboard, identified as "hfd.cn WKB603" in wired mode, "WKB603" in bluetooth mode. Adding them to the list of non-apple keyboards fixes function key. Signed-off-by: Yan Jun Signed-off-by: Jiri Kosina drivers/hid/hid-apple.c | 2 ++ 1 file changed, 2 insertions(+) commit 43527a0094c10dfbf0d5a2e7979395a38de3ff65 Author: Mikhail Khvainitski Date: Tue Dec 12 15:31:48 2023 +0200 HID: lenovo: Restrict detection of patched firmware only to USB cptkbd Commit 46a0a2c96f0f ("HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround") introduced a regression for ThinkPad TrackPoint Keyboard II which has similar quirks to cptkbd (so it uses the same workarounds) but slightly different so that there are false-positives during detecting well-behaving firmware. This commit restricts detecting well-behaving firmware to the only model which known to have one and have stable enough quirks to not cause false-positives. Fixes: 46a0a2c96f0f ("HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround") Link: https://lore.kernel.org/linux-input/ZXRiiPsBKNasioqH@jekhomev/ Link: https://bbs.archlinux.org/viewtopic.php?pid=2135468#p2135468 Signed-off-by: Mikhail Khvainitski Tested-by: Yauhen Kharuzhy Signed-off-by: Jiri Kosina drivers/hid/hid-lenovo.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 810c38a369a0a0ce625b5c12169abce1dd9ccd53 Author: Hyunwoo Kim Date: Sat Dec 9 05:05:38 2023 -0500 net/rose: Fix Use-After-Free in rose_ioctl Because rose_ioctl() accesses sk->sk_receive_queue without holding a sk->sk_receive_queue.lock, it can cause a race with rose_accept(). A use-after-free for skb occurs with the following flow. ``` rose_ioctl() -> skb_peek() rose_accept() -> skb_dequeue() -> kfree_skb() ``` Add sk->sk_receive_queue.lock to rose_ioctl() to fix this issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Hyunwoo Kim Link: https://lore.kernel.org/r/20231209100538.GA407321@v4bel-B760M-AORUS-ELITE-AX Signed-off-by: Paolo Abeni net/rose/af_rose.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 24e90b9e34f9e039f56b5f25f6e6eb92cdd8f4b3 Author: Hyunwoo Kim Date: Sat Dec 9 04:42:10 2023 -0500 atm: Fix Use-After-Free in do_vcc_ioctl Because do_vcc_ioctl() accesses sk->sk_receive_queue without holding a sk->sk_receive_queue.lock, it can cause a race with vcc_recvmsg(). A use-after-free for skb occurs with the following flow. ``` do_vcc_ioctl() -> skb_peek() vcc_recvmsg() -> skb_recv_datagram() -> skb_free_datagram() ``` Add sk->sk_receive_queue.lock to do_vcc_ioctl() to fix this issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Hyunwoo Kim Link: https://lore.kernel.org/r/20231209094210.GA403126@v4bel-B760M-AORUS-ELITE-AX Signed-off-by: Paolo Abeni net/atm/ioctl.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 1892fe103c3a20fced306c8dafa74f7f6d4ea0a3 Author: Robin Murphy Date: Mon Dec 11 19:27:28 2023 +0000 perf/arm-cmn: Fail DTC counter allocation correctly Calling arm_cmn_event_clear() before all DTC indices are allocated is wrong, and can lead to arm_cmn_event_add() erroneously clearing live counters from full DTCs where allocation fails. Since the DTC counters are only updated by arm_cmn_init_counter() after all DTC and DTM allocations succeed, nothing actually needs cleaning up in this case anyway, and it should just return directly as it did before. Fixes: 7633ec2c262f ("perf/arm-cmn: Rework DTC counters (again)") Signed-off-by: Robin Murphy Reviewed-by: Ilkka Koskinen Acked-by: Will Deacon Link: https://lore.kernel.org/r/ed589c0d8e4130dc68b8ad1625226d28bdc185d4.1702322847.git.robin.murphy@arm.com Signed-off-by: Catalin Marinas drivers/perf/arm-cmn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit da48708e873312aeba42481f12e2982f8a8ffb80 Merge: a39b6ac3781d f0b94c1c5c79 Author: Greg Kroah-Hartman Date: Tue Dec 12 11:34:07 2023 +0100 Merge tag 'thunderbolt-for-v6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: thunderbolt: Fixes for v6.7-rc6 This includes following USB4/Thunderbolt fixes for v6.7-rc6: - Fix memory leak in margining_port_remove() - Correct minimum bandwidth allocated for USB 3.x and PCIe to avoid reducing DisplayPort capabilities in certain monitor configurations. Both have been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Fix minimum allocated USB 3.x and PCIe bandwidth thunderbolt: Fix memory leak in margining_port_remove() commit ce038edfce43fb345f8dfdca0f7b17f535896701 Author: Avraham Stern Date: Thu Dec 7 04:50:17 2023 +0200 wifi: iwlwifi: pcie: avoid a NULL pointer dereference It possible that while the rx rb is being handled, the transport has been stopped and re-started. In this case the tx queue pointer is not yet initialized, which will lead to a NULL pointer dereference. Fix it. Signed-off-by: Avraham Stern Signed-off-by: Miri Korenblit Link: https://msgid.link/20231207044813.cd0898cafd89.I0b84daae753ba9612092bf383f5c6f761446e964@changeid Signed-off-by: Johannes Berg drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8c386b166e2517cf3a123018e77941ec22625d0f Author: Johannes Berg Date: Mon Dec 11 09:05:31 2023 +0200 wifi: mac80211: mesh_plink: fix matches_local logic During refactoring the "else" here got lost, add it back. Fixes: c99a89edb106 ("mac80211: factor out plink event gathering") Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://msgid.link/20231211085121.795480fa0e0b.I017d501196a5bbdcd9afd33338d342d6fe1edd79@changeid Signed-off-by: Johannes Berg net/mac80211/mesh_plink.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 1fc4a3eec50d726f4663ad3c0bb0158354d6647a Author: Johannes Berg Date: Mon Dec 11 09:05:32 2023 +0200 wifi: mac80211: mesh: check element parsing succeeded ieee802_11_parse_elems() can return NULL, so we must check for the return value. Fixes: 5d24828d05f3 ("mac80211: always allocate struct ieee802_11_elems") Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://msgid.link/20231211085121.93dea364f3d3.Ie87781c6c48979fb25a744b90af4a33dc2d83a28@changeid Signed-off-by: Johannes Berg net/mac80211/mesh_plink.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 98849ba2aa9db46e62720fb686a9d63ed9887806 Author: Johannes Berg Date: Mon Dec 11 09:05:30 2023 +0200 wifi: mac80211: check defragmentation succeeded We need to check that cfg80211_defragment_element() didn't return an error, since it can fail due to bad input, and we didn't catch that before. Fixes: 8eb8dd2ffbbb ("wifi: mac80211: Support link removal using Reconfiguration ML element") Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://msgid.link/20231211085121.8595a6b67fc0.I1225edd8f98355e007f96502e358e476c7971d8c@changeid Signed-off-by: Johannes Berg net/mac80211/mlme.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 63bafd9d5421959b2124dd940ed8d7462d99f449 Author: Johannes Berg Date: Mon Dec 11 09:05:19 2023 +0200 wifi: mac80211: don't re-add debugfs during reconfig If we're doing reconfig, then we cannot add the debugfs files that are already there from before the reconfig. Skip that in drv_change_sta_links() during reconfig. Fixes: d2caad527c19 ("wifi: mac80211: add API to show the link STAs in debugfs") Signed-off-by: Johannes Berg Reviewed-by: Gregory Greenman Reviewed-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://msgid.link/20231211085121.88a950f43e16.Id71181780994649219685887c0fcad33d387cc78@changeid Signed-off-by: Johannes Berg net/mac80211/driver-ops.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 23484d817082c3005252d8edfc8292c8a1006b5b Author: Rouven Czerwinski Date: Thu Dec 7 08:58:36 2023 +0100 net: rfkill: gpio: set GPIO direction Fix the undefined usage of the GPIO consumer API after retrieving the GPIO description with GPIO_ASIS. The API documentation mentions that GPIO_ASIS won't set a GPIO direction and requires the user to set a direction before using the GPIO. This can be confirmed on i.MX6 hardware, where rfkill-gpio is no longer able to enabled/disable a device, presumably because the GPIO controller was never configured for the output direction. Fixes: b2f750c3a80b ("net: rfkill: gpio: prevent value glitch during probe") Cc: stable@vger.kernel.org Signed-off-by: Rouven Czerwinski Link: https://msgid.link/20231207075835.3091694-1-r.czerwinski@pengutronix.de Signed-off-by: Johannes Berg net/rfkill/rfkill-gpio.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit c1393c132b906fbdf91f6d1c9eb2ef7a00cce64e Author: Edward Adam Davis Date: Wed Nov 29 20:17:47 2023 +0800 wifi: mac80211: check if the existing link config remains unchanged [Syz report] WARNING: CPU: 1 PID: 5067 at net/mac80211/rate.c:48 rate_control_rate_init+0x540/0x690 net/mac80211/rate.c:48 Modules linked in: CPU: 1 PID: 5067 Comm: syz-executor413 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:rate_control_rate_init+0x540/0x690 net/mac80211/rate.c:48 Code: 48 c7 c2 00 46 0c 8c be 08 03 00 00 48 c7 c7 c0 45 0c 8c c6 05 70 79 0b 05 01 e8 1b a0 6f f7 e9 e0 fd ff ff e8 61 b3 8f f7 90 <0f> 0b 90 e9 36 ff ff ff e8 53 b3 8f f7 e8 5e 0b 78 f7 31 ff 89 c3 RSP: 0018:ffffc90003c57248 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff888016bc4000 RCX: ffffffff89f7d519 RDX: ffff888076d43b80 RSI: ffffffff89f7d6df RDI: 0000000000000005 RBP: ffff88801daaae20 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000002 R12: 0000000000000001 R13: 0000000000000000 R14: ffff888020030e20 R15: ffff888078f08000 FS: 0000555556b94380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000005fdeb8 CR3: 0000000076d22000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: sta_apply_auth_flags.constprop.0+0x4b7/0x510 net/mac80211/cfg.c:1674 sta_apply_parameters+0xaf1/0x16c0 net/mac80211/cfg.c:2002 ieee80211_add_station+0x3fa/0x6c0 net/mac80211/cfg.c:2068 rdev_add_station net/wireless/rdev-ops.h:201 [inline] nl80211_new_station+0x13ba/0x1a70 net/wireless/nl80211.c:7603 genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972 genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline] genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b [Analysis] It is inappropriate to make a link configuration change judgment on an non-existent and non new link. [Fix] Quickly exit when there is a existent link and the link configuration has not changed. Fixes: b303835dabe0 ("wifi: mac80211: accept STA changes without link changes") Reported-and-tested-by: syzbot+62d7eef57b09bfebcd84@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Link: https://msgid.link/tencent_DE67FF86DB92ED465489A36ECD2EDDCC8C06@qq.com Signed-off-by: Johannes Berg net/mac80211/cfg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit fb768d3b13ffa325b7e84480d488ac799c9d2cd7 Author: Chen-Yu Tsai Date: Thu Dec 7 21:20:50 2023 +0800 wifi: cfg80211: Add my certificate As announced [1][2], I have taken over maintainership of the wireless-regdb project. Add my certificate so that newer releases are valid to the kernel. Seth's certificate should be kept around for awhile, at least until a few new releases by me happen. This should also be applied to stable trees so that stable kernels can utilize newly released database binaries. [1] https://lore.kernel.org/linux-wireless/CAGb2v657baNMPKU3QADijx7hZa=GUcSv2LEDdn6N=QQaFX8r-g@mail.gmail.com/ [2] https://lore.kernel.org/linux-wireless/ZWmRR5ul7EDfxCan@wens.tw/ Cc: stable@vger.kernel.org Signed-off-by: Chen-Yu Tsai Acked-by: Seth Forshee Link: https://msgid.link/ZXHGsqs34qZyzZng@wens.tw Signed-off-by: Johannes Berg net/wireless/certs/wens.hex | 87 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 87 insertions(+) commit a4754182dc936b97ec7e9f6b08cdf7ed97ef9069 Author: Johannes Berg Date: Fri Dec 8 18:32:02 2023 +0200 wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock Evidently I had only looked at all the ones in rx.c, and missed this. Add bh-disable to this use of the rxq->lock as well. Fixes: 25edc8f259c7 ("iwlwifi: pcie: properly implement NAPI") Reported-by: Brian Norris Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://msgid.link/20231208183100.e79ad3dae649.I8f19713c4383707f8be7fc20ff5cc1ecf12429bb@changeid Signed-off-by: Johannes Berg drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 76101fa0c0a9519010c6afe488574ec38aa4ba8d Merge: e1b2fa6185ba 408d4b33c244 Author: Greg Kroah-Hartman Date: Tue Dec 12 09:43:01 2023 +0100 Merge tag 'iio-fixes-for-6.7a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus Jonathan writes: First set of IIO fixes for the 6.7 cycle. Usual mixed bunch of driver bugs. The core bug probably isn't hit with upstream drivers, but good to get fix in place anyway. iio-core - Fix potential freeing of wrong iio buffer when multiple buffers used. adi,adis16475 - Add missing spi_device_id table need for module auto-loading - Fix untended BIT(BIT()) due to wrong macro definitions. amlogic,meson - Add a chip specific config for AXG soc familly which needs a vref_select to work. freescale,mp6050 - Fix eating of error code on failure to read from sensor. kionixq,kx022a - Fix scaling to comply with ABI (m/s^2 rather than micro m/s^2) measspec,ms_sensors - Fix wrong conversion times due to strange value mapping. microchip,mcp3564 - Fix previously impossible to fail check on limits. - Fix identification logic. nxp,imx93 - Add missing channels for i.mx95. ti,am335x - Fix handling of error for tiadc_request_dma(). ti,tmag5273 - Fix incorrect temperature offset. * tag 'iio-fixes-for-6.7a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: adc: MCP3564: fix hardware identification logic iio: adc: MCP3564: fix calib_bias and calib_scale range checks iio: adc: meson: add separate config for axg SoC family iio: adc: imx93: add four channels for imx93 adc iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma() iio: triggered-buffer: prevent possible freeing of wrong buffer iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw iio: imu: adis16475: use bit numbers in assign_bit() iio: imu: adis16475: add spi_device_id table iio: tmag5273: fix temperature offset iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table iio: kx022a: Fix acceleration value scaling commit e1b2fa6185babdff58953ee0b65f569255bd0897 Merge: a39b6ac3781d 9085b23b668a Author: Greg Kroah-Hartman Date: Tue Dec 12 09:42:11 2023 +0100 Merge tag 'icc-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-linus Georgi writes: interconnect fixes for v6.7-rc This contains fixes for reported issues. One fix is in framework code to explicitly treat returned NULL nodes as error when the device-tree data is translated into endpoint nodes. The other two fixes are in driver code. One is expected to improve the power consumption on the sm8250 platforms and the other one is fixing a bandwidth calculation formula that was introduced during this cycle. - interconnect: Treat xlate() returning NULL node as an error - interconnect: qcom: sm8250: Enable sync_state - interconnect: qcom: icc-rpm: Fix peak rate calculation Signed-off-by: Georgi Djakov * tag 'icc-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc: interconnect: qcom: icc-rpm: Fix peak rate calculation interconnect: qcom: sm8250: Enable sync_state interconnect: Treat xlate() returning NULL node as an error commit 98fb9b9680c9f3895ced02d6a73e27f5d7b5892b Author: Johannes Berg Date: Wed Dec 6 22:37:57 2023 +0100 wifi: ieee80211: don't require protected vendor action frames For vendor action frames, whether a protected one should be used or not is clearly up to the individual vendor and frame, so even though a protected dual is defined, it may not get used. Thus, don't require protection for vendor action frames when they're used in a connection. Since we obviously don't process frames unknown to the kernel in the kernel, it may makes sense to invert this list to have all the ones the kernel processes and knows to be requiring protection, but that'd be a different change. Fixes: 91535613b609 ("wifi: mac80211: don't drop all unprotected public action frames") Reported-by: Jouni Malinen Link: https://msgid.link/20231206223801.f6a2cf4e67ec.Ifa6acc774bd67801d3dafb405278f297683187aa@changeid Signed-off-by: Johannes Berg include/linux/ieee80211.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit b1a39a718db44ecb18c2a99a11e15f6eedc14c53 Author: Marc Zyngier Date: Thu Dec 7 15:12:01 2023 +0000 KVM: Convert comment into an assertion in kvm_io_bus_register_dev() Instead of having a comment indicating the need to hold slots_lock when calling kvm_io_bus_register_dev(), make it explicit with a lockdep assertion. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20231207151201.3028710-6-maz@kernel.org Signed-off-by: Oliver Upton virt/kvm/kvm_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 6bef365e310a5cd4b6e95fbb80b44725fce97e37 Author: Marc Zyngier Date: Thu Dec 7 15:12:00 2023 +0000 KVM: arm64: vgic: Ensure that slots_lock is held in vgic_register_all_redist_iodevs() Although we implicitly depend on slots_lock being held when registering IO devices with the IO bus infrastructure, we don't enforce this requirement. Make it explicit. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20231207151201.3028710-5-maz@kernel.org Signed-off-by: Oliver Upton arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 ++ 1 file changed, 2 insertions(+) commit 02e3858f08faabab9503ae2911cf7c7e27702257 Author: Marc Zyngier Date: Thu Dec 7 15:11:59 2023 +0000 KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy When failing to create a vcpu because (for example) it has a duplicate vcpu_id, we destroy the vcpu. Amusingly, this leaves the redistributor registered with the KVM_MMIO bus. This is no good, and we should properly clean the mess. Force a teardown of the vgic vcpu interface, including the RD device before returning to the caller. Cc: stable@vger.kernel.org Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20231207151201.3028710-4-maz@kernel.org Signed-off-by: Oliver Upton arch/arm64/kvm/arm.c | 2 +- arch/arm64/kvm/vgic/vgic-init.c | 5 ++++- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/arm64/kvm/vgic/vgic.h | 1 + 4 files changed, 7 insertions(+), 3 deletions(-) commit d26b9cb33c2d1ba68d1f26bb06c40300f16a3799 Author: Marc Zyngier Date: Thu Dec 7 15:11:58 2023 +0000 KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy() As we are going to need to call into kvm_vgic_vcpu_destroy() without prior holding of the slots_lock, introduce __kvm_vgic_vcpu_destroy() as a non-locking primitive of kvm_vgic_vcpu_destroy(). Cc: stable@vger.kernel.org Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20231207151201.3028710-3-maz@kernel.org Signed-off-by: Oliver Upton arch/arm64/kvm/vgic/vgic-init.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit 01ad29d224ff73bc4e16e0ef9ece17f28598c4a4 Author: Marc Zyngier Date: Thu Dec 7 15:11:57 2023 +0000 KVM: arm64: vgic: Simplify kvm_vgic_destroy() When destroying a vgic, we have rather cumbersome rules about when slots_lock and config_lock are held, resulting in fun buglets. The first port of call is to simplify kvm_vgic_map_resources() so that there is only one call to kvm_vgic_destroy() instead of two, with the second only holding half of the locks. For that, we kill the non-locking primitive and move the call outside of the locking altogether. This doesn't change anything (we re-acquire the locks and teardown the whole vgic), and simplifies the code significantly. Cc: stable@vger.kernel.org Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20231207151201.3028710-2-maz@kernel.org Signed-off-by: Oliver Upton arch/arm64/kvm/vgic/vgic-init.c | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) commit bedd6fe4d357f3cffb392f2153b52ef71f810259 Author: Kent Overstreet Date: Mon Dec 11 18:40:17 2023 -0500 bcachefs: Fix nocow locks deadlock On trylock failure we were waiting for outstanding reads to complete - but nocow locks need to be held until the whole move is finished. Signed-off-by: Kent Overstreet fs/bcachefs/data_update.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 26aff849438cebcd05f1a647390c4aa700d5c0f1 Merge: 52bf9f6c09fc a66ff26b0f31 Author: Linus Torvalds Date: Mon Dec 11 16:13:51 2023 -0800 Merge tag 'bcachefs-2023-12-10' of https://evilpiepirate.org/git/bcachefs Pull more bcachefs bugfixes from Kent Overstreet: - Fix a rare emergency shutdown path bug: dropping journal pins after the filesystem has mostly been torn down is not what we want. - Fix some concurrency issues with the btree write buffer and journal replay by not using the btree write buffer until journal replay is finished - A fixup from the prior patch to kill journal pre-reservations: at the start of the btree update path, where previously we took a pre-reservation, we do at least want to check the journal watermark. - Fix a race between dropping device metadata and btree node writes, which would re-add a pointer to a device that had just been dropped - Fix one of the SCRU lock warnings, in bch2_compression_stats_to_text(). - Partial fix for a rare transaction paths overflow, when indirect extents had been split by background tasks, by not running certain triggers when they're not needed. - Fix for creating a snapshot with implicit source in a subdirectory of the containing subvolume - Don't unfreeze when we're emergency read-only - Fix for rebalance spinning trying to compress unwritten extentns - Another deleted_inodes fix, for directories - Fix a rare deadlock (usually just an unecessary wait) when flushing the journal with an open journal entry. * tag 'bcachefs-2023-12-10' of https://evilpiepirate.org/git/bcachefs: bcachefs: Close journal entry if necessary when flushing all pins bcachefs: Fix uninitialized var in bch2_journal_replay() bcachefs: Fix deleted inode check for dirs bcachefs: rebalance shouldn't attempt to compress unwritten extents bcachefs: don't attempt rw on unfreeze when shutdown bcachefs: Fix creating snapshot with implict source bcachefs: Don't run indirect extent trigger unless inserting/deleting bcachefs: Convert compression_stats to for_each_btree_key2 bcachefs: Fix bch2_extent_drop_ptrs() call bcachefs: Fix a journal deadlock in replay bcachefs; Don't use btree write buffer until journal replay is finished bcachefs: Don't drop journal pins in exit path commit 52bf9f6c09fca8c74388cd41cc24e5d1bff812a9 Author: David Howells Date: Mon Dec 11 21:43:52 2023 +0000 afs: Fix refcount underflow from error handling race If an AFS cell that has an unreachable (eg. ENETUNREACH) server listed (VL server or fileserver), an asynchronous probe to one of its addresses may fail immediately because sendmsg() returns an error. When this happens, a refcount underflow can happen if certain events hit a very small window. The way this occurs is: (1) There are two levels of "call" object, the afs_call and the rxrpc_call. Each of them can be transitioned to a "completed" state in the event of success or failure. (2) Asynchronous afs_calls are self-referential whilst they are active to prevent them from evaporating when they're not being processed. This reference is disposed of when the afs_call is completed. Note that an afs_call may only be completed once; once completed completing it again will do nothing. (3) When a call transmission is made, the app-side rxrpc code queues a Tx buffer for the rxrpc I/O thread to transmit. The I/O thread invokes sendmsg() to transmit it - and in the case of failure, it transitions the rxrpc_call to the completed state. (4) When an rxrpc_call is completed, the app layer is notified. In this case, the app is kafs and it schedules a work item to process events pertaining to an afs_call. (5) When the afs_call event processor is run, it goes down through the RPC-specific handler to afs_extract_data() to retrieve data from rxrpc - and, in this case, it picks up the error from the rxrpc_call and returns it. The error is then propagated to the afs_call and that is completed too. At this point the self-reference is released. (6) If the rxrpc I/O thread manages to complete the rxrpc_call within the window between rxrpc_send_data() queuing the request packet and checking for call completion on the way out, then rxrpc_kernel_send_data() will return the error from sendmsg() to the app. (7) Then afs_make_call() will see an error and will jump to the error handling path which will attempt to clean up the afs_call. (8) The problem comes when the error handling path in afs_make_call() tries to unconditionally drop an async afs_call's self-reference. This self-reference, however, may already have been dropped by afs_extract_data() completing the afs_call (9) The refcount underflows when we return to afs_do_probe_vlserver() and that tries to drop its reference on the afs_call. Fix this by making afs_make_call() attempt to complete the afs_call rather than unconditionally putting it. That way, if afs_extract_data() manages to complete the call first, afs_make_call() won't do anything. The bug can be forced by making do_udp_sendmsg() return -ENETUNREACH and sticking an msleep() in rxrpc_send_data() after the 'success:' label to widen the race window. The error message looks something like: refcount_t: underflow; use-after-free. WARNING: CPU: 3 PID: 720 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 ... RIP: 0010:refcount_warn_saturate+0xba/0x110 ... afs_put_call+0x1dc/0x1f0 [kafs] afs_fs_get_capabilities+0x8b/0xe0 [kafs] afs_fs_probe_fileserver+0x188/0x1e0 [kafs] afs_lookup_server+0x3bf/0x3f0 [kafs] afs_alloc_server_list+0x130/0x2e0 [kafs] afs_create_volume+0x162/0x400 [kafs] afs_get_tree+0x266/0x410 [kafs] vfs_get_tree+0x25/0xc0 fc_mount+0xe/0x40 afs_d_automount+0x1b3/0x390 [kafs] __traverse_mounts+0x8f/0x210 step_into+0x340/0x760 path_openat+0x13a/0x1260 do_filp_open+0xaf/0x160 do_sys_openat2+0xaf/0x170 or something like: refcount_t: underflow; use-after-free. ... RIP: 0010:refcount_warn_saturate+0x99/0xda ... afs_put_call+0x4a/0x175 afs_send_vl_probes+0x108/0x172 afs_select_vlserver+0xd6/0x311 afs_do_cell_detect_alias+0x5e/0x1e9 afs_cell_detect_alias+0x44/0x92 afs_validate_fc+0x9d/0x134 afs_get_tree+0x20/0x2e6 vfs_get_tree+0x1d/0xc9 fc_mount+0xe/0x33 afs_d_automount+0x48/0x9d __traverse_mounts+0xe0/0x166 step_into+0x140/0x274 open_last_lookups+0x1c1/0x1df path_openat+0x138/0x1c3 do_filp_open+0x55/0xb4 do_sys_openat2+0x6c/0xb6 Fixes: 34fa47612bfe ("afs: Fix race in async call refcounting") Reported-by: Bill MacAllister Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1052304 Suggested-by: Jeffrey E Altman Signed-off-by: David Howells Reviewed-by: Jeffrey Altman cc: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/2633992.1702073229@warthog.procyon.org.uk/ # v1 Signed-off-by: Linus Torvalds fs/afs/rxrpc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3a42709fa909e22b0be4bb1e2795aa04ada732a3 Author: Paulo Alcantara Date: Mon Dec 11 10:26:43 2023 -0300 smb: client: fix OOB in smb2_query_reparse_point() Validate @ioctl_rsp->OutputOffset and @ioctl_rsp->OutputCount so that their sum does not wrap to a number that is smaller than @reparse_buf and we end up with a wild pointer as follows: BUG: unable to handle page fault for address: ffff88809c5cd45f #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 4a01067 P4D 4a01067 PUD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 2 PID: 1260 Comm: mount.cifs Not tainted 6.7.0-rc4 #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:smb2_query_reparse_point+0x3e0/0x4c0 [cifs] Code: ff ff e8 f3 51 fe ff 41 89 c6 58 5a 45 85 f6 0f 85 14 fe ff ff 49 8b 57 48 8b 42 60 44 8b 42 64 42 8d 0c 00 49 39 4f 50 72 40 <8b> 04 02 48 8b 9d f0 fe ff ff 49 8b 57 50 89 03 48 8b 9d e8 fe ff RSP: 0018:ffffc90000347a90 EFLAGS: 00010212 RAX: 000000008000001f RBX: ffff88800ae11000 RCX: 00000000000000ec RDX: ffff88801c5cd440 RSI: 0000000000000000 RDI: ffffffff82004aa4 RBP: ffffc90000347bb0 R08: 00000000800000cd R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000024 R12: ffff8880114d4100 R13: ffff8880114d4198 R14: 0000000000000000 R15: ffff8880114d4000 FS: 00007f02c07babc0(0000) GS:ffff88806ba00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88809c5cd45f CR3: 0000000011750000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: ? __die+0x23/0x70 ? page_fault_oops+0x181/0x480 ? search_module_extables+0x19/0x60 ? srso_alias_return_thunk+0x5/0xfbef5 ? exc_page_fault+0x1b6/0x1c0 ? asm_exc_page_fault+0x26/0x30 ? _raw_spin_unlock_irqrestore+0x44/0x60 ? smb2_query_reparse_point+0x3e0/0x4c0 [cifs] cifs_get_fattr+0x16e/0xa50 [cifs] ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_acquire+0xbf/0x2b0 cifs_root_iget+0x163/0x5f0 [cifs] cifs_smb3_do_mount+0x5bd/0x780 [cifs] smb3_get_tree+0xd9/0x290 [cifs] vfs_get_tree+0x2c/0x100 ? capable+0x37/0x70 path_mount+0x2d7/0xb80 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __x64_sys_mount+0x11a/0x150 do_syscall_64+0x47/0xf0 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f02c08d5b1e Fixes: 2e4564b31b64 ("smb3: add support for stat of WSL reparse points for special file types") Cc: stable@vger.kernel.org Reported-by: Robert Morris Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/smb2ops.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) commit 90d025c2e953c11974e76637977c473200593a46 Author: Paulo Alcantara Date: Mon Dec 11 10:26:42 2023 -0300 smb: client: fix NULL deref in asn1_ber_decoder() If server replied SMB2_NEGOTIATE with a zero SecurityBufferOffset, smb2_get_data_area() sets @len to non-zero but return NULL, so decode_negTokeninit() ends up being called with a NULL @security_blob: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 2 PID: 871 Comm: mount.cifs Not tainted 6.7.0-rc4 #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:asn1_ber_decoder+0x173/0xc80 Code: 01 4c 39 2c 24 75 09 45 84 c9 0f 85 2f 03 00 00 48 8b 14 24 4c 29 ea 48 83 fa 01 0f 86 1e 07 00 00 48 8b 74 24 28 4d 8d 5d 01 <42> 0f b6 3c 2e 89 fa 40 88 7c 24 5c f7 d2 83 e2 1f 0f 84 3d 07 00 RSP: 0018:ffffc9000063f950 EFLAGS: 00010202 RAX: 0000000000000002 RBX: 0000000000000000 RCX: 000000000000004a RDX: 000000000000004a RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: 000000000000004d R15: 0000000000000000 FS: 00007fce52b0fbc0(0000) GS:ffff88806ba00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000001ae64000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: ? __die+0x23/0x70 ? page_fault_oops+0x181/0x480 ? __stack_depot_save+0x1e6/0x480 ? exc_page_fault+0x6f/0x1c0 ? asm_exc_page_fault+0x26/0x30 ? asn1_ber_decoder+0x173/0xc80 ? check_object+0x40/0x340 decode_negTokenInit+0x1e/0x30 [cifs] SMB2_negotiate+0xc99/0x17c0 [cifs] ? smb2_negotiate+0x46/0x60 [cifs] ? srso_alias_return_thunk+0x5/0xfbef5 smb2_negotiate+0x46/0x60 [cifs] cifs_negotiate_protocol+0xae/0x130 [cifs] cifs_get_smb_ses+0x517/0x1040 [cifs] ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? queue_delayed_work_on+0x5d/0x90 cifs_mount_get_session+0x78/0x200 [cifs] dfs_mount_share+0x13a/0x9f0 [cifs] ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_acquire+0xbf/0x2b0 ? find_nls+0x16/0x80 ? srso_alias_return_thunk+0x5/0xfbef5 cifs_mount+0x7e/0x350 [cifs] cifs_smb3_do_mount+0x128/0x780 [cifs] smb3_get_tree+0xd9/0x290 [cifs] vfs_get_tree+0x2c/0x100 ? capable+0x37/0x70 path_mount+0x2d7/0xb80 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __x64_sys_mount+0x11a/0x150 do_syscall_64+0x47/0xf0 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7fce52c2ab1e Fix this by setting @len to zero when @off == 0 so callers won't attempt to dereference non-existing data areas. Reported-by: Robert Morris Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/smb2misc.c | 26 ++++++++++---------------- 1 file changed, 10 insertions(+), 16 deletions(-) commit af1689a9b7701d9907dfc84d2a4b57c4bc907144 Author: Paulo Alcantara Date: Mon Dec 11 10:26:41 2023 -0300 smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing invalid create contexts from server: BUG: unable to handle page fault for address: ffff8881178d8cc3 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 4a01067 P4D 4a01067 PUD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs] Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00 00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7 7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00 RSP: 0018:ffffc900007939e0 EFLAGS: 00010216 RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90 RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000 RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000 R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000 R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22 FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: ? __die+0x23/0x70 ? page_fault_oops+0x181/0x480 ? search_module_extables+0x19/0x60 ? srso_alias_return_thunk+0x5/0xfbef5 ? exc_page_fault+0x1b6/0x1c0 ? asm_exc_page_fault+0x26/0x30 ? smb2_parse_contexts+0xa0/0x3a0 [cifs] SMB2_open+0x38d/0x5f0 [cifs] ? smb2_is_path_accessible+0x138/0x260 [cifs] smb2_is_path_accessible+0x138/0x260 [cifs] cifs_is_path_remote+0x8d/0x230 [cifs] cifs_mount+0x7e/0x350 [cifs] cifs_smb3_do_mount+0x128/0x780 [cifs] smb3_get_tree+0xd9/0x290 [cifs] vfs_get_tree+0x2c/0x100 ? capable+0x37/0x70 path_mount+0x2d7/0xb80 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __x64_sys_mount+0x11a/0x150 do_syscall_64+0x47/0xf0 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f8737657b1e Reported-by: Robert Morris Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/cached_dir.c | 17 ++++++--- fs/smb/client/smb2pdu.c | 93 ++++++++++++++++++++++++++++------------------ fs/smb/client/smb2proto.h | 12 +++--- 3 files changed, 75 insertions(+), 47 deletions(-) commit eec04ea119691e65227a97ce53c0da6b9b74b0b7 Author: Paulo Alcantara Date: Mon Dec 11 10:26:40 2023 -0300 smb: client: fix OOB in receive_encrypted_standard() Fix potential OOB in receive_encrypted_standard() if server returned a large shdr->NextCommand that would end up writing off the end of @next_buffer. Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses") Cc: stable@vger.kernel.org Reported-by: Robert Morris Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/smb2ops.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) commit 7ff2b7a1821b61c324626ad57c3664398fb0083d Author: Johan Hovold Date: Tue Nov 28 09:15:12 2023 +0100 PCI/ASPM: Add pci_disable_link_state_locked() lockdep assert Add a lockdep assert to pci_disable_link_state_locked() which should only be called with a pci_bus_sem read lock held. Link: https://lore.kernel.org/r/20231128081512.19387-7-johan+linaro@kernel.org Signed-off-by: Johan Hovold [bhelgaas: include function name in subject, commit log] Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam drivers/pci/pcie/aspm.c | 2 ++ 1 file changed, 2 insertions(+) commit e673d383bdba94c9924388086b91988254d39f19 Author: Johan Hovold Date: Tue Nov 28 09:15:11 2023 +0100 PCI/ASPM: Clean up __pci_disable_link_state() 'sem' parameter Replace the current 'sem' parameter to the __pci_disable_link_state() helper with a more descriptive 'locked' parameter, which indicates whether a pci_bus_sem read lock is already held. Link: https://lore.kernel.org/r/20231128081512.19387-6-johan+linaro@kernel.org Signed-off-by: Johan Hovold [bhelgaas: include function name in subject, commit log] Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam drivers/pci/pcie/aspm.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 780f52e3213e5f05bb41adebe1f2214f2f86f4a3 Author: Johan Hovold Date: Tue Nov 28 09:15:10 2023 +0100 PCI: qcom: Clean up ASPM comment Break up the newly added ASPM comment so that it fits within the soft 80 character limit and becomes more readable. Link: https://lore.kernel.org/r/20231128081512.19387-5-johan+linaro@kernel.org Signed-off-by: Johan Hovold Signed-off-by: Bjorn Helgaas drivers/pci/controller/dwc/pcie-qcom.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit f352ce99926048e12aa4281c32471031351aec98 Author: Johan Hovold Date: Tue Nov 28 09:15:09 2023 +0100 PCI: qcom: Fix potential deadlock when enabling ASPM The qcom_pcie_enable_aspm() helper is called from pci_walk_bus() during host init to enable ASPM. Since pci_walk_bus() already holds a pci_bus_sem read lock, use pci_enable_link_state_locked() to enable link states in order to avoid a potential deadlock (e.g. in case someone takes a write lock before reacquiring the read lock). This issue was reported by lockdep: ============================================ WARNING: possible recursive locking detected 6.7.0-rc1 #4 Not tainted -------------------------------------------- kworker/u16:6/147 is trying to acquire lock: ffffbf3ff9d2cfa0 (pci_bus_sem){++++}-{3:3}, at: pci_enable_link_state+0x74/0x1e8 but task is already holding lock: ffffbf3ff9d2cfa0 (pci_bus_sem){++++}-{3:3}, at: pci_walk_bus+0x34/0xbc other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(pci_bus_sem); lock(pci_bus_sem); *** DEADLOCK *** Fixes: 9f4f3dfad8cf ("PCI: qcom: Enable ASPM for platforms supporting 1.9.0 ops") Link: https://lore.kernel.org/r/20231128081512.19387-4-johan+linaro@kernel.org Signed-off-by: Johan Hovold [bhelgaas: add "potential" in subject since the deadlock has only been reported by lockdep, include helper name in commit log] Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam drivers/pci/controller/dwc/pcie-qcom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 49de0dc87965079a8e2803ee4b39f9d946259423 Author: Johan Hovold Date: Tue Nov 28 09:15:08 2023 +0100 PCI: vmd: Fix potential deadlock when enabling ASPM The vmd_pm_enable_quirk() helper is called from pci_walk_bus() during probe to enable ASPM for controllers with VMD_FEAT_BIOS_PM_QUIRK set. Since pci_walk_bus() already holds a pci_bus_sem read lock, use pci_enable_link_state_locked() to enable link states in order to avoid a potential deadlock (e.g. in case someone takes a write lock before reacquiring the read lock). Fixes: f492edb40b54 ("PCI: vmd: Add quirk to configure PCIe ASPM and LTR") Link: https://lore.kernel.org/r/20231128081512.19387-3-johan+linaro@kernel.org Signed-off-by: Johan Hovold [bhelgaas: add "potential" in subject since the deadlock has only been reported by lockdep, include helper name in commit log] Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Cc: # 6.3 Cc: Michael Bottini Cc: David E. Box drivers/pci/controller/vmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 718ab8226636a1a3a7d281f5d6a7ad7c925efe5a Author: Johan Hovold Date: Tue Nov 28 09:15:07 2023 +0100 PCI/ASPM: Add pci_enable_link_state_locked() Add pci_enable_link_state_locked() for enabling link states that can be used in contexts where a pci_bus_sem read lock is already held (e.g. from pci_walk_bus()). This helper will be used to fix a couple of potential deadlocks where the current helper is called with the lock already held, hence the CC stable tag. Fixes: f492edb40b54 ("PCI: vmd: Add quirk to configure PCIe ASPM and LTR") Link: https://lore.kernel.org/r/20231128081512.19387-2-johan+linaro@kernel.org Signed-off-by: Johan Hovold [bhelgaas: include helper name in subject, commit log] Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Cc: # 6.3 Cc: Michael Bottini Cc: David E. Box drivers/pci/pcie/aspm.c | 53 +++++++++++++++++++++++++++++++++++++------------ include/linux/pci.h | 3 +++ 2 files changed, 43 insertions(+), 13 deletions(-) commit b96ab339ee50470d13a1faa6ad94d2218a7cd49f Author: Mario Limonciello Date: Wed Dec 6 12:08:26 2023 -0600 drm/amd/display: Restore guard against default backlight value < 1 nit Mark reports that brightness is not restored after Xorg dpms screen blank. This behavior was introduced by commit d9e865826c20 ("drm/amd/display: Simplify brightness initialization") which dropped the cached backlight value in display code, but also removed code for when the default value read back was less than 1 nit. Restore this code so that the backlight brightness is restored to the correct default value in this circumstance. Reported-by: Mark Herbert Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3031 Cc: stable@vger.kernel.org Cc: Camille Cho Cc: Krunoslav Kovac Cc: Hamza Mahfooz Fixes: d9e865826c20 ("drm/amd/display: Simplify brightness initialization") Acked-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher .../gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f528ee145bd0076cd0ed7e7b2d435893e6329e98 Author: Hamza Mahfooz Date: Tue Dec 5 14:55:04 2023 -0500 drm/amd/display: fix hw rotated modes when PSR-SU is enabled We currently don't support dirty rectangles on hardware rotated modes. So, if a user is using hardware rotated modes with PSR-SU enabled, use PSR-SU FFU for all rotated planes (including cursor planes). Cc: stable@vger.kernel.org Fixes: 30ebe41582d1 ("drm/amd/display: add FB_DAMAGE_CLIPS support") Reported-by: Kai-Heng Feng Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2952 Tested-by: Kai-Heng Feng Tested-by: Bin Li Reviewed-by: Mario Limonciello Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +++ drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 1 + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c | 12 ++++++++++-- drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 3 ++- 4 files changed, 16 insertions(+), 3 deletions(-) commit dbfbf4740e40fbd39ceeb5c42ab301ac2edd7a9f Author: Dmitrii Galantsev Date: Wed Dec 6 02:04:52 2023 -0600 drm/amd/pm: fix pp_*clk_od typo Fix pp_dpm_sclk_od and pp_dpm_mclk_od typos. Those were defined as pp_*clk_od but used as pp_dpm_*clk_od instead. This change removes the _dpm part. Fixes: 8cfd6a05750c ("drm/amd/pm: Hide irrelevant pm device attributes") Signed-off-by: Dmitrii Galantsev Reviewed-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/pm/amdgpu_pm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9fd2fbaabdb9dba947d1c14e5f4f217bc21afc34 Author: Alex Deucher Date: Mon Dec 11 11:28:30 2023 -0500 drm/amdgpu: fix buffer funcs setting order on suspend harder Part of commit dab96d8b61aa ("drm/amdgpu: fix buffer funcs setting order on suspend") got dropped accidently. Add it back. Fixes: dab96d8b61aa ("drm/amdgpu: fix buffer funcs setting order on suspend") Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 -- 1 file changed, 2 deletions(-) commit dc96528b176fa6e55a3dc01060fe9d97be450ce9 Author: Charles Keepax Date: Mon Dec 11 16:00:18 2023 +0000 ASoC: cs42l43: Don't enable bias sense during type detect Alas on some headsets the bias sense can cause problems with the type detection. It can occasionally be falsely triggered by the type detect itself and as the clamp is applied when this happens, it will cause a headset to be incorrectly identified as headphones. As such it should be disabled whilst running type detect. This does mean a jack removal during type detect will cause a larger click but that is unfortunately unavoidable. Fixes: 1e4ce0d5c023 ("ASoC: cs42l43: Move headset bias sense enable earlier in process") Signed-off-by: Charles Keepax Link: https://msgid.link/r/20231211160019.2034442-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs42l43-jack.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) commit 50d7cdf7a9b1ab6f4f74a69c84e974d5dc0c1bf1 Author: Ard Biesheuvel Date: Mon Dec 11 10:00:57 2023 +0100 efi/x86: Avoid physical KASLR on older Dell systems River reports boot hangs with v6.6 and v6.7, and the bisect points to commit a1b87d54f4e4 ("x86/efistub: Avoid legacy decompressor when doing EFI boot") which moves the memory allocation and kernel decompression from the legacy decompressor (which executes *after* ExitBootServices()) to the EFI stub, using boot services for allocating the memory. The memory allocation succeeds but the subsequent call to decompress_kernel() never returns, resulting in a failed boot and a hanging system. As it turns out, this issue only occurs when physical address randomization (KASLR) is enabled, and given that this is a feature we can live without (virtual KASLR is much more important), let's disable the physical part of KASLR when booting on AMI UEFI firmware claiming to implement revision v2.0 of the specification (which was released in 2006), as this is the version these systems advertise. Fixes: a1b87d54f4e4 ("x86/efistub: Avoid legacy decompressor when doing EFI boot") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218173 Signed-off-by: Ard Biesheuvel drivers/firmware/efi/libstub/x86-stub.c | 31 ++++++++++++++++++++++++------- 1 file changed, 24 insertions(+), 7 deletions(-) commit 4ee632c82d2dbb9e2dcc816890ef182a151cbd99 Author: Frank Li Date: Mon Nov 27 16:43:25 2023 -0500 dmaengine: fsl-edma: fix DMA channel leak in eDMAv4 Allocate channel count consistently increases due to a missing source ID (srcid) cleanup in the fsl_edma_free_chan_resources() function at imx93 eDMAv4. Reset 'srcid' at fsl_edma_free_chan_resources(). Cc: stable@vger.kernel.org Fixes: 72f5801a4e2b ("dmaengine: fsl-edma: integrate v3 support") Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20231127214325.2477247-1-Frank.Li@nxp.com Signed-off-by: Vinod Koul drivers/dma/fsl-edma-common.c | 1 + 1 file changed, 1 insertion(+) commit b6961d187fcd138981b8707dac87b9fcdbfe75d1 Author: Stuart Lee Date: Fri Nov 10 09:29:14 2023 +0800 drm/mediatek: Fix access violation in mtk_drm_crtc_dma_dev_get Add error handling to check NULL input in mtk_drm_crtc_dma_dev_get function. While display path is not configured correctly, none of crtc is established. So the caller of mtk_drm_crtc_dma_dev_get may pass input parameter *crtc as NULL, Which may cause coredump when we try to get the container of NULL pointer. Fixes: cb1d6bcca542 ("drm/mediatek: Add dma dev get function") Signed-off-by: Stuart Lee Cc: stable@vger.kernel.org Reviewed-by: AngeloGioacchino DEl Regno Tested-by: Macpaul Lin Link: https://patchwork.kernel.org/project/dri-devel/patch/20231110012914.14884-2-stuart.lee@mediatek.com/ Signed-off-by: Chun-Kuang Hu drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 02a914ed475dd928c7b2b6c9d1da9b0b27fa724d Author: Richard Fitzgerald Date: Tue Dec 5 11:57:15 2023 +0000 ASoC: Intel: soc-acpi-intel-mtl-match: Change CS35L56 prefixes to AMPn Change the ALSA prefix for the CS35L56 to "AMPn". This keeps them consistent with the CS35L56 HDA driver. It also avoids coding the chip ID into the control name, so that other Cirrus amps with the same controls can have the same control names. Signed-off-by: Richard Fitzgerald Fixes: 05fe62842804 ("ASoC: Intel: soc-acpi-intel-mtl-match: add acpi match table for cdb35l56-eight-c") Link: https://msgid.link/r/20231205115715.2460386-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/intel/common/soc-acpi-intel-mtl-match.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 759f14e20891de72e676d9d738eb2c573aa15f52 Author: Jani Nikula Date: Thu Dec 7 11:38:21 2023 +0200 drm/edid: also call add modes in EDID connector update fallback When the separate add modes call was added back in commit c533b5167c7e ("drm/edid: add separate drm_edid_connector_add_modes()"), it failed to address drm_edid_override_connector_update(). Also call add modes there. Reported-by: bbaa Closes: https://lore.kernel.org/r/930E9B4C7D91FDFF+29b34d89-8658-4910-966a-c772f320ea03@bbaa.fun Fixes: c533b5167c7e ("drm/edid: add separate drm_edid_connector_add_modes()") Cc: # v6.3+ Signed-off-by: Jani Nikula Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20231207093821.2654267-1-jani.nikula@intel.com drivers/gpu/drm/drm_edid.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit bffa7218dcddb80e7f18dfa545dd4b359b11dd93 Author: Yang Yingliang Date: Wed Nov 29 17:00:00 2023 +0800 dmaengine: fsl-edma: fix wrong pointer check in fsl_edma3_attach_pd() device_link_add() returns NULL pointer not PTR_ERR() when it fails, so replace the IS_ERR() check with NULL pointer check. Fixes: 72f5801a4e2b ("dmaengine: fsl-edma: integrate v3 support") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20231129090000.841440-1-yangyingliang@huaweicloud.com Signed-off-by: Vinod Koul drivers/dma/fsl-edma-main.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit e6861d8264cd43c5eb20196e53df36fd71ec5698 Author: Jani Nikula Date: Tue Dec 5 20:05:51 2023 +0200 drm/i915/edp: don't write to DP_LINK_BW_SET when using rate select The eDP 1.5 spec adds a clarification for eDP 1.4x: > For eDP v1.4x, if the Source device chooses the Main-Link rate by way > of DPCD 00100h, the Sink device shall ignore DPCD 00115h[2:0]. We write 0 to DP_LINK_BW_SET (DPCD 100h) even when using DP_LINK_RATE_SET (DPCD 114h). Stop doing that, as it can cause the panel to ignore the rate set method. Moreover, 0 is a reserved value for DP_LINK_BW_SET, and should not be used. v2: Improve the comments (Ville) Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/9081 Tested-by: Animesh Manna Reviewed-by: Uma Shankar Cc: Ville Syrjälä Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20231205180551.2476228-1-jani.nikula@intel.com (cherry picked from commit 23b392b94acb0499f69706c5808c099f590ebcf4) Cc: stable@vger.kernel.org Signed-off-by: Jani Nikula .../gpu/drm/i915/display/intel_dp_link_training.c | 31 +++++++++++++++------- 1 file changed, 21 insertions(+), 10 deletions(-) commit 324b70e997aab0a7deab8cb90711faccda4e98c8 Author: Ville Syrjälä Date: Mon Dec 4 22:24:43 2023 +0200 drm/i915: Fix ADL+ tiled plane stride when the POT stride is smaller than the original plane_view_scanout_stride() currently assumes that we had to pad the mapping stride with dummy pages in order to align it. But that is not the case if the original fb stride exceeds the aligned stride used to populate the remapped view, which is calculated from the user specified framebuffer width rather than the user specified framebuffer stride. Ignore the original fb stride in this case and just stick to the POT aligned stride. Getting this wrong will cause the plane to fetch the wrong data, and can lead to fault errors if the page tables at the bogus location aren't even populated. TODO: figure out if this is OK for CCS, or if we should instead increase the width of the view to cover the entire user specified fb stride instead... Cc: Imre Deak Cc: Juha-Pekka Heikkila Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20231204202443.31247-1-ville.syrjala@linux.intel.com Reviewed-by: Imre Deak Reviewed-by: Juha-Pekka Heikkila (cherry picked from commit 01a39f1c4f1220a4e6a25729fae87ff5794cbc52) Cc: stable@vger.kernel.org Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/intel_fb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c3070f080f9ba18dea92eaa21730f7ab85b5c8f4 Author: Ville Syrjälä Date: Thu Dec 7 21:34:34 2023 +0200 drm/i915: Fix intel_atomic_setup_scalers() plane_state handling Since the plane_state variable is declared outside the scaler_users loop in intel_atomic_setup_scalers(), and it's never reset back to NULL inside the loop we may end up calling intel_atomic_setup_scaler() with a non-NULL plane state for the pipe scaling case. That is bad because intel_atomic_setup_scaler() determines whether we are doing plane scaling or pipe scaling based on plane_state!=NULL. The end result is that we may miscalculate the scaler mode for pipe scaling. The hardware becomes somewhat upset if we end up in this situation when scanning out a planar format on a SDR plane. We end up programming the pipe scaler into planar mode as well, and the result is a screenfull of garbage. Fix the situation by making sure we pass the correct plane_state==NULL when calculating the scaler mode for pipe scaling. Cc: stable@vger.kernel.org Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20231207193441.20206-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit e81144106e21271c619f0c722a09e27ccb8c043d) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/skl_scaler.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0ccd963fe555451b1f84e6d14d2b3ef03dd5c947 Author: Ville Syrjälä Date: Tue Dec 5 20:03:08 2023 +0200 drm/i915: Fix remapped stride with CCS on ADL+ On ADL+ the hardware automagically calculates the CCS AUX surface stride from the main surface stride, so when remapping we can't really play a lot of tricks with the main surface stride, or else the AUX surface stride would get miscalculated and no longer match the actual data layout in memory. Supposedly we could remap in 256 main surface tile units (AUX page(4096)/cachline(64)*4(4x1 main surface tiles per AUX cacheline)=256 main surface tiles), but the extra complexity is probably not worth the hassle. So let's just make sure our mapping stride is calculated from the full framebuffer stride (instead of the framebuffer width). This way the stride we program into PLANE_STRIDE will be the original framebuffer stride, and thus there will be no change to the AUX stride/layout. Cc: stable@vger.kernel.org Cc: Imre Deak Cc: Juha-Pekka Heikkila Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20231205180308.7505-1-ville.syrjala@linux.intel.com Reviewed-by: Imre Deak (cherry picked from commit 2c12eb36f849256f5eb00ffaee9bf99396fd3814) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/intel_fb.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) commit 1f721a93a528268fa97875cff515d1fcb69f4f44 Author: Tvrtko Ursulin Date: Fri Dec 1 12:21:09 2023 +0000 drm/i915: Use internal class when counting engine resets Commit 503579448db9 ("drm/i915/gsc: Mark internal GSC engine with reserved uabi class") made the GSC0 engine not have a valid uabi class and so broke the engine reset counting, which in turn was made class based in cb823ed9915b ("drm/i915/gt: Use intel_gt as the primary object for handling resets"). Despite the title and commit text of the latter is not mentioning it (and has left the storage array incorrectly sized), tracking by class, despite it adding aliasing in hypthotetical multi-tile systems, is handy for virtual engines which for instance do not have a valid engine->id. Therefore we keep that but just change it to use the internal class which is always valid. We also add a helper to increment the count, which aligns with the existing getter. What was broken without this fix were out of bounds reads every time a reset would happen on the GSC0 engine, or during selftests when storing and cross-checking the counts in igt_live_test_begin and igt_live_test_end. Signed-off-by: Tvrtko Ursulin Fixes: 503579448db9 ("drm/i915/gsc: Mark internal GSC engine with reserved uabi class") [tursulin: fixed Fixes tag] Reported-by: Alan Previn Teres Alexis Cc: Daniele Ceraolo Spurio Reviewed-by: Daniele Ceraolo Spurio Link: https://patchwork.freedesktop.org/patch/msgid/20231201122109.729006-2-tvrtko.ursulin@linux.intel.com (cherry picked from commit cf9cb028ac56696ff879af1154c4b2f0b12701fd) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/gt/intel_reset.c | 2 +- drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 5 +++-- drivers/gpu/drm/i915/i915_gpu_error.h | 12 ++++++++++-- 3 files changed, 14 insertions(+), 5 deletions(-) commit 7c7c863bf89c5f76d8c7fda177a81559b61dc15b Author: Tvrtko Ursulin Date: Fri Dec 1 12:21:08 2023 +0000 drm/i915/selftests: Fix engine reset count storage for multi-tile Engine->id namespace is per-tile so struct igt_live_test->reset_engine[] needs to be two-dimensional so engine reset counts from all tiles can be stored with no aliasing. With aliasing, if we had a real multi-tile platform, the reset counts would be incorrect for same engine instance on different tiles. Signed-off-by: Tvrtko Ursulin Fixes: 0c29efa23f5c ("drm/i915/selftests: Consider multi-gt instead of to_gt()") Reported-by: Alan Previn Teres Alexis Cc: Tejas Upadhyay Cc: Andi Shyti Cc: Daniele Ceraolo Spurio Reviewed-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20231201122109.729006-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit 0647ece3819b018cb62a71c3bcb7c2c3243e78ac) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/selftests/igt_live_test.c | 9 +++++---- drivers/gpu/drm/i915/selftests/igt_live_test.h | 3 ++- 2 files changed, 7 insertions(+), 5 deletions(-) commit e307b5a845c5951dabafc48d00b6424ee64716c4 Author: Hariprasad Kelam Date: Fri Dec 8 14:57:54 2023 +0530 octeontx2-af: Fix pause frame configuration The current implementation's default Pause Forward setting is causing unnecessary network traffic. This patch disables Pause Forward to address this issue. Fixes: 1121f6b02e7a ("octeontx2-af: Priority flow control configuration support") Signed-off-by: Hariprasad Kelam Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: David S. Miller drivers/net/ethernet/marvell/octeontx2/af/rpm.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit 271f2a4a9576b87ed1f8584909d6d270039e52ea Author: Wang Yao Date: Wed Dec 6 08:24:27 2023 +0800 efi/loongarch: Use load address to calculate kernel entry address The efi_relocate_kernel() may load the PIE kernel to anywhere, the loaded address may not be equal to link address or EFI_KIMG_PREFERRED_ADDRESS. Acked-by: Huacai Chen Signed-off-by: Wang Yao Signed-off-by: Ard Biesheuvel arch/loongarch/include/asm/efi.h | 2 +- drivers/firmware/efi/libstub/loongarch-stub.c | 4 ++-- drivers/firmware/efi/libstub/loongarch.c | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-) commit c3e041425af9068e3ec9d90c536de2a2ba97ba2b Merge: 284f71762241 570ba37898ec Author: David S. Miller Date: Mon Dec 11 10:06:05 2023 +0000 Merge branch 'octeontx2-fixes' Hariprasad Kelam says: ==================== octeontx2: Fix issues with promisc/allmulti mode When interface is configured in promisc/all multi mode, low network performance observed. This series patches address the same. Patch1: Change the promisc/all multi mcam entry action to unicast if there are no trusted vfs associated with PF. Patch2: Configures RSS flow algorithm in promisc/all multi mcam entries to address flow distribution issues. ==================== Signed-off-by: David S. Miller commit 570ba37898ecd9069beb58bf0b6cf84daba6e0fe Author: Hariprasad Kelam Date: Fri Dec 8 12:26:10 2023 +0530 octeontx2-af: Update RSS algorithm index The RSS flow algorithm is not set up correctly for promiscuous or all multi MCAM entries. This has an impact on flow distribution. This patch fixes the issue by updating flow algorithm index in above mentioned MCAM entries. Fixes: 967db3529eca ("octeontx2-af: add support for multicast/promisc packet replication feature") Signed-off-by: Hariprasad Kelam Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: David S. Miller .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 55 +++++++++++++++++----- 1 file changed, 44 insertions(+), 11 deletions(-) commit dbda436824ded8ef6a05bb82cd9baa8d42377a49 Author: Hariprasad Kelam Date: Fri Dec 8 12:26:09 2023 +0530 octeontx2-pf: Fix promisc mcam entry action Current implementation is such that, promisc mcam entry action is set as multicast even when there are no trusted VFs. multicast action causes the hardware to copy packet data, which reduces the performance. This patch fixes this issue by setting the promisc mcam entry action to unicast instead of multicast when there are no trusted VFs. The same change is made for the 'allmulti' mcam entry action. Fixes: ffd2f89ad05c ("octeontx2-pf: Enable promisc/allmulti match MCAM entries.") Signed-off-by: Hariprasad Kelam Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: David S. Miller .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 25 +++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) commit 284f717622417cb267e344a9174f8e5698d1e3c1 Author: Shinas Rasheed Date: Thu Dec 7 21:56:46 2023 -0800 octeon_ep: explicitly test for firmware ready value The firmware ready value is 1, and get firmware ready status function should explicitly test for that value. The firmware ready value read will be 2 after driver load, and on unbind till firmware rewrites the firmware ready back to 0, the value seen by driver will be 2, which should be regarded as not ready. Fixes: 10c073e40469 ("octeon_ep: defer probe if firmware not ready") Signed-off-by: Shinas Rasheed Reviewed-by: Simon Horman Signed-off-by: David S. Miller drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 125f1c7f26ffcdbf96177abe75b70c1a6ceb17bc Author: Vlad Buslov Date: Tue Dec 5 18:25:54 2023 +0100 net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table The referenced change added custom cleanup code to act_ct to delete any callbacks registered on the parent block when deleting the tcf_ct_flow_table instance. However, the underlying issue is that the drivers don't obtain the reference to the tcf_ct_flow_table instance when registering callbacks which means that not only driver callbacks may still be on the table when deleting it but also that the driver can still have pointers to its internal nf_flowtable and can use it concurrently which results either warning in netfilter[0] or use-after-free. Fix the issue by taking a reference to the underlying struct tcf_ct_flow_table instance when registering the callback and release the reference when unregistering. Expose new API required for such reference counting by adding two new callbacks to nf_flowtable_type and implementing them for act_ct flowtable_ct type. This fixes the issue by extending the lifetime of nf_flowtable until all users have unregistered. [0]: [106170.938634] ------------[ cut here ]------------ [106170.939111] WARNING: CPU: 21 PID: 3688 at include/net/netfilter/nf_flow_table.h:262 mlx5_tc_ct_del_ft_cb+0x267/0x2b0 [mlx5_core] [106170.940108] Modules linked in: act_ct nf_flow_table act_mirred act_skbedit act_tunnel_key vxlan cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress mlx5_vdpa vringh vhost_iotlb vdpa bonding openvswitch nsh rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_regis try overlay mlx5_core [106170.943496] CPU: 21 PID: 3688 Comm: kworker/u48:0 Not tainted 6.6.0-rc7_for_upstream_min_debug_2023_11_01_13_02 #1 [106170.944361] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [106170.945292] Workqueue: mlx5e mlx5e_rep_neigh_update [mlx5_core] [106170.945846] RIP: 0010:mlx5_tc_ct_del_ft_cb+0x267/0x2b0 [mlx5_core] [106170.946413] Code: 89 ef 48 83 05 71 a4 14 00 01 e8 f4 06 04 e1 48 83 05 6c a4 14 00 01 48 83 c4 28 5b 5d 41 5c 41 5d c3 48 83 05 d1 8b 14 00 01 <0f> 0b 48 83 05 d7 8b 14 00 01 e9 96 fe ff ff 48 83 05 a2 90 14 00 [106170.947924] RSP: 0018:ffff88813ff0fcb8 EFLAGS: 00010202 [106170.948397] RAX: 0000000000000000 RBX: ffff88811eabac40 RCX: ffff88811eabad48 [106170.949040] RDX: ffff88811eab8000 RSI: ffffffffa02cd560 RDI: 0000000000000000 [106170.949679] RBP: ffff88811eab8000 R08: 0000000000000001 R09: ffffffffa0229700 [106170.950317] R10: ffff888103538fc0 R11: 0000000000000001 R12: ffff88811eabad58 [106170.950969] R13: ffff888110c01c00 R14: ffff888106b40000 R15: 0000000000000000 [106170.951616] FS: 0000000000000000(0000) GS:ffff88885fd40000(0000) knlGS:0000000000000000 [106170.952329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [106170.952834] CR2: 00007f1cefd28cb0 CR3: 000000012181b006 CR4: 0000000000370ea0 [106170.953482] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [106170.954121] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [106170.954766] Call Trace: [106170.955057] [106170.955315] ? __warn+0x79/0x120 [106170.955648] ? mlx5_tc_ct_del_ft_cb+0x267/0x2b0 [mlx5_core] [106170.956172] ? report_bug+0x17c/0x190 [106170.956537] ? handle_bug+0x3c/0x60 [106170.956891] ? exc_invalid_op+0x14/0x70 [106170.957264] ? asm_exc_invalid_op+0x16/0x20 [106170.957666] ? mlx5_del_flow_rules+0x10/0x310 [mlx5_core] [106170.958172] ? mlx5_tc_ct_block_flow_offload_add+0x1240/0x1240 [mlx5_core] [106170.958788] ? mlx5_tc_ct_del_ft_cb+0x267/0x2b0 [mlx5_core] [106170.959339] ? mlx5_tc_ct_del_ft_cb+0xc6/0x2b0 [mlx5_core] [106170.959854] ? mapping_remove+0x154/0x1d0 [mlx5_core] [106170.960342] ? mlx5e_tc_action_miss_mapping_put+0x4f/0x80 [mlx5_core] [106170.960927] mlx5_tc_ct_delete_flow+0x76/0xc0 [mlx5_core] [106170.961441] mlx5_free_flow_attr_actions+0x13b/0x220 [mlx5_core] [106170.962001] mlx5e_tc_del_fdb_flow+0x22c/0x3b0 [mlx5_core] [106170.962524] mlx5e_tc_del_flow+0x95/0x3c0 [mlx5_core] [106170.963034] mlx5e_flow_put+0x73/0xe0 [mlx5_core] [106170.963506] mlx5e_put_flow_list+0x38/0x70 [mlx5_core] [106170.964002] mlx5e_rep_update_flows+0xec/0x290 [mlx5_core] [106170.964525] mlx5e_rep_neigh_update+0x1da/0x310 [mlx5_core] [106170.965056] process_one_work+0x13a/0x2c0 [106170.965443] worker_thread+0x2e5/0x3f0 [106170.965808] ? rescuer_thread+0x410/0x410 [106170.966192] kthread+0xc6/0xf0 [106170.966515] ? kthread_complete_and_exit+0x20/0x20 [106170.966970] ret_from_fork+0x2d/0x50 [106170.967332] ? kthread_complete_and_exit+0x20/0x20 [106170.967774] ret_from_fork_asm+0x11/0x20 [106170.970466] [106170.970726] ---[ end trace 0000000000000000 ]--- Fixes: 77ac5e40c44e ("net/sched: act_ct: remove and free nf_table callbacks") Signed-off-by: Vlad Buslov Reviewed-by: Paul Blakey Acked-by: Pablo Neira Ayuso Signed-off-by: David S. Miller include/net/netfilter/nf_flow_table.h | 10 ++++++++++ net/sched/act_ct.c | 34 ++++++++++++++++++++++++++++------ 2 files changed, 38 insertions(+), 6 deletions(-) commit 35c49cfc8b702eda7a0d3f05497b16f81b69e289 Author: Andrzej Kacprowski Date: Mon Dec 4 13:23:31 2023 +0100 accel/ivpu/37xx: Fix interrupt_clear_with_0 WA initialization Using PCI Device ID/Revision to initialize the interrupt_clear_with_0 workaround is problematic - there are many pre-production steppings with different behavior, even with the same PCI ID/Revision Instead of checking for PCI Device ID/Revision, check the VPU buttress interrupt status register behavior - if this register is not zero after writing 1s it means there register is RW instead of RW1C and we need to enable the interrupt_clear_with_0 workaround. Fixes: 7f34e01f77f8 ("accel/ivpu: Clear specific interrupt status bits on C0") Signed-off-by: Andrzej Kacprowski Signed-off-by: Jacek Lawrynowicz Reviewed-by: Jeffrey Hugo Link: https://lore.kernel.org/all/20231204122331.40560-1-jacek.lawrynowicz@linux.intel.com drivers/accel/ivpu/ivpu_hw_37xx.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit 33071422714a4c9587753b0ccc130ca59323bf42 Author: Gergo Koteles Date: Mon Dec 11 00:37:33 2023 +0100 ALSA: hda/tas2781: handle missing EFI calibration data The code does not properly check whether the calibration variable is available in the EFI. If it is not available, it causes a NULL pointer dereference. Check the return value of the first get_variable call also. BUG: kernel NULL pointer dereference, address: 0000000000000000 Call Trace: ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? srso_alias_return_thunk+0x5/0x7f ? schedule+0x5e/0xd0 ? exc_page_fault+0x7f/0x180 ? asm_exc_page_fault+0x26/0x30 ? crc32_body+0x2c/0x120 ? tas2781_save_calibration+0xe4/0x220 [snd_hda_scodec_tas2781_i2c] tasdev_fw_ready+0x1af/0x280 [snd_hda_scodec_tas2781_i2c] request_firmware_work_func+0x59/0xa0 Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver") CC: stable@vger.kernel.org Signed-off-by: Gergo Koteles Link: https://lore.kernel.org/r/f1f6583bda918f78556f67d522ca7b3b91cebbd5.1702251102.git.soyer@irl.hu Signed-off-by: Takashi Iwai sound/pci/hda/tas2781_hda_i2c.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 0c154698a0fc32957d00c6009d5389e086dc8acf Author: Guanjun Date: Mon Dec 11 13:37:04 2023 +0800 dmaengine: idxd: Fix incorrect descriptions for GRPCFG register Fix incorrect descriptions for the GRPCFG register which has three sub-registers (GRPWQCFG, GRPENGCFG and GRPFLGCFG). No functional changes Signed-off-by: Guanjun Reviewed-by: Dave Jiang Reviewed-by: Fenghua Yu Acked-by: Lijun Pan Link: https://lore.kernel.org/r/20231211053704.2725417-3-guanjun@linux.alibaba.com Signed-off-by: Vinod Koul drivers/dma/idxd/registers.h | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 778dfacc903d4b1ef5b7a9726e3a36bc15913d29 Author: Guanjun Date: Mon Dec 11 13:37:03 2023 +0800 dmaengine: idxd: Protect int_handle field in hw descriptor The int_handle field in hw descriptor should also be protected by wmb() before possibly triggering a DMA read. Fixes: eb0cf33a91b4 (dmaengine: idxd: move interrupt handle assignment) Signed-off-by: Guanjun Reviewed-by: Dave Jiang Reviewed-by: Fenghua Yu Reviewed-by: Lijun Pan Link: https://lore.kernel.org/r/20231211053704.2725417-2-guanjun@linux.alibaba.com Signed-off-by: Vinod Koul drivers/dma/idxd/submit.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit a39b6ac3781d46ba18193c9dbb2110f31e9bffe9 Author: Linus Torvalds Date: Sun Dec 10 14:33:40 2023 -0800 Linux 6.7-rc5 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a66ff26b0f31189e413a87065c25949c359e4bef Author: Kent Overstreet Date: Sun Dec 10 15:23:27 2023 -0500 bcachefs: Close journal entry if necessary when flushing all pins Since outstanding journal buffers hold a journal pin, when flushing all pins we need to close the current journal entry if necessary so its pin can be released. Signed-off-by: Kent Overstreet fs/bcachefs/journal.c | 8 ++++---- fs/bcachefs/journal.h | 1 + fs/bcachefs/journal_io.c | 1 + fs/bcachefs/journal_reclaim.c | 3 +++ 4 files changed, 9 insertions(+), 4 deletions(-) commit 3a87498869d6d1e7347cd01f337a77984604eb5e Merge: 537ccb5d28d6 23ab79e8e469 Author: Linus Torvalds Date: Sun Dec 10 11:09:16 2023 -0800 Merge tag 'sched_urgent_for_v6.7_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Borislav Petkov: - Make sure tasks are thawed exactly and only once to avoid their state getting corrupted * tag 'sched_urgent_for_v6.7_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: freezer,sched: Do not restore saved_state of a thawed task commit 537ccb5d28d6f398215e7f578e46ee7836f5ac47 Merge: 5412fed78487 382c27f4ed28 Author: Linus Torvalds Date: Sun Dec 10 11:03:15 2023 -0800 Merge tag 'perf_urgent_for_v6.7_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf event fix from Borislav Petkov: - Make sure perf event size validation is done on every event in the group * tag 'perf_urgent_for_v6.7_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Fix perf_event_validate_size() commit 5412fed784876892c4d0960f003795b6dbdcfc5a Merge: 0aea22c7ab05 9b8493dc4304 Author: Linus Torvalds Date: Sun Dec 10 10:53:55 2023 -0800 Merge tag 'x86_urgent_for_v6.7_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Add a forgotten CPU vendor check in the AMD microcode post-loading callback so that the callback runs only on AMD - Make sure SEV-ES protocol negotiation happens only once and on the BSP * tag 'x86_urgent_for_v6.7_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU/AMD: Check vendor in the AMD microcode callback x86/sev: Fix kernel crash due to late update to read-only ghcb_version commit 28a7cb045ab700de5554193a1642917602787784 Author: Zhipeng Lu Date: Thu Dec 7 17:49:16 2023 +0800 octeontx2-af: fix a use-after-free in rvu_nix_register_reporters The rvu_dl will be freed in rvu_nix_health_reporters_destroy(rvu_dl) after the create_workqueue fails, and after that free, the rvu_dl will be translate back through the following call chain: rvu_nix_health_reporters_destroy |-> rvu_nix_health_reporters_create |-> rvu_health_reporters_create |-> rvu_register_dl (label err_dl_health) Finally. in the err_dl_health label, rvu_dl being freed again in rvu_health_reporters_destroy(rvu) by rvu_nix_health_reporters_destroy. In the second calls of rvu_nix_health_reporters_destroy, however, it uses rvu_dl->rvu_nix_health_reporter, which is already freed at the end of rvu_nix_health_reporters_destroy in the first call. So this patch prevents the first destroy by instantly returning -ENONMEN when create_workqueue fails. In addition, since the failure of create_workqueue is the only entrence of label err, it has been integrated into the error-handling path of create_workqueue. Fixes: 5ed66306eab6 ("octeontx2-af: Add devlink health reporters for NIX") Signed-off-by: Zhipeng Lu Signed-off-by: David S. Miller drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 0aea22c7ab05f9dfebbccf265a399331435b8938 Merge: c527f5606aa5 4cdf351d3630 Author: Linus Torvalds Date: Sun Dec 10 10:46:46 2023 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Generic: - Set .owner for various KVM file_operations so that files refcount the KVM module until KVM is done executing _all_ code, including the last few instructions of kvm_put_kvm(). And then revert the misguided attempt to rely on "struct kvm" refcounts to pin KVM-the-module. ARM: - Do not redo the mapping of vLPIs, if they have already been mapped s390: - Do not leave bits behind in PTEs - Properly catch page invalidations that affect the prefix of a nested guest x86: - When checking if a _running_ vCPU is "in-kernel", i.e. running at CPL0, get the CPL directly instead of relying on preempted_in_kernel (which is valid if and only if the vCPU was preempted, i.e. NOT running). - Fix a benign "return void" that was recently introduced. Selftests: - Makefile tweak for dependency generation - '-Wformat' fix" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: SVM: Update EFER software model on CR0 trap for SEV-ES KVM: selftests: add -MP to CFLAGS KVM: selftests: Actually print out magic token in NX hugepages skip message KVM: x86: Remove 'return void' expression for 'void function' Revert "KVM: Prevent module exit until all VMs are freed" KVM: Set file_operations.owner appropriately for all such structures KVM: x86: Get CPL directly when checking if loaded vCPU is in kernel mode KVM: arm64: GICv4: Do not perform a map to a mapped vLPI KVM: s390/mm: Properly reset no-dat KVM: s390: vsie: fix wrong VIR 37 when MSO is used commit 9fc95fe95c3e2a63ced8eeca4b256518ab204b63 Author: Radu Bulie Date: Thu Dec 7 16:38:01 2023 +0800 net: fec: correct queue selection The old implementation extracted VLAN TCI info from the payload before the VLAN tag has been pushed in the payload. Another problem was that the VLAN TCI was extracted even if the packet did not have VLAN protocol header. This resulted in invalid VLAN TCI and as a consequence a random queue was computed. This patch fixes the above issues and use the VLAN TCI from the skb if it is present or VLAN TCI from payload if present. If no VLAN header is present queue 0 is selected. Fixes: 52c4a1a85f4b ("net: fec: add ndo_select_queue to fix TX bandwidth fluctuations") Signed-off-by: Radu Bulie Signed-off-by: Wei Fang Signed-off-by: David S. Miller drivers/net/ethernet/freescale/fec_main.c | 27 +++++++++++---------------- 1 file changed, 11 insertions(+), 16 deletions(-) commit 4a147af2081070218a4c66523c584e198994528e Author: Kent Overstreet Date: Sun Dec 10 12:21:42 2023 -0500 bcachefs: Fix uninitialized var in bch2_journal_replay() Signed-off-by: Kent Overstreet fs/bcachefs/recovery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e9b220aeacf109684cce36a94fc24ed37be92b05 Author: Benjamin Bigler Date: Sat Dec 9 23:23:26 2023 +0100 spi: spi-imx: correctly configure burst length when using dma If DMA is used, burst length should be set to the bus width of the DMA. Otherwise, the SPI hardware will transmit/receive one word per DMA request. Since this issue affects both transmission and reception, it cannot be detected with a loopback test. Replace magic numbers 512 and 0xfff with MX51_ECSPI_CTRL_MAX_BURST. Reported-by Stefan Bigler Signed-off-by: Benjamin Bigler Fixes: 15a6af94a277 ("spi: Increase imx51 ecspi burst length based on transfer length") Link: https://lore.kernel.org/r/8a415902c751cdbb4b20ce76569216ed@mail.infomaniak.com Link: https://lore.kernel.org/r/20231209222338.5564-1-benjamin@bigler.one Signed-off-by: Mark Brown drivers/spi/spi-imx.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit 75a25d31b80770485641ad2789a854955f5c1e40 Author: Gergo Koteles Date: Sat Dec 9 22:18:29 2023 +0100 ALSA: hda/tas2781: leave hda_component in usable state Unloading then loading the module causes a NULL ponter dereference. The hda_unbind zeroes the hda_component, later the hda_bind tries to dereference the codec field. The hda_component is only initialized once by tas2781_generic_fixup. Set only previously modified fields to NULL. BUG: kernel NULL pointer dereference, address: 0000000000000322 Call Trace: ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? exc_page_fault+0x7f/0x180 ? asm_exc_page_fault+0x26/0x30 ? tas2781_hda_bind+0x59/0x140 [snd_hda_scodec_tas2781_i2c] component_bind_all+0xf3/0x240 try_to_bring_up_aggregate_device+0x1c3/0x270 __component_add+0xbc/0x1a0 tas2781_hda_i2c_probe+0x289/0x3a0 [snd_hda_scodec_tas2781_i2c] i2c_device_probe+0x136/0x2e0 Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver") Cc: stable@vger.kernel.org Signed-off-by: Gergo Koteles Link: https://lore.kernel.org/r/8b8ed2bd5f75fbb32e354a3226c2f966fa85b46b.1702156522.git.soyer@irl.hu Signed-off-by: Takashi Iwai sound/pci/hda/tas2781_hda_i2c.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 9b726bf6ae11add6a7a52883a21f90ff9cbca916 Author: Hartmut Knaack Date: Sat Dec 9 15:47:07 2023 +0100 ALSA: hda/realtek: Apply mute LED quirk for HP15-db The HP laptop 15-db0403ng uses the ALC236 codec and controls the mute LED using COEF 0x07 index 1. Sound card subsystem: Hewlett-Packard Company Device [103c:84ae] Use the existing quirk for this model. Signed-off-by: Hartmut Knaack Cc: Link: https://lore.kernel.org/r/e61815d0-f1c7-b164-e49d-6ca84771476a@gmx.de Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 924f5ca2975b2993ee81a7ecc3c809943a70f334 Author: Kai Vehmanen Date: Fri Dec 8 15:21:27 2023 +0200 ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants On ASUSTeK Z170M PLUS and Z170 PRO GAMING systems, the display codec pins are not registered properly without the force-connect quirk. The codec will report only one pin as having external connectivity, but i915 finds all three connectors on the system, so the two drivers are not in sync. Issue found with DRM igt-gpu-tools test kms_hdmi_inject@inject-audio. Link: https://gitlab.freedesktop.org/drm/intel/-/issues/9801 Cc: Ville Syrjälä Cc: Jani Saarinen Signed-off-by: Kai Vehmanen Cc: Link: https://lore.kernel.org/r/20231208132127.2438067-3-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_hdmi.c | 2 ++ 1 file changed, 2 insertions(+) commit 3b1ff57e24a7bcd2e2a8426dd2013a80d1fa96eb Author: Kai Vehmanen Date: Fri Dec 8 15:21:26 2023 +0200 ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB Add one more older NUC model that requires quirk to force all pins to be connected. The display codec pins are not registered properly without the force-connect quirk. The codec will report only one pin as having external connectivity, but i915 finds all three connectors on the system, so the two drivers are not in sync. Issue found with DRM igt-gpu-tools test kms_hdmi_inject@inject-audio. Link: https://gitlab.freedesktop.org/drm/igt-gpu-tools/-/issues/3 Cc: Ville Syrjälä Cc: Jani Saarinen Signed-off-by: Kai Vehmanen Cc: Link: https://lore.kernel.org/r/20231208132127.2438067-2-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_hdmi.c | 1 + 1 file changed, 1 insertion(+) commit c527f5606aa545233a4d2c6d5c636ed82b8633ef Merge: 99d4cf765955 4b3338aaa74d Author: Linus Torvalds Date: Sat Dec 9 19:32:35 2023 -0800 Merge tag 'powerpc-6.7-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fix from Michael Ellerman: - Fix stack teardown in ftrace_no_trace, seen as crashes doing CPU hotplug while ftrace is active. Thanks to Naveen N Rao. * tag 'powerpc-6.7-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/ftrace: Fix stack teardown in ftrace_no_trace commit 99d4cf7659554c2c9c5e4c0808782759b7d32bbd Merge: 21b73ffcc62a 95dd1e34ff5b Author: Linus Torvalds Date: Sat Dec 9 19:21:44 2023 -0800 Merge tag 'gpio-fixes-for-v6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fix from Bartosz Golaszewski: - fix an error path after a failed export in sysfs code * tag 'gpio-fixes-for-v6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: sysfs: Fix error handling on failed export commit 69db702c83874fbaa2a51af761e35a8e5a593b95 Author: Pavel Begunkov Date: Wed Dec 6 13:55:19 2023 +0000 io_uring/af_unix: disable sending io_uring over sockets File reference cycles have caused lots of problems for io_uring in the past, and it still doesn't work exactly right and races with unix_stream_read_generic(). The safest fix would be to completely disallow sending io_uring files via sockets via SCM_RIGHT, so there are no possible cycles invloving registered files and thus rendering SCM accounting on the io_uring side unnecessary. Cc: stable@vger.kernel.org Fixes: 0091bfc81741b ("io_uring/af_unix: defer registered files gc to io_uring release") Reported-and-suggested-by: Jann Horn Signed-off-by: Pavel Begunkov Acked-by: Jakub Kicinski Signed-off-by: David S. Miller io_uring/rsrc.h | 7 ------- net/core/scm.c | 6 ++++++ 2 files changed, 6 insertions(+), 7 deletions(-) commit 15319a4e8ee4b098118591c6ccbd17237f841613 Author: Chengfeng Ye Date: Thu Dec 7 12:34:53 2023 +0000 atm: solos-pci: Fix potential deadlock on &tx_queue_lock As &card->tx_queue_lock is acquired under softirq context along the following call chain from solos_bh(), other acquisition of the same lock inside process context should disable at least bh to avoid double lock. pclose() --> spin_lock(&card->tx_queue_lock) --> solos_bh() --> fpga_tx() --> spin_lock(&card->tx_queue_lock) This flaw was found by an experimental static analysis tool I am developing for irq-related deadlock. To prevent the potential deadlock, the patch uses spin_lock_bh() on &card->tx_queue_lock under process context code consistently to prevent the possible deadlock scenario. Fixes: 213e85d38912 ("solos-pci: clean up pclose() function") Signed-off-by: Chengfeng Ye Signed-off-by: David S. Miller drivers/atm/solos-pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d5dba32b8f6cb39be708b726044ba30dbc088b30 Author: Chengfeng Ye Date: Thu Dec 7 12:34:37 2023 +0000 atm: solos-pci: Fix potential deadlock on &cli_queue_lock As &card->cli_queue_lock is acquired under softirq context along the following call chain from solos_bh(), other acquisition of the same lock inside process context should disable at least bh to avoid double lock. console_show() --> spin_lock(&card->cli_queue_lock) --> solos_bh() --> spin_lock(&card->cli_queue_lock) This flaw was found by an experimental static analysis tool I am developing for irq-related deadlock. To prevent the potential deadlock, the patch uses spin_lock_bh() on the card->cli_queue_lock under process context code consistently to prevent the possible deadlock scenario. Fixes: 9c54004ea717 ("atm: Driver for Solos PCI ADSL2+ card.") Signed-off-by: Chengfeng Ye Signed-off-by: David S. Miller drivers/atm/solos-pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 21b73ffcc62ab772bc06e3e90bd87eff5e9e8ed4 Merge: 0b5260904b7d 61890dc28f7d Author: Linus Torvalds Date: Sat Dec 9 12:54:58 2023 -0800 Merge tag 'usb-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes for 6.7-rc5 to resolve some reported issues. Included in here are: - usb gadget f_hid, and uevent fix - xhci driver revert to resolve a much-reported issue - typec driver fix All of these have been in linux-next with no reported issues" * tag 'usb-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: gadget: f_hid: fix report descriptor allocation Revert "xhci: Loosen RPM as default policy to cover for AMD xHC 1.1" usb: typec: class: fix typec_altmode_put_partner to put plugs USB: gadget: core: adjust uevent timing on gadget unbind commit 0b5260904b7d2f55e8c4a6ac9f32e7387dc55a75 Merge: ca20f1622b0c e92fad024929 Author: Linus Torvalds Date: Sat Dec 9 12:49:22 2023 -0800 Merge tag 'tty-6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull serial driver fixes from Greg KH: "Here are some small serial driver fixes for 6.7-rc4 to resolve some reported issues. Included in here are: - pl011 dma support fix - sc16is7xx driver fix - ma35d1 console index fix - 8250 driver fixes for small issues All of these have been in linux-next with no reported issues" * tag 'tty-6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: 8250_dw: Add ACPI ID for Granite Rapids-D UART serial: ma35d1: Validate console index before assignment ARM: PL011: Fix DMA support serial: sc16is7xx: address RX timeout interrupt errata serial: 8250: 8250_omap: Clear UART_HAS_RHR_IT_DIS bit serial: 8250_omap: Add earlycon support for the AM654 UART controller serial: 8250: 8250_omap: Do not start RX DMA on THRI interrupt commit ca20f1622b0cb21853c41d2c264fafa88ebba7c0 Merge: b10a3ccaf6e3 b7c1e53751cb Author: Linus Torvalds Date: Sat Dec 9 12:44:10 2023 -0800 Merge tag 'char-misc-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc driver fixes from Greg KH: "Here are some small fixes for 6.7-rc5 for a variety of small driver subsystems. Included in here are: - debugfs revert for reported issue - greybus revert for reported issue - greybus fixup for endian build warning - coresight driver fixes - nvmem driver fixes - devcoredump fix - parport new device id - ndtest build fix All of these have ben in linux-next with no reported issues" * tag 'char-misc-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: nvmem: Do not expect fixed layouts to grab a layout driver parport: Add support for Brainboxes IX/UC/PX parallel cards Revert "greybus: gb-beagleplay: Ensure le for values in transport" greybus: gb-beagleplay: Ensure le for values in transport greybus: BeaglePlay driver needs CRC_CCITT Revert "debugfs: annotate debugfs handlers vs. removal with lockdep" devcoredump: Send uevent once devcd is ready ndtest: fix typo class_regster -> class_register misc: mei: client.c: fix problem of return '-EOVERFLOW' in mei_cl_write misc: mei: client.c: return negative error code in mei_cl_write mei: pxp: fix mei_pxp_send_message return value coresight: ultrasoc-smb: Fix uninitialized before use buf_hw_base coresight: ultrasoc-smb: Config SMB buffer before register sink coresight: ultrasoc-smb: Fix sleep while close preempt in enable_smb Documentation: coresight: fix `make refcheckdocs` warning hwtracing: hisi_ptt: Don't try to attach a task hwtracing: hisi_ptt: Handle the interrupt in hardirq context hwtracing: hisi_ptt: Add dummy callback pmu::read() coresight: Fix crash when Perf and sysfs modes are used concurrently coresight: etm4x: Remove bogous __exit annotation for some functions commit b10a3ccaf6e39f6290ca29d7c24604082eacaea0 Merge: b8503b215789 e2f7b3d8b4b3 Author: Linus Torvalds Date: Sat Dec 9 12:25:56 2023 -0800 Merge tag 'loongarch-fixes-6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Preserve syscall nr across execve(), slightly clean up drdtime(), fix the Clang built zboot kernel, fix a stack unwinder bug and several bpf jit bugs" * tag 'loongarch-fixes-6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: BPF: Fix unconditional bswap instructions LoongArch: BPF: Fix sign-extension mov instructions LoongArch: BPF: Don't sign extend function return value LoongArch: BPF: Don't sign extend memory load operand LoongArch: Preserve syscall nr across execve() LoongArch: Set unwind stack type to unknown rather than set error flag LoongArch: Slightly clean up drdtime() LoongArch: Apply dynamic relocations for LLD commit b8503b215789628d3625ef6aa252f323e32be929 Merge: 9d3bc457a24f a58a173444a6 Author: Linus Torvalds Date: Sat Dec 9 12:22:20 2023 -0800 Merge tag 'mips-fixes_6.7_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Thomas Bogendoerfer: - Fixes for broken Loongson firmware - Fix lockdep splat - Fix FPU states when creating kernel threads * tag 'mips-fixes_6.7_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: kernel: Clear FPU states when setting up kernel threads MIPS: Loongson64: Handle more memory types passed from firmware MIPS: Loongson64: Enable DMA noncoherent support MIPS: Loongson64: Reserve vgabios memory on boot mips/smp: Call rcutree_report_cpu_starting() earlier commit 9d3bc457a24f837604e45729285e9ceba757b508 Merge: 2099306c4e1d b16937474874 Author: Linus Torvalds Date: Sat Dec 9 12:16:50 2023 -0800 Merge tag 'perf-tools-fixes-for-v6.7-2-2023-12-08' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Namhyung Kim: "A random set of small bug fixes including: - Fix segfault on AmpereOne due to missing default metricgroup name - Fix segfault on `perf list --json` due to NULL pointer" * tag 'perf-tools-fixes-for-v6.7-2-2023-12-08' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf list: Fix JSON segfault by setting the used skip_duplicate_pmus callback perf vendor events arm64: AmpereOne: Add missing DefaultMetricgroupName fields perf metrics: Avoid segv if default metricgroup isn't set commit 2099306c4e1d5d772b150aeac68fdd1d0331b09d Merge: f2e8a57ee903 04909192ada3 Author: Linus Torvalds Date: Sat Dec 9 12:10:56 2023 -0800 Merge tag '6.7-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: "Six smb3 client fixes: - Fixes for copy_file_range and clone (cache invalidation and file size), also addresses an xfstest failure - Fix to return proper error if REMAP_FILE_DEDUP set (also fixes xfstest generic/304) - Fix potential null pointer reference with DFS - Multichannel fix addressing (reverting an earlier patch) some of the problems with enabling/disabling channels dynamically Still working on a followon multichannel fix to address another issue found in reconnect testing that will send next week" * tag '6.7-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: reconnect worker should take reference on server struct unconditionally Revert "cifs: reconnect work should have reference on server struct" cifs: Fix non-availability of dedup breaking generic/304 smb: client: fix potential NULL deref in parse_dfs_referrals() cifs: Fix flushing, invalidation and file size with FICLONE cifs: Fix flushing, invalidation and file size with copy_file_range() commit e2f7b3d8b4b300956a77fa1ab084c931ba1c7421 Author: Tiezhu Yang Date: Sat Dec 9 15:49:16 2023 +0800 LoongArch: BPF: Fix unconditional bswap instructions We can see that "bswap32: Takes an unsigned 32-bit number in either big- or little-endian format and returns the equivalent number with the same bit width but opposite endianness" in BPF Instruction Set Specification, so it should clear the upper 32 bits in "case 32:" for both BPF_ALU and BPF_ALU64. [root@linux fedora]# echo 1 > /proc/sys/net/core/bpf_jit_enable [root@linux fedora]# modprobe test_bpf Before: test_bpf: #313 BSWAP 32: 0x0123456789abcdef -> 0xefcdab89 jited:1 ret 1460850314 != -271733879 (0x5712ce8a != 0xefcdab89)FAIL (1 times) test_bpf: #317 BSWAP 32: 0xfedcba9876543210 -> 0x10325476 jited:1 ret -1460850316 != 271733878 (0xa8ed3174 != 0x10325476)FAIL (1 times) After: test_bpf: #313 BSWAP 32: 0x0123456789abcdef -> 0xefcdab89 jited:1 4 PASS test_bpf: #317 BSWAP 32: 0xfedcba9876543210 -> 0x10325476 jited:1 4 PASS Fixes: 4ebf9216e7df ("LoongArch: BPF: Support unconditional bswap instructions") Acked-by: Hengqi Chen Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen arch/loongarch/net/bpf_jit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 772cbe948fb07389639d4e698a2d3299f8e538b8 Author: Tiezhu Yang Date: Sat Dec 9 15:49:16 2023 +0800 LoongArch: BPF: Fix sign-extension mov instructions We can see that "Short form of movsx, dst_reg = (s8,s16,s32)src_reg" in include/linux/filter.h, additionally, for BPF_ALU64 the value of the destination register is unchanged whereas for BPF_ALU the upper 32 bits of the destination register are zeroed, so it should clear the upper 32 bits for BPF_ALU. [root@linux fedora]# echo 1 > /proc/sys/net/core/bpf_jit_enable [root@linux fedora]# modprobe test_bpf Before: test_bpf: #81 ALU_MOVSX | BPF_B jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times) test_bpf: #82 ALU_MOVSX | BPF_H jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times) After: test_bpf: #81 ALU_MOVSX | BPF_B jited:1 6 PASS test_bpf: #82 ALU_MOVSX | BPF_H jited:1 6 PASS By the way, the bpf selftest case "./test_progs -t verifier_movsx" can also be fixed with this patch. Fixes: f48012f16150 ("LoongArch: BPF: Support sign-extension mov instructions") Acked-by: Hengqi Chen Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen arch/loongarch/net/bpf_jit.c | 2 ++ 1 file changed, 2 insertions(+) commit 5d47ec2e6f4c64e30e392cfe9532df98c9beb106 Author: Hengqi Chen Date: Sat Dec 9 15:49:16 2023 +0800 LoongArch: BPF: Don't sign extend function return value The `cls_redirect` test triggers a kernel panic like: # ./test_progs -t cls_redirect Can't find bpf_testmod.ko kernel module: -2 WARNING! Selftests relying on bpf_testmod.ko will be skipped. [ 30.938489] CPU 3 Unable to handle kernel paging request at virtual address fffffffffd814de0, era == ffff800002009fb8, ra == ffff800002009f9c [ 30.939331] Oops[#1]: [ 30.939513] CPU: 3 PID: 1260 Comm: test_progs Not tainted 6.7.0-rc2-loong-devel-g2f56bb0d2327 #35 a896aca3f4164f09cc346f89f2e09832e07be5f6 [ 30.939732] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022 [ 30.939901] pc ffff800002009fb8 ra ffff800002009f9c tp 9000000104da4000 sp 9000000104da7ab0 [ 30.940038] a0 fffffffffd814de0 a1 9000000104da7a68 a2 0000000000000000 a3 9000000104da7c10 [ 30.940183] a4 9000000104da7c14 a5 0000000000000002 a6 0000000000000021 a7 00005555904d7f90 [ 30.940321] t0 0000000000000110 t1 0000000000000000 t2 fffffffffd814de0 t3 0004c4b400000000 [ 30.940456] t4 ffffffffffffffff t5 00000000c3f63600 t6 0000000000000000 t7 0000000000000000 [ 30.940590] t8 000000000006d803 u0 0000000000000020 s9 9000000104da7b10 s0 900000010504c200 [ 30.940727] s1 fffffffffd814de0 s2 900000010504c200 s3 9000000104da7c10 s4 9000000104da7ad0 [ 30.940866] s5 0000000000000000 s6 90000000030e65bc s7 9000000104da7b44 s8 90000000044f6fc0 [ 30.941015] ra: ffff800002009f9c bpf_prog_846803e5ae81417f_cls_redirect+0xa0/0x590 [ 30.941535] ERA: ffff800002009fb8 bpf_prog_846803e5ae81417f_cls_redirect+0xbc/0x590 [ 30.941696] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [ 30.942224] PRMD: 00000004 (PPLV0 +PIE -PWE) [ 30.942330] EUEN: 00000003 (+FPE +SXE -ASXE -BTE) [ 30.942453] ECFG: 00071c1c (LIE=2-4,10-12 VS=7) [ 30.942612] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) [ 30.942764] BADV: fffffffffd814de0 [ 30.942854] PRID: 0014c010 (Loongson-64bit, Loongson-3A5000) [ 30.942974] Modules linked in: [ 30.943078] Process test_progs (pid: 1260, threadinfo=00000000ce303226, task=000000007d10bb76) [ 30.943306] Stack : 900000010a064000 90000000044f6fc0 9000000104da7b48 0000000000000000 [ 30.943495] 0000000000000000 9000000104da7c14 9000000104da7c10 900000010504c200 [ 30.943626] 0000000000000001 ffff80001b88c000 9000000104da7b70 90000000030e6668 [ 30.943785] 0000000000000000 9000000104da7b58 ffff80001b88c048 9000000003d05000 [ 30.943936] 900000000303ac88 0000000000000000 0000000000000000 9000000104da7b70 [ 30.944091] 0000000000000000 0000000000000001 0000000731eeab00 0000000000000000 [ 30.944245] ffff80001b88c000 0000000000000000 0000000000000000 54b99959429f83b8 [ 30.944402] ffff80001b88c000 90000000044f6fc0 9000000101d70000 ffff80001b88c000 [ 30.944538] 000000000000005a 900000010504c200 900000010a064000 900000010a067000 [ 30.944697] 9000000104da7d88 0000000000000000 9000000003d05000 90000000030e794c [ 30.944852] ... [ 30.944924] Call Trace: [ 30.945120] [] bpf_prog_846803e5ae81417f_cls_redirect+0xbc/0x590 [ 30.945650] [<90000000030e6668>] bpf_test_run+0x1ec/0x2f8 [ 30.945958] [<90000000030e794c>] bpf_prog_test_run_skb+0x31c/0x684 [ 30.946065] [<90000000026d4f68>] __sys_bpf+0x678/0x2724 [ 30.946159] [<90000000026d7288>] sys_bpf+0x20/0x2c [ 30.946253] [<90000000032dd224>] do_syscall+0x7c/0x94 [ 30.946343] [<9000000002541c5c>] handle_syscall+0xbc/0x158 [ 30.946492] [ 30.946549] Code: 0015030e 5c0009c0 5001d000 <28c00304> 02c00484 29c00304 00150009 2a42d2e4 0280200d [ 30.946793] [ 30.946971] ---[ end trace 0000000000000000 ]--- [ 32.093225] Kernel panic - not syncing: Fatal exception in interrupt [ 32.093526] Kernel relocated by 0x2320000 [ 32.093630] .text @ 0x9000000002520000 [ 32.093725] .data @ 0x9000000003400000 [ 32.093792] .bss @ 0x9000000004413200 [ 34.971998] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- This is because we signed-extend function return values. When subprog mode is enabled, we have: cls_redirect() -> get_global_metrics() returns pcpu ptr 0xfffffefffc00b480 The pointer returned is later signed-extended to 0xfffffffffc00b480 at `BPF_JMP | BPF_EXIT`. During BPF prog run, this triggers unhandled page fault and a kernel panic. Drop the unnecessary signed-extension on return values like other architectures do. With this change, we have: # ./test_progs -t cls_redirect Can't find bpf_testmod.ko kernel module: -2 WARNING! Selftests relying on bpf_testmod.ko will be skipped. #51/1 cls_redirect/cls_redirect_inlined:OK #51/2 cls_redirect/IPv4 TCP accept unknown (no hops, flags: SYN):OK #51/3 cls_redirect/IPv6 TCP accept unknown (no hops, flags: SYN):OK #51/4 cls_redirect/IPv4 TCP accept unknown (no hops, flags: ACK):OK #51/5 cls_redirect/IPv6 TCP accept unknown (no hops, flags: ACK):OK #51/6 cls_redirect/IPv4 TCP forward unknown (one hop, flags: ACK):OK #51/7 cls_redirect/IPv6 TCP forward unknown (one hop, flags: ACK):OK #51/8 cls_redirect/IPv4 TCP accept known (one hop, flags: ACK):OK #51/9 cls_redirect/IPv6 TCP accept known (one hop, flags: ACK):OK #51/10 cls_redirect/IPv4 UDP accept unknown (no hops, flags: none):OK #51/11 cls_redirect/IPv6 UDP accept unknown (no hops, flags: none):OK #51/12 cls_redirect/IPv4 UDP forward unknown (one hop, flags: none):OK #51/13 cls_redirect/IPv6 UDP forward unknown (one hop, flags: none):OK #51/14 cls_redirect/IPv4 UDP accept known (one hop, flags: none):OK #51/15 cls_redirect/IPv6 UDP accept known (one hop, flags: none):OK #51/16 cls_redirect/cls_redirect_subprogs:OK #51/17 cls_redirect/IPv4 TCP accept unknown (no hops, flags: SYN):OK #51/18 cls_redirect/IPv6 TCP accept unknown (no hops, flags: SYN):OK #51/19 cls_redirect/IPv4 TCP accept unknown (no hops, flags: ACK):OK #51/20 cls_redirect/IPv6 TCP accept unknown (no hops, flags: ACK):OK #51/21 cls_redirect/IPv4 TCP forward unknown (one hop, flags: ACK):OK #51/22 cls_redirect/IPv6 TCP forward unknown (one hop, flags: ACK):OK #51/23 cls_redirect/IPv4 TCP accept known (one hop, flags: ACK):OK #51/24 cls_redirect/IPv6 TCP accept known (one hop, flags: ACK):OK #51/25 cls_redirect/IPv4 UDP accept unknown (no hops, flags: none):OK #51/26 cls_redirect/IPv6 UDP accept unknown (no hops, flags: none):OK #51/27 cls_redirect/IPv4 UDP forward unknown (one hop, flags: none):OK #51/28 cls_redirect/IPv6 UDP forward unknown (one hop, flags: none):OK #51/29 cls_redirect/IPv4 UDP accept known (one hop, flags: none):OK #51/30 cls_redirect/IPv6 UDP accept known (one hop, flags: none):OK #51/31 cls_redirect/cls_redirect_dynptr:OK #51/32 cls_redirect/IPv4 TCP accept unknown (no hops, flags: SYN):OK #51/33 cls_redirect/IPv6 TCP accept unknown (no hops, flags: SYN):OK #51/34 cls_redirect/IPv4 TCP accept unknown (no hops, flags: ACK):OK #51/35 cls_redirect/IPv6 TCP accept unknown (no hops, flags: ACK):OK #51/36 cls_redirect/IPv4 TCP forward unknown (one hop, flags: ACK):OK #51/37 cls_redirect/IPv6 TCP forward unknown (one hop, flags: ACK):OK #51/38 cls_redirect/IPv4 TCP accept known (one hop, flags: ACK):OK #51/39 cls_redirect/IPv6 TCP accept known (one hop, flags: ACK):OK #51/40 cls_redirect/IPv4 UDP accept unknown (no hops, flags: none):OK #51/41 cls_redirect/IPv6 UDP accept unknown (no hops, flags: none):OK #51/42 cls_redirect/IPv4 UDP forward unknown (one hop, flags: none):OK #51/43 cls_redirect/IPv6 UDP forward unknown (one hop, flags: none):OK #51/44 cls_redirect/IPv4 UDP accept known (one hop, flags: none):OK #51/45 cls_redirect/IPv6 UDP accept known (one hop, flags: none):OK #51 cls_redirect:OK Summary: 1/45 PASSED, 0 SKIPPED, 0 FAILED Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support") Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen arch/loongarch/net/bpf_jit.c | 2 -- 1 file changed, 2 deletions(-) commit fe5757553bf9ebe45ae8ecab5922f6937c8d8dfc Author: Hengqi Chen Date: Sat Dec 9 15:49:16 2023 +0800 LoongArch: BPF: Don't sign extend memory load operand The `cgrp_local_storage` test triggers a kernel panic like: # ./test_progs -t cgrp_local_storage Can't find bpf_testmod.ko kernel module: -2 WARNING! Selftests relying on bpf_testmod.ko will be skipped. [ 550.930632] CPU 1 Unable to handle kernel paging request at virtual address 0000000000000080, era == ffff80000200be34, ra == ffff80000200be00 [ 550.931781] Oops[#1]: [ 550.931966] CPU: 1 PID: 1303 Comm: test_progs Not tainted 6.7.0-rc2-loong-devel-g2f56bb0d2327 #35 a896aca3f4164f09cc346f89f2e09832e07be5f6 [ 550.932215] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022 [ 550.932403] pc ffff80000200be34 ra ffff80000200be00 tp 9000000108350000 sp 9000000108353dc0 [ 550.932545] a0 0000000000000000 a1 0000000000000517 a2 0000000000000118 a3 00007ffffbb15558 [ 550.932682] a4 00007ffffbb15620 a5 90000001004e7700 a6 0000000000000021 a7 0000000000000118 [ 550.932824] t0 ffff80000200bdc0 t1 0000000000000517 t2 0000000000000517 t3 00007ffff1c06ee0 [ 550.932961] t4 0000555578ae04d0 t5 fffffffffffffff8 t6 0000000000000004 t7 0000000000000020 [ 550.933097] t8 0000000000000040 u0 00000000000007b8 s9 9000000108353e00 s0 90000001004e7700 [ 550.933241] s1 9000000004005000 s2 0000000000000001 s3 0000000000000000 s4 0000555555eb2ec8 [ 550.933379] s5 00007ffffbb15bb8 s6 00007ffff1dafd60 s7 000055555663f610 s8 00007ffff1db0050 [ 550.933520] ra: ffff80000200be00 bpf_prog_98f1b9e767be2a84_on_enter+0x40/0x200 [ 550.933911] ERA: ffff80000200be34 bpf_prog_98f1b9e767be2a84_on_enter+0x74/0x200 [ 550.934105] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [ 550.934596] PRMD: 00000004 (PPLV0 +PIE -PWE) [ 550.934712] EUEN: 00000003 (+FPE +SXE -ASXE -BTE) [ 550.934836] ECFG: 00071c1c (LIE=2-4,10-12 VS=7) [ 550.934976] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) [ 550.935097] BADV: 0000000000000080 [ 550.935181] PRID: 0014c010 (Loongson-64bit, Loongson-3A5000) [ 550.935291] Modules linked in: [ 550.935391] Process test_progs (pid: 1303, threadinfo=000000006c3b1c41, task=0000000061f84a55) [ 550.935643] Stack : 00007ffffbb15bb8 0000555555eb2ec8 0000000000000000 0000000000000001 [ 550.935844] 9000000004005000 ffff80001b864000 00007ffffbb15450 90000000029aa034 [ 550.935990] 0000000000000000 9000000108353ec0 0000000000000118 d07d9dfb09721a09 [ 550.936175] 0000000000000001 0000000000000000 9000000108353ec0 0000000000000118 [ 550.936314] 9000000101d46ad0 900000000290abf0 000055555663f610 0000000000000000 [ 550.936479] 0000000000000003 9000000108353ec0 00007ffffbb15450 90000000029d7288 [ 550.936635] 00007ffff1dafd60 000055555663f610 0000000000000000 0000000000000003 [ 550.936779] 9000000108353ec0 90000000035dd1f0 00007ffff1dafd58 9000000002841c5c [ 550.936939] 0000000000000119 0000555555eea5a8 00007ffff1d78780 00007ffffbb153e0 [ 550.937083] ffffffffffffffda 00007ffffbb15518 0000000000000040 00007ffffbb15558 [ 550.937224] ... [ 550.937299] Call Trace: [ 550.937521] [] bpf_prog_98f1b9e767be2a84_on_enter+0x74/0x200 [ 550.937910] [<90000000029aa034>] bpf_trace_run2+0x90/0x154 [ 550.938105] [<900000000290abf0>] syscall_trace_enter.isra.0+0x1cc/0x200 [ 550.938224] [<90000000035dd1f0>] do_syscall+0x48/0x94 [ 550.938319] [<9000000002841c5c>] handle_syscall+0xbc/0x158 [ 550.938477] [ 550.938607] Code: 580009ae 50016000 262402e4 <28c20085> 14092084 03a00084 16000024 03240084 00150006 [ 550.938851] [ 550.939021] ---[ end trace 0000000000000000 ]--- Further investigation shows that this panic is triggered by memory load operations: ptr = bpf_cgrp_storage_get(&map_a, task->cgroups->dfl_cgrp, 0, BPF_LOCAL_STORAGE_GET_F_CREATE); The expression `task->cgroups->dfl_cgrp` involves two memory load. Since the field offset fits in imm12 or imm14, we use ldd or ldptrd instructions. But both instructions have the side effect that it will signed-extended the imm operand. Finally, we got the wrong addresses and panics is inevitable. Use a generic ldxd instruction to avoid this kind of issues. With this change, we have: # ./test_progs -t cgrp_local_storage Can't find bpf_testmod.ko kernel module: -2 WARNING! Selftests relying on bpf_testmod.ko will be skipped. test_cgrp_local_storage:PASS:join_cgroup /cgrp_local_storage 0 nsec #48/1 cgrp_local_storage/tp_btf:OK test_attach_cgroup:PASS:skel_open 0 nsec test_attach_cgroup:PASS:prog_attach 0 nsec test_attach_cgroup:PASS:prog_attach 0 nsec libbpf: prog 'update_cookie_tracing': failed to attach: ERROR: strerror_r(-524)=22 test_attach_cgroup:FAIL:prog_attach unexpected error: -524 #48/2 cgrp_local_storage/attach_cgroup:FAIL test_recursion:PASS:skel_open_and_load 0 nsec libbpf: prog 'on_lookup': failed to attach: ERROR: strerror_r(-524)=22 libbpf: prog 'on_lookup': failed to auto-attach: -524 test_recursion:FAIL:skel_attach unexpected error: -524 (errno 524) #48/3 cgrp_local_storage/recursion:FAIL #48/4 cgrp_local_storage/negative:OK #48/5 cgrp_local_storage/cgroup_iter_sleepable:OK test_yes_rcu_lock:PASS:skel_open 0 nsec test_yes_rcu_lock:PASS:skel_load 0 nsec libbpf: prog 'yes_rcu_lock': failed to attach: ERROR: strerror_r(-524)=22 libbpf: prog 'yes_rcu_lock': failed to auto-attach: -524 test_yes_rcu_lock:FAIL:skel_attach unexpected error: -524 (errno 524) #48/6 cgrp_local_storage/yes_rcu_lock:FAIL #48/7 cgrp_local_storage/no_rcu_lock:OK #48 cgrp_local_storage:FAIL All error logs: test_cgrp_local_storage:PASS:join_cgroup /cgrp_local_storage 0 nsec test_attach_cgroup:PASS:skel_open 0 nsec test_attach_cgroup:PASS:prog_attach 0 nsec test_attach_cgroup:PASS:prog_attach 0 nsec libbpf: prog 'update_cookie_tracing': failed to attach: ERROR: strerror_r(-524)=22 test_attach_cgroup:FAIL:prog_attach unexpected error: -524 #48/2 cgrp_local_storage/attach_cgroup:FAIL test_recursion:PASS:skel_open_and_load 0 nsec libbpf: prog 'on_lookup': failed to attach: ERROR: strerror_r(-524)=22 libbpf: prog 'on_lookup': failed to auto-attach: -524 test_recursion:FAIL:skel_attach unexpected error: -524 (errno 524) #48/3 cgrp_local_storage/recursion:FAIL test_yes_rcu_lock:PASS:skel_open 0 nsec test_yes_rcu_lock:PASS:skel_load 0 nsec libbpf: prog 'yes_rcu_lock': failed to attach: ERROR: strerror_r(-524)=22 libbpf: prog 'yes_rcu_lock': failed to auto-attach: -524 test_yes_rcu_lock:FAIL:skel_attach unexpected error: -524 (errno 524) #48/6 cgrp_local_storage/yes_rcu_lock:FAIL #48 cgrp_local_storage:FAIL Summary: 0/4 PASSED, 0 SKIPPED, 1 FAILED No panics any more (The test still failed because lack of BPF trampoline which I am actively working on). Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support") Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen arch/loongarch/net/bpf_jit.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) commit d6c5f06e46a836e6a70c7cfd95bb38a67d9252ec Author: Hengqi Chen Date: Sat Dec 9 15:49:15 2023 +0800 LoongArch: Preserve syscall nr across execve() Currently, we store syscall nr in pt_regs::regs[11] and syscall execve() accidentally overrides it during its execution: sys_execve() -> do_execve() -> do_execveat_common() -> bprm_execve() -> exec_binprm() -> search_binary_handler() -> load_elf_binary() -> ELF_PLAT_INIT() ELF_PLAT_INIT() reset regs[11] to 0, so in syscall_exit_to_user_mode() we later get a wrong syscall nr. This breaks tools like execsnoop since it relies on execve() tracepoints. Skip pt_regs::regs[11] reset in ELF_PLAT_INIT() to fix the issue. Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen arch/loongarch/include/asm/elf.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 97ceddbc9404a7d1e2c4049435bff29427d762cc Author: Jinyang He Date: Sat Dec 9 15:49:15 2023 +0800 LoongArch: Set unwind stack type to unknown rather than set error flag During unwinding, unwind_done() is used as an end condition. Normally it unwind to the user stack and then set the stack type to unknown, which is a normal exit. When something unexpected happens in unwind process and we cannot unwind anymore, we should set the error flag, and also set the stack type to unknown to indicate that the unwind process can not continue. The error flag emphasizes that the unwind process produce an unexpected error. There is no unexpected things when we unwind the PT_REGS in the top of IRQ stack and find out that is an user mode PT_REGS. Thus, we should not set error flag and just set stack type to unknown. Reported-by: Hengqi Chen Acked-by: Hengqi Chen Signed-off-by: Jinyang He Signed-off-by: Huacai Chen arch/loongarch/kernel/stacktrace.c | 2 +- arch/loongarch/kernel/unwind.c | 1 - arch/loongarch/kernel/unwind_prologue.c | 2 +- 3 files changed, 2 insertions(+), 3 deletions(-) commit 8146c5b349074da7732f1d45eb4a5f9fd192c7c1 Author: Xi Ruoyao Date: Sat Dec 9 15:49:15 2023 +0800 LoongArch: Slightly clean up drdtime() As we are just discarding the stable clock ID, simply write it into $zero instead of allocating a temporary register. Signed-off-by: Xi Ruoyao Signed-off-by: Huacai Chen arch/loongarch/include/asm/loongarch.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit eea673e9d5ea994c60b550ffb684413d3759b3f4 Author: WANG Rui Date: Sat Dec 9 15:49:15 2023 +0800 LoongArch: Apply dynamic relocations for LLD For the following assembly code: .text .global func func: nop .data var: .dword func When linked with `-pie`, GNU LD populates the `var` variable with the pre-relocated value of `func`. However, LLVM LLD does not exhibit the same behavior. This issue also arises with the `kernel_entry` in arch/ loongarch/kernel/head.S: _head: .word MZ_MAGIC /* "MZ", MS-DOS header */ .org 0x8 .dword kernel_entry /* Kernel entry point */ The correct kernel entry from the MS-DOS header is crucial for jumping to vmlinux from zboot. This necessity is why the compressed relocatable kernel compiled by Clang encounters difficulties in booting. To address this problem, it is proposed to apply dynamic relocations to place with `--apply-dynamic-relocs`. Link: https://github.com/ClangBuiltLinux/linux/issues/1962 Signed-off-by: WANG Rui Signed-off-by: Huacai Chen arch/loongarch/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1ae4cd3cbdd08287c56c4cc816ebf05eb6681a0f Merge: 9c25aae0132b c13e268c0768 Author: Jakub Kicinski Date: Fri Dec 8 17:20:28 2023 -0800 Merge branch 'bnxt_en-misc-fixes' Michael Chan says: ==================== bnxt_en: Misc. fixes 4 miscellaneous driver fixes covering PM resume, SKB recycling, wrong return value check, and PTP HWTSTAMP_FILTER_ALL. ==================== Link: https://lore.kernel.org/r/20231208001658.14230-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit c13e268c0768659cdaae4bfe2fb24860bcc8ddb4 Author: Michael Chan Date: Thu Dec 7 16:16:58 2023 -0800 bnxt_en: Fix HWTSTAMP_FILTER_ALL packet timestamp logic When the chip is configured to timestamp all receive packets, the timestamp in the RX completion is only valid if the metadata present flag is not set for packets received on the wire. In addition, internal loopback packets will never have a valid timestamp and the timestamp field will always be zero. We must exclude any 0 value in the timestamp field because there is no way to determine if it is a loopback packet or not. Add a new function bnxt_rx_ts_valid() to check for all timestamp valid conditions. Fixes: 66ed81dcedc6 ("bnxt_en: Enable packet timestamping for all RX packets") Reviewed-by: Andy Gospodarek Reviewed-by: Pavan Chebbi Signed-off-by: Michael Chan Link: https://lore.kernel.org/r/20231208001658.14230-5-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt.c | 20 +++++++++++++++++--- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 8 +++++++- 2 files changed, 24 insertions(+), 4 deletions(-) commit bd6781c18cb5b5e5d8c5873fa9a51668e89ec76e Author: Kalesh AP Date: Thu Dec 7 16:16:57 2023 -0800 bnxt_en: Fix wrong return value check in bnxt_close_nic() The wait_event_interruptible_timeout() function returns 0 if the timeout elapsed, -ERESTARTSYS if it was interrupted by a signal, and the remaining jiffies otherwise if the condition evaluated to true before the timeout elapsed. Driver should have checked for zero return value instead of a positive value. MChan: Print a warning for -ERESTARTSYS. The close operation will proceed anyway when wait_event_interruptible_timeout() returns for any reason. Since we do the close no matter what, we should not return this error code to the caller. Change bnxt_close_nic() to a void function and remove all error handling from some of the callers. Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") Reviewed-by: Andy Gospodarek Reviewed-by: Vikas Gupta Reviewed-by: Somnath Kotur Signed-off-by: Kalesh AP Signed-off-by: Michael Chan Link: https://lore.kernel.org/r/20231208001658.14230-4-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 +++++++------ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 11 ++--------- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 19 ++++--------------- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 5 ++--- 5 files changed, 16 insertions(+), 34 deletions(-) commit aded5d1feb08e48d544845d3594d70c4d5fe6e54 Author: Sreekanth Reddy Date: Thu Dec 7 16:16:56 2023 -0800 bnxt_en: Fix skb recycling logic in bnxt_deliver_skb() Receive SKBs can go through the VF-rep path or the normal path. skb_mark_for_recycle() is only called for the normal path. Fix it to do it for both paths to fix possible stalled page pool shutdown errors. Fixes: 86b05508f775 ("bnxt_en: Use the unified RX page pool buffers for XDP and non-XDP") Reviewed-by: Somnath Kotur Reviewed-by: Andy Gospodarek Reviewed-by: Vikas Gupta Signed-off-by: Sreekanth Reddy Signed-off-by: Michael Chan Link: https://lore.kernel.org/r/20231208001658.14230-3-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 9ef7c58f5abe41e6d91f37f28fe2d851ffedd92a Author: Somnath Kotur Date: Thu Dec 7 16:16:55 2023 -0800 bnxt_en: Clear resource reservation during resume We are issuing HWRM_FUNC_RESET cmd to reset the device including all reserved resources, but not clearing the reservations within the driver struct. As a result, when the driver re-initializes as part of resume, it believes that there is no need to do any resource reservation and goes ahead and tries to allocate rings which will eventually fail beyond a certain number pre-reserved by the firmware. Fixes: 674f50a5b026 ("bnxt_en: Implement new method to reserve rings.") Reviewed-by: Kalesh AP Reviewed-by: Ajit Khaparde Reviewed-by: Andy Gospodarek Signed-off-by: Somnath Kotur Signed-off-by: Michael Chan Link: https://lore.kernel.org/r/20231208001658.14230-2-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 ++ 1 file changed, 2 insertions(+) commit 9c25aae0132b8babbe71ebb2160186d69231d9b3 Author: Eric Dumazet Date: Thu Dec 7 18:13:42 2023 +0000 tcp: fix tcp_disordered_ack() vs usec TS resolution After commit 939463016b7a ("tcp: change data receiver flowlabel after one dup") we noticed an increase of TCPACKSkippedPAWS events. Neal Cardwell tracked the issue to tcp_disordered_ack() assumption about remote peer TS clock. RFC 1323 & 7323 are suggesting the following: "timestamp clock frequency in the range 1 ms to 1 sec per tick between 1ms and 1sec." This has to be adjusted for 1 MHz clock frequency. This hints at reorders of SACK packets on send side, this might deserve a future patch. (skb->ooo_okay is always set for pure ACK packets) Fixes: 614e8316aa4c ("tcp: add support for usec resolution in TCP TS values") Co-developed-by: Neal Cardwell Signed-off-by: Neal Cardwell Signed-off-by: Eric Dumazet Cc: David Morley Link: https://lore.kernel.org/r/20231207181342.525181-1-edumazet@google.com Signed-off-by: Jakub Kicinski net/ipv4/tcp_input.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) commit 4eb69d00fe967699b9d93f7e74a990fe813e8d2b Author: Vineet Gupta Date: Fri Dec 8 16:25:23 2023 -0800 ARC: fix smatch warning Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202311280906.VAIwEAfT-lkp@intel.com/ Signed-off-by: Vineet Gupta arch/arc/kernel/setup.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit aca02d933f63ba8bc84258bf35f9ffaf6b664336 Author: Vineet Gupta Date: Fri Dec 8 15:57:07 2023 -0800 ARC: fix spare error Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202312082320.VDN5A9hb-lkp@intel.com/ Signed-off-by: Vineet Gupta arch/arc/kernel/signal.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 6732c0e494ac35fbadd749bbbd226c0aceb2d2c4 Author: Vineet Gupta Date: Wed Feb 15 21:06:33 2023 -0800 ARC: mm: retire support for aliasing VIPT D$ Legacy ARC700 processors (first generation of MMU enabled ARC cores) had VIPT cached which could be configured such that they could alias. Corresponding support in kernel (with all the obnoxious cache flush overhead) was added in ARC port 10 years ago to support 1 silicon. That is long bygone and we can let it RIP. Cc: Matthew Wilcox (Oracle) Signed-off-by: Vineet Gupta arch/arc/Kconfig | 5 -- arch/arc/include/asm/cacheflush.h | 43 ------------ arch/arc/mm/cache.c | 136 ++------------------------------------ arch/arc/mm/mmap.c | 21 +----- arch/arc/mm/tlb.c | 16 ++--- 5 files changed, 14 insertions(+), 207 deletions(-) commit 3a02ec2f0b304af6b38e9cc5a009bf517d38e72c Author: Vineet Gupta Date: Wed May 20 11:23:21 2020 -0700 ARC: entry: move ARCompact specific bits out of entry.h - PUSHAUX/POPAUX helpers to ARCompact entry - use gas provided "push"/pop pseudo instructions Signed-off-by: Vineet Gupta arch/arc/include/asm/entry-compact.h | 55 +++++++++++++++++++++++++++++- arch/arc/include/asm/entry.h | 66 ------------------------------------ 2 files changed, 54 insertions(+), 67 deletions(-) commit 9de7fc30f288ccee11c74613b9a0ee4904f6875f Author: Vineet Gupta Date: Thu May 21 13:33:24 2020 -0700 ARC: entry: SAVE_ABI_CALLEE_REG: ISA/ABI specific helper And for ARcompact variant replace the PUSH/POP macros with gas provided push/pop pseudo-instructions This allows ISA specific implementation e.g. Current ARCv2 PUSH/POP could be replaced with STD/LDL to save 2 registers at a time (w/o bothering with SP update each time) or perhaps use ENTER_S/LEAVE_S to reduce code size For ARCv3 ABI changed so callee regs are now r14-r26 (vs. r13-r25) thus would need a different implementation. Signed-off-by: Vineet Gupta arch/arc/include/asm/entry-arcv2.h | 32 ++++++++++++++++++++++++++ arch/arc/include/asm/entry-compact.h | 32 ++++++++++++++++++++++++++ arch/arc/include/asm/entry.h | 44 ++++-------------------------------- arch/arc/include/asm/ptrace.h | 14 +++++++----- 4 files changed, 76 insertions(+), 46 deletions(-) commit a45f1e46274256852990c479fbb1198a7d84529b Author: Karsten Graul Date: Thu Dec 7 21:23:58 2023 +0100 MAINTAINERS: remove myself as maintainer of SMC I changed responsibilities some time ago, its time to remove myself as maintainer of the SMC component. Signed-off-by: Karsten Graul Signed-off-by: Wenjia Zhang Link: https://lore.kernel.org/r/20231207202358.53502-1-wenjia@linux.ibm.com Signed-off-by: Jakub Kicinski MAINTAINERS | 1 - 1 file changed, 1 deletion(-) commit c65efe3685f5d150eeca5599afeabdc85da899d1 Author: Ira Weiny Date: Thu Nov 16 16:03:29 2023 -0800 cxl/cdat: Free correct buffer on checksum error The new 6.7-rc1 kernel now checks the checksum on CDAT data. While using a branch of Fan's DCD qemu work (and specifying DCD devices), the following splat was observed. WARNING: CPU: 1 PID: 1384 at drivers/base/devres.c:1064 devm_kfree+0x4f/0x60 ... RIP: 0010:devm_kfree+0x4f/0x60 ... ? devm_kfree+0x4f/0x60 read_cdat_data+0x1a0/0x2a0 [cxl_core] cxl_port_probe+0xdf/0x200 [cxl_port] ... The issue in qemu is still unknown but the spat is a straight forward bug in the CDAT checksum processing code. Use a CDAT buffer variable to ensure the devm_free() works correctly on error. Fixes: 670e4e88f3b1 ("cxl: Add checksum verification to CDAT from CXL") Signed-off-by: Ira Weiny Reviewed-by: Dave Jiang Reviewed-by: Fan Ni Reviewed-by: Robert Richter Link: http://lore.kernel.org/r/20231116-fix-cdat-devm-free-v1-1-b148b40707d7@intel.com Signed-off-by: Dan Williams drivers/cxl/core/pci.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit 271f31d5967b9480824f5bf9b6665aea65ad2ce0 Merge: a1664b991ac1 1057812d146d Author: Jakub Kicinski Date: Fri Dec 8 16:12:21 2023 -0800 Merge branch 'qca_spi-collection-of-major-fixes' Stefan Wahren says: ==================== qca_spi: collection of major fixes This series contains a collection of major fixes for the qca_spi driver, which has been recently discovered. ==================== Link: https://lore.kernel.org/r/20231206141222.52029-1-wahrenst@gmx.net Signed-off-by: Jakub Kicinski commit 1057812d146dd658c9a9a96d869c2551150207b5 Author: Stefan Wahren Date: Wed Dec 6 15:12:22 2023 +0100 qca_spi: Fix reset behavior In case of a reset triggered by the QCA7000 itself, the behavior of the qca_spi driver was not quite correct: - in case of a pending RX frame decoding the drop counter must be incremented and decoding state machine reseted - also the reset counter must always be incremented regardless of sync state Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/20231206141222.52029-4-wahrenst@gmx.net Signed-off-by: Jakub Kicinski drivers/net/ethernet/qualcomm/qca_spi.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 96a7e861d9e04d07febd3011c30cd84cd141d81f Author: Stefan Wahren Date: Wed Dec 6 15:12:21 2023 +0100 qca_debug: Fix ethtool -G iface tx behavior After calling ethtool -g it was not possible to adjust the TX ring size again: # ethtool -g eth1 Ring parameters for eth1: Pre-set maximums: RX: 4 RX Mini: n/a RX Jumbo: n/a TX: 10 Current hardware settings: RX: 4 RX Mini: n/a RX Jumbo: n/a TX: 10 # ethtool -G eth1 tx 8 netlink error: Invalid argument The reason for this is that the readonly setting rx_pending get initialized and after that the range check in qcaspi_set_ringparam() fails regardless of the provided parameter. So fix this by accepting the exposed RX defaults. Instead of adding another magic number better use a new define here. Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") Suggested-by: Paolo Abeni Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/20231206141222.52029-3-wahrenst@gmx.net Signed-off-by: Jakub Kicinski drivers/net/ethernet/qualcomm/qca_debug.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit f4e6064c97c050bd9904925ff7d53d0c9954fc7b Author: Stefan Wahren Date: Wed Dec 6 15:12:20 2023 +0100 qca_debug: Prevent crash on TX ring changes The qca_spi driver stop and restart the SPI kernel thread (via ndo_stop & ndo_open) in case of TX ring changes. This is a big issue because it allows userspace to prevent restart of the SPI kernel thread (via signals). A subsequent change of TX ring wrongly assume a valid spi_thread pointer which result in a crash. So prevent this by stopping the network traffic handling and temporary park the SPI thread. Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/20231206141222.52029-2-wahrenst@gmx.net Signed-off-by: Jakub Kicinski drivers/net/ethernet/qualcomm/qca_debug.c | 9 ++++----- drivers/net/ethernet/qualcomm/qca_spi.c | 12 ++++++++++++ 2 files changed, 16 insertions(+), 5 deletions(-) commit a1664b991ac12b872be859ca03529c68c72795a2 Author: Shinas Rasheed Date: Wed Dec 6 05:52:27 2023 -0800 octeon_ep: initialise control mbox tasks before using APIs Initialise various workqueue tasks and queue interrupt poll task before the first invocation of any control net APIs. Since octep_ctrl_net_get_info was called before the control net receive work task was initialised or even the interrupt poll task was queued, the function call wasn't returning actual firmware info queried from Octeon. Fixes: 8d6198a14e2b ("octeon_ep: support to fetch firmware info") Signed-off-by: Shinas Rasheed Reviewed-by: Michal Schmidt Link: https://lore.kernel.org/r/20231206135228.2591659-1-srasheed@marvell.com Signed-off-by: Jakub Kicinski .../net/ethernet/marvell/octeon_ep/octep_main.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) commit f2e8a57ee9036c7d5443382b6c3c09b51a92ec7e Merge: d71369dbe0c5 235f2b548d7f Author: Linus Torvalds Date: Fri Dec 8 12:40:38 2023 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fix from James Bottomley: "One tiny fix to the be2iscsi driver fixing a memory leak in an error leg" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle() commit d71369dbe0c5c1217dc681d6871b7918b2996de6 Merge: 689659c98819 c6d3ab9e76dc Author: Linus Torvalds Date: Fri Dec 8 12:36:45 2023 -0800 Merge tag 'block-6.7-2023-12-08' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "Nothing major in here, just miscellanous fixes for MD and NVMe: - NVMe pull request via Keith: - Proper nvme ctrl state setting (Keith) - Passthrough command optimization (Keith) - Spectre fix (Nitesh) - Kconfig clarifications (Shin'ichiro) - Frozen state deadlock fix (Bitao) - Power setting quirk (Georg) - MD pull requests via Song: - 6.7 regresisons with recovery/sync (Yu) - Reshape fix (David)" * tag 'block-6.7-2023-12-08' of git://git.kernel.dk/linux: md: split MD_RECOVERY_NEEDED out of mddev_resume nvme-pci: Add sleep quirk for Kingston drives md: fix stopping sync thread md: don't leave 'MD_RECOVERY_FROZEN' in error path of md_set_readonly() md: fix missing flush of sync_work nvme: fix deadlock between reset and scan nvme: prevent potential spectre v1 gadget nvme: improve NVME_HOST_AUTH and NVME_TARGET_AUTH config descriptions nvme-ioctl: move capable() admin check to the end nvme: ensure reset state check ordering nvme: introduce helper function to get ctrl state md/raid6: use valid sector values to determine if an I/O should wait on the reshape commit 689659c988193f1e16bc34bfda3f333b11528c1f Merge: 8aa74869d2e9 705318a99a13 Author: Linus Torvalds Date: Fri Dec 8 12:32:38 2023 -0800 Merge tag 'io_uring-6.7-2023-12-08' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "Two minor fixes for issues introduced in this release cycle, and two fixes for issues or potential issues that are heading to stable. One of these ends up disabling passing io_uring file descriptors via SCM_RIGHTS. There really shouldn't be an overlap between that kind of historic use case and modern usage of io_uring, which is why this was deemed appropriate" * tag 'io_uring-6.7-2023-12-08' of git://git.kernel.dk/linux: io_uring/af_unix: disable sending io_uring over sockets io_uring/kbuf: check for buffer list readiness after NULL check io_uring/kbuf: Fix an NULL vs IS_ERR() bug in io_alloc_pbuf_ring() io_uring: fix mutex_unlock with unreferenced ctx commit 8aa74869d2e9d868b1c4598eecc1a89f637a92cf Merge: 081ed90a8c66 e3e82fcb79ee Author: Linus Torvalds Date: Fri Dec 8 12:27:11 2023 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Primarily rtrs and irdma fixes: - Fix uninitialized value in ib_get_eth_speed() - Fix hns refusing to work if userspace doesn't select the correct congestion control algorithm - Several irdma fixes - unreliable Send Queue Drain, use after free, 64k page size bugs, device removal races - Several rtrs bug fixes - crashes, memory leaks, use after free, bad credit accounting, bogus WARN_ON - Typos and a MAINTAINER update" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/irdma: Avoid free the non-cqp_request scratch RDMA/irdma: Fix support for 64k pages RDMA/irdma: Ensure iWarp QP queue memory is OS paged aligned RDMA/core: Fix umem iterator when PAGE_SIZE is greater then HCA pgsz RDMA/irdma: Fix UAF in irdma_sc_ccq_get_cqe_info() RDMA/bnxt_re: Correct module description string RDMA/rtrs-clt: Remove the warnings for req in_use check RDMA/rtrs-clt: Fix the max_send_wr setting RDMA/rtrs-srv: Destroy path files after making sure no IOs in-flight RDMA/rtrs-srv: Free srv_mr iu only when always_invalidate is true RDMA/rtrs-srv: Check return values while processing info request RDMA/rtrs-clt: Start hb after path_up RDMA/rtrs-srv: Do not unconditionally enable irq MAINTAINERS: Add Chengchang Tang as Hisilicon RoCE maintainer RDMA/irdma: Add wait for suspend on SQD RDMA/irdma: Do not modify to SQD on error RDMA/hns: Fix unnecessary err return when using invalid congest control algorithm RDMA/core: Fix uninit-value access in ib_get_eth_speed() commit 081ed90a8c662455a79843add14857b356de37a4 Merge: c3e2f9bda2ff bdefd9913bdd Author: Linus Torvalds Date: Fri Dec 8 11:57:55 2023 -0800 Merge tag 'pm-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Fix cpufreq reference counting in the DTPM (dynamic thermal and power management) power capping framework (Lukasz Luba)" * tag 'pm-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: powercap: DTPM: Fix missing cpufreq_cpu_put() calls commit c3e2f9bda2ffa2dd7dcaf2b45604db08c6ab0579 Merge: 0dfe14fca933 8f0b960a42ba Author: Linus Torvalds Date: Fri Dec 8 11:54:07 2023 -0800 Merge tag 'acpi-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Fix a possible crash on an attempt to free unallocated memory in the error path of acpi_evaluate_reference() that has been introduced by one of the recent changes (Rafael Wysocki)" * tag 'acpi-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: utils: Fix error path in acpi_evaluate_reference() commit 0dfe14fca933dc729fd7671c7b8fa616d74856b7 Merge: d650b3beff76 307004e8b254 Author: Linus Torvalds Date: Fri Dec 8 11:46:41 2023 -0800 Merge tag 'hwmon-for-v6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - acpi_power_meter: Fix 4.29 MW output seen if acpi reports bad data - corsair-psu: Fix ability to probe if the driver is built into the kernel - ltc2991: Fix spelling mistake "contiuous" -> "continuous" - max31827: Add missing regulator header file include - nzxt-kraken2: Fix error handling path in probe function * tag 'hwmon-for-v6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (corsair-psu) Fix probe when built-in hwmon: (nzxt-kraken2) Fix error handling path in kraken2_probe() hwmon: (acpi_power_meter) Fix 4.29 MW bug hwmon: max31827: include regulator header hwmon: ltc2991: Fix spelling mistake "contiuous" -> "continuous" commit d650b3beff76bd0d1eaba6c706f9fbac52137339 Merge: b8b68d2fd41c 4e7a8dbd2bc0 Author: Linus Torvalds Date: Fri Dec 8 11:41:56 2023 -0800 Merge tag 'pwm/for-6.7-rc5-fixes' of https://git.pengutronix.de/git/ukl/linux Pull pwm fix from Uwe Kleine-König: "This fixes a null pointer exception in the bcm2835 pwm driver. The problem was introduced by a combination of two commits merged for v6.7-rc1 where each change alone would have been fine. Thanks to Florian Fainelli for noticing and fixing the issue" * tag 'pwm/for-6.7-rc5-fixes' of https://git.pengutronix.de/git/ukl/linux: pwm: bcm2835: Fix NPD in suspend/resume commit b8b68d2fd41c1068554290fdf2c5adc6b03d40ce Merge: 38bafa65b126 634e5e1e06f5 Author: Linus Torvalds Date: Fri Dec 8 11:29:45 2023 -0800 Merge tag 'sound-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This is a typical bump in the middle of its way; we've gathered lots of fixes (mostly for ASoC) at this time: - PCM array out-of-bound access fix - Correction of SOC PCM merge error - Lots of ASoC SOF Intel updates - A few ASoC AMD quirks - More proper timer handling in PCM test module - HD-audio and USB-audio quirks as usual - Other device-specific fixes for various ASoC codecs" * tag 'sound-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (39 commits) ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 ALSA: pcmtest: stop timer before buffer is released ALSA: hda/realtek: Add Framework laptop 16 to quirks ALSA: hda/realtek: add new Framework laptop to quirks ALSA: pcm: fix out-of-bounds in snd_pcm_state_names ASoC: qcom: sc8280xp: Limit speaker digital volumes ASoC: ops: add correct range check for limiting volume ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5 ALSA: hda/realtek: fix speakers on XPS 9530 (2023) ALSA: usb-audio: Add Pioneer DJM-450 mixer controls ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate ASoC: da7219: Support low DC impedance headset ASoC: amd: acp: Add support for a new Huawei Matebook laptop ALSA: hda/realtek: Apply quirk for ASUS UM3504DA ASoC: SOF: ipc4-topology: Correct data structures for the GAIN module ASoC: SOF: ipc4-topology: Correct data structures for the SRC module ASoC: hdac_hda: Conditionally register dais for HDMI and Analog ASoC: codecs: lpass-tx-macro: set active_decimator correct default value ASoC: amd: yc: Fix non-functional mic on ASUS E1504FA ASoC: amd: yc: Add DMI entry to support System76 Pangolin 13 ... commit 38bafa65b1260cb774cfc0c9a3ddf82d3c563e10 Merge: 4df7c5fde316 b7b5a56acec8 Author: Linus Torvalds Date: Fri Dec 8 11:17:44 2023 -0800 Merge tag 'drm-fixes-2023-12-08' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Regular weekly fixes, mostly amdgpu and i915 as usual. A couple of nouveau, panfrost, one core and one bridge Kconfig. Seems about normal for rc5. atomic-helpers: - invoke end_fb_access while owning plane state i915: - fix a missing dep for a previous fix - Relax BXT/GLK DSI transcoder hblank limits - Fix DP MST .mode_valid_ctx() return values - Reject DP MST modes that require bigjoiner (as it's not yet supported on DP MST) - Fix _intel_dsb_commit() variable type to allow negative values nouveau: - document some bits of gsp rm - flush vmm more on tu102 to avoid hangs panfrost: - fix imported dma-buf objects residency - fix device freq update bridge: - tc358768 - fix Kconfig amdgpu: - Disable MCBP on gfx9 - DC vbios fix - eDP fix - dml2 UBSAN fix - SMU 14 fix - RAS fixes - dml KASAN/KCSAN fix - PSP 13 fix - Clockgating fixes - Suspend fix exynos: - fix pointer dereference - fix wrong error check" * tag 'drm-fixes-2023-12-08' of git://anongit.freedesktop.org/drm/drm: (27 commits) drm/exynos: fix a wrong error checking drm/exynos: fix a potential error pointer dereference drm/amdgpu: fix buffer funcs setting order on suspend drm/amdgpu: Avoid querying DRM MGCG status drm/amdgpu: Update HDP 4.4.2 clock gating flags drm/amdgpu: Add NULL checks for function pointers drm/amdgpu: Restrict extended wait to PSP v13.0.6 drm/amd/display: Increase frame warning limit with KASAN or KCSAN in dml drm/amdgpu: optimize the printing order of error data drm/amdgpu: Update fw version for boot time error query drm/amd/pm: support new mca smu error code decoding drm/amd/swsmu: update smu v14_0_0 driver if version and metrics table drm/amd/display: Fix array-index-out-of-bounds in dml2 drm/amd/display: Add monitor patch for specific eDP drm/amd/display: Use channel_width = 2 for vram table 3.0 drm/amdgpu: disable MCBP by default drm/atomic-helpers: Invoke end_fb_access while owning plane state drm/i915: correct the input parameter on _intel_dsb_commit() drm/i915/mst: Reject modes that require the bigjoiner drm/i915/mst: Fix .mode_valid_ctx() return values ... commit c12296bbecc488623b7d1932080e394d08f3226b Author: Florent Revest Date: Wed Dec 6 13:37:18 2023 +0100 team: Fix use-after-free when an option instance allocation fails In __team_options_register, team_options are allocated and appended to the team's option_list. If one option instance allocation fails, the "inst_rollback" cleanup path frees the previously allocated options but doesn't remove them from the team's option_list. This leaves dangling pointers that can be dereferenced later by other parts of the team driver that iterate over options. This patch fixes the cleanup path to remove the dangling pointers from the list. As far as I can tell, this uaf doesn't have much security implications since it would be fairly hard to exploit (an attacker would need to make the allocation of that specific small object fail) but it's still nice to fix. Cc: stable@vger.kernel.org Fixes: 80f7c6683fe0 ("team: add support for per-port options") Signed-off-by: Florent Revest Reviewed-by: Jiri Pirko Reviewed-by: Hangbin Liu Link: https://lore.kernel.org/r/20231206123719.1963153-1-revest@chromium.org Signed-off-by: Jakub Kicinski drivers/net/team/team.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 4cdf351d3630a640ab6a05721ef055b9df62277f Author: Sean Christopherson Date: Fri May 7 09:59:46 2021 -0700 KVM: SVM: Update EFER software model on CR0 trap for SEV-ES In general, activating long mode involves setting the EFER_LME bit in the EFER register and then enabling the X86_CR0_PG bit in the CR0 register. At this point, the EFER_LMA bit will be set automatically by hardware. In the case of SVM/SEV guests where writes to CR0 are intercepted, it's necessary for the host to set EFER_LMA on behalf of the guest since hardware does not see the actual CR0 write. In the case of SEV-ES guests where writes to CR0 are trapped instead of intercepted, the hardware *does* see/record the write to CR0 before exiting and passing the value on to the host, so as part of enabling SEV-ES support commit f1c6366e3043 ("KVM: SVM: Add required changes to support intercepts under SEV-ES") dropped special handling of the EFER_LMA bit with the understanding that it would be set automatically. However, since the guest never explicitly sets the EFER_LMA bit, the host never becomes aware that it has been set. This becomes problematic when userspace tries to get/set the EFER values via KVM_GET_SREGS/KVM_SET_SREGS, since the EFER contents tracked by the host will be missing the EFER_LMA bit, and when userspace attempts to pass the EFER value back via KVM_SET_SREGS it will fail a sanity check that asserts that EFER_LMA should always be set when X86_CR0_PG and EFER_LME are set. Fix this by always inferring the value of EFER_LMA based on X86_CR0_PG and EFER_LME, regardless of whether or not SEV-ES is enabled. Fixes: f1c6366e3043 ("KVM: SVM: Add required changes to support intercepts under SEV-ES") Reported-by: Peter Gonda Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Message-Id: <20210507165947.2502412-2-seanjc@google.com> [A two year old patch that was revived after we noticed the failure in KVM_SET_SREGS and a similar patch was posted by Michael Roth. This is Sean's patch, but with Michael's more complete commit message. - Paolo] Signed-off-by: Paolo Bonzini arch/x86/kvm/svm/svm.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 307004e8b254ad28e150b63f299ab9caa4bc7c3e Author: Armin Wolf Date: Thu Dec 7 22:07:23 2023 +0100 hwmon: (corsair-psu) Fix probe when built-in It seems that when the driver is built-in, the HID bus is initialized after the driver is loaded, which whould cause module_hid_driver() to fail. Fix this by registering the driver after the HID bus using late_initcall() in accordance with other hwmon HID drivers. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20231207210723.222552-1-W_Armin@gmx.de [groeck: Dropped "compile tested" comment; the patch has been tested but the tester did not provide a Tested-by: tag] Signed-off-by: Guenter Roeck drivers/hwmon/corsair-psu.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) commit 96f124015f825a4a186b8497e20cf87f6519c7b4 Author: David Woodhouse Date: Sat Oct 28 20:34:53 2023 +0100 KVM: selftests: add -MP to CFLAGS Using -MD without -MP causes build failures when a header file is deleted or moved. With -MP, the compiler will emit phony targets for the header files it lists as dependencies, and the Makefiles won't refuse to attempt to rebuild a C unit which no longer includes the deleted header. Signed-off-by: David Woodhouse Link: https://lore.kernel.org/r/9fc8b5395321abbfcaf5d78477a9a7cd350b08e4.camel@infradead.org Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini tools/testing/selftests/kvm/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4a073e813477be4ae95dfd23cb08baf36e93a29f Author: angquan yu Date: Tue Nov 28 16:11:05 2023 -0600 KVM: selftests: Actually print out magic token in NX hugepages skip message Pass MAGIC_TOKEN to __TEST_REQUIRE() when printing the help message about needing to pass a magic value to manually run the NX hugepages test, otherwise the help message will contain garbage. In file included from x86_64/nx_huge_pages_test.c:15: x86_64/nx_huge_pages_test.c: In function ‘main’: include/test_util.h:40:32: error: format ‘%d’ expects a matching ‘int’ argument [-Werror=format=] 40 | ksft_exit_skip("- " fmt "\n", ##__VA_ARGS__); \ | ^~~~ x86_64/nx_huge_pages_test.c:259:9: note: in expansion of macro ‘__TEST_REQUIRE’ 259 | __TEST_REQUIRE(token == MAGIC_TOKEN, | ^~~~~~~~~~~~~~ Signed-off-by: angquan yu Link: https://lore.kernel.org/r/20231128221105.63093-1-angquan21@gmail.com [sean: rewrite shortlog+changelog] Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini tools/testing/selftests/kvm/x86_64/nx_huge_pages_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6254eebad4bedd3ac258a7e0710ec9fb28d8dbe9 Merge: aa0ae3df8099 ef8d89033c3f Author: Paolo Bonzini Date: Fri Dec 8 13:13:45 2023 -0500 Merge tag 'kvm-x86-fixes-6.7-rcN' of https://github.com/kvm-x86/linux into kvm-master KVM fixes for 6.7-rcN: - When checking if a _running_ vCPU is "in-kernel", i.e. running at CPL0, get the CPL directly instead of relying on preempted_in_kernel, which is valid if and only if the vCPU was preempted, i.e. NOT running. - Set .owner for various KVM file_operations so that files refcount the KVM module until KVM is done executing _all_ code, including the last few instructions of kvm_put_kvm(). And then revert the misguided attempt to rely on "struct kvm" refcounts to pin KVM-the-module. - Fix a benign "return void" that was recently introduced. commit aa0ae3df809909b5f06bd46a825dd923538e0115 Merge: c8a11a938c9d 27072b8e18a7 Author: Paolo Bonzini Date: Fri Dec 8 13:13:12 2023 -0500 Merge tag 'kvm-s390-master-6.7-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into kvm-master Two small but important bugfixes. commit c8a11a938c9def4e976b3c6f92f01c9b8655ff78 Merge: 33cc938e65a9 8e4ece6889a5 Author: Paolo Bonzini Date: Fri Dec 8 13:11:42 2023 -0500 Merge tag 'kvmarm-fixes-6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into kvm-master KVM/arm64 fixes for 6.7, take #1 - Avoid mapping vLPIs that have already been mapped commit c5becf57dd5659c687d41d623a69f42d63f59eb2 Author: Martin K. Petersen Date: Fri Dec 8 12:09:38 2023 -0500 Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity" This reverts commit 9dc704dcc09eae7d21b5da0615eb2ed79278f63e. Several reports have been made indicating that this commit caused hangs. Numerous attempts at root causing and fixing the issue have been unsuccessful so let's revert for now. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217599 Cc: Signed-off-by: Martin K. Petersen drivers/scsi/aacraid/aacraid.h | 1 - drivers/scsi/aacraid/commsup.c | 6 +----- drivers/scsi/aacraid/linit.c | 14 -------------- drivers/scsi/aacraid/src.c | 25 ++----------------------- 4 files changed, 3 insertions(+), 43 deletions(-) commit 4df7c5fde316820286dfa6d203a1005d7fbe007d Merge: a6adef898741 ed5b7cfd7839 Author: Linus Torvalds Date: Fri Dec 8 09:03:54 2023 -0800 Merge tag 'riscv-for-linus-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A pair of fixes to the new module load-time relocation code - A fix for hwprobe overflowing on rv32 - A fix for to correctly decode C.SWSP and C.SDSP, which manifests in misaligned access handling - A fix for a boot-time shadow call stack initialization ordering issue - A fix for Andes' errata probing, which was calling riscv_noncoherent_supported() too late in the boot process and triggering an oops * tag 'riscv-for-linus-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: errata: andes: Probe for IOCP only once in boot stage riscv: Fix SMP when shadow call stacks are enabled dt-bindings: perf: riscv,pmu: drop unneeded quotes riscv: fix misaligned access handling of C.SWSP and C.SDSP RISC-V: hwprobe: Always use u64 for extension bits Support rv32 ULEB128 test riscv: Correct type casting in module loading riscv: Safely remove entries from relocation list commit a6adef898741eb07526aaf9d8b982d3dff4a9e67 Merge: 17894c2a7aa6 fd1e5745f87a Author: Linus Torvalds Date: Fri Dec 8 08:58:39 2023 -0800 Merge tag 'soc-fixes-6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "Most of the changes are devicetree fixes for NXP, Mediatek, Rockchips Arm machines as well as Microchip RISC-V, and most of these address build-time warnings for spec violations and other minor issues. One of the Mediatek warnings was enabled by default and prevented a clean build. The ones that address serious runtime issues are all on the i.MX platform: - a boot time panic on imx8qm - USB hanging under load on imx8 - regressions on the imx93 ethernet phy Code fixes include a minor error handling for the i.MX PMU driver, and a number of firmware driver fixes: - OP-TEE fix for supplicant based device enumeration, and a new sysfs attribute to needed to fix a race against userspace - Arm SCMI fix for possible truncation/overflow in the frequency computations - Multiple FF-A fixes for the newly added notification support" * tag 'soc-fixes-6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (55 commits) MAINTAINERS: change the S32G2 maintainer's email address. arm64: dts: rockchip: Fix eMMC Data Strobe PD on rk3588 ARM: dts: imx28-xea: Pass the 'model' property ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt MAINTAINERS: reinstate freescale ARM64 DT directory in i.MX entry arm64: dts: imx8-apalis: set wifi regulator to always-on ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init arm64: dts: imx8ulp: update gpio node name to align with register address arm64: dts: imx93: update gpio node name to align with register address arm64: dts: imx93: correct mediamix power arm64: dts: imx8qm: Add imx8qm's own pm to avoid panic during startup arm64: dts: freescale: imx8-ss-dma: Fix #pwm-cells arm64: dts: freescale: imx8-ss-lsio: Fix #pwm-cells dt-bindings: pwm: imx-pwm: Unify #pwm-cells for all compatibles ARM: dts: imx6ul-pico: Describe the Ethernet PHY clock arm64: dts: imx8mp: imx8mq: Add parkmode-disable-ss-quirk on DWC3 arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru arm64: dts: rockchip: drop interrupt-names property from rk3588s dfi firmware: arm_scmi: Fix possible frequency truncation when using level indexing mode firmware: arm_scmi: Fix frequency truncation by promoting multiplier type ... commit ef61a0405742a9f7f6051bc6fd2f017d87d07911 Author: Jiaxun Yang Date: Fri Dec 1 11:50:28 2023 +0000 PCI: loongson: Limit MRRS to 256 This is a partial revert of 8b3517f88ff2 ("PCI: loongson: Prevent LS7A MRRS increases") for MIPS-based Loongson. Some MIPS Loongson systems don't support arbitrary Max_Read_Request_Size (MRRS) settings. 8b3517f88ff2 ("PCI: loongson: Prevent LS7A MRRS increases") worked around that by (1) assuming that firmware configured MRRS to the maximum supported value and (2) preventing the PCI core from increasing MRRS. Unfortunately, some firmware doesn't set that maximum MRRS correctly, which results in devices not being initialized correctly. One symptom, from the Debian report below, is this: ata4.00: exception Emask 0x0 SAct 0x20000000 SErr 0x0 action 0x6 frozen ata4.00: failed command: WRITE FPDMA QUEUED ata4.00: cmd 61/20:e8:00:f0:e1/00:00:00:00:00/40 tag 29 ncq dma 16384 out res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout) ata4.00: status: { DRDY } ata4: hard resetting link Limit MRRS to 256 because MIPS Loongson with higher MRRS support is considered rare. This must be done at device enablement stage because the MRRS setting may get lost if PCI_COMMAND_MASTER on the parent bridge is cleared, and we are only sure parent bridge is enabled at this point. Fixes: 8b3517f88ff2 ("PCI: loongson: Prevent LS7A MRRS increases") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217680 Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1035587 Link: https://lore.kernel.org/r/20231201115028.84351-1-jiaxun.yang@flygoat.com Signed-off-by: Jiaxun Yang Signed-off-by: Bjorn Helgaas Acked-by: Huacai Chen Cc: stable@vger.kernel.org drivers/pci/controller/pci-loongson.c | 46 +++++++++++++++++++++++++++++++---- 1 file changed, 41 insertions(+), 5 deletions(-) commit 17894c2a7aa60a6da7495cc8500a53523e64c4b1 Merge: 8e819a7623f1 f458a1453424 Author: Linus Torvalds Date: Fri Dec 8 08:44:43 2023 -0800 Merge tag 'trace-v6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Snapshot buffer issues: 1. When instances started allowing latency tracers, it uses a snapshot buffer (another buffer that is not written to but swapped with the main buffer that is). The snapshot buffer needs to be the same size as the main buffer. But when the snapshot buffers were added to instances, the code to make the snapshot equal to the main buffer still was only doing it for the main buffer and not the instances. 2. Need to stop the current tracer when resizing the buffers. Otherwise there can be a race if the tracer decides to make a snapshot between resizing the main buffer and the snapshot buffer. 3. When a tracer is "stopped" in disables both the main buffer and the snapshot buffer. This needs to be done for instances and not only the main buffer, now that instances also have a snapshot buffer. - Buffered event for filtering issues: When filtering is enabled, because events can be dropped often, it is quicker to copy the event into a temp buffer and write that into the main buffer if it is not filtered or just drop the event if it is, than to write the event into the ring buffer and then try to discard it. This temp buffer is allocated and needs special synchronization to do so. But there were some issues with that: 1. When disabling the filter and freeing the buffer, a call to all CPUs is required to stop each per_cpu usage. But the code called smp_call_function_many() which does not include the current CPU. If the task is migrated to another CPU when it enables the CPUs via smp_call_function_many(), it will not enable the one it is currently on and this causes issues later on. Use on_each_cpu_mask() instead, which includes the current CPU. 2.When the allocation of the buffered event fails, it can give a warning. But the buffered event is just an optimization (it's still OK to write to the ring buffer and free it). Do not WARN in this case. 3.The freeing of the buffer event requires synchronization. First a counter is decremented to zero so that no new uses of it will happen. Then it sets the buffered event to NULL, and finally it frees the buffered event. There's a synchronize_rcu() between the counter decrement and the setting the variable to NULL, but only a smp_wmb() between that and the freeing of the buffer. It is theoretically possible that a user missed seeing the decrement, but will use the buffer after it is free. Another synchronize_rcu() is needed in place of that smp_wmb(). - ring buffer timestamps on 32 bit machines The ring buffer timestamp on 32 bit machines has to break the 64 bit number into multiple values as cmpxchg is required on it, and a 64 bit cmpxchg on 32 bit architectures is very slow. The code use to just use two 32 bit values and make it a 60 bit timestamp where the other 4 bits were used as counters for synchronization. It later came known that the timestamp on 32 bit still need all 64 bits in some cases. So 3 words were created to handle the 64 bits. But issues arised with this: 1. The synchronization logic still only compared the counter with the first two, but not with the third number, so the synchronization could fail unknowingly. 2. A check on discard of an event could race if an event happened between the discard and updating one of the counters. The counter needs to be updated (forcing an absolute timestamp and not to use a delta) before the actual discard happens. * tag 'trace-v6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Test last update in 32bit version of __rb_time_read() ring-buffer: Force absolute timestamp on discard of event tracing: Fix a possible race when disabling buffered events tracing: Fix a warning when allocating buffered events fails tracing: Fix incomplete locking when disabling buffered events tracing: Disable snapshot buffer when stopping instance tracers tracing: Stop current tracer when resizing buffer tracing: Always update snapshot buffer size commit 8e819a7623f19534bce6d53678b581c167b5b079 Merge: 5e3f5b81de80 b2f557a21bc8 Author: Linus Torvalds Date: Fri Dec 8 08:36:23 2023 -0800 Merge tag 'mm-hotfixes-stable-2023-12-07-18-47' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "31 hotfixes. Ten of these address pre-6.6 issues and are marked cc:stable. The remainder address post-6.6 issues or aren't considered serious enough to justify backporting" * tag 'mm-hotfixes-stable-2023-12-07-18-47' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (31 commits) mm/madvise: add cond_resched() in madvise_cold_or_pageout_pte_range() nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage() mm/hugetlb: have CONFIG_HUGETLB_PAGE select CONFIG_XARRAY_MULTI scripts/gdb: fix lx-device-list-bus and lx-device-list-class MAINTAINERS: drop Antti Palosaari highmem: fix a memory copy problem in memcpy_from_folio nilfs2: fix missing error check for sb_set_blocksize call kernel/Kconfig.kexec: drop select of KEXEC for CRASH_DUMP units: add missing header drivers/base/cpu: crash data showing should depends on KEXEC_CORE mm/damon/sysfs-schemes: add timeout for update_schemes_tried_regions scripts/gdb/tasks: fix lx-ps command error mm/Kconfig: make userfaultfd a menuconfig selftests/mm: prevent duplicate runs caused by TEST_GEN_PROGS mm/damon/core: copy nr_accesses when splitting region lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly checkstack: fix printed address mm/memory_hotplug: fix error handling in add_memory_resource() mm/memory_hotplug: add missing mem_hotplug_lock .mailmap: add a new address mapping for Chester Lin ... commit 13736654481198e519059d4a2e2e3b20fa9fdb3e Author: Namjae Jeon Date: Wed Dec 6 08:23:49 2023 +0900 ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE MS confirm that "AISi" name of SMB2_CREATE_ALLOCATION_SIZE in MS-SMB2 specification is a typo. cifs/ksmbd have been using this wrong name from MS-SMB2. It should be "AlSi". Also It will cause problem when running smb2.create.open test in smbtorture against ksmbd. Cc: stable@vger.kernel.org Fixes: 12197a7fdda9 ("Clarify SMB2/SMB3 create context and add missing ones") Signed-off-by: Namjae Jeon Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/common/smb2pdu.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a9f106c765c12d2f58aa33431bd8ce8e9d8a404a Author: Namjae Jeon Date: Mon Dec 4 22:23:34 2023 +0900 ksmbd: fix wrong allocation size update in smb2_open() When client send SMB2_CREATE_ALLOCATION_SIZE create context, ksmbd update old size to ->AllocationSize in smb2 create response. ksmbd_vfs_getattr() should be called after it to get updated stat result. Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2pdu.c | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) commit 658609d9a618d8881bf549b5893c0ba8fcff4526 Author: Namjae Jeon Date: Mon Dec 4 22:20:46 2023 +0900 ksmbd: avoid duplicate opinfo_put() call on error of smb21_lease_break_ack() opinfo_put() could be called twice on error of smb21_lease_break_ack(). It will cause UAF issue if opinfo is referenced on other places. Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2pdu.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit c2a721eead71202a0d8ddd9b56ec8dce652c71d1 Author: Namjae Jeon Date: Fri Dec 8 14:37:56 2023 +0900 ksmbd: lazy v2 lease break on smb2_write() Don't immediately send directory lease break notification on smb2_write(). Instead, It postpones it until smb2_close(). Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/oplock.c | 45 +++++++++++++++++++++++++++++++++++++++++++-- fs/smb/server/oplock.h | 1 + fs/smb/server/vfs.c | 3 +++ fs/smb/server/vfs_cache.h | 1 + 4 files changed, 48 insertions(+), 2 deletions(-) commit d47d9886aeef79feba7adac701a510d65f3682b5 Author: Namjae Jeon Date: Fri Dec 8 14:33:41 2023 +0900 ksmbd: send v2 lease break notification for directory If client send different parent key, different client guid, or there is no parent lease key flags in create context v2 lease, ksmbd send lease break to client. Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/common/smb2pdu.h | 1 + fs/smb/server/oplock.c | 56 ++++++++++++++++++++++++++++++++++++++++++----- fs/smb/server/oplock.h | 4 ++++ fs/smb/server/smb2pdu.c | 7 ++++++ fs/smb/server/vfs_cache.c | 13 ++++++++++- fs/smb/server/vfs_cache.h | 2 ++ 6 files changed, 77 insertions(+), 6 deletions(-) commit b1a6a1a77f0666a5a6dc0893ab6ec8fcae46f24c Author: Vineeth Vijayan Date: Thu Nov 23 22:52:53 2023 +0100 s390/scm: fix virtual vs physical address confusion Fix virtual vs physical address confusion (which currently are the same). Signed-off-by: Vineeth Vijayan Reviewed-by: Peter Oberparleiter Acked-by: Alexander Gordeev Signed-off-by: Alexander Gordeev drivers/s390/block/scm_blk.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 6e455f5dcdd15fa28edf0ffb5b44d3508512dccf Author: Jani Nikula Date: Fri Dec 8 15:12:38 2023 +0200 drm/crtc: fix uninitialized variable use Commit 3823119b9c2b ("drm/crtc: Fix uninit-value bug in drm_mode_setcrtc") was supposed to fix use of an uninitialized variable, but introduced another. num_connectors is only initialized if crtc_req->count_connectors > 0, but it's used regardless. Fix it. Fixes: 3823119b9c2b ("drm/crtc: Fix uninit-value bug in drm_mode_setcrtc") Cc: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com Cc: Ziqi Zhao Cc: Maxime Ripard Cc: Maarten Lankhorst Cc: Thomas Zimmermann Signed-off-by: Jani Nikula Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20231208131238.2924571-1-jani.nikula@intel.com drivers/gpu/drm/drm_crtc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 7bcd032370f88fd4022b6926d101403e96a86309 Author: Randy Dunlap Date: Tue Dec 5 22:01:18 2023 -0800 platform/x86: intel_ips: fix kernel-doc formatting Fix kernel-doc function notation and comment formatting to prevent warnings from scripts/kernel-doc. for drivers/platform/x86/intel_ips.c: 595: warning: No description found for return value of 'mcp_exceeded' 624: warning: No description found for return value of 'cpu_exceeded' 650: warning: No description found for return value of 'mch_exceeded' 745: warning: bad line: cpu+ gpu+ cpu+gpu- cpu-gpu+ cpu-gpu- 746: warning: bad line: cpu < gpu < cpu+gpu+ cpu+ gpu+ nothing 753: warning: No description found for return value of 'ips_adjust' 747: warning: bad line: cpu < gpu >= cpu+gpu-(mcp<) cpu+gpu-(mcp<) gpu- gpu- 748: warning: bad line: cpu >= gpu < cpu-gpu+(mcp<) cpu- cpu-gpu+(mcp<) cpu- 749: warning: bad line: cpu >= gpu >= cpu-gpu- cpu-gpu- cpu-gpu- cpu-gpu- 945: warning: No description found for return value of 'ips_monitor' 1151: warning: No description found for return value of 'ips_irq_handler' 1301: warning: Function parameter or member 'ips' not described in 'ips_detect_cpu' 1302: warning: No description found for return value of 'ips_detect_cpu' 1358: warning: No description found for return value of 'ips_get_i915_syms' Signed-off-by: Randy Dunlap Cc: Hans de Goede Cc: Ilpo Järvinen Cc: platform-driver-x86@vger.kernel.org Link: https://lore.kernel.org/r/20231206060120.4816-1-rdunlap@infradead.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/intel_ips.c | 30 +++++++++++++++++++++++------- 1 file changed, 23 insertions(+), 7 deletions(-) commit 17fe3ec0c110b4afc04052e2a33b146766aac8a1 Author: Randy Dunlap Date: Tue Dec 5 22:01:43 2023 -0800 platform/x86: thinkpad_acpi: fix kernel-doc warnings Add a function's return description and don't misuse "/**" for non-kernel-doc comments to prevent warnings from scripts/kernel-doc. thinkpad_acpi.c:523: warning: No description found for return value of 'tpacpi_check_quirks' thinkpad_acpi.c:9307: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst thinkpad_acpi.c:9307: warning: missing initial short description on line: * This evaluates a ACPI method call specific to the battery Signed-off-by: Randy Dunlap Cc: Henrique de Moraes Holschuh Cc: Hans de Goede Cc: Ilpo Järvinen CC: ibm-acpi-devel@lists.sourceforge.net CC: platform-driver-x86@vger.kernel.org Reviewed-by: mpearson-lenovo@squebb.ca Link: https://lore.kernel.org/r/20231206060144.8260-1-rdunlap@infradead.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/thinkpad_acpi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 14c200b7ca46b9a9f4af9e81d258a58274320b6f Author: Hans de Goede Date: Mon Dec 4 16:06:01 2023 +0100 platform/x86: intel-vbtn: Fix missing tablet-mode-switch events 2 issues have been reported on the Dell Inspiron 7352: 1. Sometimes the tablet-mode-switch stops reporting tablet-mode change events. Add a "VBDL" call to notify_handler() to work around this. 2. Sometimes the tablet-mode is incorrect after suspend/resume Add a detect_tablet_mode() to resume() to fix this. Reported-by: Arnold Gozum Closes: https://lore.kernel.org/platform-driver-x86/87271a74-c831-4eec-b7a4-1371d0e42471@gmail.com/ Tested-by: Arnold Gozum Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231204150601.46976-1-hdegoede@redhat.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/intel/vbtn.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) commit bd4a816752bab609dd6d65ae021387beb9e2ddbd Author: Maciej Żenczykowski Date: Wed Dec 6 09:36:12 2023 -0800 net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX Lorenzo points out that we effectively clear all unknown flags from PIO when copying them to userspace in the netlink RTM_NEWPREFIX notification. We could fix this one at a time as new flags are defined, or in one fell swoop - I choose the latter. We could either define 6 new reserved flags (reserved1..6) and handle them individually (and rename them as new flags are defined), or we could simply copy the entire unmodified byte over - I choose the latter. This unfortunately requires some anonymous union/struct magic, so we add a static assert on the struct size for a little extra safety. Cc: David Ahern Cc: Lorenzo Colitti Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Maciej Żenczykowski Reviewed-by: David Ahern Signed-off-by: David S. Miller include/net/addrconf.h | 12 ++++++++++-- include/net/if_inet6.h | 4 ---- net/ipv6/addrconf.c | 6 +----- 3 files changed, 11 insertions(+), 11 deletions(-) commit e5dc5afff62f3e97e86c3643ec9fcad23de4f2d3 Author: Judy Hsiao Date: Wed Dec 6 03:38:33 2023 +0000 neighbour: Don't let neigh_forced_gc() disable preemption for long We are seeing cases where neigh_cleanup_and_release() is called by neigh_forced_gc() many times in a row with preemption turned off. When running on a low powered CPU at a low CPU frequency, this has been measured to keep preemption off for ~10 ms. That's not great on a system with HZ=1000 which expects tasks to be able to schedule in with ~1ms latency. Suggested-by: Douglas Anderson Signed-off-by: Judy Hsiao Reviewed-by: David Ahern Reviewed-by: Eric Dumazet Reviewed-by: Douglas Anderson Signed-off-by: David S. Miller net/core/neighbour.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 179a8b515e4b8971ae4ad2db36a44f0691fc6756 Merge: 5e3f5b81de80 ca4ef28d0ad8 Author: David S. Miller Date: Fri Dec 8 10:30:34 2023 +0000 Merge tag 'mlx5-fixes-2023-12-04' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2023-12-04 This series provides bug fixes to mlx5 driver. V1->V2: - Drop commit #9 ("net/mlx5e: Forbid devlink reload if IPSec rules are offloaded"), we are working on a better fix Please pull and let me know if there is any problem. ==================== Signed-off-by: David S. Miller commit 3823119b9c2b5f9e9b760336f75bc989b805cde6 Author: Ziqi Zhao Date: Fri Jul 21 09:14:46 2023 -0700 drm/crtc: Fix uninit-value bug in drm_mode_setcrtc The connector_set contains uninitialized values when allocated with kmalloc_array. However, in the "out" branch, the logic assumes that any element in connector_set would be equal to NULL if failed to initialize, which causes the bug reported by Syzbot. The fix is to use an extra variable to keep track of how many connectors are initialized indeed, and use that variable to decrease any refcounts in the "out" branch. Reported-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com Signed-off-by: Ziqi Zhao Reported-and-tested-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com Tested-by: Harshit Mogalapalli Link: https://lore.kernel.org/r/20230721161446.8602-1-astrajoan@yahoo.com Signed-off-by: Maxime Ripard drivers/gpu/drm/drm_crtc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit fd1e5745f87a9e06974d2f42d22b3e1682c99105 Merge: 7c9bb1904583 37f3d6108730 Author: Arnd Bergmann Date: Fri Dec 8 08:36:17 2023 +0100 Merge tag 'v6.7-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes Devicetree fixes for the 6.7-cycle. All over the place this time. From adapting the size of the vdec nodes on rk3328 and rk3399, fixing some wrong pinctrl settings on rk3128 and the Turing RK1 board, emmc-settings fixes on rk3588 and interrupt-name mishaps, down to some dt-cleanups. Also this adds the missing rockchip,rk3588-pmugrf compatible to the soc grf binding, that I somehow messed up during the pull requests for the -rc1 . At least with it included the dt-checker is happier. * tag 'v6.7-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: Fix eMMC Data Strobe PD on rk3588 arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru arm64: dts: rockchip: drop interrupt-names property from rk3588s dfi arm64: dts: rockchip: Fix Turing RK1 interrupt pinctrls ARM: dts: rockchip: Fix sdmmc_pwren's pinmux setting for RK3128 arm64: dts: rockchip: minor whitespace cleanup around '=' ARM: dts: rockchip: minor whitespace cleanup around '=' dt-bindings: soc: rockchip: grf: add rockchip,rk3588-pmugrf arm64: dts: rockchip: fix rk356x pcie msg interrupt name arm64: dts: rockchip: Expand reg size of vdec node for RK3399 arm64: dts: rockchip: Expand reg size of vdec node for RK3328 Link: https://lore.kernel.org/r/2709704.mvXUDI8C0e@phil Signed-off-by: Arnd Bergmann commit f0b94c1c5c7994a74e487f43c91cfc922105a423 Author: Gil Fine Date: Thu Nov 30 18:17:13 2023 +0200 thunderbolt: Fix minimum allocated USB 3.x and PCIe bandwidth With the current bandwidth allocation we end up reserving too much for the USB 3.x and PCIe tunnels that leads to reduced capabilities for the second DisplayPort tunnel. Fix this by decreasing the USB 3.x allocation to 900 Mb/s which then allows both tunnels to get the maximum HBR2 bandwidth. This way, the reserved bandwidth for USB 3.x and PCIe, would be 1350 Mb/s (taking weights of USB 3.x and PCIe into account). So bandwidth allocations on a link are: USB 3.x + PCIe tunnels => 1350 Mb/s DisplayPort tunnel #1 => 17280 Mb/s DisplayPort tunnel #2 => 17280 Mb/s Total consumed bandwidth is 35910 Mb/s. So that all the above can be tunneled on a Gen 3 link (which allows maximum of 36000 Mb/s). Fixes: 582e70b0d3a4 ("thunderbolt: Change bandwidth reservations to comply USB4 v2") Signed-off-by: Gil Fine Signed-off-by: Mika Westerberg drivers/thunderbolt/usb4.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 6d1980f0af439b5fd49b1bee2220deff6888792e Author: Kent Overstreet Date: Thu Dec 7 12:39:13 2023 -0500 bcachefs: Fix deleted inode check for dirs We could delete directories transactionally on rmdir()/unlink(), but we don't; instead, like with regular files we wait for the VFS to call evict(). That means that our check for directories in the deleted inodes btree is wrong - the check should be for non-empty directories. Signed-off-by: Kent Overstreet fs/bcachefs/dirent.c | 19 +++++++++++-------- fs/bcachefs/dirent.h | 1 + fs/bcachefs/inode.c | 15 ++++++++++----- 3 files changed, 22 insertions(+), 13 deletions(-) commit b7b5a56acec819bb8dcd03c687e97a091b29d28f Merge: 9f3e1c591916 8d1b7809684c Author: Dave Airlie Date: Fri Dec 8 13:55:29 2023 +1000 Merge tag 'exynos-drm-next-for-v6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes Two fixups - Fix a potential error pointer dereference by checking the return value of exynos_drm_crtc_get_by_type() function before accessing to crtc object. - Fix a wrong error checking in exynos_drm_dma.c modules, which was reported by Dan[1] [1] https://lore.kernel.org/all/33e52277-1349-472b-a55b-ab5c3462bfcf@moroto.mountain/ Signed-off-by: Dave Airlie From: Inki Dae Link: https://patchwork.freedesktop.org/patch/msgid/20231207042223.2473706-1-inki.dae@samsung.com commit 9f3e1c5919169002c547df783b6167a2fc06c005 Merge: 9ac4883d24f2 dab96d8b61aa Author: Dave Airlie Date: Fri Dec 8 13:15:03 2023 +1000 Merge tag 'amd-drm-fixes-6.7-2023-12-06' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.7-2023-12-06: amdgpu: - Disable MCBP on gfx9 - DC vbios fix - eDP fix - dml2 UBSAN fix - SMU 14 fix - RAS fixes - dml KASAN/KCSAN fix - PSP 13 fix - Clockgating fixes - Suspend fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20231206221102.4995-1-alexander.deucher@amd.com commit 6f5c4eca48ffe18307b4e1d375817691c9005c87 Author: Dan Williams Date: Wed Dec 6 19:11:14 2023 -0800 cxl/hdm: Fix dpa translation locking The helper, cxl_dpa_resource_start(), snapshots the dpa-address of an endpoint-decoder after acquiring the cxl_dpa_rwsem. However, it is sufficient to assert that cxl_dpa_rwsem is held rather than acquire it in the helper. Otherwise, it triggers multiple lockdep reports: 1/ Tracing callbacks are in an atomic context that can not acquire sleeping locks: BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1525 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1288, name: bash preempt_count: 2, expected: 0 RCU nest depth: 0, expected: 0 [..] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc38 05/24/2023 Call Trace: dump_stack_lvl+0x71/0x90 __might_resched+0x1b2/0x2c0 down_read+0x1a/0x190 cxl_dpa_resource_start+0x15/0x50 [cxl_core] cxl_trace_hpa+0x122/0x300 [cxl_core] trace_event_raw_event_cxl_poison+0x1c9/0x2d0 [cxl_core] 2/ The rwsem is already held in the inject poison path: WARNING: possible recursive locking detected 6.7.0-rc2+ #12 Tainted: G W OE N -------------------------------------------- bash/1288 is trying to acquire lock: ffffffffc05f73d0 (cxl_dpa_rwsem){++++}-{3:3}, at: cxl_dpa_resource_start+0x15/0x50 [cxl_core] but task is already holding lock: ffffffffc05f73d0 (cxl_dpa_rwsem){++++}-{3:3}, at: cxl_inject_poison+0x7d/0x1e0 [cxl_core] [..] Call Trace: dump_stack_lvl+0x71/0x90 __might_resched+0x1b2/0x2c0 down_read+0x1a/0x190 cxl_dpa_resource_start+0x15/0x50 [cxl_core] cxl_trace_hpa+0x122/0x300 [cxl_core] trace_event_raw_event_cxl_poison+0x1c9/0x2d0 [cxl_core] __traceiter_cxl_poison+0x5c/0x80 [cxl_core] cxl_inject_poison+0x1bc/0x1e0 [cxl_core] This appears to have been an issue since the initial implementation and uncovered by the new cxl-poison.sh test [1]. That test is now passing with these changes. Fixes: 28a3ae4ff66c ("cxl/trace: Add an HPA to cxl_poison trace events") Link: http://lore.kernel.org/r/e4f2716646918135ddbadf4146e92abb659de734.1700615159.git.alison.schofield@intel.com [1] Cc: Cc: Alison Schofield Cc: Jonathan Cameron Cc: Dave Jiang Cc: Ira Weiny Signed-off-by: Dan Williams drivers/cxl/core/hdm.c | 3 +-- drivers/cxl/core/port.c | 4 ++-- 2 files changed, 3 insertions(+), 4 deletions(-) commit 9ac4883d24f231a290c3547b29bfc1f3b16727a5 Merge: abd02118807a e0f04e41e8ee Author: Dave Airlie Date: Fri Dec 8 12:16:10 2023 +1000 Merge tag 'drm-misc-fixes-2023-12-07' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v6.7-rc5: - Document nouveau's GSP-RM. - Flush vmm harder on nouveau tu102. - Panfrost fix for imported dma-buf objects, and device frequency. - Kconfig Build fix for tc358768. - Call end_fb_access after atomic commit. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/05a26dc0-8cf1-4b1f-abb6-3bf471fbfc99@linux.intel.com commit 5e3f5b81de80c98338bcb47c233aebefee5a4801 Merge: 9ace34a8e446 b0a930e8d90c Author: Linus Torvalds Date: Thu Dec 7 17:04:13 2023 -0800 Merge tag 'net-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bpf and netfilter. Current release - regressions: - veth: fix packet segmentation in veth_convert_skb_to_xdp_buff Current release - new code bugs: - tcp: assorted fixes to the new Auth Option support Older releases - regressions: - tcp: fix mid stream window clamp - tls: fix incorrect splice handling - ipv4: ip_gre: handle skb_pull() failure in ipgre_xmit() - dsa: mv88e6xxx: restore USXGMII support for 6393X - arcnet: restore support for multiple Sohard Arcnet cards Older releases - always broken: - tcp: do not accept ACK of bytes we never sent - require admin privileges to receive packet traces via netlink - packet: move reference count in packet_sock to atomic_long_t - bpf: - fix incorrect branch offset comparison with cpu=v4 - fix prog_array_map_poke_run map poke update - netfilter: - three fixes for crashes on bad admin commands - xt_owner: fix race accessing sk->sk_socket, TOCTOU null-deref - nf_tables: fix 'exist' matching on bigendian arches - leds: netdev: fix RTNL handling to prevent potential deadlock - eth: tg3: prevent races in error/reset handling - eth: r8169: fix rtl8125b PAUSE storm when suspended - eth: r8152: improve reset and surprise removal handling - eth: hns: fix race between changing features and sending - eth: nfp: fix sleep in atomic for bonding offload" * tag 'net-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (62 commits) vsock/virtio: fix "comparison of distinct pointer types lacks a cast" warning net/smc: fix missing byte order conversion in CLC handshake net: dsa: microchip: provide a list of valid protocols for xmit handler drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group psample: Require 'CAP_NET_ADMIN' when joining "packets" group bpf: sockmap, updating the sg structure should also update curr net: tls, update curr on splice as well nfp: flower: fix for take a mutex lock in soft irq context and rcu lock net: dsa: mv88e6xxx: Restore USXGMII support for 6393X tcp: do not accept ACK of bytes we never sent selftests/bpf: Add test for early update in prog_array_map_poke_run bpf: Fix prog_array_map_poke_run map poke update netfilter: xt_owner: Fix for unsafe access of sk->sk_socket netfilter: nf_tables: validate family when identifying table via handle netfilter: nf_tables: bail out on mismatching dynset and set expressions netfilter: nf_tables: fix 'exist' matching on bigendian arches netfilter: nft_set_pipapo: skip inactive elements during set walk netfilter: bpf: fix bad registration on nf_defrag leds: trigger: netdev: fix RTNL handling to prevent potential deadlock octeontx2-af: Update Tx link register range ... commit abd02118807adec599e2d03b8b18529f5ba7f2a5 Merge: 33924328498e 9f269070abe9 Author: Dave Airlie Date: Fri Dec 8 11:00:58 2023 +1000 Merge tag 'drm-intel-fixes-2023-12-07' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v6.7-rc5: - d21a3962d304 ("drm/i915: Call intel_pre_plane_updates() also for pipes getting enabled") in the previous fixes pull depends on a change that wasn't included. Pick it up. - Relax BXT/GLK DSI transcoder hblank limits - Fix DP MST .mode_valid_ctx() return values - Reject DP MST modes that require bigjoiner (as it's not yet supported on DP MST) - Fix _intel_dsb_commit() variable type to allow negative values Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87msum1hv8.fsf@intel.com commit 9ace34a8e446c1a566f3b0a3e0c4c483987e39a6 Merge: e0348c1f686a cff5f49d433f Author: Linus Torvalds Date: Thu Dec 7 12:42:40 2023 -0800 Merge tag 'cgroup-for-6.7-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fix from Tejun Heo: "Just one fix. Commit f5d39b020809 ("freezer,sched: Rewrite core freezer logic") changed how freezing state is recorded which made cgroup_freezing() disagree with the actual state of the task while thawing triggering a warning. Fix it by updating cgroup_freezing()" * tag 'cgroup-for-6.7-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup_freezer: cgroup_freezing: Check if not frozen commit 8f0b960a42badda7a2781e8a33564624200debc9 Author: Rafael J. Wysocki Date: Thu Dec 7 19:28:10 2023 +0100 ACPI: utils: Fix error path in acpi_evaluate_reference() If a pointer to an uninitialized struct acpi_handle_list is passed to acpi_evaluate_reference() and it decides to bail out early, either because acpi_evaluate_object() fails, or because it produces invalid data, the handles pointer from the struct acpi_handle_list will be passed to kfree() and if it is not NULL, the kernel will crash on an attempt to free unallocated memory. Address this by moving the "end" label in acpi_evaluate_reference() to the end of the function, which is sufficient, because no cleanup is needed in that case. Fixes: 2e57d10a6591 ("ACPI: utils: Dynamically determine acpi_handle_list size") Signed-off-by: Rafael J. Wysocki Tested-by: Woody Suwalski drivers/acpi/utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e0348c1f686a939222a2cbe7f3861e356b60d9b6 Merge: 4388ae22aeaa 4a6c5607d450 Author: Linus Torvalds Date: Thu Dec 7 12:36:32 2023 -0800 Merge tag 'wq-for-6.7-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fix from Tejun Heo: "Just one patch to fix a bug which can crash the kernel if the housekeeping and wq_unbound_cpu cpumask configuration combination leaves the latter empty" * tag 'wq-for-6.7-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Make sure that wq_unbound_cpumask is never empty commit 4388ae22aeaa1cd2f74edaa5cf5a518cc5f04c56 Merge: d5c0b6014534 fea88064445a Author: Linus Torvalds Date: Thu Dec 7 12:30:54 2023 -0800 Merge tag 'regmap-fix-v6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fix from Mark Brown: "An incremental fix for the fix introduced during the merge window for caching of the selector for windowed register ranges. We were incorrectly leaking an error code in the case where the last selector accessed was for some reason not cached" * tag 'regmap-fix-v6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: fix bogus error on regcache_sync success commit d5c0b601453483f3068b9b06e13f83ea546c36e6 Merge: 33d42bde9927 136c6531ba12 Author: Linus Torvalds Date: Thu Dec 7 12:22:36 2023 -0800 Merge tag 'devicetree-fixes-for-6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix dt-extract-compatibles for builds with in tree build directory - Drop Xinlei Lee bouncing email - Fix the of_reconfig_get_state_change() return value documentation - Add missing #power-domain-cells property to QCom MPM - Fix warnings in i.MX LCDIF and adi,adv7533 * tag 'devicetree-fixes-for-6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: display: adi,adv75xx: Document #sound-dai-cells dt-bindings: lcdif: Properly describe the i.MX23 interrupts dt-bindings: interrupt-controller: Allow #power-domain-cells of: dynamic: Fix of_reconfig_get_state_change() return value documentation dt-bindings: display: mediatek: dsi: remove Xinlei's mail dt: dt-extract-compatibles: Don't follow symlinks when walking tree commit 33d42bde99274217305327ab14cef9e182961ff3 Merge: f35e46631b28 3494a594315b Author: Linus Torvalds Date: Thu Dec 7 12:10:55 2023 -0800 Merge tag 'platform-drivers-x86-v6.7-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - Fix i8042 filter resource handling, input, and suspend issues in asus-wmi - Skip zero instance WMI blocks to avoid issues with some laptops - Differentiate dev/production keys in mlxbf-bootctl - Correct surface serdev related return value to avoid leaking errno into userspace - Error checking fixes * tag 'platform-drivers-x86-v6.7-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/mellanox: Check devm_hwmon_device_register_with_groups() return value platform/mellanox: Add null pointer checks for devm_kasprintf() mlxbf-bootctl: correctly identify secure boot with development keys platform/x86: wmi: Skip blocks with zero instances platform/surface: aggregator: fix recv_buf() return value platform/x86: asus-wmi: disable USB0 hub on ROG Ally before suspend platform/x86: asus-wmi: Filter Volume key presses if also reported via atkbd platform/x86: asus-wmi: Change q500a_i8042_filter() into a generic i8042-filter platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code commit f35e46631b28a63ca3887d7afef1a65a5544da52 Merge: 55b224d90d44 f4116bfc4462 Author: Linus Torvalds Date: Thu Dec 7 11:56:34 2023 -0800 Merge tag 'x86-int80-20231207' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 int80 fixes from Dave Hansen: "Avoid VMM misuse of 'int 0x80' handling in TDX and SEV guests. It also has the very nice side effect of getting rid of a bunch of assembly entry code" * tag 'x86-int80-20231207' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/tdx: Allow 32-bit emulation by default x86/entry: Do not allow external 0x80 interrupts x86/entry: Convert INT 0x80 emulation to IDTENTRY x86/coco: Disable 32-bit emulation by default on TDX and SEV commit c6d3ab9e76dc01011392cf8309f7e684b94ec464 Merge: 22b9a8964ead b39113349de6 Author: Jens Axboe Date: Thu Dec 7 12:15:18 2023 -0700 Merge tag 'md-fixes-20231207-1' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-6.7 Pull MD fix from Song: "This change from Yu Kuai fixes a bug reported in https://bugzilla.kernel.org/show_bug.cgi?id=218200" * tag 'md-fixes-20231207-1' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: md: split MD_RECOVERY_NEEDED out of mddev_resume commit 634e5e1e06f5cdd614a1bc429ecb243a51cc009d Author: Takashi Iwai Date: Thu Dec 7 19:20:35 2023 +0100 ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 Lenovo Yoga Pro 7 14APH8 (PCI SSID 17aa:3882) seems requiring the similar workaround like Yoga 9 model for the bass speaker. Cc: Link: https://lore.kernel.org/r/CAGGk=CRRQ1L9p771HsXTN_ebZP41Qj+3gw35Gezurn+nokRewg@mail.gmail.com Link: https://lore.kernel.org/r/20231207182035.30248-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit b39113349de60e9b0bc97c2e129181b193c45054 Author: Yu Kuai Date: Thu Dec 7 10:07:24 2023 +0800 md: split MD_RECOVERY_NEEDED out of mddev_resume New mddev_resume() calls are added to synchronize IO with array reconfiguration, however, this introduces a performance regression while adding it in md_start_sync(): 1) someone sets MD_RECOVERY_NEEDED first; 2) daemon thread grabs reconfig_mutex, then clears MD_RECOVERY_NEEDED and queues a new sync work; 3) daemon thread releases reconfig_mutex; 4) in md_start_sync a) check that there are spares that can be added/removed, then suspend the array; b) remove_and_add_spares may not be called, or called without really add/remove spares; c) resume the array, then set MD_RECOVERY_NEEDED again! Loop between 2 - 4, then mddev_suspend() will be called quite often, for consequence, normal IO will be quite slow. Fix this problem by don't set MD_RECOVERY_NEEDED again in md_start_sync(), hence the loop will be broken. Fixes: bc08041b32ab ("md: suspend array in md_start_sync() if array need reconfiguration") Suggested-by: Song Liu Reported-by: Janpieter Sollie Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218200 Signed-off-by: Yu Kuai Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20231207020724.2797445-1-yukuai1@huaweicloud.com drivers/md/md.c | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-) commit b0a930e8d90caf66a94fee7a9d0b8472bc3e7561 Author: Stefano Garzarella Date: Wed Dec 6 17:41:43 2023 +0100 vsock/virtio: fix "comparison of distinct pointer types lacks a cast" warning After backporting commit 581512a6dc93 ("vsock/virtio: MSG_ZEROCOPY flag support") in CentOS Stream 9, CI reported the following error: In file included from ./include/linux/kernel.h:17, from ./include/linux/list.h:9, from ./include/linux/preempt.h:11, from ./include/linux/spinlock.h:56, from net/vmw_vsock/virtio_transport_common.c:9: net/vmw_vsock/virtio_transport_common.c: In function ‘virtio_transport_can_zcopy‘: ./include/linux/minmax.h:20:35: error: comparison of distinct pointer types lacks a cast [-Werror] 20 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ^~ ./include/linux/minmax.h:26:18: note: in expansion of macro ‘__typecheck‘ 26 | (__typecheck(x, y) && __no_side_effects(x, y)) | ^~~~~~~~~~~ ./include/linux/minmax.h:36:31: note: in expansion of macro ‘__safe_cmp‘ 36 | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~ ./include/linux/minmax.h:45:25: note: in expansion of macro ‘__careful_cmp‘ 45 | #define min(x, y) __careful_cmp(x, y, <) | ^~~~~~~~~~~~~ net/vmw_vsock/virtio_transport_common.c:63:37: note: in expansion of macro ‘min‘ 63 | int pages_to_send = min(pages_in_iov, MAX_SKB_FRAGS); We could solve it by using min_t(), but this operation seems entirely unnecessary, because we also pass MAX_SKB_FRAGS to iov_iter_npages(), which performs almost the same check, returning at most MAX_SKB_FRAGS elements. So, let's eliminate this unnecessary comparison. Fixes: 581512a6dc93 ("vsock/virtio: MSG_ZEROCOPY flag support") Cc: avkrasnov@salutedevices.com Signed-off-by: Stefano Garzarella Acked-by: Michael S. Tsirkin Reviewed-by: Arseniy Krasnov Link: https://lore.kernel.org/r/20231206164143.281107-1-sgarzare@redhat.com Signed-off-by: Jakub Kicinski net/vmw_vsock/virtio_transport_common.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit c5a10397d4571bcfd4bd7ca211ee47bcb6792ec3 Author: Wen Gu Date: Thu Dec 7 01:02:37 2023 +0800 net/smc: fix missing byte order conversion in CLC handshake The byte order conversions of ISM GID and DMB token are missing in process of CLC accept and confirm. So fix it. Fixes: 3d9725a6a133 ("net/smc: common routine for CLC accept and confirm") Signed-off-by: Wen Gu Reviewed-by: Tony Lu Reviewed-by: Alexandra Winter Reviewed-by: Wenjia Zhang Link: https://lore.kernel.org/r/1701882157-87956-1-git-send-email-guwen@linux.alibaba.com Signed-off-by: Jakub Kicinski net/smc/af_smc.c | 4 ++-- net/smc/smc_clc.c | 9 ++++----- net/smc/smc_clc.h | 4 ++-- 3 files changed, 8 insertions(+), 9 deletions(-) commit 1499b89289bf272fd83cb296c82fb5519d0fe93f Author: Sean Nyekjaer Date: Wed Dec 6 08:16:54 2023 +0100 net: dsa: microchip: provide a list of valid protocols for xmit handler Provide a list of valid protocols for which the driver will provide it's deferred xmit handler. When using DSA_TAG_PROTO_KSZ8795 protocol, it does not provide a "connect" method, therefor ksz_connect() is not allocating ksz_tagger_data. This avoids the following null pointer dereference: ksz_connect_tag_protocol from dsa_register_switch+0x9ac/0xee0 dsa_register_switch from ksz_switch_register+0x65c/0x828 ksz_switch_register from ksz_spi_probe+0x11c/0x168 ksz_spi_probe from spi_probe+0x84/0xa8 spi_probe from really_probe+0xc8/0x2d8 Fixes: ab32f56a4100 ("net: dsa: microchip: ptp: add packet transmission timestamping") Signed-off-by: Sean Nyekjaer Reviewed-by: Florian Fainelli Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20231206071655.1626479-1-sean@geanix.com Signed-off-by: Jakub Kicinski drivers/net/dsa/microchip/ksz_common.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) commit a041adee8a9c8d07d876d0633476f407554fc8cb Merge: 4a02609d756c e03781879a0d Author: Jakub Kicinski Date: Thu Dec 7 09:54:04 2023 -0800 Merge branch 'generic-netlink-multicast-fixes' Ido Schimmel says: ==================== Generic netlink multicast fixes Restrict two generic netlink multicast groups - in the "psample" and "NET_DM" families - to be root-only with the appropriate capabilities. See individual patches for more details. ==================== Link: https://lore.kernel.org/r/20231206213102.1824398-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit e03781879a0d524ce3126678d50a80484a513c4b Author: Ido Schimmel Date: Wed Dec 6 23:31:02 2023 +0200 drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group The "NET_DM" generic netlink family notifies drop locations over the "events" multicast group. This is problematic since by default generic netlink allows non-root users to listen to these notifications. Fix by adding a new field to the generic netlink multicast group structure that when set prevents non-root users or root without the 'CAP_SYS_ADMIN' capability (in the user namespace owning the network namespace) from joining the group. Set this field for the "events" group. Use 'CAP_SYS_ADMIN' rather than 'CAP_NET_ADMIN' because of the nature of the information that is shared over this group. Note that the capability check in this case will always be performed against the initial user namespace since the family is not netns aware and only operates in the initial network namespace. A new field is added to the structure rather than using the "flags" field because the existing field uses uAPI flags and it is inappropriate to add a new uAPI flag for an internal kernel check. In net-next we can rework the "flags" field to use internal flags and fold the new field into it. But for now, in order to reduce the amount of changes, add a new field. Since the information can only be consumed by root, mark the control plane operations that start and stop the tracing as root-only using the 'GENL_ADMIN_PERM' flag. Tested using [1]. Before: # capsh -- -c ./dm_repo # capsh --drop=cap_sys_admin -- -c ./dm_repo After: # capsh -- -c ./dm_repo # capsh --drop=cap_sys_admin -- -c ./dm_repo Failed to join "events" multicast group [1] $ cat dm.c #include #include #include #include int main(int argc, char **argv) { struct nl_sock *sk; int grp, err; sk = nl_socket_alloc(); if (!sk) { fprintf(stderr, "Failed to allocate socket\n"); return -1; } err = genl_connect(sk); if (err) { fprintf(stderr, "Failed to connect socket\n"); return err; } grp = genl_ctrl_resolve_grp(sk, "NET_DM", "events"); if (grp < 0) { fprintf(stderr, "Failed to resolve \"events\" multicast group\n"); return grp; } err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE); if (err) { fprintf(stderr, "Failed to join \"events\" multicast group\n"); return err; } return 0; } $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o dm_repo dm.c Fixes: 9a8afc8d3962 ("Network Drop Monitor: Adding drop monitor implementation & Netlink protocol") Reported-by: "The UK's National Cyber Security Centre (NCSC)" Signed-off-by: Ido Schimmel Reviewed-by: Jacob Keller Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/20231206213102.1824398-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski include/net/genetlink.h | 2 ++ net/core/drop_monitor.c | 4 +++- net/netlink/genetlink.c | 3 +++ 3 files changed, 8 insertions(+), 1 deletion(-) commit 44ec98ea5ea9cfecd31a5c4cc124703cb5442832 Author: Ido Schimmel Date: Wed Dec 6 23:31:01 2023 +0200 psample: Require 'CAP_NET_ADMIN' when joining "packets" group The "psample" generic netlink family notifies sampled packets over the "packets" multicast group. This is problematic since by default generic netlink allows non-root users to listen to these notifications. Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will prevent non-root users or root without the 'CAP_NET_ADMIN' capability (in the user namespace owning the network namespace) from joining the group. Tested using [1]. Before: # capsh -- -c ./psample_repo # capsh --drop=cap_net_admin -- -c ./psample_repo After: # capsh -- -c ./psample_repo # capsh --drop=cap_net_admin -- -c ./psample_repo Failed to join "packets" multicast group [1] $ cat psample.c #include #include #include #include int join_grp(struct nl_sock *sk, const char *grp_name) { int grp, err; grp = genl_ctrl_resolve_grp(sk, "psample", grp_name); if (grp < 0) { fprintf(stderr, "Failed to resolve \"%s\" multicast group\n", grp_name); return grp; } err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE); if (err) { fprintf(stderr, "Failed to join \"%s\" multicast group\n", grp_name); return err; } return 0; } int main(int argc, char **argv) { struct nl_sock *sk; int err; sk = nl_socket_alloc(); if (!sk) { fprintf(stderr, "Failed to allocate socket\n"); return -1; } err = genl_connect(sk); if (err) { fprintf(stderr, "Failed to connect socket\n"); return err; } err = join_grp(sk, "config"); if (err) return err; err = join_grp(sk, "packets"); if (err) return err; return 0; } $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling") Reported-by: "The UK's National Cyber Security Centre (NCSC)" Signed-off-by: Ido Schimmel Reviewed-by: Jacob Keller Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/20231206213102.1824398-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski net/psample/psample.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 4a02609d756cdcf2f2d58f16423ba166f599ea7a Merge: 4de75d3e6b0e bb9aefde5bba Author: Jakub Kicinski Date: Thu Dec 7 09:52:30 2023 -0800 Merge branch 'fixes-for-ktls' John Fastabend says: ==================== Couple fixes for TLS and BPF interactions. ==================== Link: https://lore.kernel.org/r/20231206232706.374377-1-john.fastabend@gmail.com Signed-off-by: Jakub Kicinski commit bb9aefde5bbaf6c168c77ba635c155b4980c2287 Author: John Fastabend Date: Wed Dec 6 15:27:06 2023 -0800 bpf: sockmap, updating the sg structure should also update curr Curr pointer should be updated when the sg structure is shifted. Fixes: 7246d8ed4dcce ("bpf: helper to pop data from messages") Signed-off-by: John Fastabend Link: https://lore.kernel.org/r/20231206232706.374377-3-john.fastabend@gmail.com Signed-off-by: Jakub Kicinski net/core/filter.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) commit c5a595000e2677e865a39f249c056bc05d6e55fd Author: John Fastabend Date: Wed Dec 6 15:27:05 2023 -0800 net: tls, update curr on splice as well The curr pointer must also be updated on the splice similar to how we do this for other copy types. Fixes: d829e9c4112b ("tls: convert to generic sk_msg interface") Signed-off-by: John Fastabend Reported-by: Jann Horn Link: https://lore.kernel.org/r/20231206232706.374377-2-john.fastabend@gmail.com Signed-off-by: Jakub Kicinski net/tls/tls_sw.c | 2 ++ 1 file changed, 2 insertions(+) commit f4116bfc44621882556bbf70f5284fbf429a5cf6 Author: Kirill A. Shutemov Date: Mon Dec 4 11:31:41 2023 +0300 x86/tdx: Allow 32-bit emulation by default 32-bit emulation was disabled on TDX to prevent a possible attack by a VMM injecting an interrupt on vector 0x80. Now that int80_emulation() has a check for external interrupts the limitation can be lifted. To distinguish software interrupts from external ones, int80_emulation() checks the APIC ISR bit relevant to the 0x80 vector. For software interrupts, this bit will be 0. On TDX, the VAPIC state (including ISR) is protected and cannot be manipulated by the VMM. The ISR bit is set by the microcode flow during the handling of posted interrupts. [ dhansen: more changelog tweaks ] Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Reviewed-by: Thomas Gleixner Reviewed-by: Borislav Petkov (AMD) Cc: # v6.0+ arch/x86/coco/tdx/tdx.c | 9 --------- 1 file changed, 9 deletions(-) commit 55617fb991df535f953589586468612351575704 Author: Thomas Gleixner Date: Mon Dec 4 11:31:40 2023 +0300 x86/entry: Do not allow external 0x80 interrupts The INT 0x80 instruction is used for 32-bit x86 Linux syscalls. The kernel expects to receive a software interrupt as a result of the INT 0x80 instruction. However, an external interrupt on the same vector also triggers the same codepath. An external interrupt on vector 0x80 will currently be interpreted as a 32-bit system call, and assuming that it was a user context. Panic on external interrupts on the vector. To distinguish software interrupts from external ones, the kernel checks the APIC ISR bit relevant to the 0x80 vector. For software interrupts, this bit will be 0. Signed-off-by: Thomas Gleixner Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Reviewed-by: Borislav Petkov (AMD) Cc: # v6.0+ arch/x86/entry/common.c | 37 ++++++++++++++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) commit be5341eb0d43b1e754799498bd2e8756cc167a41 Author: Thomas Gleixner Date: Mon Dec 4 11:31:39 2023 +0300 x86/entry: Convert INT 0x80 emulation to IDTENTRY There is no real reason to have a separate ASM entry point implementation for the legacy INT 0x80 syscall emulation on 64-bit. IDTENTRY provides all the functionality needed with the only difference that it does not: - save the syscall number (AX) into pt_regs::orig_ax - set pt_regs::ax to -ENOSYS Both can be done safely in the C code of an IDTENTRY before invoking any of the syscall related functions which depend on this convention. Aside of ASM code reduction this prepares for detecting and handling a local APIC injected vector 0x80. [ kirill.shutemov: More verbose comments ] Suggested-by: Linus Torvalds Signed-off-by: Thomas Gleixner Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Reviewed-by: Borislav Petkov (AMD) Cc: # v6.0+ arch/x86/entry/common.c | 58 +++++++++++++++++++++++++++++- arch/x86/entry/entry_64_compat.S | 77 ---------------------------------------- arch/x86/include/asm/idtentry.h | 4 +++ arch/x86/include/asm/proto.h | 4 --- arch/x86/kernel/idt.c | 2 +- arch/x86/xen/enlighten_pv.c | 2 +- arch/x86/xen/xen-asm.S | 2 +- 7 files changed, 64 insertions(+), 85 deletions(-) commit b82a8dbd3d2f4563156f7150c6f2ecab6e960b30 Author: Kirill A. Shutemov Date: Mon Dec 4 11:31:38 2023 +0300 x86/coco: Disable 32-bit emulation by default on TDX and SEV The INT 0x80 instruction is used for 32-bit x86 Linux syscalls. The kernel expects to receive a software interrupt as a result of the INT 0x80 instruction. However, an external interrupt on the same vector triggers the same handler. The kernel interprets an external interrupt on vector 0x80 as a 32-bit system call that came from userspace. A VMM can inject external interrupts on any arbitrary vector at any time. This remains true even for TDX and SEV guests where the VMM is untrusted. Put together, this allows an untrusted VMM to trigger int80 syscall handling at any given point. The content of the guest register file at that moment defines what syscall is triggered and its arguments. It opens the guest OS to manipulation from the VMM side. Disable 32-bit emulation by default for TDX and SEV. User can override it with the ia32_emulation=y command line option. [ dhansen: reword the changelog ] Reported-by: Supraja Sridhara Reported-by: Benedict Schlüter Reported-by: Mark Kuhne Reported-by: Andrin Bertschi Reported-by: Shweta Shinde Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Reviewed-by: Thomas Gleixner Reviewed-by: Borislav Petkov (AMD) Cc: # v6.0+: 1da5c9b x86: Introduce ia32_enabled() Cc: # v6.0+ arch/x86/coco/tdx/tdx.c | 10 ++++++++++ arch/x86/include/asm/ia32.h | 7 +++++++ arch/x86/mm/mem_encrypt_amd.c | 11 +++++++++++ 3 files changed, 28 insertions(+) commit 4de75d3e6b0ece518a2e6e48c2716f1b223716d3 Merge: c85e5594b745 7ae836a3d630 Author: Jakub Kicinski Date: Thu Dec 7 09:43:29 2023 -0800 Merge tag 'nf-23-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Incorrect nf_defrag registration for bpf link infra, from D. Wythe. 2) Skip inactive elements in pipapo set backend walk to avoid double deactivation, from Florian Westphal. 3) Fix NFT_*_F_PRESENT check with big endian arch, also from Florian. 4) Bail out if number of expressions in NFTA_DYNSET_EXPRESSIONS mismatch stateful expressions in set declaration. 5) Honor family in table lookup by handle. Broken since 4.16. 6) Use sk_callback_lock to protect access to sk->sk_socket in xt_owner. sock_orphan() might zap this pointer, from Phil Sutter. All of these fixes address broken stuff for several releases. * tag 'nf-23-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: xt_owner: Fix for unsafe access of sk->sk_socket netfilter: nf_tables: validate family when identifying table via handle netfilter: nf_tables: bail out on mismatching dynset and set expressions netfilter: nf_tables: fix 'exist' matching on bigendian arches netfilter: nft_set_pipapo: skip inactive elements during set walk netfilter: bpf: fix bad registration on nf_defrag ==================== Link: https://lore.kernel.org/r/20231206180357.959930-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 705318a99a138c29a512a72c3e0043b3cd7f55f4 Author: Pavel Begunkov Date: Wed Dec 6 13:26:47 2023 +0000 io_uring/af_unix: disable sending io_uring over sockets File reference cycles have caused lots of problems for io_uring in the past, and it still doesn't work exactly right and races with unix_stream_read_generic(). The safest fix would be to completely disallow sending io_uring files via sockets via SCM_RIGHT, so there are no possible cycles invloving registered files and thus rendering SCM accounting on the io_uring side unnecessary. Cc: Fixes: 0091bfc81741b ("io_uring/af_unix: defer registered files gc to io_uring release") Reported-and-suggested-by: Jann Horn Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/c716c88321939156909cfa1bd8b0faaf1c804103.1701868795.git.asml.silence@gmail.com Signed-off-by: Jens Axboe io_uring/rsrc.h | 7 ------- net/core/scm.c | 6 ++++++ 2 files changed, 6 insertions(+), 7 deletions(-) commit c85e5594b7456d55103fa1f1bde47cd4e002e7fb Merge: 0ad722bd9ee3 ffed24eff9e0 Author: Jakub Kicinski Date: Thu Dec 7 09:32:23 2023 -0800 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2023-12-06 We've added 4 non-merge commits during the last 6 day(s) which contain a total of 7 files changed, 185 insertions(+), 55 deletions(-). The main changes are: 1) Fix race found by syzkaller on prog_array_map_poke_run when a BPF program's kallsym symbols were still missing, from Jiri Olsa. 2) Fix BPF verifier's branch offset comparison for BPF_JMP32 | BPF_JA, from Yonghong Song. 3) Fix xsk's poll handling to only set mask on bound xsk sockets, from Yewon Choi. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Add test for early update in prog_array_map_poke_run bpf: Fix prog_array_map_poke_run map poke update xsk: Skip polling event check for unbound socket bpf: Fix a verifier bug due to incorrect branch offset comparison with cpu=v4 ==================== Link: https://lore.kernel.org/r/20231206220528.12093-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 22b9a8964ead09e4bc0f03305cadee353653d790 Merge: 7d2affce3320 107b4e063d78 Author: Jens Axboe Date: Thu Dec 7 10:30:54 2023 -0700 Merge tag 'nvme-6.7-2023-12-7' of git://git.infradead.org/nvme into block-6.7 Pull NVMe fixes from Keith: "nvme fixes for Linux 6.7 - Proper nvme ctrl state setting (Keith) - Passthrough command optimization (Keith) - Spectre fix (Nitesh) - Kconfig clarifications (Shin'ichiro) - Frozen state deadlock fix (Bitao) - Power setting quirk (Georg)" * tag 'nvme-6.7-2023-12-7' of git://git.infradead.org/nvme: nvme-pci: Add sleep quirk for Kingston drives nvme: fix deadlock between reset and scan nvme: prevent potential spectre v1 gadget nvme: improve NVME_HOST_AUTH and NVME_TARGET_AUTH config descriptions nvme-ioctl: move capable() admin check to the end nvme: ensure reset state check ordering nvme: introduce helper function to get ctrl state commit 107b4e063d78c300b21e2d5291b1aa94c514ea5b Author: Georg Gottleuber Date: Wed Sep 20 10:52:10 2023 +0200 nvme-pci: Add sleep quirk for Kingston drives Some Kingston NV1 and A2000 are wasting a lot of power on specific TUXEDO platforms in s2idle sleep if 'Simple Suspend' is used. This patch applies a new quirk 'Force No Simple Suspend' to achieve a low power sleep without 'Simple Suspend'. Signed-off-by: Werner Sembach Signed-off-by: Georg Gottleuber Cc: Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/host/nvme.h | 5 +++++ drivers/nvme/host/pci.c | 16 +++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-) commit 7c9bb19045835946ad85811d7b5e8d21f53f52a0 Merge: b0b2981c49ff 63ef8fc9bcee Author: Arnd Bergmann Date: Thu Dec 7 17:36:27 2023 +0100 Merge tag 'imx-fixes-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.7: - A MAINTAINERS update to reinstate freescale ARM64 DT directory in i.MX entry. - A series from Alexander Stein to fix #pwm-cells for imx8-ss. - A series from Haibo Chen to fix GPIO node name for i.MX93 and i.MX8ULP. - Add parkmode-disable-ss-quirk for DWC3 on i.MX8MP and i.MX8MQ to fix an issue that the controller may hang when processing transactions under heavy USB traffic from multiple endpoints. - Fix mediamix block power on/off for i.MX93 by correcting the power domain clock to be 'nic_media'. - A couple of Ethernet PHY clock regression fixes for imx6ul-pico and imx6q-skov board. - Fix edma3 power domain for i.MX8QM to fix a panic during startup process. * tag 'imx-fixes-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: dts: imx28-xea: Pass the 'model' property ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt MAINTAINERS: reinstate freescale ARM64 DT directory in i.MX entry arm64: dts: imx8-apalis: set wifi regulator to always-on ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init arm64: dts: imx8ulp: update gpio node name to align with register address arm64: dts: imx93: update gpio node name to align with register address arm64: dts: imx93: correct mediamix power arm64: dts: imx8qm: Add imx8qm's own pm to avoid panic during startup arm64: dts: freescale: imx8-ss-dma: Fix #pwm-cells arm64: dts: freescale: imx8-ss-lsio: Fix #pwm-cells dt-bindings: pwm: imx-pwm: Unify #pwm-cells for all compatibles ARM: dts: imx6ul-pico: Describe the Ethernet PHY clock arm64: dts: imx8mp: imx8mq: Add parkmode-disable-ss-quirk on DWC3 ARM: dts: imx6q: skov: fix ethernet clock regression arm64: dt: imx93: tqma9352-mba93xxla: Fix LPUART2 pad config Link: https://lore.kernel.org/r/20231207005202.GF270430@dragon Signed-off-by: Arnd Bergmann commit 5a6c9a05e55cb2972396cc991af9d74c8c15029a Author: Lingkai Dong Date: Wed Dec 6 13:51:58 2023 +0000 drm: Fix FD ownership check in drm_master_check_perm() The DRM subsystem keeps a record of the owner of a DRM device file descriptor using thread group ID (TGID) instead of process ID (PID), to ensures all threads within the same userspace process are considered the owner. However, the DRM master ownership check compares the current thread's PID against the record, so the thread is incorrectly considered to be not the FD owner if the PID is not equal to the TGID. This causes DRM ioctls to be denied master privileges, even if the same thread that opened the FD performs an ioctl. Fix this by checking TGID. Fixes: 4230cea89cafb ("drm: Track clients by tgid and not tid") Signed-off-by: Lingkai Dong Reviewed-by: Christian König Reviewed-by: Tvrtko Ursulin Cc: # v6.4+ Link: https://patchwork.freedesktop.org/patch/msgid/PA6PR08MB107665920BE9A96658CDA04CE8884A@PA6PR08MB10766.eurprd08.prod.outlook.com Signed-off-by: Christian König drivers/gpu/drm/drm_auth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0ad722bd9ee3a9bdfca9613148645e4c9b7f26cf Author: Hui Zhou Date: Tue Dec 5 11:26:25 2023 +0200 nfp: flower: fix for take a mutex lock in soft irq context and rcu lock The neighbour event callback call the function nfp_tun_write_neigh, this function will take a mutex lock and it is in soft irq context, change the work queue to process the neighbour event. Move the nfp_tun_write_neigh function out of range rcu_read_lock/unlock() in function nfp_tunnel_request_route_v4 and nfp_tunnel_request_route_v6. Fixes: abc210952af7 ("nfp: flower: tunnel neigh support bond offload") CC: stable@vger.kernel.org # 6.2+ Signed-off-by: Hui Zhou Signed-off-by: Louis Peens Signed-off-by: David S. Miller .../ethernet/netronome/nfp/flower/tunnel_conf.c | 127 +++++++++++++++------ 1 file changed, 95 insertions(+), 32 deletions(-) commit eb99b1b72a424a79f56c972e0fd7ad01fe93a008 Author: Ivan Orlov Date: Wed Dec 6 22:32:11 2023 +0000 ALSA: pcmtest: stop timer before buffer is released Stop timer in the 'trigger' and 'sync_stop' callbacks since we want the timer to be stopped before the DMA buffer is released. Otherwise, it could trigger a kernel panic in some circumstances, for instance when the DMA buffer is already released but the timer callback is still running. Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20231206223211.12761-1-ivan.orlov0322@gmail.com Signed-off-by: Takashi Iwai sound/drivers/pcmtest.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) commit 55b224d90d44d794c1afab046c4fd9dc8be9247d Merge: bee0e7762ad2 487635756198 Author: Linus Torvalds Date: Wed Dec 6 23:22:48 2023 -0800 Merge tag 'parisc-for-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fix from Helge Deller: "A single line patch for parisc which fixes the build in tinyconfig configurations: - Fix asm operand number out of range build error in bug table" * tag 'parisc-for-6.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Fix asm operand number out of range build error in bug table commit 8804fa04a492f4176ea407390052292912227820 Author: Mario Limonciello Date: Wed Dec 6 13:39:27 2023 -0600 ALSA: hda/realtek: Add Framework laptop 16 to quirks The Framework 16" laptop has the same controller as other Framework models. Apply the presence detection quirk. Signed-off-by: Mario Limonciello Cc: Link: https://lore.kernel.org/r/20231206193927.2996-1-mario.limonciello@amd.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 803a809d3d85cf06a04770fb04b585364d2d26dc Merge: 0c7ed1f9197a a206d9959f5c Author: Jakub Kicinski Date: Wed Dec 6 19:33:43 2023 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-12-05 (ice, i40e, iavf) This series contains updates to ice, i40e and iavf drivers. Michal fixes incorrect usage of VF MSIX value and index calculation for ice. Marcin restores disabling of Rx VLAN filtering which was inadvertently removed for ice. Ivan Vecera corrects improper messaging of MFS port for i40e. Jake fixes incorrect checking of coalesce values on iavf. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: iavf: validate tx_coalesce_usecs even if rx_coalesce_usecs is zero i40e: Fix unexpected MFS warning message ice: Restore fix disabling RX VLAN filtering ice: change vfs.num_msix_per to vf->num_msix ==================== Link: https://lore.kernel.org/r/20231205211918.2123019-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 0c7ed1f9197aecada33a08b022e484a97bf584ba Author: Tobias Waldekranz Date: Tue Dec 5 23:13:59 2023 +0100 net: dsa: mv88e6xxx: Restore USXGMII support for 6393X In 4a56212774ac, USXGMII support was added for 6393X, but this was lost in the PCS conversion (the blamed commit), most likely because these efforts where more or less done in parallel. Restore this feature by porting Michal's patch to fit the new implementation. Reviewed-by: Florian Fainelli Tested-by: Michal Smulski Reviewed-by: Vladimir Oltean Fixes: e5b732a275f5 ("net: dsa: mv88e6xxx: convert 88e639x to phylink_pcs") Signed-off-by: Tobias Waldekranz Link: https://lore.kernel.org/r/20231205221359.3926018-1-tobias@waldekranz.com Signed-off-by: Jakub Kicinski drivers/net/dsa/mv88e6xxx/pcs-639x.c | 31 +++++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) commit 3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27 Author: Eric Dumazet Date: Tue Dec 5 16:18:41 2023 +0000 tcp: do not accept ACK of bytes we never sent This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow. ACK seq validation is currently following RFC 5961 5.2 guidelines: The ACK value is considered acceptable only if it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <= SND.NXT). All incoming segments whose ACK value doesn't satisfy the above condition MUST be discarded and an ACK sent back. It needs to be noted that RFC 793 on page 72 (fifth check) says: "If the ACK is a duplicate (SEG.ACK < SND.UNA), it can be ignored. If the ACK acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an ACK, drop the segment, and return". The "ignored" above implies that the processing of the incoming data segment continues, which means the ACK value is treated as acceptable. This mitigation makes the ACK check more stringent since any ACK < SND.UNA wouldn't be accepted, instead only ACKs that are in the range ((SND.UNA - MAX.SND.WND) <= SEG.ACK <= SND.NXT) get through. This can be refined for new (and possibly spoofed) flows, by not accepting ACK for bytes that were never sent. This greatly improves TCP security at a little cost. I added a Fixes: tag to make sure this patch will reach stable trees, even if the 'blamed' patch was adhering to the RFC. tp->bytes_acked was added in linux-4.2 Following packetdrill test (courtesy of Yepeng Pan) shows the issue at hand: 0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0 +0 listen(3, 1024) = 0 // ---------------- Handshake ------------------- // // when window scale is set to 14 the window size can be extended to // 65535 * (2^14) = 1073725440. Linux would accept an ACK packet // with ack number in (Server_ISN+1-1073725440. Server_ISN+1) // ,though this ack number acknowledges some data never // sent by the server. +0 < S 0:0(0) win 65535 +0 > S. 0:0(0) ack 1 <...> +0 < . 1:1(0) ack 1 win 65535 +0 accept(3, ..., ...) = 4 // For the established connection, we send an ACK packet, // the ack packet uses ack number 1 - 1073725300 + 2^32, // where 2^32 is used to wrap around. // Note: we used 1073725300 instead of 1073725440 to avoid possible // edge cases. // 1 - 1073725300 + 2^32 = 3221241997 // Oops, old kernels happily accept this packet. +0 < . 1:1001(1000) ack 3221241997 win 65535 // After the kernel fix the following will be replaced by a challenge ACK, // and prior malicious frame would be dropped. +0 > . 1:1(0) ack 1001 Fixes: 354e4aa391ed ("tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation") Signed-off-by: Eric Dumazet Reported-by: Yepeng Pan Reported-by: Christian Rossow Acked-by: Neal Cardwell Link: https://lore.kernel.org/r/20231205161841.2702925-1-edumazet@google.com Signed-off-by: Jakub Kicinski net/ipv4/tcp_input.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 8d1b7809684c688005706125b804e1f9792d2b1b Author: Inki Dae Date: Wed Nov 1 18:36:51 2023 +0900 drm/exynos: fix a wrong error checking Fix a wrong error checking in exynos_drm_dma.c module. In the exynos_drm_register_dma function, both arm_iommu_create_mapping() and iommu_get_domain_for_dev() functions are expected to return NULL as an error. However, the error checking is performed using the statement if(IS_ERR(mapping)), which doesn't provide a suitable error value. So check if 'mapping' is NULL, and if it is, return -ENODEV. This issue[1] was reported by Dan. Changelog v1: - fix build warning. [1] https://lore.kernel.org/all/33e52277-1349-472b-a55b-ab5c3462bfcf@moroto.mountain/ Reported-by : Dan Carpenter Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_dma.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit 73bf1c9ae6c054c53b8e84452c5e46f86dd28246 Author: Xiang Yang Date: Sat Aug 12 14:27:48 2023 +0800 drm/exynos: fix a potential error pointer dereference Smatch reports the warning below: drivers/gpu/drm/exynos/exynos_hdmi.c:1864 hdmi_bind() error: 'crtc' dereferencing possible ERR_PTR() The return value of exynos_drm_crtc_get_by_type maybe ERR_PTR(-ENODEV), which can not be used directly. Fix this by checking the return value before using it. Signed-off-by: Xiang Yang Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_hdmi.c | 2 ++ 1 file changed, 2 insertions(+) commit b7c1e53751cb3990153084f31c41f25fde3b629c Author: Miquel Raynal Date: Fri Nov 24 20:38:14 2023 +0100 nvmem: Do not expect fixed layouts to grab a layout driver Two series lived in parallel for some time, which led to this situation: - The nvmem-layout container is used for dynamic layouts - We now expect fixed layouts to also use the nvmem-layout container but this does not require any additional driver, the support is built-in the nvmem core. Ensure we don't refuse to probe for wrong reasons. Fixes: 27f699e578b1 ("nvmem: core: add support for fixed cells *layout*") Cc: stable@vger.kernel.org Reported-by: Luca Ceresoli Signed-off-by: Miquel Raynal Tested-by: Rafał Miłecki Tested-by: Luca Ceresoli Reviewed-by: Luca Ceresoli Link: https://lore.kernel.org/r/20231124193814.360552-1-miquel.raynal@bootlin.com Signed-off-by: Greg Kroah-Hartman drivers/nvmem/core.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 1a031f6edc460e9562098bdedc3918da07c30a6e Author: Cameron Williams Date: Thu Nov 2 21:10:40 2023 +0000 parport: Add support for Brainboxes IX/UC/PX parallel cards Adds support for Intashield IX-500/IX-550, UC-146/UC-157, PX-146/PX-157, PX-203 and PX-475 (LPT port) Cc: stable@vger.kernel.org Signed-off-by: Cameron Williams Acked-by: Sudip Mukherjee Link: https://lore.kernel.org/r/AS4PR02MB790389C130410BD864C8DCC9C4A6A@AS4PR02MB7903.eurprd02.prod.outlook.com Signed-off-by: Greg Kroah-Hartman drivers/parport/parport_pc.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) commit e92fad024929c79460403acf946bc9c09ce5c3a9 Author: Andy Shevchenko Date: Tue Dec 5 21:55:24 2023 +0200 serial: 8250_dw: Add ACPI ID for Granite Rapids-D UART Granite Rapids-D has an additional UART that is enumerated via ACPI. Add ACPI ID for it. Signed-off-by: Andy Shevchenko Cc: stable Link: https://lore.kernel.org/r/20231205195524.2705965-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/8250/8250_dw.c | 1 + 1 file changed, 1 insertion(+) commit f0b9d97a77fa8f18400450713358303a435ab688 Author: Andi Shyti Date: Mon Dec 4 17:38:03 2023 +0100 serial: ma35d1: Validate console index before assignment The console is immediately assigned to the ma35d1 port without checking its index. This oversight can lead to out-of-bounds errors when the index falls outside the valid '0' to MA35_UART_NR range. Such scenario trigges ran error like the following: UBSAN: array-index-out-of-bounds in drivers/tty/serial/ma35d1_serial.c:555:51 index -1 is out of range for type 'uart_ma35d1_port [17] Check the index before using it and bail out with a warning. Fixes: 930cbf92db01 ("tty: serial: Add Nuvoton ma35d1 serial driver support") Signed-off-by: Andi Shyti Cc: Jacky Huang Cc: # v6.5+ Link: https://lore.kernel.org/r/20231204163804.1331415-2-andi.shyti@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/ma35d1_serial.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit 61890dc28f7d9e9aac8a9471302613824c22fae4 Author: Konstantin Aladyshev Date: Wed Dec 6 11:07:44 2023 +0300 usb: gadget: f_hid: fix report descriptor allocation The commit 89ff3dfac604 ("usb: gadget: f_hid: fix f_hidg lifetime vs cdev") has introduced a bug that leads to hid device corruption after the replug operation. Reverse device managed memory allocation for the report descriptor to fix the issue. Tested: This change was tested on the AMD EthanolX CRB server with the BMC based on the OpenBMC distribution. The BMC provides KVM functionality via the USB gadget device: - before: KVM page refresh results in a broken USB device, - after: KVM page refresh works without any issues. Fixes: 89ff3dfac604 ("usb: gadget: f_hid: fix f_hidg lifetime vs cdev") Cc: stable@vger.kernel.org Signed-off-by: Konstantin Aladyshev Link: https://lore.kernel.org/r/20231206080744.253-2-aladyshev22@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/function/f_hid.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 0c92218f4e7d4b4a7245d32bea042fa6f9cc39d7 Merge: b2f557a21bc8 33cc938e65a9 Author: Andrew Morton Date: Wed Dec 6 17:03:50 2023 -0800 Merge branch 'master' into mm-hotfixes-stable commit b2f557a21bc8fffdcd65794eda8a854e024999f3 Author: Jiexun Wang Date: Thu Sep 21 20:27:51 2023 +0800 mm/madvise: add cond_resched() in madvise_cold_or_pageout_pte_range() I conducted real-time testing and observed that madvise_cold_or_pageout_pte_range() causes significant latency under memory pressure, which can be effectively reduced by adding cond_resched() within the loop. I tested on the LicheePi 4A board using Cylictest for latency testing and Ftrace for latency tracing. The board uses TH1520 processor and has a memory size of 8GB. The kernel version is 6.5.0 with the PREEMPT_RT patch applied. The script I tested is as follows: echo wakeup_rt > /sys/kernel/tracing/current_tracer echo 1 > /sys/kernel/tracing/tracing_on echo 0 > /sys/kernel/tracing/tracing_max_latency stress-ng --vm 8 --vm-bytes 2G & cyclictest --mlockall --smp --priority=99 --distance=0 --duration=30m echo 0 > /sys/kernel/tracing/tracing_on cat /sys/kernel/tracing/trace The tracing results before modification are as follows: # tracer: wakeup_rt # # wakeup_rt latency trace v1.1.5 on 6.5.0-rt6-r1208-00003-g999d221864bf # -------------------------------------------------------------------- # latency: 2552 us, #6/6, CPU#3 | (M:preempt_rt VP:0, KP:0, SP:0 HP:0 #P:4) # ----------------- # | task: cyclictest-196 (uid:0 nice:0 policy:1 rt_prio:99) # ----------------- # # _--------=> CPU# # / _-------=> irqs-off/BH-disabled # | / _------=> need-resched # || / _-----=> need-resched-lazy # ||| / _----=> hardirq/softirq # |||| / _---=> preempt-depth # ||||| / _--=> preempt-lazy-depth # |||||| / _-=> migrate-disable # ||||||| / delay # cmd pid |||||||| time | caller # \ / |||||||| \ | / stress-n-206 3dn.h512 2us : 206:120:R + [003] 196: 0:R cyclictest stress-n-206 3dn.h512 7us : => __ftrace_trace_stack => __trace_stack => probe_wakeup => ttwu_do_activate => try_to_wake_up => wake_up_process => hrtimer_wakeup => __hrtimer_run_queues => hrtimer_interrupt => riscv_timer_interrupt => handle_percpu_devid_irq => generic_handle_domain_irq => riscv_intc_irq => handle_riscv_irq => do_irq stress-n-206 3dn.h512 9us#: 0 stress-n-206 3d...3.. 2544us : __schedule stress-n-206 3d...3.. 2545us : 206:120:R ==> [003] 196: 0:R cyclictest stress-n-206 3d...3.. 2551us : => __ftrace_trace_stack => __trace_stack => probe_wakeup_sched_switch => __schedule => preempt_schedule => migrate_enable => rt_spin_unlock => madvise_cold_or_pageout_pte_range => walk_pgd_range => __walk_page_range => walk_page_range => madvise_pageout => madvise_vma_behavior => do_madvise => sys_madvise => do_trap_ecall_u => ret_from_exception The tracing results after modification are as follows: # tracer: wakeup_rt # # wakeup_rt latency trace v1.1.5 on 6.5.0-rt6-r1208-00004-gca3876fc69a6-dirty # -------------------------------------------------------------------- # latency: 1689 us, #6/6, CPU#0 | (M:preempt_rt VP:0, KP:0, SP:0 HP:0 #P:4) # ----------------- # | task: cyclictest-217 (uid:0 nice:0 policy:1 rt_prio:99) # ----------------- # # _--------=> CPU# # / _-------=> irqs-off/BH-disabled # | / _------=> need-resched # || / _-----=> need-resched-lazy # ||| / _----=> hardirq/softirq # |||| / _---=> preempt-depth # ||||| / _--=> preempt-lazy-depth # |||||| / _-=> migrate-disable # ||||||| / delay # cmd pid |||||||| time | caller # \ / |||||||| \ | / stress-n-232 0dn.h413 1us+: 232:120:R + [000] 217: 0:R cyclictest stress-n-232 0dn.h413 12us : => __ftrace_trace_stack => __trace_stack => probe_wakeup => ttwu_do_activate => try_to_wake_up => wake_up_process => hrtimer_wakeup => __hrtimer_run_queues => hrtimer_interrupt => riscv_timer_interrupt => handle_percpu_devid_irq => generic_handle_domain_irq => riscv_intc_irq => handle_riscv_irq => do_irq stress-n-232 0dn.h413 19us#: 0 stress-n-232 0d...3.. 1671us : __schedule stress-n-232 0d...3.. 1676us+: 232:120:R ==> [000] 217: 0:R cyclictest stress-n-232 0d...3.. 1687us : => __ftrace_trace_stack => __trace_stack => probe_wakeup_sched_switch => __schedule => preempt_schedule => migrate_enable => free_unref_page_list => release_pages => free_pages_and_swap_cache => tlb_batch_pages_flush => tlb_flush_mmu => unmap_page_range => unmap_vmas => unmap_region => do_vmi_align_munmap.constprop.0 => do_vmi_munmap => __vm_munmap => sys_munmap => do_trap_ecall_u => ret_from_exception After the modification, the cause of maximum latency is no longer madvise_cold_or_pageout_pte_range(), so this modification can reduce the latency caused by madvise_cold_or_pageout_pte_range(). Currently the madvise_cold_or_pageout_pte_range() function exhibits significant latency under memory pressure, which can be effectively reduced by adding cond_resched() within the loop. When the batch_count reaches SWAP_CLUSTER_MAX, we reschedule the task to ensure fairness and avoid long lock holding times. Link: https://lkml.kernel.org/r/85363861af65fac66c7a98c251906afc0d9c8098.1695291046.git.wangjiexun@tinylab.org Signed-off-by: Jiexun Wang Cc: Zhangjin Wu Signed-off-by: Andrew Morton mm/madvise.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 675abf8df1353e0e3bde314993e0796c524cfbf0 Author: Ryusuke Konishi Date: Tue Dec 5 17:59:47 2023 +0900 nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage() If nilfs2 reads a disk image with corrupted segment usage metadata, and its segment usage information is marked as an error for the segment at the write location, nilfs_sufile_set_segment_usage() can trigger WARN_ONs during log writing. Segments newly allocated for writing with nilfs_sufile_alloc() will not have this error flag set, but this unexpected situation will occur if the segment indexed by either nilfs->ns_segnum or nilfs->ns_nextnum (active segment) was marked in error. Fix this issue by inserting a sanity check to treat it as a file system corruption. Since error returns are not allowed during the execution phase where nilfs_sufile_set_segment_usage() is used, this inserts the sanity check into nilfs_sufile_mark_dirty() which pre-reads the buffer containing the segment usage record to be updated and sets it up in a dirty state for writing. In addition, nilfs_sufile_set_segment_usage() is also called when canceling log writing and undoing segment usage update, so in order to avoid issuing the same kernel warning in that case, in case of cancellation, avoid checking the error flag in nilfs_sufile_set_segment_usage(). Link: https://lkml.kernel.org/r/20231205085947.4431-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: syzbot+14e9f834f6ddecece094@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=14e9f834f6ddecece094 Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton fs/nilfs2/sufile.c | 42 +++++++++++++++++++++++++++++++++++------- 1 file changed, 35 insertions(+), 7 deletions(-) commit 4a3ef6be03e6700037fc20e63aa5ffd972e435ca Author: Sidhartha Kumar Date: Mon Dec 4 10:32:34 2023 -0800 mm/hugetlb: have CONFIG_HUGETLB_PAGE select CONFIG_XARRAY_MULTI After commit a08c7193e4f1 "mm/filemap: remove hugetlb special casing in filemap.c", hugetlb pages are stored in the page cache in base page sized indexes. This leads to multi index stores in the xarray which is only supporting through CONFIG_XARRAY_MULTI. The other page cache user of multi index stores ,THP, selects XARRAY_MULTI. Have CONFIG_HUGETLB_PAGE follow this behavior as well to avoid the BUG() with a CONFIG_HUGETLB_PAGE && !CONFIG_XARRAY_MULTI config. Link: https://lkml.kernel.org/r/20231204183234.348697-1-sidhartha.kumar@oracle.com Fixes: a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in filemap.c") Signed-off-by: Sidhartha Kumar Reported-by: Al Viro Cc: Mike Kravetz Cc: Muchun Song Signed-off-by: Andrew Morton fs/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 801a2b1b49f4dcf06703130922806e9c639c2ca8 Author: Florian Fainelli Date: Wed Nov 29 20:33:16 2023 -0800 scripts/gdb: fix lx-device-list-bus and lx-device-list-class After the conversion to bus_to_subsys() and class_to_subsys(), the gdb scripts listing the system buses and classes respectively was broken, fix those by returning the subsys_priv pointer and have the various caller de-reference either the 'bus' or 'class' structure members accordingly. Link: https://lkml.kernel.org/r/20231130043317.174188-1-florian.fainelli@broadcom.com Fixes: 7b884b7f24b4 ("driver core: class.c: convert to only use class_to_subsys") Signed-off-by: Florian Fainelli Tested-by: Kuan-Ying Lee Cc: Greg Kroah-Hartman Cc: Jan Kiszka Cc: Kieran Bingham Signed-off-by: Andrew Morton scripts/gdb/linux/device.py | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit bc220fe70919d6500811e5e1e07aff43e137065a Author: Bagas Sanjaya Date: Thu Nov 30 15:38:48 2023 +0700 MAINTAINERS: drop Antti Palosaari He is currently inactive (last message from him is two years ago [1]). His media tree [2] is also dormant (latest activity is 6 years ago), yet his site is still online [3]. Drop him from MAINTAINERS and add CREDITS entry for him. We thank him for maintaining various DVB drivers. [1]: https://lore.kernel.org/all/660772b3-0597-02db-ed94-c6a9be04e8e8@iki.fi/ [2]: https://git.linuxtv.org/anttip/media_tree.git/ [3]: https://palosaari.fi/linux/ Link: https://lkml.kernel.org/r/20231130083848.5396-1-bagasdotme@gmail.com Signed-off-by: Bagas Sanjaya Acked-by: Antti Palosaari Cc: Hans Verkuil Cc: Lukas Bulwahn Cc: Mauro Carvalho Chehab Cc: Uwe Kleine-König Signed-off-by: Andrew Morton CREDITS | 8 +++ MAINTAINERS | 179 +++++++++++++----------------------------------------------- 2 files changed, 45 insertions(+), 142 deletions(-) commit 73424d00dc63ba681856e06cfb0a5abbdb62e2b5 Author: Su Hui Date: Thu Nov 30 11:40:18 2023 +0800 highmem: fix a memory copy problem in memcpy_from_folio Clang static checker complains that value stored to 'from' is never read. And memcpy_from_folio() only copy the last chunk memory from folio to destination. Use 'to += chunk' to replace 'from += chunk' to fix this typo problem. Link: https://lkml.kernel.org/r/20231130034017.1210429-1-suhui@nfschina.com Fixes: b23d03ef7af5 ("highmem: add memcpy_to_folio() and memcpy_from_folio()") Signed-off-by: Su Hui Reviewed-by: Matthew Wilcox (Oracle) Cc: Ira Weiny Cc: Jiaqi Yan Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Collingbourne Cc: Tom Rix Cc: Tony Luck Cc: Signed-off-by: Andrew Morton include/linux/highmem.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d61d0ab573649789bf9eb909c89a1a193b2e3d10 Author: Ryusuke Konishi Date: Wed Nov 29 23:15:47 2023 +0900 nilfs2: fix missing error check for sb_set_blocksize call When mounting a filesystem image with a block size larger than the page size, nilfs2 repeatedly outputs long error messages with stack traces to the kernel log, such as the following: getblk(): invalid block size 8192 requested logical block size: 512 ... Call Trace: dump_stack_lvl+0x92/0xd4 dump_stack+0xd/0x10 bdev_getblk+0x33a/0x354 __breadahead+0x11/0x80 nilfs_search_super_root+0xe2/0x704 [nilfs2] load_nilfs+0x72/0x504 [nilfs2] nilfs_mount+0x30f/0x518 [nilfs2] legacy_get_tree+0x1b/0x40 vfs_get_tree+0x18/0xc4 path_mount+0x786/0xa88 __ia32_sys_mount+0x147/0x1a8 __do_fast_syscall_32+0x56/0xc8 do_fast_syscall_32+0x29/0x58 do_SYSENTER_32+0x15/0x18 entry_SYSENTER_32+0x98/0xf1 ... This overloads the system logger. And to make matters worse, it sometimes crashes the kernel with a memory access violation. This is because the return value of the sb_set_blocksize() call, which should be checked for errors, is not checked. The latter issue is due to out-of-buffer memory being accessed based on a large block size that caused sb_set_blocksize() to fail for buffers read with the initial minimum block size that remained unupdated in the super_block structure. Since nilfs2 mkfs tool does not accept block sizes larger than the system page size, this has been overlooked. However, it is possible to create this situation by intentionally modifying the tool or by passing a filesystem image created on a system with a large page size to a system with a smaller page size and mounting it. Fix this issue by inserting the expected error handling for the call to sb_set_blocksize(). Link: https://lkml.kernel.org/r/20231129141547.4726-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton fs/nilfs2/the_nilfs.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit dccf78d39f1069a5ddf4328bf0c97aa5f2f4296e Author: Baoquan He Date: Tue Nov 28 13:44:57 2023 +0800 kernel/Kconfig.kexec: drop select of KEXEC for CRASH_DUMP Ignat Korchagin complained that a potential config regression was introduced by commit 89cde455915f ("kexec: consolidate kexec and crash options into kernel/Kconfig.kexec"). Before the commit, CONFIG_CRASH_DUMP has no dependency on CONFIG_KEXEC. After the commit, CRASH_DUMP selects KEXEC. That enforces system to have CONFIG_KEXEC=y as long as CONFIG_CRASH_DUMP=Y which people may not want. In Ignat's case, he sets CONFIG_CRASH_DUMP=y, CONFIG_KEXEC_FILE=y and CONFIG_KEXEC=n because kexec_load interface could have security issue if kernel/initrd has no chance to be signed and verified. CRASH_DUMP has select of KEXEC because Eric, author of above commit, met a LKP report of build failure when posting patch of earlier version. Please see below link to get detail of the LKP report: https://lore.kernel.org/all/3e8eecd1-a277-2cfb-690e-5de2eb7b988e@oracle.com/T/#u In fact, that LKP report is triggered because arm's is wrapped in CONFIG_KEXEC ifdeffery scope. That is wrong. CONFIG_KEXEC controls the enabling/disabling of kexec_load interface, but not kexec feature. Removing the wrongly added CONFIG_KEXEC ifdeffery scope in of arm allows us to drop the select KEXEC for CRASH_DUMP. Meanwhile, change arch/arm/kernel/Makefile to let machine_kexec.o relocate_kernel.o depend on KEXEC_CORE. Link: https://lkml.kernel.org/r/20231128054457.659452-1-bhe@redhat.com Fixes: 89cde455915f ("kexec: consolidate kexec and crash options into kernel/Kconfig.kexec") Signed-off-by: Baoquan He Reported-by: Ignat Korchagin Tested-by: Ignat Korchagin [compile-time only] Tested-by: Alexander Gordeev Reviewed-by: Eric DeVolder Tested-by: Eric DeVolder Signed-off-by: Andrew Morton arch/arm/include/asm/kexec.h | 4 ---- arch/arm/kernel/Makefile | 2 +- kernel/Kconfig.kexec | 1 - 3 files changed, 1 insertion(+), 6 deletions(-) commit 8e92157d7f6190c86bfd6144a409001469827100 Author: Andy Shevchenko Date: Tue Nov 28 19:44:03 2023 +0200 units: add missing header BITS_PER_BYTE is defined in bits.h. Link: https://lkml.kernel.org/r/20231128174404.393393-1-andriy.shevchenko@linux.intel.com Fixes: e8eed5f7366f ("units: Add BYTES_PER_*BIT") Signed-off-by: Andy Shevchenko Reviewed-by: Randy Dunlap Cc: Damian Muszynski Cc: Rasmus Villemoes Cc: Herbert Xu Signed-off-by: Andrew Morton include/linux/units.h | 1 + 1 file changed, 1 insertion(+) commit 4e9e2e4c65136dfd32dd0afe555961433d1cf906 Author: Baoquan He Date: Tue Nov 28 13:52:48 2023 +0800 drivers/base/cpu: crash data showing should depends on KEXEC_CORE After commit 88a6f8994421 ("crash: memory and CPU hotplug sysfs attributes"), on x86_64, if only below kernel configs related to kdump are set, compiling error are triggered. ---- CONFIG_CRASH_CORE=y CONFIG_KEXEC_CORE=y CONFIG_CRASH_DUMP=y CONFIG_CRASH_HOTPLUG=y ------ ------------------------------------------------------ drivers/base/cpu.c: In function `crash_hotplug_show': drivers/base/cpu.c:309:40: error: implicit declaration of function `crash_hotplug_cpu_support'; did you mean `crash_hotplug_show'? [-Werror=implicit-function-declaration] 309 | return sysfs_emit(buf, "%d\n", crash_hotplug_cpu_support()); | ^~~~~~~~~~~~~~~~~~~~~~~~~ | crash_hotplug_show cc1: some warnings being treated as errors ------------------------------------------------------ CONFIG_KEXEC is used to enable kexec_load interface, the crash_notes/crash_notes_size/crash_hotplug showing depends on CONFIG_KEXEC is incorrect. It should depend on KEXEC_CORE instead. Fix it now. Link: https://lkml.kernel.org/r/20231128055248.659808-1-bhe@redhat.com Fixes: 88a6f8994421 ("crash: memory and CPU hotplug sysfs attributes") Signed-off-by: Baoquan He Tested-by: Ignat Korchagin [compile-time only] Tested-by: Alexander Gordeev Reviewed-by: Eric DeVolder Cc: Signed-off-by: Andrew Morton drivers/base/cpu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 7d6fa31a2fd7072376b3c8be66bf8527b2c8208c Author: SeongJae Park Date: Fri Nov 24 21:38:40 2023 +0000 mm/damon/sysfs-schemes: add timeout for update_schemes_tried_regions If a scheme is set to not applied to any monitoring target region for any reasons including the target access pattern, quota, filters, or watermarks, writing 'update_schemes_tried_regions' to 'state' DAMON sysfs file can indefinitely hang. Fix the case by implementing a timeout for the operation. The time limit is two apply intervals of each scheme. Link: https://lkml.kernel.org/r/20231124213840.39157-1-sj@kernel.org Fixes: 4d4e41b68299 ("mm/damon/sysfs-schemes: do not update tried regions more than one DAMON snapshot") Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton mm/damon/sysfs-schemes.c | 49 ++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 43 insertions(+), 6 deletions(-) commit 854f2764b5771e450b44e6a5fddb6872deb5bb56 Author: Kuan-Ying Lee Date: Mon Nov 27 15:04:01 2023 +0800 scripts/gdb/tasks: fix lx-ps command error Since commit 8e1f385104ac ("kill task_struct->thread_group") remove the thread_group, we will encounter below issue. (gdb) lx-ps TASK PID COMM 0xffff800086503340 0 swapper/0 Python Exception : There is no member named thread_group. Error occurred in Python: There is no member named thread_group. We use signal->thread_head to iterate all threads instead. [Kuan-Ying.Lee@mediatek.com: v2] Link: https://lkml.kernel.org/r/20231129065142.13375-2-Kuan-Ying.Lee@mediatek.com Link: https://lkml.kernel.org/r/20231127070404.4192-2-Kuan-Ying.Lee@mediatek.com Fixes: 8e1f385104ac ("kill task_struct->thread_group") Signed-off-by: Kuan-Ying Lee Acked-by: Oleg Nesterov Tested-by: Florian Fainelli Cc: AngeloGioacchino Del Regno Cc: Chinwen Chang Cc: Kuan-Ying Lee Cc: Matthias Brugger Cc: Qun-Wei Lin Cc: Andrey Konovalov Signed-off-by: Andrew Morton scripts/gdb/linux/tasks.py | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) commit 97219cc358ad156ec5b170c2ed6f44278932c63c Author: Peter Xu Date: Thu Nov 23 17:42:04 2023 -0500 mm/Kconfig: make userfaultfd a menuconfig PTE_MARKER_UFFD_WP is a subconfig for userfaultfd. To make it clear, switch to use menuconfig for userfaultfd. Link: https://lkml.kernel.org/r/20231123224204.1060152-1-peterx@redhat.com Signed-off-by: Peter Xu Cc: Andrea Arcangeli Cc: Axel Rasmussen Cc: Mike Rapoport (IBM) Cc: Peter Xu Signed-off-by: Andrew Morton mm/Kconfig | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) commit f39fb633fe9b9a4a7572ec32debf766d971a500b Author: Nico Pache Date: Mon Nov 20 15:29:08 2023 -0700 selftests/mm: prevent duplicate runs caused by TEST_GEN_PROGS Commit 05f1edac8009 ("selftests/mm: run all tests from run_vmtests.sh") fixed the inconsistency caused by tests being defined as TEST_GEN_PROGS. This issue was leading to tests not being executed via run_vmtests.sh and furthermore some tests running twice due to the kselftests wrapper also executing them. Fix the definition of two tests (soft-dirty and pagemap_ioctl) that are still incorrectly defined. Link: https://lkml.kernel.org/r/20231120222908.28559-1-npache@redhat.com Signed-off-by: Nico Pache Reviewed-by: David Hildenbrand Cc: Joel Savitz Cc: Shuah Khan Signed-off-by: Andrew Morton tools/testing/selftests/mm/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1f3730fd9e8d4d77fb99c60d0e6ad4b1104e7e04 Author: SeongJae Park Date: Sun Nov 19 17:15:28 2023 +0000 mm/damon/core: copy nr_accesses when splitting region Regions split function ('damon_split_region_at()') is called at the beginning of an aggregation interval, and when DAMOS applying the actions and charging quota. Because 'nr_accesses' fields of all regions are reset at the beginning of each aggregation interval, and DAMOS was applying the action at the end of each aggregation interval, there was no need to copy the 'nr_accesses' field to the split-out region. However, commit 42f994b71404 ("mm/damon/core: implement scheme-specific apply interval") made DAMOS applies action on its own timing interval. Hence, 'nr_accesses' should also copied to split-out regions, but the commit didn't. Fix it by copying it. Link: https://lkml.kernel.org/r/20231119171529.66863-1-sj@kernel.org Fixes: 42f994b71404 ("mm/damon/core: implement scheme-specific apply interval") Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton mm/damon/core.c | 1 + 1 file changed, 1 insertion(+) commit 0263f92fadbb9d294d5971ac57743f882c93b2b3 Author: Ming Lei Date: Mon Nov 20 16:35:59 2023 +0800 lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly group_cpus_evenly() could be part of storage driver's error handler, such as nvme driver, when may happen during CPU hotplug, in which storage queue has to drain its pending IOs because all CPUs associated with the queue are offline and the queue is becoming inactive. And handling IO needs error handler to provide forward progress. Then deadlock is caused: 1) inside CPU hotplug handler, CPU hotplug lock is held, and blk-mq's handler is waiting for inflight IO 2) error handler is waiting for CPU hotplug lock 3) inflight IO can't be completed in blk-mq's CPU hotplug handler because error handling can't provide forward progress. Solve the deadlock by not holding CPU hotplug lock in group_cpus_evenly(), in which two stage spreads are taken: 1) the 1st stage is over all present CPUs; 2) the end stage is over all other CPUs. Turns out the two stage spread just needs consistent 'cpu_present_mask', and remove the CPU hotplug lock by storing it into one local cache. This way doesn't change correctness, because all CPUs are still covered. Link: https://lkml.kernel.org/r/20231120083559.285174-1-ming.lei@redhat.com Signed-off-by: Ming Lei Reported-by: Yi Zhang Reported-by: Guangwu Zhang Tested-by: Guangwu Zhang Reviewed-by: Chengming Zhou Reviewed-by: Jens Axboe Cc: Keith Busch Cc: Signed-off-by: Andrew Morton lib/group_cpus.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) commit ee34db3f271cea4d4252048617919c2caafe698b Author: Heiko Carstens Date: Mon Nov 20 19:37:17 2023 +0100 checkstack: fix printed address All addresses printed by checkstack have an extra incorrect 0 appended at the end. This was introduced with commit 677f1410e058 ("scripts/checkstack.pl: don't display $dre as different entity"): since then the address is taken from the line which contains the function name, instead of the line which contains stack consumption. E.g. on s390: 0000000000100a30 : ... 100a44: e3 f0 ff 70 ff 71 lay %r15,-144(%r15) So the used regex which matches spaces and hexadecimal numbers to extract an address now matches a different substring. Subsequently replacing spaces with 0 appends a zero at the and, instead of replacing leading spaces. Fix this by using the proper regex, and simplify the code a bit. Link: https://lkml.kernel.org/r/20231120183719.2188479-2-hca@linux.ibm.com Fixes: 677f1410e058 ("scripts/checkstack.pl: don't display $dre as different entity") Signed-off-by: Heiko Carstens Cc: Maninder Singh Cc: Masahiro Yamada Cc: Vaneet Narang Cc: Signed-off-by: Andrew Morton scripts/checkstack.pl | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit f42ce5f087eb69e47294ababd2e7e6f88a82d308 Author: Sumanth Korikkar Date: Mon Nov 20 15:53:53 2023 +0100 mm/memory_hotplug: fix error handling in add_memory_resource() In add_memory_resource(), creation of memory block devices occurs after successful call to arch_add_memory(). However, creation of memory block devices could fail. In that case, arch_remove_memory() is called to perform necessary cleanup. Currently with or without altmap support, arch_remove_memory() is always passed with altmap set to NULL during error handling. This leads to freeing of struct pages using free_pages(), eventhough the allocation might have been performed with altmap support via altmap_alloc_block_buf(). Fix the error handling by passing altmap in arch_remove_memory(). This ensures the following: * When altmap is disabled, deallocation of the struct pages array occurs via free_pages(). * When altmap is enabled, deallocation occurs via vmem_altmap_free(). Link: https://lkml.kernel.org/r/20231120145354.308999-3-sumanthk@linux.ibm.com Fixes: a08a2ae34613 ("mm,memory_hotplug: allocate memmap from the added memory range") Signed-off-by: Sumanth Korikkar Reviewed-by: Gerald Schaefer Acked-by: David Hildenbrand Cc: Alexander Gordeev Cc: Aneesh Kumar K.V Cc: Anshuman Khandual Cc: Heiko Carstens Cc: kernel test robot Cc: Michal Hocko Cc: Oscar Salvador Cc: Vasily Gorbik Cc: [5.15+] Signed-off-by: Andrew Morton mm/memory_hotplug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 001002e73712cdf6b8d9a103648cda3040ad7647 Author: Sumanth Korikkar Date: Mon Nov 20 15:53:52 2023 +0100 mm/memory_hotplug: add missing mem_hotplug_lock From Documentation/core-api/memory-hotplug.rst: When adding/removing/onlining/offlining memory or adding/removing heterogeneous/device memory, we should always hold the mem_hotplug_lock in write mode to serialise memory hotplug (e.g. access to global/zone variables). mhp_(de)init_memmap_on_memory() functions can change zone stats and struct page content, but they are currently called w/o the mem_hotplug_lock. When memory block is being offlined and when kmemleak goes through each populated zone, the following theoretical race conditions could occur: CPU 0: | CPU 1: memory_offline() | -> offline_pages() | -> mem_hotplug_begin() | ... | -> mem_hotplug_done() | | kmemleak_scan() | -> get_online_mems() | ... -> mhp_deinit_memmap_on_memory() | [not protected by mem_hotplug_begin/done()]| Marks memory section as offline, | Retrieves zone_start_pfn poisons vmemmap struct pages and updates | and struct page members. the zone related data | | ... | -> put_online_mems() Fix this by ensuring mem_hotplug_lock is taken before performing mhp_init_memmap_on_memory(). Also ensure that mhp_deinit_memmap_on_memory() holds the lock. online/offline_pages() are currently only called from memory_block_online/offline(), so it is safe to move the locking there. Link: https://lkml.kernel.org/r/20231120145354.308999-2-sumanthk@linux.ibm.com Fixes: a08a2ae34613 ("mm,memory_hotplug: allocate memmap from the added memory range") Signed-off-by: Sumanth Korikkar Reviewed-by: Gerald Schaefer Acked-by: David Hildenbrand Cc: Alexander Gordeev Cc: Aneesh Kumar K.V Cc: Anshuman Khandual Cc: Heiko Carstens Cc: Michal Hocko Cc: Oscar Salvador Cc: Vasily Gorbik Cc: kernel test robot Cc: [5.15+] Signed-off-by: Andrew Morton drivers/base/memory.c | 18 +++++++++++++++--- mm/memory_hotplug.c | 13 ++++++------- 2 files changed, 21 insertions(+), 10 deletions(-) commit c540b03828dff96e1b36e9e75714f0a8e807a92e Author: Chester Lin Date: Fri Nov 17 10:28:07 2023 +0800 .mailmap: add a new address mapping for Chester Lin My company email address is going to be disabled so let's create a mapping that links to my private/community email just in case people might still try to reach me via the old one. Link: https://lkml.kernel.org/r/20231117022807.29461-1-clin@suse.com Signed-off-by: Chester Lin Cc: Chester Lin Cc: Bjorn Andersson Cc: Greg Kroah-Hartman Cc: Heiko Stuebner Cc: Jakub Kicinski Cc: Konrad Dybcio Cc: Oleksij Rempel Cc: Stephen Hemminger Cc: Conor Dooley Cc: Matthias Brugger Signed-off-by: Andrew Morton .mailmap | 1 + 1 file changed, 1 insertion(+) commit 9aa1345d66b8132745ffb99b348b1492088da9e2 Author: Hugh Dickins Date: Fri Nov 17 00:49:18 2023 -0800 mm: fix oops when filemap_map_pmd() without prealloc_pte syzbot reports oops in lockdep's __lock_acquire(), called from __pte_offset_map_lock() called from filemap_map_pages(); or when I run the repro, the oops comes in pmd_install(), called from filemap_map_pmd() called from filemap_map_pages(), just before the __pte_offset_map_lock(). The problem is that filemap_map_pmd() has been assuming that when it finds pmd_none(), a page table has already been prepared in prealloc_pte; and indeed do_fault_around() has been careful to preallocate one there, when it finds pmd_none(): but what if *pmd became none in between? My 6.6 mods in mm/khugepaged.c, avoiding mmap_lock for write, have made it easy for *pmd to be cleared while servicing a page fault; but even before those, a huge *pmd might be zapped while a fault is serviced. The difference in symptomatic stack traces comes from the "memory model" in use: pmd_install() uses pmd_populate() uses page_to_pfn(): in some models that is strict, and will oops on the NULL prealloc_pte; in other models, it will construct a bogus value to be populated into *pmd, then __pte_offset_map_lock() oops when trying to access split ptlock pointer (or some other symptom in normal case of ptlock embedded not pointer). Link: https://lore.kernel.org/linux-mm/20231115065506.19780-1-jose.pekkarinen@foxhound.fi/ Link: https://lkml.kernel.org/r/6ed0c50c-78ef-0719-b3c5-60c0c010431c@google.com Fixes: f9ce0be71d1f ("mm: Cleanup faultaround and finish_fault() codepaths") Signed-off-by: Hugh Dickins Reported-and-tested-by: syzbot+89edd67979b52675ddec@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-mm/0000000000005e44550608a0806c@google.com/ Reviewed-by: David Hildenbrand Cc: Jann Horn , Cc: José Pekkarinen Cc: Kirill A. Shutemov Cc: Matthew Wilcox (Oracle) Cc: [5.12+] Signed-off-by: Andrew Morton mm/filemap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit eb66b8abae98f869c224f7c852b685ae02144564 Author: Lizhi Xu Date: Thu Nov 16 11:13:52 2023 +0800 squashfs: squashfs_read_data need to check if the length is 0 When the length passed in is 0, the pagemap_scan_test_walk() caller should bail. This error causes at least a WARN_ON(). Link: https://lkml.kernel.org/r/20231116031352.40853-1-lizhi.xu@windriver.com Reported-by: syzbot+32d3767580a1ea339a81@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/0000000000000526f2060a30a085@google.com Signed-off-by: Lizhi Xu Reviewed-by: Phillip Lougher Signed-off-by: Andrew Morton fs/squashfs/block.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3f3cac5c0a5c3b09bdfb919a7518dca83523a52c Author: Peter Xu Date: Thu Nov 16 15:15:47 2023 -0500 mm/selftests: fix pagemap_ioctl memory map test __FILE__ is not guaranteed to exist in current dir. Replace that with argv[0] for memory map test. Link: https://lkml.kernel.org/r/20231116201547.536857-4-peterx@redhat.com Fixes: 46fd75d4a3c9 ("selftests: mm: add pagemap ioctl tests") Signed-off-by: Peter Xu Reviewed-by: David Hildenbrand Cc: Andrei Vagin Cc: David Hildenbrand Cc: Muhammad Usama Anjum Signed-off-by: Andrew Morton tools/testing/selftests/mm/pagemap_ioctl.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 4980e837cab7e2acc4dad18dba656c6896c531aa Author: Peter Xu Date: Thu Nov 16 15:15:46 2023 -0500 mm/pagemap: fix wr-protect even if PM_SCAN_WP_MATCHING not set The new pagemap ioctl contains a fast path for wr-protections without looking into category masks. It forgets to check PM_SCAN_WP_MATCHING before applying the wr-protections. It can cause, e.g., pte markers installed on archs that do not even support uffd wr-protect. WARNING: CPU: 0 PID: 5059 at mm/memory.c:1520 zap_pte_range mm/memory.c:1520 [inline] Link: https://lkml.kernel.org/r/20231116201547.536857-3-peterx@redhat.com Fixes: 12f6b01a0bcb ("fs/proc/task_mmu: add fast paths to get/clear PAGE_IS_WRITTEN flag") Signed-off-by: Peter Xu Reported-by: syzbot+7ca4b2719dc742b8d0a4@syzkaller.appspotmail.com Reviewed-by: David Hildenbrand Reviewed-by: Andrei Vagin Cc: Muhammad Usama Anjum Signed-off-by: Andrew Morton fs/proc/task_mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0dff1b407def32452a0d80148172889862c64fe7 Author: Peter Xu Date: Thu Nov 16 15:15:45 2023 -0500 mm/pagemap: fix ioctl(PAGEMAP_SCAN) on vma check Patch series "mm/pagemap: A few fixes to the recent PAGEMAP_SCAN". This series should fix two known reports from syzbot on the new PAGEMAP_SCAN ioctl(): https://lore.kernel.org/all/000000000000b0e576060a30ee3b@google.com/ https://lore.kernel.org/all/000000000000773fa7060a31e2cc@google.com/ The 3rd patch is something I found when testing these patches. This patch (of 3): The new ioctl(PAGEMAP_SCAN) relies on vma wr-protect capability provided by userfault, however in the vma test it didn't explicitly require the vma to have wr-protect function enabled, even if PM_SCAN_WP_MATCHING flag is set. It means the pagemap code can now apply uffd-wp bit to a page in the vma even if not registered to userfaultfd at all. Then in whatever way as long as the pte got written and page fault resolved, we'll apply the write bit even if uffd-wp bit is set. We'll see a pte that has both UFFD_WP and WRITE bit set. Anything later that looks up the pte for uffd-wp bit will trigger the warning: WARNING: CPU: 1 PID: 5071 at arch/x86/include/asm/pgtable.h:403 pte_uffd_wp arch/x86/include/asm/pgtable.h:403 [inline] Fix it by doing proper check over the vma attributes when PM_SCAN_WP_MATCHING is specified. Link: https://lkml.kernel.org/r/20231116201547.536857-1-peterx@redhat.com Link: https://lkml.kernel.org/r/20231116201547.536857-2-peterx@redhat.com Fixes: 52526ca7fdb9 ("fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs") Signed-off-by: Peter Xu Reported-by: syzbot+e94c5aaf7890901ebf9b@syzkaller.appspotmail.com Reviewed-by: David Hildenbrand Reviewed-by: Andrei Vagin Reviewed-by: Muhammad Usama Anjum Signed-off-by: Andrew Morton fs/proc/task_mmu.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) commit 5f79489a73d77419d18952e0258efbd5ecb74770 Author: Roman Gushchin Date: Wed Nov 15 18:51:09 2023 -0800 mm: kmem: properly initialize local objcg variable in current_obj_cgroup() Erhard reported that the 6.7-rc1 kernel panics on boot if being built with clang-16. The problem was not reproducible with gcc. [ 5.975049] general protection fault, probably for non-canonical address 0xf555515555555557: 0000 [#1] SMP KASAN PTI [ 5.976422] KASAN: maybe wild-memory-access in range [0xaaaaaaaaaaaaaab8-0xaaaaaaaaaaaaaabf] [ 5.977475] CPU: 3 PID: 1 Comm: systemd Not tainted 6.7.0-rc1-Zen3 #77 [ 5.977860] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 5.977860] RIP: 0010:obj_cgroup_charge_pages+0x27/0x2d5 [ 5.977860] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 89 d5 41 89 f6 49 89 ff 48 b8 00 00 00 00 00 fc ff df 49 83 c7 10 4d3 [ 5.977860] RSP: 0018:ffffc9000001fb18 EFLAGS: 00010a02 [ 5.977860] RAX: dffffc0000000000 RBX: aaaaaaaaaaaaaaaa RCX: ffff8883eb9a8b08 [ 5.977860] RDX: 0000000000000005 RSI: 0000000000400cc0 RDI: aaaaaaaaaaaaaaaa [ 5.977860] RBP: 0000000000000005 R08: 3333333333333333 R09: 0000000000000000 [ 5.977860] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8883eb9a8b18 [ 5.977860] R13: 1555555555555557 R14: 0000000000400cc0 R15: aaaaaaaaaaaaaaba [ 5.977860] FS: 00007f2976438b40(0000) GS:ffff8883eb980000(0000) knlGS:0000000000000000 [ 5.977860] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5.977860] CR2: 00007f29769e0060 CR3: 0000000107222003 CR4: 0000000000370eb0 [ 5.977860] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 5.977860] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 5.977860] Call Trace: [ 5.977860] [ 5.977860] ? __die_body+0x16/0x75 [ 5.977860] ? die_addr+0x4a/0x70 [ 5.977860] ? exc_general_protection+0x1c9/0x2d0 [ 5.977860] ? cgroup_mkdir+0x455/0x9fb [ 5.977860] ? __x64_sys_mkdir+0x69/0x80 [ 5.977860] ? asm_exc_general_protection+0x26/0x30 [ 5.977860] ? obj_cgroup_charge_pages+0x27/0x2d5 [ 5.977860] obj_cgroup_charge+0x114/0x1ab [ 5.977860] pcpu_alloc+0x1a6/0xa65 [ 5.977860] ? mem_cgroup_css_alloc+0x1eb/0x1140 [ 5.977860] ? cgroup_apply_control_enable+0x26b/0x7c0 [ 5.977860] mem_cgroup_css_alloc+0x23f/0x1140 [ 5.977860] cgroup_apply_control_enable+0x26b/0x7c0 [ 5.977860] ? cgroup_kn_set_ugid+0x2d/0x1a0 [ 5.977860] cgroup_mkdir+0x455/0x9fb [ 5.977860] ? __cfi_cgroup_mkdir+0x10/0x10 [ 5.977860] kernfs_iop_mkdir+0x130/0x170 [ 5.977860] vfs_mkdir+0x405/0x530 [ 5.977860] do_mkdirat+0x188/0x1f0 [ 5.977860] __x64_sys_mkdir+0x69/0x80 [ 5.977860] do_syscall_64+0x7d/0x100 [ 5.977860] ? do_syscall_64+0x89/0x100 [ 5.977860] ? do_syscall_64+0x89/0x100 [ 5.977860] ? do_syscall_64+0x89/0x100 [ 5.977860] ? do_syscall_64+0x89/0x100 [ 5.977860] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 5.977860] RIP: 0033:0x7f297671defb [ 5.977860] Code: 8b 05 39 7f 0d 00 bb ff ff ff ff 64 c7 00 16 00 00 00 e9 61 ff ff ff e8 23 0c 02 00 0f 1f 00 f3 0f 1e fa b88 [ 5.977860] RSP: 002b:00007ffee6242bb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 5.977860] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f297671defb [ 5.977860] RDX: 0000000000000000 RSI: 00000000000001ed RDI: 000055c6b449f0e0 [ 5.977860] RBP: 00007ffee6242bf0 R08: 000000000000000e R09: 0000000000000000 [ 5.977860] R10: 0000000000000000 R11: 0000000000000246 R12: 000055c6b445db80 [ 5.977860] R13: 00000000000003a0 R14: 00007f2976a68651 R15: 00000000000003a0 [ 5.977860] [ 5.977860] Modules linked in: [ 6.014095] ---[ end trace 0000000000000000 ]--- [ 6.014701] RIP: 0010:obj_cgroup_charge_pages+0x27/0x2d5 [ 6.015348] Code: 90 90 90 55 41 57 41 56 41 55 41 54 53 89 d5 41 89 f6 49 89 ff 48 b8 00 00 00 00 00 fc ff df 49 83 c7 10 4d3 [ 6.017575] RSP: 0018:ffffc9000001fb18 EFLAGS: 00010a02 [ 6.018255] RAX: dffffc0000000000 RBX: aaaaaaaaaaaaaaaa RCX: ffff8883eb9a8b08 [ 6.019120] RDX: 0000000000000005 RSI: 0000000000400cc0 RDI: aaaaaaaaaaaaaaaa [ 6.019983] RBP: 0000000000000005 R08: 3333333333333333 R09: 0000000000000000 [ 6.020849] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8883eb9a8b18 [ 6.021747] R13: 1555555555555557 R14: 0000000000400cc0 R15: aaaaaaaaaaaaaaba [ 6.022609] FS: 00007f2976438b40(0000) GS:ffff8883eb980000(0000) knlGS:0000000000000000 [ 6.023593] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.024296] CR2: 00007f29769e0060 CR3: 0000000107222003 CR4: 0000000000370eb0 [ 6.025279] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 6.026139] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 6.027000] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Actually the problem is caused by uninitialized local variable in current_obj_cgroup(). If the root memory cgroup is set as an active memory cgroup for a charging scope (as in the trace, where systemd tries to create the first non-root cgroup, so the parent cgroup is the root cgroup), the "for" loop is skipped and uninitialized objcg is returned, causing a panic down the accounting stack. The fix is trivial: initialize the objcg variable to NULL unconditionally before the "for" loop. [vbabka@suse.cz: remove redundant assignment] Link: https://lkml.kernel.org/r/4bd106d5-c3e3-6731-9a74-cff81e2392de@suse.cz Link: https://lkml.kernel.org/r/20231116025109.3775055-1-roman.gushchin@linux.dev Fixes: e86828e5446d ("mm: kmem: scoped objcg protection") Signed-off-by: Roman Gushchin (Cruise) Signed-off-by: Vlastimil Babka Reported-by: Erhard Furtner Closes: https://github.com/ClangBuiltLinux/linux/issues/1959 Tested-by: Erhard Furtner Acked-by: Vlastimil Babka Acked-by: Shakeel Butt Cc: David Rientjes Cc: Dennis Zhou Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Signed-off-by: Andrew Morton mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d63385a7d3099fedf201b0263282aebf9f9af3e8 Author: Liu Shixin Date: Wed Nov 15 16:21:38 2023 +0800 mm/kmemleak: move set_track_prepare() outside raw_spinlocks set_track_prepare() will call __alloc_pages() which attempts to acquire zone->lock(spinlocks), so move it outside object->lock(raw_spinlocks) because it's not right to acquire spinlocks while holding raw_spinlocks in RT mode. Link: https://lkml.kernel.org/r/20231115082138.2649870-3-liushixin2@huawei.com Signed-off-by: Liu Shixin Acked-by: Catalin Marinas Cc: Geert Uytterhoeven Cc: Kefeng Wang Cc: Patrick Wang Signed-off-by: Andrew Morton mm/kmemleak.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 4eff7d62abdeb293233fdda2a2ecc4e0907a9a30 Author: Liu Shixin Date: Wed Nov 15 16:21:37 2023 +0800 Revert "mm/kmemleak: move the initialisation of object to __link_object" Patch series "Fix invalid wait context of set_track_prepare()". Geert reported an invalid wait context[1] which is resulted by moving set_track_prepare() inside kmemleak_lock. This is not allowed because in RT mode, the spinlocks can be preempted but raw_spinlocks can not, so it is not allowd to acquire spinlocks while holding raw_spinlocks. The second patch fix same problem in kmemleak_update_trace(). This patch (of 2): Move the initialisation of object back to__alloc_object() because set_track_prepare() attempt to acquire zone->lock(spinlocks) while __link_object is holding kmemleak_lock(raw_spinlocks). This is not right for RT mode. This reverts commit 245245c2fffd00 ("mm/kmemleak: move the initialisation of object to __link_object"). Link: https://lkml.kernel.org/r/20231115082138.2649870-1-liushixin2@huawei.com Link: https://lkml.kernel.org/r/20231115082138.2649870-2-liushixin2@huawei.com Fixes: 245245c2fffd ("mm/kmemleak: move the initialisation of object to __link_object") Signed-off-by: Liu Shixin Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/linux-mm/CAMuHMdWj0UzwNaxUvcocTfh481qRJpOWwXxsJCTJfu1oCqvgdA@mail.gmail.com/ [1] Acked-by: Catalin Marinas Cc: Kefeng Wang Cc: Patrick Wang Signed-off-by: Andrew Morton mm/kmemleak.c | 36 +++++++++++++++++++----------------- 1 file changed, 19 insertions(+), 17 deletions(-) commit 727d16f1993bcf46ee2888c13e3fc1463babed8d Author: Andrew Morton Date: Wed Nov 15 13:54:18 2023 -0800 mm/memory.c:zap_pte_range() print bad swap entry We have a report of this WARN() triggering. Let's print the offending swp_entry_t to help diagnosis. Link: https://lkml.kernel.org/r/000000000000b0e576060a30ee3b@google.com Cc: Muhammad Usama Anjum Signed-off-by: Andrew Morton mm/memory.c | 1 + 1 file changed, 1 insertion(+) commit 187da0f8250aa94bd96266096aef6f694e0b4cd2 Author: Mike Kravetz Date: Mon Nov 13 17:20:33 2023 -0800 hugetlb: fix null-ptr-deref in hugetlb_vma_lock_write The routine __vma_private_lock tests for the existence of a reserve map associated with a private hugetlb mapping. A pointer to the reserve map is in vma->vm_private_data. __vma_private_lock was checking the pointer for NULL. However, it is possible that the low bits of the pointer could be used as flags. In such instances, vm_private_data is not NULL and not a valid pointer. This results in the null-ptr-deref reported by syzbot: general protection fault, probably for non-canonical address 0xdffffc000000001d: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef] CPU: 0 PID: 5048 Comm: syz-executor139 Not tainted 6.6.0-rc7-syzkaller-00142-g88 8cf78c29e2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 1 0/09/2023 RIP: 0010:__lock_acquire+0x109/0x5de0 kernel/locking/lockdep.c:5004 ... Call Trace: lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5718 down_write+0x93/0x200 kernel/locking/rwsem.c:1573 hugetlb_vma_lock_write mm/hugetlb.c:300 [inline] hugetlb_vma_lock_write+0xae/0x100 mm/hugetlb.c:291 __hugetlb_zap_begin+0x1e9/0x2b0 mm/hugetlb.c:5447 hugetlb_zap_begin include/linux/hugetlb.h:258 [inline] unmap_vmas+0x2f4/0x470 mm/memory.c:1733 exit_mmap+0x1ad/0xa60 mm/mmap.c:3230 __mmput+0x12a/0x4d0 kernel/fork.c:1349 mmput+0x62/0x70 kernel/fork.c:1371 exit_mm kernel/exit.c:567 [inline] do_exit+0x9ad/0x2a20 kernel/exit.c:861 __do_sys_exit kernel/exit.c:991 [inline] __se_sys_exit kernel/exit.c:989 [inline] __x64_sys_exit+0x42/0x50 kernel/exit.c:989 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Mask off low bit flags before checking for NULL pointer. In addition, the reserve map only 'belongs' to the OWNER (parent in parent/child relationships) so also check for the OWNER flag. Link: https://lkml.kernel.org/r/20231114012033.259600-1-mike.kravetz@oracle.com Reported-by: syzbot+6ada951e7c0f7bc8a71e@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-mm/00000000000078d1e00608d7878b@google.com/ Fixes: bf4916922c60 ("hugetlbfs: extend hugetlb_vma_lock to private VMAs") Signed-off-by: Mike Kravetz Reviewed-by: Rik van Riel Cc: Edward Adam Davis Cc: Muchun Song Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Tom Rix Cc: Signed-off-by: Andrew Morton include/linux/hugetlb.h | 5 +---- mm/hugetlb.c | 7 +++++++ 2 files changed, 8 insertions(+), 4 deletions(-) commit b197d16669831d3e3240e2b6a3e4f9cf0331d58e Author: Andrew Morton Date: Tue Nov 14 15:02:04 2023 -0800 MAINTAINERS: add Andrew Morton for lib/* Add myself as the fallthough maintainer for material under lib/. Cc: Joe Perches Signed-off-by: Andrew Morton MAINTAINERS | 7 +++++++ 1 file changed, 7 insertions(+) commit a0ffa8115e1ea9786b03edc3f431d2f4ef3e7a2e Author: Ricardo Rivera-Matos Date: Wed Dec 6 10:03:18 2023 -0600 ASoC: cs35l45: Prevents spinning during runtime suspend Masks the "DSP Virtual Mailbox 2 write" interrupt when before issuing the hibernate command to the DSP. The interrupt is unmasked when exiting runtime suspend as it is required for DSP operation. Without this change the DSP fires an interrupt when hibernating causing the system spin between runtime suspend and runtime resume. Signed-off-by: Ricardo Rivera-Matos Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20231206160318.1255034-4-rriveram@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs35l45.c | 4 ++++ 1 file changed, 4 insertions(+) commit c3c8b088949b9ccb88da2f84d3c3cc06580a6a43 Author: Ricardo Rivera-Matos Date: Wed Dec 6 10:03:17 2023 -0600 ASoC: cs35l45: Prevent IRQ handling when suspending/resuming Use the SYSTEM_SLEEP_PM_OPS handlers to prevent handling an IRQ when the system is in the middle of suspending or resuming. Signed-off-by: Ricardo Rivera-Matos Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20231206160318.1255034-3-rriveram@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs35l45.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) commit 12e102b1bd22ee00361559d57a5876445bcb2407 Author: Ricardo Rivera-Matos Date: Wed Dec 6 10:03:16 2023 -0600 ASoC: cs35l45: Use modern pm_ops Make use of the recently introduced EXPORT_GPL_DEV_PM_OPS() macro, to conditionally export the runtime/system PM functions. Replace the old SET_{RUNTIME,SYSTEM_SLEEP,NOIRQ_SYSTEM_SLEEP}_PM_OPS() helpers with their modern alternatives and get rid of the now unnecessary '__maybe_unused' annotations on all PM functions. Additionally, use the pm_ptr() macro to fix the following errors when building with CONFIG_PM disabled: Signed-off-by: Ricardo Rivera-Matos Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20231206160318.1255034-2-rriveram@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs35l45-i2c.c | 2 +- sound/soc/codecs/cs35l45-spi.c | 2 +- sound/soc/codecs/cs35l45.c | 9 ++++----- 3 files changed, 6 insertions(+), 7 deletions(-) commit e59728883943c6820a0aa413db66a38f2e8c27bd Author: Daniel Hill Date: Wed Dec 6 21:26:00 2023 +1300 bcachefs: rebalance shouldn't attempt to compress unwritten extents This fixes a bug where rebalance would loop repeatedly on the same extents. Signed-off-by: Daniel Hill Signed-off-by: Kent Overstreet fs/bcachefs/extents.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 136c6531ba12e4a658376387e355a09c9b5223e5 Author: Fabio Estevam Date: Wed Dec 6 06:36:43 2023 -0300 dt-bindings: display: adi,adv75xx: Document #sound-dai-cells When using audio from ADV7533 or ADV7535 and describing the audio card via simple-audio-card, the '#sound-dai-cells' needs to be passed. Document the '#sound-dai-cells' property to fix the following dt-schema warning: imx8mn-beacon-kit.dtb: hdmi@3d: '#sound-dai-cells' does not match any of the regexes: 'pinctrl-[0-9]+' from schema $id: http://devicetree.org/schemas/display/bridge/adi,adv7533.yaml# Signed-off-by: Fabio Estevam Acked-by: Adam Ford Link: https://lore.kernel.org/r/20231206093643.2198562-1-festevam@gmail.com Signed-off-by: Rob Herring Documentation/devicetree/bindings/display/bridge/adi,adv7533.yaml | 6 ++++++ 1 file changed, 6 insertions(+) commit b6c7ca4d7966c9d6e3deaefa896666cd5f8e2d8d Author: Fabio Estevam Date: Wed Dec 6 08:23:37 2023 -0300 dt-bindings: lcdif: Properly describe the i.MX23 interrupts i.MX23 has two LCDIF interrupts instead of a single one like other i.MX devices. Take this into account for properly describing the i.MX23 LCDIF interrupts. This fixes the following dt-schema warning: imx23-olinuxino.dtb: lcdif@80030000: interrupts: [[46], [45]] is too long from schema $id: http://devicetree.org/schemas/display/fsl,lcdif.yaml# Signed-off-by: Fabio Estevam Reviewed-by: Marek Vasut Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20231206112337.2234849-1-festevam@gmail.com Signed-off-by: Rob Herring .../devicetree/bindings/display/fsl,lcdif.yaml | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) commit 7d2affce33209662f5a0b3b0fe60f41b948c279a Merge: a134cd8dfb8c f52f5c71f3d4 Author: Jens Axboe Date: Wed Dec 6 15:31:58 2023 -0700 Merge tag 'md-fixes-20231206' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-6.7 Pull MD fixes from Song: "This set from Yu Kuai fixes issues around sync_work, which was introduced in 6.7 kernels." * tag 'md-fixes-20231206' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: md: fix stopping sync thread md: don't leave 'MD_RECOVERY_FROZEN' in error path of md_set_readonly() md: fix missing flush of sync_work commit ffed24eff9e0e52d8e74df1c18db8ed43b4666e6 Author: Jiri Olsa Date: Wed Dec 6 09:30:41 2023 +0100 selftests/bpf: Add test for early update in prog_array_map_poke_run Adding test that tries to trigger the BUG_IN during early map update in prog_array_map_poke_run function. The idea is to share prog array map between thread that constantly updates it and another one loading a program that uses that prog array. Eventually we will hit a place where the program is ok to be updated (poke->tailcall_target_stable check) but the address is still not registered in kallsyms, so the bpf_arch_text_poke returns -EINVAL and cause imbalance for the next tail call update check, which will fail with -EBUSY in bpf_arch_text_poke as described in previous fix. Signed-off-by: Jiri Olsa Signed-off-by: Daniel Borkmann Acked-by: Ilya Leoshkevich Link: https://lore.kernel.org/bpf/20231206083041.1306660-3-jolsa@kernel.org tools/testing/selftests/bpf/prog_tests/tailcalls.c | 84 ++++++++++++++++++++++ tools/testing/selftests/bpf/progs/tailcall_poke.c | 32 +++++++++ 2 files changed, 116 insertions(+) commit 4b7de801606e504e69689df71475d27e35336fb3 Author: Jiri Olsa Date: Wed Dec 6 09:30:40 2023 +0100 bpf: Fix prog_array_map_poke_run map poke update Lee pointed out issue found by syscaller [0] hitting BUG in prog array map poke update in prog_array_map_poke_run function due to error value returned from bpf_arch_text_poke function. There's race window where bpf_arch_text_poke can fail due to missing bpf program kallsym symbols, which is accounted for with check for -EINVAL in that BUG_ON call. The problem is that in such case we won't update the tail call jump and cause imbalance for the next tail call update check which will fail with -EBUSY in bpf_arch_text_poke. I'm hitting following race during the program load: CPU 0 CPU 1 bpf_prog_load bpf_check do_misc_fixups prog_array_map_poke_track map_update_elem bpf_fd_array_map_update_elem prog_array_map_poke_run bpf_arch_text_poke returns -EINVAL bpf_prog_kallsyms_add After bpf_arch_text_poke (CPU 1) fails to update the tail call jump, the next poke update fails on expected jump instruction check in bpf_arch_text_poke with -EBUSY and triggers the BUG_ON in prog_array_map_poke_run. Similar race exists on the program unload. Fixing this by moving the update to bpf_arch_poke_desc_update function which makes sure we call __bpf_arch_text_poke that skips the bpf address check. Each architecture has slightly different approach wrt looking up bpf address in bpf_arch_text_poke, so instead of splitting the function or adding new 'checkip' argument in previous version, it seems best to move the whole map_poke_run update as arch specific code. [0] https://syzkaller.appspot.com/bug?extid=97a4fe20470e9bc30810 Fixes: ebf7d1f508a7 ("bpf, x64: rework pro/epilogue and tailcall handling in JIT") Reported-by: syzbot+97a4fe20470e9bc30810@syzkaller.appspotmail.com Signed-off-by: Jiri Olsa Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Cc: Lee Jones Cc: Maciej Fijalkowski Link: https://lore.kernel.org/bpf/20231206083041.1306660-2-jolsa@kernel.org arch/x86/net/bpf_jit_comp.c | 46 +++++++++++++++++++++++++++++++++++ include/linux/bpf.h | 3 +++ kernel/bpf/arraymap.c | 58 ++++++++------------------------------------- 3 files changed, 59 insertions(+), 48 deletions(-) commit e85a0adacf170634878fffcbf34b725aff3f49ed Author: Boris Burkov Date: Fri Dec 1 13:00:13 2023 -0800 btrfs: ensure releasing squota reserve on head refs A reservation goes through a 3 step lifetime: - generated during delalloc - released/counted by ordered_extent allocation - freed by running delayed ref That third step depends on must_insert_reserved on the head ref, so the head ref with that field set owns the reservation. Once you prepare to run the head ref, must_insert_reserved is unset, which means that running the ref must free the reservation, whether or not it succeeds, or else the reservation is leaked. That results in either a risk of spurious ENOSPC if the fs stays writeable or a warning on unmount if it is readonly. The existing squota code was aware of these invariants, but missed a few cases. Improve it by adding a helper function to use in the cleanup paths and call it from the existing early returns in running delayed refs. This also simplifies btrfs_record_squota_delta and struct btrfs_quota_delta. This fixes (or at least improves the reliability of) generic/475 with "mkfs -O squota". On my machine, that test failed ~4/10 times without this patch and passed 100/100 times with it. Signed-off-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 48 ++++++++++++++++++++++++++++++++++-------------- fs/btrfs/qgroup.c | 14 +++++++++++--- fs/btrfs/qgroup.h | 3 +-- 3 files changed, 46 insertions(+), 19 deletions(-) commit a86805504b88f636a6458520d85afdf0634e3c6b Author: Boris Burkov Date: Fri Dec 1 13:00:12 2023 -0800 btrfs: don't clear qgroup reserved bit in release_folio The EXTENT_QGROUP_RESERVED bit is used to "lock" regions of the file for duplicate reservations. That is two writes to that range in one transaction shouldn't create two reservations, as the reservation will only be freed once when the write finally goes down. Therefore, it is never OK to clear that bit without freeing the associated qgroup reserve. At this point, we don't want to be freeing the reserve, so mask off the bit. CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/extent_io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit b321a52cce062ec7ed385333a33905d22159ce36 Author: Boris Burkov Date: Fri Dec 1 13:00:11 2023 -0800 btrfs: free qgroup pertrans reserve on transaction abort If we abort a transaction, we never run the code that frees the pertrans qgroup reservation. This results in warnings on unmount as that reservation has been leaked. The leak isn't a huge issue since the fs is read-only, but it's better to clean it up when we know we can/should. Do it during the cleanup_transaction step of aborting. CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/disk-io.c | 28 ++++++++++++++++++++++++++++ fs/btrfs/qgroup.c | 5 +++-- fs/btrfs/transaction.c | 2 -- fs/btrfs/transaction.h | 3 +++ 4 files changed, 34 insertions(+), 4 deletions(-) commit 9e65bfca24cf1d77e4a5c7a170db5867377b3fe7 Author: Boris Burkov Date: Fri Dec 1 13:00:10 2023 -0800 btrfs: fix qgroup_free_reserved_data int overflow The reserved data counter and input parameter is a u64, but we inadvertently accumulate it in an int. Overflowing that int results in freeing the wrong amount of data and breaking reserve accounting. Unfortunately, this overflow rot spreads from there, as the qgroup release/free functions rely on returning an int to take advantage of negative values for error codes. Therefore, the full fix is to return the "released" or "freed" amount by a u64 argument and to return 0 or negative error code via the return value. Most of the call sites simply ignore the return value, though some of them handle the error and count the returned bytes. Change all of them accordingly. CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/delalloc-space.c | 2 +- fs/btrfs/file.c | 2 +- fs/btrfs/inode.c | 16 ++++++++-------- fs/btrfs/ordered-data.c | 7 ++++--- fs/btrfs/qgroup.c | 25 +++++++++++++++---------- fs/btrfs/qgroup.h | 4 ++-- 6 files changed, 31 insertions(+), 25 deletions(-) commit f63e1164b90b385cd832ff0fdfcfa76c3cc15436 Author: Boris Burkov Date: Fri Dec 1 13:00:09 2023 -0800 btrfs: free qgroup reserve when ORDERED_IOERR is set An ordered extent completing is a critical moment in qgroup reserve handling, as the ownership of the reservation is handed off from the ordered extent to the delayed ref. In the happy path we release (unlock) but do not free (decrement counter) the reservation, and the delayed ref drives the free. However, on an error, we don't create a delayed ref, since there is no ref to add. Therefore, free on the error path. CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/ordered-data.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit dab96d8b61aab1a4f99d0b86964a6c40e7bb1756 Author: Alex Deucher Date: Wed Nov 29 15:44:25 2023 -0500 drm/amdgpu: fix buffer funcs setting order on suspend We need to disable this after the last eviction call, but before we disable the SDMA IP. Fixes: b70438004a14 ("drm/amdgpu: move buffer funcs setting up a level") Link: https://lore.kernel.org/r/87edgv4x3i.fsf@vps.thesusis.net Reviewed-by: Luben Tuikov Tested-by: Phillip Susi Signed-off-by: Alex Deucher Cc: Phillip Susi Cc: Luben Tuikov drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 ++ 1 file changed, 2 insertions(+) commit 27b024a88acba17c8e3a71ff4fd425064851e3b7 Author: Lijo Lazar Date: Thu Nov 30 16:35:58 2023 +0530 drm/amdgpu: Avoid querying DRM MGCG status MP0 v13.0.6 SOCs don't support DRM MGCG. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/soc15.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 555e39f0270b1a1c51224044be9922b4c3a4c27f Author: Lijo Lazar Date: Thu Nov 30 15:58:21 2023 +0530 drm/amdgpu: Update HDP 4.4.2 clock gating flags HDP 4.4.2 clockgating is enabled by default, update the flags accordingly. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/hdp_v4_0.c | 5 +++++ 1 file changed, 5 insertions(+) commit 81577503efb49f4ad76af22f9941d72900ef4aab Author: Lijo Lazar Date: Wed Nov 29 12:37:34 2023 +0530 drm/amdgpu: Add NULL checks for function pointers Check if function is implemented before making the call. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/soc15.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 6fce23a4d8c5f93bf80b7f122449fbb97f1e40dd Author: Lijo Lazar Date: Wed Nov 29 18:06:55 2023 +0530 drm/amdgpu: Restrict extended wait to PSP v13.0.6 Only PSPv13.0.6 SOCs take a longer time to reach steady state. Other PSPv13 based SOCs don't need extended wait. Also, reduce PSPv13.0.6 wait time. Cc: stable@vger.kernel.org Fixes: fc5988907156 ("drm/amdgpu: update retry times for psp vmbx wait") Fixes: d8c1925ba8cd ("drm/amdgpu: update retry times for psp BL wait") Link: https://lore.kernel.org/amd-gfx/34dd4c66-f7bf-44aa-af8f-c82889dd652c@amd.com/ Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/psp_v13_0.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 5b750b22530fe53bf7fd6a30baacd53ada26911b Author: Alex Deucher Date: Thu Nov 30 17:34:07 2023 -0500 drm/amd/display: Increase frame warning limit with KASAN or KCSAN in dml Does the same thing as: commit 6740ec97bcdb ("drm/amd/display: Increase frame warning limit with KASAN or KCSAN in dml2") Reviewed-by: Harry Wentland Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311302107.hUDXVyWT-lkp@intel.com/ Fixes: 67e38874b85b ("drm/amd/display: Increase num voltage states to 40") Signed-off-by: Alex Deucher Cc: Alvin Lee Cc: Hamza Mahfooz Cc: Samson Tam Cc: Harry Wentland drivers/gpu/drm/amd/display/dc/dml/Makefile | 4 ++++ 1 file changed, 4 insertions(+) commit dbf3850d12baf3ba8a80c302f538d1b01940aef7 Author: Yang Wang Date: Mon Dec 4 10:44:32 2023 +0800 drm/amdgpu: optimize the printing order of error data sort error data list to optimize the printing order. Signed-off-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) commit 0e8af20517197934cc04f8e361c6bbe198c327fd Author: Hawking Zhang Date: Mon Nov 20 10:43:02 2023 +0800 drm/amdgpu: Update fw version for boot time error query Boot time error query is not available until fw a10109 Signed-off-by: Hawking Zhang Reviewed-by: Stanley Yang Reviewed-by: Yang Wang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/psp_v13_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 37c57631c18661c4c0dc415e75afd143ed89e098 Author: Yang Wang Date: Mon Dec 4 10:17:57 2023 +0800 drm/amd/pm: support new mca smu error code decoding support new mca smu error code decoding from smu 85.86.0 for smu v13.0.6 Signed-off-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_mca.h | 2 ++ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 9 ++++++++- 2 files changed, 10 insertions(+), 1 deletion(-) commit 78825df90d427b26964bf9610eaac30542ee9e2d Author: Li Ma Date: Tue Nov 14 16:17:51 2023 +0800 drm/amd/swsmu: update smu v14_0_0 driver if version and metrics table Increment the driver if version and add new mems to the mertics table. Signed-off-by: Li Ma Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/include/kgd_pp_interface.h | 17 +++++ drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 10 +++ .../pm/swsmu/inc/pmfw_if/smu14_driver_if_v14_0_0.h | 77 +++++++++++++--------- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c | 46 ++++++++++++- 4 files changed, 115 insertions(+), 35 deletions(-) commit 9f7cb03e3c32613fb5891e10ce3ff9169b09ba69 Author: Roman Li Date: Fri Dec 1 06:25:40 2023 -0700 drm/amd/display: Fix array-index-out-of-bounds in dml2 [Why] UBSAN errors observed in dmesg. array-index-out-of-bounds in dml2/display_mode_core.c [How] Fix the index. Tested-by: Daniel Wheeler Acked-by: Rodrigo Siqueira Signed-off-by: Roman Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 3d71a8726e05a35beb9de394e86ce896d69e563f Author: Ivan Lipski Date: Fri Dec 1 06:25:16 2023 -0700 drm/amd/display: Add monitor patch for specific eDP [WHY] Some eDP panels's ext caps don't write initial value cause the value of dpcd_addr(0x317) is random. It means that sometimes the eDP will clarify it is OLED, miniLED...etc cause the backlight control interface is incorrect. [HOW] Add a new panel patch to remove sink ext caps(HDR,OLED...etc) Tested-by: Daniel Wheeler Reviewed-by: Sun peng Li Acked-by: Rodrigo Siqueira Signed-off-by: Ivan Lipski Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 6 ++++++ 1 file changed, 6 insertions(+) commit fec05adc40c25a028c9dfa9d540f800a2d433f80 Author: Alvin Lee Date: Fri Dec 1 06:25:07 2023 -0700 drm/amd/display: Use channel_width = 2 for vram table 3.0 VBIOS has suggested to use channel_width=2 for any ASIC that uses vram info 3.0. This is because channel_width in the vram table no longer represents the memory width Tested-by: Daniel Wheeler Reviewed-by: Samson Tam Acked-by: Rodrigo Siqueira Signed-off-by: Alvin Lee Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit f52f5c71f3d4bb0992800139d2f35cf9f6f6e0ee Author: Yu Kuai Date: Tue Dec 5 17:42:15 2023 +0800 md: fix stopping sync thread Currently sync thread is stopped from multiple contex: - idle_sync_thread - frozen_sync_thread - __md_stop_writes - md_set_readonly - do_md_stop And there are some problems: 1) sync_work is flushed while reconfig_mutex is grabbed, this can deadlock because the work function will grab reconfig_mutex as well. 2) md_reap_sync_thread() can't be called directly while md_do_sync() is not finished yet, for example, commit 130443d60b1b ("md: refactor idle/frozen_sync_thread() to fix deadlock"). 3) If MD_RECOVERY_RUNNING is not set, there is no need to stop sync_thread at all because sync_thread must not be registered. Factor out a helper stop_sync_thread(), so that above contex will behave the same. Fix 1) by flushing sync_work after reconfig_mutex is released, before waiting for sync_thread to be done; Fix 2) bt letting daemon thread to unregister sync_thread; Fix 3) by always checking MD_RECOVERY_RUNNING first. Fixes: db5e653d7c9f ("md: delay choosing sync action to md_start_sync()") Signed-off-by: Yu Kuai Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20231205094215.1824240-4-yukuai1@huaweicloud.com drivers/md/md.c | 90 ++++++++++++++++++++++++--------------------------------- 1 file changed, 37 insertions(+), 53 deletions(-) commit c9f7cb5b2bc968adcdc686c197ed108f47fd8eb0 Author: Yu Kuai Date: Tue Dec 5 17:42:14 2023 +0800 md: don't leave 'MD_RECOVERY_FROZEN' in error path of md_set_readonly() If md_set_readonly() failed, the array could still be read-write, however 'MD_RECOVERY_FROZEN' could still be set, which leave the array in an abnormal state that sync or recovery can't continue anymore. Hence make sure the flag is cleared after md_set_readonly() returns. Fixes: 88724bfa68be ("md: wait for pending superblock updates before switching to read-only") Signed-off-by: Yu Kuai Acked-by: Xiao Ni Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20231205094215.1824240-3-yukuai1@huaweicloud.com drivers/md/md.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) commit f2d87a759f6841a132e845e2fafdad37385ddd30 Author: Yu Kuai Date: Tue Dec 5 17:42:13 2023 +0800 md: fix missing flush of sync_work Commit ac619781967b ("md: use separate work_struct for md_start_sync()") use a new sync_work to replace del_work, however, stop_sync_thread() and __md_stop_writes() was trying to wait for sync_thread to be done, hence they should switch to use sync_work as well. Noted that md_start_sync() from sync_work will grab 'reconfig_mutex', hence other contex can't held the same lock to flush work, and this will be fixed in later patches. Fixes: ac619781967b ("md: use separate work_struct for md_start_sync()") Signed-off-by: Yu Kuai Acked-by: Xiao Ni Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20231205094215.1824240-2-yukuai1@huaweicloud.com drivers/md/md.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d6a57588666301acd9d42d3b00d74240964f07f6 Author: Jiadong Zhu Date: Fri Dec 1 08:38:15 2023 +0800 drm/amdgpu: disable MCBP by default Disable MCBP(mid command buffer preemption) by default as old Mesa hangs with it. We shall not enable the feature that breaks old usermode driver. Fixes: 50a7c8765ca6 ("drm/amdgpu: enable mcbp by default on gfx9") Signed-off-by: Jiadong Zhu Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ---- 1 file changed, 4 deletions(-) commit f458a1453424e03462b5bb539673c9a3cddda480 Author: Steven Rostedt (Google) Date: Wed Dec 6 10:00:50 2023 -0500 ring-buffer: Test last update in 32bit version of __rb_time_read() Since 64 bit cmpxchg() is very expensive on 32bit architectures, the timestamp used by the ring buffer does some interesting tricks to be able to still have an atomic 64 bit number. It originally just used 60 bits and broke it up into two 32 bit words where the extra 2 bits were used for synchronization. But this was not enough for all use cases, and all 64 bits were required. The 32bit version of the ring buffer timestamp was then broken up into 3 32bit words using the same counter trick. But one update was not done. The check to see if the read operation was done without interruption only checked the first two words and not last one (like it had before this update). Fix it by making sure all three updates happen without interruption by comparing the initial counter with the last updated counter. Link: https://lore.kernel.org/linux-trace-kernel/20231206100050.3100b7bb@gandalf.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Fixes: f03f2abce4f39 ("ring-buffer: Have 32 bit time stamps use all 64 bits") Signed-off-by: Steven Rostedt (Google) kernel/trace/ring_buffer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b2dd797543cfa6580eac8408dd67fa02164d9e56 Author: Steven Rostedt (Google) Date: Wed Dec 6 10:02:44 2023 -0500 ring-buffer: Force absolute timestamp on discard of event There's a race where if an event is discarded from the ring buffer and an interrupt were to happen at that time and insert an event, the time stamp is still used from the discarded event as an offset. This can screw up the timings. If the event is going to be discarded, set the "before_stamp" to zero. When a new event comes in, it compares the "before_stamp" with the "write_stamp" and if they are not equal, it will insert an absolute timestamp. This will prevent the timings from getting out of sync due to the discarded event. Link: https://lore.kernel.org/linux-trace-kernel/20231206100244.5130f9b3@gandalf.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Fixes: 6f6be606e763f ("ring-buffer: Force before_stamp and write_stamp to be different on discard") Signed-off-by: Steven Rostedt (Google) kernel/trace/ring_buffer.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) commit 04909192ada3285070f8ced0af7f07735478b364 Author: Shyam Prasad N Date: Wed Dec 6 16:37:38 2023 +0000 cifs: reconnect worker should take reference on server struct unconditionally Reconnect worker currently assumes that the server struct is alive and only takes reference on the server if it needs to call smb2_reconnect. With the new ability to disable channels based on whether the server has multichannel disabled, this becomes a problem when we need to disable established channels. While disabling the channels and deallocating the server, there could be reconnect work that could not be cancelled (because it started). This change forces the reconnect worker to unconditionally take a reference on the server when it runs. Also, this change now allows smb2_reconnect to know if it was called by the reconnect worker. Based on this, the cifs_put_tcp_session can decide whether it can cancel the reconnect work synchronously or not. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/connect.c | 8 ++++---- fs/smb/client/smb2pdu.c | 29 +++++++++++++++-------------- 2 files changed, 19 insertions(+), 18 deletions(-) commit 823342524868168bf681f135d01b4ae10f5863ec Author: Shyam Prasad N Date: Wed Dec 6 16:37:37 2023 +0000 Revert "cifs: reconnect work should have reference on server struct" This reverts commit 19a4b9d6c372cab6a3b2c9a061a236136fe95274. This earlier commit was making an assumption that each mod_delayed_work called for the reconnect work would result in smb2_reconnect_server being called twice. This assumption turns out to be untrue. So reverting this change for now. I will submit a follow-up patch to fix the actual problem in a different way. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/connect.c | 27 ++++++--------------------- fs/smb/client/smb2pdu.c | 23 ++++++++++------------- 2 files changed, 16 insertions(+), 34 deletions(-) commit 7ae836a3d630e146b732fe8ef7d86b243748751f Author: Phil Sutter Date: Tue Dec 5 21:58:12 2023 +0100 netfilter: xt_owner: Fix for unsafe access of sk->sk_socket A concurrently running sock_orphan() may NULL the sk_socket pointer in between check and deref. Follow other users (like nft_meta.c for instance) and acquire sk_callback_lock before dereferencing sk_socket. Fixes: 0265ab44bacc ("[NETFILTER]: merge ipt_owner/ip6t_owner in xt_owner") Reported-by: Jann Horn Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso net/netfilter/xt_owner.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) commit b0b2981c49ff43f2c547c3a7c82869d6135cfb9a Merge: 94ea0ed356b4 f1ed48ef97e2 Author: Arnd Bergmann Date: Wed Dec 6 17:35:29 2023 +0100 Merge tag 'ffa-fixes-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm FF-A fixes for v6.7 A bunch of fixes addressing issues around the notification support that was added this cycle. They address issue in partition IDs handling in ffa_notification_info_get(), notifications cleanup path and the size of the allocation in ffa_partitions_cleanup(). It also adds check for the notification enabled state so that the drivers registering the callbacks can be rejected if not enabled/supported. It also moves the partitions setup operation after the notification initialisation so that the driver has the correct state for notification enabled/supported before the partitions are initialised/setup. It also now allows FF-A initialisation to complete successfully even when the notification initialisation fails as it is an optional support in the specification. Initial support just allowed it only if the firmware didn't support notifications. Finally, it also adds a fix for smatch warning by declaring ffa_bus_type structure in the header. * tag 'ffa-fixes-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_ffa: Fix ffa_notification_info_get() IDs handling firmware: arm_ffa: Fix the size of the allocation in ffa_partitions_cleanup() firmware: arm_ffa: Fix FFA notifications cleanup path firmware: arm_ffa: Add checks for the notification enabled state firmware: arm_ffa: Setup the partitions after the notification initialisation firmware: arm_ffa: Allow FF-A initialisation even when notification fails firmware: arm_ffa: Declare ffa_bus_type structure in the header Link: https://lore.kernel.org/r/20231116191603.929767-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 7a733e060bd20edb63b1f27f0b29cf9b184e0e8b Author: Nam Cao Date: Wed Dec 6 15:52:33 2023 +0100 spi: cadence: revert "Add SPI transfer delays" The commit 855a40cd8ccc ("spi: cadence: Add SPI transfer delays") adds a delay after each transfer into the driver's transfer_one(). However, the delay is already done in SPI core. So this commit unnecessarily doubles the delay amount. Revert this commit. Signed-off-by: Nam Cao Link: https://lore.kernel.org/r/20231206145233.74982-1-namcao@linutronix.de Signed-off-by: Mark Brown drivers/spi/spi-cadence.c | 1 - 1 file changed, 1 deletion(-) commit d20d36755a605a21e737b6b16c566658589b1811 Author: Curtis Malainey Date: Tue Dec 5 14:01:18 2023 -0800 ASoC: SOF: mediatek: mt8186: Revert Add Google Steelix topology compatible This reverts commit 505c83212da5bfca95109421b8f5d9f8c6cdfef2. This is not an official topology from the SOF project. Topologies are named based on the card configuration and are NOT board specific. Signed-off-by: Curtis Malainey Link: https://lore.kernel.org/r/20231205220131.2585913-1-cujomalainey@chromium.org Signed-off-by: Mark Brown sound/soc/sof/mediatek/mt8186/mt8186.c | 3 --- 1 file changed, 3 deletions(-) commit f6e1532a2697b81da00bfb184e99d15e01e9d98c Author: Pablo Neira Ayuso Date: Mon Dec 4 14:51:48 2023 +0100 netfilter: nf_tables: validate family when identifying table via handle Validate table family when looking up for it via NFTA_TABLE_HANDLE. Fixes: 3ecbfd65f50e ("netfilter: nf_tables: allocate handle and delete objects via handle") Reported-by: Xingyuan Mo Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_tables_api.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 3701cd390fd731ee7ae8b8006246c8db82c72bea Author: Pablo Neira Ayuso Date: Mon Dec 4 14:25:33 2023 +0100 netfilter: nf_tables: bail out on mismatching dynset and set expressions If dynset expressions provided by userspace is larger than the declared set expressions, then bail out. Fixes: 48b0ae046ee9 ("netfilter: nftables: netlink support for several set element expressions") Reported-by: Xingyuan Mo Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_dynset.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit 63331e37fb227e796894b31d713697612c8dee7f Author: Florian Westphal Date: Mon Dec 4 12:29:54 2023 +0100 netfilter: nf_tables: fix 'exist' matching on bigendian arches Maze reports "tcp option fastopen exists" fails to match on OpenWrt 22.03.5, r20134-5f15225c1e (5.10.176) router. "tcp option fastopen exists" translates to: inet [ exthdr load tcpopt 1b @ 34 + 0 present => reg 1 ] [ cmp eq reg 1 0x00000001 ] .. but existing nft userspace generates a 1-byte compare. On LSB (x86), "*reg32 = 1" is identical to nft_reg_store8(reg32, 1), but not on MSB, which will place the 1 last. IOW, on bigendian aches the cmp8 is awalys false. Make sure we store this in a consistent fashion, so existing userspace will also work on MSB (bigendian). Regardless of this patch we can also change nft userspace to generate 'reg32 == 0' and 'reg32 != 0' instead of u8 == 0 // u8 == 1 when adding 'option x missing/exists' expressions as well. Fixes: 3c1fece8819e ("netfilter: nft_exthdr: Allow checking TCP option presence, too") Fixes: b9f9a485fb0e ("netfilter: nft_exthdr: add boolean DCCP option matching") Fixes: 055c4b34b94f ("netfilter: nft_fib: Support existence check") Reported-by: Maciej Żenczykowski Closes: https://lore.kernel.org/netfilter-devel/CAHo-OozyEqHUjL2-ntATzeZOiuftLWZ_HU6TOM_js4qLfDEAJg@mail.gmail.com/ Signed-off-by: Florian Westphal Acked-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_exthdr.c | 4 ++-- net/netfilter/nft_fib.c | 8 ++++++-- 2 files changed, 8 insertions(+), 4 deletions(-) commit 317eb9685095678f2c9f5a8189de698c5354316a Author: Florian Westphal Date: Fri Dec 1 15:47:13 2023 +0100 netfilter: nft_set_pipapo: skip inactive elements during set walk Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_set_pipapo.c | 3 +++ 1 file changed, 3 insertions(+) commit 1834d62ae88500f37cba4439c3237aa85242272e Author: D. Wythe Date: Thu Nov 30 15:23:23 2023 +0800 netfilter: bpf: fix bad registration on nf_defrag We should pass a pointer to global_hook to the get_proto_defrag_hook() instead of its value, since the passed value won't be updated even if the request module was loaded successfully. Log: [ 54.915713] nf_defrag_ipv4 has bad registration [ 54.915779] WARNING: CPU: 3 PID: 6323 at net/netfilter/nf_bpf_link.c:62 get_proto_defrag_hook+0x137/0x160 [ 54.915835] CPU: 3 PID: 6323 Comm: fentry Kdump: loaded Tainted: G E 6.7.0-rc2+ #35 [ 54.915839] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 [ 54.915841] RIP: 0010:get_proto_defrag_hook+0x137/0x160 [ 54.915844] Code: 4f 8c e8 2c cf 68 ff 80 3d db 83 9a 01 00 0f 85 74 ff ff ff 48 89 ee 48 c7 c7 8f 12 4f 8c c6 05 c4 83 9a 01 01 e8 09 ee 5f ff <0f> 0b e9 57 ff ff ff 49 8b 3c 24 4c 63 e5 e8 36 28 6c ff 4c 89 e0 [ 54.915849] RSP: 0018:ffffb676003fbdb0 EFLAGS: 00010286 [ 54.915852] RAX: 0000000000000023 RBX: ffff9596503d5600 RCX: ffff95996fce08c8 [ 54.915854] RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff95996fce08c0 [ 54.915855] RBP: ffffffff8c4f12de R08: 0000000000000000 R09: 00000000fffeffff [ 54.915859] R10: ffffb676003fbc70 R11: ffffffff8d363ae8 R12: 0000000000000000 [ 54.915861] R13: ffffffff8e1f75c0 R14: ffffb676003c9000 R15: 00007ffd15e78ef0 [ 54.915864] FS: 00007fb6e9cab740(0000) GS:ffff95996fcc0000(0000) knlGS:0000000000000000 [ 54.915867] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 54.915868] CR2: 00007ffd15e75c40 CR3: 0000000101e62006 CR4: 0000000000360ef0 [ 54.915870] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 54.915871] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 54.915873] Call Trace: [ 54.915891] [ 54.915894] ? __warn+0x84/0x140 [ 54.915905] ? get_proto_defrag_hook+0x137/0x160 [ 54.915908] ? __report_bug+0xea/0x100 [ 54.915925] ? report_bug+0x2b/0x80 [ 54.915928] ? handle_bug+0x3c/0x70 [ 54.915939] ? exc_invalid_op+0x18/0x70 [ 54.915942] ? asm_exc_invalid_op+0x1a/0x20 [ 54.915948] ? get_proto_defrag_hook+0x137/0x160 [ 54.915950] bpf_nf_link_attach+0x1eb/0x240 [ 54.915953] link_create+0x173/0x290 [ 54.915969] __sys_bpf+0x588/0x8f0 [ 54.915974] __x64_sys_bpf+0x20/0x30 [ 54.915977] do_syscall_64+0x45/0xf0 [ 54.915989] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 54.915998] RIP: 0033:0x7fb6e9daa51d [ 54.916001] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 2b 89 0c 00 f7 d8 64 89 01 48 [ 54.916003] RSP: 002b:00007ffd15e78ed8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 54.916006] RAX: ffffffffffffffda RBX: 00007ffd15e78fc0 RCX: 00007fb6e9daa51d [ 54.916007] RDX: 0000000000000040 RSI: 00007ffd15e78ef0 RDI: 000000000000001c [ 54.916009] RBP: 000000000000002d R08: 00007fb6e9e73a60 R09: 0000000000000001 [ 54.916010] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 54.916012] R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000 [ 54.916014] [ 54.916015] ---[ end trace 0000000000000000 ]--- Fixes: 91721c2d02d3 ("netfilter: bpf: Support BPF_F_NETFILTER_IP_DEFRAG in netfilter link") Signed-off-by: D. Wythe Acked-by: Daniel Xu Reviewed-by: Simon Horman Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_bpf_link.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 94ea0ed356b45fa2d5d0c08d5495471bde29a1e5 Author: Chester Lin Date: Thu Nov 16 07:45:08 2023 +0800 MAINTAINERS: change the S32G2 maintainer's email address. I am leaving SUSE so the current email address will be disabled soon. will be my new address for handling emails, patches and pull requests from upstream and communities. Cc: Chester Lin Cc: NXP S32 Linux Team Cc: Arnd Bergmann Cc: Olof Johansson Cc: Andreas Färber Cc: Matthias Brugger Signed-off-by: Chester Lin Reviewed-by: Matthias Brugger Link: https://lore.kernel.org/r/20231115234508.11510-1-clin@suse.com Signed-off-by: Arnd Bergmann MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 56d4eaed1e38c1e010156556d4534c9793bf68be Merge: 2d8781ba59c1 dc761f11af2e Author: Arnd Bergmann Date: Wed Dec 6 16:36:55 2023 +0100 Merge tag 'arm-soc/for-6.7/devicetree-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM-based SoCs Device Tree fixes for 6.7, please pull the following: - Stefan corrects the disabling of the activity LED for the Raspberry Pi 400 * tag 'arm-soc/for-6.7/devicetree-fixes' of https://github.com/Broadcom/stblinux: ARM: dts: bcm2711-rpi-400: Fix delete-node of led_act Link: https://lore.kernel.org/r/20231205225021.653045-1-florian.fainelli@broadcom.com Signed-off-by: Arnd Bergmann commit fe2b1226656afae56702d1d84c6900f6b67df297 Author: Heiner Kallweit Date: Fri Dec 1 11:23:22 2023 +0100 leds: trigger: netdev: fix RTNL handling to prevent potential deadlock When working on LED support for r8169 I got the following lockdep warning. Easiest way to prevent this scenario seems to be to take the RTNL lock before the trigger_data lock in set_device_name(). ====================================================== WARNING: possible circular locking dependency detected 6.7.0-rc2-next-20231124+ #2 Not tainted ------------------------------------------------------ bash/383 is trying to acquire lock: ffff888103aa1c68 (&trigger_data->lock){+.+.}-{3:3}, at: netdev_trig_notify+0xec/0x190 [ledtrig_netdev] but task is already holding lock: ffffffff8cddf808 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x12/0x20 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (rtnl_mutex){+.+.}-{3:3}: __mutex_lock+0x9b/0xb50 mutex_lock_nested+0x16/0x20 rtnl_lock+0x12/0x20 set_device_name+0xa9/0x120 [ledtrig_netdev] netdev_trig_activate+0x1a1/0x230 [ledtrig_netdev] led_trigger_set+0x172/0x2c0 led_trigger_write+0xf1/0x140 sysfs_kf_bin_write+0x5d/0x80 kernfs_fop_write_iter+0x15d/0x210 vfs_write+0x1f0/0x510 ksys_write+0x6c/0xf0 __x64_sys_write+0x14/0x20 do_syscall_64+0x3f/0xf0 entry_SYSCALL_64_after_hwframe+0x6c/0x74 -> #0 (&trigger_data->lock){+.+.}-{3:3}: __lock_acquire+0x1459/0x25a0 lock_acquire+0xc8/0x2d0 __mutex_lock+0x9b/0xb50 mutex_lock_nested+0x16/0x20 netdev_trig_notify+0xec/0x190 [ledtrig_netdev] call_netdevice_register_net_notifiers+0x5a/0x100 register_netdevice_notifier+0x85/0x120 netdev_trig_activate+0x1d4/0x230 [ledtrig_netdev] led_trigger_set+0x172/0x2c0 led_trigger_write+0xf1/0x140 sysfs_kf_bin_write+0x5d/0x80 kernfs_fop_write_iter+0x15d/0x210 vfs_write+0x1f0/0x510 ksys_write+0x6c/0xf0 __x64_sys_write+0x14/0x20 do_syscall_64+0x3f/0xf0 entry_SYSCALL_64_after_hwframe+0x6c/0x74 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(rtnl_mutex); lock(&trigger_data->lock); lock(rtnl_mutex); lock(&trigger_data->lock); *** DEADLOCK *** 8 locks held by bash/383: #0: ffff888103ff33f0 (sb_writers#3){.+.+}-{0:0}, at: ksys_write+0x6c/0xf0 #1: ffff888103aa1e88 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x114/0x210 #2: ffff8881036f1890 (kn->active#82){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x11d/0x210 #3: ffff888108e2c358 (&led_cdev->led_access){+.+.}-{3:3}, at: led_trigger_write+0x30/0x140 #4: ffffffff8cdd9e10 (triggers_list_lock){++++}-{3:3}, at: led_trigger_write+0x75/0x140 #5: ffff888108e2c270 (&led_cdev->trigger_lock){++++}-{3:3}, at: led_trigger_write+0xe3/0x140 #6: ffffffff8cdde3d0 (pernet_ops_rwsem){++++}-{3:3}, at: register_netdevice_notifier+0x1c/0x120 #7: ffffffff8cddf808 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x12/0x20 stack backtrace: CPU: 0 PID: 383 Comm: bash Not tainted 6.7.0-rc2-next-20231124+ #2 Hardware name: Default string Default string/Default string, BIOS ADLN.M6.SODIMM.ZB.CY.015 08/08/2023 Call Trace: dump_stack_lvl+0x5c/0xd0 dump_stack+0x10/0x20 print_circular_bug+0x2dd/0x410 check_noncircular+0x131/0x150 __lock_acquire+0x1459/0x25a0 lock_acquire+0xc8/0x2d0 ? netdev_trig_notify+0xec/0x190 [ledtrig_netdev] __mutex_lock+0x9b/0xb50 ? netdev_trig_notify+0xec/0x190 [ledtrig_netdev] ? __this_cpu_preempt_check+0x13/0x20 ? netdev_trig_notify+0xec/0x190 [ledtrig_netdev] ? __cancel_work_timer+0x11c/0x1b0 ? __mutex_lock+0x123/0xb50 mutex_lock_nested+0x16/0x20 ? mutex_lock_nested+0x16/0x20 netdev_trig_notify+0xec/0x190 [ledtrig_netdev] call_netdevice_register_net_notifiers+0x5a/0x100 register_netdevice_notifier+0x85/0x120 netdev_trig_activate+0x1d4/0x230 [ledtrig_netdev] led_trigger_set+0x172/0x2c0 ? preempt_count_add+0x49/0xc0 led_trigger_write+0xf1/0x140 sysfs_kf_bin_write+0x5d/0x80 kernfs_fop_write_iter+0x15d/0x210 vfs_write+0x1f0/0x510 ksys_write+0x6c/0xf0 __x64_sys_write+0x14/0x20 do_syscall_64+0x3f/0xf0 entry_SYSCALL_64_after_hwframe+0x6c/0x74 RIP: 0033:0x7f269055d034 Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d 35 c3 0d 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 48 89 54 24 18 48 RSP: 002b:00007ffddb7ef748 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00007f269055d034 RDX: 0000000000000007 RSI: 000055bf5f4af3c0 RDI: 0000000000000001 RBP: 000055bf5f4af3c0 R08: 0000000000000073 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000007 R13: 00007f26906325c0 R14: 00007f269062ff20 R15: 0000000000000000 Fixes: d5e01266e7f5 ("leds: trigger: netdev: add additional specific link speed mode") Cc: stable@vger.kernel.org Signed-off-by: Heiner Kallweit Reviewed-by: Andrew Lunn Acked-by: Lee Jones Link: https://lore.kernel.org/r/fb5c8294-2a10-4bf5-8f10-3d2b77d2757e@gmail.com Signed-off-by: Jakub Kicinski drivers/leds/trigger/ledtrig-netdev.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit 2d8781ba59c1b74afa93f6fdd97e6e95a77f2526 Merge: 437c99c25627 77f5032e94f2 Author: Arnd Bergmann Date: Wed Dec 6 16:25:42 2023 +0100 Merge tag 'scmi-fixes-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm SCMI fixes for v6.7 A fix for possible truncation/overflow in the frequency computations as both the performance value and the multiplier are 32bit values. * tag 'scmi-fixes-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Fix possible frequency truncation when using level indexing mode firmware: arm_scmi: Fix frequency truncation by promoting multiplier type Link: https://lore.kernel.org/r/20231204134724.30465-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 437c99c2562717b457ca44ac5df2a007664ea790 Merge: 1133ae113d6c 79997eda0d31 Author: Arnd Bergmann Date: Wed Dec 6 16:24:07 2023 +0100 Merge tag 'riscv-dt-fixes-for-v6.7-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into arm/fixes RISC-V Devicetree fixes for v6.7-rc4 Two fixes, both rather minor. The first fixes some dtbs_check warnings introduced after an update to the bindings, that returns the architecture to being clean of dtbs_check issues. The second relocates a soc-specific property to the appropriate location in $soc.dtsi, and hopefully avoids the same mistake being copy-pasted into more devicetrees. Signed-off-by: Conor Dooley * tag 'riscv-dt-fixes-for-v6.7-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: dts: microchip: move timebase-frequency to mpfs.dtsi riscv: dts: sophgo: remove address-cells from intc node Link: https://lore.kernel.org/r/20231130-maternity-majestic-dd29f0170050@spud Signed-off-by: Arnd Bergmann commit 1133ae113d6c588f02b0af584b81c1bea60de901 Merge: 9c7f01d5f438 5943b8f7449d Author: Arnd Bergmann Date: Wed Dec 6 16:23:10 2023 +0100 Merge tag 'mtk-dts64-fixes-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into arm/fixes MediaTek ARM64 DeviceTree fixes for v6.7 Fixes for various MediaTek SoCs, including MT7986: - eMMC HS400 mode failures - Cooling trips for emergency system shutdown - BPI-R3 machine SFP power limit and active cooling MT8173: - EVB device tree unit_address_vs_reg warning MT8183: - unit_address_vs_reg and simple_bus_reg warnings - Kukui device tree nodes naming consistency and adhering to bindings - Jacuzzi device tree unnecessary cells removed as those were producing avoid_unnecessary_addr_size MT8186: - Power domains faults due to incorrect clocks - GPU speed bin nvmem cell name was wrong, producing issues with interpreting the speedbin with GPU OPPs MT8195: - Local Arbiter (and whole system) ability to suspend - Cherry device tree interrupts_property warning ...and another unit_address_vs_reg warning on MT7622. * tag 'mtk-dts64-fixes-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: arm64: dts: mediatek: cherry: Fix interrupt cells for MT6360 on I2C7 arm64: dts: mediatek: mt8183-kukui-jacuzzi: fix dsi unnecessary cells properties arm64: dts: mediatek: mt7622: fix memory node warning check arm64: dts: mediatek: mt8186: fix clock names for power domains arm64: dts: mediatek: mt8186: Change gpu speedbin nvmem cell name arm64: dts: mt7986: change cooling trips arm64: dts: mt7986: define 3W max power to both SFP on BPI-R3 arm64: dts: mt7986: fix emmc hs400 mode without uboot initialization arm64: dts: mt8183: kukui: Fix underscores in node names arm64: dts: mediatek: mt8183: Move thermal-zones to the root node arm64: dts: mediatek: mt8173-evb: Fix regulator-fixed node names arm64: dts: mediatek: mt8183-evb: Fix unit_address_vs_reg warning on ntc arm64: dts: mediatek: mt8183: Fix unit address for scp reserved memory arm64: dts: mediatek: mt8195: Fix PM suspend/resume with venc clocks Link: https://lore.kernel.org/r/20231129113905.134732-1-angelogioacchino.delregno@collabora.com Signed-off-by: Arnd Bergmann commit ed5b7cfd7839f9280a63365c1133482b42d0981f Author: Lad Prabhakar Date: Thu Nov 30 21:26:47 2023 +0000 riscv: errata: andes: Probe for IOCP only once in boot stage We need to probe for IOCP only once during boot stage, as we were probing for IOCP for all the stages this caused the below issue during module-init stage, [9.019104] Unable to handle kernel paging request at virtual address ffffffff8100d3a0 [9.027153] Oops [#1] [9.029421] Modules linked in: rcar_canfd renesas_usbhs i2c_riic can_dev spi_rspi i2c_core [9.037686] CPU: 0 PID: 90 Comm: udevd Not tainted 6.7.0-rc1+ #57 [9.043756] Hardware name: Renesas SMARC EVK based on r9a07g043f01 (DT) [9.050339] epc : riscv_noncoherent_supported+0x10/0x3e [9.055558]  ra : andes_errata_patch_func+0x4a/0x52 [9.060418] epc : ffffffff8000d8c2 ra : ffffffff8000d95c sp : ffffffc8003abb00 [9.067607]  gp : ffffffff814e25a0 tp : ffffffd80361e540 t0 : 0000000000000000 [9.074795]  t1 : 000000000900031e t2 : 0000000000000001 s0 : ffffffc8003abb20 [9.081984]  s1 : ffffffff015b57c7 a0 : 0000000000000000 a1 : 0000000000000001 [9.089172]  a2 : 0000000000000000 a3 : 0000000000000000 a4 : ffffffff8100d8be [9.096360]  a5 : 0000000000000001 a6 : 0000000000000001 a7 : 000000000900031e [9.103548]  s2 : ffffffff015b57d7 s3 : 0000000000000001 s4 : 000000000000031e [9.110736]  s5 : 8000000000008a45 s6 : 0000000000000500 s7 : 000000000000003f [9.117924]  s8 : ffffffc8003abd48 s9 : ffffffff015b1140 s10: ffffffff8151a1b0 [9.125113]  s11: ffffffff015b1000 t3 : 0000000000000001 t4 : fefefefefefefeff [9.132301]  t5 : ffffffff015b57c7 t6 : ffffffd8b63a6000 [9.137587] status: 0000000200000120 badaddr: ffffffff8100d3a0 cause: 000000000000000f [9.145468] [] riscv_noncoherent_supported+0x10/0x3e [9.151972] [] _apply_alternatives+0x84/0x86 [9.157784] [] apply_module_alternatives+0x10/0x1a [9.164113] [] module_finalize+0x5e/0x7a [9.169583] [] load_module+0xfd8/0x179c [9.174965] [] init_module_from_file+0x76/0xaa [9.180948] [] __riscv_sys_finit_module+0x176/0x2a8 [9.187365] [] do_trap_ecall_u+0xbe/0x130 [9.192922] [] ret_from_exception+0x0/0x64 [9.198573] Code: 0009 b7e9 6797 014d a783 85a7 c799 4785 0717 0100 (0123) aef7 [9.205994] ---[ end trace 0000000000000000 ]--- This is because we called riscv_noncoherent_supported() for all the stages during IOCP probe. riscv_noncoherent_supported() function sets noncoherent_supported variable to true which has an annotation set to "__ro_after_init" due to which we were seeing the above splat. Fix this by probing for IOCP only once in boot stage by having a boolean variable "done" which will be set to true upon IOCP probe in errata_probe_iocp() and we bail out early if "done" is set to true. While at it make return type of errata_probe_iocp() to void as we were not checking the return value in andes_errata_patch_func(). Fixes: e021ae7f5145 ("riscv: errata: Add Andes alternative ports") Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Reviewed-by: Yu Chien Peter Lin Link: https://lore.kernel.org/r/20231130212647.108746-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Palmer Dabbelt arch/riscv/errata/andes/errata.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) commit 9c7f01d5f438a3b3e3dc551df560ae420b4b741c Merge: 2cc14f52aeb7 7269cba53d90 Author: Arnd Bergmann Date: Wed Dec 6 16:15:25 2023 +0100 Merge tag 'optee-supplicant-fix-for-v6.7' of git://git.linaro.org:/people/jens.wiklander/linux-tee into arm/fixes OP-TEE fix for supplicant based device enumeration Adds a sysfs attribute for devices depending on supplicant services so that the user-space service can detect and detach those devices before closing the supplicant * tag 'optee-supplicant-fix-for-v6.7' of git://git.linaro.org:/people/jens.wiklander/linux-tee: tee: optee: Fix supplicant based device enumeration Link: https://lore.kernel.org/r/20231114153113.GA1310615@rayden Signed-off-by: Arnd Bergmann commit f40cab8e18ed57d2c7b5213437d83d955f78097f Author: Samuel Holland Date: Tue Nov 21 13:19:29 2023 -0800 riscv: Fix SMP when shadow call stacks are enabled This fixes two bugs in SCS initialization for secondary CPUs. First, the SCS was not initialized at all in the spinwait boot path. Second, the code for the SBI HSM path attempted to initialize the SCS before enabling the MMU. However, that involves dereferencing the thread pointer, which requires the MMU to be enabled. Fix both issues by setting up the SCS in the common secondary entry path, after enabling the MMU. Fixes: d1584d791a29 ("riscv: Implement Shadow Call Stack") Signed-off-by: Samuel Holland Reviewed-by: Sami Tolvanen Link: https://lore.kernel.org/r/20231121211958.3158576-1-samuel.holland@sifive.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/head.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9085b23b668ad5aca62df4f071b306a47152e6b3 Author: Bjorn Andersson Date: Tue Dec 5 14:14:00 2023 -0800 interconnect: qcom: icc-rpm: Fix peak rate calculation Per the commit message of commit 'dd014803f260 ("interconnect: qcom: icc-rpm: Add AB/IB calculations coefficients")', the peak rate should be 100/ib_percent. But, in what looks like a typical typo, the numerator value is discarded in the calculation. Update the implementation to match the described intention. Fixes: dd014803f260 ("interconnect: qcom: icc-rpm: Add AB/IB calculations coefficients") Cc: stable@vger.kernel.org Signed-off-by: Bjorn Andersson Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20231205-qcom_icc_calc_rate-typo-v1-1-9d4378dcf53e@quicinc.com Signed-off-by: Georgi Djakov drivers/interconnect/qcom/icc-rpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 96ba4a47d147cf8c4b764ec3a66a088a5bb3033a Author: Rob Herring Date: Wed Nov 22 15:44:14 2023 -0700 dt-bindings: perf: riscv,pmu: drop unneeded quotes Drop unneeded quotes over simple string values to fix a soon to be enabled yamllint warning: [error] string value is redundantly quoted with any quotes (quoted-strings) Signed-off-by: Rob Herring Reviewed-by: Krzysztof Kozlowski Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20231122224414.2809184-1-robh@kernel.org Signed-off-by: Palmer Dabbelt Documentation/devicetree/bindings/perf/riscv,pmu.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 33038efb64f7576bac635164021f5c984d4c755f Author: Tim Bosse Date: Wed Dec 6 09:26:29 2023 -0500 ALSA: hda/realtek: add new Framework laptop to quirks The Framework Laptop 13 (AMD Ryzen 7040Series) has an ALC295 with a disconnected or faulty headset mic presence detect similar to the previous models. It works with the same quirk chain as 309d7363ca3d9fcdb92ff2d958be14d7e8707f68. This model has a VID:PID of f111:0006. Signed-off-by: Tim Bosse Cc: Link: https://lore.kernel.org/r/20231206142629.388615-1-flinn@timbos.se Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 22e0eb04837a63af111fae35a92f7577676b9bc8 Author: Clément Léger Date: Fri Nov 3 10:02:23 2023 +0100 riscv: fix misaligned access handling of C.SWSP and C.SDSP This is a backport of a fix that was done in OpenSBI: ec0559eb315b ("lib: sbi_misaligned_ldst: Fix handling of C.SWSP and C.SDSP"). Unlike C.LWSP/C.LDSP, these encodings can be used with the zero register, so checking that the rs2 field is non-zero is unnecessary. Additionally, the previous check was incorrect since it was checking the immediate field of the instruction instead of the rs2 field. Fixes: 956d705dd279 ("riscv: Unaligned load/store handling for M_MODE") Signed-off-by: Clément Léger Link: https://lore.kernel.org/r/20231103090223.702340-1-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/traps_misaligned.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit fbbc69d2bba592fb6a84c2253a693dffcf7f9062 Merge: 2b3a7a302c98 0a10d15280a3 Author: Takashi Iwai Date: Wed Dec 6 14:56:00 2023 +0100 Merge tag 'asoc-fix-v6.7-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.7 A crop of fixes for v6.7, one core fix for a merge issue and a bunch of driver specific fixes and new IDs, mostly for x86 platforms. commit c0a2755aced969e0125fd68ccd95269b28d8913a Author: Konrad Dybcio Date: Wed Nov 29 20:12:31 2023 +0100 dt-bindings: interrupt-controller: Allow #power-domain-cells MPM provides a single genpd. Allow #power-domain-cells = <0>. Fixes: 54fc9851c0e0 ("dt-bindings: interrupt-controller: Add Qualcomm MPM support") Acked-by: Shawn Guo Acked-by: Krzysztof Kozlowski Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20231129-topic-mpmbindingspd-v2-1-acbe909ceee1@linaro.org Signed-off-by: Rob Herring Documentation/devicetree/bindings/interrupt-controller/qcom,mpm.yaml | 4 ++++ 1 file changed, 4 insertions(+) commit 777c0d761be7d981a2ae5494dfbc636311908dfb Author: Andrew Jones Date: Wed Nov 1 15:19:09 2023 +0100 RISC-V: hwprobe: Always use u64 for extension bits Extensions are getting added quickly and their hwprobe bits will soon exceed 31 (which pair values accommodate, since they're of type u64). However, in one tree, where a bunch of extensions got merged prior to zicboz, zicboz already got pushed to bit 32. Pushing it exposed a 32-bit compilation bug, since unsigned long was used instead of u64. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202310311801.hxduISrr-lkp@intel.com/ Fixes: 9c7646d5ffd2 ("RISC-V: hwprobe: Expose Zicboz extension and its block size") Signed-off-by: Andrew Jones Link: https://lore.kernel.org/r/20231101141908.192198-2-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/sys_riscv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2078a341f5f609d55667c2dc6337f90d8f322b8f Merge: 3142dbf084cb 7336fc196748 Author: Paolo Abeni Date: Wed Dec 6 13:44:40 2023 +0100 Merge branch 'octeontx2-af-miscellaneous-fixes' Geetha sowjanya says: ==================== octeontx2-af: miscellaneous fixes The series of patches fixes various issues related to mcs and NIX link registers. v3-v4: Used FIELD_PREP macro and proper data types. v2-v3: Fixed typo error in patch 4 commit message. v1-v2: Fixed author name for patch 5. Added Reviewed-by. ==================== Link: https://lore.kernel.org/r/20231205080434.27604-1-gakula@marvell.com Signed-off-by: Paolo Abeni commit 7336fc196748f82646b630d5a2e9d283e200b988 Author: Rahul Bhansali Date: Tue Dec 5 13:34:34 2023 +0530 octeontx2-af: Update Tx link register range On new silicons the TX channels for transmit level has increased. This patch fixes the respective register offset range to configure the newly added channels. Fixes: b279bbb3314e ("octeontx2-af: NIX Tx scheduler queue config support") Signed-off-by: Rahul Bhansali Signed-off-by: Geetha sowjanya Reviewed-by: Wojciech Drewek Signed-off-by: Paolo Abeni drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d431abd0a9aa27be379fb5f8304062071b0f5a7e Author: Geetha sowjanya Date: Tue Dec 5 13:34:33 2023 +0530 octeontx2-af: Add missing mcs flr handler call If mcs resources are attached to PF/VF. These resources need to be freed on FLR. This patch add missing mcs flr call on PF FLR. Fixes: bd69476e86fc ("octeontx2-af: cn10k: mcs: Install a default TCAM for normal traffic") Signed-off-by: Geetha sowjanya Reviewed-by: Wojciech Drewek Signed-off-by: Paolo Abeni drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 3 +++ 1 file changed, 3 insertions(+) commit 3ba98a8c6f8ceb4e01a78f973d8d9017020bbd57 Author: Geetha sowjanya Date: Tue Dec 5 13:34:32 2023 +0530 octeontx2-af: Fix mcs stats register address This patch adds the miss mcs stats register for mcs supported platforms. Fixes: 9312150af8da ("octeontx2-af: cn10k: mcs: Support for stats collection") Signed-off-by: Geetha sowjanya Reviewed-by: Wojciech Drewek Signed-off-by: Paolo Abeni drivers/net/ethernet/marvell/octeontx2/af/mcs.c | 4 +-- .../net/ethernet/marvell/octeontx2/af/mcs_reg.h | 31 +++++++++++++++++++--- 2 files changed, 29 insertions(+), 6 deletions(-) commit 9723b2cca1f0e980c53156b52ea73b93966b3c8a Author: Geetha sowjanya Date: Tue Dec 5 13:34:31 2023 +0530 octeontx2-af: Fix mcs sa cam entries size On latest silicon versions SA cam entries increased to 256. This patch fixes the datatype of sa_entries in mcs_hw_info struct to u16 to hold 256 entries. Fixes: 080bbd19c9dd ("octeontx2-af: cn10k: mcs: Add mailboxes for port related operations") Signed-off-by: Geetha sowjanya Reviewed-by: Wojciech Drewek Signed-off-by: Paolo Abeni drivers/net/ethernet/marvell/octeontx2/af/mbox.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit dca6fa8644b89f54345e55501b1419316ba5cb29 Author: Nithin Dabilpuram Date: Tue Dec 5 13:34:30 2023 +0530 octeontx2-af: Adjust Tx credits when MCS external bypass is disabled When MCS external bypass is disabled, MCS returns additional 2 credits(32B) for every packet Tx'ed on LMAC. To account for these extra credits, NIX_AF_TX_LINKX_NORM_CREDIT.CC_MCS_CNT needs to be configured as otherwise NIX Tx credits would overflow and will never be returned to idle state credit count causing issues with credit control and MTU change. This patch fixes the same by configuring CC_MCS_CNT at probe time for MCS enabled SoC's Fixes: bd69476e86fc ("octeontx2-af: cn10k: mcs: Install a default TCAM for normal traffic") Signed-off-by: Nithin Dabilpuram Signed-off-by: Geetha sowjanya Signed-off-by: Sunil Goutham Reviewed-by: Wojciech Drewek Signed-off-by: Paolo Abeni drivers/net/ethernet/marvell/octeontx2/af/mcs.c | 14 +++++++++++++- drivers/net/ethernet/marvell/octeontx2/af/mcs.h | 2 ++ drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 8 ++++++++ drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h | 1 + 5 files changed, 25 insertions(+), 1 deletion(-) commit 82180b1fae2432ee88b4a54cc6c376ba01e57b22 Author: Charlie Jenkins Date: Wed Nov 22 15:35:54 2023 -0800 Support rv32 ULEB128 test Use opcodes available to both rv32 and rv64 in uleb128 module linking test. Fixes: af71bc194916 ("riscv: Add tests for riscv module loading") Signed-off-by: Charlie Jenkins Reported-by: Randy Dunlap Closes: https://lore.kernel.org/lkml/1d7c71ee-5742-4df4-b8ef-a2aea0a624eb@infradead.org/ Tested-by: Randy Dunlap # build-tested Link: https://lore.kernel.org/r/20231122-module_fixup-v2-1-dfb9565e9ea5@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/tests/module_test/test_uleb128.S | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 3142dbf084cb66080b111673148192906a4c037c Merge: 6b07b5225d87 9396c4ee93f9 Author: Paolo Abeni Date: Wed Dec 6 12:36:59 2023 +0100 Merge branch 'tcp-ao-fixes' Dmitry Safonov says: ==================== TCP-AO fixes Changes from v4: - Dropped 2 patches on which there's no consensus. They will require more work TBD if they may made acceptable. Those are: o "net/tcp: Allow removing current/rnext TCP-AO keys on TCP_LISTEN sockets" o "net/tcp: Store SNEs + SEQs on ao_info" Changes from v3: - Don't restrict adding any keys on TCP-AO connection in VRF, but only the ones that don't match l3index (David) Changes from v2: - rwlocks are problematic in net code (Paolo) Changed the SNE code to avoid spin/rw locks on RX/TX fastpath by double-accounting SEQ numbers for TCP-AO enabled connections. Changes from v1: - Use tcp_can_repair_sock() helper to limit TCP_AO_REPAIR (Eric) - Instead of hook to listen() syscall, allow removing current/rnext keys on TCP_LISTEN (addressing Eric's objection) - Add sne_lock to protect snd_sne/rcv_sne - Don't move used_tcp_ao in struct tcp_request_sock (Eric) I've been working on TCP-AO key-rotation selftests and as a result exercised some corner-cases that are not usually met in production. Here are a bunch of semi-related fixes: - Documentation typo (reported by Markus Elfring) - Proper alignment for TCP-AO option in TCP header that has MAC length of non 4 bytes (now a selftest with randomized maclen/algorithm/etc passes) - 3 uAPI restricting patches that disallow more things to userspace in order to prevent it shooting itself in any parts of the body - SNEs READ_ONCE()/WRITE_ONCE() that went missing by my human factor - Avoid storing MAC length from SYN header as SYN-ACK will use rnext_key.maclen (drops an extra check that fails on new selftests) ==================== Link: https://lore.kernel.org/r/ Signed-off-by: Paolo Abeni commit 9396c4ee93f9ac03cd0cea0bb345fbc657772943 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Dec 4 19:00:44 2023 +0000 net/tcp: Don't store TCP-AO maclen on reqsk This extra check doesn't work for a handshake when SYN segment has (current_key.maclen != rnext_key.maclen). It could be amended to preserve rnext_key.maclen instead of current_key.maclen, but that requires a lookup on listen socket. Originally, this extra maclen check was introduced just because it was cheap. Drop it and convert tcp_request_sock::maclen into boolean tcp_request_sock::used_tcp_ao. Fixes: 06b22ef29591 ("net/tcp: Wire TCP-AO to request sockets") Signed-off-by: Dmitry Safonov Reviewed-by: Eric Dumazet Signed-off-by: Paolo Abeni include/linux/tcp.h | 8 ++------ net/ipv4/tcp_ao.c | 4 ++-- net/ipv4/tcp_input.c | 5 +++-- net/ipv4/tcp_output.c | 9 +++------ 4 files changed, 10 insertions(+), 16 deletions(-) commit 12083d728213285c2d4347fa0ed3b556449703ce Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Dec 4 19:00:43 2023 +0000 net/tcp: Don't add key with non-matching VRF on connected sockets If the connection was established, don't allow adding TCP-AO keys that don't match the peer. Currently, there are checks for ip-address matching, but L3 index check is missing. Add it to restrict userspace shooting itself somewhere. Yet, nothing restricts the CAP_NET_RAW user from trying to shoot themselves by performing setsockopt(SO_BINDTODEVICE) or setsockopt(SO_BINDTOIFINDEX) over an established TCP-AO connection. So, this is just "minimum effort" to potentially save someone's debugging time, rather than a full restriction on doing weird things. Fixes: 248411b8cb89 ("net/tcp: Wire up l3index to TCP-AO") Signed-off-by: Dmitry Safonov Reviewed-by: Eric Dumazet Signed-off-by: Paolo Abeni net/ipv4/tcp_ao.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 965c00e4ea2e4df986ecd73c2fe9d3a00a2858db Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Dec 4 19:00:42 2023 +0000 net/tcp: Limit TCP_AO_REPAIR to non-listen sockets Listen socket is not an established TCP connection, so setsockopt(TCP_AO_REPAIR) doesn't have any impact. Restrict this uAPI for listen sockets. Fixes: faadfaba5e01 ("net/tcp: Add TCP_AO_REPAIR") Signed-off-by: Dmitry Safonov Reviewed-by: Eric Dumazet Signed-off-by: Paolo Abeni net/ipv4/tcp.c | 6 ++++++ 1 file changed, 6 insertions(+) commit da7dfaa6d6f731c30eca6ffa808b83634d43e26f Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Dec 4 19:00:41 2023 +0000 net/tcp: Consistently align TCP-AO option in the header Currently functions that pre-calculate TCP header options length use unaligned TCP-AO header + MAC-length for skb reservation. And the functions that actually write TCP-AO options into skb do align the header. Nothing good can come out of this for ((maclen % 4) != 0). Provide tcp_ao_len_aligned() helper and use it everywhere for TCP header options space calculations. Fixes: 1e03d32bea8e ("net/tcp: Add TCP-AO sign to outgoing packets") Signed-off-by: Dmitry Safonov Reviewed-by: Eric Dumazet Signed-off-by: Paolo Abeni include/net/tcp_ao.h | 6 ++++++ net/ipv4/tcp_ao.c | 4 ++-- net/ipv4/tcp_ipv4.c | 4 ++-- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 6 +++--- net/ipv6/tcp_ipv6.c | 2 +- 6 files changed, 15 insertions(+), 9 deletions(-) commit 714589c2742209cc228991b115e48548fb8d89cf Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Dec 4 19:00:40 2023 +0000 Documentation/tcp: Fix an obvious typo Yep, my VIM spellchecker is not good enough for typos like this one. Fixes: 7fe0e38bb669 ("Documentation/tcp: Add TCP-AO documentation") Cc: Jonathan Corbet Cc: linux-doc@vger.kernel.org Reported-by: Markus Elfring Closes: https://lore.kernel.org/all/2745ab4e-acac-40d4-83bf-37f2600d0c3d@web.de/ Signed-off-by: Dmitry Safonov Signed-off-by: Paolo Abeni Documentation/networking/tcp_ao.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6b07b5225d87f1ff212be9f95d527a3bb6b99adb Merge: cbe860be3609 f708aba40f9c Author: Paolo Abeni Date: Wed Dec 6 12:19:10 2023 +0100 Merge branch 'there-are-some-bugfix-for-the-hns-ethernet-driver' Jijie Shao says: ==================== There are some bugfix for the HNS ethernet driver There are some bugfix for the HNS ethernet driver --- changeLog: v2 -> v3: - Refine the commit msg as Wojciech suggestions - Reconstruct the "hns_mac_link_anti_shake" function suggested by Wojciech v2: https://lore.kernel.org/all/20231204011051.4055031-1-shaojijie@huawei.com/ v1 -> v2: - Fixed the internal function is not decorated with static issue, suggested by Jakub v1: https://lore.kernel.org/all/20231201102703.4134592-1-shaojijie@huawei.com/ --- ==================== Link: https://lore.kernel.org/r/20231204143232.3221542-1-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit f708aba40f9c1eeb9c7e93ed4863b5f85b09b288 Author: Yonglong Liu Date: Mon Dec 4 22:32:32 2023 +0800 net: hns: fix fake link up on xge port If a xge port just connect with an optical module and no fiber, it may have a fake link up because there may be interference on the hardware. This patch adds an anti-shake to avoid the problem. And the time of anti-shake is base on tests. Fixes: b917078c1c10 ("net: hns: Add ACPI support to check SFP present") Signed-off-by: Yonglong Liu Signed-off-by: Jijie Shao Reviewed-by: Wojciech Drewek Signed-off-by: Paolo Abeni drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 29 +++++++++++++++++++++++ 1 file changed, 29 insertions(+) commit 84757d0839451b20b11e993128f0a77393ca50c1 Author: Yonglong Liu Date: Mon Dec 4 22:32:31 2023 +0800 net: hns: fix wrong head when modify the tx feature when sending packets Upon changing the tx feature, the hns driver will modify the maybe_stop_tx() and fill_desc() functions, if the modify happens during packet sending, will cause the hardware and software pointers do not match, and the port can not work anymore. This patch deletes the maybe_stop_tx() and fill_desc() functions modification when setting tx feature, and use the skb_is_gro() to determine which functions to use in the tx path. Fixes: 38f616da1c28 ("net:hns: Add support of ethtool TSO set option for Hip06 in HNS") Signed-off-by: Yonglong Liu Signed-off-by: Jijie Shao Reviewed-by: Wojciech Drewek Signed-off-by: Paolo Abeni drivers/net/ethernet/hisilicon/hns/hns_enet.c | 53 ++++++++++++++++----------- drivers/net/ethernet/hisilicon/hns/hns_enet.h | 3 +- 2 files changed, 33 insertions(+), 23 deletions(-) commit cbe860be36095e68e4e5561ab43610982fb429fd Author: Daniil Maximov Date: Mon Dec 4 11:58:10 2023 +0300 net: atlantic: Fix NULL dereference of skb pointer in If is_ptp_ring == true in the loop of __aq_ring_xdp_clean function, then a timestamp is stored from a packet in a field of skb object, which is not allocated at the moment of the call (skb == NULL). Generalize aq_ptp_extract_ts and other affected functions so they don't work with struct sk_buff*, but with struct skb_shared_hwtstamps*. Found by Linux Verification Center (linuxtesting.org) with SVACE Fixes: 26efaef759a1 ("net: atlantic: Implement xdp data plane") Signed-off-by: Daniil Maximov Reviewed-by: Igor Russkikh Link: https://lore.kernel.org/r/20231204085810.1681386-1-daniil31415it@gmail.com Signed-off-by: Paolo Abeni drivers/net/ethernet/aquantia/atlantic/aq_ptp.c | 10 +++++----- drivers/net/ethernet/aquantia/atlantic/aq_ptp.h | 4 ++-- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 18 ++++++++++++------ 3 files changed, 19 insertions(+), 13 deletions(-) commit 5c47251e8c4903111608ddcba2a77c0c425c247c Author: Herve Codina Date: Tue Nov 14 16:26:55 2023 +0100 lib/vsprintf: Fix %pfwf when current node refcount == 0 A refcount issue can appeared in __fwnode_link_del() due to the pr_debug() call: WARNING: CPU: 0 PID: 901 at lib/refcount.c:25 refcount_warn_saturate+0xe5/0x110 Call Trace: ... of_node_get+0x1e/0x30 of_fwnode_get+0x28/0x40 fwnode_full_name_string+0x34/0x90 fwnode_string+0xdb/0x140 ... vsnprintf+0x17b/0x630 ... __fwnode_link_del+0x25/0xa0 fwnode_links_purge+0x39/0xb0 of_node_release+0xd9/0x180 ... Indeed, an fwnode (of_node) is being destroyed and so, of_node_release() is called because the of_node refcount reached 0. From of_node_release() several function calls are done and lead to a pr_debug() calls with %pfwf to print the fwnode full name. The issue is not present if we change %pfwf to %pfwP. To print the full name, %pfwf iterates over the current node and its parents and obtain/drop a reference to all nodes involved. In order to allow to print the full name (%pfwf) of a node while it is being destroyed, do not obtain/drop a reference to this current node. Fixes: a92eb7621b9f ("lib/vsprintf: Make use of fwnode API to obtain node names and separators") Cc: stable@vger.kernel.org Signed-off-by: Herve Codina Reviewed-by: Sakari Ailus Reviewed-by: Andy Shevchenko Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20231114152655.409331-1-herve.codina@bootlin.com lib/vsprintf.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit e0f04e41e8eedd4e5a1275f2318df7e1841855f2 Author: Thomas Zimmermann Date: Mon Dec 4 09:32:33 2023 +0100 drm/atomic-helpers: Invoke end_fb_access while owning plane state Invoke drm_plane_helper_funcs.end_fb_access before drm_atomic_helper_commit_hw_done(). The latter function hands over ownership of the plane state to the following commit, which might free it. Releasing resources in end_fb_access then operates on undefined state. This bug has been observed with non-blocking commits when they are being queued up quickly. Here is an example stack trace from the bug report. The plane state has been free'd already, so the pages for drm_gem_fb_vunmap() are gone. Unable to handle kernel paging request at virtual address 0000000100000049 [...] drm_gem_fb_vunmap+0x18/0x74 drm_gem_end_shadow_fb_access+0x1c/0x2c drm_atomic_helper_cleanup_planes+0x58/0xd8 drm_atomic_helper_commit_tail+0x90/0xa0 commit_tail+0x15c/0x188 commit_work+0x14/0x20 Fix this by running end_fb_access immediately after updating all planes in drm_atomic_helper_commit_planes(). The existing clean-up helper drm_atomic_helper_cleanup_planes() now only handles cleanup_fb. For aborted commits, roll back from drm_atomic_helper_prepare_planes() in the new helper drm_atomic_helper_unprepare_planes(). This case is different from regular cleanup, as we have to release the new state; regular cleanup releases the old state. The new helper also invokes cleanup_fb for all planes. The changes mostly involve DRM's atomic helpers. Only two drivers, i915 and nouveau, implement their own commit function. Update them to invoke drm_atomic_helper_unprepare_planes(). Drivers with custom commit_tail function do not require changes. v4: * fix documentation (kernel test robot) v3: * add drm_atomic_helper_unprepare_planes() for rolling back * use correct state for end_fb_access v2: * fix test in drm_atomic_helper_cleanup_planes() Reported-by: Alyssa Ross Closes: https://lore.kernel.org/dri-devel/87leazm0ya.fsf@alyssa.is/ Suggested-by: Daniel Vetter Fixes: 94d879eaf7fb ("drm/atomic-helper: Add {begin,end}_fb_access to plane helpers") Tested-by: Alyssa Ross Reviewed-by: Alyssa Ross Signed-off-by: Thomas Zimmermann Cc: # v6.2+ Link: https://patchwork.freedesktop.org/patch/msgid/20231204083247.22006-1-tzimmermann@suse.de drivers/gpu/drm/drm_atomic_helper.c | 78 ++++++++++++++++++---------- drivers/gpu/drm/i915/display/intel_display.c | 2 +- drivers/gpu/drm/nouveau/dispnv50/disp.c | 2 +- include/drm/drm_atomic_helper.h | 2 + 4 files changed, 56 insertions(+), 28 deletions(-) commit 7037d95a047cd89b1f680eed253c6ab586bef1ed Author: Kelly Kane Date: Sat Dec 2 17:17:12 2023 -0800 r8152: add vendor/device ID pair for ASUS USB-C2500 The ASUS USB-C2500 is an RTL8156 based 2.5G Ethernet controller. Add the vendor and product ID values to the driver. This makes Ethernet work with the adapter. Signed-off-by: Kelly Kane Link: https://lore.kernel.org/r/20231203011712.6314-1-kelly@hawknetworks.com Signed-off-by: Paolo Abeni drivers/net/usb/r8152.c | 1 + include/linux/usb/r8152.h | 1 + 2 files changed, 2 insertions(+) commit 37f3d6108730713c411827ab4af764909f4dfc78 Author: Sam Edwards Date: Tue Dec 5 12:29:00 2023 -0800 arm64: dts: rockchip: Fix eMMC Data Strobe PD on rk3588 JEDEC standard JESD84-B51 defines the eMMC Data Strobe line, which is currently used only in HS400 mode, as a device->host clock signal that "is used only in read operation. The Data Strobe is always High-Z (not driven by the device and pulled down by RDS) or Driven Low in write operation, except during CRC status response." RDS is a pull-down resistor specified in the 10K-100K ohm range. Thus per the standard, the Data Strobe is always pulled to ground (by the eMMC and/or RDS) during write operations. Evidently, the eMMC host controller in the RK3588 considers an active voltage on the eMMC-DS line during a write to be an error. The default (i.e. hardware reset, and Rockchip BSP) behavior for the RK3588 is to activate the eMMC-DS pin's builtin pull-down. As a result, many RK3588 board designers do not bother adding a dedicated RDS resistor, instead relying on the RK3588's internal bias. The current devicetree, however, disables this bias (`pcfg_pull_none`), breaking HS400-mode writes for boards without a dedicated RDS, but with an eMMC chip that chooses to High-Z (instead of drive-low) the eMMC-DS line. (The Turing RK1 is one such board.) Fix this by changing the bias in the (common) emmc_data_strobe case to reflect the expected hardware/BSP behavior. This is unlikely to cause regressions elsewhere: the pull-down is only relevant for High-Z eMMCs, and if this is redundant with a (dedicated) RDS resistor, the effective result is only a lower resistance to ground -- where the range of tolerance is quite high. If it does, it's better fixed in the specific devicetrees. Fixes: d85f8a5c798d5 ("arm64: dts: rockchip: Add rk3588 pinctrl data") Signed-off-by: Sam Edwards Link: https://lore.kernel.org/r/20231205202900.4617-2-CFSworks@gmail.com Signed-off-by: Heiko Stuebner arch/arm64/boot/dts/rockchip/rk3588s-pinctrl.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 63ef8fc9bcee6b73ca445a19a7ac6bd544723c9f Author: Fabio Estevam Date: Tue Dec 5 10:27:35 2023 -0300 ARM: dts: imx28-xea: Pass the 'model' property Per root-node.yaml, 'model' is a required property. Pass it to fix the following dt-schema warning: imx28-xea.dtb: /: 'model' is a required property from schema $id: http://devicetree.org/schemas/root-node.yaml# Signed-off-by: Fabio Estevam Fixes: 445ae16ac1c5 ("ARM: dts: imx28: Add DTS description of imx28 based XEA board") Signed-off-by: Shawn Guo arch/arm/boot/dts/nxp/mxs/imx28-xea.dts | 1 + 1 file changed, 1 insertion(+) commit 80d875cfc9d3711a029f234ef7d680db79e8fa4b Author: Shigeru Yoshida Date: Sun Dec 3 01:14:41 2023 +0900 ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit() In ipgre_xmit(), skb_pull() may fail even if pskb_inet_may_pull() returns true. For example, applications can use PF_PACKET to create a malformed packet with no IP header. This type of packet causes a problem such as uninit-value access. This patch ensures that skb_pull() can pull the required size by checking the skb with pskb_network_may_pull() before skb_pull(). Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.") Signed-off-by: Shigeru Yoshida Reviewed-by: Eric Dumazet Reviewed-by: Suman Ghosh Link: https://lore.kernel.org/r/20231202161441.221135-1-syoshida@redhat.com Signed-off-by: Paolo Abeni net/ipv4/ip_gre.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit 2b3a7a302c9804e463f2ea5b54dc3a6ad106a344 Author: Jason Zhang Date: Wed Dec 6 09:31:39 2023 +0800 ALSA: pcm: fix out-of-bounds in snd_pcm_state_names The pcm state can be SNDRV_PCM_STATE_DISCONNECTED at disconnect callback, and there is not an entry of SNDRV_PCM_STATE_DISCONNECTED in snd_pcm_state_names. This patch adds the missing entry to resolve this issue. cat /proc/asound/card2/pcm0p/sub0/status That results in stack traces like the following: [ 99.702732][ T5171] Unexpected kernel BRK exception at EL1 [ 99.702774][ T5171] Internal error: BRK handler: f2005512 [#1] PREEMPT SMP [ 99.703858][ T5171] Modules linked in: bcmdhd(E) (...) [ 99.747425][ T5171] CPU: 3 PID: 5171 Comm: cat Tainted: G C OE 5.10.189-android13-4-00003-g4a17384380d8-ab11086999 #1 [ 99.748447][ T5171] Hardware name: Rockchip RK3588 CVTE V10 Board (DT) [ 99.749024][ T5171] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) [ 99.749616][ T5171] pc : snd_pcm_substream_proc_status_read+0x264/0x2bc [ 99.750204][ T5171] lr : snd_pcm_substream_proc_status_read+0xa4/0x2bc [ 99.750778][ T5171] sp : ffffffc0175abae0 [ 99.751132][ T5171] x29: ffffffc0175abb80 x28: ffffffc009a2c498 [ 99.751665][ T5171] x27: 0000000000000001 x26: ffffff810cbae6e8 [ 99.752199][ T5171] x25: 0000000000400cc0 x24: ffffffc0175abc60 [ 99.752729][ T5171] x23: 0000000000000000 x22: ffffff802f558400 [ 99.753263][ T5171] x21: ffffff81d8d8ff00 x20: ffffff81020cdc00 [ 99.753795][ T5171] x19: ffffff802d110000 x18: ffffffc014fbd058 [ 99.754326][ T5171] x17: 0000000000000000 x16: 0000000000000000 [ 99.754861][ T5171] x15: 000000000000c276 x14: ffffffff9a976fda [ 99.755392][ T5171] x13: 0000000065689089 x12: 000000000000d72e [ 99.755923][ T5171] x11: ffffff802d110000 x10: 00000000000000e0 [ 99.756457][ T5171] x9 : 9c431600c8385d00 x8 : 0000000000000008 [ 99.756990][ T5171] x7 : 0000000000000000 x6 : 000000000000003f [ 99.757522][ T5171] x5 : 0000000000000040 x4 : ffffffc0175abb70 [ 99.758056][ T5171] x3 : 0000000000000001 x2 : 0000000000000001 [ 99.758588][ T5171] x1 : 0000000000000000 x0 : 0000000000000000 [ 99.759123][ T5171] Call trace: [ 99.759404][ T5171] snd_pcm_substream_proc_status_read+0x264/0x2bc [ 99.759958][ T5171] snd_info_seq_show+0x54/0xa4 [ 99.760370][ T5171] seq_read_iter+0x19c/0x7d4 [ 99.760770][ T5171] seq_read+0xf0/0x128 [ 99.761117][ T5171] proc_reg_read+0x100/0x1f8 [ 99.761515][ T5171] vfs_read+0xf4/0x354 [ 99.761869][ T5171] ksys_read+0x7c/0x148 [ 99.762226][ T5171] __arm64_sys_read+0x20/0x30 [ 99.762625][ T5171] el0_svc_common+0xd0/0x1e4 [ 99.763023][ T5171] el0_svc+0x28/0x98 [ 99.763358][ T5171] el0_sync_handler+0x8c/0xf0 [ 99.763759][ T5171] el0_sync+0x1b8/0x1c0 [ 99.764118][ T5171] Code: d65f03c0 b9406102 17ffffae 94191565 (d42aa240) [ 99.764715][ T5171] ---[ end trace 1eeffa3e17c58e10 ]--- [ 99.780720][ T5171] Kernel panic - not syncing: BRK handler: Fatal exception Signed-off-by: Jason Zhang Cc: Link: https://lore.kernel.org/r/20231206013139.20506-1-jason.zhang@rock-chips.com Signed-off-by: Takashi Iwai sound/core/pcm.c | 1 + 1 file changed, 1 insertion(+) commit 397caf68e2d36532054cb14ae8995537f27f8b61 Author: Philipp Zabel Date: Mon Nov 27 17:05:01 2023 +0100 ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt The timer nodes declare compatibility with "fsl,imx6sx-gpt", which itself is compatible with "fsl,imx6dl-gpt". Switch the fallback compatible from "fsl,imx6sx-gpt" to "fsl,imx6dl-gpt". Fixes: 949673450291 ("ARM: dts: add imx7d soc dtsi file") Signed-off-by: Philipp Zabel Signed-off-by: Roland Hieber Signed-off-by: Shawn Guo arch/arm/boot/dts/nxp/imx/imx7s.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 15a1c7f3e8d9c16e65644b83ad96895164fb2988 Author: Ahmad Fatoum Date: Mon Nov 27 06:34:14 2023 +0100 MAINTAINERS: reinstate freescale ARM64 DT directory in i.MX entry The MAINTAINERS entry's F: currently only matches the 32-bit device trees, as commit 724ba6751532 ("ARM: dts: Move .dts files to vendor sub-directories") inadvertently dropped the 64-bit DT match when it added the 32 bit matches. The entry has a N: imx, which reduced the impact a bit, but still some board device trees may not contain the substring and would thus not be covered by the entry. Reinstate the missing F: line to restore previous behavior. Fixes: 724ba6751532 ("ARM: dts: Move .dts files to vendor sub-directories") Signed-off-by: Ahmad Fatoum Signed-off-by: Shawn Guo MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit 04179605ab604dba32571a05cd06423afc9eca19 Author: Stefan Eichenberger Date: Thu Nov 23 11:48:12 2023 +0100 arm64: dts: imx8-apalis: set wifi regulator to always-on Make sure that the wifi regulator is always on. The wifi driver itself puts the wifi module into suspend mode. If we cut the power the driver will crash when resuming from suspend. Signed-off-by: Stefan Eichenberger Signed-off-by: Francesco Dolcini Fixes: ad0de4ceb706 ("arm64: dts: freescale: add initial apalis imx8 aka quadmax module support") Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx8-apalis-v1.1.dtsi | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 1c2b1049af3f86545fcc5fae0fc725fb64b3a09e Author: Kunwu Chan Date: Wed Nov 22 14:46:36 2023 +0800 ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Release the id allocated in 'mmdc_pmu_init' when 'devm_kasprintf' return NULL Suggested-by: Ahmad Fatoum Fixes: e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver") Signed-off-by: Kunwu Chan Signed-off-by: Shawn Guo arch/arm/mach-imx/mmdc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 8ae06f1366390972fdcce0f0cee3cac0f63b3209 Author: Haibo Chen Date: Wed Nov 15 11:56:21 2023 +0800 arm64: dts: imx8ulp: update gpio node name to align with register address Change the gpio node name to align with register address. Fixes: ac7bcf48ddba ("arm64: dts: imx8ulp: update gpio node") Signed-off-by: Haibo Chen Reviewed-by: Marco Felsch Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx8ulp.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 4af1b258b68c5c948601082d5ce858ba31eb64f4 Author: Haibo Chen Date: Wed Nov 15 11:56:20 2023 +0800 arm64: dts: imx93: update gpio node name to align with register address Change the gpio node name to align with register address Fixes: c1d0782b5fc3 ("arm64: dts: imx93: update gpio node") Signed-off-by: Haibo Chen Reviewed-by: Marco Felsch Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx93.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit d4cb68a5d3a1ed30ecaf1591eb901523faa13496 Author: Peng Fan Date: Mon Nov 13 18:02:29 2023 +0800 arm64: dts: imx93: correct mediamix power "nic_media" clock should be enabled when power on/off mediamix, otherwise power on/off will fail. Because "media_axi_root" clock is the parent of "nic_media" clock, so replace "media_axi_clock" clock with "nic_media" clock in mediamix node. Link: https://github.com/nxp-imx/linux-imx/commit/ce18e6d0071ae9df5486af8613708ebe920484be Fixes: f2d03ba997cb ("arm64: dts: imx93: reorder device nodes") Fixes: e85d3458a804 ("arm64: dts: imx93: add src node") Reviewed-by: Jacky Bai Signed-off-by: Peng Fan Signed-off-by: Liu Ying Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx93.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b37e75bddc35d4a40a4caeb9921cb95c33c3eba9 Author: Xiaolei Wang Date: Fri Nov 10 15:25:31 2023 +0800 arm64: dts: imx8qm: Add imx8qm's own pm to avoid panic during startup Add imx8qm's own pm, otherwise the following panic will occur during the startup process: Kernel panic - not syncing: Asynchronous SError Interrupt Hardware name: Freescale i.MX8QM MEK (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace+0x98/0xf0 show_stack+0x18/0x24 dump_stack_lvl+0x60/0xac dump_stack+0x18/0x24 panic+0x340/0x3a0 nmi_panic+0x8c/0x90 arm64_serror_panic+0x6c/0x78 do_serror+0x3c/0x78 el1h_64_error_handler+0x38/0x50 el1h_64_error+0x64/0x68 fsl_edma_chan_mux+0x98/0xdc fsl_edma_probe+0x278/0x898 platform_probe+0x68/0xd8 really_probe+0x110/0x27c __driver_probe_device+0x78/0x12c driver_probe_device+0x3c/0x118 __device_attach_driver+0xb8/0xf8 bus_for_each_drv+0x84/0xe4 __device_attach+0xfc/0x18c device_initial_probe+0x14/0x20 Fixes: e4d7a330fb7a ("arm64: dts: imx8: add edma[0..3]") Signed-off-by: Xiaolei Wang Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 7cef7c0b1dea1e17c7913826b74403f4ab7edeb9 Author: Alexander Stein Date: Mon Nov 6 16:13:26 2023 +0100 arm64: dts: freescale: imx8-ss-dma: Fix #pwm-cells i.MX8QXP supports inverted PWM output, thus #pwm-cells needs to be set to 3. Fixes: f1d6a6b991ef9 ("arm64: dts: imx8qxp: add adma_pwm in adma") Signed-off-by: Alexander Stein Reviewed-by: Uwe Kleine-König Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d863a2f4f47560d71447650822857fc3d2aea715 Author: Alexander Stein Date: Mon Nov 6 16:13:25 2023 +0100 arm64: dts: freescale: imx8-ss-lsio: Fix #pwm-cells i.MX8QM/QXP supports inverted PWM output, thus #pwm-cells needs to be set to 3. Fixes: 23fa99b205ea ("arm64: dts: freescale: imx8-ss-lsio: add support for lsio_pwm0-3") Signed-off-by: Alexander Stein Reviewed-by: Uwe Kleine-König Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 5796230582f6131fa217f0a1700783c459c847d2 Author: Brian Foster Date: Tue Dec 5 08:24:38 2023 -0500 bcachefs: don't attempt rw on unfreeze when shutdown The internal freeze mechanism in bcachefs mostly reuses the generic rw<->ro transition code. If the fs happens to shutdown during or after freeze, a transition back to rw can fail. This is expected, but returning an error from the unfreeze callout prevents the filesystem from being unfrozen. Skip the read write transition if the fs is shutdown. This allows the fs to unfreeze at the vfs level so writes will no longer block, but will still fail due to the emergency read-only state of the fs. Signed-off-by: Brian Foster Signed-off-by: Kent Overstreet fs/bcachefs/fs.c | 3 +++ 1 file changed, 3 insertions(+) commit 7aebaabfede75feda5c5d16991da74124aee428d Author: Kent Overstreet Date: Mon Dec 4 15:44:15 2023 -0500 bcachefs: Fix creating snapshot with implict source When creating a snapshot without specifying the source subvolume, we use the subvolume containing the new snapshot. Previously, this worked if the directory containing the new snapshot was the subvolume root - but we were using the incorrect helper, and got a subvolume ID of 0 when the parent directory wasn't the root of the subvolume, causing an emergency read-only. Signed-off-by: Kent Overstreet fs/bcachefs/fs-ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit efd563ff1a7e692408c9d44bec3d90949f7a9557 Merge: 58d3aade20cd 4115ba677c35 Author: Jakub Kicinski Date: Tue Dec 5 20:20:22 2023 -0800 Merge branch 'ionic-small-driver-fixes' Shannon Nelson says: ==================== ionic: small driver fixes This is a pair of fixes to address a DIM issue and a kernel test robot complaint v1: https://lore.kernel.org/netdev/20231201000519.13363-1-shannon.nelson@amd.com/ ==================== Link: https://lore.kernel.org/r/20231204192234.21017-1-shannon.nelson@amd.com Signed-off-by: Jakub Kicinski commit 4115ba677c35f694b62298e55f0e04ce84eed469 Author: Brett Creeley Date: Mon Dec 4 11:22:34 2023 -0800 ionic: Fix dim work handling in split interrupt mode Currently ionic_dim_work() is incorrect when in split interrupt mode. This is because the interrupt rate is only being changed for the Rx side even for dim running on Tx. Fix this by using the qcq from the container_of macro. Also, introduce some local variables for a bit of cleanup. Fixes: a6ff85e0a2d9 ("ionic: remove intr coalesce update from napi") Signed-off-by: Brett Creeley Signed-off-by: Shannon Nelson Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20231204192234.21017-3-shannon.nelson@amd.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/pensando/ionic/ionic_lif.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 0ceb3860a67652f9d36dfdecfcd2cb3eb2f4537d Author: Shannon Nelson Date: Mon Dec 4 11:22:33 2023 -0800 ionic: fix snprintf format length warning Our friendly kernel test robot has reminded us that with a new check we have a warning about a potential string truncation. In this case it really doesn't hurt anything, but it is worth addressing especially since there really is no reason to reserve so many bytes for our queue names. It seems that cutting the queue name buffer length in half stops the complaint. Fixes: c06107cabea3 ("ionic: more ionic name tweaks") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311300201.lO8v7mKU-lkp@intel.com/ Signed-off-by: Shannon Nelson Reviewed-by: Brett Creeley Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20231204192234.21017-2-shannon.nelson@amd.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/pensando/ionic/ionic_dev.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 58d3aade20cdddbac6c9707ac0f3f5f8c1278b74 Author: Paolo Abeni Date: Mon Dec 4 17:08:05 2023 +0100 tcp: fix mid stream window clamp. After the blamed commit below, if the user-space application performs window clamping when tp->rcv_wnd is 0, the TCP socket will never be able to announce a non 0 receive window, even after completely emptying the receive buffer and re-setting the window clamp to higher values. Refactor tcp_set_window_clamp() to address the issue: when the user decreases the current clamp value, set rcv_ssthresh according to the same logic used at buffer initialization, but ensuring reserved mem provisioning. To avoid code duplication factor-out the relevant bits from tcp_adjust_rcv_ssthresh() in a new helper and reuse it in the above scenario. When increasing the clamp value, give the rcv_ssthresh a chance to grow according to previously implemented heuristic. Fixes: 3aa7857fe1d7 ("tcp: enable mid stream window clamp") Reported-by: David Gibson Reported-by: Stefano Brivio Signed-off-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/705dad54e6e6e9a010e571bf58e0b35a8ae70503.1701706073.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski include/net/tcp.h | 9 +++++++-- net/ipv4/tcp.c | 22 +++++++++++++++++++--- 2 files changed, 26 insertions(+), 5 deletions(-) commit d007caaaf052f82ca2340d4c7b32d04a3f5dbf3f Author: Dinghao Liu Date: Mon Dec 4 10:40:04 2023 +0800 net: bnxt: fix a potential use-after-free in bnxt_init_tc When flow_indr_dev_register() fails, bnxt_init_tc will free bp->tc_info through kfree(). However, the caller function bnxt_init_one() will ignore this failure and call bnxt_shutdown_tc() on failure of bnxt_dl_register(), where a use-after-free happens. Fix this issue by setting bp->tc_info to NULL after kfree(). Fixes: 627c89d00fb9 ("bnxt_en: flow_offload: offload tunnel decap rules via indirect callbacks") Signed-off-by: Dinghao Liu Reviewed-by: Pavan Chebbi Reviewed-by: Michael Chan Reviewed-by: Somnath Kotur Link: https://lore.kernel.org/r/20231204024004.8245-1-dinghao.liu@zju.edu.cn Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 + 1 file changed, 1 insertion(+) commit a61f46e1102545cf1fb5f19992288265362cefb0 Author: Lorenzo Bianconi Date: Mon Dec 4 16:01:48 2023 +0100 net: veth: fix packet segmentation in veth_convert_skb_to_xdp_buff Based on the previous allocated packet, page_offset can be not null in veth_convert_skb_to_xdp_buff routine. Take into account page fragment offset during the skb paged area copy in veth_convert_skb_to_xdp_buff(). Fixes: 2d0de67da51a ("net: veth: use newly added page pool API for veth with xdp") Signed-off-by: Lorenzo Bianconi Reviewed-by: Yunsheng Lin Link: https://lore.kernel.org/r/eddfe549e7e626870071930964ac3c38a1dc8068.1701702000.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski drivers/net/veth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 5101ada56f845e9701440f62fc68a76fc0d711ef Merge: fcc9b50e5517 862c135bde8b Author: Greg Kroah-Hartman Date: Wed Dec 6 12:13:30 2023 +0900 Merge tag 'coresight-fixes-for-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/coresight/linux into char-misc-next Suzuki writes: coresight: Fixes for v6.7-rc1 Here are a few fixes for the hwtracing subsystem targetting v6.7. Includes: - Ultrasoc-SMB driver fixes - HiSilicon PTT driver fixes - Corsight driver fixes Signed-off-by: Suzuki K Poulose * tag 'coresight-fixes-for-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/coresight/linux: coresight: ultrasoc-smb: Fix uninitialized before use buf_hw_base coresight: ultrasoc-smb: Config SMB buffer before register sink coresight: ultrasoc-smb: Fix sleep while close preempt in enable_smb Documentation: coresight: fix `make refcheckdocs` warning hwtracing: hisi_ptt: Don't try to attach a task hwtracing: hisi_ptt: Handle the interrupt in hardirq context hwtracing: hisi_ptt: Add dummy callback pmu::read() coresight: Fix crash when Perf and sysfs modes are used concurrently coresight: etm4x: Remove bogous __exit annotation for some functions commit 691a41d8da4b34fe72f09393505f55f28a8f34ec Author: David Howells Date: Mon Dec 4 14:01:59 2023 +0000 cifs: Fix non-availability of dedup breaking generic/304 Deduplication isn't supported on cifs, but cifs doesn't reject it, instead treating it as extent duplication/cloning. This can cause generic/304 to go silly and run for hours on end. Fix cifs to indicate EOPNOTSUPP if REMAP_FILE_DEDUP is set in ->remap_file_range(). Note that it's unclear whether or not commit b073a08016a1 is meant to cause cifs to return an error if REMAP_FILE_DEDUP. Fixes: b073a08016a1 ("cifs: fix that return -EINVAL when do dedupe operation") Cc: stable@vger.kernel.org Suggested-by: Dave Chinner cc: Xiaoli Feng cc: Shyam Prasad N cc: Rohith Surabattula cc: Jeff Layton cc: Darrick Wong cc: fstests@vger.kernel.org cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/3876191.1701555260@warthog.procyon.org.uk/ Signed-off-by: David Howells Signed-off-by: Steve French fs/smb/client/cifsfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 92414333eb375ed64f4ae92d34d579e826936480 Author: Paulo Alcantara Date: Tue Dec 5 21:49:29 2023 -0300 smb: client: fix potential NULL deref in parse_dfs_referrals() If server returned no data for FSCTL_DFS_GET_REFERRALS, @dfs_rsp will remain NULL and then parse_dfs_referrals() will dereference it. Fix this by returning -EIO when no output data is returned. Besides, we can't fix it in SMB2_ioctl() as some FSCTLs are allowed to return no data as per MS-SMB2 2.2.32. Fixes: 9d49640a21bf ("CIFS: implement get_dfs_refer for SMB2+") Cc: stable@vger.kernel.org Reported-by: Robert Morris Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/smb2ops.c | 2 ++ 1 file changed, 2 insertions(+) commit eb547407f3572d2110cb1194ecd8865b3371a7a4 Author: Namjae Jeon Date: Tue Dec 5 21:02:03 2023 +0900 ksmbd: downgrade RWH lease caching state to RH for directory RWH(Read + Write + Handle) caching state is not supported for directory. ksmbd downgrade it to RH for directory if client send RWH caching lease state. Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/oplock.c | 9 +++++++-- fs/smb/server/oplock.h | 2 +- fs/smb/server/smb2pdu.c | 8 ++++---- 3 files changed, 12 insertions(+), 7 deletions(-) commit 18dd1c367c31d0a060f737d48345747662369b64 Author: Namjae Jeon Date: Mon Dec 4 22:10:16 2023 +0900 ksmbd: set v2 lease capability Set SMB2_GLOBAL_CAP_DIRECTORY_LEASING to ->capabilities to inform server support directory lease to client. Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/oplock.c | 4 ---- fs/smb/server/smb2ops.c | 9 ++++++--- 2 files changed, 6 insertions(+), 7 deletions(-) commit d045850b628aaf931fc776c90feaf824dca5a1cf Author: Namjae Jeon Date: Mon Dec 4 22:07:03 2023 +0900 ksmbd: set epoch in create context v2 lease To support v2 lease(directory lease), ksmbd set epoch in create context v2 lease response. Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/oplock.c | 5 ++++- fs/smb/server/oplock.h | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) commit 8f1752723019db900fb60a5b9d0dfd3a2bdea36c Author: Zizhi Wo Date: Fri Dec 1 22:50:48 2023 +0800 ksmbd: fix memory leak in smb2_lock() In smb2_lock(), if setup_async_work() executes successfully, work->cancel_argv will bind the argv that generated by kmalloc(). And release_async_work() is called in ksmbd_conn_try_dequeue_request() or smb2_lock() to release argv. However, when setup_async_work function fails, work->cancel_argv has not been bound to the argv, resulting in the previously allocated argv not being released. Call kfree() to fix it. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Signed-off-by: Zizhi Wo Acked-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2pdu.c | 1 + 1 file changed, 1 insertion(+) commit 235f2b548d7f4ac5931d834f05d3f7f5166a2e72 Author: Dinghao Liu Date: Thu Nov 23 16:19:41 2023 +0800 scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle() When an error occurs in the for loop of beiscsi_init_wrb_handle(), we should free phwi_ctxt->be_wrbq before returning an error code to prevent potential memleak. Fixes: a7909b396ba7 ("[SCSI] be2iscsi: Fix dynamic CID allocation Mechanism in driver") Signed-off-by: Dinghao Liu Link: https://lore.kernel.org/r/20231123081941.24854-1-dinghao.liu@zju.edu.cn Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen drivers/scsi/be2iscsi/be_main.c | 1 + 1 file changed, 1 insertion(+) commit c0591b1cccf708a47bc465c62436d669a4213323 Author: Petr Pavlu Date: Tue Dec 5 17:17:36 2023 +0100 tracing: Fix a possible race when disabling buffered events Function trace_buffered_event_disable() is responsible for freeing pages backing buffered events and this process can run concurrently with trace_event_buffer_lock_reserve(). The following race is currently possible: * Function trace_buffered_event_disable() is called on CPU 0. It increments trace_buffered_event_cnt on each CPU and waits via synchronize_rcu() for each user of trace_buffered_event to complete. * After synchronize_rcu() is finished, function trace_buffered_event_disable() has the exclusive access to trace_buffered_event. All counters trace_buffered_event_cnt are at 1 and all pointers trace_buffered_event are still valid. * At this point, on a different CPU 1, the execution reaches trace_event_buffer_lock_reserve(). The function calls preempt_disable_notrace() and only now enters an RCU read-side critical section. The function proceeds and reads a still valid pointer from trace_buffered_event[CPU1] into the local variable "entry". However, it doesn't yet read trace_buffered_event_cnt[CPU1] which happens later. * Function trace_buffered_event_disable() continues. It frees trace_buffered_event[CPU1] and decrements trace_buffered_event_cnt[CPU1] back to 0. * Function trace_event_buffer_lock_reserve() continues. It reads and increments trace_buffered_event_cnt[CPU1] from 0 to 1. This makes it believe that it can use the "entry" that it already obtained but the pointer is now invalid and any access results in a use-after-free. Fix the problem by making a second synchronize_rcu() call after all trace_buffered_event values are set to NULL. This waits on all potential users in trace_event_buffer_lock_reserve() that still read a previous pointer from trace_buffered_event. Link: https://lore.kernel.org/all/20231127151248.7232-2-petr.pavlu@suse.com/ Link: https://lkml.kernel.org/r/20231205161736.19663-4-petr.pavlu@suse.com Cc: stable@vger.kernel.org Fixes: 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events") Signed-off-by: Petr Pavlu Signed-off-by: Steven Rostedt (Google) kernel/trace/trace.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 34209fe83ef8404353f91ab4ea4035dbc9922d04 Author: Petr Pavlu Date: Tue Dec 5 17:17:35 2023 +0100 tracing: Fix a warning when allocating buffered events fails Function trace_buffered_event_disable() produces an unexpected warning when the previous call to trace_buffered_event_enable() fails to allocate pages for buffered events. The situation can occur as follows: * The counter trace_buffered_event_ref is at 0. * The soft mode gets enabled for some event and trace_buffered_event_enable() is called. The function increments trace_buffered_event_ref to 1 and starts allocating event pages. * The allocation fails for some page and trace_buffered_event_disable() is called for cleanup. * Function trace_buffered_event_disable() decrements trace_buffered_event_ref back to 0, recognizes that it was the last use of buffered events and frees all allocated pages. * The control goes back to trace_buffered_event_enable() which returns. The caller of trace_buffered_event_enable() has no information that the function actually failed. * Some time later, the soft mode is disabled for the same event. Function trace_buffered_event_disable() is called. It warns on "WARN_ON_ONCE(!trace_buffered_event_ref)" and returns. Buffered events are just an optimization and can handle failures. Make trace_buffered_event_enable() exit on the first failure and left any cleanup later to when trace_buffered_event_disable() is called. Link: https://lore.kernel.org/all/20231127151248.7232-2-petr.pavlu@suse.com/ Link: https://lkml.kernel.org/r/20231205161736.19663-3-petr.pavlu@suse.com Fixes: 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events") Signed-off-by: Petr Pavlu Signed-off-by: Steven Rostedt (Google) kernel/trace/trace.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 7fed14f7ac9cf5e38c693836fe4a874720141845 Author: Petr Pavlu Date: Tue Dec 5 17:17:34 2023 +0100 tracing: Fix incomplete locking when disabling buffered events The following warning appears when using buffered events: [ 203.556451] WARNING: CPU: 53 PID: 10220 at kernel/trace/ring_buffer.c:3912 ring_buffer_discard_commit+0x2eb/0x420 [...] [ 203.670690] CPU: 53 PID: 10220 Comm: stress-ng-sysin Tainted: G E 6.7.0-rc2-default #4 56e6d0fcf5581e6e51eaaecbdaec2a2338c80f3a [ 203.670704] Hardware name: Intel Corp. GROVEPORT/GROVEPORT, BIOS GVPRCRB1.86B.0016.D04.1705030402 05/03/2017 [ 203.670709] RIP: 0010:ring_buffer_discard_commit+0x2eb/0x420 [ 203.735721] Code: 4c 8b 4a 50 48 8b 42 48 49 39 c1 0f 84 b3 00 00 00 49 83 e8 01 75 b1 48 8b 42 10 f0 ff 40 08 0f 0b e9 fc fe ff ff f0 ff 47 08 <0f> 0b e9 77 fd ff ff 48 8b 42 10 f0 ff 40 08 0f 0b e9 f5 fe ff ff [ 203.735734] RSP: 0018:ffffb4ae4f7b7d80 EFLAGS: 00010202 [ 203.735745] RAX: 0000000000000000 RBX: ffffb4ae4f7b7de0 RCX: ffff8ac10662c000 [ 203.735754] RDX: ffff8ac0c750be00 RSI: ffff8ac10662c000 RDI: ffff8ac0c004d400 [ 203.781832] RBP: ffff8ac0c039cea0 R08: 0000000000000000 R09: 0000000000000000 [ 203.781839] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 203.781842] R13: ffff8ac10662c000 R14: ffff8ac0c004d400 R15: ffff8ac10662c008 [ 203.781846] FS: 00007f4cd8a67740(0000) GS:ffff8ad798880000(0000) knlGS:0000000000000000 [ 203.781851] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 203.781855] CR2: 0000559766a74028 CR3: 00000001804c4000 CR4: 00000000001506f0 [ 203.781862] Call Trace: [ 203.781870] [ 203.851949] trace_event_buffer_commit+0x1ea/0x250 [ 203.851967] trace_event_raw_event_sys_enter+0x83/0xe0 [ 203.851983] syscall_trace_enter.isra.0+0x182/0x1a0 [ 203.851990] do_syscall_64+0x3a/0xe0 [ 203.852075] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 203.852090] RIP: 0033:0x7f4cd870fa77 [ 203.982920] Code: 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 90 b8 89 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e9 43 0e 00 f7 d8 64 89 01 48 [ 203.982932] RSP: 002b:00007fff99717dd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000089 [ 203.982942] RAX: ffffffffffffffda RBX: 0000558ea1d7b6f0 RCX: 00007f4cd870fa77 [ 203.982948] RDX: 0000000000000000 RSI: 00007fff99717de0 RDI: 0000558ea1d7b6f0 [ 203.982957] RBP: 00007fff99717de0 R08: 00007fff997180e0 R09: 00007fff997180e0 [ 203.982962] R10: 00007fff997180e0 R11: 0000000000000246 R12: 00007fff99717f40 [ 204.049239] R13: 00007fff99718590 R14: 0000558e9f2127a8 R15: 00007fff997180b0 [ 204.049256] For instance, it can be triggered by running these two commands in parallel: $ while true; do echo hist:key=id.syscall:val=hitcount > \ /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger; done $ stress-ng --sysinfo $(nproc) The warning indicates that the current ring_buffer_per_cpu is not in the committing state. It happens because the active ring_buffer_event doesn't actually come from the ring_buffer_per_cpu but is allocated from trace_buffered_event. The bug is in function trace_buffered_event_disable() where the following normally happens: * The code invokes disable_trace_buffered_event() via smp_call_function_many() and follows it by synchronize_rcu(). This increments the per-CPU variable trace_buffered_event_cnt on each target CPU and grants trace_buffered_event_disable() the exclusive access to the per-CPU variable trace_buffered_event. * Maintenance is performed on trace_buffered_event, all per-CPU event buffers get freed. * The code invokes enable_trace_buffered_event() via smp_call_function_many(). This decrements trace_buffered_event_cnt and releases the access to trace_buffered_event. A problem is that smp_call_function_many() runs a given function on all target CPUs except on the current one. The following can then occur: * Task X executing trace_buffered_event_disable() runs on CPU 0. * The control reaches synchronize_rcu() and the task gets rescheduled on another CPU 1. * The RCU synchronization finishes. At this point, trace_buffered_event_disable() has the exclusive access to all trace_buffered_event variables except trace_buffered_event[CPU0] because trace_buffered_event_cnt[CPU0] is never incremented and if the buffer is currently unused, remains set to 0. * A different task Y is scheduled on CPU 0 and hits a trace event. The code in trace_event_buffer_lock_reserve() sees that trace_buffered_event_cnt[CPU0] is set to 0 and decides the use the buffer provided by trace_buffered_event[CPU0]. * Task X continues its execution in trace_buffered_event_disable(). The code incorrectly frees the event buffer pointed by trace_buffered_event[CPU0] and resets the variable to NULL. * Task Y writes event data to the now freed buffer and later detects the created inconsistency. The issue is observable since commit dea499781a11 ("tracing: Fix warning in trace_buffered_event_disable()") which moved the call of trace_buffered_event_disable() in __ftrace_event_enable_disable() earlier, prior to invoking call->class->reg(.. TRACE_REG_UNREGISTER ..). The underlying problem in trace_buffered_event_disable() is however present since the original implementation in commit 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events"). Fix the problem by replacing the two smp_call_function_many() calls with on_each_cpu_mask() which invokes a given callback on all CPUs. Link: https://lore.kernel.org/all/20231127151248.7232-2-petr.pavlu@suse.com/ Link: https://lkml.kernel.org/r/20231205161736.19663-2-petr.pavlu@suse.com Cc: stable@vger.kernel.org Fixes: 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events") Fixes: dea499781a11 ("tracing: Fix warning in trace_buffered_event_disable()") Signed-off-by: Petr Pavlu Signed-off-by: Steven Rostedt (Google) kernel/trace/trace.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) commit b538bf7d0ec11ca49f536dfda742a5f6db90a798 Author: Steven Rostedt (Google) Date: Tue Dec 5 16:52:11 2023 -0500 tracing: Disable snapshot buffer when stopping instance tracers It use to be that only the top level instance had a snapshot buffer (for latency tracers like wakeup and irqsoff). When stopping a tracer in an instance would not disable the snapshot buffer. This could have some unintended consequences if the irqsoff tracer is enabled. Consolidate the tracing_start/stop() with tracing_start/stop_tr() so that all instances behave the same. The tracing_start/stop() functions will just call their respective tracing_start/stop_tr() with the global_array passed in. Link: https://lkml.kernel.org/r/20231205220011.041220035@goodmis.org Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Fixes: 6d9b3fa5e7f6 ("tracing: Move tracing_max_latency into trace_array") Signed-off-by: Steven Rostedt (Google) kernel/trace/trace.c | 110 ++++++++++++++++----------------------------------- 1 file changed, 34 insertions(+), 76 deletions(-) commit d78ab792705c7be1b91243b2544d1a79406a2ad7 Author: Steven Rostedt (Google) Date: Tue Dec 5 16:52:10 2023 -0500 tracing: Stop current tracer when resizing buffer When the ring buffer is being resized, it can cause side effects to the running tracer. For instance, there's a race with irqsoff tracer that swaps individual per cpu buffers between the main buffer and the snapshot buffer. The resize operation modifies the main buffer and then the snapshot buffer. If a swap happens in between those two operations it will break the tracer. Simply stop the running tracer before resizing the buffers and enable it again when finished. Link: https://lkml.kernel.org/r/20231205220010.748996423@goodmis.org Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Fixes: 3928a8a2d9808 ("ftrace: make work with new ring buffer") Signed-off-by: Steven Rostedt (Google) kernel/trace/trace.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 7be76461f302ec05cbd62b90b2a05c64299ca01f Author: Steven Rostedt (Google) Date: Tue Dec 5 16:52:09 2023 -0500 tracing: Always update snapshot buffer size It use to be that only the top level instance had a snapshot buffer (for latency tracers like wakeup and irqsoff). The update of the ring buffer size would check if the instance was the top level and if so, it would also update the snapshot buffer as it needs to be the same as the main buffer. Now that lower level instances also has a snapshot buffer, they too need to update their snapshot buffer sizes when the main buffer is changed, otherwise the following can be triggered: # cd /sys/kernel/tracing # echo 1500 > buffer_size_kb # mkdir instances/foo # echo irqsoff > instances/foo/current_tracer # echo 1000 > instances/foo/buffer_size_kb Produces: WARNING: CPU: 2 PID: 856 at kernel/trace/trace.c:1938 update_max_tr_single.part.0+0x27d/0x320 Which is: ret = ring_buffer_swap_cpu(tr->max_buffer.buffer, tr->array_buffer.buffer, cpu); if (ret == -EBUSY) { [..] } WARN_ON_ONCE(ret && ret != -EAGAIN && ret != -EBUSY); <== here That's because ring_buffer_swap_cpu() has: int ret = -EINVAL; [..] /* At least make sure the two buffers are somewhat the same */ if (cpu_buffer_a->nr_pages != cpu_buffer_b->nr_pages) goto out; [..] out: return ret; } Instead, update all instances' snapshot buffer sizes when their main buffer size is updated. Link: https://lkml.kernel.org/r/20231205220010.454662151@goodmis.org Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Fixes: 6d9b3fa5e7f6 ("tracing: Move tracing_max_latency into trace_array") Signed-off-by: Steven Rostedt (Google) kernel/trace/trace.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit bdefd9913bdd453991ef756b6f7176e8ad80d786 Author: Lukasz Luba Date: Fri Dec 1 12:32:05 2023 +0000 powercap: DTPM: Fix missing cpufreq_cpu_put() calls The policy returned by cpufreq_cpu_get() has to be released with the help of cpufreq_cpu_put() to balance its kobject reference counter properly. Add the missing calls to cpufreq_cpu_put() in the code. Fixes: 0aea2e4ec2a2 ("powercap/dtpm_cpu: Reset per_cpu variable in the release function") Fixes: 0e8f68d7f048 ("powercap/drivers/dtpm: Add CPU energy model based support") Cc: v5.16+ # v5.16+ Signed-off-by: Lukasz Luba Signed-off-by: Rafael J. Wysocki drivers/powercap/dtpm_cpu.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) commit 24be0b3c40594a14b65141ced486ae327398faf8 Author: Mathias Nyman Date: Tue Dec 5 11:05:48 2023 +0200 Revert "xhci: Loosen RPM as default policy to cover for AMD xHC 1.1" This reverts commit 4baf1218150985ee3ab0a27220456a1f027ea0ac. Enabling runtime pm as default for all AMD xHC 1.1 controllers caused regression. An initial attempt to fix those was done in commit a5d6264b638e ("xhci: Enable RPM on controllers that support low-power states") but new issues are still seen. Revert this to get those AMD xHC 1.1 systems working This patch went to stable an needs to be reverted from there as well. Fixes: 4baf12181509 ("xhci: Loosen RPM as default policy to cover for AMD xHC 1.1") Link: https://lore.kernel.org/linux-usb/55c50bf5-bffb-454e-906e-4408c591cb63@molgen.mpg.de Cc: Mario Limonciello Cc: Basavaraj Natikar Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20231205090548.1377667-1-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-pci.c | 2 -- 1 file changed, 2 deletions(-) commit b1693747487442984050eb0f462b83a3a8307525 Author: Ian Rogers Date: Wed Nov 29 13:34:26 2023 -0800 perf list: Fix JSON segfault by setting the used skip_duplicate_pmus callback Json output didn't set the skip_duplicate_pmus callback yielding a segfault. Fixes: cd4e1efbbc40 ("perf pmus: Skip duplicate PMUs and don't print list suffix by default") Signed-off-by: Ian Rogers Cc: James Clark Cc: Kan Liang Cc: Athira Rajeev Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20231129213428.2227448-2-irogers@google.com [namhyung: updated subject line according to Arnaldo] Signed-off-by: Namhyung Kim tools/perf/builtin-list.c | 6 ++++++ 1 file changed, 6 insertions(+) commit a206d9959f5ccd0fb2d54a997c993947ae0e881c Author: Jacob Keller Date: Mon Nov 27 15:33:50 2023 -0800 iavf: validate tx_coalesce_usecs even if rx_coalesce_usecs is zero In __iavf_set_coalesce, the driver checks both ec->rx_coalesce_usecs and ec->tx_coalesce_usecs for validity. It does this via a chain if if/else-if blocks. If every single branch of the series of if statements exited, this would be fine. However, the rx_coalesce_usecs is checked against zero to print an informative message if use_adaptive_rx_coalesce is enabled. If this check is true, it short circuits the entire chain of statements, preventing validation of the tx_coalesce_usecs field. Indeed, since commit e792779e6b63 ("iavf: Prevent changing static ITR values if adaptive moderation is on") the iavf driver actually rejects any change to the tx_coalesce_usecs or rx_coalesce_usecs when use_adaptive_tx_coalesce or use_adaptive_rx_coalesce is enabled, making this checking a bit redundant. Fix this error by removing the unnecessary and redundant checks for use_adaptive_rx_coalesce and use_adaptive_tx_coalesce. Since zero is a valid value, and since the tx_coalesce_usecs and rx_coalesce_usecs fields are already unsigned, remove the minimum value check. This allows assigning an ITR value ranging from 0-8160 as described by the printed message. Fixes: 65e87c0398f5 ("i40evf: support queue-specific settings for interrupt moderation") Signed-off-by: Jacob Keller Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 12 ++---------- drivers/net/ethernet/intel/iavf/iavf_txrx.h | 1 - 2 files changed, 2 insertions(+), 11 deletions(-) commit 7d9f22b3d3ef379ed05bd3f3e2de83dfa8da8258 Author: Ivan Vecera Date: Fri Nov 10 09:12:09 2023 +0100 i40e: Fix unexpected MFS warning message Commit 3a2c6ced90e1 ("i40e: Add a check to see if MFS is set") added a warning message that reports unexpected size of port's MFS (max frame size) value. This message use for the port number local variable 'i' that is wrong. In i40e_probe() this 'i' variable is used only to iterate VSIs to find FDIR VSI: ... /* if FDIR VSI was set up, start it now */ for (i = 0; i < pf->num_alloc_vsi; i++) { if (pf->vsi[i] && pf->vsi[i]->type == I40E_VSI_FDIR) { i40e_vsi_open(pf->vsi[i]); break; } } ... So the warning message use for the port number index of FDIR VSI if this exists or pf->num_alloc_vsi if not. Fix the message by using 'pf->hw.port' for the port number. Fixes: 3a2c6ced90e1 ("i40e: Add a check to see if MFS is set") Signed-off-by: Ivan Vecera Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4e7f0087b058cc3cab8f3c32141b51aa5457d298 Author: Marcin Szycik Date: Tue Nov 7 14:51:38 2023 +0100 ice: Restore fix disabling RX VLAN filtering Fix setting dis_rx_filtering depending on whether port vlan is being turned on or off. This was originally fixed in commit c793f8ea15e3 ("ice: Fix disabling Rx VLAN filtering with port VLAN enabled"), but while refactoring ice_vf_vsi_init_vlan_ops(), the fix has been lost. Restore the fix along with the original comment from that change. Also delete duplicate lines in ice_port_vlan_on(). Fixes: 2946204b3fa8 ("ice: implement bridge port vlan") Reviewed-by: Wojciech Drewek Signed-off-by: Marcin Szycik Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit f8e9889f54da6e3146c2cb3f5c206cf1a704f9d3 Author: Michal Swiatkowski Date: Tue Oct 24 16:20:10 2023 +0200 ice: change vfs.num_msix_per to vf->num_msix vfs::num_msix_per should be only used as default value for vf->num_msix. For other use cases vf->num_msix should be used, as VF can have different MSI-X amount values. Fix incorrect register index calculation. vfs::num_msix_per and pf->sriov_base_vector shouldn't be used after implementation of changing MSI-X amount on VFs. Instead vf->first_vector_idx should be used, as it is storing value for first irq index. Fixes: fe1c5ca2fe76 ("ice: implement num_msix field per VF") Reviewed-by: Jacob Keller Signed-off-by: Michal Swiatkowski Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_sriov.c | 7 +------ drivers/net/ethernet/intel/ice/ice_virtchnl.c | 5 ++--- 2 files changed, 3 insertions(+), 9 deletions(-) commit 90fe70d4e23cb57253d2668a171d5695c332deb7 Author: Ilkka Koskinen Date: Thu Nov 30 18:15:48 2023 -0800 perf vendor events arm64: AmpereOne: Add missing DefaultMetricgroupName fields AmpereOne metrics were missing DefaultMetricgroupName from metrics with "Default" in group name resulting perf to segfault. Add the missing field to address the issue. Fixes: 59faeaf80d02 ("perf vendor events arm64: Fix for AmpereOne metrics") Signed-off-by: Ilkka Koskinen Reviewed-by: Ian Rogers Cc: James Clark Cc: Will Deacon Cc: Leo Yan Cc: Mike Leach Cc: John Garry Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20231201021550.1109196-2-ilkka@os.amperecomputing.com Signed-off-by: Namhyung Kim tools/perf/pmu-events/arch/arm64/ampere/ampereone/metrics.json | 2 ++ 1 file changed, 2 insertions(+) commit e2b005d6ec0e738df584190e21d2c7ada37266a0 Author: Ian Rogers Date: Mon Dec 4 10:23:29 2023 -0800 perf metrics: Avoid segv if default metricgroup isn't set A metric is default by having "Default" within its groups. The default metricgroup name needn't be set and this can result in segv in default_metricgroup_cmp and perf_stat__print_shadow_stats_metricgroup that assume it has a value when there is a Default metric group. To avoid the segv initialize the value to "". Fixes: 1c0e47956a8e ("perf metrics: Sort the Default metricgroup") Signed-off-by: Ian Rogers Reviewed-and-tested-by: Ilkka Koskinen Cc: James Clark Cc: Will Deacon Cc: Leo Yan Cc: Mike Leach Cc: Kajol Jain Cc: Kan Liang Cc: John Garry Cc: stable@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20231204182330.654255-1-irogers@google.com Signed-off-by: Namhyung Kim tools/perf/util/metricgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a58a173444a68412bb08849bd81c679395f20ca0 Author: Thomas Bogendoerfer Date: Thu Nov 30 17:36:01 2023 +0100 MIPS: kernel: Clear FPU states when setting up kernel threads io_uring sets up the io worker kernel thread via a syscall out of an user space prrocess. This process might have used FPU and since copy_thread() didn't clear FPU states for kernel threads a BUG() is triggered for using FPU inside kernel. Move code around to always clear FPU state for user and kernel threads. Cc: stable@vger.kernel.org Reported-by: Aurelien Jarno Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1055021 Suggested-by: Jiaxun Yang Reviewed-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer arch/mips/kernel/process.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) commit c7206e7bd214ebb3ca6fa474a4423662327d9beb Author: Jiaxun Yang Date: Tue Nov 7 11:15:20 2023 +0000 MIPS: Loongson64: Handle more memory types passed from firmware There are many types of revsered memory passed from firmware that should be reserved in memblock, and UMA memory passed from firmware that should be added to system memory for system to use. Also for memblock there is no need to align those space into page, which actually cause problems. Handle them properly to prevent memory corruption on some systems. Cc: stable@vger.kernel.org Signed-off-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer arch/mips/include/asm/mach-loongson64/boot_param.h | 6 +++- arch/mips/loongson64/init.c | 42 +++++++++++++--------- 2 files changed, 31 insertions(+), 17 deletions(-) commit edc0378eee00200a5bedf1bb9f00ad390e0d1bd4 Author: Jiaxun Yang Date: Tue Nov 7 11:15:19 2023 +0000 MIPS: Loongson64: Enable DMA noncoherent support There are some Loongson64 systems come with broken coherent DMA support, firmware will set a bit in boot_param and pass nocoherentio in cmdline. However nonconherent support was missed out when spin off Loongson-2EF form Loongson64, and that boot_param change never made itself into upstream. Support DMA noncoherent properly to get those systems working. Cc: stable@vger.kernel.org Fixes: 71e2f4dd5a65 ("MIPS: Fork loongson2ef from loongson64") Signed-off-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer arch/mips/Kconfig | 2 ++ arch/mips/include/asm/mach-loongson64/boot_param.h | 3 ++- arch/mips/loongson64/env.c | 10 +++++++++- 3 files changed, 13 insertions(+), 2 deletions(-) commit 8f7aa77a463f47c9e00592d02747a9fcf2271543 Author: Jiaxun Yang Date: Tue Nov 7 11:15:18 2023 +0000 MIPS: Loongson64: Reserve vgabios memory on boot vgabios is passed from firmware to kernel on Loongson64 systems. Sane firmware will keep this pointer in reserved memory space passed from the firmware but insane firmware keeps it in low memory before kernel entry that is not reserved. Previously kernel won't try to allocate memory from low memory before kernel entry on boot, but after converting to memblock it will do that. Fix by resversing those memory on early boot. Cc: stable@vger.kernel.org Fixes: a94e4f24ec83 ("MIPS: init: Drop boot_mem_map") Signed-off-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer arch/mips/loongson64/init.c | 5 +++++ 1 file changed, 5 insertions(+) commit 55702ec9603ebeffb15e6f7b113623fe1d8872f4 Author: Stefan Wiehler Date: Mon Nov 6 13:12:07 2023 +0100 mips/smp: Call rcutree_report_cpu_starting() earlier rcutree_report_cpu_starting() must be called before clockevents_register_device() to avoid the following lockdep splat triggered by calling list_add() when CONFIG_PROVE_RCU_LIST=y: WARNING: suspicious RCU usage ... ----------------------------- kernel/locking/lockdep.c:3680 RCU-list traversed in non-reader section!! other info that might help us debug this: RCU used illegally from offline CPU! rcu_scheduler_active = 1, debug_locks = 1 no locks held by swapper/1/0. ... Call Trace: [] show_stack+0x64/0x158 [] dump_stack_lvl+0x90/0xc4 [] __lock_acquire+0x1404/0x2940 [] lock_acquire+0x14c/0x448 [] _raw_spin_lock_irqsave+0x50/0x88 [] clockevents_register_device+0x60/0x1e8 [] r4k_clockevent_init+0x220/0x3a0 [] start_secondary+0x50/0x3b8 raw_smp_processor_id() is required in order to avoid calling into lockdep before RCU has declared the CPU to be watched for readers. See also commit 29368e093921 ("x86/smpboot: Move rcu_cpu_starting() earlier"), commit de5d9dae150c ("s390/smp: move rcu_cpu_starting() earlier") and commit 99f070b62322 ("powerpc/smp: Call rcu_cpu_starting() earlier"). Signed-off-by: Stefan Wiehler Reviewed-by: Huacai Chen Signed-off-by: Thomas Bogendoerfer arch/mips/kernel/smp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3c91c909f13f0c32b0d54d75c3f798479b1a84f5 Author: Zhipeng Lu Date: Sat Dec 2 17:59:02 2023 +0800 octeontx2-af: fix a use-after-free in rvu_npa_register_reporters The rvu_dl will be freed in rvu_npa_health_reporters_destroy(rvu_dl) after the create_workqueue fails, and after that free, the rvu_dl will be translate back through rvu_npa_health_reporters_create, rvu_health_reporters_create, and rvu_register_dl. Finally it goes to the err_dl_health label, being freed again in rvu_health_reporters_destroy(rvu) by rvu_npa_health_reporters_destroy. In the second calls of rvu_npa_health_reporters_destroy, however, it uses rvu_dl->rvu_npa_health_reporter, which is already freed at the end of rvu_npa_health_reporters_destroy in the first call. So this patch prevents the first destroy by instantly returning -ENONMEN when create_workqueue fails. In addition, since the failure of create_workqueue is the only entrence of label err, it has been integrated into the error-handling path of create_workqueue. Fixes: f1168d1e207c ("octeontx2-af: Add devlink health reporters for NPA") Signed-off-by: Zhipeng Lu Acked-by: Paolo Abeni Acked-by: Geethasowjanya Akula Link: https://lore.kernel.org/r/20231202095902.3264863-1-alexious@zju.edu.cn Signed-off-by: Paolo Abeni drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 9865346b7e8374b57f1c3ccacdc77846c6352ff4 Author: Jens Axboe Date: Tue Dec 5 07:02:13 2023 -0700 io_uring/kbuf: check for buffer list readiness after NULL check Move the buffer list 'is_ready' check below the validity check for the buffer list for a given group. Fixes: 5cf4f52e6d8a ("io_uring: free io_buffer_list entries via RCU") Reported-by: Dan Carpenter Signed-off-by: Jens Axboe io_uring/kbuf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e53f7b54b1fdecae897f25002ff0cff04faab228 Author: Dan Carpenter Date: Tue Dec 5 15:37:17 2023 +0300 io_uring/kbuf: Fix an NULL vs IS_ERR() bug in io_alloc_pbuf_ring() The io_mem_alloc() function returns error pointers, not NULL. Update the check accordingly. Fixes: b10b73c102a2 ("io_uring/kbuf: recycle freed mapped buffer ring entries") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/5ed268d3-a997-4f64-bd71-47faa92101ab@moroto.mountain Signed-off-by: Jens Axboe io_uring/kbuf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 890188d2d7e4ac6c131ba166ca116cb315e752ee Author: Miquel Raynal Date: Tue Dec 5 09:31:02 2023 +0100 spi: atmel: Prevent spi transfers from being killed Upstream commit e0205d6203c2 ("spi: atmel: Prevent false timeouts on long transfers") has tried to mitigate the problem of getting spi transfers canceled because they were lasting too long. On slow buses, transfers in the MiB range can take more than one second and thus a calculation was added to progressively increment the timeout value. In order to not be too problematic from a user point of view (waiting dozen of seconds or even minutes), the wait call was turned interruptible. Turning the wait interruptible was a mistake as what we really wanted to do was to be able to kill a transfer. Any signal interrupting our transfer would not be suitable at all so a second attempt was made at turning the wait killable instead. Link: https://lore.kernel.org/linux-spi/20231127095842.389631-1-miquel.raynal@bootlin.com/ All being well, it was reported that JFFS2 was showing a splat when interrupting a transfer. After some more debate about whether JFFS2 should be fixed and how, it was also pointed out that the whole consistency of the filesystem in case of parallel I/O would be compromised. Changing JFFS2 behavior would in theory be possible but nobody has the energy and time and knowledge to do this now, so better prevent spi transfers to be interrupted by the user. Partially revert the blamed commit to no longer use the interruptible nor the killable variant of wait_for_completion(). Fixes: e0205d6203c2 ("spi: atmel: Prevent false timeouts on long transfers") Cc: Signed-off-by: Miquel Raynal Tested-by: Ronald Wahl Link: https://lore.kernel.org/r/20231205083102.16946-1-miquel.raynal@bootlin.com Signed-off-by: Mark Brown drivers/spi/spi-atmel.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit e4d008d49a7135214e0ee70537405b6a069e3a3f Author: Yewon Choi Date: Fri Dec 1 15:10:52 2023 +0900 xsk: Skip polling event check for unbound socket In xsk_poll(), checking available events and setting mask bits should be executed only when a socket has been bound. Setting mask bits for unbound socket is meaningless. Currently, it checks events even when xsk_check_common() failed. To prevent this, we move goto location (skip_tx) after that checking. Fixes: 1596dae2f17e ("xsk: check IFF_UP earlier in Tx path") Signed-off-by: Yewon Choi Signed-off-by: Daniel Borkmann Acked-by: Magnus Karlsson Link: https://lore.kernel.org/bpf/20231201061048.GA1510@libra05 net/xdp/xsk.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 4c6f19ab2aed2abc78d788d5418047e5f44b1921 Author: Alexander Stein Date: Mon Nov 6 16:13:24 2023 +0100 dt-bindings: pwm: imx-pwm: Unify #pwm-cells for all compatibles Use #pwm-cells for all i.MX variants. Only fsl,imx1-pwm does not support inverted PWM output. Keep it the same for consistency. Signed-off-by: Alexander Stein Reviewed-by: Uwe Kleine-König Acked-by: Conor Dooley Signed-off-by: Shawn Guo Documentation/devicetree/bindings/pwm/imx-pwm.yaml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit d951f8f5f23a9417b7952f22b33784c73caa1ebb Author: Fabio Estevam Date: Sun Nov 5 10:32:19 2023 -0300 ARM: dts: imx6ul-pico: Describe the Ethernet PHY clock Since commit c7e73b5051d6 ("ARM: imx: mach-imx6ul: remove 14x14 EVK specific PHY fixup")thet Ethernet PHY is no longer configured via code in board file. This caused Ethernet to stop working. Fix this problem by describing the clocks and clock-names to the Ethernet PHY node so that the KSZ8081 chip can be clocked correctly. Fixes: c7e73b5051d6 ("ARM: imx: mach-imx6ul: remove 14x14 EVK specific PHY fixup") Signed-off-by: Fabio Estevam Reviewed-by: Andrew Lunn Signed-off-by: Shawn Guo arch/arm/boot/dts/nxp/imx/imx6ul-pico.dtsi | 2 ++ 1 file changed, 2 insertions(+) commit a931c6816078af3e306e0f444f492396ce40de31 Author: JP Kobryn Date: Mon Dec 4 12:23:20 2023 -0800 9p: prevent read overrun in protocol dump tracepoint An out of bounds read can occur within the tracepoint 9p_protocol_dump. In the fast assign, there is a memcpy that uses a constant size of 32 (macro named P9_PROTO_DUMP_SZ). When the copy is invoked, the source buffer is not guaranteed match this size. It was found that in some cases the source buffer size is less than 32, resulting in a read that overruns. The size of the source buffer seems to be known at the time of the tracepoint being invoked. The allocations happen within p9_fcall_init(), where the capacity field is set to the allocated size of the payload buffer. This patch tries to fix the overrun by changing the fixed array to a dynamically sized array and using the minimum of the capacity value or P9_PROTO_DUMP_SZ as its length. The trace log statement is adjusted to account for this. Note that the trace log no longer splits the payload on the first 16 bytes. The full payload is now logged to a single line. To repro the orignal problem, operations to a plan 9 managed resource can be used. The simplest approach might just be mounting a shared filesystem (between host and guest vm) using the plan 9 protocol while the tracepoint is enabled. mount -t 9p -o trans=virtio The bpftrace program below can be used to show the out of bounds read. Note that a recent version of bpftrace is needed for the raw tracepoint support. The script was tested using v0.19.0. /* from include/net/9p/9p.h */ struct p9_fcall { u32 size; u8 id; u16 tag; size_t offset; size_t capacity; struct kmem_cache *cache; u8 *sdata; bool zc; }; tracepoint:9p:9p_protocol_dump { /* out of bounds read can happen when this tracepoint is enabled */ } rawtracepoint:9p_protocol_dump { $pdu = (struct p9_fcall *)arg1; $dump_sz = (uint64)32; if ($dump_sz > $pdu->capacity) { printf("reading %zu bytes from src buffer of %zu bytes\n", $dump_sz, $pdu->capacity); } } Signed-off-by: JP Kobryn Message-ID: <20231204202321.22730-1-inwardvessel@gmail.com> Fixes: 60ece0833b6c ("net/9p: allocate appropriate reduced message buffers") Cc: stable@vger.kernel.org Reviewed-by: Christian Schoenebeck Signed-off-by: Dominique Martinet include/trace/events/9p.h | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit 9f269070abe9c45dc60abc84e29326f855317eac Author: heminhong Date: Tue Nov 14 10:43:41 2023 +0800 drm/i915: correct the input parameter on _intel_dsb_commit() Current, the dewake_scanline variable is defined as unsigned int, an unsigned int variable that is always greater than or equal to 0. when _intel_dsb_commit function is called by intel_dsb_commit function, the dewake_scanline variable may have an int value. So the dewake_scanline variable is necessary to defined as an int. Fixes: f83b94d23770 ("drm/i915/dsb: Use DEwake to combat PkgC latency") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202310052201.AnVbpgPr-lkp@intel.com/ Cc: Ville Syrjälä Cc: Uma Shankar Signed-off-by: heminhong Reviewed-by: Jani Nikula Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20231114024341.14524-1-heminhong@kylinos.cn (cherry picked from commit ef32c3cc9c62252986f09e06b4e525742cd91529) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/intel_dsb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit dd7eb65c493615fda7d459501c3d4a46e00ea5ba Author: Ville Syrjälä Date: Mon Nov 27 16:50:27 2023 +0200 drm/i915/mst: Reject modes that require the bigjoiner We have no bigjoiner support in the MST code, so .mode_valid() pretending otherwise is just going to result black screens for users. Reject any mode that needs the joiner. Cc: stable@vger.kernel.org Cc: Stanislav Lisovskiy Fixes: d51f25eb479a ("drm/i915: Add DSC support to MST path") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20231127145028.4899-3-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit 9c058492b16f90bb772cb0dad567e8acc68e155d) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/intel_dp_mst.c | 4 ++++ 1 file changed, 4 insertions(+) commit 7cf82b25dd91d7f330d9df2de868caca14289ba1 Author: Ville Syrjälä Date: Mon Nov 27 16:50:26 2023 +0200 drm/i915/mst: Fix .mode_valid_ctx() return values .mode_valid_ctx() returns an errno, not the mode status. Fix the code to do the right thing. Cc: stable@vger.kernel.org Cc: Stanislav Lisovskiy Fixes: d51f25eb479a ("drm/i915: Add DSC support to MST path") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20231127145028.4899-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit c1799032d2ef6616113b733428dfaa2199a5604b) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/intel_dp_mst.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 20c2dbff342aec13bf93c2f6c951da198916a455 Author: Ville Syrjälä Date: Mon Nov 27 16:50:25 2023 +0200 drm/i915: Skip some timing checks on BXT/GLK DSI transcoders Apparently some BXT/GLK systems have DSI panels whose timings don't agree with the normal cpu transcoder hblank>=32 limitation. This is perhaps fine as there are no specific hblank/etc. limits listed for the BXT/GLK DSI transcoders. Move those checks out from the global intel_mode_valid() into into connector specific .mode_valid() hooks, skipping BXT/GLK DSI connectors. We'll leave the basic [hv]display/[hv]total checks in intel_mode_valid() as those seem like sensible upper limits regardless of the transcoder used. Cc: stable@vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/9720 Fixes: 8f4b1068e7fc ("drm/i915: Check some transcoder timing minimum limits") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20231127145028.4899-1-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit e0ef2daa8ca8ce4dbc2fd0959e383b753a87fd7d) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/icl_dsi.c | 7 +++++++ drivers/gpu/drm/i915/display/intel_crt.c | 5 +++++ drivers/gpu/drm/i915/display/intel_display.c | 10 ++++++++++ drivers/gpu/drm/i915/display/intel_display.h | 3 +++ drivers/gpu/drm/i915/display/intel_dp.c | 4 ++++ drivers/gpu/drm/i915/display/intel_dp_mst.c | 4 ++++ drivers/gpu/drm/i915/display/intel_dvo.c | 6 ++++++ drivers/gpu/drm/i915/display/intel_hdmi.c | 4 ++++ drivers/gpu/drm/i915/display/intel_lvds.c | 5 +++++ drivers/gpu/drm/i915/display/intel_sdvo.c | 8 +++++++- drivers/gpu/drm/i915/display/intel_tv.c | 8 +++++++- drivers/gpu/drm/i915/display/vlv_dsi.c | 18 +++++++++++++++++- 12 files changed, 79 insertions(+), 3 deletions(-) commit 209043cf092d7b0d4739921b3f11d6d0b451eabf Author: Nathan Rossi Date: Mon Nov 6 02:14:36 2023 +0000 arm64: dts: imx8mp: imx8mq: Add parkmode-disable-ss-quirk on DWC3 The i.MX8MP and i.MX8MQ devices both use the same DWC3 controller and are both affected by a known issue with the controller due to specific behaviour when park mode is enabled in SuperSpeed host mode operation. Under heavy USB traffic from multiple endpoints the controller will sometimes incorrectly process transactions such that some transactions are lost, or the controller may hang when processing transactions. When the controller hangs it does not recover. This issue is documented partially within the linux-imx vendor kernel which references a Synopsys STAR number 9001415732 in commits [1] and additional details in [2]. Those commits provide some additional controller internal implementation specifics around the incorrect behaviour of the SuperSpeed host controller operation when park mode is enabled. The summary of this issue is that the host controller can incorrectly enter/exit park mode such that part of the controller is in a state which behaves as if in park mode even though it is not. In this state the controller incorrectly calculates the number of TRBs available which results in incorrect access of the internal caches causing the overwrite of pending requests in the cache which should have been processed but are ignored. This can cause the controller to drop the requests or hang waiting for the pending state of the dropped requests. The workaround for this issue is to disable park mode for SuperSpeed operation of the controller through the GUCTL1[17] bit. This is already available as a quirk for the DWC3 controller and can be enabled via the 'snps,parkmode-disable-ss-quirk' device tree property. It is possible to replicate this failure on an i.MX8MP EVK with a USB Hub connecting 4 SuperSpeed USB flash drives. Performing continuous small read operations (dd if=/dev/sd... of=/dev/null bs=16) on the block devices will result in device errors initially and will eventually result in the controller hanging. [13240.896936] xhci-hcd xhci-hcd.0.auto: WARN Event TRB for slot 4 ep 2 with no TDs queued? [13240.990708] usb 2-1.3: reset SuperSpeed USB device number 5 using xhci-hcd [13241.015582] sd 2:0:0:0: [sdc] tag#0 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s [13241.025198] sd 2:0:0:0: [sdc] tag#0 CDB: opcode=0x28 28 00 00 00 03 e0 00 01 00 00 [13241.032949] I/O error, dev sdc, sector 992 op 0x0:(READ) flags 0x80700 phys_seg 25 prio class 2 [13272.150710] usb 2-1.2: reset SuperSpeed USB device number 4 using xhci-hcd [13272.175469] sd 1:0:0:0: [sdb] tag#0 UNKNOWN(0x2003) Result: hostbyte=0x03 driverbyte=DRIVER_OK cmd_age=31s [13272.185365] sd 1:0:0:0: [sdb] tag#0 CDB: opcode=0x28 28 00 00 00 03 e0 00 01 00 00 [13272.193385] I/O error, dev sdb, sector 992 op 0x0:(READ) flags 0x80700 phys_seg 18 prio class 2 [13434.846556] xhci-hcd xhci-hcd.0.auto: xHCI host not responding to stop endpoint command [13434.854592] xhci-hcd xhci-hcd.0.auto: xHCI host controller not responding, assume dead [13434.862553] xhci-hcd xhci-hcd.0.auto: HC died; cleaning up [1] https://github.com/nxp-imx/linux-imx/commit/97a5349d936b08cf301730b59e4e8855283f815c [2] https://github.com/nxp-imx/linux-imx/commit/b4b5cbc5a12d7c3b920d1d7cba0ada3379e4e42b Fixes: fb8587a2c165 ("arm64: dtsi: imx8mp: add usb nodes") Fixes: ad37549cb5dc ("arm64: dts: imx8mq: add USB nodes") Signed-off-by: Nathan Rossi Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 ++ arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 ++ 2 files changed, 4 insertions(+) commit 26513300978f7285c3e776c144f27ef71be61f57 Author: Arnd Bergmann Date: Mon Dec 4 08:27:36 2023 +0100 drm/bridge: tc358768: select CONFIG_VIDEOMODE_HELPERS A dependency on this feature was recently introduced: x86_64-linux-ld: vmlinux.o: in function `tc358768_bridge_pre_enable': tc358768.c:(.text+0xbe3dae): undefined reference to `drm_display_mode_to_videomode' Make sure this is always enabled. Fixes: e5fb21678136 ("drm/bridge: tc358768: Use struct videomode") Signed-off-by: Arnd Bergmann Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20231204072814.968816-1-arnd@kernel.org Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20231204072814.968816-1-arnd@kernel.org drivers/gpu/drm/bridge/Kconfig | 1 + 1 file changed, 1 insertion(+) commit ca4ef28d0ad831d2521fa2b16952f37fd9324ca3 Author: Dan Carpenter Date: Fri Nov 3 09:36:20 2023 +0300 net/mlx5: Fix a NULL vs IS_ERR() check The mlx5_esw_offloads_devlink_port() function returns error pointers, not NULL. Fixes: 7bef147a6ab6 ("net/mlx5: Don't skip vport check") Signed-off-by: Dan Carpenter Reviewed-by: Wojciech Drewek Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7aaf975238c47b710fcc4eca0da1e7902a53abe2 Author: Gavin Li Date: Thu Aug 31 05:47:09 2023 +0300 net/mlx5e: Check netdev pointer before checking its net ns Previously, when comparing the net namespaces, the case where the netdev doesn't exist wasn't taken into account, and therefore can cause a crash. In such a case, the comparing function should return false, as there is no netdev->net to compare the devlink->net to. Furthermore, this will result in an attempt to enter switchdev mode without a netdev to fail, and which is the desired result as there is no meaning in switchdev mode without a net device. Fixes: 662404b24a4c ("net/mlx5e: Block entering switchdev mode with ns inconsistency") Signed-off-by: Gavin Li Reviewed-by: Gavi Teitz Signed-off-by: Saeed Mahameed .../net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) commit 3d7a3f2612d75de5f371a681038b089ded6667eb Author: Moshe Shemesh Date: Mon Aug 7 13:11:32 2023 +0300 net/mlx5: Nack sync reset request when HotPlug is enabled Current sync reset flow is not supported when PCIe bridge connected directly to mlx5 device has HotPlug interrupt enabled and can be triggered on link state change event. Return nack on reset request in such case. Fixes: 92501fa6e421 ("net/mlx5: Ack on sync_reset_request only if PF can do reset_now") Signed-off-by: Moshe Shemesh Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 29 ++++++++++++++++++++++ 1 file changed, 29 insertions(+) commit ccbe33003b109f14c4dde2a4fca9c2a50c423601 Author: Chris Mi Date: Mon Sep 11 13:28:10 2023 +0300 net/mlx5e: TC, Don't offload post action rule if not supported If post action is not supported, eg. ignore_flow_level is not supported, don't offload post action rule. Otherwise, will hit panic [1]. Fix it by checking if post action table is valid or not. [1] [445537.863880] BUG: unable to handle page fault for address: ffffffffffffffb1 [445537.864617] #PF: supervisor read access in kernel mode [445537.865244] #PF: error_code(0x0000) - not-present page [445537.865860] PGD 70683a067 P4D 70683a067 PUD 70683c067 PMD 0 [445537.866497] Oops: 0000 [#1] PREEMPT SMP NOPTI [445537.867077] CPU: 19 PID: 248742 Comm: tc Kdump: loaded Tainted: G O 6.5.0+ #1 [445537.867888] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [445537.868834] RIP: 0010:mlx5e_tc_post_act_add+0x51/0x130 [mlx5_core] [445537.869635] Code: c0 0d 00 00 e8 20 96 c6 d3 48 85 c0 0f 84 e5 00 00 00 c7 83 b0 01 00 00 00 00 00 00 49 89 c5 31 c0 31 d2 66 89 83 b4 01 00 00 <49> 8b 44 24 10 83 23 df 83 8b d8 01 00 00 04 48 89 83 c0 01 00 00 [445537.871318] RSP: 0018:ffffb98741cef428 EFLAGS: 00010246 [445537.871962] RAX: 0000000000000000 RBX: ffff8df341167000 RCX: 0000000000000001 [445537.872704] RDX: 0000000000000000 RSI: ffffffff954844e1 RDI: ffffffff9546e9cb [445537.873430] RBP: ffffb98741cef448 R08: 0000000000000020 R09: 0000000000000246 [445537.874160] R10: 0000000000000000 R11: ffffffff943f73ff R12: ffffffffffffffa1 [445537.874893] R13: ffff8df36d336c20 R14: ffffffffffffffa1 R15: ffff8df341167000 [445537.875628] FS: 00007fcd6564f800(0000) GS:ffff8dfa9ea00000(0000) knlGS:0000000000000000 [445537.876425] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [445537.877090] CR2: ffffffffffffffb1 CR3: 00000003b5884001 CR4: 0000000000770ee0 [445537.877832] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [445537.878564] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [445537.879300] PKRU: 55555554 [445537.879797] Call Trace: [445537.880263] [445537.880713] ? show_regs+0x6e/0x80 [445537.881232] ? __die+0x29/0x70 [445537.881731] ? page_fault_oops+0x85/0x160 [445537.882276] ? search_exception_tables+0x65/0x70 [445537.882852] ? kernelmode_fixup_or_oops+0xa2/0x120 [445537.883432] ? __bad_area_nosemaphore+0x18b/0x250 [445537.884019] ? bad_area_nosemaphore+0x16/0x20 [445537.884566] ? do_kern_addr_fault+0x8b/0xa0 [445537.885105] ? exc_page_fault+0xf5/0x1c0 [445537.885623] ? asm_exc_page_fault+0x2b/0x30 [445537.886149] ? __kmem_cache_alloc_node+0x1df/0x2a0 [445537.886717] ? mlx5e_tc_post_act_add+0x51/0x130 [mlx5_core] [445537.887431] ? mlx5e_tc_post_act_add+0x30/0x130 [mlx5_core] [445537.888172] alloc_flow_post_acts+0xfb/0x1c0 [mlx5_core] [445537.888849] parse_tc_actions+0x582/0x5c0 [mlx5_core] [445537.889505] parse_tc_fdb_actions+0xd7/0x1f0 [mlx5_core] [445537.890175] __mlx5e_add_fdb_flow+0x1ab/0x2b0 [mlx5_core] [445537.890843] mlx5e_add_fdb_flow+0x56/0x120 [mlx5_core] [445537.891491] ? debug_smp_processor_id+0x1b/0x30 [445537.892037] mlx5e_tc_add_flow+0x79/0x90 [mlx5_core] [445537.892676] mlx5e_configure_flower+0x305/0x450 [mlx5_core] [445537.893341] mlx5e_rep_setup_tc_cls_flower+0x3d/0x80 [mlx5_core] [445537.894037] mlx5e_rep_setup_tc_cb+0x5c/0xa0 [mlx5_core] [445537.894693] tc_setup_cb_add+0xdc/0x220 [445537.895177] fl_hw_replace_filter+0x15f/0x220 [cls_flower] [445537.895767] fl_change+0xe87/0x1190 [cls_flower] [445537.896302] tc_new_tfilter+0x484/0xa50 Fixes: f0da4daa3413 ("net/mlx5e: Refactor ct to use post action infrastructure") Signed-off-by: Chris Mi Reviewed-by: Jianbo Liu Signed-off-by: Saeed Mahameed Reviewed-by: Automatic Verification Reviewed-by: Maher Sanalla Reviewed-by: Shay Drory Reviewed-by: Moshe Shemesh Reviewed-by: Shachar Kagan Reviewed-by: Tariq Toukan .../ethernet/mellanox/mlx5/core/en/tc/post_act.c | 6 ++++++ drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 25 ++++++++++++++++++---- 2 files changed, 27 insertions(+), 4 deletions(-) commit eab0da38912ebdad922ed0388209f7eb0a5163cd Author: Moshe Shemesh Date: Wed Sep 21 18:45:11 2022 +0300 net/mlx5e: Fix possible deadlock on mlx5e_tx_timeout_work Due to the cited patch, devlink health commands take devlink lock and this may result in deadlock for mlx5e_tx_reporter as it takes local state_lock before calling devlink health report and on the other hand devlink health commands such as diagnose for same reporter take local state_lock after taking devlink lock (see kernel log below). To fix it, remove local state_lock from mlx5e_tx_timeout_work() before calling devlink_health_report() and take care to cancel the work before any call to close channels, which may free the SQs that should be handled by the work. Before cancel_work_sync(), use current_work() to check we are not calling it from within the work, as mlx5e_tx_timeout_work() itself may close the channels and reopen as part of recovery flow. While removing state_lock from mlx5e_tx_timeout_work() keep rtnl_lock to ensure no change in netdev->real_num_tx_queues, but use rtnl_trylock() and a flag to avoid deadlock by calling cancel_work_sync() before closing the channels while holding rtnl_lock too. Kernel log: ====================================================== WARNING: possible circular locking dependency detected 6.0.0-rc3_for_upstream_debug_2022_08_30_13_10 #1 Not tainted ------------------------------------------------------ kworker/u16:2/65 is trying to acquire lock: ffff888122f6c2f8 (&devlink->lock_key#2){+.+.}-{3:3}, at: devlink_health_report+0x2f1/0x7e0 but task is already holding lock: ffff888121d20be0 (&priv->state_lock){+.+.}-{3:3}, at: mlx5e_tx_timeout_work+0x70/0x280 [mlx5_core] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&priv->state_lock){+.+.}-{3:3}: __mutex_lock+0x12c/0x14b0 mlx5e_rx_reporter_diagnose+0x71/0x700 [mlx5_core] devlink_nl_cmd_health_reporter_diagnose_doit+0x212/0xa50 genl_family_rcv_msg_doit+0x1e9/0x2f0 genl_rcv_msg+0x2e9/0x530 netlink_rcv_skb+0x11d/0x340 genl_rcv+0x24/0x40 netlink_unicast+0x438/0x710 netlink_sendmsg+0x788/0xc40 sock_sendmsg+0xb0/0xe0 __sys_sendto+0x1c1/0x290 __x64_sys_sendto+0xdd/0x1b0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 -> #0 (&devlink->lock_key#2){+.+.}-{3:3}: __lock_acquire+0x2c8a/0x6200 lock_acquire+0x1c1/0x550 __mutex_lock+0x12c/0x14b0 devlink_health_report+0x2f1/0x7e0 mlx5e_health_report+0xc9/0xd7 [mlx5_core] mlx5e_reporter_tx_timeout+0x2ab/0x3d0 [mlx5_core] mlx5e_tx_timeout_work+0x1c1/0x280 [mlx5_core] process_one_work+0x7c2/0x1340 worker_thread+0x59d/0xec0 kthread+0x28f/0x330 ret_from_fork+0x1f/0x30 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&priv->state_lock); lock(&devlink->lock_key#2); lock(&priv->state_lock); lock(&devlink->lock_key#2); *** DEADLOCK *** 4 locks held by kworker/u16:2/65: #0: ffff88811a55b138 ((wq_completion)mlx5e#2){+.+.}-{0:0}, at: process_one_work+0x6e2/0x1340 #1: ffff888101de7db8 ((work_completion)(&priv->tx_timeout_work)){+.+.}-{0:0}, at: process_one_work+0x70f/0x1340 #2: ffffffff84ce8328 (rtnl_mutex){+.+.}-{3:3}, at: mlx5e_tx_timeout_work+0x53/0x280 [mlx5_core] #3: ffff888121d20be0 (&priv->state_lock){+.+.}-{3:3}, at: mlx5e_tx_timeout_work+0x70/0x280 [mlx5_core] stack backtrace: CPU: 1 PID: 65 Comm: kworker/u16:2 Not tainted 6.0.0-rc3_for_upstream_debug_2022_08_30_13_10 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5e mlx5e_tx_timeout_work [mlx5_core] Call Trace: dump_stack_lvl+0x57/0x7d check_noncircular+0x278/0x300 ? print_circular_bug+0x460/0x460 ? find_held_lock+0x2d/0x110 ? __stack_depot_save+0x24c/0x520 ? alloc_chain_hlocks+0x228/0x700 __lock_acquire+0x2c8a/0x6200 ? register_lock_class+0x1860/0x1860 ? kasan_save_stack+0x1e/0x40 ? kasan_set_free_info+0x20/0x30 ? ____kasan_slab_free+0x11d/0x1b0 ? kfree+0x1ba/0x520 ? devlink_health_do_dump.part.0+0x171/0x3a0 ? devlink_health_report+0x3d5/0x7e0 lock_acquire+0x1c1/0x550 ? devlink_health_report+0x2f1/0x7e0 ? lockdep_hardirqs_on_prepare+0x400/0x400 ? find_held_lock+0x2d/0x110 __mutex_lock+0x12c/0x14b0 ? devlink_health_report+0x2f1/0x7e0 ? devlink_health_report+0x2f1/0x7e0 ? mutex_lock_io_nested+0x1320/0x1320 ? trace_hardirqs_on+0x2d/0x100 ? bit_wait_io_timeout+0x170/0x170 ? devlink_health_do_dump.part.0+0x171/0x3a0 ? kfree+0x1ba/0x520 ? devlink_health_do_dump.part.0+0x171/0x3a0 devlink_health_report+0x2f1/0x7e0 mlx5e_health_report+0xc9/0xd7 [mlx5_core] mlx5e_reporter_tx_timeout+0x2ab/0x3d0 [mlx5_core] ? lockdep_hardirqs_on_prepare+0x400/0x400 ? mlx5e_reporter_tx_err_cqe+0x1b0/0x1b0 [mlx5_core] ? mlx5e_tx_reporter_timeout_dump+0x70/0x70 [mlx5_core] ? mlx5e_tx_reporter_dump_sq+0x320/0x320 [mlx5_core] ? mlx5e_tx_timeout_work+0x70/0x280 [mlx5_core] ? mutex_lock_io_nested+0x1320/0x1320 ? process_one_work+0x70f/0x1340 ? lockdep_hardirqs_on_prepare+0x400/0x400 ? lock_downgrade+0x6e0/0x6e0 mlx5e_tx_timeout_work+0x1c1/0x280 [mlx5_core] process_one_work+0x7c2/0x1340 ? lockdep_hardirqs_on_prepare+0x400/0x400 ? pwq_dec_nr_in_flight+0x230/0x230 ? rwlock_bug.part.0+0x90/0x90 worker_thread+0x59d/0xec0 ? process_one_work+0x1340/0x1340 kthread+0x28f/0x330 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 Fixes: c90005b5f75c ("devlink: Hold the instance lock in health callbacks") Signed-off-by: Moshe Shemesh Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 27 ++++++++++++++++++++--- 2 files changed, 25 insertions(+), 3 deletions(-) commit 762a55a54eec4217e4cec9265ab6e5d4c11b61bd Author: Chris Mi Date: Mon Oct 30 15:44:47 2023 +0200 net/mlx5e: Disable IPsec offload support if not FW steering IPsec FDB offload can only work with FW steering as of now, disable the cap upon non FW steering. And since the IPSec cap is dynamic now based on steering mode. Cleanup the resources if they exist instead of checking the IPsec cap again. Fixes: edd8b295f9e2 ("Merge branch 'mlx5-ipsec-packet-offload-support-in-eswitch-mode'") Signed-off-by: Chris Mi Signed-off-by: Leon Romanovsky .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 26 +++++++++------------- .../mellanox/mlx5/core/en_accel/ipsec_offload.c | 8 ++++++- 2 files changed, 18 insertions(+), 16 deletions(-) commit 4e25b661f484df54b6751b65f9ea2434a3b67539 Author: Jianbo Liu Date: Thu Oct 12 02:00:44 2023 +0000 net/mlx5e: Check the number of elements before walk TC rhashtable After IPSec TX tables are destroyed, the flow rules in TC rhashtable, which have the destination to IPSec, are restored to the original one, the uplink. However, when the device is in switchdev mode and unload driver with IPSec rules configured, TC rhashtable cleanup is done before IPSec cleanup, which means tc_ht->tbl is already freed when walking TC rhashtable, in order to restore the destination. So add the checking before walking to avoid unexpected behavior. Fixes: d1569537a837 ("net/mlx5e: Modify and restore TC rules for IPSec TX rules") Signed-off-by: Jianbo Liu Signed-off-by: Leon Romanovsky drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit baac8351f74c543896b8fd40138b7ad9365587a3 Author: Jianbo Liu Date: Wed Oct 11 03:38:29 2023 +0000 net/mlx5e: Reduce eswitch mode_lock protection context Currently eswitch mode_lock is so heavy, for example, it's locked during the whole process of the mode change, which may need to hold other locks. As the mode_lock is also used by IPSec to block mode and encap change now, it is easy to cause lock dependency. Since some of protections are also done by devlink lock, the eswitch mode_lock is not needed at those places, and thus the possibility of lockdep issue is reduced. Fixes: c8e350e62fc5 ("net/mlx5e: Make TC and IPsec offloads mutually exclusive on a netdev") Signed-off-by: Jianbo Liu Signed-off-by: Leon Romanovsky .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 9 +++-- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 35 ++++++++++++-------- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 2 ++ .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 38 +++++++++++++--------- 4 files changed, 52 insertions(+), 32 deletions(-) commit c2bf84f1d1a1595dcc45fe867f0e02b331993fee Author: Leon Romanovsky Date: Sun Nov 12 13:50:00 2023 +0200 net/mlx5e: Tidy up IPsec NAT-T SA discovery IPsec NAT-T packets are UDP encapsulated packets over ESP normal ones. In case they arrive to RX, the SPI and ESP are located in inner header, while the check was performed on outer header instead. That wrong check caused to the situation where received rekeying request was missed and caused to rekey timeout, which "compensated" this failure by completing rekeying. Fixes: d65954934937 ("net/mlx5e: Support IPsec NAT-T functionality") Signed-off-by: Leon Romanovsky .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 22 ++++++++++++++++------ include/linux/mlx5/mlx5_ifc.h | 2 +- 2 files changed, 17 insertions(+), 7 deletions(-) commit dddb49b63d8683be81cff220b94a0196c1367b74 Author: Patrisious Haddad Date: Sun Sep 24 11:50:31 2023 +0300 net/mlx5e: Add IPsec and ASO syndromes check in HW After IPsec decryption it isn't enough to only check the IPsec syndrome but need to also check the ASO syndrome in order to verify that the operation was actually successful. Verify that both syndromes are actually zero and in case not drop the packet and increment the appropriate flow counter for the drop reason. Fixes: 6b5c45e16e43 ("net/mlx5e: Configure IPsec packet offload flow steering") Signed-off-by: Patrisious Haddad Signed-off-by: Leon Romanovsky .../ethernet/mellanox/mlx5/core/en_accel/ipsec.h | 8 + .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 235 +++++++++++++++++++-- 2 files changed, 223 insertions(+), 20 deletions(-) commit 5ad00dee43b98129b86930d457b983d4d04dc553 Author: Leon Romanovsky Date: Tue Oct 3 16:44:19 2023 +0300 net/mlx5e: Remove exposure of IPsec RX flow steering struct After previous commit, which unified various IPsec creation modes, there is no need to have struct mlx5e_ipsec_rx exposed in global IPsec header. Move it to ipsec_fs.c to be placed together with already existing struct mlx5e_ipsec_tx. Fixes: 1762f132d542 ("net/mlx5e: Support IPsec packet offload for RX in switchdev mode") Signed-off-by: Leon Romanovsky drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h | 14 +------------- .../net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c | 16 ++++++++++++++-- drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c | 8 ++++---- 3 files changed, 19 insertions(+), 19 deletions(-) commit 94af50c0a9bb961fe93cf0fdd14eb0883da86721 Author: Patrisious Haddad Date: Thu Sep 21 14:06:18 2023 +0300 net/mlx5e: Unify esw and normal IPsec status table creation/destruction Change normal IPsec flow to use the same creation/destruction functions for status flow table as that of ESW, which first of all refines the code to have less code duplication. And more importantly, the ESW status table handles IPsec syndrome checks at steering by HW, which is more efficient than the previous behaviour we had where it was copied to WQE meta data and checked by the driver. Fixes: 1762f132d542 ("net/mlx5e: Support IPsec packet offload for RX in switchdev mode") Signed-off-by: Patrisious Haddad Signed-off-by: Leon Romanovsky .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 187 ++++++++++++++++----- .../net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c | 152 ----------------- .../net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.h | 15 -- 3 files changed, 141 insertions(+), 213 deletions(-) commit 3d42c8cc67a8fcbff0181f9ed6d03d353edcee07 Author: Leon Romanovsky Date: Wed Sep 20 10:07:13 2023 +0300 net/mlx5e: Ensure that IPsec sequence packet number starts from 1 According to RFC4303, section "3.3.3. Sequence Number Generation", the first packet sent using a given SA will contain a sequence number of 1. However if user didn't set seq/oseq, the HW used zero as first sequence packet number. Such misconfiguration causes to drop of first packet if replay window protection was enabled in SA. To fix it, set sequence number to be at least 1. Fixes: 7db21ef4566e ("net/mlx5e: Set IPsec replay sequence numbers") Signed-off-by: Leon Romanovsky drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit a5e400a985df8041ed4659ed1462aa9134318130 Author: Leon Romanovsky Date: Sun Aug 20 20:58:56 2023 +0300 net/mlx5e: Honor user choice of IPsec replay window size Users can configure IPsec replay window size, but mlx5 driver didn't honor their choice and set always 32bits. Fix assignment logic to configure right size from the beginning. Fixes: 7db21ef4566e ("net/mlx5e: Set IPsec replay sequence numbers") Reviewed-by: Patrisious Haddad Signed-off-by: Leon Romanovsky .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 21 +++++++++++++++++++++ .../mellanox/mlx5/core/en_accel/ipsec_offload.c | 2 +- include/linux/mlx5/mlx5_ifc.h | 7 +++++++ 3 files changed, 29 insertions(+), 1 deletion(-) commit 4b3338aaa74d7d4ec5b6734dc298f0db94ec83d2 Author: Naveen N Rao Date: Thu Nov 30 12:29:47 2023 +0530 powerpc/ftrace: Fix stack teardown in ftrace_no_trace Commit 41a506ef71eb ("powerpc/ftrace: Create a dummy stackframe to fix stack unwind") added use of a new stack frame on ftrace entry to fix stack unwind. However, the commit missed updating the offset used while tearing down the ftrace stack when ftrace is disabled. Fix the same. In addition, the commit missed saving the correct stack pointer in pt_regs. Update the same. Fixes: 41a506ef71eb ("powerpc/ftrace: Create a dummy stackframe to fix stack unwind") Cc: stable@vger.kernel.org # v6.5+ Signed-off-by: Naveen N Rao Signed-off-by: Michael Ellerman Link: https://msgid.link/20231130065947.2188860-1-naveen@kernel.org arch/powerpc/kernel/trace/ftrace_entry.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 37e4b8df27bc68340f3fc80dbb27e3549c7f881c Author: Jianheng Zhang Date: Fri Dec 1 03:22:03 2023 +0000 net: stmmac: fix FPE events losing The status bits of register MAC_FPE_CTRL_STS are clear on read. Using 32-bit read for MAC_FPE_CTRL_STS in dwmac5_fpe_configure() and dwmac5_fpe_send_mpacket() clear the status bits. Then the stmmac interrupt handler missing FPE event status and leads to FPE handshaking failure and retries. To avoid clear status bits of MAC_FPE_CTRL_STS in dwmac5_fpe_configure() and dwmac5_fpe_send_mpacket(), add fpe_csr to stmmac_fpe_cfg structure to cache the control bits of MAC_FPE_CTRL_STS and to avoid reading MAC_FPE_CTRL_STS in those methods. Fixes: 5a5586112b92 ("net: stmmac: support FPE link partner hand-shaking procedure") Reviewed-by: Serge Semin Signed-off-by: Jianheng Zhang Link: https://lore.kernel.org/r/CY5PR12MB637225A7CF529D5BE0FBE59CBF81A@CY5PR12MB6372.namprd12.prod.outlook.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 45 +++++++++------------- drivers/net/ethernet/stmicro/stmmac/dwmac5.h | 4 +- .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 3 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 4 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 8 +++- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 1 + include/linux/stmmac.h | 1 + 7 files changed, 36 insertions(+), 30 deletions(-) commit adbf100fc47001c93d7e513ecac6fd6e04d5b4a1 Author: Naveen Mamindlapalli Date: Fri Dec 1 11:03:30 2023 +0530 octeontx2-pf: consider both Rx and Tx packet stats for adaptive interrupt coalescing The current adaptive interrupt coalescing code updates only rx packet stats for dim algorithm. This patch also updates tx packet stats which will be useful when there is only tx traffic. Also moved configuring hardware adaptive interrupt setting to driver dim callback. Fixes: 6e144b47f560 ("octeontx2-pf: Add support for adaptive interrupt coalescing") Signed-off-by: Naveen Mamindlapalli Signed-off-by: Suman Ghosh Reviewed-by: Wojciech Drewek Link: https://lore.kernel.org/r/20231201053330.3903694-1-sumang@marvell.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 9 +++++++++ .../net/ethernet/marvell/octeontx2/nic/otx2_txrx.c | 20 ++++++++++---------- 2 files changed, 19 insertions(+), 10 deletions(-) commit 33924328498e903bea74727353e5012d29653aff Merge: 33cc938e65a9 96d7e7940136 Author: Dave Airlie Date: Tue Dec 5 12:19:21 2023 +1000 Merge tag 'drm-intel-fixes-2023-12-01-1' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v6.7-rc4 #2: - d21a3962d304 ("drm/i915: Call intel_pre_plane_updates() also for pipes getting enabled") in the previous fixes pull depends on a change that wasn't included. Pick it up. Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87fs0m48ol.fsf@intel.com commit 6b17a597fc2f13aaaa0a2780eb7edb9ae7ac9aea Author: Thomas Reichinger Date: Thu Nov 30 12:35:03 2023 +0100 arcnet: restoring support for multiple Sohard Arcnet cards Probe of Sohard Arcnet cards fails, if 2 or more cards are installed in a system. See kernel log: [ 2.759203] arcnet: arcnet loaded [ 2.763648] arcnet:com20020: COM20020 chipset support (by David Woodhouse et al.) [ 2.770585] arcnet:com20020_pci: COM20020 PCI support [ 2.772295] com20020 0000:02:00.0: enabling device (0000 -> 0003) [ 2.772354] (unnamed net_device) (uninitialized): PLX-PCI Controls ... [ 3.071301] com20020 0000:02:00.0 arc0-0 (uninitialized): PCI COM20020: station FFh found at F080h, IRQ 101. [ 3.071305] com20020 0000:02:00.0 arc0-0 (uninitialized): Using CKP 64 - data rate 2.5 Mb/s [ 3.071534] com20020 0000:07:00.0: enabling device (0000 -> 0003) [ 3.071581] (unnamed net_device) (uninitialized): PLX-PCI Controls ... [ 3.369501] com20020 0000:07:00.0: Led pci:green:tx:0-0 renamed to pci:green:tx:0-0_1 due to name collision [ 3.369535] com20020 0000:07:00.0: Led pci:red:recon:0-0 renamed to pci:red:recon:0-0_1 due to name collision [ 3.370586] com20020 0000:07:00.0 arc0-0 (uninitialized): PCI COM20020: station E1h found at C000h, IRQ 35. [ 3.370589] com20020 0000:07:00.0 arc0-0 (uninitialized): Using CKP 64 - data rate 2.5 Mb/s [ 3.370608] com20020: probe of 0000:07:00.0 failed with error -5 commit 5ef216c1f848 ("arcnet: com20020-pci: add rotary index support") changes the device name of all COM20020 based PCI cards, even if only some cards support this: snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i); The error happens because all Sohard Arcnet cards would be called arc0-0, since the Sohard Arcnet cards don't have a PLX rotary coder. I.e. EAE Arcnet cards have a PLX rotary coder, which sets the first decimal, ensuring unique devices names. This patch adds two new card feature flags to indicate which cards support LEDs and the PLX rotary coder. For EAE based cards the names still depend on the PLX rotary coder (untested, since missing EAE hardware). For Sohard based cards, this patch will result in devices being called arc0, arc1, ... (tested). Signed-off-by: Thomas Reichinger Fixes: 5ef216c1f848 ("arcnet: com20020-pci: add rotary index support") Link: https://lore.kernel.org/r/20231130113503.6812-1-thomas.reichinger@sohard.de Signed-off-by: Jakub Kicinski drivers/net/arcnet/arcdevice.h | 2 + drivers/net/arcnet/com20020-pci.c | 89 ++++++++++++++++++++------------------- 2 files changed, 48 insertions(+), 43 deletions(-) commit 659aa050a53817157b7459529538598a6449c1d3 Author: Alison Schofield Date: Mon Nov 13 14:13:24 2023 -0800 kernel/resource: Increment by align value in get_free_mem_region() Currently get_free_mem_region() searches for available capacity in increments equal to the region size being requested. This can cause the search to take giant steps through the resource leaving needless gaps and missing available space. Specifically 'cxl create-region' fails with ERANGE even though capacity of the given size and CXL's expected 256M x InterleaveWays alignment can be satisfied. Replace the total-request-size increment with a next alignment increment so that the next possible address is always examined for availability. Fixes: 14b80582c43e ("resource: Introduce alloc_free_mem_region()") Reported-by: Dmytro Adamenko Reported-by: Dan Williams Signed-off-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20231113221324.1118092-1-alison.schofield@intel.com Cc: Jason Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Dan Williams kernel/resource.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e05501e8a84eee4f819f31b9ce663bddd01b3b69 Author: Dave Jiang Date: Mon Nov 6 10:26:45 2023 -0700 cxl: Add cxl_num_decoders_committed() usage to cxl_test Commit 458ba8189cb4 ("cxl: Add cxl_decoders_committed() helper") missed the conversion for cxl_test. Add usage of cxl_num_decoders_committed() to replace the open coding. Suggested-by: Alison Schofield Signed-off-by: Dave Jiang Reviewed-by: Fan Ni Link: https://lore.kernel.org/r/169929160525.824083.11813222229025394254.stgit@djiang5-mobl3 Signed-off-by: Dan Williams tools/testing/cxl/Kbuild | 1 + tools/testing/cxl/cxl_core_exports.c | 7 +++++++ tools/testing/cxl/test/cxl.c | 5 +++-- 3 files changed, 11 insertions(+), 2 deletions(-) commit fcc9b50e5517f7d65cdc33d81f223b22536f863f Author: Greg Kroah-Hartman Date: Tue Dec 5 09:10:01 2023 +0900 Revert "greybus: gb-beagleplay: Ensure le for values in transport" This reverts commit 52eb67861ebeb2110318bd9fe33d85ddcf92aac7. Turns out to not be correct, a new version will be generated later. Link: https://lore.kernel.org/r/20231204131008.384583-1-ayushdevel1325@gmail.com Cc: Ayush Singh Signed-off-by: Greg Kroah-Hartman drivers/greybus/gb-beagleplay.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit e3e82fcb79eeb3f1a88a89f676831773caff514a Author: Shifeng Li Date: Thu Nov 30 00:14:15 2023 -0800 RDMA/irdma: Avoid free the non-cqp_request scratch When creating ceq_0 during probing irdma, cqp.sc_cqp will be sent as a cqp_request to cqp->sc_cqp.sq_ring. If the request is pending when removing the irdma driver or unplugging its aux device, cqp.sc_cqp will be dereferenced as wrong struct in irdma_free_pending_cqp_request(). PID: 3669 TASK: ffff88aef892c000 CPU: 28 COMMAND: "kworker/28:0" #0 [fffffe0000549e38] crash_nmi_callback at ffffffff810e3a34 #1 [fffffe0000549e40] nmi_handle at ffffffff810788b2 #2 [fffffe0000549ea0] default_do_nmi at ffffffff8107938f #3 [fffffe0000549eb8] do_nmi at ffffffff81079582 #4 [fffffe0000549ef0] end_repeat_nmi at ffffffff82e016b4 [exception RIP: native_queued_spin_lock_slowpath+1291] RIP: ffffffff8127e72b RSP: ffff88aa841ef778 RFLAGS: 00000046 RAX: 0000000000000000 RBX: ffff88b01f849700 RCX: ffffffff8127e47e RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff83857ec0 RBP: ffff88afe3e4efc8 R8: ffffed15fc7c9dfa R9: ffffed15fc7c9dfa R10: 0000000000000001 R11: ffffed15fc7c9df9 R12: 0000000000740000 R13: ffff88b01f849708 R14: 0000000000000003 R15: ffffed1603f092e1 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0000 -- -- #5 [ffff88aa841ef778] native_queued_spin_lock_slowpath at ffffffff8127e72b #6 [ffff88aa841ef7b0] _raw_spin_lock_irqsave at ffffffff82c22aa4 #7 [ffff88aa841ef7c8] __wake_up_common_lock at ffffffff81257363 #8 [ffff88aa841ef888] irdma_free_pending_cqp_request at ffffffffa0ba12cc [irdma] #9 [ffff88aa841ef958] irdma_cleanup_pending_cqp_op at ffffffffa0ba1469 [irdma] #10 [ffff88aa841ef9c0] irdma_ctrl_deinit_hw at ffffffffa0b2989f [irdma] #11 [ffff88aa841efa28] irdma_remove at ffffffffa0b252df [irdma] #12 [ffff88aa841efae8] auxiliary_bus_remove at ffffffff8219afdb #13 [ffff88aa841efb00] device_release_driver_internal at ffffffff821882e6 #14 [ffff88aa841efb38] bus_remove_device at ffffffff82184278 #15 [ffff88aa841efb88] device_del at ffffffff82179d23 #16 [ffff88aa841efc48] ice_unplug_aux_dev at ffffffffa0eb1c14 [ice] #17 [ffff88aa841efc68] ice_service_task at ffffffffa0d88201 [ice] #18 [ffff88aa841efde8] process_one_work at ffffffff811c589a #19 [ffff88aa841efe60] worker_thread at ffffffff811c71ff #20 [ffff88aa841eff10] kthread at ffffffff811d87a0 #21 [ffff88aa841eff50] ret_from_fork at ffffffff82e0022f Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions") Link: https://lore.kernel.org/r/20231130081415.891006-1-lishifeng@sangfor.com.cn Suggested-by: "Ismail, Mustafa" Signed-off-by: Shifeng Li Reviewed-by: Shiraz Saleem Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/irdma/hw.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 03769f72d66edab82484449ed594cb6b00ae0223 Author: Mike Marciniszyn Date: Wed Nov 29 14:21:43 2023 -0600 RDMA/irdma: Fix support for 64k pages Virtual QP and CQ require a 4K HW page size but the driver passes PAGE_SIZE to ib_umem_find_best_pgsz() instead. Fix this by using the appropriate 4k value in the bitmap passed to ib_umem_find_best_pgsz(). Fixes: 693a5386eff0 ("RDMA/irdma: Split mr alloc and free into new functions") Link: https://lore.kernel.org/r/20231129202143.1434-4-shiraz.saleem@intel.com Signed-off-by: Mike Marciniszyn Signed-off-by: Shiraz Saleem Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/irdma/verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0a5ec366de7e94192669ba08de6ed336607fd282 Author: Mike Marciniszyn Date: Wed Nov 29 14:21:42 2023 -0600 RDMA/irdma: Ensure iWarp QP queue memory is OS paged aligned The SQ is shared for between kernel and used by storing the kernel page pointer and passing that to a kmap_atomic(). This then requires that the alignment is PAGE_SIZE aligned. Fix by adding an iWarp specific alignment check. Fixes: e965ef0e7b2c ("RDMA/irdma: Split QP handler into irdma_reg_user_mr_type_qp") Link: https://lore.kernel.org/r/20231129202143.1434-3-shiraz.saleem@intel.com Signed-off-by: Mike Marciniszyn Signed-off-by: Shiraz Saleem Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/irdma/verbs.c | 5 +++++ 1 file changed, 5 insertions(+) commit 4fbc3a52cd4d14de3793f4b2c721d7306ea84cf9 Author: Mike Marciniszyn Date: Wed Nov 29 14:21:41 2023 -0600 RDMA/core: Fix umem iterator when PAGE_SIZE is greater then HCA pgsz 64k pages introduce the situation in this diagram when the HCA 4k page size is being used: +-------------------------------------------+ <--- 64k aligned VA | | | HCA 4k page | | | +-------------------------------------------+ | o | | | | o | | | | o | +-------------------------------------------+ | | | HCA 4k page | | | +-------------------------------------------+ <--- Live HCA page |OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO| <--- offset | | <--- VA | MR data | +-------------------------------------------+ | | | HCA 4k page | | | +-------------------------------------------+ | o | | | | o | | | | o | +-------------------------------------------+ | | | HCA 4k page | | | +-------------------------------------------+ The VA addresses are coming from rdma-core in this diagram can be arbitrary, but for 64k pages, the VA may be offset by some number of HCA 4k pages and followed by some number of HCA 4k pages. The current iterator doesn't account for either the preceding 4k pages or the following 4k pages. Fix the issue by extending the ib_block_iter to contain the number of DMA pages like comment [1] says and by using __sg_advance to start the iterator at the first live HCA page. The changes are contained in a parallel set of iterator start and next functions that are umem aware and specific to umem since there is one user of the rdma_for_each_block() without umem. These two fixes prevents the extra pages before and after the user MR data. Fix the preceding pages by using the __sq_advance field to start at the first 4k page containing MR data. Fix the following pages by saving the number of pgsz blocks in the iterator state and downcounting on each next. This fix allows for the elimination of the small page crutch noted in the Fixes. Fixes: 10c75ccb54e4 ("RDMA/umem: Prevent small pages from being returned by ib_umem_find_best_pgsz()") Link: https://lore.kernel.org/r/20231129202143.1434-2-shiraz.saleem@intel.com Signed-off-by: Mike Marciniszyn Signed-off-by: Shiraz Saleem Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe drivers/infiniband/core/umem.c | 6 ------ include/rdma/ib_umem.h | 9 ++++++++- include/rdma/ib_verbs.h | 1 + 3 files changed, 9 insertions(+), 7 deletions(-) commit db3fadacaf0c817b222090290d06ca2a338422d0 Author: Daniel Borkmann Date: Fri Dec 1 14:10:21 2023 +0100 packet: Move reference count in packet_sock to atomic_long_t In some potential instances the reference count on struct packet_sock could be saturated and cause overflows which gets the kernel a bit confused. To prevent this, move to a 64-bit atomic reference count on 64-bit architectures to prevent the possibility of this type to overflow. Because we can not handle saturation, using refcount_t is not possible in this place. Maybe someday in the future if it changes it could be used. Also, instead of using plain atomic64_t, use atomic_long_t instead. 32-bit machines tend to be memory-limited (i.e. anything that increases a reference uses so much memory that you can't actually get to 2**32 references). 32-bit architectures also tend to have serious problems with 64-bit atomics. Hence, atomic_long_t is the more natural solution. Reported-by: "The UK's National Cyber Security Centre (NCSC)" Co-developed-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman Signed-off-by: Daniel Borkmann Cc: Linus Torvalds Cc: stable@kernel.org Reviewed-by: Willem de Bruijn Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20231201131021.19999-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski net/packet/af_packet.c | 16 ++++++++-------- net/packet/internal.h | 2 +- 2 files changed, 9 insertions(+), 9 deletions(-) commit bee0e7762ad2c6025b9f5245c040fcc36ef2bde8 Merge: 1e535748449a 6f9c4d8c468c Author: Linus Torvalds Date: Tue Dec 5 06:54:52 2023 +0900 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd fixes from Jason Gunthorpe: - A small fix for the dirty tracking self test to fail correctly if the code is buggy - Fix a tricky syzkaller race UAF with object reference counting * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Do not UAF during iommufd_put_object() iommufd: Add iommufd_ctx to iommufd_put_object() iommufd/selftest: Fix _test_mock_dirty_bitmaps() commit 1e535748449a51842872c46db61525f7524fc63a Merge: 33cc938e65a9 cefc9ba6aed4 Author: Linus Torvalds Date: Tue Dec 5 06:51:43 2023 +0900 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull vdpa fixes from Michael Tsirkin: "Fixes in mlx5 and pds drivers" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: pds_vdpa: set features order pds_vdpa: clear config callback when status goes to 0 pds_vdpa: fix up format-truncation complaint vdpa/mlx5: preserve CVQ vringh index commit 0a10d15280a385e5971fb58a6d2eddbf7c0aa9f3 Merge: 29046a78a3c0 716d4e5373e9 Author: Mark Brown Date: Mon Dec 4 21:42:29 2023 +0000 ASoC: qcom: Limit Digital gains on speaker Merge series from srinivas.kandagatla@linaro.org: Limit the speaker digital gains to 0dB so that the users will not damage them. Currently there is a limit in UCM, but this does not stop the user form changing the digital gains from command line. So limit this in driver which makes the speakers more safer without active speaker protection in place. Apart from this there is also a range check fix in snd_soc_limit_volume to allow setting this limit correctly. Tested on Lenovo X13s. commit f88d811a238b12a261a04f125db952cf05c06d0b Author: Kent Overstreet Date: Sun Dec 3 13:05:21 2023 -0500 bcachefs: Don't run indirect extent trigger unless inserting/deleting This fixes a transaction path overflow reported in the snapshot deletion path, when moving extents to the correct snapshot. The root of the issue is that creating/deleting a reflink pointer can generate an unbounded number of updates, if it is allowed to reference an unbounded number of indirect extents; to prevent this, merging of reflink pointers has been disabled. But there's a hole, which is that copygc/rebalance may fragment existing extents in the course of moving them around, and if an indirect extent becomes too fragmented we'll then become unable to delete the reflink pointer. The eventual solution is going to be to tweak trigger handling so that we can process large reflink pointers incrementally when necessary, and notice that trigger updates don't need to be run for the part of the reflink pointer not changing. That is going to be a bigger project though, for another patch. Signed-off-by: Kent Overstreet fs/bcachefs/reflink.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit adcf4ee64291b701d083bacf653eb10a4c46acd7 Author: Kent Overstreet Date: Mon Dec 4 00:38:56 2023 -0500 bcachefs: Convert compression_stats to for_each_btree_key2 for_each_btree_key2() runs each loop iteration in a btree transaction, and thus does not cause SRCU lock hold time problems. Signed-off-by: Kent Overstreet fs/bcachefs/sysfs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 131898b0cb4ac6598d3537eeeee2711dec129f51 Author: Kent Overstreet Date: Sat Dec 2 02:43:58 2023 -0500 bcachefs: Fix bch2_extent_drop_ptrs() call Also, make bch2_extent_drop_ptrs() safer, so it works with extents and non-extents iterators. Signed-off-by: Kent Overstreet fs/bcachefs/data_update.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 87b0d8d3d05028c59b64c0287efeca90c28e1152 Author: Kent Overstreet Date: Fri Dec 1 01:14:50 2023 -0500 bcachefs: Fix a journal deadlock in replay Recently, journal pre-reservations were removed. They were for reserving space ahead of time in the journal for operations that are required for journal reclaim, e.g. btree key cache flushing and interior node btree updates. Instead we have watermarks - only operations for journal reclaim are allowed when the journal is low on space, and in general we're quite good about doing operations in the order that will free up space in the journal quickest when we're low on space. If we're doing a journal reclaim operation out of order, we usually do it in nonblocking mode if it's not freeing up space at the end of the journal. There's an exceptino though - interior btree node update operations have to be BCH_WATERMARK_reclaim - once they've been started, and they can't be nonblocking. Generally this is fine because they'll only be a very small fraction of transaction commits - but there's an exception, which is during journal replay. Journal replay does many btree operations, but doesn't need to commit them to the journal since they're already in the journal. So killing off of pre-reservation, plus another change to make journal replay more efficient by initially doing the replay in sorted btree order, made it possible for the interior update operations replay generates to fill and deadlock the journal. Fix this by introducing a new check on journal space at the _start_ of an interior update operation. This causes us to block if necessary in exactly the same way as we used to when interior updates took a journal pre-reservaiton, but without all the expensive accounting pre-reservations required. Signed-off-by: Kent Overstreet fs/bcachefs/btree_update_interior.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit ef6fae4a13aecfa7966edff0445e5c920ad2ddd9 Author: Kent Overstreet Date: Fri Dec 1 22:31:23 2023 -0500 bcachefs; Don't use btree write buffer until journal replay is finished The keys being replayed by journal replay have to be synchronized with updates by other threads that overwrite them. We rely on btree node locks for synchronizing - but since btree write buffer updates take no btree locks, that won't work. Instead, simply disable using the btree write buffer until journal replay is finished. This fixes a rare backpointers error in the merge_torture_flakey test. Signed-off-by: Kent Overstreet fs/bcachefs/btree_update.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit c13c823a78b77ea0e5f1f73112d910e259911101 Author: Rob Herring Date: Thu Nov 30 13:18:29 2023 -0600 arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru The rk3399-gru PCI node addresses are wrong. In rk3399-gru-scarlet, the bus number in the address should be 0. This is because bus number assignment is dynamic and not known up front. For FDT, the bus number is simply ignored. In rk3399-gru-chromebook, the addresses are simply invalid. The first "reg" entry must be the configuration space for the device. The entry should be all 0s except for device/slot and function numbers. The existing 64-bit memory space (0x83000000) entries are not valid because they must have the BAR address in the lower byte of the first cell. Warnings for these are enabled by adding the missing 'device_type = "pci"' for the root port node. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20231130191830.2424361-1-robh@kernel.org Signed-off-by: Heiko Stuebner arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi | 3 +-- arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts | 4 ++-- arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi | 1 + 3 files changed, 4 insertions(+), 4 deletions(-) commit c54fc3a4f375663f2361a9cbb2955fb4ef912879 Author: David Howells Date: Fri Dec 1 00:22:01 2023 +0000 cifs: Fix flushing, invalidation and file size with FICLONE Fix a number of issues in the cifs filesystem implementation of the FICLONE ioctl in cifs_remap_file_range(). This is analogous to the previously fixed bug in cifs_file_copychunk_range() and can share the helper functions. Firstly, the invalidation of the destination range is handled incorrectly: We shouldn't just invalidate the whole file as dirty data in the file may get lost and we can't just call truncate_inode_pages_range() to invalidate the destination range as that will erase parts of a partial folio at each end whilst invalidating and discarding all the folios in the middle. We need to force all the folios covering the range to be reloaded, but we mustn't lose dirty data in them that's not in the destination range. Further, we shouldn't simply round out the range to PAGE_SIZE at each end as cifs should move to support multipage folios. Secondly, there's an issue whereby a write may have extended the file locally, but not have been written back yet. This can leaves the local idea of the EOF at a later point than the server's EOF. If a clone request is issued, this will fail on the server with STATUS_INVALID_VIEW_SIZE (which gets translated to -EIO locally) if the clone source extends past the server's EOF. Fix this by: (0) Flush the source region (already done). The flush does nothing and the EOF isn't moved if the source region has no dirty data. (1) Move the EOF to the end of the source region if it isn't already at least at this point. If we can't do this, for instance if the server doesn't support it, just flush the entire source file. (2) Find the folio (if present) at each end of the range, flushing it and increasing the region-to-be-invalidated to cover those in their entirety. (3) Fully discard all the folios covering the range as we want them to be reloaded. (4) Then perform the extent duplication. Thirdly, set i_size after doing the duplicate_extents operation as this value may be used by various things internally. stat() hides the issue because setting ->time to 0 causes cifs_getatr() to revalidate the attributes. These were causing the cifs/001 xfstest to fail. Fixes: 04b38d601239 ("vfs: pull btrfs clone API to vfs layer") Signed-off-by: David Howells Cc: stable@vger.kernel.org cc: Christoph Hellwig cc: Paulo Alcantara cc: Shyam Prasad N cc: Rohith Surabattula cc: Matthew Wilcox cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: linux-mm@kvack.org Signed-off-by: David Howells Signed-off-by: Steve French fs/smb/client/cifsfs.c | 68 ++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 57 insertions(+), 11 deletions(-) commit 7b2404a886f8b91250c31855d287e632123e1746 Author: David Howells Date: Fri Dec 1 00:22:00 2023 +0000 cifs: Fix flushing, invalidation and file size with copy_file_range() Fix a number of issues in the cifs filesystem implementation of the copy_file_range() syscall in cifs_file_copychunk_range(). Firstly, the invalidation of the destination range is handled incorrectly: We shouldn't just invalidate the whole file as dirty data in the file may get lost and we can't just call truncate_inode_pages_range() to invalidate the destination range as that will erase parts of a partial folio at each end whilst invalidating and discarding all the folios in the middle. We need to force all the folios covering the range to be reloaded, but we mustn't lose dirty data in them that's not in the destination range. Further, we shouldn't simply round out the range to PAGE_SIZE at each end as cifs should move to support multipage folios. Secondly, there's an issue whereby a write may have extended the file locally, but not have been written back yet. This can leaves the local idea of the EOF at a later point than the server's EOF. If a copy request is issued, this will fail on the server with STATUS_INVALID_VIEW_SIZE (which gets translated to -EIO locally) if the copy source extends past the server's EOF. Fix this by: (0) Flush the source region (already done). The flush does nothing and the EOF isn't moved if the source region has no dirty data. (1) Move the EOF to the end of the source region if it isn't already at least at this point. If we can't do this, for instance if the server doesn't support it, just flush the entire source file. (2) Find the folio (if present) at each end of the range, flushing it and increasing the region-to-be-invalidated to cover those in their entirety. (3) Fully discard all the folios covering the range as we want them to be reloaded. (4) Then perform the copy. Thirdly, set i_size after doing the copychunk_range operation as this value may be used by various things internally. stat() hides the issue because setting ->time to 0 causes cifs_getatr() to revalidate the attributes. These were causing the generic/075 xfstest to fail. Fixes: 620d8745b35d ("Introduce cifs_copy_file_range()") Cc: stable@vger.kernel.org Signed-off-by: David Howells cc: Paulo Alcantara cc: Shyam Prasad N cc: Rohith Surabattula cc: Matthew Wilcox cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: linux-mm@kvack.org Signed-off-by: David Howells Signed-off-by: Steve French fs/smb/client/cifsfs.c | 102 +++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 99 insertions(+), 3 deletions(-) commit 815f986f33eeb06652d59d8a4d405d4fdb4e59a8 Author: Heiko Stuebner Date: Fri Dec 1 14:48:59 2023 +0100 arm64: dts: rockchip: drop interrupt-names property from rk3588s dfi The dfi binding does not specify interrupt names, with the interrupts just specifying channels 0-x. So drop the unspecified property. Fixes: 5a6976b1040a ("arm64: dts: rockchip: Add DFI to rk3588s") Reported-by: Jagan Teki Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20231201134859.322491-1-heiko@sntech.de arch/arm64/boot/dts/rockchip/rk3588s.dtsi | 1 - 1 file changed, 1 deletion(-) commit 7c1593410bca9a66c89d528f523ae32e2e220e68 Merge: b85ea95d0864 4a92a87950c4 Author: Palmer Dabbelt Date: Mon Dec 4 11:02:40 2023 -0800 Merge patch series "riscv: Fix issues with module loading" Charlie Jenkins says: Module loading did not account for multiple threads concurrently loading modules. This patch fixes that issue. There is also a small patch to fix the type of a __le16 variable. * b4-shazam-merge: riscv: Correct type casting in module loading riscv: Safely remove entries from relocation list Link: https://lore.kernel.org/r/20231127-module_linking_freeing-v4-0-a2ca1d7027d0@rivosinc.com Signed-off-by: Palmer Dabbelt commit 4a92a87950c4f86bc372ee3b1da4ba9d092252a9 Author: Charlie Jenkins Date: Mon Nov 27 14:05:00 2023 -0800 riscv: Correct type casting in module loading Use __le16 with le16_to_cpu. Fixes: 8fd6c5142395 ("riscv: Add remaining module relocations") Signed-off-by: Charlie Jenkins Reviewed-by: Samuel Holland Tested-by: Samuel Holland Tested-by: Björn Töpel Link: https://lore.kernel.org/r/20231127-module_linking_freeing-v4-2-a2ca1d7027d0@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/module.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d8792a5734b0f3e58b898c2e2f910bfac48e9ee3 Author: Charlie Jenkins Date: Mon Nov 27 14:04:59 2023 -0800 riscv: Safely remove entries from relocation list Use the safe versions of list and hlist iteration to safely remove entries from the module relocation lists. To allow mutliple threads to load modules concurrently, move relocation list pointers onto the stack rather than using global variables. Fixes: 8fd6c5142395 ("riscv: Add remaining module relocations") Reported-by: Ron Economos Closes: https://lore.kernel.org/linux-riscv/444de86a-7e7c-4de7-5d1d-c1c40eefa4ba@w6rz.net Signed-off-by: Charlie Jenkins Tested-by: Björn Töpel Link: https://lore.kernel.org/r/20231127-module_linking_freeing-v4-1-a2ca1d7027d0@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/module.c | 110 +++++++++++++++++++++++++++++++++------------ 1 file changed, 82 insertions(+), 28 deletions(-) commit 839a40d1e730977d4448d141fa653517c2959a88 Author: Bitao Hu Date: Thu Nov 30 10:13:37 2023 +0800 nvme: fix deadlock between reset and scan If controller reset occurs when allocating namespace, both nvme_reset_work and nvme_scan_work will hang, as shown below. Test Scripts: for ((t=1;t<=128;t++)) do nsid=`nvme create-ns /dev/nvme1 -s 14537724 -c 14537724 -f 0 -m 0 \ -d 0 | awk -F: '{print($NF);}'` nvme attach-ns /dev/nvme1 -n $nsid -c 0 done nvme reset /dev/nvme1 We will find that both nvme_reset_work and nvme_scan_work hung: INFO: task kworker/u249:4:17848 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u249:4 state:D stack: 0 pid:17848 ppid: 2 flags:0x00000028 Workqueue: nvme-reset-wq nvme_reset_work [nvme] Call trace: __switch_to+0xb4/0xfc __schedule+0x22c/0x670 schedule+0x4c/0xd0 blk_mq_freeze_queue_wait+0x84/0xc0 nvme_wait_freeze+0x40/0x64 [nvme_core] nvme_reset_work+0x1c0/0x5cc [nvme] process_one_work+0x1d8/0x4b0 worker_thread+0x230/0x440 kthread+0x114/0x120 INFO: task kworker/u249:3:22404 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u249:3 state:D stack: 0 pid:22404 ppid: 2 flags:0x00000028 Workqueue: nvme-wq nvme_scan_work [nvme_core] Call trace: __switch_to+0xb4/0xfc __schedule+0x22c/0x670 schedule+0x4c/0xd0 rwsem_down_write_slowpath+0x32c/0x98c down_write+0x70/0x80 nvme_alloc_ns+0x1ac/0x38c [nvme_core] nvme_validate_or_alloc_ns+0xbc/0x150 [nvme_core] nvme_scan_ns_list+0xe8/0x2e4 [nvme_core] nvme_scan_work+0x60/0x500 [nvme_core] process_one_work+0x1d8/0x4b0 worker_thread+0x260/0x440 kthread+0x114/0x120 INFO: task nvme:28428 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:nvme state:D stack: 0 pid:28428 ppid: 27119 flags:0x00000000 Call trace: __switch_to+0xb4/0xfc __schedule+0x22c/0x670 schedule+0x4c/0xd0 schedule_timeout+0x160/0x194 do_wait_for_common+0xac/0x1d0 __wait_for_common+0x78/0x100 wait_for_completion+0x24/0x30 __flush_work.isra.0+0x74/0x90 flush_work+0x14/0x20 nvme_reset_ctrl_sync+0x50/0x74 [nvme_core] nvme_dev_ioctl+0x1b0/0x250 [nvme_core] __arm64_sys_ioctl+0xa8/0xf0 el0_svc_common+0x88/0x234 do_el0_svc+0x7c/0x90 el0_svc+0x1c/0x30 el0_sync_handler+0xa8/0xb0 el0_sync+0x148/0x180 The reason for the hang is that nvme_reset_work occurs while nvme_scan_work is still running. nvme_scan_work may add new ns into ctrl->namespaces list after nvme_reset_work frozen all ns->q in ctrl->namespaces list. The newly added ns is not frozen, so nvme_wait_freeze will wait forever. Unfortunately, ctrl->namespaces_rwsem is held by nvme_reset_work, so nvme_scan_work will also wait forever. Now we are deadlocked! PROCESS1 PROCESS2 ============== ============== nvme_scan_work ... nvme_reset_work nvme_validate_or_alloc_ns nvme_dev_disable nvme_alloc_ns nvme_start_freeze down_write ... nvme_ns_add_to_ctrl_list ... up_write nvme_wait_freeze ... down_read nvme_alloc_ns blk_mq_freeze_queue_wait down_write Fix by marking the ctrl with say NVME_CTRL_FROZEN flag set in nvme_start_freeze and cleared in nvme_unfreeze. Then the scan can check it before adding the new namespace (under the namespaces_rwsem). Signed-off-by: Bitao Hu Reviewed-by: Guixin Liu Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/host/core.c | 10 ++++++++++ drivers/nvme/host/nvme.h | 1 + 2 files changed, 11 insertions(+) commit 20dc66f2d76b4a410df14e4675e373b718babc34 Author: Nitesh Shetty Date: Tue Nov 28 17:59:57 2023 +0530 nvme: prevent potential spectre v1 gadget This patch fixes the smatch warning, "nvmet_ns_ana_grpid_store() warn: potential spectre issue 'nvmet_ana_group_enabled' [w] (local cap)" Prevent the contents of kernel memory from being leaked to user space via speculative execution by using array_index_nospec. Signed-off-by: Nitesh Shetty Reviewed-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch drivers/nvme/target/configfs.c | 3 +++ 1 file changed, 3 insertions(+) commit 29ac4b2f9263f52ba12fa35832cc6506ce3b4793 Author: Shin'ichiro Kawasaki Date: Wed Nov 29 13:49:51 2023 +0900 nvme: improve NVME_HOST_AUTH and NVME_TARGET_AUTH config descriptions Currently two similar config options NVME_HOST_AUTH and NVME_TARGET_AUTH have almost same descriptions. It is confusing to choose them in menuconfig. Improve the descriptions to distinguish them. Signed-off-by: Shin'ichiro Kawasaki Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/host/Kconfig | 5 +++-- drivers/nvme/target/Kconfig | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) commit 7be866b1cf0bf1dfa74480fe8097daeceda68622 Author: Keith Busch Date: Tue May 2 11:43:41 2023 -0700 nvme-ioctl: move capable() admin check to the end This can be an expensive call on some kernel configs. Move it to the end after checking the cheaper ways to determine if the command is allowed. Reviewed-by: Jens Axboe Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/host/ioctl.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) commit e6e7f7ac03e40795346f1b2994a05f507ad8d345 Author: Keith Busch Date: Fri Oct 27 10:58:12 2023 -0700 nvme: ensure reset state check ordering A different CPU may be setting the ctrl->state value, so ensure proper barriers to prevent optimizing to a stale state. Normally it isn't a problem to observe the wrong state as it is merely advisory to take a quicker path during initialization and error recovery, but seeing an old state can report unexpected ENETRESET errors when a reset request was in fact successful. Reported-by: Minh Hoang Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch Signed-off-by: Hannes Reinecke drivers/nvme/host/core.c | 42 ++++++++++++++++++++++-------------------- drivers/nvme/host/fc.c | 6 +++--- drivers/nvme/host/pci.c | 14 +++++++------- drivers/nvme/host/rdma.c | 23 ++++++++++++++--------- drivers/nvme/host/tcp.c | 27 +++++++++++++++++---------- 5 files changed, 63 insertions(+), 49 deletions(-) commit 5c687c287c46fadb14644091823298875a5216aa Author: Keith Busch Date: Mon Oct 30 08:13:09 2023 -0700 nvme: introduce helper function to get ctrl state The controller state is typically written by another CPU, so reading it should ensure no optimizations are taken. This is a repeated pattern in the driver, so start with adding a convenience function that returns the controller state with READ_ONCE(). Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch drivers/nvme/host/nvme.h | 5 +++++ 1 file changed, 5 insertions(+) commit 716d4e5373e9d1ae993485ab2e3b893bf7104fb1 Author: Srinivas Kandagatla Date: Mon Dec 4 12:47:36 2023 +0000 ASoC: qcom: sc8280xp: Limit speaker digital volumes Limit the speaker digital gains to 0dB so that the users will not damage them. Currently there is a limit in UCM, but this does not stop the user form changing the digital gains from command line. So limit this in driver which makes the speakers more safer without active speaker protection in place. Signed-off-by: Srinivas Kandagatla Reviewed-by: Johan Hovold Tested-by: Johan Hovold Link: https://lore.kernel.org/r/20231204124736.132185-3-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown sound/soc/qcom/sc8280xp.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) commit fb9ad24485087e0f00d84bee7a5914640b2b9024 Author: Srinivas Kandagatla Date: Mon Dec 4 12:47:35 2023 +0000 ASoC: ops: add correct range check for limiting volume Volume can have ranges that start with negative values, ex: -84dB to +40dB. Apply correct range check in snd_soc_limit_volume before setting the platform_max. Without this patch, for example setting a 0dB limit on a volume range of -84dB to +40dB would fail. Signed-off-by: Srinivas Kandagatla Tested-by: Johan Hovold Reviewed-by: Johan Hovold Link: https://lore.kernel.org/r/20231204124736.132185-2-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown sound/soc/soc-ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 31e52523267faab5ed8569b9d5c22c9a2283872f Author: Sebastian Parschauer Date: Mon Nov 27 23:49:37 2023 +0100 HID: Add quirk for Labtec/ODDOR/aikeec handbrake This device needs ALWAYS_POLL quirk, otherwise it keeps reconnecting indefinitely. It is a handbrake for sim racing detected as joystick. Reported and tested by GitHub user N0th1ngM4tt3rs. Link: https://github.com/sriemer/fix-linux-mouse issue 22 Signed-off-by: Sebastian Parschauer Signed-off-by: Jiri Kosina drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+) commit a9f68ffe1170ca4bc17ab29067d806a354a026e0 Author: Mario Limonciello Date: Sat Dec 2 21:24:30 2023 -0600 HID: i2c-hid: Add IDEA5002 to i2c_hid_acpi_blacklist[] Users have reported problems with recent Lenovo laptops that contain an IDEA5002 I2C HID device. Reports include fans turning on and running even at idle and spurious wakeups from suspend. Presumably in the Windows ecosystem there is an application that uses the HID device. Maybe that puts it into a lower power state so it doesn't cause spurious events. This device doesn't serve any functional purpose in Linux as nothing interacts with it so blacklist it from being probed. This will prevent the GPIO driver from setting up the GPIO and the spurious interrupts and wake events will not occur. Cc: stable@vger.kernel.org # 6.1 Reported-and-tested-by: Marcus Aram Reported-and-tested-by: Mark Herbert Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2812 Signed-off-by: Mario Limonciello Signed-off-by: Jiri Kosina drivers/hid/i2c-hid/i2c-hid-acpi.c | 5 +++++ 1 file changed, 5 insertions(+) commit 2fff0b5e1a6b9c577b4dd4958902c877159c856b Author: Mario Limonciello Date: Sat Dec 2 21:24:31 2023 -0600 pinctrl: amd: Mask non-wake source pins with interrupt enabled at suspend If a pin isn't marked as a wake source processing any interrupts is just going to destroy battery life. The APU may wake up from a hardware sleep state to process the interrupt but not return control to the OS. Mask interrupt for all non-wake source pins at suspend. They'll be re-enabled at resume. Reported-and-tested-by: Marcus Aram Reported-and-tested-by: Mark Herbert Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2812 Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20231203032431.30277-3-mario.limonciello@amd.com Signed-off-by: Linus Walleij drivers/pinctrl/pinctrl-amd.c | 9 +++++++++ drivers/pinctrl/pinctrl-amd.h | 5 +++++ 2 files changed, 14 insertions(+) commit b8e0792449928943c15d1af9f63816911d139267 Author: Stefan Hajnoczi Date: Mon Dec 4 09:07:43 2023 -0500 virtio_blk: fix snprintf truncation compiler warning Commit 4e0400525691 ("virtio-blk: support polling I/O") triggers the following gcc 13 W=1 warnings: drivers/block/virtio_blk.c: In function ‘init_vq’: drivers/block/virtio_blk.c:1077:68: warning: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 7 [-Wformat-truncation=] 1077 | snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i); | ^~ drivers/block/virtio_blk.c:1077:58: note: directive argument in the range [-2147483648, 65534] 1077 | snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i); | ^~~~~~~~~~~~~ drivers/block/virtio_blk.c:1077:17: note: ‘snprintf’ output between 11 and 21 bytes into a destination of size 16 1077 | snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This is a false positive because the lower bound -2147483648 is incorrect. The true range of i is [0, num_vqs - 1] where 0 < num_vqs < 65536. The code mixes int, unsigned short, and unsigned int types in addition to using "%d" for an unsigned value. Use unsigned short and "%u" consistently to solve the compiler warning. Cc: Suwan Kim Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202312041509.DIyvEt9h-lkp@intel.com/ Signed-off-by: Stefan Hajnoczi Message-Id: <20231204140743.1487843-1-stefanha@redhat.com> Signed-off-by: Michael S. Tsirkin drivers/block/virtio_blk.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 6f7e4664e597440dfbdb8b2931c561b717030d07 Author: Bin Li Date: Mon Dec 4 18:04:50 2023 +0800 ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5 Lenovo M90 Gen5 is equipped with ALC897, and it needs ALC897_FIXUP_HEADSET_MIC_PIN quirk to make its headset mic work. Signed-off-by: Bin Li Cc: Link: https://lore.kernel.org/r/20231204100450.642783-1-bin.li@canonical.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit cd14dedf15be432066e63783c63d650f2800cd48 Author: Aleksandrs Vinarskis Date: Mon Dec 4 00:30:06 2023 +0100 ALSA: hda/realtek: fix speakers on XPS 9530 (2023) XPS 9530 has 2 tweeters and 2 subwoofers powered by CS35L41 amplifier, SPI connected. For subwoofers to work, it requires both to enable amplifier support, and to enable output to subwoofers via 0x17 quirk (similalry to XPS 9510/9520). Signed-off-by: Aleksandrs Vinarskis Cc: Link: https://lore.kernel.org/r/20231203233006.100558-1-alex.vinarskis@gmail.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit bbb8e71965c3737bdc691afd803a34bfd61cfbeb Author: Sarah Grant Date: Fri Dec 1 18:16:54 2023 +0000 ALSA: usb-audio: Add Pioneer DJM-450 mixer controls These values mirror those of the Pioneer DJM-250MK2 as the channel layout appears identical based on my observations. This duplication could be removed in later contributions if desired. Signed-off-by: Sarah Grant Cc: Link: https://lore.kernel.org/r/20231201181654.5058-1-s@srd.tw Signed-off-by: Takashi Iwai sound/usb/mixer_quirks.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) commit 408d4b33c2440600418a1eb9c89eaa27cf5867ad Author: Marius Cristea Date: Wed Nov 29 15:56:19 2023 +0200 iio: adc: MCP3564: fix hardware identification logic In mcp3564_config() fix the hardware identification logic based on the hardware ID registers. Second part of the code was disabled by an logic error. Fix a typo related to the "MODULE_DESCRIPTION". Fixes: 33ec3e5fc1ea (iio: adc: adding support for MCP3564 ADC) Signed-off-by: Marius Cristea Link: https://lore.kernel.org/r/20231129135619.63475-1-marius.cristea@microchip.com Signed-off-by: Jonathan Cameron drivers/iio/adc/mcp3564.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 85ac6d92fdfd6097a16d9c61363fe1d0272c1604 Author: Javier Carrasco Date: Fri Dec 1 10:48:03 2023 +0100 iio: adc: MCP3564: fix calib_bias and calib_scale range checks The current implementation uses the AND (&&) operator to check if the value to write for IIO_CHAN_INFO_CALIBBIAS and IIO_CHAN_INFO_CALIBSCALE is within the valid ranges. The evaluated values are the lower and upper limits of the ranges, so this operation always evaluates to false. The OR (||) operator must be used instead. Signed-off-by: Javier Carrasco Reviewed-by: Marius Cristea Link: https://lore.kernel.org/r/20231201-mcp3564_range_checks-v1-1-68f4436e22b0@gmail.com Cc: Signed-off-by: Jonathan Cameron drivers/iio/adc/mcp3564.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1f475cd572ea77ae6474a17e693a96bca927efe9 Author: Xuan Zhuo Date: Fri Dec 1 11:33:03 2023 +0800 virtio_ring: fix syncs DMA memory with different direction Now the APIs virtqueue_dma_sync_single_range_for_{cpu,device} ignore the parameter 'dir', that is a mistake. [ 6.101666] ------------[ cut here ]------------ [ 6.102079] DMA-API: virtio-pci 0000:00:04.0: device driver syncs DMA memory with different direction [device address=0x00000000ae010000] [size=32752 bytes] [mapped with DMA_FROM_DEVICE] [synced with DMA_BIDIRECTIONAL] [ 6.103630] WARNING: CPU: 6 PID: 0 at kernel/dma/debug.c:1125 check_sync+0x53e/0x6c0 [ 6.107420] CPU: 6 PID: 0 Comm: swapper/6 Tainted: G E 6.6.0+ #290 [ 6.108030] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 6.108936] RIP: 0010:check_sync+0x53e/0x6c0 [ 6.109289] Code: 24 10 e8 f5 d9 74 00 4c 8b 4c 24 10 4c 8b 44 24 18 48 8b 4c 24 20 48 89 c6 41 56 4c 89 ea 48 c7 c7 b0 f1 50 82 e8 32 fc f3 ff <0f> 0b 48 c7 c7 48 4b 4a 82 e8 74 d9 fc ff 8b 73 4c 48 8d 7b 50 31 [ 6.110750] RSP: 0018:ffffc90000180cd8 EFLAGS: 00010092 [ 6.111178] RAX: 00000000000000ce RBX: ffff888100aa5900 RCX: 0000000000000000 [ 6.111744] RDX: 0000000000000104 RSI: ffffffff824c3208 RDI: 00000000ffffffff [ 6.112316] RBP: ffffc90000180d40 R08: 0000000000000000 R09: 00000000fffeffff [ 6.112893] R10: ffffc90000180b98 R11: ffffffff82f63308 R12: ffffffff83d5af00 [ 6.113460] R13: ffff888100998200 R14: ffffffff824a4b5f R15: 0000000000000286 [ 6.114027] FS: 0000000000000000(0000) GS:ffff88842fd80000(0000) knlGS:0000000000000000 [ 6.114665] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.115128] CR2: 00007f10f1e03030 CR3: 0000000108272004 CR4: 0000000000770ee0 [ 6.115701] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 6.116272] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 6.116842] PKRU: 55555554 [ 6.117069] Call Trace: [ 6.117275] [ 6.117452] ? __warn+0x84/0x140 [ 6.117727] ? check_sync+0x53e/0x6c0 [ 6.118034] ? __report_bug+0xea/0x100 [ 6.118353] ? check_sync+0x53e/0x6c0 [ 6.118653] ? report_bug+0x41/0xc0 [ 6.118944] ? handle_bug+0x3c/0x70 [ 6.119237] ? exc_invalid_op+0x18/0x70 [ 6.119551] ? asm_exc_invalid_op+0x1a/0x20 [ 6.119900] ? check_sync+0x53e/0x6c0 [ 6.120199] ? check_sync+0x53e/0x6c0 [ 6.120499] debug_dma_sync_single_for_cpu+0x5c/0x70 [ 6.120906] ? dma_sync_single_for_cpu+0xb7/0x100 [ 6.121291] virtnet_rq_unmap+0x158/0x170 [virtio_net] [ 6.121716] virtnet_receive+0x196/0x220 [virtio_net] [ 6.122135] virtnet_poll+0x48/0x1b0 [virtio_net] [ 6.122524] __napi_poll+0x29/0x1b0 [ 6.123083] net_rx_action+0x282/0x360 [ 6.123612] __do_softirq+0xf3/0x2fb [ 6.124138] __irq_exit_rcu+0x8e/0xf0 [ 6.124663] common_interrupt+0xbc/0xe0 [ 6.125202] We need to enable CONFIG_DMA_API_DEBUG and work with need sync mode(such as swiotlb) to reproduce this warn. Fixes: 8bd2f71054bd ("virtio_ring: introduce dma sync api for virtqueue") Reported-by: "Ning, Hongyu" Closes: https://lore.kernel.org/all/f37cb55a-6fc8-4e21-8789-46d468325eea@linux.intel.com/ Suggested-by: Jason Wang Signed-off-by: Xuan Zhuo Message-Id: <20231201033303.25141-1-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Parav Pandit Acked-by: Jason Wang Tested-by: Hongyu Ning drivers/virtio/virtio_ring.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit b17b7fe6dd5c6ff74b38b0758ca799cdbb79e26e Author: RD Babiera Date: Wed Nov 29 19:23:50 2023 +0000 usb: typec: class: fix typec_altmode_put_partner to put plugs When typec_altmode_put_partner is called by a plug altmode upon release, the port altmode the plug belongs to will not remove its reference to the plug. The check to see if the altmode being released evaluates against the released altmode's partner instead of the calling altmode itself, so change adev in typec_altmode_put_partner to properly refer to the altmode being released. typec_altmode_set_partner is not run for port altmodes, so also add a check in typec_altmode_release to prevent typec_altmode_put_partner() calls on port altmode release. Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes") Cc: stable@vger.kernel.org Signed-off-by: RD Babiera Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20231129192349.1773623-2-rdbabiera@google.com Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/class.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 73ea73affe8622bdf292de898da869d441da6a9d Author: Roy Luo Date: Tue Nov 28 22:17:56 2023 +0000 USB: gadget: core: adjust uevent timing on gadget unbind The KOBJ_CHANGE uevent is sent before gadget unbind is actually executed, resulting in inaccurate uevent emitted at incorrect timing (the uevent would have USB_UDC_DRIVER variable set while it would soon be removed). Move the KOBJ_CHANGE uevent to the end of the unbind function so that uevent is sent only after the change has been made. Fixes: 2ccea03a8f7e ("usb: gadget: introduce UDC Class") Cc: stable@vger.kernel.org Signed-off-by: Roy Luo Link: https://lore.kernel.org/r/20231128221756.2591158-1-royluo@google.com Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/udc/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3494a594315b56516988afb6854d75dee5b501db Author: Kunwu Chan Date: Fri Dec 1 13:54:47 2023 +0800 platform/mellanox: Check devm_hwmon_device_register_with_groups() return value devm_hwmon_device_register_with_groups() returns an error pointer upon failure. Check its return value for errors. Compile-tested only. Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver") Suggested-by: Ilpo Järvinen Suggested-by: Vadim Pasternak Signed-off-by: Kunwu Chan Reviewed-by: Vadim Pasternak Link: https://lore.kernel.org/r/20231201055447.2356001-1-chentao@kylinos.cn [ij: split the change into two] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/mellanox/mlxbf-pmc.c | 2 ++ 1 file changed, 2 insertions(+) commit 2c7c857f5fed997be93047d2de853d7f10c8defe Author: Kunwu Chan Date: Fri Dec 1 13:54:47 2023 +0800 platform/mellanox: Add null pointer checks for devm_kasprintf() devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Compile-tested only. Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver") Suggested-by: Ilpo Järvinen Suggested-by: Vadim Pasternak Signed-off-by: Kunwu Chan Reviewed-by: Vadim Pasternak Link: https://lore.kernel.org/r/20231201055447.2356001-1-chentao@kylinos.cn [ij: split the change into two] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/mellanox/mlxbf-pmc.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 29046a78a3c0a1f8fa0427f164caa222f003cf5b Author: Dinghao Liu Date: Mon Dec 4 15:41:56 2023 +0800 ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate When wm_adsp_buffer_read() fails, we should free buf->regions. Otherwise, the callers of wm_adsp_buffer_populate() will directly free buf on failure, which makes buf->regions a leaked memory. Fixes: a792af69b08f ("ASoC: wm_adsp: Refactor compress stream initialisation") Signed-off-by: Dinghao Liu Reviewed-by: Richard Fitzgerald Link: https://lore.kernel.org/r/20231204074158.12026-1-dinghao.liu@zju.edu.cn Signed-off-by: Mark Brown sound/soc/codecs/wm_adsp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 5f44de697383fcc9a9a1a78f99e09d1838704b90 Author: David Rau Date: Fri Dec 1 12:29:33 2023 +0800 ASoC: da7219: Support low DC impedance headset Change the default MIC detection impedance threshold to 200ohm to support low mic DC impedance headset. Signed-off-by: David Rau Link: https://lore.kernel.org/r/20231201042933.26392-1-David.Rau.opensource@dm.renesas.com Signed-off-by: Mark Brown sound/soc/codecs/da7219-aad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b5338b1b901e41bd7cead66a0b3a796e9fa95684 Author: Marian Postevca Date: Sun Dec 3 00:29:51 2023 +0200 ASoC: amd: acp: Add support for a new Huawei Matebook laptop This commit adds support for Huawei MateBook D16 2021 with Ryzen 4600H in driver acp3x-es83xx. Signed-off-by: Marian Postevca Link: https://lore.kernel.org/r/20231202223001.8025-1-posteuca@mutex.one Signed-off-by: Mark Brown sound/soc/amd/acp-config.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit d4eef75279f5e9d594f5785502038c763ce42268 Author: David Thompson Date: Thu Nov 30 13:35:15 2023 -0500 mlxbf-bootctl: correctly identify secure boot with development keys The secure boot state of the BlueField SoC is represented by two bits: 0 = production state 1 = secure boot enabled 2 = non-secure (secure boot disabled) 3 = RMA state There is also a single bit to indicate whether production keys or development keys are being used when secure boot is enabled. This single bit (specified by MLXBF_BOOTCTL_SB_DEV_MASK) only has meaning if secure boot state equals 1 (secure boot enabled). The secure boot states are as follows: - “GA secured” is when secure boot is enabled with official production keys. - “Secured (development)” is when secure boot is enabled with development keys. Without this fix “GA Secured” is displayed on development cards which is misleading. This patch updates the logic in "lifecycle_state_show()" to handle the case where the SoC is configured for secure boot and is using development keys. Fixes: 79e29cb8fbc5c ("platform/mellanox: Add bootctl driver for Mellanox BlueField Soc") Reviewed-by: Khalil Blaiech Signed-off-by: David Thompson Link: https://lore.kernel.org/r/20231130183515.17214-1-davthompson@nvidia.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/mellanox/mlxbf-bootctl.c | 39 ++++++++++++++++++++----------- 1 file changed, 26 insertions(+), 13 deletions(-) commit fea88064445a59584460f7f67d102b6e5fc1ca1d Author: Matthias Reichl Date: Sun Dec 3 23:22:16 2023 +0100 regmap: fix bogus error on regcache_sync success Since commit 0ec7731655de ("regmap: Ensure range selector registers are updated after cache sync") opening pcm512x based soundcards fail with EINVAL and dmesg shows sync cache and pm_runtime_get errors: [ 228.794676] pcm512x 1-004c: Failed to sync cache: -22 [ 228.794740] pcm512x 1-004c: ASoC: error at snd_soc_pcm_component_pm_runtime_get on pcm512x.1-004c: -22 This is caused by the cache check result leaking out into the regcache_sync return value. Fix this by making the check local-only, as the comment above the regcache_read call states a non-zero return value means there's nothing to do so the return value should not be altered. Fixes: 0ec7731655de ("regmap: Ensure range selector registers are updated after cache sync") Cc: stable@vger.kernel.org Signed-off-by: Matthias Reichl Link: https://lore.kernel.org/r/20231203222216.96547-1-hias@horus.com Signed-off-by: Mark Brown drivers/base/regmap/regcache.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 77f5032e94f244ba08db51e17ca8f37bd7ff9acb Author: Sudeep Holla Date: Thu Nov 30 20:43:43 2023 +0000 firmware: arm_scmi: Fix possible frequency truncation when using level indexing mode The multiplier is already promoted to unsigned long, however the frequency calculations done when using level indexing mode doesn't use the multiplier computed. It instead hardcodes the multiplier value of 1000 at all the usage sites. Clean that up by assigning the multiplier value of 1000 when using the perf level indexing mode and update the frequency calculations to use the multiplier instead. It should fix the possible frequency truncation for all the values greater than or equal to 4GHz on 64-bit machines. Fixes: 31c7c1397a33 ("firmware: arm_scmi: Add v3.2 perf level indexing mode support") Reported-by: Sibi Sankar Closes: https://lore.kernel.org/all/20231129065748.19871-3-quic_sibis@quicinc.com/ Cc: Cristian Marussi Link: https://lore.kernel.org/r/20231130204343.503076-2-sudeep.holla@arm.com Reviewed-by: Cristian Marussi Signed-off-by: Sudeep Holla drivers/firmware/arm_scmi/perf.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 8e3c98d9187e09274fc000a7d1a77b070a42d259 Author: Sudeep Holla Date: Thu Nov 30 20:43:42 2023 +0000 firmware: arm_scmi: Fix frequency truncation by promoting multiplier type Fix the possible frequency truncation for all values equal to or greater 4GHz on 64bit machines by updating the multiplier 'mult_factor' to 'unsigned long' type. It is also possible that the multiplier itself can be greater than or equal to 2^32. So we need to also fix the equation computing the value of the multiplier. Fixes: a9e3fbfaa0ff ("firmware: arm_scmi: add initial support for performance protocol") Reported-by: Sibi Sankar Closes: https://lore.kernel.org/all/20231129065748.19871-3-quic_sibis@quicinc.com/ Cc: Cristian Marussi Link: https://lore.kernel.org/r/20231130204343.503076-1-sudeep.holla@arm.com Signed-off-by: Sudeep Holla drivers/firmware/arm_scmi/perf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 79321a793945fdbff2f405f84712d0ab81bed287 Author: Douglas Anderson Date: Wed Nov 29 13:25:24 2023 -0800 r8152: Add RTL8152_INACCESSIBLE to r8153_aldps_en() Delay loops in r8152 should break out if RTL8152_INACCESSIBLE is set so that they don't delay too long if the device becomes inaccessible. Add the break to the loop in r8153_aldps_en(). Fixes: 4214cc550bf9 ("r8152: check if disabling ALDPS is finished") Reviewed-by: Grant Grundler Signed-off-by: Douglas Anderson Acked-by: Hayes Wang Signed-off-by: David S. Miller drivers/net/usb/r8152.c | 2 ++ 1 file changed, 2 insertions(+) commit 8c53a7bd706535a9cf4e2ec3a4e8d61d46353ca0 Author: Douglas Anderson Date: Wed Nov 29 13:25:23 2023 -0800 r8152: Add RTL8152_INACCESSIBLE to r8153_pre_firmware_1() Delay loops in r8152 should break out if RTL8152_INACCESSIBLE is set so that they don't delay too long if the device becomes inaccessible. Add the break to the loop in r8153_pre_firmware_1(). Fixes: 9370f2d05a2a ("r8152: support request_firmware for RTL8153") Reviewed-by: Grant Grundler Signed-off-by: Douglas Anderson Acked-by: Hayes Wang Signed-off-by: David S. Miller drivers/net/usb/r8152.c | 2 ++ 1 file changed, 2 insertions(+) commit 8a67b47fced9f6a84101eb9ec5ce4c7d64204bc7 Author: Douglas Anderson Date: Wed Nov 29 13:25:22 2023 -0800 r8152: Add RTL8152_INACCESSIBLE to r8156b_wait_loading_flash() Delay loops in r8152 should break out if RTL8152_INACCESSIBLE is set so that they don't delay too long if the device becomes inaccessible. Add the break to the loop in r8156b_wait_loading_flash(). Fixes: 195aae321c82 ("r8152: support new chips") Reviewed-by: Grant Grundler Signed-off-by: Douglas Anderson Acked-by: Hayes Wang Signed-off-by: David S. Miller drivers/net/usb/r8152.c | 2 ++ 1 file changed, 2 insertions(+) commit 32a574c7e2685aa8138754d4d755f9246cc6bd48 Author: Douglas Anderson Date: Wed Nov 29 13:25:21 2023 -0800 r8152: Add RTL8152_INACCESSIBLE checks to more loops Previous commits added checks for RTL8152_INACCESSIBLE in the loops in the driver. There are still a few more that keep tripping the driver up in error cases and make things take longer than they should. Add those in. All the loops that are part of this commit existed in some form or another since the r8152 driver was first introduced, though RTL8152_INACCESSIBLE was known as RTL8152_UNPLUG before commit 715f67f33af4 ("r8152: Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE") Fixes: ac718b69301c ("net/usb: new driver for RTL8152") Reviewed-by: Grant Grundler Signed-off-by: Douglas Anderson Acked-by: Hayes Wang Signed-off-by: David S. Miller drivers/net/usb/r8152.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit e62adaeecdc6a1e8ae86e7f3f9f8223a3ede94f5 Author: Douglas Anderson Date: Wed Nov 29 13:25:20 2023 -0800 r8152: Hold the rtnl_lock for all of reset As of commit d9962b0d4202 ("r8152: Block future register access if register access fails") there is a race condition that can happen between the USB device reset thread and napi_enable() (not) getting called during rtl8152_open(). Specifically: * While rtl8152_open() is running we get a register access error that's _not_ -ENODEV and queue up a USB reset. * rtl8152_open() exits before calling napi_enable() due to any reason (including usb_submit_urb() returning an error). In that case: * Since the USB reset is perform in a separate thread asynchronously, it can run at anytime USB device lock is not held - even before rtl8152_open() has exited with an error and caused __dev_open() to clear the __LINK_STATE_START bit. * The rtl8152_pre_reset() will notice that the netif_running() returns true (since __LINK_STATE_START wasn't cleared) so it won't exit early. * rtl8152_pre_reset() will then hang in napi_disable() because napi_enable() was never called. We can fix the race by making sure that the r8152 reset routines don't run at the same time as we're opening the device. Specifically we need the reset routines in their entirety rely on the return value of netif_running(). The only way to reliably depend on that is for them to hold the rntl_lock() mutex for the duration of reset. Grabbing the rntl_lock() mutex for the duration of reset seems like a long time, but reset is not expected to be common and the rtnl_lock() mutex is already held for long durations since the core grabs it around the open/close calls. Fixes: d9962b0d4202 ("r8152: Block future register access if register access fails") Reviewed-by: Grant Grundler Signed-off-by: Douglas Anderson Signed-off-by: David S. Miller drivers/net/usb/r8152.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit 59b75dcb0953813676b5030877f3f37cedaed87d Author: George Stark Date: Tue Nov 28 02:55:58 2023 +0300 iio: adc: meson: add separate config for axg SoC family According to Amlogic custom kernels ADC of axg SoC family has vref_select and requires this setting to work nominally and thus needs a separate config. Fixes: 90c6241860bf ("iio: adc: meson: init voltage control bits") Signed-off-by: George Stark Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20231127235558.71995-1-gnstark@salutedevices.com Signed-off-by: Jonathan Cameron drivers/iio/adc/meson_saradc.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) commit 5c584f175d32f9cc66c909f851cd905da58b39ea Author: Nam Cao Date: Fri Dec 1 10:23:29 2023 +0100 pinctrl: starfive: jh7100: ignore disabled device tree nodes The driver always registers pin configurations in device tree. This can cause some inconvenience to users, as pin configurations in the base device tree cannot be disabled in the device tree overlay, even when the relevant devices are not used. Ignore disabled pin configuration nodes in device tree. Fixes: ec648f6b7686 ("pinctrl: starfive: Add pinctrl driver for StarFive SoCs") Cc: Signed-off-by: Nam Cao Link: https://lore.kernel.org/r/fe4c15dcc3074412326b8dc296b0cbccf79c49bf.1701422582.git.namcao@linutronix.de Signed-off-by: Linus Walleij drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f6e3b40a2c89c1d832ed9cb031dc9825bbf43b7c Author: Nam Cao Date: Fri Dec 1 10:23:28 2023 +0100 pinctrl: starfive: jh7110: ignore disabled device tree nodes The driver always registers pin configurations in device tree. This can cause some inconvenience to users, as pin configurations in the base device tree cannot be disabled in the device tree overlay, even when the relevant devices are not used. Ignore disabled pin configuration nodes in device tree. Fixes: 447976ab62c5 ("pinctrl: starfive: Add StarFive JH7110 sys controller driver") Cc: Signed-off-by: Nam Cao Link: https://lore.kernel.org/r/fd8bf044799ae50a6291ae150ef87b4f1923cacb.1701422582.git.namcao@linutronix.de Signed-off-by: Linus Walleij drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 2475ecdb9b6e177b133cf26e64e8d441d37bebde Author: Haibo Chen Date: Thu Nov 16 15:10:26 2023 +0800 iio: adc: imx93: add four channels for imx93 adc According to the spec, this ADC totally support 8 channels. i.MX93 contain this ADC with 4 channels connected to pins in the package. i.MX95 contain this ADC with 8 channels connected to pins in the package. Signed-off-by: Haibo Chen Fixes: 7d02296ac8b8 ("iio: adc: add imx93 adc support") Link: https://lore.kernel.org/r/20231116071026.611269-1-haibo.chen@nxp.com Cc: Signed-off-by: Jonathan Cameron drivers/iio/adc/imx93_adc.c | 4 ++++ 1 file changed, 4 insertions(+) commit 2d880bfa4a97002962d5be148725197be98b191a Author: Jiri Kosina Date: Mon Dec 4 10:37:15 2023 +0100 mailmap: add address mapping for Jiri Kosina Since I switched the MAINTAINERS entry to @kernel.org some time ago, let's canonicalize my addressess to it. Signed-off-by: Jiri Kosina Signed-off-by: Jiri Kosina .mailmap | 3 +++ 1 file changed, 3 insertions(+) commit 60576e84c187043cef11f11d015249e71151d35a Author: Wadim Egorov Date: Mon Sep 25 15:44:27 2023 +0200 iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma() Fix wrong handling of a DMA request where the probing only failed if -EPROPE_DEFER was returned. Instead, let us fail if a non -ENODEV value is returned. This makes DMAs explicitly optional. Even if the DMA request is unsuccessfully, the ADC can still work properly. We do also handle the defer probe case by making use of dev_err_probe(). Fixes: f438b9da75eb ("drivers: iio: ti_am335x_adc: add dma support") Signed-off-by: Wadim Egorov Reviewed-by: Bhavya Kapoor Link: https://lore.kernel.org/r/20230925134427.214556-1-w.egorov@phytec.de Cc: Signed-off-by: Jonathan Cameron drivers/iio/adc/ti_am335x_adc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 3f29f1c336c0e8a4bec52f1e5217f88835553e5b Author: Amir Goldstein Date: Sun Dec 3 09:42:33 2023 +0200 fuse: disable FOPEN_PARALLEL_DIRECT_WRITES with FUSE_DIRECT_IO_ALLOW_MMAP The new fuse init flag FUSE_DIRECT_IO_ALLOW_MMAP breaks assumptions made by FOPEN_PARALLEL_DIRECT_WRITES and causes test generic/095 to hit BUG_ON(fi->writectr < 0) assertions in fuse_set_nowrite(): generic/095 5s ... kernel BUG at fs/fuse/dir.c:1756! ... ? fuse_set_nowrite+0x3d/0xdd ? do_raw_spin_unlock+0x88/0x8f ? _raw_spin_unlock+0x2d/0x43 ? fuse_range_is_writeback+0x71/0x84 fuse_sync_writes+0xf/0x19 fuse_direct_io+0x167/0x5bd fuse_direct_write_iter+0xf0/0x146 Auto disable FOPEN_PARALLEL_DIRECT_WRITES when server negotiated FUSE_DIRECT_IO_ALLOW_MMAP. Fixes: e78662e818f9 ("fuse: add a new fuse init flag to relax restrictions in no cache mode") Cc: # v6.6 Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi fs/fuse/file.c | 2 ++ 1 file changed, 2 insertions(+) commit 7f8ed28d1401320bcb02dda81b3c23ab2dc5a6d8 Author: Hangyu Hua Date: Thu Nov 16 15:57:26 2023 +0800 fuse: dax: set fc->dax to NULL in fuse_dax_conn_free() fuse_dax_conn_free() will be called when fuse_fill_super_common() fails after fuse_dax_conn_alloc(). Then deactivate_locked_super() in virtio_fs_get_tree() will call virtio_kill_sb() to release the discarded superblock. This will call fuse_dax_conn_free() again in fuse_conn_put(), resulting in a possible double free. Fixes: 1dd539577c42 ("virtiofs: add a mount option to enable dax") Signed-off-by: Hangyu Hua Acked-by: Vivek Goyal Reviewed-by: Jingbo Xu Cc: # v5.10 Signed-off-by: Miklos Szeredi fs/fuse/dax.c | 1 + 1 file changed, 1 insertion(+) commit c4d361f66ac91db8fc65061a9671682f61f4ca9d Author: Krister Johansen Date: Fri Nov 3 10:39:47 2023 -0700 fuse: share lookup state between submount and its parent Fuse submounts do not perform a lookup for the nodeid that they inherit from their parent. Instead, the code decrements the nlookup on the submount's fuse_inode when it is instantiated, and no forget is performed when a submount root is evicted. Trouble arises when the submount's parent is evicted despite the submount itself being in use. In this author's case, the submount was in a container and deatched from the initial mount namespace via a MNT_DEATCH operation. When memory pressure triggered the shrinker, the inode from the parent was evicted, which triggered enough forgets to render the submount's nodeid invalid. Since submounts should still function, even if their parent goes away, solve this problem by sharing refcounted state between the parent and its submount. When all of the references on this shared state reach zero, it's safe to forget the final lookup of the fuse nodeid. Signed-off-by: Krister Johansen Cc: stable@vger.kernel.org Fixes: 1866d779d5d2 ("fuse: Allow fuse_fill_super_common() for submounts") Signed-off-by: Miklos Szeredi fs/fuse/fuse_i.h | 15 ++++++++++++ fs/fuse/inode.c | 75 +++++++++++++++++++++++++++++++++++++++++++++++++++++--- 2 files changed, 87 insertions(+), 3 deletions(-) commit 11ca77cdcca17cec909d2b97404ddacfec0acafd Author: Tyler Fanelli Date: Tue Sep 19 22:40:01 2023 -0400 docs/fuse-io: Document the usage of DIRECT_IO_ALLOW_MMAP By default, shared mmap is disabled in FUSE DIRECT_IO mode. However, when the DIRECT_IO_ALLOW_MMAP flag is enabled in the FUSE_INIT reply, shared mmap is allowed. Signed-off-by: Tyler Fanelli Signed-off-by: Miklos Szeredi Documentation/filesystems/fuse-io.rst | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c55e0a55b165202f18cbc4a20650d2e1becd5507 Author: Tyler Fanelli Date: Tue Sep 19 22:40:00 2023 -0400 fuse: Rename DIRECT_IO_RELAX to DIRECT_IO_ALLOW_MMAP Although DIRECT_IO_RELAX's initial usage is to allow shared mmap, its description indicates a purpose of reducing memory footprint. This may imply that it could be further used to relax other DIRECT_IO operations in the future. Replace it with a flag DIRECT_IO_ALLOW_MMAP which does only one thing, allow shared mmap of DIRECT_IO files while still bypassing the cache on regular reads and writes. [Miklos] Also Keep DIRECT_IO_RELAX definition for backward compatibility. Signed-off-by: Tyler Fanelli Fixes: e78662e818f9 ("fuse: add a new fuse init flag to relax restrictions in no cache mode") Cc: # v6.6 Signed-off-by: Miklos Szeredi fs/fuse/file.c | 6 +++--- fs/fuse/fuse_i.h | 4 ++-- fs/fuse/inode.c | 6 +++--- include/uapi/linux/fuse.h | 10 ++++++---- 4 files changed, 14 insertions(+), 12 deletions(-) commit 52eb67861ebeb2110318bd9fe33d85ddcf92aac7 Author: Ayush Singh Date: Sun Dec 3 13:23:10 2023 +0530 greybus: gb-beagleplay: Ensure le for values in transport Ensure that the following values are little-endian: - header->pad (which is used for cport_id) - header->size Fixes: ec558bbfea67 ("greybus: Add BeaglePlay Linux Driver") Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202311072329.Xogj7hGW-lkp@intel.com/ Signed-off-by: Ayush Singh Link: https://lore.kernel.org/r/20231203075312.255233-1-ayushdevel1325@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/greybus/gb-beagleplay.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 4181ef7dbb63e638739e929bca5b7bca3a37a311 Author: Randy Dunlap Date: Mon Oct 30 21:09:09 2023 -0700 greybus: BeaglePlay driver needs CRC_CCITT The gb-beagleplay driver uses crc_ccitt(), so it should select CRC_CCITT to make sure that the function is available. Fixes these build errors: s390-linux-ld: drivers/greybus/gb-beagleplay.o: in function `hdlc_append_tx_u8': gb-beagleplay.c:(.text+0x2c0): undefined reference to `crc_ccitt' s390-linux-ld: drivers/greybus/gb-beagleplay.o: in function `hdlc_rx_frame': gb-beagleplay.c:(.text+0x6a0): undefined reference to `crc_ccitt' Fixes: ec558bbfea67 ("greybus: Add BeaglePlay Linux Driver") Signed-off-by: Randy Dunlap Cc: Ayush Singh Cc: Johan Hovold Cc: Alex Elder Cc: greybus-dev@lists.linaro.org Link: https://lore.kernel.org/r/20231031040909.21201-1-rdunlap@infradead.org Reviewed-by: Ayush Singh Signed-off-by: Greg Kroah-Hartman drivers/greybus/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 88ac06a9f938c158bbeafec16adb483b0c66142f Author: Johannes Berg Date: Sat Dec 2 11:49:37 2023 +0100 Revert "debugfs: annotate debugfs handlers vs. removal with lockdep" This reverts commit f4acfcd4deb1 ("debugfs: annotate debugfs handlers vs. removal with lockdep"), it appears to have false positives and really shouldn't have been in the -rc series with the fixes anyway. Signed-off-by: Johannes Berg Link: https://lore.kernel.org/r/20231202114936.fd55431ab160.I911aa53abeeca138126f690d383a89b13eb05667@changeid Signed-off-by: Greg Kroah-Hartman fs/debugfs/file.c | 10 ---------- fs/debugfs/inode.c | 7 ------- fs/debugfs/internal.h | 6 ------ 3 files changed, 23 deletions(-) commit 4906f39a1343713a4fb3fe78aecd12eba5257dc0 Merge: af54d778a038 33cc938e65a9 Author: Greg Kroah-Hartman Date: Mon Dec 4 07:42:16 2023 +0100 Merge 6.7-rc4 into char-misc-linus We need 6.7-rc4 in here as we need to revert one of the debugfs changes that came in that release through the wireless tree. Signed-off-by: Greg Kroah-Hartman commit f7b32e785042d2357c5abc23ca6db1b92c91a070 Author: Pavel Begunkov Date: Sun Dec 3 15:37:53 2023 +0000 io_uring: fix mutex_unlock with unreferenced ctx Callers of mutex_unlock() have to make sure that the mutex stays alive for the whole duration of the function call. For io_uring that means that the following pattern is not valid unless we ensure that the context outlives the mutex_unlock() call. mutex_lock(&ctx->uring_lock); req_put(req); // typically via io_req_task_submit() mutex_unlock(&ctx->uring_lock); Most contexts are fine: io-wq pins requests, syscalls hold the file, task works are taking ctx references and so on. However, the task work fallback path doesn't follow the rule. Cc: Fixes: 04fc6c802d ("io_uring: save ctx put/get for task_work submit") Reported-by: Jann Horn Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/io-uring/CAG48ez3xSoYb+45f1RLtktROJrpiDQ1otNvdR+YLQf7m+Krj5Q@mail.gmail.com/ Signed-off-by: Jens Axboe io_uring/io_uring.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit 59b6a747e2d39227ac2325c5e29d6ab3bb070c2a Author: Haoran Liu Date: Sun Dec 3 19:00:23 2023 +0000 Input: ipaq-micro-keys - add error handling for devm_kmemdup Check the return value of i2c_add_adapter. Static analysis revealed that the function did not properly handle potential failures of i2c_add_adapter, which could lead to partial initialization of the I2C adapter and unstable operation. Signed-off-by: Haoran Liu Link: https://lore.kernel.org/r/20231203164653.38983-1-liuhaoran14@163.com Fixes: d7535ffa427b ("Input: driver for microcontroller keys on the iPaq h3xxx") Signed-off-by: Dmitry Torokhov drivers/input/keyboard/ipaq-micro-keys.c | 3 +++ 1 file changed, 3 insertions(+) commit 0117591e69d1edff46bc87061e533a1e25a8c500 Author: Kent Overstreet Date: Thu Nov 30 23:32:20 2023 -0500 bcachefs: Don't drop journal pins in exit path There's no need to drop journal pins in our exit paths - the code was trying to have everything cleaned up on any shutdown, but better to just tweak the assertions a bit. This fixes a bug where calling into journal reclaim in the exit path would cass a null ptr deref. Signed-off-by: Kent Overstreet fs/bcachefs/btree_cache.c | 8 +++----- fs/bcachefs/btree_io.c | 4 ++-- fs/bcachefs/btree_io.h | 3 --- fs/bcachefs/btree_key_cache.c | 2 -- 4 files changed, 5 insertions(+), 12 deletions(-) commit 35fe2ad259a3bfca15ab78c8ffb5278cb6149c89 Author: Christophe JAILLET Date: Sun Dec 3 16:24:05 2023 +0100 hwmon: (nzxt-kraken2) Fix error handling path in kraken2_probe() There is no point in calling hid_hw_stop() if hid_hw_start() has failed. There is no point in calling hid_hw_close() if hid_hw_open() has failed. Update the error handling path accordingly. Fixes: 82e3430dfa8c ("hwmon: add driver for NZXT Kraken X42/X52/X62/X72") Reported-by: Aleksa Savic Closes: https://lore.kernel.org/all/121470f0-6c1f-418a-844c-7ec2e8a54b8e@gmail.com/ Signed-off-by: Christophe JAILLET Reviewed-by: Jonas Malaco Link: https://lore.kernel.org/r/a768e69851a07a1f4e29f270f4e2559063f07343.1701617030.git.christophe.jaillet@wanadoo.fr Signed-off-by: Guenter Roeck drivers/hwmon/nzxt-kraken2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 33cc938e65a98f1d29d0a18403dbbee050dcad9a Author: Linus Torvalds Date: Sun Dec 3 18:52:56 2023 +0900 Linux 6.7-rc4 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c5c325bb5849868d76969d3fe014515f5e99eabc Author: Pascal Noël Date: Fri Dec 1 17:37:44 2023 -0800 ALSA: hda/realtek: Apply quirk for ASUS UM3504DA The ASUS UM3504DA uses a Realtek HDA codec and two CS35L41 amplifiers via I2C. Apply existing quirk to model. Signed-off-by: Pascal Noël Cc: Link: https://lore.kernel.org/r/20231202013744.12369-1-pascal@pascalcompiles.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 968f35f4ab1c0966ceb39af3c89f2e24afedf878 Merge: 55abae438c3c 0015eb6e1238 Author: Linus Torvalds Date: Sun Dec 3 09:08:26 2023 +0900 Merge tag 'v6.7-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Two fallocate fixes - Fix warnings from new gcc - Two symlink fixes * tag 'v6.7-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client, common: fix fortify warnings cifs: Fix FALLOC_FL_INSERT_RANGE by setting i_size after EOF moved cifs: Fix FALLOC_FL_ZERO_RANGE by setting i_size if EOF moved smb: client: report correct st_size for SMB and NFS symlinks smb: client: fix missing mode bits for SMB symlinks commit 55abae438c3cf39f66c3e0cb922c3d915363afb5 Merge: 1b8af6552cb7 891e0eab32a5 Author: Linus Torvalds Date: Sun Dec 3 09:03:07 2023 +0900 Merge tag 'firewire-fixes-6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "A single patch to fix long-standing issue of memory leak at failure of device registration for fw_unit. We rarely encounter the issue, but it should be applied to stable releases, since it fixes inappropriate API usage" * tag 'firewire-fixes-6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: core: fix possible memory leak in create_units() commit 1b8af6552cb7c9bf1194e871f8d733a19b113230 Merge: 17b17be28d42 dc158d23b33d Author: Linus Torvalds Date: Sun Dec 3 08:43:35 2023 +0900 Merge tag 'powerpc-6.7-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix corruption of f0/vs0 during FP/Vector save, seen as userspace crashes when using io-uring workers (in particular with MariaDB) - Fix KVM_RUN potentially clobbering all host userspace FP/Vector registers Thanks to Timothy Pearson, Jens Axboe, and Nicholas Piggin. * tag 'powerpc-6.7-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: KVM: PPC: Book3S HV: Fix KVM_RUN clobbering FP/VEC user registers powerpc: Don't clobber f0/vs0 during fp|altivec register save commit 17b17be28d42f59f579ef9da2557b92a97291777 Merge: deb4b9dd3b53 4ea95c04fa6b Author: Linus Torvalds Date: Sun Dec 3 08:37:39 2023 +0900 Merge tag 'vfio-v6.7-rc4' of https://github.com/awilliam/linux-vfio Pull vfio fixes from Alex Williamson: - Fix the lifecycle of a mutex in the pds variant driver such that a reset prior to opening the device won't find it uninitialized. Implement the release path to symmetrically destroy the mutex. Also switch a different lock from spinlock to mutex as the code path has the potential to sleep and doesn't need the spinlock context otherwise (Brett Creeley) - Fix an issue detected via randconfig where KVM tries to symbol_get an undeclared function. The symbol is temporarily declared unconditionally here, which resolves the problem and avoids churn relative to a series pending for the next merge window which resolves some of this symbol ugliness, but also fixes Kconfig dependencies (Sean Christopherson) * tag 'vfio-v6.7-rc4' of https://github.com/awilliam/linux-vfio: vfio: Drop vfio_file_iommu_group() stub to fudge around a KVM wart vfio/pds: Fix possible sleep while in atomic context vfio/pds: Fix mutex lock->magic != lock warning commit deb4b9dd3b539c8331bbc0d64dff3b4fb57296ef Merge: 669fc83452d4 7f3da4b698bc Author: Linus Torvalds Date: Sun Dec 3 08:31:53 2023 +0900 Merge tag 'for-linus-6.7a-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - A fix for the Xen event driver setting the correct return value when experiencing an allocation failure - A fix for allocating space for a struct in the percpu area to not cross page boundaries (this one is for x86, a similar one for Arm was already in the pull request for rc3) * tag 'for-linus-6.7a-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/events: fix error code in xen_bind_pirq_msi_to_irq() x86/xen: fix percpu vcpu_info allocation commit 669fc83452d443cb48f03ce0ebc496562e1c2205 Merge: 815fb87b7530 a1461f1fd6cf Author: Linus Torvalds Date: Sun Dec 3 08:02:49 2023 +0900 Merge tag 'probes-fixes-v6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes fixes from Masami Hiramatsu: - objpool: Fix objpool overrun case on memory/cache access delay especially on the big.LITTLE SoC. The objpool uses a copy of object slot index internal loop, but the slot index can be changed on another processor in parallel. In that case, the difference of 'head' local copy and the 'slot->last' index will be bigger than local slot size. In that case, we need to re-read the slot::head to update it. - kretprobe: Fix to use appropriate rcu API for kretprobe holder. Since kretprobe_holder::rp is RCU managed, it should use rcu_assign_pointer() and rcu_dereference_check() correctly. Also adding __rcu tag for finding wrong usage by sparse. - rethook: Fix to use appropriate rcu API for rethook::handler. The same as kretprobe, rethook::handler is RCU managed and it should use rcu_assign_pointer() and rcu_dereference_check(). This also adds __rcu tag for finding wrong usage by sparse. * tag 'probes-fixes-v6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rethook: Use __rcu pointer for rethook::handler kprobes: consistent rcu api usage for kretprobe holder lib: objpool: fix head overrun on RK3588 SBC commit 4b0768b6556af56ee9b7cf4e68452a2b6289ae45 Author: ChunHao Lin Date: Wed Nov 29 23:53:50 2023 +0800 r8169: fix rtl8125b PAUSE frames blasting when suspended When FIFO reaches near full state, device will issue pause frame. If pause slot is enabled(set to 1), in this time, device will issue pause frame only once. But if pause slot is disabled(set to 0), device will keep sending pause frames until FIFO reaches near empty state. When pause slot is disabled, if there is no one to handle receive packets, device FIFO will reach near full state and keep sending pause frames. That will impact entire local area network. This issue can be reproduced in Chromebox (not Chromebook) in developer mode running a test image (and v5.10 kernel): 1) ping -f $CHROMEBOX (from workstation on same local network) 2) run "powerd_dbus_suspend" from command line on the $CHROMEBOX 3) ping $ROUTER (wait until ping fails from workstation) Takes about ~20-30 seconds after step 2 for the local network to stop working. Fix this issue by enabling pause slot to only send pause frame once when FIFO reaches near full state. Fixes: f1bce4ad2f1c ("r8169: add support for RTL8125") Reported-by: Grant Grundler Tested-by: Grant Grundler Cc: stable@vger.kernel.org Signed-off-by: ChunHao Lin Reviewed-by: Jacob Keller Reviewed-by: Heiner Kallweit Link: https://lore.kernel.org/r/20231129155350.5843-1-hau@realtek.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/realtek/r8169_main.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 9f6acd2b4dfef81dcc45486ac704cf602c88db02 Author: Sam Edwards Date: Fri Dec 1 23:12:12 2023 -0800 arm64: dts: rockchip: Fix Turing RK1 interrupt pinctrls The pinctrls for the hym8563 interrupt line and fan-tach input were both mistakenly defined as `pcfg_pull_none`. As these are active-low signals (level-triggered, in the hym8563 case) which may not be driven at times, these should really be pull-up. The lack of any bias results in spurious interrupts. Fix this by modifying the `rockchip,pins` properties as necessary to enable the pull-up resistors. Fixes: 2806a69f3fef6 ("arm64: dts: rockchip: Add Turing RK1 SoM support") Signed-off-by: Sam Edwards Link: https://lore.kernel.org/r/20231202071212.1606800-1-CFSworks@gmail.com Signed-off-by: Heiko Stuebner arch/arm64/boot/dts/rockchip/rk3588-turing-rk1.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9b8493dc43044376716d789d07699f17d538a7c4 Author: Borislav Petkov (AMD) Date: Fri Dec 1 19:37:27 2023 +0100 x86/CPU/AMD: Check vendor in the AMD microcode callback Commit in Fixes added an AMD-specific microcode callback. However, it didn't check the CPU vendor the kernel runs on explicitly. The only reason the Zenbleed check in it didn't run on other x86 vendors hardware was pure coincidental luck: if (!cpu_has_amd_erratum(c, amd_zenbleed)) return; gives true on other vendors because they don't have those families and models. However, with the removal of the cpu_has_amd_erratum() in 05f5f73936fa ("x86/CPU/AMD: Drop now unused CPU erratum checking function") that coincidental condition is gone, leading to the zenbleed check getting executed on other vendors too. Add the explicit vendor check for the whole callback as it should've been done in the first place. Fixes: 522b1d69219d ("x86/cpu/amd: Add a Zenbleed fix") Cc: Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20231201184226.16749-1-bp@alien8.de arch/x86/kernel/cpu/amd.c | 3 +++ 1 file changed, 3 insertions(+) commit 6c89f49964375c904cea33c0247467873f4daf2c Author: Randy Dunlap Date: Wed Nov 29 21:58:53 2023 -0800 hv_netvsc: rndis_filter needs to select NLS rndis_filter uses utf8s_to_utf16s() which is provided by setting NLS, so select NLS to fix the build error: ERROR: modpost: "utf8s_to_utf16s" [drivers/net/hyperv/hv_netvsc.ko] undefined! Fixes: 1ce09e899d28 ("hyperv: Add support for setting MAC from within guests") Signed-off-by: Randy Dunlap Cc: Haiyang Zhang Cc: K. Y. Srinivasan Cc: Wei Liu Cc: Dexuan Cui Reviewed-by: Simon Horman Tested-by: Simon Horman # build-tested Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20231130055853.19069-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski drivers/net/hyperv/Kconfig | 1 + 1 file changed, 1 insertion(+) commit a134cd8dfb8cdfd8f019a7ec2ad5cb8e855f0245 Merge: 8ad3ac92f076 c467e97f079f Author: Jens Axboe Date: Fri Dec 1 18:37:24 2023 -0700 Merge tag 'md-fixes-20231201-1' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-6.7 Pull MD fix from Song: "This change fixes issue with raid456 reshape." * tag 'md-fixes-20231201-1' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: md/raid6: use valid sector values to determine if an I/O should wait on the reshape commit 16b55b1f2269962fb6b5154b8bf43f37c9a96637 Author: Thinh Tran Date: Thu Nov 30 18:19:11 2023 -0600 net/tg3: fix race condition in tg3_reset_task() When an EEH error is encountered by a PCI adapter, the EEH driver modifies the PCI channel's state as shown below: enum { /* I/O channel is in normal state */ pci_channel_io_normal = (__force pci_channel_state_t) 1, /* I/O to channel is blocked */ pci_channel_io_frozen = (__force pci_channel_state_t) 2, /* PCI card is dead */ pci_channel_io_perm_failure = (__force pci_channel_state_t) 3, }; If the same EEH error then causes the tg3 driver's transmit timeout logic to execute, the tg3_tx_timeout() function schedules a reset task via tg3_reset_task_schedule(), which may cause a race condition between the tg3 and EEH driver as both attempt to recover the HW via a reset action. EEH driver gets error event --> eeh_set_channel_state() and set device to one of error state above scheduler: tg3_reset_task() get returned error from tg3_init_hw() --> dev_close() shuts down the interface tg3_io_slot_reset() and tg3_io_resume() fail to reset/resume the device To resolve this issue, we avoid the race condition by checking the PCI channel state in the tg3_reset_task() function and skip the tg3 driver initiated reset when the PCI channel is not in the normal state. (The driver has no access to tg3 device registers at this point and cannot even complete the reset task successfully without external assistance.) We'll leave the reset procedure to be managed by the EEH driver which calls the tg3_io_error_detected(), tg3_io_slot_reset() and tg3_io_resume() functions as appropriate. Adding the same checking in tg3_dump_state() to avoid dumping all device registers when the PCI channel is not in the normal state. Signed-off-by: Thinh Tran Tested-by: Venkata Sai Duggi Reviewed-by: David Christensen Reviewed-by: Michael Chan Link: https://lore.kernel.org/r/20231201001911.656-1-thinhtr@linux.vnet.ibm.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/tg3.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit 815fb87b753055df2d9e50f6cd80eb10235fe3e9 Merge: ce474ae7d006 a6b31256928d Author: Linus Torvalds Date: Sat Dec 2 09:01:00 2023 +0900 Merge tag 'pm-6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix issues in two cpufreq drivers, in the AMD P-state driver and in the power-capping DTPM framework. Specifics: - Fix the AMD P-state driver's EPP sysfs interface in the cases when the performance governor is in use (Ayush Jain) - Make the ->fast_switch() callback in the AMD P-state driver return the target frequency as expected (Gautham R. Shenoy) - Allow user space to control the range of frequencies to use via scaling_min_freq and scaling_max_freq when AMD P-state driver is in use (Wyes Karny) - Prevent power domains needed for wakeup signaling from being turned off during system suspend on Qualcomm systems and prevent performance states votes from runtime-suspended devices from being lost across a system suspend-resume cycle in qcom-cpufreq-nvmem (Stephan Gerhold) - Fix disabling the 792 Mhz OPP in the imx6q cpufreq driver for the i.MX6ULL types that can run at that frequency (Christoph Niedermaier) - Eliminate unnecessary and harmful conversions to uW from the DTPM (dynamic thermal and power management) framework (Lukasz Luba)" * tag 'pm-6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq/amd-pstate: Only print supported EPP values for performance governor cpufreq/amd-pstate: Fix scaling_min_freq and scaling_max_freq update powercap: DTPM: Fix unneeded conversions to micro-Watts cpufreq/amd-pstate: Fix the return value of amd_pstate_fast_switch() pmdomain: qcom: rpmpd: Set GENPD_FLAG_ACTIVE_WAKEUP cpufreq: qcom-nvmem: Preserve PM domain votes in system suspend cpufreq: qcom-nvmem: Enable virtual power domain devices cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily commit ce474ae7d006e4d451d8b9e23ee8110499edb62a Merge: 35f84584806e 7d4c44a53dad Author: Linus Torvalds Date: Sat Dec 2 08:52:20 2023 +0900 Merge tag 'acpi-6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "This fixes a recently introduced build issue on ARM32 and a NULL pointer dereference in the ACPI backlight driver due to a design issue exposed by a recent change in the ACPI bus type code. Specifics: - Fix a recently introduced build issue on ARM32 platforms caused by an inadvertent header file breakage (Dave Jiang) - Eliminate questionable usage of acpi_driver_data() in the ACPI backlight cooling device code that leads to NULL pointer dereferences after recent ACPI core changes (Hans de Goede)" * tag 'acpi-6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: video: Use acpi_video_device for cooling-dev driver data ACPI: Fix ARM32 platforms compile issue introduced by fw_table changes commit 35f84584806e4e127a667221c592f8ae248132f6 Merge: 1a2b4185669b f5259997f3e8 Author: Linus Torvalds Date: Sat Dec 2 08:48:59 2023 +0900 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fix from Catalin Marinas: "Fix a regression where the arm64 KPTI ends up enabled even on systems that don't need it" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Avoid enabling KPTI unnecessarily commit 1a2b4185669b6318cf75ec18d13fa5f8779ac073 Merge: 06a3c59f9cf4 c2183b3dcc9d Author: Linus Torvalds Date: Sat Dec 2 08:42:39 2023 +0900 Merge tag 'iommu-fixes-v6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - Fix race conditions in device probe path - Handle ERR_PTR() returns in __iommu_domain_alloc() path - Update MAINTAINERS entry for Qualcom IOMMUs - Printk argument fix in device tree specific code - Several Intel VT-d fixes from Lu Baolu: - Do not support enforcing cache coherency for non-empty domains - Avoid devTLB invalidation if iommu is off - Disable PCI ATS in legacy passthrough mode - Support non-PCI devices when clearing context - Fix incorrect cache invalidation for mm notification - Add MTL to quirk list to skip TE disabling - Set variable intel_dirty_ops to static * tag 'iommu-fixes-v6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu: Fix printk arg in of_iommu_get_resv_regions() iommu/vt-d: Set variable intel_dirty_ops to static iommu/vt-d: Fix incorrect cache invalidation for mm notification iommu/vt-d: Add MTL to quirk list to skip TE disabling iommu/vt-d: Make context clearing consistent with context mapping iommu/vt-d: Disable PCI ATS in legacy passthrough mode iommu/vt-d: Omit devTLB invalidation requests when TES=0 iommu/vt-d: Support enforce_cache_coherency only for empty domains iommu: Avoid more races around device probe MAINTAINERS: list all Qualcomm IOMMU drivers in the QUALCOMM IOMMU entry iommu: Flow ERR_PTR out from __iommu_domain_alloc() commit dfce9cb3140592b886838e06f3e0c25fea2a9cae Author: Yonghong Song Date: Thu Nov 30 18:46:40 2023 -0800 bpf: Fix a verifier bug due to incorrect branch offset comparison with cpu=v4 Bpf cpu=v4 support is introduced in [1] and Commit 4cd58e9af8b9 ("bpf: Support new 32bit offset jmp instruction") added support for new 32bit offset jmp instruction. Unfortunately, in function bpf_adj_delta_to_off(), for new branch insn with 32bit offset, the offset (plus/minor a small delta) compares to 16-bit offset bound [S16_MIN, S16_MAX], which caused the following verification failure: $ ./test_progs-cpuv4 -t verif_scale_pyperf180 ... insn 10 cannot be patched due to 16-bit range ... libbpf: failed to load object 'pyperf180.bpf.o' scale_test:FAIL:expect_success unexpected error: -12 (errno 12) #405 verif_scale_pyperf180:FAIL Note that due to recent llvm18 development, the patch [2] (already applied in bpf-next) needs to be applied to bpf tree for testing purpose. The fix is rather simple. For 32bit offset branch insn, the adjusted offset compares to [S32_MIN, S32_MAX] and then verification succeeded. [1] https://lore.kernel.org/all/20230728011143.3710005-1-yonghong.song@linux.dev [2] https://lore.kernel.org/bpf/20231110193644.3130906-1-yonghong.song@linux.dev Fixes: 4cd58e9af8b9 ("bpf: Support new 32bit offset jmp instruction") Signed-off-by: Yonghong Song Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20231201024640.3417057-1-yonghong.song@linux.dev kernel/bpf/core.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 42b8ff47720258d1f6a4412e780a480c139773a0 Author: Uwe Kleine-König Date: Fri Dec 1 14:37:48 2023 +0100 Input: amimouse - convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20231201133747.1099286-2-u.kleine-koenig@pengutronix.de Signed-off-by: Dmitry Torokhov drivers/input/mouse/amimouse.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 06a3c59f9cf4f550facf16a2f1e48ba364deb293 Merge: b1e51588aa50 a337c355719c Author: Linus Torvalds Date: Sat Dec 2 08:33:29 2023 +0900 Merge tag 'sound-6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "No surprise here, including only a collection of HD-audio device-specific small fixes" * tag 'sound-6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda: Disable power-save on KONTRON SinglePC ALSA: hda/realtek: Add supported ALC257 for ChromeOS ALSA: hda/realtek: Headset Mic VREF to 100% ALSA: hda: intel-nhlt: Ignore vbps when looking for DMIC 32 bps format ALSA: hda: cs35l56: Enable low-power hibernation mode on SPI ALSA: cs35l41: Fix for old systems which do not support command ALSA: hda: cs35l41: Remove unnecessary boolean state variable firmware_running ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro commit b1e51588aa50287c3d33e14969d47ccdd403ad80 Merge: c9a925b7bcd9 908f60642441 Author: Linus Torvalds Date: Sat Dec 2 08:18:59 2023 +0900 Merge tag 'drm-fixes-2023-12-01' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Weekly fixes, mostly amdgpu fixes with a scattering of nouveau, i915, and a couple of reverts. Hopefully it will quieten down in coming weeks. drm: - Revert unexport of prime helpers for fd/handle conversion dma_resv: - Do not double add fences in dma_resv_add_fence. gpuvm: - Fix GPUVM license identifier. i915: - Mark internal GSC engine with reserved uabi class - Take VGA converters into account in eDP probe - Fix intel_pre_plane_updates() call to ensure workarounds get applied panel: - Revert panel fixes as they require exporting device_is_dependent. nouveau: - fix oversized allocations in new vm path - fix zero-length array - remove a stray lock nt36523: - Fix error check for nt36523. amdgpu: - DMUB fix - DCN 3.5 fixes - XGMI fix - DCN 3.2 fixes - Vangogh suspend fix - NBIO 7.9 fix - GFX11 golden register fix - Backlight fix - NBIO 7.11 fix - IB test overflow fix - DCN 3.1.4 fixes - fix a runtime pm ref count - Retimer fix - ABM fix - DCN 3.1.5 fix - Fix AGP addressing - Fix possible memory leak in SMU error path - Make sure PME is enabled in D3 - Fix possible NULL pointer dereference in debugfs - EEPROM fix - GC 9.4.3 fix amdkfd: - IP version check fix - Fix memory leak in pqm_uninit()" * tag 'drm-fixes-2023-12-01' of git://anongit.freedesktop.org/drm/drm: (53 commits) Revert "drm/prime: Unexport helpers for fd/handle conversion" drm/amdgpu: Use another offset for GC 9.4.3 remap drm/amd/display: Fix some HostVM parameters in DML drm/amdkfd: Free gang_ctx_bo and wptr_bo in pqm_uninit drm/amdgpu: Update EEPROM I2C address for smu v13_0_0 drm/amd/display: Allow DTBCLK disable for DCN35 drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer drm/amd: Enable PCIe PME from D3 drm/amd/pm: fix a memleak in aldebaran_tables_init drm/amdgpu: fix AGP addressing when GART is not at 0 drm/amd/display: update dcn315 lpddr pstate latency drm/amd/display: fix ABM disablement drm/amd/display: Fix black screen on video playback with embedded panel drm/amd/display: Fix conversions between bytes and KB drm/amdkfd: Use common function for IP version check drm/amd/display: Remove config update drm/amd/display: Update DCN35 clock table policy drm/amd/display: force toggle rate wa for first link training for a retimer drm/amdgpu: correct the amdgpu runtime dereference usage count drm/amd/display: Update min Z8 residency time to 2100 for DCN314 ... commit c467e97f079f0019870c314996fae952cc768e82 Author: David Jeffery Date: Tue Nov 28 13:11:39 2023 -0500 md/raid6: use valid sector values to determine if an I/O should wait on the reshape During a reshape or a RAID6 array such as expanding by adding an additional disk, I/Os to the region of the array which have not yet been reshaped can stall indefinitely. This is from errors in the stripe_ahead_of_reshape function causing md to think the I/O is to a region in the actively undergoing the reshape. stripe_ahead_of_reshape fails to account for the q disk having a sector value of 0. By not excluding the q disk from the for loop, raid6 will always generate a min_sector value of 0, causing a return value which stalls. The function's max_sector calculation also uses min() when it should use max(), causing the max_sector value to always be 0. During a backwards rebuild this can cause the opposite problem where it allows I/O to advance when it should wait. Fixing these errors will allow safe I/O to advance in a timely manner and delay only I/O which is unsafe due to stripes in the middle of undergoing the reshape. Fixes: 486f60558607 ("md/raid5: Check all disks in a stripe_head for reshape progress") Cc: stable@vger.kernel.org # v6.0+ Signed-off-by: David Jeffery Tested-by: Laurence Oberman Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20231128181233.6187-1-djeffery@redhat.com drivers/md/raid5.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 49d8575ca6135a533218e40ddcb85462fd9ff1d2 Author: Miquel Raynal Date: Mon Nov 27 10:58:42 2023 +0100 spi: atmel: Drop unused defines These defines are leftovers from previous versions of the blamed commit, they are simply unused so drop them. Fixes: e0205d6203c2 ("spi: atmel: Prevent false timeouts on long transfers") Reported-by: Ronald Wahl Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20231127095842.389631-2-miquel.raynal@bootlin.com Signed-off-by: Mark Brown drivers/spi/spi-atmel.c | 3 --- 1 file changed, 3 deletions(-) commit 1ca2761a7734928ffe0678f88789266cf3d05362 Author: Miquel Raynal Date: Mon Nov 27 10:58:41 2023 +0100 spi: atmel: Do not cancel a transfer upon any signal The intended move from wait_for_completion_*() to wait_for_completion_interruptible_*() was to allow (very) long spi memory transfers to be stopped upon user request instead of freezing the machine forever as the timeout value could now be significantly bigger. However, depending on the user logic, applications can receive many signals for their own "internal" purpose and have nothing to do with the requested kernel operations, hence interrupting spi transfers upon any signal is probably not a wise choice. Instead, let's switch to wait_for_completion_killable_*() to only catch the "important" signals. This was likely the intended behavior anyway. Fixes: e0205d6203c2 ("spi: atmel: Prevent false timeouts on long transfers") Cc: stable@vger.kernel.org Reported-by: Ronald Wahl Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20231127095842.389631-1-miquel.raynal@bootlin.com Signed-off-by: Mark Brown drivers/spi/spi-atmel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c9a925b7bcd9552f19ba50519c6a49ed7ca61691 Merge: ee0c8a9b349e 73363c262d6a Author: Linus Torvalds Date: Sat Dec 2 06:47:32 2023 +0900 Merge tag 'io_uring-6.7-2023-11-30' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Fix an issue with discontig page checking for IORING_SETUP_NO_MMAP - Fix an issue with not allowing IORING_SETUP_NO_MMAP also disallowing mmap'ed buffer rings - Fix an issue with deferred release of memory mapped pages - Fix a lockdep issue with IORING_SETUP_NO_MMAP - Use fget/fput consistently, even from our sync system calls. No real issue here, but if we were ever to allow closing io_uring descriptors it would be required. Let's play it safe and just use the full ref counted versions upfront. Most uses of io_uring are threaded anyway, and hence already doing the full version underneath. * tag 'io_uring-6.7-2023-11-30' of git://git.kernel.dk/linux: io_uring: use fget/fput consistently io_uring: free io_buffer_list entries via RCU io_uring/kbuf: prune deferred locked cache when tearing down io_uring/kbuf: recycle freed mapped buffer ring entries io_uring/kbuf: defer release of mapped buffer rings io_uring: enable io_mem_alloc/free to be used in other parts io_uring: don't guard IORING_OFF_PBUF_RING with SETUP_NO_MMAP io_uring: don't allow discontig pages for IORING_SETUP_NO_MMAP commit ee0c8a9b349ecdc97f81f0000a94ac9be8d8006c Merge: abd792f330fa 8ad3ac92f076 Author: Linus Torvalds Date: Sat Dec 2 06:39:30 2023 +0900 Merge tag 'block-6.7-2023-12-01' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - NVMe pull request via Keith: - Invalid namespace identification error handling (Marizio Ewan, Keith) - Fabrics keep-alive tuning (Mark) - Fix for a bad error check regression in bcache (Markus) - Fix for a performance regression with O_DIRECT (Ming) - Fix for a flush related deadlock (Ming) - Make the read-only warn on per-partition (Yu) * tag 'block-6.7-2023-12-01' of git://git.kernel.dk/linux: nvme-core: check for too small lba shift blk-mq: don't count completed flush data request as inflight in case of quiesce block: Document the role of the two attribute groups block: warn once for each partition in bio_check_ro() block: move .bd_inode into 1st cacheline of block_device nvme: check for valid nvme_identify_ns() before using it nvme-core: fix a memory leak in nvme_ns_info_from_identify() nvme: fine-tune sending of first keep-alive bcache: revert replacing IS_ERR_OR_NULL with IS_ERR commit abd792f330fa328e8f8c30f3e32e609006c846fc Merge: ff4a9f49054a 41e05548fa6b Author: Linus Torvalds Date: Sat Dec 2 06:32:29 2023 +0900 Merge tag 'dm-6.7/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix DM verity target's FEC support to always initialize IO before it frees it. Also fix alignment of struct dm_verity_fec_io within the per-bio-data - Fix DM verity target to not FEC failed readahead IO - Update DM flakey target to use MAX_ORDER rather than MAX_ORDER - 1 * tag 'dm-6.7/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm-flakey: start allocating with MAX_ORDER dm-verity: align struct dm_verity_fec_io properly dm verity: don't perform FEC for failed readahead IO dm verity: initialize fec io before freeing it commit ff4a9f49054a9cc5ae733155398d2aff2ef90836 Merge: c1c09da07c55 b09d7f8fd50f Author: Linus Torvalds Date: Sat Dec 2 06:27:20 2023 +0900 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Three small fixes, one in drivers. The core changes are to the internal representation of flags in scsi_devices which removes space wasting bools in favour of single bit flags and to add a flag to force a runtime resume which is used by ATA devices" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: sd: Fix system start for ATA devices scsi: Change SCSI device boolean fields to single bit flags scsi: ufs: core: Clear cmd if abort succeeds in MCQ mode commit c1c09da07c550971a1764a113963533dcc8e4d2a Merge: e6861be452a5 8abc712ea486 Author: Linus Torvalds Date: Sat Dec 2 06:19:27 2023 +0900 Merge tag 'fs_for_v6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull ext2 fix from Jan Kara: "Fix an ext2 bug introduced by changes in ext2 & iomap stepping on each other toes (apparently ext2 driver does not get much testing in linux-next)" * tag 'fs_for_v6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: ext2: Fix ki_pos update for DIO buffered-io fallback case commit e6861be452a53a5de3e1a048eabd811a05a44915 Merge: 994d5c58e50e 415e5107b0dc Author: Linus Torvalds Date: Sat Dec 2 06:02:16 2023 +0900 Merge tag 'bcachefs-2023-11-29' of https://evilpiepirate.org/git/bcachefs Pull more bcachefs bugfixes from Kent Overstreet: - bcache & bcachefs were broken with CFI enabled; patch for closures to fix type punning - mark erasure coding as extra-experimental; there are incompatible disk space accounting changes coming for erasure coding, and I'm still seeing checksum errors in some tests - several fixes for durability-related issues (durability is a device specific setting where we can tell bcachefs that data on a given device should be counted as replicated x times) - a fix for a rare livelock when a btree node merge then updates a parent node that is almost full - fix a race in the device removal path, where dropping a pointer in a btree node to a device would be clobbered by an in flight btree write updating the btree node key on completion - fix one SRCU lock hold time warning in the btree gc code - ther's still a bunch more of these to fix - fix a rare race where we'd start copygc before initializing the "are we rw" percpu refcount; copygc would think we were already ro and die immediately * tag 'bcachefs-2023-11-29' of https://evilpiepirate.org/git/bcachefs: (23 commits) bcachefs: Extra kthread_should_stop() calls for copygc bcachefs: Convert gc_alloc_start() to for_each_btree_key2() bcachefs: Fix race between btree writes and metadata drop bcachefs: move journal seq assertion bcachefs: -EROFS doesn't count as move_extent_start_fail bcachefs: trace_move_extent_start_fail() now includes errcode bcachefs: Fix split_race livelock bcachefs: Fix bucket data type for stripe buckets bcachefs: Add missing validation for jset_entry_data_usage bcachefs: Fix zstd compress workspace size bcachefs: bpos is misaligned on big endian bcachefs: Fix ec + durability calculation bcachefs: Data update path won't accidentaly grow replicas bcachefs: deallocate_extra_replicas() bcachefs: Proper refcounting for journal_keys bcachefs: preserve device path as device name bcachefs: Fix an endianness conversion bcachefs: Start gc, copygc, rebalance threads after initing writes ref bcachefs: Don't stop copygc thread on device resize bcachefs: Make sure bch2_move_ratelimit() also waits for move_ops ... commit 7d4c44a53dade7103c3a9a928705db2326efba6f Merge: 172c48caed91 35732699f5d2 Author: Rafael J. Wysocki Date: Fri Dec 1 21:32:19 2023 +0100 Merge branch 'acpi-tables' Merge a fix for a recently introduced build issue on ARM32 platforms caused by an inadvertent header file breakage (Dave Jiang). * acpi-tables: ACPI: Fix ARM32 platforms compile issue introduced by fw_table changes commit a6b31256928d78204f8f282220d3b0d64387f79d Merge: 142c169b31be b817f1488fca Author: Rafael J. Wysocki Date: Fri Dec 1 21:07:55 2023 +0100 Merge branch 'powercap' Merge a power capping fix for 6.7-rc4 which eliminates unnecessary and harmful conversions to uW from the DTPM (dynamic thermal and power management) framework (Lukasz Luba). * powercap: powercap: DTPM: Fix unneeded conversions to micro-Watts commit ef8d89033c3f1f6a64757f066b2c17e76d1189f8 Author: Like Xu Date: Sat Oct 7 14:40:19 2023 +0800 KVM: x86: Remove 'return void' expression for 'void function' The requested info will be stored in 'guest_xsave->region' referenced by the incoming pointer "struct kvm_xsave *guest_xsave", thus there is no need to explicitly use return void expression for a void function "static void kvm_vcpu_ioctl_x86_get_xsave(...)". The issue is caught with [-Wpedantic]. Fixes: 2d287ec65e79 ("x86/fpu: Allow caller to constrain xfeatures when copying to uabi buffer") Signed-off-by: Like Xu Reviewed-by: Maxim Levitsky Link: https://lore.kernel.org/r/20231007064019.17472-1-likexu@tencent.com Signed-off-by: Sean Christopherson arch/x86/kvm/x86.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ea61294befd361ab8260c65d53987b400e5599a7 Author: Sean Christopherson Date: Wed Oct 18 13:46:24 2023 -0700 Revert "KVM: Prevent module exit until all VMs are freed" Revert KVM's misguided attempt to "fix" a use-after-module-unload bug that was actually due to failure to flush a workqueue, not a lack of module refcounting. Pinning the KVM module until kvm_vm_destroy() doesn't prevent use-after-free due to the module being unloaded, as userspace can invoke delete_module() the instant the last reference to KVM is put, i.e. can cause all KVM code to be unmapped while KVM is actively executing said code. Generally speaking, the many instances of module_put(THIS_MODULE) notwithstanding, outside of a few special paths, a module can never safely put the last reference to itself without creating deadlock, i.e. something external to the module *must* put the last reference. In other words, having VMs grab a reference to the KVM module is futile, pointless, and as evidenced by the now-reverted commit 70375c2d8fa3 ("Revert "KVM: set owner of cpu and vm file operations""), actively dangerous. This reverts commit 405294f29faee5de8c10cb9d4a90e229c2835279 and commit 5f6de5cbebee925a612856fce6f9182bb3eee0db. Fixes: 405294f29fae ("KVM: Unconditionally get a ref to /dev/kvm module when creating a VM") Fixes: 5f6de5cbebee ("KVM: Prevent module exit until all VMs are freed") Link: https://lore.kernel.org/r/20231018204624.1905300-4-seanjc@google.com Signed-off-by: Sean Christopherson virt/kvm/kvm_main.c | 7 ------- 1 file changed, 7 deletions(-) commit 087e15206d6ac0d46734e2b0ab34370c0fdca481 Author: Sean Christopherson Date: Wed Oct 18 13:46:22 2023 -0700 KVM: Set file_operations.owner appropriately for all such structures Set .owner for all KVM-owned filed types so that the KVM module is pinned until any files with callbacks back into KVM are completely freed. Using "struct kvm" as a proxy for the module, i.e. keeping KVM-the-module alive while there are active VMs, doesn't provide full protection. Userspace can invoke delete_module() the instant the last reference to KVM is put. If KVM itself puts the last reference, e.g. via kvm_destroy_vm(), then it's possible for KVM to be preempted and deleted/unloaded before KVM fully exits, e.g. when the task running kvm_destroy_vm() is scheduled back in, it will jump to a code page that is no longer mapped. Note, file types that can call into sub-module code, e.g. kvm-intel.ko or kvm-amd.ko on x86, must use the module pointer passed to kvm_init(), not THIS_MODULE (which points at kvm.ko). KVM assumes that if /dev/kvm is reachable, e.g. VMs are active, then the vendor module is loaded. To reduce the probability of forgetting to set .owner entirely, use THIS_MODULE for stats files where KVM does not call back into vendor code. This reverts commit 70375c2d8fa3fb9b0b59207a9c5df1e2e1205c10, and fixes several other file types that have been buggy since their introduction. Fixes: 70375c2d8fa3 ("Revert "KVM: set owner of cpu and vm file operations"") Fixes: 3bcd0662d66f ("KVM: X86: Introduce mmu_rmaps_stat per-vm debugfs file") Reported-by: Al Viro Link: https://lore.kernel.org/all/20231010003746.GN800259@ZenIV Link: https://lore.kernel.org/r/20231018204624.1905300-2-seanjc@google.com Signed-off-by: Sean Christopherson arch/x86/kvm/debugfs.c | 1 + virt/kvm/kvm_main.c | 11 ++++++++--- 2 files changed, 9 insertions(+), 3 deletions(-) commit 8ad3ac92f0760fdd8537857ee1adfde849ab0268 Merge: 0e4237ae8d15 74fbc88e1614 Author: Jens Axboe Date: Fri Dec 1 09:09:16 2023 -0700 Merge tag 'nvme-6.7-2023-12-01' of git://git.infradead.org/nvme into block-6.7 Pull NVMe fixes from Keith: "nvme fixes for Linux 6.7 - Invalid namespace identification error handling (Marizio Ewan, Keith) - Fabrics keep-alive tuning (Mark)" * tag 'nvme-6.7-2023-12-01' of git://git.infradead.org/nvme: nvme-core: check for too small lba shift nvme: check for valid nvme_identify_ns() before using it nvme-core: fix a memory leak in nvme_ns_info_from_identify() nvme: fine-tune sending of first keep-alive commit 74fbc88e161424b3b96a22b23a8e3e1edab9d05c Author: Keith Busch Date: Tue Nov 28 09:36:04 2023 -0800 nvme-core: check for too small lba shift The block layer doesn't support logical block sizes smaller than 512 bytes. The nvme spec doesn't support that small either, but the driver isn't checking to make sure the device responded with usable data. Failing to catch this will result in a kernel bug, either from a division by zero when stacking, or a zero length bio. Reviewed-by: Jens Axboe Signed-off-by: Keith Busch drivers/nvme/host/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit cefc9ba6aed48a3aa085888e3262ac2aa975714b Author: Shannon Nelson Date: Fri Nov 10 14:18:02 2023 -0800 pds_vdpa: set features order Fix up the order that the device and negotiated features are checked to get a more reliable difference when things get changed. Signed-off-by: Shannon Nelson Message-Id: <20231110221802.46841-4-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang drivers/vdpa/pds/vdpa_dev.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit dd3b8de16e90c5594eddd29aeeb99e97c6f863be Author: Shannon Nelson Date: Fri Nov 10 14:18:01 2023 -0800 pds_vdpa: clear config callback when status goes to 0 If the client driver is setting status to 0, something is getting shutdown and possibly removed. Make sure we clear the config_cb so that it doesn't end up crashing when trying to call a bogus callback. Signed-off-by: Shannon Nelson Message-Id: <20231110221802.46841-3-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang drivers/vdpa/pds/vdpa_dev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 4f317d6529d7fc3ab7769ef89645d43fc7eec61b Author: Shannon Nelson Date: Fri Nov 10 14:18:00 2023 -0800 pds_vdpa: fix up format-truncation complaint Our friendly kernel test robot has recently been pointing out some format-truncation issues. Here's a fix for one of them. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311040109.RfgJoE7L-lkp@intel.com/ Signed-off-by: Shannon Nelson Message-Id: <20231110221802.46841-2-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang drivers/vdpa/pds/debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 480b3e73720f6b5d76bef2387b1f9d19ed67573b Author: Steve Sistare Date: Fri Nov 3 05:26:27 2023 -0700 vdpa/mlx5: preserve CVQ vringh index mlx5_vdpa does not preserve userland's view of vring base for the control queue in the following sequence: ioctl VHOST_SET_VRING_BASE ioctl VHOST_VDPA_SET_STATUS VIRTIO_CONFIG_S_DRIVER_OK mlx5_vdpa_set_status() setup_cvq_vring() vringh_init_iotlb() vringh_init_kern() vrh->last_avail_idx = 0; ioctl VHOST_GET_VRING_BASE To fix, restore the value of cvq->vring.last_avail_idx after calling vringh_init_iotlb. Fixes: 5262912ef3cf ("vdpa/mlx5: Add support for control VQ and MAC setting") Signed-off-by: Steve Sistare Acked-by: Eugenio Pérez Acked-by: Jason Wang Message-Id: <1699014387-194368-1-git-send-email-steven.sistare@oracle.com> Signed-off-by: Michael S. Tsirkin drivers/vdpa/mlx5/net/mlx5_vnet.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 0e4237ae8d159e3d28f3cd83146a46f576ffb586 Author: Ming Lei Date: Fri Dec 1 16:56:05 2023 +0800 blk-mq: don't count completed flush data request as inflight in case of quiesce Request queue quiesce may interrupt flush sequence, and the original request may have been marked as COMPLETE, but can't get finished because of queue quiesce. This way is fine from driver viewpoint, because flush sequence is block layer concept, and it isn't related with driver. However, driver(such as dm-rq) can call blk_mq_queue_inflight() to count & drain inflight requests, then the wait & drain never gets done because the completed & not-finished flush request is counted as inflight. Fix this issue by not counting completed flush data request as inflight in case of quiesce. Cc: Mike Snitzer Cc: David Jeffery Cc: John Pittman Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20231201085605.577730-1-ming.lei@redhat.com Signed-off-by: Jens Axboe block/blk-mq.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) commit e238b68e6dc89ddab52bd98216fe5623e94792b1 Author: Peter Ujfalusi Date: Wed Nov 29 15:14:11 2023 +0200 ASoC: SOF: ipc4-topology: Correct data structures for the GAIN module Move the base_cfg to struct sof_ipc4_gain_data. This struct describes the message payload passed to the firmware via the mailbox. It is not wise to be 'clever' and try to use the first part of a struct as IPC message without marking the message section as packed and aligned. Signed-off-by: Peter Ujfalusi Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20231129131411.27516-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown sound/soc/sof/ipc4-control.c | 20 ++++++++++---------- sound/soc/sof/ipc4-topology.c | 31 +++++++++++++++---------------- sound/soc/sof/ipc4-topology.h | 18 +++++++++++++----- 3 files changed, 38 insertions(+), 31 deletions(-) commit c447636970e3409ac39f0bb8c2dcff6b726f36b0 Author: Peter Ujfalusi Date: Wed Nov 29 15:14:10 2023 +0200 ASoC: SOF: ipc4-topology: Correct data structures for the SRC module Separate the IPC message part as struct sof_ipc4_src_data. This struct describes the message payload passed to the firmware via the mailbox. It is not wise to be 'clever' and try to use the first part of a struct as IPC message without marking the message section as packed and aligned. Signed-off-by: Peter Ujfalusi Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20231129131411.27516-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown sound/soc/sof/ipc4-topology.c | 21 +++++++++++---------- sound/soc/sof/ipc4-topology.h | 16 ++++++++++++---- 2 files changed, 23 insertions(+), 14 deletions(-) commit a0575b4add21a243cc3257e75ad913cd5377d5f2 Author: Peter Ujfalusi Date: Tue Nov 28 14:39:14 2023 +0200 ASoC: hdac_hda: Conditionally register dais for HDMI and Analog The current driver is registering the same dais for each hdev found in the system which results duplicated widgets to be registered and the kernel log contains similar prints: snd_hda_codec_realtek ehdaudio0D0: ASoC: sink widget AIF1TX overwritten snd_hda_codec_realtek ehdaudio0D0: ASoC: source widget AIF1RX overwritten skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget hifi3 overwritten skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget hifi2 overwritten skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget hifi1 overwritten skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Codec Output Pin1 overwritten skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Codec Input Pin1 overwritten skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Analog Codec Playback overwritten skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Digital Codec Playback overwritten skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Alt Analog Codec Playback overwritten skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Analog Codec Capture overwritten skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Digital Codec Capture overwritten skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Alt Analog Codec Capture overwritten To avoid such issue, split the dai array into HDMI and non HDMI array and register them conditionally: for HDMI hdev only register the dais needed for HDMI for non HDMI hdev do not register the HDMI dais. Depends-on: 3d1dc8b1030d ("ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not available") Link: https://github.com/thesofproject/linux/issues/4509 Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Link: https://lore.kernel.org/r/20231128123914.3986-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown sound/soc/codecs/hdac_hda.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) commit a2f35ed1d237c459100adb0c39bb811d7f170977 Author: Neil Armstrong Date: Thu Nov 16 17:44:21 2023 +0100 ASoC: codecs: lpass-tx-macro: set active_decimator correct default value The -1 value for active_decimator[dai_id] is considered as "not set", but at probe the table is initialized a 0, this prevents enabling the DEC0 Mixer since it will be considered as already set. Initialize the table entries as -1 to fix tx_macro_tx_mixer_put(). Fixes: 1c6a7f5250ce ("ASoC: codecs: tx-macro: fix active_decimator array") Fixes: c1057a08af43 ("ASoC: codecs: tx-macro: fix kcontrol put") Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20231116-topic-sm8x50-upstream-tx-macro-fix-active-decimator-set-v1-1-6edf402f4b6f@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/lpass-tx-macro.c | 5 +++++ 1 file changed, 5 insertions(+) commit b24e3590c94ab0aba6e455996b502a83baa5c31c Author: Malcolm Hart Date: Mon Nov 27 20:36:00 2023 +0000 ASoC: amd: yc: Fix non-functional mic on ASUS E1504FA This patch adds ASUSTeK COMPUTER INC "E1504FA" to the quirks file acp6x-mach.c to enable microphone array on ASUS Vivobook GO 15. I have this laptop and can confirm that the patch succeeds in enabling the microphone array. Signed-off-by: Malcolm Hart Cc: stable@vger.kernel.org Rule: add Link: https://lore.kernel.org/stable/875y1nt1bx.fsf%405harts.com Link: https://lore.kernel.org/r/871qcbszh0.fsf@5harts.com Signed-off-by: Mark Brown sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 19650c0f402f53abe48a55a1c49c8ed9576a088c Author: Jeremy Soller Date: Mon Nov 27 11:42:38 2023 -0700 ASoC: amd: yc: Add DMI entry to support System76 Pangolin 13 Add pang13 quirk to enable the internal microphone. Signed-off-by: Jeremy Soller Signed-off-by: Tim Crawford Link: https://lore.kernel.org/r/20231127184237.32077-2-tcrawford@system76.com Signed-off-by: Mark Brown sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 830139e7b6911266a84a77e1f18abf758995cc89 Author: Subbaraya Sundeep Date: Wed Nov 29 11:11:48 2023 +0530 octeontx2-af: Check return value of nix_get_nixlf before using nixlf If a NIXLF is not attached to a PF/VF device then nix_get_nixlf function fails and returns proper error code. But npc_get_default_entry_action does not check it and uses garbage value in subsequent calls. Fix this by cheking the return value of nix_get_nixlf. Fixes: 967db3529eca ("octeontx2-af: add support for multicast/promisc packet replication feature") Signed-off-by: Subbaraya Sundeep Signed-off-by: David S. Miller drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 9572c949385aa2ef10368287c439bcb7935137c8 Author: Subbaraya Sundeep Date: Wed Nov 29 10:53:42 2023 +0530 octeontx2-pf: Add missing mutex lock in otx2_get_pauseparam All the mailbox messages sent to AF needs to be guarded by mutex lock. Add the missing lock in otx2_get_pauseparam function. Fixes: 75f36270990c ("octeontx2-pf: Support to enable/disable pause frames via ethtool") Signed-off-by: Subbaraya Sundeep Reviewed-by: Simon Horman Signed-off-by: David S. Miller drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit cf50b5cae84741268c7bd3fed568c1b8beef9fa9 Author: Jakub Kicinski Date: Tue Nov 28 06:59:15 2023 -0800 MAINTAINERS: exclude 9p from networking We don't have much to say about 9p, even tho it lives under net/. Avoid CCing netdev. Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit 95dd1e34ff5bbee93a28ff3947eceaf6de811b1a Author: Boerge Struempfel Date: Wed Nov 29 16:23:07 2023 +0100 gpiolib: sysfs: Fix error handling on failed export If gpio_set_transitory() fails, we should free the GPIO again. Most notably, the flag FLAG_REQUESTED has previously been set in gpiod_request_commit(), and should be reset on failure. To my knowledge, this does not affect any current users, since the gpio_set_transitory() mainly returns 0 and -ENOTSUPP, which is converted to 0. However the gpio_set_transitory() function calles the .set_config() function of the corresponding GPIO chip and there are some GPIO drivers in which some (unlikely) branches return other values like -EPROBE_DEFER, and -EINVAL. In these cases, the above mentioned FLAG_REQUESTED would not be reset, which results in the pin being blocked until the next reboot. Fixes: e10f72bf4b3e ("gpio: gpiolib: Generalise state persistence beyond sleep") Signed-off-by: Boerge Struempfel Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski drivers/gpio/gpiolib-sysfs.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) commit c2183b3dcc9dd41b768569ea88bededa58cceebb Author: Daniel Mentz Date: Tue Nov 7 22:22:26 2023 -0800 iommu: Fix printk arg in of_iommu_get_resv_regions() The variable phys is defined as (struct resource *) which aligns with the printk format specifier %pr. Taking the address of it results in a value of type (struct resource **) which is incompatible with the format specifier %pr. Therefore, remove the address of operator (&). Fixes: a5bf3cfce8cb ("iommu: Implement of_iommu_get_resv_regions()") Signed-off-by: Daniel Mentz Acked-by: Thierry Reding Link: https://lore.kernel.org/r/20231108062226.928985-1-danielmentz@google.com Signed-off-by: Joerg Roedel drivers/iommu/of_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 96d7e79401364c6e9a63af5f74f76792b03cb832 Author: Ville Syrjälä Date: Tue Nov 21 07:43:14 2023 +0200 drm/i915: Check pipe active state in {planes,vrr}_{enabling,disabling}() {planes,vrr}_{enabling,disabling}() are supposed to indicate whether the specific hardware feature is supposed to be enabling or disabling. That can only makes sense if the pipe is active overall. So check for that before we go poking at the hardware. I think we're semi-safe currently on due to: - intel_pre_plane_update() doesn't get called when the pipe was not-active prior to the commit, but this is actually a bug. This saves vrr_disabling(), and vrr_enabling() is called from deeper down where we have already checked hw.active. - active_planes mirrors the crtc's hw.active Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20231121054324.9988-2-ville.syrjala@linux.intel.com (cherry picked from commit bc53c4d56eb24dbe56cd2c66ef4e9fc9393b1533) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/intel_display.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 75475bb51e78a3f54ad2f69380f2a1c985e85f2d Author: Eric Dumazet Date: Wed Nov 29 16:06:30 2023 +0000 ipv6: fix potential NULL deref in fib6_add() If fib6_find_prefix() returns NULL, we should silently fallback using fib6_null_entry regardless of RT6_DEBUG value. syzbot reported: WARNING: CPU: 0 PID: 5477 at net/ipv6/ip6_fib.c:1516 fib6_add+0x310d/0x3fa0 net/ipv6/ip6_fib.c:1516 Modules linked in: CPU: 0 PID: 5477 Comm: syz-executor.0 Not tainted 6.7.0-rc2-syzkaller-00029-g9b6de136b5f0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:fib6_add+0x310d/0x3fa0 net/ipv6/ip6_fib.c:1516 Code: 00 48 8b 54 24 68 e8 42 22 00 00 48 85 c0 74 14 49 89 c6 e8 d5 d3 c2 f7 eb 5d e8 ce d3 c2 f7 e9 ca 00 00 00 e8 c4 d3 c2 f7 90 <0f> 0b 90 48 b8 00 00 00 00 00 fc ff df 48 8b 4c 24 38 80 3c 01 00 RSP: 0018:ffffc90005067740 EFLAGS: 00010293 RAX: ffffffff89cba5bc RBX: ffffc90005067ab0 RCX: ffff88801a2e9dc0 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90005067980 R08: ffffffff89cbca85 R09: 1ffff110040d4b85 R10: dffffc0000000000 R11: ffffed10040d4b86 R12: 00000000ffffffff R13: 1ffff110051c3904 R14: ffff8880206a5c00 R15: ffff888028e1c820 FS: 00007f763783c6c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f763783bff8 CR3: 000000007f74d000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __ip6_ins_rt net/ipv6/route.c:1303 [inline] ip6_route_add+0x88/0x120 net/ipv6/route.c:3847 ipv6_route_ioctl+0x525/0x7b0 net/ipv6/route.c:4467 inet6_ioctl+0x21a/0x270 net/ipv6/af_inet6.c:575 sock_do_ioctl+0x152/0x460 net/socket.c:1220 sock_ioctl+0x615/0x8c0 net/socket.c:1339 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xf8/0x170 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82 Fixes: 7bbfe00e0252 ("ipv6: fix general protection fault in fib6_add()") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Wei Wang Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20231129160630.3509216-1-edumazet@google.com Signed-off-by: Jakub Kicinski net/ipv6/ip6_fib.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit a1461f1fd6cfdc4b8917c9d4a91e92605d1f28dc Author: Masami Hiramatsu (Google) Date: Fri Dec 1 14:53:56 2023 +0900 rethook: Use __rcu pointer for rethook::handler Since the rethook::handler is an RCU-maganged pointer so that it will notice readers the rethook is stopped (unregistered) or not, it should be an __rcu pointer and use appropriate functions to be accessed. This will use appropriate memory barrier when accessing it. OTOH, rethook::data is never changed, so we don't need to check it in get_kretprobe(). NOTE: To avoid sparse warning, rethook::handler is defined by a raw function pointer type with __rcu instead of rethook_handler_t. Link: https://lore.kernel.org/all/170126066201.398836.837498688669005979.stgit@devnote2/ Fixes: 54ecbe6f1ed5 ("rethook: Add a generic return hook") Cc: stable@vger.kernel.org Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311241808.rv9ceuAh-lkp@intel.com/ Tested-by: JP Kobryn Signed-off-by: Masami Hiramatsu (Google) include/linux/kprobes.h | 6 ++---- include/linux/rethook.h | 7 ++++++- kernel/trace/rethook.c | 23 ++++++++++++++--------- 3 files changed, 22 insertions(+), 14 deletions(-) commit d839a656d0f3caca9f96e9bf912fd394ac6a11bc Author: JP Kobryn Date: Fri Dec 1 14:53:55 2023 +0900 kprobes: consistent rcu api usage for kretprobe holder It seems that the pointer-to-kretprobe "rp" within the kretprobe_holder is RCU-managed, based on the (non-rethook) implementation of get_kretprobe(). The thought behind this patch is to make use of the RCU API where possible when accessing this pointer so that the needed barriers are always in place and to self-document the code. The __rcu annotation to "rp" allows for sparse RCU checking. Plain writes done to the "rp" pointer are changed to make use of the RCU macro for assignment. For the single read, the implementation of get_kretprobe() is simplified by making use of an RCU macro which accomplishes the same, but note that the log warning text will be more generic. I did find that there is a difference in assembly generated between the usage of the RCU macros vs without. For example, on arm64, when using rcu_assign_pointer(), the corresponding store instruction is a store-release (STLR) which has an implicit barrier. When normal assignment is done, a regular store (STR) is found. In the macro case, this seems to be a result of rcu_assign_pointer() using smp_store_release() when the value to write is not NULL. Link: https://lore.kernel.org/all/20231122132058.3359-1-inwardvessel@gmail.com/ Fixes: d741bf41d7c7 ("kprobes: Remove kretprobe hash") Cc: stable@vger.kernel.org Signed-off-by: JP Kobryn Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) include/linux/kprobes.h | 7 ++----- kernel/kprobes.c | 4 ++-- 2 files changed, 4 insertions(+), 7 deletions(-) commit d67f39d2b81b6a8259944d2400c1ff4fe283ff72 Author: wuqiang.matt Date: Fri Dec 1 14:53:55 2023 +0900 lib: objpool: fix head overrun on RK3588 SBC objpool overrun stress with test_objpool on OrangePi5+ SBC triggered the following kernel warnings: WARNING: CPU: 6 PID: 3115 at lib/objpool.c:168 objpool_push+0xc0/0x100 This message is from objpool.c:168: WARN_ON_ONCE(tail - head > pool->nr_objs); The overrun test case is to validate the case that pre-allocated objects are insufficient: 8 objects are pre-allocated for each node and consumer thread per node tries to grab 16 objects in a row. The testing system is OrangePI 5+, with RK3588, a big.LITTLE SOC with 4x A76 and 4x A55. When disabling either all 4 big or 4 little cores, the overrun tests run well, and once with big and little cores mixed together, the overrun test would always cause an overrun loop. It's likely the memory timing differences of big and little cores cause this trouble. Here are the debugging data of objpool_try_get_slot after try_cmpxchg_release: objpool_pop: cpu: 4/0 0:0 head: 278/279 tail:278 last:276/278 The local copies of 'head' and 'last' were 278 and 276, and reloading of 'slot->head' and 'slot->last' got 279 and 278. After try_cmpxchg_release 'slot->head' became 'head + 1', which is correct. But what's wrong here is the stale value of 'last', and that stale value of 'last' finally led the overrun of 'head'. Memory updating of 'last' and 'head' are performed in push() and pop() independently, which could be the culprit leading this out of order visibility of 'last' and 'head'. So for objpool_try_get_slot(), it's not enough only checking the condition of 'head != slot', the implicit condition 'last - head <= nr_objs' must also be explicitly asserted to guarantee 'last' is always behind 'head' before the object retrieving. This patch will check and try reloading of 'head' and 'last' to ensure 'last' is behind 'head' at the time of object retrieving. Performance testings show the average impact is about 0.1% for X86_64 and 1.12% for ARM64. Here are the results: OS: Debian 10 X86_64, Linux 6.6rc HW: XEON 8336C x 2, 64 cores/128 threads, DDR4 3200MT/s 1T 2T 4T 8T 16T native: 49543304 99277826 199017659 399070324 795185848 objpool: 29909085 59865637 119692073 239750369 478005250 objpool+: 29879313 59230743 119609856 239067773 478509029 32T 48T 64T 96T 128T native: 1596927073 2390099988 2929397330 3183875848 3257546602 objpool: 957553042 1435814086 1680872925 2043126796 2165424198 objpool+: 956476281 1434491297 1666055740 2041556569 2157415622 OS: Debian 11 AARCH64, Linux 6.6rc HW: Kunpeng-920 96 cores/2 sockets/4 NUMA nodes, DDR4 2933 MT/s 1T 2T 4T 8T 16T native: 30890508 60399915 123111980 242257008 494002946 objpool: 14742531 28883047 57739948 115886644 232455421 objpool+: 14107220 29032998 57286084 113730493 232232850 24T 32T 48T 64T 96T native: 746406039 1000174750 1493236240 1998318364 2942911180 objpool: 349164852 467284332 702296756 934459713 1387898285 objpool+: 348388180 462750976 696606096 927865887 1368402195 Link: https://lore.kernel.org/all/20231114115148.298821-1-wuqiang.matt@bytedance.com/ Fixes: b4edb8d2d464 ("lib: objpool added: ring-array based lockless MPMC") Signed-off-by: wuqiang.matt Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) lib/objpool.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) commit 994d5c58e50e91bb02c7be4a91d5186292a895c8 Merge: 47669f40b14c d71f22365a9c Author: Linus Torvalds Date: Fri Dec 1 14:17:54 2023 +0900 Merge tag 'hardening-v6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: - struct_group: propagate attributes to top-level union (Dmitry Antipov) - gcc-plugins: randstruct: Update code comment in relayout_struct (Gustavo A. R. Silva) - MAINTAINERS: refresh LLVM support (Nick Desaulniers) * tag 'hardening-v6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: gcc-plugins: randstruct: Update code comment in relayout_struct() uapi: propagate __struct_group() attributes to the container union MAINTAINERS: refresh LLVM support commit 47669f40b14c32c9771e0852f7cd3a12eb044c2f Merge: 2594faafeee2 1bddcf77ce66 Author: Linus Torvalds Date: Fri Dec 1 14:03:05 2023 +0900 Merge tag 'linux_kselftest-kunit-fixes-6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull KUnit fixes from Shuah Khan: "Three fixes to warnings and run-time test behavior. With these fixes, test suite counter will be reset correctly before running tests, kunit will warn if tests are too slow, and eliminate warning when kfree() as an action" * tag 'linux_kselftest-kunit-fixes-6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: test: Avoid cast warning when adding kfree() as an action kunit: Reset suite counter right before running tests kunit: Warn if tests are slow commit 619f75dae2cf117b1d07f27b046b9ffb071c4685 Author: Jan Kara Date: Thu Nov 30 10:56:53 2023 +0100 ext4: fix warning in ext4_dio_write_end_io() The syzbot has reported that it can hit the warning in ext4_dio_write_end_io() because i_size < i_disksize. Indeed the reproducer creates a race between DIO IO completion and truncate expanding the file and thus ext4_dio_write_end_io() sees an inconsistent inode state where i_disksize is already updated but i_size is not updated yet. Since we are careful when setting up DIO write and consider it extending (and thus performing the IO synchronously with i_rwsem held exclusively) whenever it goes past either of i_size or i_disksize, we can use the same test during IO completion without risking entering ext4_handle_inode_extension() without i_rwsem held. This way we make it obvious both i_size and i_disksize are large enough when we report DIO completion without relying on unreliable WARN_ON. Reported-by: Fixes: 91562895f803 ("ext4: properly sync file size update after O_SYNC direct IO") Signed-off-by: Jan Kara Reviewed-by: Ritesh Harjani (IBM) Link: https://lore.kernel.org/r/20231130095653.22679-1-jack@suse.cz Signed-off-by: Theodore Ts'o fs/ext4/file.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) commit 6a3afb6ac6dfab158ebdd4b87941178f58c8939f Author: Zhang Yi Date: Wed Nov 29 19:47:40 2023 +0800 jbd2: increase the journal IO's priority Current jbd2 only add REQ_SYNC for descriptor block, metadata log buffer, commit buffer and superblock buffer, the submitted IO could be throttled by writeback throttle in block layer, that could lead to priority inversion in some cases. The log IO looks like a kind of high priority metadata IO, so it should not be throttled by WBT like QOS policies in block layer, let's add REQ_SYNC | REQ_IDLE to exempt from writeback throttle, and also add REQ_META together indicates it's a metadata IO. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20231129114740.2686201-2-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o fs/jbd2/commit.c | 9 +++++---- fs/jbd2/journal.c | 20 +++++++++++--------- include/linux/jbd2.h | 3 +++ 3 files changed, 19 insertions(+), 13 deletions(-) commit 85559227211020b270728104c3b89918f7af27ac Author: Zhang Yi Date: Wed Nov 29 19:47:39 2023 +0800 jbd2: correct the printing of write_flags in jbd2_write_superblock() The write_flags print in the trace of jbd2_write_superblock() is not real, so move the modification before the trace. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20231129114740.2686201-1-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o fs/jbd2/journal.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 1fefca6c57fb928d2131ff365270cbf863d89c88 Author: Armin Wolf Date: Fri Nov 24 19:27:47 2023 +0100 hwmon: (acpi_power_meter) Fix 4.29 MW bug The ACPI specification says: "If an error occurs while obtaining the meter reading or if the value is not available then an Integer with all bits set is returned" Since the "integer" is 32 bits in case of the ACPI power meter, userspace will get a power reading of 2^32 * 1000 miliwatts (~4.29 MW) in case of such an error. This was discovered due to a lm_sensors bugreport (https://github.com/lm-sensors/lm-sensors/issues/460). Fix this by returning -ENODATA instead. Tested-by: Fixes: de584afa5e18 ("hwmon driver for ACPI 4.0 power meters") Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20231124182747.13956-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck drivers/hwmon/acpi_power_meter.c | 4 ++++ 1 file changed, 4 insertions(+) commit 908f60642441cb4f9f0e1eb576e63b0011d318b9 Merge: a74229bcafe1 0514f63cfff3 Author: Dave Airlie Date: Fri Dec 1 13:56:22 2023 +1000 Merge tag 'amd-drm-fixes-6.7-2023-11-30' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.7-2023-11-30: amdgpu: - DMUB fix - DCN 3.5 fixes - XGMI fix - DCN 3.2 fixes - Vangogh suspend fix - NBIO 7.9 fix - GFX11 golden register fix - Backlight fix - NBIO 7.11 fix - IB test overflow fix - DCN 3.1.4 fixes - fix a runtime pm ref count - Retimer fix - ABM fix - DCN 3.1.5 fix - Fix AGP addressing - Fix possible memory leak in SMU error path - Make sure PME is enabled in D3 - Fix possible NULL pointer dereference in debugfs - EEPROM fix - GC 9.4.3 fix amdkfd: - IP version check fix - Fix memory leak in pqm_uninit() drm: - Revert unexport of prime helpers for fd/handle conversion Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20231130213135.5083-1-alexander.deucher@amd.com commit 2dcf5fde6dffb312a4bfb8ef940cea2d1f402e32 Author: Baokun Li Date: Mon Nov 27 14:33:13 2023 +0800 ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS For files with logical blocks close to EXT_MAX_BLOCKS, the file size predicted in ext4_mb_normalize_request() may exceed EXT_MAX_BLOCKS. This can cause some blocks to be preallocated that will not be used. And after [Fixes], the following issue may be triggered: ========================================================= kernel BUG at fs/ext4/mballoc.c:4653! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 1 PID: 2357 Comm: xfs_io 6.7.0-rc2-00195-g0f5cc96c367f Hardware name: linux,dummy-virt (DT) pc : ext4_mb_use_inode_pa+0x148/0x208 lr : ext4_mb_use_inode_pa+0x98/0x208 Call trace: ext4_mb_use_inode_pa+0x148/0x208 ext4_mb_new_inode_pa+0x240/0x4a8 ext4_mb_use_best_found+0x1d4/0x208 ext4_mb_try_best_found+0xc8/0x110 ext4_mb_regular_allocator+0x11c/0xf48 ext4_mb_new_blocks+0x790/0xaa8 ext4_ext_map_blocks+0x7cc/0xd20 ext4_map_blocks+0x170/0x600 ext4_iomap_begin+0x1c0/0x348 ========================================================= Here is a calculation when adjusting ac_b_ex in ext4_mb_new_inode_pa(): ex.fe_logical = orig_goal_end - EXT4_C2B(sbi, ex.fe_len); if (ac->ac_o_ex.fe_logical >= ex.fe_logical) goto adjust_bex; The problem is that when orig_goal_end is subtracted from ac_b_ex.fe_len it is still greater than EXT_MAX_BLOCKS, which causes ex.fe_logical to overflow to a very small value, which ultimately triggers a BUG_ON in ext4_mb_new_inode_pa() because pa->pa_free < len. The last logical block of an actual write request does not exceed EXT_MAX_BLOCKS, so in ext4_mb_normalize_request() also avoids normalizing the last logical block to exceed EXT_MAX_BLOCKS to avoid the above issue. The test case in [Link] can reproduce the above issue with 64k block size. Link: https://patchwork.kernel.org/project/fstests/list/?series=804003 Cc: # 6.4 Fixes: 93cdf49f6eca ("ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()") Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20231127063313.3734294-1-libaokun1@huawei.com Signed-off-by: Theodore Ts'o fs/ext4/mballoc.c | 4 ++++ 1 file changed, 4 insertions(+) commit 2594faafeee2f4406ff82790604e4e3f55037d60 Merge: 6172a5180fcc 57686a72da08 Author: Linus Torvalds Date: Fri Dec 1 10:17:16 2023 +0900 Merge tag 'perf-tools-fixes-for-v6.7-1-2023-11-29' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Namhyung Kim: "Assorted build fixes including: - fix compile errors in printf() with u64 on 32-bit systesm - sync kernel headers to the tool copies - update arm64 sysreg generation for tarballs - disable compile warnings on __packed attribute" * tag 'perf-tools-fixes-for-v6.7-1-2023-11-29' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: tools: Disable __packed attribute compiler warning due to -Werror=attributes perf build: Ensure sysreg-defs Makefile respects output dir tools perf: Add arm64 sysreg files to MANIFEST tools/perf: Update tools's copy of mips syscall table tools/perf: Update tools's copy of s390 syscall table tools/perf: Update tools's copy of powerpc syscall table tools/perf: Update tools's copy of x86 syscall table tools headers: Update tools's copy of s390/asm headers tools headers: Update tools's copy of arm64/asm headers tools headers: Update tools's copy of x86/asm headers tools headers: Update tools's copy of socket.h header tools headers UAPI: Update tools's copy of unistd.h header tools headers UAPI: Update tools's copy of vhost.h header tools headers UAPI: Update tools's copy of mount.h header tools headers UAPI: Update tools's copy of kvm.h header tools headers UAPI: Update tools's copy of fscrypt.h header tools headers UAPI: Update tools's copy of drm headers perf lock contention: Fix a build error on 32-bit perf kwork: Fix a build error on 32-bit commit 6172a5180fcc65170bfa2d49e55427567860f2a7 Merge: e8f60209d6cf 777f245eec81 Author: Linus Torvalds Date: Fri Dec 1 08:24:46 2023 +0900 Merge tag 'net-6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from bpf and wifi. Current release - regressions: - neighbour: fix __randomize_layout crash in struct neighbour - r8169: fix deadlock on RTL8125 in jumbo mtu mode Previous releases - regressions: - wifi: - mac80211: fix warning at station removal time - cfg80211: fix CQM for non-range use - tools: ynl-gen: fix unexpected response handling - octeontx2-af: fix possible buffer overflow - dpaa2: recycle the RX buffer only after all processing done - rswitch: fix missing dev_kfree_skb_any() in error path Previous releases - always broken: - ipv4: fix uaf issue when receiving igmp query packet - wifi: mac80211: fix debugfs deadlock at device removal time - bpf: - sockmap: af_unix stream sockets need to hold ref for pair sock - netdevsim: don't accept device bound programs - selftests: fix a char signedness issue - dsa: mv88e6xxx: fix marvell 6350 probe crash - octeontx2-pf: restore TC ingress police rules when interface is up - wangxun: fix memory leak on msix entry - ravb: keep reverse order of operations in ravb_remove()" * tag 'net-6.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (51 commits) net: ravb: Keep reverse order of operations in ravb_remove() net: ravb: Stop DMA in case of failures on ravb_open() net: ravb: Start TX queues after HW initialization succeeded net: ravb: Make write access to CXR35 first before accessing other EMAC registers net: ravb: Use pm_runtime_resume_and_get() net: ravb: Check return value of reset_control_deassert() net: libwx: fix memory leak on msix entry ice: Fix VF Reset paths when interface in a failed over aggregate bpf, sockmap: Add af_unix test with both sockets in map bpf, sockmap: af_unix stream sockets need to hold ref for pair sock tools: ynl-gen: always construct struct ynl_req_state ethtool: don't propagate EOPNOTSUPP from dumps ravb: Fix races between ravb_tx_timeout_work() and net related ops r8169: prevent potential deadlock in rtl8169_close r8169: fix deadlock on RTL8125 in jumbo mtu mode neighbour: Fix __randomize_layout crash in struct neighbour octeontx2-pf: Restore TC ingress police rules when interface is up octeontx2-pf: Fix adding mbox work queue entry when num_vfs > 64 net: stmmac: xgmac: Disable FPE MMC interrupts octeontx2-af: Fix possible buffer overflow ... commit e8f60209d6cf652a9cfda64371acea69f62770aa Merge: 09443a144c16 0cb19e50a911 Author: Linus Torvalds Date: Fri Dec 1 08:17:08 2023 +0900 Merge tag 'pmdomain-v6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fix from Ulf Hansson: - Avoid polling for the scmi_perf_domain on arm * tag 'pmdomain-v6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: arm: Avoid polling for scmi_perf_domain commit 09443a144c1642b302c9bc329eb9475ae95b4304 Merge: 16864755721d 477865af60b2 Author: Linus Torvalds Date: Fri Dec 1 08:15:05 2023 +0900 Merge tag 'mmc-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC core: - Fix CQE error recovery path MMC host: - cqhci: Fix CQE error recovery path - sdhci-pci-gli: Fix initialization of LPM - sdhci-sprd: Fix enabling/disabling of the vqmmc regulator" * tag 'mmc-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled mmc: sdhci-pci-gli: Disable LPM during initialization mmc: cqhci: Fix task clearing in CQE error recovery mmc: cqhci: Warn of halt or task clear failure mmc: block: Retry commands in CQE error recovery mmc: block: Be sure to wait while busy in CQE error recovery mmc: cqhci: Increase recovery halt timeout mmc: block: Do not lose cache flush during CQE error recovery commit 16864755721d53d7d866cf254905fde32370aa7c Merge: 9d3eac3c05ff 8f2244c9af24 Author: Linus Torvalds Date: Fri Dec 1 08:00:02 2023 +0900 Merge tag 'leds-fixes-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED fix from Lee Jones: - Remove duplicate sysfs entry 'color' from LEDs class * tag 'leds-fixes-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: leds: class: Don't expose color sysfs entry commit 9d3eac3c05ffb4e56cece2e7c4cc7fa2f1188748 Merge: 3b47bc037bd4 01b1e3ca0e5c Author: Linus Torvalds Date: Fri Dec 1 07:57:08 2023 +0900 Merge tag 'efi-urgent-for-v6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fix from Ard Biesheuvel: - Fix for EFI unaccepted memory handling * tag 'efi-urgent-for-v6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi/unaccepted: Fix off-by-one when checking for overlapping ranges commit a74229bcafe154c103ffa63eac3a513a2280088f Merge: 54001331d25c fb18fe0fdf22 Author: Dave Airlie Date: Fri Dec 1 08:05:31 2023 +1000 Merge tag 'drm-misc-fixes-2023-11-29' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Fixes for v6.7-rc4: - Revert panel fixes as they require exporting device_is_dependent. - Do not double add fences in dma_resv_add_fence. - Fix GPUVM license identifier. - Assorted nouveau fixes. - Fix error check for nt36523. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/561f807e-f9d3-43c1-80d3-8b41ba83c9ec@linux.intel.com commit 54001331d25c431849af621e89ac1a2c2736081a Merge: 2cc14f52aeb7 d21a3962d304 Author: Dave Airlie Date: Fri Dec 1 07:01:06 2023 +1000 Merge tag 'drm-intel-fixes-2023-11-30' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v6.7-rc4: - Mark internal GSC engine with reserved uabi class - Take VGA converters into account in eDP probe - Fix intel_pre_plane_updates() call to ensure workarounds get applied Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87msuv479z.fsf@intel.com commit 335fe00319e030d481a54d5e0e68d50c5e672c0e Author: Esther Shimanovich Date: Thu Nov 30 19:56:19 2023 +0000 Input: i8042 - add nomux quirk for Acer P459-G2-M After the laptop lid is opened, and the device resumes from S3 deep sleep, if the user presses a keyboard key while the screen is still black, the mouse and keyboard become unusable. Enabling this quirk prevents this behavior from occurring. Signed-off-by: Esther Shimanovich Link: https://lore.kernel.org/r/20231130195615.v2.1.Ibe78a9df97ecd18dc227a5cff67d3029631d9c11@changeid Signed-off-by: Dmitry Torokhov drivers/input/serio/i8042-acpipnpio.h | 8 ++++++++ 1 file changed, 8 insertions(+) commit 0514f63cfff38a0dcb7ba9c5f245827edc0c5107 Author: Felix Kuehling Date: Fri Nov 17 16:44:17 2023 -0500 Revert "drm/prime: Unexport helpers for fd/handle conversion" This reverts commit 71a7974ac7019afeec105a54447ae1dc7216cbb3. These helper functions are needed for KFD to export and import DMABufs the right way without duplicating the tracking of DMABufs associated with GEM objects while ensuring that move notifier callbacks are working as intended. CC: Christian König CC: Thomas Zimmermann Acked-by: Thomas Zimmermann Acked-by: Daniel Vetter Signed-off-by: Felix Kuehling Signed-off-by: Alex Deucher drivers/gpu/drm/drm_prime.c | 33 ++++++++++++++++++--------------- include/drm/drm_prime.h | 7 +++++++ 2 files changed, 25 insertions(+), 15 deletions(-) commit f5259997f3e8d6edfcc2daf5b2c0b34f074d7bc0 Author: Ard Biesheuvel Date: Mon Nov 27 13:00:51 2023 +0100 arm64: Avoid enabling KPTI unnecessarily Commit 42c5a3b04bf6 refactored the KPTI init code in a way that results in the use of non-global kernel mappings even on systems that have no need for it, and even when KPTI has been disabled explicitly via the command line. Ensure that this only happens when we have decided (based on the detected system-wide CPU features) that KPTI should be enabled. Fixes: 42c5a3b04bf6 ("arm64: Split kpti_install_ng_mappings()") Signed-off-by: Ard Biesheuvel Acked-by: Will Deacon Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20231127120049.2258650-6-ardb@google.com Signed-off-by: Catalin Marinas arch/arm64/kernel/cpufeature.c | 4 ++++ 1 file changed, 4 insertions(+) commit 4ea95c04fa6b9043a1a301240996aeebe3cb28ec Author: Sean Christopherson Date: Wed Nov 29 16:10:00 2023 -0800 vfio: Drop vfio_file_iommu_group() stub to fudge around a KVM wart Drop the vfio_file_iommu_group() stub and instead unconditionally declare the function to fudge around a KVM wart where KVM tries to do symbol_get() on vfio_file_iommu_group() (and other VFIO symbols) even if CONFIG_VFIO=n. Ensuring the symbol is always declared fixes a PPC build error when modules are also disabled, in which case symbol_get() simply points at the address of the symbol (with some attributes shenanigans). Because KVM does symbol_get() instead of directly depending on VFIO, the lack of a fully defined symbol is not problematic (ugly, but "fine"). arch/powerpc/kvm/../../../virt/kvm/vfio.c:89:7: error: attribute declaration must precede definition [-Werror,-Wignored-attributes] fn = symbol_get(vfio_file_iommu_group); ^ include/linux/module.h:805:60: note: expanded from macro 'symbol_get' #define symbol_get(x) ({ extern typeof(x) x __attribute__((weak,visibility("hidden"))); &(x); }) ^ include/linux/vfio.h:294:35: note: previous definition is here static inline struct iommu_group *vfio_file_iommu_group(struct file *file) ^ arch/powerpc/kvm/../../../virt/kvm/vfio.c:89:7: error: attribute declaration must precede definition [-Werror,-Wignored-attributes] fn = symbol_get(vfio_file_iommu_group); ^ include/linux/module.h:805:65: note: expanded from macro 'symbol_get' #define symbol_get(x) ({ extern typeof(x) x __attribute__((weak,visibility("hidden"))); &(x); }) ^ include/linux/vfio.h:294:35: note: previous definition is here static inline struct iommu_group *vfio_file_iommu_group(struct file *file) ^ 2 errors generated. Although KVM is firmly in the wrong (there is zero reason for KVM to build virt/kvm/vfio.c when VFIO is disabled), fudge around the error in VFIO as the stub is unnecessary and doesn't serve its intended purpose (KVM is the only external user of vfio_file_iommu_group()), and there is an in-flight series to clean up the entire KVM<->VFIO interaction, i.e. fixing this in KVM would result in more churn in the long run, and the stub needs to go away regardless. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202308251949.5IiaV0sz-lkp@intel.com Closes: https://lore.kernel.org/oe-kbuild-all/202309030741.82aLACDG-lkp@intel.com Closes: https://lore.kernel.org/oe-kbuild-all/202309110914.QLH0LU6L-lkp@intel.com Link: https://lore.kernel.org/all/0-v1-08396538817d+13c5-vfio_kvm_kconfig_jgg@nvidia.com Link: https://lore.kernel.org/all/20230916003118.2540661-1-seanjc@google.com Cc: Nick Desaulniers Cc: Jason Gunthorpe Tested-by: Michael Ellerman Fixes: c1cce6d079b8 ("vfio: Compile vfio_group infrastructure optionally") Signed-off-by: Sean Christopherson Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20231130001000.543240-1-seanjc@google.com Signed-off-by: Alex Williamson include/linux/vfio.h | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit 0015eb6e12384ff1c589928e84deac2ad1ceb236 Author: Dmitry Antipov Date: Tue Nov 28 13:53:47 2023 +0300 smb: client, common: fix fortify warnings When compiling with gcc version 14.0.0 20231126 (experimental) and CONFIG_FORTIFY_SOURCE=y, I've noticed the following: In file included from ./include/linux/string.h:295, from ./include/linux/bitmap.h:12, from ./include/linux/cpumask.h:12, from ./arch/x86/include/asm/paravirt.h:17, from ./arch/x86/include/asm/cpuid.h:62, from ./arch/x86/include/asm/processor.h:19, from ./arch/x86/include/asm/cpufeature.h:5, from ./arch/x86/include/asm/thread_info.h:53, from ./include/linux/thread_info.h:60, from ./arch/x86/include/asm/preempt.h:9, from ./include/linux/preempt.h:79, from ./include/linux/spinlock.h:56, from ./include/linux/wait.h:9, from ./include/linux/wait_bit.h:8, from ./include/linux/fs.h:6, from fs/smb/client/smb2pdu.c:18: In function 'fortify_memcpy_chk', inlined from '__SMB2_close' at fs/smb/client/smb2pdu.c:3480:4: ./include/linux/fortify-string.h:588:25: warning: call to '__read_overflow2_field' declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning] 588 | __read_overflow2_field(q_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ and: In file included from ./include/linux/string.h:295, from ./include/linux/bitmap.h:12, from ./include/linux/cpumask.h:12, from ./arch/x86/include/asm/paravirt.h:17, from ./arch/x86/include/asm/cpuid.h:62, from ./arch/x86/include/asm/processor.h:19, from ./arch/x86/include/asm/cpufeature.h:5, from ./arch/x86/include/asm/thread_info.h:53, from ./include/linux/thread_info.h:60, from ./arch/x86/include/asm/preempt.h:9, from ./include/linux/preempt.h:79, from ./include/linux/spinlock.h:56, from ./include/linux/wait.h:9, from ./include/linux/wait_bit.h:8, from ./include/linux/fs.h:6, from fs/smb/client/cifssmb.c:17: In function 'fortify_memcpy_chk', inlined from 'CIFS_open' at fs/smb/client/cifssmb.c:1248:3: ./include/linux/fortify-string.h:588:25: warning: call to '__read_overflow2_field' declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning] 588 | __read_overflow2_field(q_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In both cases, the fortification logic inteprets calls to 'memcpy()' as an attempts to copy an amount of data which exceeds the size of the specified field (i.e. more than 8 bytes from __le64 value) and thus issues an overread warning. Both of these warnings may be silenced by using the convenient 'struct_group()' quirk. Signed-off-by: Dmitry Antipov Acked-by: Namjae Jeon Signed-off-by: Steve French fs/smb/client/cifspdu.h | 24 ++++++++++++++---------- fs/smb/client/cifssmb.c | 6 ++++-- fs/smb/client/smb2pdu.c | 8 +++----- fs/smb/client/smb2pdu.h | 16 +++++++++------- fs/smb/common/smb2pdu.h | 17 ++++++++++------- 5 files changed, 40 insertions(+), 31 deletions(-) commit bfc7db1cb94ad664546d70212699f8cc6c539e8c Author: Konrad Dybcio Date: Thu Nov 30 15:04:45 2023 +0100 interconnect: qcom: sm8250: Enable sync_state Add the generic icc sync_state callback to ensure interconnect votes are taken into account, instead of being pegged at maximum values. Fixes: b95b668eaaa2 ("interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate") Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20231130-topic-8250icc_syncstate-v1-1-7ce78ba6e04c@linaro.org Signed-off-by: Georgi Djakov drivers/interconnect/qcom/sm8250.c | 1 + 1 file changed, 1 insertion(+) commit a337c355719c42a6c5b67e985ad753590ed844fb Author: Takashi Iwai Date: Thu Nov 30 16:13:21 2023 +0100 ALSA: hda: Disable power-save on KONTRON SinglePC It's been reported that the runtime PM on KONTRON SinglePC (PCI SSID 1734:1232) caused a stall of playback after a bunch of invocations. (FWIW, this looks like an timing issue, and the stall happens rather on the controller side.) As a workaround, disable the default power-save on this platform. Cc: Link: https://lore.kernel.org/r/20231130151321.9813-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/pci/hda/hda_intel.c | 2 ++ 1 file changed, 2 insertions(+) commit 4a6756f56bcf8e64c87144a626ce53aea4899c0e Author: Geert Uytterhoeven Date: Wed Nov 29 17:55:33 2023 +0100 reset: Fix crash when freeing non-existent optional resets When obtaining one or more optional resets, non-existent resets are stored as NULL pointers, and all related error and cleanup paths need to take this into account. Currently only reset_control_put() and reset_control_bulk_put() get this right. All of __reset_control_bulk_get(), of_reset_control_array_get(), and reset_control_array_put() lack the proper checking, causing NULL pointer dereferences on failure or release. Fix this by moving the existing check from reset_control_bulk_put() to __reset_control_put_internal(), so it applies to all callers. The double check in reset_control_put() doesn't hurt. Fixes: 17c82e206d2a3cd8 ("reset: Add APIs to manage array of resets") Fixes: 48d71395896d54ee ("reset: Add reset_control_bulk API") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/2440edae7ca8534628cdbaf559ded288f2998178.1701276806.git.geert+renesas@glider.be Signed-off-by: Philipp Zabel drivers/reset/core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit c72b9c33ef9695ad7ce7a6eb39a9df8a01b70796 Author: Kunwu Chan Date: Thu Nov 23 22:52:37 2023 +0800 ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. When 'soc_dev_attr->family' is NULL,it'll trigger the null pointer dereference issue, such as in 'soc_info_show'. And when 'soc_device_register' fails, it's necessary to release 'soc_dev_attr->family' to avoid memory leaks. Fixes: 6770b2114325 ("ARM: OMAP2+: Export SoC information to userspace") Signed-off-by: Kunwu Chan Message-ID: <20231123145237.609442-1-chentao@kylinos.cn> Signed-off-by: Tony Lindgren arch/arm/mach-omap2/id.c | 5 +++++ 1 file changed, 5 insertions(+) commit cbf54f37600e874d82886aa3b2f471778cae01ce Author: Armin Wolf Date: Wed Nov 29 19:16:54 2023 +0100 platform/x86: wmi: Skip blocks with zero instances Some machines like the HP Omen 17 ck2000nf contain WMI blocks with zero instances, so any WMI driver which tries to handle the associated WMI device will fail. Skip such WMI blocks to avoid confusing any WMI drivers. Reported-by: Alexis Belmonte Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218188 Fixes: bff431e49ff5 ("ACPI: WMI: Add ACPI-WMI mapping driver") Tested-by: Alexis Belmonte Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20231129181654.5800-1-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/wmi.c | 5 +++++ 1 file changed, 5 insertions(+) commit 1e5caee2ba8f1426e8098afb4ca38dc40a0ca71b Author: Andrew Davis Date: Mon Nov 13 12:16:04 2023 -0600 ARM: dts: dra7: Fix DRA7 L3 NoC node register size This node can access any part of the L3 configuration registers space, including CLK1 and CLK2 which are 0x800000 offset. Restore this area size to include these areas. Fixes: 7f2659ce657e ("ARM: dts: Move dra7 l3 noc to a separate node") Signed-off-by: Andrew Davis Message-ID: <20231113181604.546444-1-afd@ti.com> Signed-off-by: Tony Lindgren arch/arm/boot/dts/ti/omap/dra7.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 64111a0e22a9d4e0de7a5d04e7d5c21d0af4b900 Author: Adrián Larumbe Date: Sat Nov 25 20:52:03 2023 +0000 drm/panfrost: Fix incorrect updating of current device frequency It was noticed when setting the Panfrost's DVFS device to the performant governor, GPU frequency as reported by fdinfo had dropped to 0 permamently. There are two separate issues causing this behaviour: - Not initialising the device's current_frequency variable to its original value during device probe(). - Updating said variable in Panfrost devfreq's get_dev_status() rather than after the new OPP's frequency had been retrieved in target(), which meant the old frequency would be assigned instead. Signed-off-by: Adrián Larumbe Fixes: f11b0417eec2 ("drm/panfrost: Add fdinfo support GPU load metrics") Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://patchwork.freedesktop.org/patch/msgid/20231125205438.375407-3-adrian.larumbe@collabora.com drivers/gpu/drm/panfrost/panfrost_devfreq.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) commit 7701ce26c747322de1f1a87f8e32792582f33249 Author: Adrián Larumbe Date: Sat Nov 25 20:52:02 2023 +0000 drm/panfrost: Consider dma-buf imported objects as resident A GEM object constructed from a dma-buf imported sgtable should be regarded as being memory resident, because the dma-buf API mandates backing storage to be allocated when attachment succeeds. Signed-off-by: Adrián Larumbe Fixes: 9ccdac7aa822 ("drm/panfrost: Add fdinfo support for memory stats") Reported-by: Boris Brezillon Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://patchwork.freedesktop.org/patch/msgid/20231125205438.375407-2-adrian.larumbe@collabora.com drivers/gpu/drm/panfrost/panfrost_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 777f245eec8152926b411e3d4f4545310f52cbed Merge: 91fdb30ddfdb edf9bc396e05 Author: Paolo Abeni Date: Thu Nov 30 10:59:10 2023 +0100 Merge branch 'net-ravb-fixes-for-the-ravb-driver' Claudiu Beznea says: ==================== net: ravb: Fixes for the ravb driver This series adds some fixes for ravb driver. Patches in this series were initilly part of series at [1]. Changes in v2: - in description of patch 1/6 documented the addition of out_free_netdev goto label - collected tags - s/out_runtime_disable/out_rpm_disable in patch 2/6 - fixed typos in description of patch 6/6 Changes since [1]: - addressed review comments - added patch 6/6 [1] https://lore.kernel.org/all/20231120084606.4083194-1-claudiu.beznea.uj@bp.renesas.com/ ==================== Link: https://lore.kernel.org/r/20231128080439.852467-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Paolo Abeni commit edf9bc396e05081ca281ffb0cd41e44db478ff26 Author: Claudiu Beznea Date: Tue Nov 28 10:04:39 2023 +0200 net: ravb: Keep reverse order of operations in ravb_remove() On RZ/G3S SMARC Carrier II board having RGMII connections b/w Ethernet MACs and PHYs it has been discovered that doing unbind/bind for ravb driver in a loop leads to wrong speed and duplex for Ethernet links and broken connectivity (the connectivity cannot be restored even with bringing interface down/up). Before doing unbind/bind the Ethernet interfaces were configured though systemd. The sh instructions used to do unbind/bind were: $ cd /sys/bus/platform/drivers/ravb/ $ while :; do echo 11c30000.ethernet > unbind ; \ echo 11c30000.ethernet > bind; done It has been discovered that there is a race b/w IOCTLs initialized by systemd at the response of success binding and the "ravb_write(ndev, CCC_OPC_RESET, CCC)" call in ravb_remove() as follows: 1/ as a result of bind success the user space open/configures the interfaces tough an IOCTL; the following stack trace has been identified on RZ/G3S: Call trace: dump_backtrace+0x9c/0x100 show_stack+0x20/0x38 dump_stack_lvl+0x48/0x60 dump_stack+0x18/0x28 ravb_open+0x70/0xa58 __dev_open+0xf4/0x1e8 __dev_change_flags+0x198/0x218 dev_change_flags+0x2c/0x80 devinet_ioctl+0x640/0x708 inet_ioctl+0x1e4/0x200 sock_do_ioctl+0x50/0x108 sock_ioctl+0x240/0x358 __arm64_sys_ioctl+0xb0/0x100 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x34/0xb8 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x190/0x198 2/ this call may execute concurrently with ravb_remove() as the unbind/bind operation was executed in a loop 3/ if the operation mode is changed to RESET (through ravb_write(ndev, CCC_OPC_RESET, CCC) call in ravb_remove()) while the above ravb_open() is in progress it may lead to MAC (or PHY, or MAC-PHY connection, the right point hasn't been identified at the moment) to be broken, thus the Ethernet connectivity fails to restore. The simple fix for this is to move ravb_write(ndev, CCC_OPC_RESET, CCC)) after unregister_netdev() to avoid resetting the controller while the netdev interface is still registered. To avoid future issues in ravb_remove(), the patch follows the proper order of operations in ravb_remove(): reverse order compared with ravb_probe(). This avoids described races as the IOCTLs as well as unregister_netdev() (called now at the beginning of ravb_remove()) calls rtnl_lock() before continuing and IOCTLs check (though devinet_ioctl()) if device is still registered just after taking the lock: int devinet_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr) { // ... rtnl_lock(); ret = -ENODEV; dev = __dev_get_by_name(net, ifr->ifr_name); if (!dev) goto done; // ... done: rtnl_unlock(); out: return ret; } Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") Reviewed-by: Sergey Shtylyov Signed-off-by: Claudiu Beznea Signed-off-by: Paolo Abeni drivers/net/ethernet/renesas/ravb_main.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) commit eac16a733427ba0de2449ffc7bd3da32ddb65cb7 Author: Claudiu Beznea Date: Tue Nov 28 10:04:38 2023 +0200 net: ravb: Stop DMA in case of failures on ravb_open() In case ravb_phy_start() returns with error the settings applied in ravb_dmac_init() are not reverted (e.g. config mode). For this call ravb_stop_dma() on failure path of ravb_open(). Fixes: a0d2f20650e8 ("Renesas Ethernet AVB PTP clock driver") Reviewed-by: Sergey Shtylyov Signed-off-by: Claudiu Beznea Signed-off-by: Paolo Abeni drivers/net/ethernet/renesas/ravb_main.c | 1 + 1 file changed, 1 insertion(+) commit 6f32c086602050fc11157adeafaa1c1eb393f0af Author: Claudiu Beznea Date: Tue Nov 28 10:04:37 2023 +0200 net: ravb: Start TX queues after HW initialization succeeded ravb_phy_start() may fail. If that happens, the TX queues will remain started. Thus, move the netif_tx_start_all_queues() after PHY is successfully initialized. Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") Reviewed-by: Sergey Shtylyov Signed-off-by: Claudiu Beznea Reviewed-by: Kalesh AP Signed-off-by: Paolo Abeni drivers/net/ethernet/renesas/ravb_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d78c0ced60d5e2f8b5a4a0468a5c400b24aeadf2 Author: Claudiu Beznea Date: Tue Nov 28 10:04:36 2023 +0200 net: ravb: Make write access to CXR35 first before accessing other EMAC registers Hardware manual of RZ/G3S (and RZ/G2L) specifies the following on the description of CXR35 register (chapter "PHY interface select register (CXR35)"): "After release reset, make write-access to this register before making write-access to other registers (except MDIOMOD). Even if not need to change the value of this register, make write-access to this register at least one time. Because RGMII/MII MODE is recognized by accessing this register". The setup procedure for EMAC module (chapter "Setup procedure" of RZ/G3S, RZ/G2L manuals) specifies the E-MAC.CXR35 register is the first EMAC register that is to be configured. Note [A] from chapter "PHY interface select register (CXR35)" specifies the following: [A] The case which CXR35 SEL_XMII is used for the selection of RGMII/MII in APB Clock 100 MHz. (1) To use RGMII interface, Set ‘H’03E8_0000’ to this register. (2) To use MII interface, Set ‘H’03E8_0002’ to this register. Take into account these indication. Fixes: 1089877ada8d ("ravb: Add RZ/G2L MII interface support") Reviewed-by: Sergey Shtylyov Signed-off-by: Claudiu Beznea Signed-off-by: Paolo Abeni drivers/net/ethernet/renesas/ravb_main.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) commit 88b74831faaee455c2af380382d979fc38e79270 Author: Claudiu Beznea Date: Tue Nov 28 10:04:35 2023 +0200 net: ravb: Use pm_runtime_resume_and_get() pm_runtime_get_sync() may return an error. In case it returns with an error dev->power.usage_count needs to be decremented. pm_runtime_resume_and_get() takes care of this. Thus use it. Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") Reviewed-by: Sergey Shtylyov Signed-off-by: Claudiu Beznea Signed-off-by: Paolo Abeni drivers/net/ethernet/renesas/ravb_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit d8eb6ea4b302e7ff78535c205510e359ac10a0bd Author: Claudiu Beznea Date: Tue Nov 28 10:04:34 2023 +0200 net: ravb: Check return value of reset_control_deassert() reset_control_deassert() could return an error. Some devices cannot work if reset signal de-assert operation fails. To avoid this check the return code of reset_control_deassert() in ravb_probe() and take proper action. Along with it, the free_netdev() call from the error path was moved after reset_control_assert() on its own label (out_free_netdev) to free netdev in case reset_control_deassert() fails. Fixes: 0d13a1a464a0 ("ravb: Add reset support") Reviewed-by: Sergey Shtylyov Reviewed-by: Philipp Zabel Signed-off-by: Claudiu Beznea Signed-off-by: Paolo Abeni drivers/net/ethernet/renesas/ravb_main.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 27d25348d42161837be08fc63b04a2559d2e781c Author: Ashwin Dayanand Kamat Date: Wed Nov 29 16:10:29 2023 +0530 x86/sev: Fix kernel crash due to late update to read-only ghcb_version A write-access violation page fault kernel crash was observed while running cpuhotplug LTP testcases on SEV-ES enabled systems. The crash was observed during hotplug, after the CPU was offlined and the process was migrated to different CPU. setup_ghcb() is called again which tries to update ghcb_version in sev_es_negotiate_protocol(). Ideally this is a read_only variable which is initialised during booting. Trying to write it results in a pagefault: BUG: unable to handle page fault for address: ffffffffba556e70 #PF: supervisor write access in kernel mode #PF: error_code(0x0003) - permissions violation [ ...] Call Trace: ? __die_body.cold+0x1a/0x1f ? __die+0x2a/0x35 ? page_fault_oops+0x10c/0x270 ? setup_ghcb+0x71/0x100 ? __x86_return_thunk+0x5/0x6 ? search_exception_tables+0x60/0x70 ? __x86_return_thunk+0x5/0x6 ? fixup_exception+0x27/0x320 ? kernelmode_fixup_or_oops+0xa2/0x120 ? __bad_area_nosemaphore+0x16a/0x1b0 ? kernel_exc_vmm_communication+0x60/0xb0 ? bad_area_nosemaphore+0x16/0x20 ? do_kern_addr_fault+0x7a/0x90 ? exc_page_fault+0xbd/0x160 ? asm_exc_page_fault+0x27/0x30 ? setup_ghcb+0x71/0x100 ? setup_ghcb+0xe/0x100 cpu_init_exception_handling+0x1b9/0x1f0 The fix is to call sev_es_negotiate_protocol() only in the BSP boot phase, and it only needs to be done once in any case. [ mingo: Refined the changelog. ] Fixes: 95d33bfaa3e1 ("x86/sev: Register GHCB memory when SEV-SNP is active") Suggested-by: Tom Lendacky Co-developed-by: Bo Gan Signed-off-by: Bo Gan Signed-off-by: Ashwin Dayanand Kamat Signed-off-by: Ingo Molnar Acked-by: Tom Lendacky Link: https://lore.kernel.org/r/1701254429-18250-1-git-send-email-kashwindayan@vmware.com arch/x86/kernel/sev.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit cb9c919364653eeafb49e7ff5cd32f1ad64063ac Author: Dave Airlie Date: Thu Nov 30 11:08:52 2023 +1000 nouveau/tu102: flush all pdbs on vmm flush This is a hack around a bug exposed with the GSP code, I'm not sure what is happening exactly, but it appears some of our flushes don't result in proper tlb invalidation for out BAR2 and we get a BAR2 fault from GSP and it all dies. Signed-off-by: Dave Airlie Signed-off-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/20231130010852.4034774-1-airlied@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 91fdb30ddfdb651509914d3ed0a0302712540fed Author: Jiawen Wu Date: Tue Nov 28 17:59:28 2023 +0800 net: libwx: fix memory leak on msix entry Since pci_free_irq_vectors() set pdev->msix_enabled as 0 in the calling of pci_msix_shutdown(), wx->msix_entries is never freed. Reordering the lines to fix the memory leak. Cc: stable@vger.kernel.org Fixes: 3f703186113f ("net: libwx: Add irq flow functions") Signed-off-by: Jiawen Wu Reviewed-by: Kalesh AP Link: https://lore.kernel.org/r/20231128095928.1083292-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/wangxun/libwx/wx_lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9f74a3dfcf83e11aedcb98250b8040dbc6d9659a Author: Dave Ertman Date: Mon Nov 27 13:23:38 2023 -0800 ice: Fix VF Reset paths when interface in a failed over aggregate There is an error when an interface has the following conditions: - PF is in an aggregate (bond) - PF has VFs created on it - bond is in a state where it is failed-over to the secondary interface - A VF reset is issued on one or more of those VFs The issue is generated by the originating PF trying to rebuild or reconfigure the VF resources. Since the bond is failed over to the secondary interface the queue contexts are in a modified state. To fix this issue, have the originating interface reclaim its resources prior to the tear-down and rebuild or reconfigure. Then after the process is complete, move the resources back to the currently active interface. There are multiple paths that can be used depending on what triggered the event, so create a helper function to move the queues and use paired calls to the helper (back to origin, process, then move back to active interface) under the same lag_mutex lock. Fixes: 1e0f9881ef79 ("ice: Flesh out implementation of support for SRIOV on bonded interface") Signed-off-by: Dave Ertman Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen Reviewed-by: Przemek Kitszel Link: https://lore.kernel.org/r/20231127212340.1137657-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/ice/ice_lag.c | 122 +++++++++++++++----------- drivers/net/ethernet/intel/ice/ice_lag.h | 1 + drivers/net/ethernet/intel/ice/ice_vf_lib.c | 20 +++++ drivers/net/ethernet/intel/ice/ice_virtchnl.c | 25 ++++++ 4 files changed, 118 insertions(+), 50 deletions(-) commit 300fbb247eb3d2146b37c8dc127056f695091218 Merge: 0d47fa5cc91b 4ded3bfe1db6 Author: Jakub Kicinski Date: Wed Nov 29 19:43:34 2023 -0800 Merge tag 'wireless-2023-11-29' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== wireless fixes: - debugfs had a deadlock (removal vs. use of files), fixes going through wireless ACKed by Greg - support for HT STAs on 320 MHz channels, even if it's not clear that should ever happen (that's 6 GHz), best not to WARN() - fix for the previous CQM fix that broke most cases - various wiphy locking fixes - various small driver fixes * tag 'wireless-2023-11-29' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211: use wiphy locked debugfs for sdata/link wifi: mac80211: use wiphy locked debugfs helpers for agg_status wifi: cfg80211: add locked debugfs wrappers debugfs: add API to allow debugfs operations cancellation debugfs: annotate debugfs handlers vs. removal with lockdep debugfs: fix automount d_fsdata usage wifi: mac80211: handle 320 MHz in ieee80211_ht_cap_ie_to_sta_ht_cap wifi: avoid offset calculation on NULL pointer wifi: cfg80211: hold wiphy mutex for send_interface wifi: cfg80211: lock wiphy mutex for rfkill poll wifi: cfg80211: fix CQM for non-range use wifi: mac80211: do not pass AP_VLAN vif pointer to drivers during flush wifi: iwlwifi: mvm: fix an error code in iwl_mvm_mld_add_sta() wifi: mt76: mt7925: fix typo in mt7925_init_he_caps wifi: mt76: mt7921: fix 6GHz disabled by the missing default CLC config ==================== Link: https://lore.kernel.org/r/20231129150809.31083-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 0d47fa5cc91b9c8a0c90833bf1705048b2295714 Merge: 83f2df9d66bc 51354f700d40 Author: Jakub Kicinski Date: Wed Nov 29 19:40:04 2023 -0800 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2023-11-30 We've added 5 non-merge commits during the last 7 day(s) which contain a total of 10 files changed, 66 insertions(+), 15 deletions(-). The main changes are: 1) Fix AF_UNIX splat from use after free in BPF sockmap, from John Fastabend. 2) Fix a syzkaller splat in netdevsim by properly handling offloaded programs (and not device-bound ones), from Stanislav Fomichev. 3) Fix bpf_mem_cache_alloc_flags() to initialize the allocation hint, from Hou Tao. 4) Fix netkit by rejecting IFLA_NETKIT_PEER_INFO in changelink, from Daniel Borkmann. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf, sockmap: Add af_unix test with both sockets in map bpf, sockmap: af_unix stream sockets need to hold ref for pair sock netkit: Reject IFLA_NETKIT_PEER_INFO in netkit_change_link bpf: Add missed allocation hint for bpf_mem_cache_alloc_flags() netdevsim: Don't accept device bound programs ==================== Link: https://lore.kernel.org/r/20231129234916.16128-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 88010155f02b2c3b03c71609ba6ceeb457ece095 Author: David Howells Date: Wed Nov 29 16:56:18 2023 +0000 cifs: Fix FALLOC_FL_INSERT_RANGE by setting i_size after EOF moved Fix the cifs filesystem implementations of FALLOC_FL_INSERT_RANGE, in smb3_insert_range(), to set i_size after extending the file on the server and before we do the copy to open the gap (as we don't clean up the EOF marker if the copy fails). Fixes: 7fe6fe95b936 ("cifs: add FALLOC_FL_INSERT_RANGE support") Cc: stable@vger.kernel.org Signed-off-by: David Howells Acked-by: Paulo Alcantara cc: Shyam Prasad N cc: Rohith Surabattula cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: linux-mm@kvack.org Signed-off-by: Steve French fs/smb/client/smb2ops.c | 3 +++ 1 file changed, 3 insertions(+) commit 83d5518b124dfd605f10a68128482c839a239f9d Author: David Howells Date: Wed Nov 29 16:56:17 2023 +0000 cifs: Fix FALLOC_FL_ZERO_RANGE by setting i_size if EOF moved Fix the cifs filesystem implementations of FALLOC_FL_ZERO_RANGE, in smb3_zero_range(), to set i_size after extending the file on the server. Fixes: 72c419d9b073 ("cifs: fix smb3_zero_range so it can expand the file-size when required") Cc: stable@vger.kernel.org Signed-off-by: David Howells Acked-by: Paulo Alcantara cc: Shyam Prasad N cc: Rohith Surabattula cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: linux-mm@kvack.org Signed-off-by: Steve French fs/smb/client/smb2ops.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 0e33ac9c3ffe5e4f55c68345f44cea7fec2fe750 Author: Alison Schofield Date: Sun Nov 26 16:09:30 2023 -0800 cxl/memdev: Hold region_rwsem during inject and clear poison ops Poison inject and clear are supported via debugfs where a privileged user can inject and clear poison to a device physical address. Commit 458ba8189cb4 ("cxl: Add cxl_decoders_committed() helper") added a lockdep assert that highlighted a gap in poison inject and clear functions where holding the dpa_rwsem does not assure that a a DPA is not added to a region. The impact for inject and clear is that if the DPA address being injected or cleared has been attached to a region, but not yet committed, the dev_dbg() message intended to alert the debug user that they are acting on a mapped address is not emitted. Also, the cxl_poison trace event that serves as a log of the inject and clear activity will not include region info. Close this gap by snapshotting an unchangeable region state during poison inject and clear operations. That means holding both the region_rwsem and the dpa_rwsem during the inject and clear ops. Fixes: d2fbc4865802 ("cxl/memdev: Add support for the Inject Poison mailbox command") Fixes: 9690b07748d1 ("cxl/memdev: Add support for the Clear Poison mailbox command") Signed-off-by: Alison Schofield Reviewed-by: Davidlohr Bueso Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/08721dc1df0a51e4e38fecd02425c3475912dfd5.1701041440.git.alison.schofield@intel.com Signed-off-by: Dan Williams drivers/cxl/core/memdev.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) commit 5558b92e8d39e18aa19619be2ee37274e9592528 Author: Alison Schofield Date: Sun Nov 26 16:09:29 2023 -0800 cxl/core: Always hold region_rwsem while reading poison lists A read of a device poison list is triggered via a sysfs attribute and the results are logged as kernel trace events of type cxl_poison. The work is managed by either: a) the region driver when one of more regions map the device, or by b) the memdev driver when no regions map the device. In the case of a) the region driver holds the region_rwsem while reading the poison by committed endpoint decoder mappings and for any unmapped resources. This makes sure that the cxl_poison trace event trace reports valid region info. (Region name, HPA, and UUID). In the case of b) the memdev driver holds the dpa_rwsem preventing new DPA resources from being attached to a region. However, it leaves a gap between region attach and decoder commit actions. If a DPA in the gap is in the poison list, the cxl_poison trace event will omit the region info. Close the gap by holding the region_rwsem and the dpa_rwsem when reading poison per memdev. Since both methods now hold both locks, down_read both from the caller. Doing so also addresses the lockdep assert that found this issue: Commit 458ba8189cb4 ("cxl: Add cxl_decoders_committed() helper") Fixes: f0832a586396 ("cxl/region: Provide region info to the cxl_poison trace event") Signed-off-by: Alison Schofield Reviewed-by: Davidlohr Bueso Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/08e8e7ec9a3413b91d51de39e385653494b1eed0.1701041440.git.alison.schofield@intel.com Signed-off-by: Dan Williams drivers/cxl/core/memdev.c | 9 ++++++++- drivers/cxl/core/region.c | 5 ----- 2 files changed, 8 insertions(+), 6 deletions(-) commit 6f9c4d8c468c189d6dc470324bd52955f8aa0a10 Author: Jason Gunthorpe Date: Sun Nov 12 15:44:08 2023 -0400 iommufd: Do not UAF during iommufd_put_object() The mixture of kernel and user space lifecycle objects continues to be complicated inside iommufd. The obj->destroy_rwsem is used to bring order to the kernel driver destruction sequence but it cannot be sequenced right with the other refcounts so we end up possibly UAF'ing: BUG: KASAN: slab-use-after-free in __up_read+0x627/0x750 kernel/locking/rwsem.c:1342 Read of size 8 at addr ffff888073cde868 by task syz-executor934/6535 CPU: 1 PID: 6535 Comm: syz-executor934 Not tainted 6.6.0-rc7-syzkaller-00195-g2af9b20dbb39 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xc4/0x620 mm/kasan/report.c:475 kasan_report+0xda/0x110 mm/kasan/report.c:588 __up_read+0x627/0x750 kernel/locking/rwsem.c:1342 iommufd_put_object drivers/iommu/iommufd/iommufd_private.h:149 [inline] iommufd_vfio_ioas+0x46c/0x580 drivers/iommu/iommufd/vfio_compat.c:146 iommufd_fops_ioctl+0x347/0x4d0 drivers/iommu/iommufd/main.c:398 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl fs/ioctl.c:857 [inline] __x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd There are two races here, the more obvious one: CPU 0 CPU 1 iommufd_put_object() iommufd_destroy() refcount_dec(&obj->users) iommufd_object_remove() kfree() up_read(&obj->destroy_rwsem) // Boom And there is also perhaps some possibility that the rwsem could hit an issue: CPU 0 CPU 1 iommufd_put_object() iommufd_object_destroy_user() refcount_dec(&obj->users); down_write(&obj->destroy_rwsem) up_read(&obj->destroy_rwsem); atomic_long_or(RWSEM_FLAG_WAITERS, &sem->count); tmp = atomic_long_add_return_release() rwsem_try_write_lock() iommufd_object_remove() up_write(&obj->destroy_rwsem) kfree() clear_nonspinnable() // Boom Fix this by reorganizing this again so that two refcounts are used to keep track of things with a rule that users == 0 && shortterm_users == 0 means no other threads have that memory. Put a wait_queue in the iommufd_ctx object that is triggered when any sub object reaches a 0 shortterm_users. This allows the same wait for userspace ioctls to finish behavior that the rwsem was providing. This is weaker still than the prior versions: - There is no bias on shortterm_users so if some thread is waiting to destroy other threads can continue to get new read sides - If destruction fails, eg because of an active in-kernel user, then shortterm_users will have cycled to zero momentarily blocking new users - If userspace races destroy with other userspace operations they continue to get an EBUSY since we still can't intermix looking up an ID and sleeping for its unref In all cases these are things that userspace brings on itself, correct programs will not hit them. Fixes: 99f98a7c0d69 ("iommufd: IOMMUFD_DESTROY should not increase the refcount") Link: https://lore.kernel.org/all/2-v2-ca9e00171c5b+123-iommufd_syz4_jgg@nvidia.com/ Reported-by: syzbot+d31adfb277377ef8fcba@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/00000000000055ef9a0609336580@google.com Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe drivers/iommu/iommufd/iommufd_private.h | 67 ++++++++++++--- drivers/iommu/iommufd/main.c | 146 +++++++++++++++++--------------- 2 files changed, 135 insertions(+), 78 deletions(-) commit bd7a282650b8beb57bc9d19bfcb714b1ccae843a Author: Jason Gunthorpe Date: Sun Nov 12 14:50:13 2023 -0400 iommufd: Add iommufd_ctx to iommufd_put_object() Will be used in the next patch. Link: https://lore.kernel.org/r/1-v2-ca9e00171c5b+123-iommufd_syz4_jgg@nvidia.com/ Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe drivers/iommu/iommufd/device.c | 14 +++++++------- drivers/iommu/iommufd/hw_pagetable.c | 8 ++++---- drivers/iommu/iommufd/ioas.c | 14 +++++++------- drivers/iommu/iommufd/iommufd_private.h | 3 ++- drivers/iommu/iommufd/selftest.c | 14 +++++++------- drivers/iommu/iommufd/vfio_compat.c | 18 +++++++++--------- 6 files changed, 36 insertions(+), 35 deletions(-) commit 891e0eab32a57fca4d36c5162628eb0bcb1f0edf Author: Yang Yingliang Date: Wed Nov 29 17:34:08 2023 +0800 firewire: core: fix possible memory leak in create_units() If device_register() fails, the refcount of device is not 0, the name allocated in dev_set_name() is leaked. To fix this by calling put_device(), so that it will be freed in callback function kobject_cleanup(). unreferenced object 0xffff9d99035c7a90 (size 8): comm "systemd-udevd", pid 168, jiffies 4294672386 (age 152.089s) hex dump (first 8 bytes): 66 77 30 2e 30 00 ff ff fw0.0... backtrace: [<00000000e1d62bac>] __kmem_cache_alloc_node+0x1e9/0x360 [<00000000bbeaff31>] __kmalloc_node_track_caller+0x44/0x1a0 [<00000000491f2fb4>] kvasprintf+0x67/0xd0 [<000000005b960ddc>] kobject_set_name_vargs+0x1e/0x90 [<00000000427ac591>] dev_set_name+0x4e/0x70 [<000000003b4e447d>] create_units+0xc5/0x110 fw_unit_release() will be called in the error path, move fw_device_get() before calling device_register() to keep balanced with fw_device_put() in fw_unit_release(). Cc: stable@vger.kernel.org Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array") Fixes: a1f64819fe9f ("firewire: struct device - replace bus_id with dev_name(), dev_set_name()") Signed-off-by: Yang Yingliang Signed-off-by: Takashi Sakamoto drivers/firewire/core-device.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit 88a2b4d34a64bba914c4e245c6de3ca42bea93cf Author: Timur Tabi Date: Wed Nov 22 14:28:40 2023 -0600 nouveau/gsp: document some aspects of GSP-RM Document a few aspects of communication with GSP-RM. These comments are derived from notes made during early development of GSP-RM support in Nouveau, but were not included in the initial patch set. Reviewed-by: Dave Airlie Signed-off-by: Timur Tabi Reviewed-by: Danilo Krummrich Signed-off-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/20231122202840.2565153-1-ttabi@nvidia.com .../common/shared/msgq/inc/msgq/msgq_priv.h | 51 ++++++++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 82 ++++++++++++++++++++++ 2 files changed, 133 insertions(+) commit 51354f700d400e55b329361e1386b04695e6e5c1 Author: John Fastabend Date: Tue Nov 28 17:25:57 2023 -0800 bpf, sockmap: Add af_unix test with both sockets in map This adds a test where both pairs of a af_unix paired socket are put into a BPF map. This ensures that when we tear down the af_unix pair we don't have any issues on sockmap side with ordering and reference counting. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20231129012557.95371-3-john.fastabend@gmail.com .../selftests/bpf/prog_tests/sockmap_listen.c | 51 +++++++++++++++++----- .../selftests/bpf/progs/test_sockmap_listen.c | 7 +++ 2 files changed, 47 insertions(+), 11 deletions(-) commit 8866730aed5100f06d3d965c22f1c61f74942541 Author: John Fastabend Date: Tue Nov 28 17:25:56 2023 -0800 bpf, sockmap: af_unix stream sockets need to hold ref for pair sock AF_UNIX stream sockets are a paired socket. So sending on one of the pairs will lookup the paired socket as part of the send operation. It is possible however to put just one of the pairs in a BPF map. This currently increments the refcnt on the sock in the sockmap to ensure it is not free'd by the stack before sockmap cleans up its state and stops any skbs being sent/recv'd to that socket. But we missed a case. If the peer socket is closed it will be free'd by the stack. However, the paired socket can still be referenced from BPF sockmap side because we hold a reference there. Then if we are sending traffic through BPF sockmap to that socket it will try to dereference the free'd pair in its send logic creating a use after free. And following splat: [59.900375] BUG: KASAN: slab-use-after-free in sk_wake_async+0x31/0x1b0 [59.901211] Read of size 8 at addr ffff88811acbf060 by task kworker/1:2/954 [...] [59.905468] Call Trace: [59.905787] [59.906066] dump_stack_lvl+0x130/0x1d0 [59.908877] print_report+0x16f/0x740 [59.910629] kasan_report+0x118/0x160 [59.912576] sk_wake_async+0x31/0x1b0 [59.913554] sock_def_readable+0x156/0x2a0 [59.914060] unix_stream_sendmsg+0x3f9/0x12a0 [59.916398] sock_sendmsg+0x20e/0x250 [59.916854] skb_send_sock+0x236/0xac0 [59.920527] sk_psock_backlog+0x287/0xaa0 To fix let BPF sockmap hold a refcnt on both the socket in the sockmap and its paired socket. It wasn't obvious how to contain the fix to bpf_unix logic. The primarily problem with keeping this logic in bpf_unix was: In the sock close() we could handle the deref by having a close handler. But, when we are destroying the psock through a map delete operation we wouldn't have gotten any signal thorugh the proto struct other than it being replaced. If we do the deref from the proto replace its too early because we need to deref the sk_pair after the backlog worker has been stopped. Given all this it seems best to just cache it at the end of the psock and eat 8B for the af_unix and vsock users. Notice dgram sockets are OK because they handle locking already. Fixes: 94531cfcbe79 ("af_unix: Add unix_stream_proto for sockmap") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20231129012557.95371-2-john.fastabend@gmail.com include/linux/skmsg.h | 1 + include/net/af_unix.h | 1 + net/core/skmsg.c | 2 ++ net/unix/af_unix.c | 2 -- net/unix/unix_bpf.c | 5 +++++ 5 files changed, 9 insertions(+), 2 deletions(-) commit ed6e4f0a27ebafffbd12bf3878ab004787685d8a Author: Lijo Lazar Date: Tue Nov 28 16:47:14 2023 +0530 drm/amdgpu: Use another offset for GC 9.4.3 remap The legacy region at 0x7F000 maps to valid registers in GC 9.4.3 SOCs. Use 0x1A000 offset instead as MMIO register remap region. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/soc15.c | 5 +++++ 1 file changed, 5 insertions(+) commit a2ab248d94f5af2c609c8c3329875f92324782c5 Author: Taimur Hassan Date: Fri Nov 10 10:24:20 2023 -0500 drm/amd/display: Fix some HostVM parameters in DML [Why] A number of DML parameters related to HostVM were either missing or being set incorrectly, which may cause inaccuracies in calculating margins and determining BW limitations. [How] Correct these values where needed and populate the missing values. Cc: stable@vger.kernel.org Reviewed-by: Nicholas Kazlauskas Acked-by: Hamza Mahfooz Signed-off-by: Taimur Hassan Signed-off-by: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher .../gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c | 33 ++++++++++++++++++++++ .../amd/display/dc/dml2/dml2_translation_helper.c | 9 ++++-- 2 files changed, 39 insertions(+), 3 deletions(-) commit 72838777aa38352e20301e123b97110c456cd38e Author: ZhenGuo Yin Date: Mon Nov 6 18:07:51 2023 +0800 drm/amdkfd: Free gang_ctx_bo and wptr_bo in pqm_uninit [Why] Memory leaks of gang_ctx_bo and wptr_bo. [How] Free gang_ctx_bo and wptr_bo in pqm_uninit. v2: add a common function pqm_clean_queue_resource to free queue's resources. v3: reset pdd->pqd.num_gws when destorying GWS queue. Reviewed-by: Felix Kuehling Signed-off-by: ZhenGuo Yin Signed-off-by: Alex Deucher .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 54 +++++++++++++--------- 1 file changed, 33 insertions(+), 21 deletions(-) commit e0409021e34af50e7b6f31635c8d21583d7c43dd Author: Candice Li Date: Fri Nov 24 09:33:47 2023 +0800 drm/amdgpu: Update EEPROM I2C address for smu v13_0_0 Check smu v13_0_0 SKU type to select EEPROM I2C address. Signed-off-by: Candice Li Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 27750e176a4f8549e13fa91f311b29a2e40d47be Author: Nicholas Kazlauskas Date: Tue Nov 14 11:22:09 2023 -0500 drm/amd/display: Allow DTBCLK disable for DCN35 [Why] DTBCLK is enabled on idle and it will burn power. [How] There's a few issues here: - Always enabling DTBCLK on clock manager init - Setting refclk when DTBCLK is supposed to be disabled - Not applying the correct calculated version refclk, but instead the base value which might be zero On dtbclk_en change we'll message PMFW to enable or disable the clock accordingly. The DTBDTO will be then based on refclk, but it will be set to the default fixed value if there was nothing calculated in DML despite the clock being considered enabled. Reviewed-by: Charlene Liu Acked-by: Tom Chung Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 27 ++++++++++------------ 1 file changed, 12 insertions(+), 15 deletions(-) commit 2161e09cd05a50d80736fe397145340d2e8f6c05 Author: Lu Yao Date: Thu Nov 23 09:22:34 2023 +0800 drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer For 'AMDGPU_FAMILY_SI' family cards, in 'si_common_early_init' func, init 'didt_rreg' and 'didt_wreg' to 'NULL'. But in func 'amdgpu_debugfs_regs_didt_read/write', using 'RREG32_DIDT' 'WREG32_DIDT' lacks of relevant judgment. And other 'amdgpu_ip_block_version' that use these two definitions won't be added for 'AMDGPU_FAMILY_SI'. So, add null pointer judgment before calling. Reviewed-by: Christian König Signed-off-by: Lu Yao Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 6967741d26c87300a51b5e50d4acd104bc1a9759 Author: Mario Limonciello Date: Fri Nov 24 09:56:32 2023 -0600 drm/amd: Enable PCIe PME from D3 When dGPU is put into BOCO it may be in D3cold but still able send PME on display hotplug event. For this to work it must be enabled as wake source from D3. When runpm is enabled use pci_wake_from_d3() to mark wakeup as enabled by default. Cc: stable@vger.kernel.org # 6.1+ Signed-off-by: Mario Limonciello Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 ++ 1 file changed, 2 insertions(+) commit 7a88f23e768491bae653b444a96091d2aaeb0818 Author: Dinghao Liu Date: Thu Nov 23 15:33:22 2023 +0800 drm/amd/pm: fix a memleak in aldebaran_tables_init When kzalloc() for smu_table->ecc_table fails, we should free the previously allocated resources to prevent memleak. Fixes: edd794208555 ("drm/amd/pm: add message smu to get ecc_table v2") Signed-off-by: Dinghao Liu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit e222b36e9649404cc0770a6d778d69cf73bcd440 Author: Alex Deucher Date: Fri Nov 10 09:39:18 2023 -0500 drm/amdgpu: fix AGP addressing when GART is not at 0 This worked by luck if the GART aperture ended up at 0. When we ended up moving GART on some chips, the GART aperture ended up offsetting the AGP address since the resource->start is a GART offset, not an MC address. Fix this by moving the AGP address setup into amdgpu_bo_gpu_offset_no_check(). v2: check mem_type before checking agp v3: check if the ttm bo has a ttm_tt allocated yet Fixes: 67318cb84341 ("drm/amdgpu/gmc11: set gart placement GC11") Tested-by: Mario Limonciello Reported-by: Jesse Zhang Reported-by: Yifan Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: christian.koenig@amd.com Cc: mario.limonciello@amd.com drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 3 +++ drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 10 +++++++--- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 4 +--- 3 files changed, 11 insertions(+), 6 deletions(-) commit c92da0403d373c03ea5c65c0260c7db6762013b0 Author: Dmytro Laktyushkin Date: Fri Nov 3 14:55:37 2023 -0400 drm/amd/display: update dcn315 lpddr pstate latency [WHY/HOW] Increase the pstate latency to improve ac/dc transition Reviewed-by: Charlene Liu Acked-by: Tom Chung Signed-off-by: Dmytro Laktyushkin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit b9f46f0b98784e40288ee393f863f553fde062fa Author: Hamza Mahfooz Date: Wed Nov 22 14:50:34 2023 -0500 drm/amd/display: fix ABM disablement On recent versions of DMUB firmware, if we want to completely disable ABM we have to pass ABM_LEVEL_IMMEDIATE_DISABLE as the requested ABM level to DMUB. Otherwise, LCD eDP displays are unable to reach their maximum brightness levels. So, to fix this whenever the user requests an ABM level of 0 pass ABM_LEVEL_IMMEDIATE_DISABLE to DMUB instead. Also, to keep the user's experience consistent map ABM_LEVEL_IMMEDIATE_DISABLE to 0 when a user tries to read the requested ABM level. Cc: stable@vger.kernel.org # 6.1+ Reviewed-by: Harry Wentland Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 47831f4860d4e8cdfee4910d2b76ccd892fd72d1 Author: Sung Joon Kim Date: Fri Nov 10 11:33:45 2023 -0500 drm/amd/display: Fix black screen on video playback with embedded panel [why] We have dynamic power control in driver but should be ignored when power is forced on. [how] Bypass any power control when it's forced on. Cc: stable@vger.kernel.org Reviewed-by: Nicholas Kazlauskas Acked-by: Hamza Mahfooz Signed-off-by: Sung Joon Kim Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 1 - drivers/gpu/drm/amd/display/dc/dcn35/dcn35_pg_cntl.c | 10 ++++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) commit dcf6cd7f35de572a946e2805ed32eb20d429a881 Author: Taimur Hassan Date: Fri Nov 10 10:15:28 2023 -0500 drm/amd/display: Fix conversions between bytes and KB [Why] There are a number of instances where we convert HostVMMinPageSize or GPUVMMinPageSize from bytes to KB by dividing (rather than multiplying) and vice versa. Additionally, in some cases, a parameter is passed through DML in KB but later checked as if it were in bytes. Cc: stable@vger.kernel.org Reviewed-by: Nicholas Kazlauskas Acked-by: Hamza Mahfooz Signed-off-by: Taimur Hassan Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c | 16 ++++++++-------- .../drm/amd/display/dc/dml2/dml2_translation_helper.c | 4 ++-- 2 files changed, 10 insertions(+), 10 deletions(-) commit 2f86bf79b63dbe6963ebc647b77a5f576a906b40 Author: Mukul Joshi Date: Wed Nov 22 15:17:22 2023 -0500 drm/amdkfd: Use common function for IP version check KFD_GC_VERSION was recently updated to use a new function for IP version checks. As a result, use KFD_GC_VERSION as the common function for all IP version checks in KFD. Signed-off-by: Mukul Joshi Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c5ca994445a6c99012e70ed6f3550f07efa4c341 Author: Taimur Hassan Date: Fri Nov 10 10:06:09 2023 -0500 drm/amd/display: Remove config update [Why] Prevent overwrite of dc->config.use_default_clock_table, as it should be pre-configured. Reviewed-by: Nicholas Kazlauskas Acked-by: Hamza Mahfooz Signed-off-by: Taimur Hassan Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn35/dcn35_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d60f56b92d3c59364a54618d557d7f9ba5939b21 Author: Nicholas Kazlauskas Date: Fri Nov 3 18:07:11 2023 -0400 drm/amd/display: Update DCN35 clock table policy [Why] The new table doesn't have an implicit mapping between Fclk SOC voltage and MemClk and it currently builds the table off of number of Fclk states rather than DcfClock states. The DML table in use is not correct for functionality or power and does not align with our existing policies for DCN3x. [How] Build the table based on DcfClock with the following assumptions: 1. Raising Soc voltage is the most expensive operation, so assume that running at max DispClock or DppClock is preferable. 2. Assume that we can run at max Fclk / MemClk at any state, but restrict the maximum state to the very last entry in the table as the worst case scenario. 3. Assume that Fclk always has a 2x multiplier on DcfClock unless the table specifies something lower. Reviewed-by: Taimur Hassan Acked-by: Hamza Mahfooz Signed-off-by: Nicholas Kazlauskas Signed-off-by: Alex Deucher .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 77 ++++++++++++++-------- 1 file changed, 51 insertions(+), 26 deletions(-) commit eb28018943fed7639dfea1c9ec9c756ec692b99a Author: Zhongwei Date: Wed Nov 8 16:34:36 2023 +0800 drm/amd/display: force toggle rate wa for first link training for a retimer [WHY] Handover from DMUB to driver does not perform link rate toggle. It might cause link training failure for boot up. [HOW] Force toggle rate wa for first link train. link->vendor_specific_lttpr_link_rate_wa should be zero then. Cc: stable@vger.kernel.org # 6.1+ Reviewed-by: Michael Strauss Acked-by: Hamza Mahfooz Signed-off-by: Zhongwei Signed-off-by: Alex Deucher .../dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit c6df7f313794c3ad41a49b9a7c95da369db607f3 Author: Prike Liang Date: Wed Nov 8 14:38:29 2023 +0800 drm/amdgpu: correct the amdgpu runtime dereference usage count Fix the amdgpu runpm dereference usage count. Signed-off-by: Prike Liang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit 4636a211980052ca0df90265c8a3ed2d46099091 Author: Nicholas Kazlauskas Date: Wed Nov 8 10:59:00 2023 -0500 drm/amd/display: Update min Z8 residency time to 2100 for DCN314 [Why] Some panels with residency period of 2054 exhibit flickering with Z8 at the end of the frame. [How] As a workaround, increase the limit to block these panels. Cc: stable@vger.kernel.org # 6.1+ Reviewed-by: Syed Hassan Acked-by: Hamza Mahfooz Signed-off-by: Nicholas Kazlauskas Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 08448812acb2ab701cd5ff7e1a1dc97f7f10260c Author: Nicholas Kazlauskas Date: Wed Nov 8 10:55:53 2023 -0500 drm/amd/display: Remove min_dst_y_next_start check for Z8 [Why] Flickering occurs on DRR supported panels when engaged in DRR due to min_dst_y_next becoming larger than the frame size itself. [How] In general, we should be able to enter Z8 when this is engaged but it might be a net power loss even if the calculation wasn't bugged. Don't support enabling Z8 during the DRR region. Cc: stable@vger.kernel.org # 6.1+ Reviewed-by: Syed Hassan Acked-by: Hamza Mahfooz Signed-off-by: Nicholas Kazlauskas Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) commit 6b0b7789a7a5f3e69185449f891beea58e563f9b Author: Tim Huang Date: Tue Nov 21 11:06:51 2023 +0800 drm/amdgpu: fix memory overflow in the IB test Fix a memory overflow issue in the gfx IB test for some ASICs. At least 20 bytes are needed for the IB test packet. v2: correct code indentation errors. (Christian) Signed-off-by: Tim Huang Reviewed-by: Yifan Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 4 ++-- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 4 ++-- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) commit 5c908a3586492d469aef4f60f74f5298b7cb68af Author: Li Ma Date: Tue Nov 21 16:54:59 2023 +0800 drm/amdgpu: add init_registers for nbio v7.11 enable init_registers callback func for nbio v7.11. Signed-off-by: Li Ma Reviewed-by: Yifan Zhang Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/nbio_v7_11.c | 18 +++++++------- .../amd/include/asic_reg/nbio/nbio_7_11_0_offset.h | 2 ++ .../include/asic_reg/nbio/nbio_7_11_0_sh_mask.h | 29 ++++++++++++++++++++++ 3 files changed, 40 insertions(+), 9 deletions(-) commit d9e865826c202b262f9ee3f17a03cc4ac5d44ced Author: Camille Cho Date: Fri Nov 3 12:08:42 2023 +0800 drm/amd/display: Simplify brightness initialization [Why] Remove the brightness cache in DC. It uses a single value to represent the brightness for both SDR and HDR mode. This leads to flash in HDR on/off. It also unconditionally programs brightness as in HDR mode. This may introduce garbage on SDR mode in miniLED panel. [How] Simplify the initialization flow by removing the DC cache and taking what panel has as default. Expand the mechanism for PWM to DPCD Aux to restore cached brightness value generally. Cc: stable@vger.kernel.org # 6.1+ Reviewed-by: Krunoslav Kovac Acked-by: Hamza Mahfooz Signed-off-by: Camille Cho Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dc.h | 1 - drivers/gpu/drm/amd/display/dc/dc_types.h | 4 ---- drivers/gpu/drm/amd/display/dc/link/link_detection.c | 2 +- drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 3 +-- .../display/dc/link/protocols/link_edp_panel_control.c | 16 +++------------- .../display/dc/link/protocols/link_edp_panel_control.h | 1 - 6 files changed, 5 insertions(+), 22 deletions(-) commit 67e38874b85b8df7b23d29f78ac3d7ecccd9519d Author: Alvin Lee Date: Wed Nov 8 17:16:28 2023 -0500 drm/amd/display: Increase num voltage states to 40 [Description] If during driver init stage there are greater than 20 intermediary voltage states while constructing the SOC BB we could hit issues because we will index outside of the clock_limits array and start overwriting data. Increase the total number of states to 40 to avoid this issue. Cc: stable@vger.kernel.org # 6.1+ Reviewed-by: Samson Tam Acked-by: Hamza Mahfooz Signed-off-by: Alvin Lee Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dml/dc_features.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9976421f8cb26e22b611ad7036c8b26340dcce25 Author: Michael Strauss Date: Fri Oct 27 14:12:51 2023 -0400 drm/amd/display: Do not read DPREFCLK spread info from LUT on DCN35 [WHY] Currently DCN35 does not spread DPREFCLK [HOW] Remove hardcoded table with nonzero caps Reviewed-by: Nicholas Kazlauskas Acked-by: Hamza Mahfooz Signed-off-by: Michael Strauss Signed-off-by: Alex Deucher .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 22 ---------------------- 1 file changed, 22 deletions(-) commit 9be601135ba8ac69880c01606c82140f2dde105e Author: Alvin Lee Date: Tue Nov 7 17:01:49 2023 -0500 drm/amd/display: Use DRAM speed from validation for dummy p-state [Description] When choosing which dummy p-state latency to use, we need to use the DRAM speed from validation. The DRAMSpeed DML variable can change because we use different input params to DML when populating watermarks set B. Cc: stable@vger.kernel.org # 6.1+ Reviewed-by: Samson Tam Acked-by: Hamza Mahfooz Signed-off-by: Alvin Lee Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 6f395cebdd8927fbffdc3a55a14fcacf93634359 Author: Ilya Bakoulin Date: Tue Nov 7 15:07:56 2023 -0500 drm/amd/display: Fix MPCC 1DLUT programming [Why] Wrong function is used to translate LUT values to HW format, leading to visible artifacting in some cases. [How] Use the correct cm3_helper function. Cc: stable@vger.kernel.org # 6.1+ Reviewed-by: Krunoslav Kovac Acked-by: Hamza Mahfooz Signed-off-by: Ilya Bakoulin Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit cab667a87133d409ff18913fd53c2324803ea8d2 Author: Nicholas Kazlauskas Date: Tue Nov 7 11:15:16 2023 -0500 drm/amd/display: Feed SR and Z8 watermarks into DML2 for DCN35 [Why] We've updated the table but the values aren't being reflected in DML2 calculation. [How] Pass them into the bbox overrides. Reviewed-by: Jun Lei Acked-by: Hamza Mahfooz Signed-off-by: Nicholas Kazlauskas Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 4b27a33c3b173bef1d19ba89e0b9b812b4fddd25 Author: Alex Sierra Date: Mon Nov 20 11:31:32 2023 -0600 drm/amdgpu: Force order between a read and write to the same address Setting register to force ordering to prevent read/write or write/read hazards for un-cached modes. Signed-off-by: Alex Sierra Acked-by: Alex Deucher Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 8 ++++++++ drivers/gpu/drm/amd/include/asic_reg/gc/gc_11_0_0_offset.h | 2 ++ 2 files changed, 10 insertions(+) commit 884e9b0827e889a8742e203ccd052101fb0b945d Author: Hawking Zhang Date: Mon Nov 20 10:14:21 2023 +0800 drm/amdgpu: Do not issue gpu reset from nbio v7_9 bif interrupt In nbio v7_9, host driver should not issu gpu reset Signed-off-by: Hawking Zhang Reviewed-by: Stanley Yang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c | 5 ----- 1 file changed, 5 deletions(-) commit 0652a1c8a4a434a9766ca6bc52487c907df1864d Author: Nicholas Kazlauskas Date: Tue Nov 7 11:12:45 2023 -0500 drm/amd/display: Add Z8 watermarks for DML2 bbox overrides [Why] We can override SR watermarks but not Z8 ones. [How] Add new parameters for Z8 matching the SR ones and feed them into the states. These also weren't being applied to every state, so make sure that we loop over and update all SOC states if given an override. Reviewed-by: Jun Lei Acked-by: Hamza Mahfooz Signed-off-by: Nicholas Kazlauskas Signed-off-by: Alex Deucher .../amd/display/dc/dml2/dml2_translation_helper.c | 47 +++++++++++++++------- drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.h | 2 + 2 files changed, 34 insertions(+), 15 deletions(-) commit 8c4e9105b2a8ab4ac4e6eeb479951ba6a3b4e897 Author: Perry Yuan Date: Tue Aug 1 10:37:41 2023 -0400 drm/amdgpu: optimize RLC powerdown notification on Vangogh The smu needs to get the rlc power down message to sync the rlc state with smu, the rlc state updating message need to be sent at while smu begin suspend sequence , otherwise SMU will crash while RLC state is not notified by driver, and rlc state probally changed after that notification, so it needs to notify rlc state to smu at the end of the suspend sequence in amdgpu_device_suspend() that can make sure the rlc state is correctly set to SMU. [ 101.000590] amdgpu 0000:03:00.0: amdgpu: SMU: I'm not done with your previous command: SMN_C2PMSG_66:0x0000001E SMN_C2PMSG_82:0x00000000 [ 101.000598] amdgpu 0000:03:00.0: amdgpu: Failed to disable gfxoff! [ 110.838026] amdgpu 0000:03:00.0: amdgpu: SMU: I'm not done with your previous command: SMN_C2PMSG_66:0x0000001E SMN_C2PMSG_82:0x00000000 [ 110.838035] amdgpu 0000:03:00.0: amdgpu: Failed to disable smu features. [ 110.838039] amdgpu 0000:03:00.0: amdgpu: Fail to disable dpm features! [ 110.838040] [drm:amdgpu_device_ip_suspend_phase2 [amdgpu]] *ERROR* suspend of IP block failed -62 [ 110.884394] PM: suspend of devices aborted after 21213.620 msecs [ 110.884402] PM: start suspend of devices aborted after 21213.882 msecs [ 110.884405] PM: Some devices failed to suspend, or early wake event detected Reviewed-by: Yifan Zhang Signed-off-by: Perry Yuan Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++++ drivers/gpu/drm/amd/include/kgd_pp_interface.h | 1 + drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 18 ++++++++++++++++++ drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 2 ++ drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 10 ++++++++++ drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 5 +++++ drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 5 ++--- drivers/gpu/drm/amd/pm/swsmu/smu_internal.h | 1 + 8 files changed, 43 insertions(+), 3 deletions(-) commit dc9b0c2af004fe7d9d7b67015fadcb0a7123c740 Author: Wenjing Liu Date: Mon Nov 6 16:47:19 2023 -0500 drm/amd/display: fix a pipe mapping error in dcn32_fpu [why] In dcn32 DML pipes are ordered the same as dc pipes but only for used pipes. For example, if dc pipe 1 and 2 are used, their dml pipe indices would be 0 and 1 respectively. However update_pipe_slice_table_with_split_flags doesn't skip indices for free pipes. This causes us to not reference correct dml pipe output when building pipe topology. [how] Use two variables to iterate dc and dml pipes respectively and only increment dml pipe index when current dc pipe is not free. Cc: stable@vger.kernel.org # 6.1+ Reviewed-by: Chaitanya Dhere Acked-by: Hamza Mahfooz Signed-off-by: Wenjing Liu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) commit fdf84f10e2b08b6e3cbfc672e5dd2cebf4317dea Author: Nicholas Kazlauskas Date: Mon Nov 6 17:29:33 2023 -0500 drm/amd/display: Update DCN35 watermarks [Why & How] Update to the new values per HW team request. Affects both stutter and z8. Reviewed-by: Charlene Liu Acked-by: Hamza Mahfooz Signed-off-by: Nicholas Kazlauskas Signed-off-by: Alex Deucher .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 32 +++++++++++----------- .../gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c | 8 +++--- 2 files changed, 20 insertions(+), 20 deletions(-) commit b9eab9e0aad3285651040e8ab86f64f6c4e51956 Author: Jonathan Kim Date: Thu Nov 16 13:57:07 2023 -0500 drm/amdgpu: update xgmi num links info post gc9.4.2 GC IP 9.4.2 and up support TA reporting of the number of xGMI links between peers. Tested-by: Vignesh Chander Signed-off-by: Jonathan Kim Reviewed-by: Mukul Joshi Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c95f12b7b724abee5e8c3727db066c63c0876db3 Author: Nicholas Kazlauskas Date: Fri Nov 3 10:01:01 2023 -0400 drm/amd/display: Add z-state support policy for dcn35 [Why] DML2 means that the dcn3x policy for calculating z-state support no longer runs from validate_bandwidth. This means we are unconditionally allowing Z8, the hardware default. [How] Port the policy over to DCN35, but with a few modifications: - Don't use min_dst_y_next_start as a check for Z8/Z10 allow - Add support for overriding the Z10 stutter period per ASIC - Cleanup the code to make the policy assignment more clear Reviewed-by: Charlene Liu Acked-by: Hamza Mahfooz Signed-off-by: Nicholas Kazlauskas Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dc.h | 1 + .../gpu/drm/amd/display/dc/dcn35/dcn35_resource.c | 7 +++++ .../gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c | 34 ++++++++++++++++++++++ .../gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.h | 2 ++ 4 files changed, 44 insertions(+) commit 3c9ea68cb61bd7e5bd312c06a12adada74ff5805 Author: Alvin Lee Date: Mon Nov 6 11:20:15 2023 -0500 drm/amd/display: Include udelay when waiting for INBOX0 ACK When waiting for the ACK for INBOX0 message, we have to ensure to include the udelay for proper wait time Cc: stable@vger.kernel.org # 6.1+ Reviewed-by: Samson Tam Acked-by: Hamza Mahfooz Signed-off-by: Alvin Lee Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c | 1 + 1 file changed, 1 insertion(+) commit 142c169b31beb364ef39385b4e88735bd51d37fe Author: Ayush Jain Date: Fri Nov 3 15:18:15 2023 +0530 cpufreq/amd-pstate: Only print supported EPP values for performance governor show_energy_performance_available_preferences() to show only supported values which is performance in performance governor policy. -------Before-------- $ cat /sys/devices/system/cpu/cpu1/cpufreq/scaling_driver amd-pstate-epp $ cat /sys/devices/system/cpu/cpu1/cpufreq/scaling_governor performance $ cat /sys/devices/system/cpu/cpu1/cpufreq/energy_performance_preference performance $ cat /sys/devices/system/cpu/cpu1/cpufreq/energy_performance_available_preferences default performance balance_performance balance_power power -------After-------- $ cat /sys/devices/system/cpu/cpu1/cpufreq/scaling_driver amd-pstate-epp $ cat /sys/devices/system/cpu/cpu1/cpufreq/scaling_governor performance $ cat /sys/devices/system/cpu/cpu1/cpufreq/energy_performance_preference performance $ cat /sys/devices/system/cpu/cpu1/cpufreq/energy_performance_available_preferences performance Fixes: ffa5096a7c33 ("cpufreq: amd-pstate: implement Pstate EPP support for the AMD processors") Suggested-by: Wyes Karny Signed-off-by: Ayush Jain Reviewed-by: Wyes Karny Acked-by: Huang Rui Signed-off-by: Rafael J. Wysocki drivers/cpufreq/amd-pstate.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 41e05548fa6b069a2b895cf4c7bd9ad618b21e2f Author: Mikulas Patocka Date: Tue Nov 28 14:48:06 2023 +0100 dm-flakey: start allocating with MAX_ORDER Commit 23baf831a32c ("mm, treewide: redefine MAX_ORDER sanely") changed the meaning of MAX_ORDER from exclusive to inclusive. So, we can allocate compound pages with up to 1 << MAX_ORDER pages. Reflect this change in dm-flakey and start trying to allocate compound pages with MAX_ORDER. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-flakey.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 547c91929f437b42e6a9c90fec1fb5aec3e64aac Author: Like Xu Date: Thu Nov 23 15:58:18 2023 +0800 KVM: x86: Get CPL directly when checking if loaded vCPU is in kernel mode When querying whether or not a vCPU "is" running in kernel mode, directly get the CPL if the vCPU is the currently loaded vCPU. In scenarios where a guest is profiled via perf-kvm, querying vcpu->arch.preempted_in_kernel from kvm_guest_state() is wrong if vCPU is actively running, i.e. isn't scheduled out due to being preempted and so preempted_in_kernel is stale. This affects perf/core's ability to accurately tag guest RIP with PERF_RECORD_MISC_GUEST_{KERNEL|USER} and record it in the sample. This causes perf/tool to fail to connect the vCPU RIPs to the guest kernel space symbols when parsing these samples due to incorrect PERF_RECORD_MISC flags: Before (perf-report of a cpu-cycles sample): 1.23% :58945 [unknown] [u] 0xffffffff818012e0 After: 1.35% :60703 [kernel.vmlinux] [g] asm_exc_page_fault Note, checking preempted_in_kernel in kvm_arch_vcpu_in_kernel() is awful as nothing in the API's suggests that it's safe to use if and only if the vCPU was preempted. That can be cleaned up in the future, for now just fix the glaring correctness bug. Note #2, checking vcpu->preempted is NOT safe, as getting the CPL on VMX requires VMREAD, i.e. is correct if and only if the vCPU is loaded. If the target vCPU *was* preempted, then it can be scheduled back in after the check on vcpu->preempted in kvm_vcpu_on_spin(), i.e. KVM could end up trying to do VMREAD on a VMCS that isn't loaded on the current pCPU. Signed-off-by: Like Xu Fixes: e1bfc24577cc ("KVM: Move x86's perf guest info callbacks to generic KVM") Link: https://lore.kernel.org/r/20231123075818.12521-1-likexu@tencent.com [sean: massage changelong, add Fixes] Signed-off-by: Sean Christopherson arch/x86/kvm/x86.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 38bc1ab135db87577695816b190e7d6d8ec75879 Author: Mikulas Patocka Date: Tue Nov 28 14:50:23 2023 +0100 dm-verity: align struct dm_verity_fec_io properly dm_verity_fec_io is placed after the end of two hash digests. If the hash digest has unaligned length, struct dm_verity_fec_io could be unaligned. This commit fixes the placement of struct dm_verity_fec_io, so that it's aligned. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Fixes: a739ff3f543a ("dm verity: add support for forward error correction") Signed-off-by: Mike Snitzer drivers/md/dm-verity-fec.c | 3 ++- drivers/md/dm-verity.h | 6 ------ 2 files changed, 2 insertions(+), 7 deletions(-) commit 0193e3966ceeeef69e235975918b287ab093082b Author: Wu Bo Date: Tue Nov 21 20:51:50 2023 -0700 dm verity: don't perform FEC for failed readahead IO We found an issue under Android OTA scenario that many BIOs have to do FEC where the data under dm-verity is 100% complete and no corruption. Android OTA has many dm-block layers, from upper to lower: dm-verity dm-snapshot dm-origin & dm-cow dm-linear ufs DM tables have to change 2 times during Android OTA merging process. When doing table change, the dm-snapshot will be suspended for a while. During this interval, many readahead IOs are submitted to dm_verity from filesystem. Then the kverity works are busy doing FEC process which cost too much time to finish dm-verity IO. This causes needless delay which feels like system is hung. After adding debugging it was found that each readahead IO needed around 10s to finish when this situation occurred. This is due to IO amplification: dm-snapshot suspend erofs_readahead // 300+ io is submitted dm_submit_bio (dm_verity) dm_submit_bio (dm_snapshot) bio return EIO bio got nothing, it's empty verity_end_io verity_verify_io forloop range(0, io->n_blocks) // each io->nblocks ~= 20 verity_fec_decode fec_decode_rsb fec_read_bufs forloop range(0, v->fec->rsn) // v->fec->rsn = 253 new_read submit_bio (dm_snapshot) end loop end loop dm-snapshot resume Readahead BIOs get nothing while dm-snapshot is suspended, so all of them will cause verity's FEC. Each readahead BIO needs to verify ~20 (io->nblocks) blocks. Each block needs to do FEC, and every block needs to do 253 (v->fec->rsn) reads. So during the suspend interval(~200ms), 300 readahead BIOs trigger ~1518000 (300*20*253) IOs to dm-snapshot. As readahead IO is not required by userspace, and to fix this issue, it is best to pass readahead errors to upper layer to handle it. Cc: stable@vger.kernel.org Fixes: a739ff3f543a ("dm verity: add support for forward error correction") Signed-off-by: Wu Bo Reviewed-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-verity-target.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 7be05bdfb4efc1396f7692562c7161e2b9f595f1 Author: Wu Bo Date: Tue Nov 21 20:51:49 2023 -0700 dm verity: initialize fec io before freeing it If BIO error, verity_end_io() can call verity_finish_io() before verity_fec_init_io(). Therefore, fec_io->rs is not initialized and may crash when doing memory freeing in verity_fec_finish_io(). Crash call stack: die+0x90/0x2b8 __do_kernel_fault+0x260/0x298 do_bad_area+0x2c/0xdc do_translation_fault+0x3c/0x54 do_mem_abort+0x54/0x118 el1_abort+0x38/0x5c el1h_64_sync_handler+0x50/0x90 el1h_64_sync+0x64/0x6c free_rs+0x18/0xac fec_rs_free+0x10/0x24 mempool_free+0x58/0x148 verity_fec_finish_io+0x4c/0xb0 verity_end_io+0xb8/0x150 Cc: stable@vger.kernel.org # v6.0+ Fixes: 5721d4e5a9cd ("dm verity: Add optional "try_verify_in_tasklet" feature") Signed-off-by: Wu Bo Reviewed-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-verity-target.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3649ff0a0b152b5f00e8f56a5ce0da0945aae278 Author: Bart Van Assche Date: Tue Nov 28 11:40:19 2023 -0800 block: Document the role of the two attribute groups It is nontrivial to derive the role of the two attribute groups in source file block/blk-sysfs.c. Hence add a comment that explains their roles. See also commit 6d85ebf95c44 ("blk-sysfs: add a new attr_group for blk_mq"). Cc: Christoph Hellwig Cc: Yu Kuai Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20231128194019.72762-1-bvanassche@acm.org Signed-off-by: Jens Axboe block/blk-sysfs.c | 2 ++ 1 file changed, 2 insertions(+) commit 83f2df9d66bc9e1e0dbd5d5586a701088f6a1d42 Author: Jakub Kicinski Date: Sun Nov 26 14:58:58 2023 -0800 tools: ynl-gen: always construct struct ynl_req_state struct ynl_req_state carries reply-related info from generated code into generic YNL code. While we don't need reply info to execute a request without a reply, we still need to pass in the struct, because it's also where we get the pointer to struct ynl_sock from. Passing NULL results in crashes if kernel returns an error or an unexpected reply. Fixes: dc0956c98f11 ("tools: ynl-gen: move the response reading logic into YNL") Link: https://lore.kernel.org/r/20231126225858.2144136-1-kuba@kernel.org Signed-off-by: Jakub Kicinski tools/net/ynl/generated/devlink-user.c | 87 +++++++++++++++++++++----------- tools/net/ynl/generated/ethtool-user.c | 51 ++++++++++++------- tools/net/ynl/generated/fou-user.c | 6 ++- tools/net/ynl/generated/handshake-user.c | 3 +- tools/net/ynl/ynl-gen-c.py | 10 ++-- 5 files changed, 102 insertions(+), 55 deletions(-) commit cbeb989e41f4094f54bec2cecce993f26f547bea Author: Jakub Kicinski Date: Sun Nov 26 14:58:06 2023 -0800 ethtool: don't propagate EOPNOTSUPP from dumps The default dump handler needs to clear ret before returning. Otherwise if the last interface returns an inconsequential error this error will propagate to user space. This may confuse user space (ethtool CLI seems to ignore it, but YNL doesn't). It will also terminate the dump early for mutli-skb dump, because netlink core treats EOPNOTSUPP as a real error. Fixes: 728480f12442 ("ethtool: default handlers for GET requests") Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20231126225806.2143528-1-kuba@kernel.org Signed-off-by: Jakub Kicinski net/ethtool/netlink.c | 1 + 1 file changed, 1 insertion(+) commit febab20caebac959fdc3d7520bc52de8b1184455 Author: Wyes Karny Date: Fri Nov 17 06:38:39 2023 +0000 cpufreq/amd-pstate: Fix scaling_min_freq and scaling_max_freq update When amd_pstate is running, writing to scaling_min_freq and scaling_max_freq has no effect. These values are only passed to the policy level, but not to the platform level. This means that the platform does not know about the frequency limits set by the user. To fix this, update the min_perf and max_perf values at the platform level whenever the user changes the scaling_min_freq and scaling_max_freq values. Fixes: ffa5096a7c33 ("cpufreq: amd-pstate: implement Pstate EPP support for the AMD processors") Acked-by: Huang Rui Signed-off-by: Wyes Karny Signed-off-by: Rafael J. Wysocki drivers/cpufreq/amd-pstate.c | 60 ++++++++++++++++++++++++++++++++++---------- include/linux/amd-pstate.h | 4 +++ 2 files changed, 51 insertions(+), 13 deletions(-) commit fb18fe0fdf22a2f4512a8b644bb5ea1473829cda Author: Yang Yingliang Date: Wed Nov 29 17:07:15 2023 +0800 drm/panel: nt36523: fix return value check in nt36523_probe() mipi_dsi_device_register_full() never returns NULL pointer, it will return ERR_PTR() when it fails, so replace the check with IS_ERR(). Fixes: 0993234a0045 ("drm/panel: Add driver for Novatek NT36523") Signed-off-by: Yang Yingliang Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20231129090715.856263-1-yangyingliang@huaweicloud.com Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20231129090715.856263-1-yangyingliang@huaweicloud.com drivers/gpu/drm/panel/panel-novatek-nt36523.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit fc1ccc16271a0526518f19f460fed63d575a8a42 Author: xiazhengqiao Date: Wed Nov 29 16:41:15 2023 +0800 drm/panel: starry-2081101qfh032011-53g: Fine tune the panel power sequence For the "starry, 2081101qfh032011-53g" panel, it is stipulated in the panel spec that MIPI needs to keep the LP11 state before the lcm_reset pin is pulled high. Fixes: 6069b66cd962 ("drm/panel: support for STARRY 2081101QFH032011-53G MIPI-DSI panel") Signed-off-by: xiazhengqiao Reviewed-by: Jessica Zhang Link: https://lore.kernel.org/r/20231129084115.7918-1-xiazhengqiao@huaqin.corp-partner.google.com Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20231129084115.7918-1-xiazhengqiao@huaqin.corp-partner.google.com drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 1 + 1 file changed, 1 insertion(+) commit 3b47bc037bd44f142ac09848e8d3ecccc726be99 Merge: 18d46e76d7c2 90785ea8158b Author: Linus Torvalds Date: Wed Nov 29 06:45:22 2023 -0800 Merge tag 'pinctrl-v6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Fix a really interesting potential core bug in the list iterator requireing the use of READ_ONCE() discovered when testing kernel compiles with clang. - Check devm_kcalloc() return value and an array bounds in the STM32 driver. - Fix an exotic string truncation issue in the s32cc driver, found by the kernel test robot (impressive!) - Fix an undocumented struct member in the cy8c95x0 driver. - Fix a symbol overlap with MIPS in the Lochnagar driver, MIPS defines a global symbol "RST" which is a bit too generic and collide with stuff. OK this one should be renamed too, we will fix that as well. - Fix erroneous branch taking in the Realtek driver. - Fix the mail address in MAINTAINERS for the s32g2 driver. * tag 'pinctrl-v6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: dt-bindings: pinctrl: s32g2: change a maintainer email address pinctrl: realtek: Fix logical error when finding descriptor pinctrl: lochnagar: Don't build on MIPS pinctrl: avoid reload of p state in list iteration pinctrl: cy8c95x0: Fix doc warning pinctrl: s32cc: Avoid possible string truncation pinctrl: stm32: fix array read out of bound pinctrl: stm32: Add check for devm_kcalloc commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b Author: Peter Zijlstra Date: Wed Nov 29 15:24:52 2023 +0100 perf: Fix perf_event_validate_size() Budimir noted that perf_event_validate_size() only checks the size of the newly added event, even though the sizes of all existing events can also change due to not all events having the same read_format. When we attach the new event, perf_group_attach(), we do re-compute the size for all events. Fixes: a723968c0ed3 ("perf: Fix u16 overflows") Reported-by: Budimir Markovic Signed-off-by: Peter Zijlstra (Intel) kernel/events/core.c | 61 ++++++++++++++++++++++++++++++++-------------------- 1 file changed, 38 insertions(+), 23 deletions(-) commit 23ab79e8e469e2605beec2e3ccb40d19c68dd2e0 Author: Elliot Berman Date: Mon Nov 20 09:36:31 2023 -0800 freezer,sched: Do not restore saved_state of a thawed task It is possible for a task to be thawed multiple times when mixing the *legacy* cgroup freezer and system-wide freezer. To do this, freeze the cgroup, do system-wide freeze/thaw, then thaw the cgroup. When this happens, then a stale saved_state can be written to the task's state and cause task to hang indefinitely. Fix this by only trying to thaw tasks that are actually frozen. This change also has the marginal benefit avoiding unnecessary wake_up_state(p, TASK_FROZEN) if we know the task is already thawed. There is not possibility of time-of-compare/time-of-use race when we skip the wake_up_state because entering/exiting TASK_FROZEN is guarded by freezer_lock. Fixes: 8f0eed4a78a8 ("freezer,sched: Use saved_state to reduce some spurious wakeups") Signed-off-by: Elliot Berman Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Abhijeet Dharmapurikar Link: https://lore.kernel.org/r/20231120-freezer-state-multiple-thaws-v1-1-f2e1dd7ce5a2@quicinc.com kernel/freezer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit dc158d23b33df9033bcc8e7117e8591dd2f9d125 Author: Nicholas Piggin Date: Wed Nov 22 12:58:11 2023 +1000 KVM: PPC: Book3S HV: Fix KVM_RUN clobbering FP/VEC user registers Before running a guest, the host process (e.g., QEMU) FP/VEC registers are saved if they were being used, similarly to when the kernel uses FP registers. The guest values are then loaded into regs, and the host process registers will be restored lazily when it uses FP/VEC. KVM HV has a bug here: the host process registers do get saved, but the user MSR bits remain enabled, which indicates the registers are valid for the process. After they are clobbered by running the guest, this valid indication causes the host process to take on the FP/VEC register values of the guest. Fixes: 34e119c96b2b ("KVM: PPC: Book3S HV P9: Reduce mtmsrd instructions required to save host SPRs") Cc: stable@vger.kernel.org # v5.17+ Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20231122025811.2973-1-npiggin@gmail.com arch/powerpc/kernel/process.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 5943b8f7449df9881b273db07bdde1e7120dccf0 Author: AngeloGioacchino Del Regno Date: Mon Nov 27 14:20:26 2023 +0100 arm64: dts: mediatek: cherry: Fix interrupt cells for MT6360 on I2C7 Change interrupt cells to 2 to suppress interrupts_property warning. Cc: stable@vger.kernel.org Fixes: 0de0fe950f1b ("arm64: dts: mediatek: cherry: Enable MT6360 sub-pmic on I2C7") Link: https://lore.kernel.org/r/20231127132026.165027-1-angelogioacchino.delregno@collabora.com Signed-off-by: AngeloGioacchino Del Regno arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 74543b303a9abfe4fa253d1fa215281baa05ff3a Author: Eugen Hristev Date: Mon Aug 14 10:10:53 2023 +0300 arm64: dts: mediatek: mt8183-kukui-jacuzzi: fix dsi unnecessary cells properties dtbs_check throws a warning at the dsi node: Warning (avoid_unnecessary_addr_size): /soc/dsi@14014000: unnecessary #address-cells/#size-cells without "ranges" or child "reg" property Other DTS have a panel child node with a reg, so the parent dtsi must have the address-cells and size-cells, however this specific DT has the panel removed, but not the cells, hence the warning above. If panel is deleted then the cells must also be deleted since they are tied together, as the child node in this DT does not have a reg. Cc: stable@vger.kernel.org Fixes: cabc71b08eb5 ("arm64: dts: mt8183: Add kukui-jacuzzi-damu board") Signed-off-by: Eugen Hristev Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230814071053.5459-1-eugen.hristev@collabora.com Signed-off-by: AngeloGioacchino Del Regno arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 2 ++ 1 file changed, 2 insertions(+) commit 8e6ecbfd44b5542a7598c1c5fc9c6dcb5d367f2a Author: Eugen Hristev Date: Mon Aug 14 09:50:42 2023 +0300 arm64: dts: mediatek: mt7622: fix memory node warning check dtbs_check throws a warning at the memory node: Warning (unit_address_vs_reg): /memory: node has a reg or ranges property, but no unit name fix by adding the address into the node name. Cc: stable@vger.kernel.org Fixes: 0b6286dd96c0 ("arm64: dts: mt7622: add bananapi BPI-R64 board") Signed-off-by: Eugen Hristev Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230814065042.4973-1-eugen.hristev@collabora.com Signed-off-by: AngeloGioacchino Del Regno arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 2 +- arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 9adf7580f6d498a5839e02fa1d1535e934364602 Author: Eugen Hristev Date: Thu Oct 5 13:30:41 2023 +0300 arm64: dts: mediatek: mt8186: fix clock names for power domains Clocks for each power domain are split into big categories: pd clocks and subsys clocks. According to the binding, all clocks which have a dash '-' in their name are treated as subsys clocks, and must be placed at the end of the list. The other clocks which are pd clocks must come first. Fixed the naming and the placing of all clocks in the power domains. For the avoidance of doubt, prefixed all subsys clocks with the 'subsys' prefix. The binding does not enforce strict clock names, the driver uses them in bulk, only making a difference for pd clocks vs subsys clocks. The above problem appears to be trivial, however, it leads to incorrect power up and power down sequence of the power domains, because some clocks will be mistakenly taken for subsys clocks and viceversa. One consequence is the fact that if the DIS power domain goes power down and power back up during the boot process, when it comes back up, there are still transactions left on the bus which makes the display inoperable. Some of the clocks for the DIS power domain were wrongly using '_' instead of '-', which again made these clocks being treated as pd clocks instead of subsys clocks. Cc: stable@vger.kernel.org Fixes: d9e43c1e7a38 ("arm64: dts: mt8186: Add power domains controller") Signed-off-by: Eugen Hristev Tested-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Reviewed-by: Alexandre Mergnat Link: https://lore.kernel.org/r/20231005103041.352478-1-eugen.hristev@collabora.com Signed-off-by: AngeloGioacchino Del Regno arch/arm64/boot/dts/mediatek/mt8186.dtsi | 42 ++++++++++++++++++++------------ 1 file changed, 27 insertions(+), 15 deletions(-) commit 59fa1e51ba54e1f513985a8177969b62973f7fd5 Author: AngeloGioacchino Del Regno Date: Thu Oct 5 17:11:50 2023 +0200 arm64: dts: mediatek: mt8186: Change gpu speedbin nvmem cell name MT8186's GPU speedbin value must be interpreted, or the value will not be meaningful. Use the correct "gpu-speedbin" nvmem cell name for the GPU speedbin to allow triggering the cell info fixup handler, hence feeding the right speedbin number to the users. Cc: stable@vger.kernel.org Fixes: 263d2fd02afc ("arm64: dts: mediatek: mt8186: Add GPU speed bin NVMEM cells") Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20231005151150.355536-1-angelogioacchino.delregno@collabora.com Signed-off-by: AngeloGioacchino Del Regno arch/arm64/boot/dts/mediatek/mt8186.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1fcda8ceb014aafd56f10b33e0077c93b5dd45d1 Author: Frank Wunderlich Date: Wed Oct 25 19:08:30 2023 +0200 arm64: dts: mt7986: change cooling trips Add Critical and hot trips for emergency system shutdown and limiting system load. Change passive trip to active to make sure fan is activated on the lowest trip. Cc: stable@vger.kernel.org Fixes: 1f5be05132f3 ("arm64: dts: mt7986: add thermal-zones") Fixes: c26f779a2295 ("arm64: dts: mt7986: add pwm-fan and cooling-maps to BPI-R3 dts") Suggested-by: Daniel Golle Signed-off-by: Frank Wunderlich Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20231025170832.78727-4-linux@fw-web.de Signed-off-by: AngeloGioacchino Del Regno .../boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts | 10 +++++----- arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 20 ++++++++++++++++---- 2 files changed, 21 insertions(+), 9 deletions(-) commit 6413cbc17f89b3a160f3a6f3fad1232b1678fe40 Author: Frank Wunderlich Date: Wed Oct 25 19:08:29 2023 +0200 arm64: dts: mt7986: define 3W max power to both SFP on BPI-R3 All SFP power supplies are connected to the system VDD33 which is 3v3/8A. Set 3A per SFP slot to allow SFPs work which need more power than the default 1W. Cc: stable@vger.kernel.org Fixes: 8e01fb15b815 ("arm64: dts: mt7986: add Bananapi R3") Signed-off-by: Frank Wunderlich Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20231025170832.78727-3-linux@fw-web.de Signed-off-by: AngeloGioacchino Del Regno arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts | 2 ++ 1 file changed, 2 insertions(+) commit 8dfe51c3f6ef31502fca3e2da8cd250ebbe4b8f2 Author: Eric Woudstra Date: Wed Oct 25 19:08:28 2023 +0200 arm64: dts: mt7986: fix emmc hs400 mode without uboot initialization Eric reports errors on emmc with hs400 mode when booting linux on bpi-r3 without uboot [1]. Booting with uboot does not show this because clocks seem to be initialized by uboot. Fix this by adding assigned-clocks and assigned-clock-parents like it's done in uboot [2]. [1] https://forum.banana-pi.org/t/bpi-r3-kernel-fails-setting-emmc-clock-to-416m-depends-on-u-boot/15170 [2] https://github.com/u-boot/u-boot/blob/master/arch/arm/dts/mt7986.dtsi#L287 Cc: stable@vger.kernel.org Fixes: 513b49d19b34 ("arm64: dts: mt7986: add mmc related device nodes") Signed-off-by: Eric Woudstra Signed-off-by: Frank Wunderlich Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20231025170832.78727-2-linux@fw-web.de Signed-off-by: AngeloGioacchino Del Regno arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 4 ++++ 1 file changed, 4 insertions(+) commit 8980c30141d3986beab815d85762b9c67196ed72 Author: Hsin-Yi Wang Date: Thu Oct 26 12:09:10 2023 -0700 arm64: dts: mt8183: kukui: Fix underscores in node names Replace underscores with hyphens in pinctrl node names both for consistency and to adhere to the bindings. Cc: stable@vger.kernel.org Fixes: cd894e274b74 ("arm64: dts: mt8183: Add krane-sku176 board") Fixes: 1652dbf7363a ("arm64: dts: mt8183: add scp node") Fixes: 27eaf34df364 ("arm64: dts: mt8183: config dsi node") Signed-off-by: Hsin-Yi Wang Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20231026191343.3345279-2-hsinyi@chromium.org Signed-off-by: AngeloGioacchino Del Regno .../boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 6 +- arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 94 +++++++++++----------- 2 files changed, 50 insertions(+), 50 deletions(-) commit 5a60d63439694590cd5ab1f998fc917ff7ba1c1d Author: AngeloGioacchino Del Regno Date: Wed Oct 25 11:38:16 2023 +0200 arm64: dts: mediatek: mt8183: Move thermal-zones to the root node The thermal zones are not a soc bus device: move it to the root node to solve simple_bus_reg warnings. Cc: stable@vger.kernel.org Fixes: b325ce39785b ("arm64: dts: mt8183: add thermal zone node") Link: https://lore.kernel.org/r/20231025093816.44327-9-angelogioacchino.delregno@collabora.com Signed-off-by: AngeloGioacchino Del Regno arch/arm64/boot/dts/mediatek/mt8183.dtsi | 242 +++++++++++++++---------------- 1 file changed, 121 insertions(+), 121 deletions(-) commit 24165c5dad7ba7c7624d05575a5e0cc851396c71 Author: AngeloGioacchino Del Regno Date: Wed Oct 25 11:38:15 2023 +0200 arm64: dts: mediatek: mt8173-evb: Fix regulator-fixed node names Fix a unit_address_vs_reg warning for the USB VBUS fixed regulators by renaming the regulator nodes from regulator@{0,1} to regulator-usb-p0 and regulator-usb-p1. Cc: stable@vger.kernel.org Fixes: c0891284a74a ("arm64: dts: mediatek: add USB3 DRD driver") Link: https://lore.kernel.org/r/20231025093816.44327-8-angelogioacchino.delregno@collabora.com Signed-off-by: AngeloGioacchino Del Regno arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9dea1c724fc36643e83216c1f5a26613412150db Author: AngeloGioacchino Del Regno Date: Wed Oct 25 11:38:14 2023 +0200 arm64: dts: mediatek: mt8183-evb: Fix unit_address_vs_reg warning on ntc The NTC is defined as ntc@0 but it doesn't need any address at all. Fix the unit_address_vs_reg warning by dropping the unit address: since the node name has to be generic also fully rename it from ntc@0 to thermal-sensor. Cc: stable@vger.kernel.org Fixes: ff9ea5c62279 ("arm64: dts: mediatek: mt8183-evb: Add node for thermistor") Link: https://lore.kernel.org/r/20231025093816.44327-7-angelogioacchino.delregno@collabora.com Signed-off-by: AngeloGioacchino Del Regno arch/arm64/boot/dts/mediatek/mt8183-evb.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 19cba9a6c071db57888dc6b2ec1d9bf8996ea681 Author: AngeloGioacchino Del Regno Date: Wed Oct 25 11:38:13 2023 +0200 arm64: dts: mediatek: mt8183: Fix unit address for scp reserved memory The reserved memory for scp had node name "scp_mem_region" and also without unit-address: change the name to "memory@(address)". This fixes a unit_address_vs_reg warning. Cc: stable@vger.kernel.org Fixes: 1652dbf7363a ("arm64: dts: mt8183: add scp node") Link: https://lore.kernel.org/r/20231025093816.44327-6-angelogioacchino.delregno@collabora.com Signed-off-by: AngeloGioacchino Del Regno arch/arm64/boot/dts/mediatek/mt8183-evb.dts | 2 +- arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 61b94d54421a1f3670ddd5396ec70afe833e9405 Author: AngeloGioacchino Del Regno Date: Thu Jul 6 11:58:41 2023 +0200 arm64: dts: mediatek: mt8195: Fix PM suspend/resume with venc clocks Before suspending the LARBs we're making sure that any operation is done: this never happens because we are unexpectedly unclocking the LARB20 before executing the suspend handler for the MediaTek Smart Multimedia Interface (SMI) and the cause of this is incorrect clocks on this LARB. Fix this issue by changing the Local Arbiter 20 (used by the video encoder secondary core) apb clock to CLK_VENC_CORE1_VENC; furthermore, in order to make sure that both the PM resume and video encoder operation is stable, add the CLK_VENC(_CORE1)_LARB clock to the VENC (main core) and VENC_CORE1 power domains, as this IP cannot communicate with the rest of the system (the AP) without local arbiter clocks being operational. Cc: stable@vger.kernel.org Fixes: 3b5838d1d82e ("arm64: dts: mt8195: Add iommu and smi nodes") Fixes: 2b515194bf0c ("arm64: dts: mt8195: Add power domains controller") Reviewed-by: Alexandre Mergnat Link: https://lore.kernel.org/r/20230706095841.109315-1-angelogioacchino.delregno@collabora.com Signed-off-by: AngeloGioacchino Del Regno arch/arm64/boot/dts/mediatek/mt8195.dtsi | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit c8820c92caf0770bec976b01fa9e82bb993c5865 Author: Francesco Dolcini Date: Tue Nov 28 20:49:35 2023 +0100 platform/surface: aggregator: fix recv_buf() return value Serdev recv_buf() callback is supposed to return the amount of bytes consumed, therefore an int in between 0 and count. Do not return negative number in case of issue, when ssam_controller_receive_buf() returns ESHUTDOWN just returns 0, e.g. no bytes consumed, this keep the exact same behavior as it was before. This fixes a potential WARN in serdev-ttyport.c:ttyport_receive_buf(). Fixes: c167b9c7e3d6 ("platform/surface: Add Surface Aggregator subsystem") Cc: stable@vger.kernel.org Signed-off-by: Francesco Dolcini Reviewed-by: Maximilian Luz Link: https://lore.kernel.org/r/20231128194935.11350-1-francesco@dolcini.it Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/surface/aggregator/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit cae2bdb579ecc9d4219c58a7d3fde1958118dc1d Author: Kailang Yang Date: Wed Nov 29 15:38:40 2023 +0800 ALSA: hda/realtek: Add supported ALC257 for ChromeOS ChromeOS want to support ALC257. Add codec ID to some relation function. Signed-off-by: Kailang Yang Cc: Link: https://lore.kernel.org/r/99a88a7dbdb045fd9d934abeb6cec15f@realtek.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 3 +++ 1 file changed, 3 insertions(+) commit d21a3962d3042e6f56ad324cf18bdd64a1e6ecfa Author: Ville Syrjälä Date: Tue Nov 21 07:43:15 2023 +0200 drm/i915: Call intel_pre_plane_updates() also for pipes getting enabled We used to call intel_pre_plane_updates() for any pipe going through a modeset whether the pipe was previously enabled or not. This in fact needed to apply all the necessary clock gating workarounds/etc. Restore the correct behaviour. Fixes: 39919997322f ("drm/i915: Disable all planes before modesetting any pipes") Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20231121054324.9988-3-ville.syrjala@linux.intel.com (cherry picked from commit e0d5ce11ed0a21bb2bf328ad82fd261783c7ad88) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/intel_display.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit f76f83a83c8fdbb62acbf8bd945f10821768145b Author: Ville Syrjälä Date: Tue Nov 14 16:23:33 2023 +0200 drm/i915: Also check for VGA converter in eDP probe Unfortunately even the HPD based detection added in commit cfe5bdfb27fa ("drm/i915: Check HPD live state during eDP probe") fails to detect that the VBT's eDP/DDI-A is a ghost on Asus B360M-A (CFL+CNP). On that board eDP/DDI-A has its HPD asserted despite nothing being actually connected there :( The straps/fuses also indicate that the eDP port is present. So if one boots with a VGA monitor connected the eDP probe will mistake the DP->VGA converter hooked to DDI-E for an eDP panel on DDI-A. As a last resort check what kind of DP device we've detected, and if it looks like a DP->VGA converter then conclude that the eDP port should be ignored. Cc: stable@vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/9636 Fixes: cfe5bdfb27fa ("drm/i915: Check HPD live state during eDP probe") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20231114142333.15799-1-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit fcd479a79120bf0cd507d85f898297a3b868dda6) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/intel_dp.c | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) commit 503579448db93f9fbcc93cd99a1f2d5aa4b2cda6 Author: Tvrtko Ursulin Date: Thu Nov 16 08:44:56 2023 +0000 drm/i915/gsc: Mark internal GSC engine with reserved uabi class The GSC CS is not exposed to the user, so we skipped assigning a uabi class number for it. However, the trace logs use the uabi class and instance to identify the engine, so leaving uabi class unset makes the GSC CS show up as the RCS in those logs. Given that the engine is not exposed to the user, we can't add a new case in the uabi enum, so we insted internally define a kernel internal class as -1. At the same time remove special handling for the name and complete the uabi_classes array so internal class is automatically correctly assigned. Engine will show as 65535:0 other0 in the logs/traces which should be unique enough. v2: * Fix uabi class u8 vs u16 type confusion. Signed-off-by: Tvrtko Ursulin Fixes: 194babe26bdc ("drm/i915/mtl: don't expose GSC command streamer to the user") Cc: Daniele Ceraolo Spurio Cc: Alan Previn Cc: Matt Roper Reviewed-by: Daniele Ceraolo Spurio Link: https://patchwork.freedesktop.org/patch/msgid/20231116084456.291533-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit dfed6b58d54f3a5d7e6bc1fb060e2c936330eba2) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/gt/intel_engine_user.c | 39 ++++++++++++++++------------- 1 file changed, 22 insertions(+), 17 deletions(-) commit 415e5107b0dce0e5407ae4a46700cd7e8859e252 Author: Kent Overstreet Date: Tue Nov 28 16:33:52 2023 -0500 bcachefs: Extra kthread_should_stop() calls for copygc This fixes a bug where going read-only was taking longer than it should have due to copygc forgetting to check kthread_should_stop() Additionally: fix a missing is_kthread check in bch2_move_ratelimit(). Signed-off-by: Kent Overstreet fs/bcachefs/move.c | 12 +++++++++--- fs/bcachefs/movinggc.c | 2 +- 2 files changed, 10 insertions(+), 4 deletions(-) commit 463086d99889c84ce0960fac2815c596f26cc0e5 Author: Kent Overstreet Date: Tue Nov 28 16:31:48 2023 -0500 bcachefs: Convert gc_alloc_start() to for_each_btree_key2() This eliminates some SRCU warnings: for_each_btree_key2() runs every loop iteration in a distinct transaction context. Signed-off-by: Kent Overstreet fs/bcachefs/btree_gc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 2111f39459b0b2ec54859b756c625edb0befce0e Author: Kent Overstreet Date: Tue Nov 28 19:26:23 2023 -0500 bcachefs: Fix race between btree writes and metadata drop btree writes update the btree node key after every write, in order to update sectors_written, and they also might need to drop pointers if one of the writes failed in a replicated btree node. But the btree node might also have had a pointer dropped while the write was in flight, by bch2_dev_metadata_drop(), and thus there was a bug where the btree node write would ovewrite the btree node's key with what it had at the start of the write. Fix this by dropping pointers not currently in the btree node key. Signed-off-by: Kent Overstreet fs/bcachefs/btree_update_interior.c | 4 ++++ 1 file changed, 4 insertions(+) commit ef0beeb8dd343a57cf8ad4967b508b8e7452f347 Author: Kent Overstreet Date: Mon Nov 27 00:53:46 2023 -0500 bcachefs: move journal seq assertion journal_cur_seq() can legitimately be used outside of the journal lock, where this assert can race Signed-off-by: Kent Overstreet fs/bcachefs/journal.c | 2 ++ fs/bcachefs/journal.h | 4 +--- 2 files changed, 3 insertions(+), 3 deletions(-) commit 1b1bd0fd41577400434d5948edc2679092c57b08 Author: Kent Overstreet Date: Sun Nov 26 23:11:18 2023 -0500 bcachefs: -EROFS doesn't count as move_extent_start_fail The automated tests check if we've hit too many slowpath/error path events and fail the test - if we're just shutting down, that naturally shouldn't count. Signed-off-by: Kent Overstreet fs/bcachefs/move.c | 4 ++++ 1 file changed, 4 insertions(+) commit 9870257a0a338cd8d6c1cddab74e703f490f6779 Author: Yoshihiro Shimoda Date: Mon Nov 27 21:24:20 2023 +0900 ravb: Fix races between ravb_tx_timeout_work() and net related ops Fix races between ravb_tx_timeout_work() and functions of net_device_ops and ethtool_ops by using rtnl_trylock() and rtnl_unlock(). Note that since ravb_close() is under the rtnl lock and calls cancel_work_sync(), ravb_tx_timeout_work() should calls rtnl_trylock(). Otherwise, a deadlock may happen in ravb_tx_timeout_work() like below: CPU0 CPU1 ravb_tx_timeout() schedule_work() ... __dev_close_many() // Under rtnl lock ravb_close() cancel_work_sync() // Waiting ravb_tx_timeout_work() rtnl_lock() // This is possible to cause a deadlock If rtnl_trylock() fails, rescheduling the work with sleep for 1 msec. Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") Signed-off-by: Yoshihiro Shimoda Reviewed-by: Sergey Shtylyov Link: https://lore.kernel.org/r/20231127122420.3706751-1-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/renesas/ravb_main.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit 9d63509547a940225d06d7eba1dc412befae255d Author: Paulo Alcantara Date: Tue Nov 28 16:37:19 2023 -0300 smb: client: report correct st_size for SMB and NFS symlinks We can't rely on FILE_STANDARD_INFORMATION::EndOfFile for reparse points as they will be always zero. Set it to symlink target's length as specified by POSIX. This will make stat() family of syscalls return the correct st_size for such files. Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/inode.c | 2 ++ 1 file changed, 2 insertions(+) commit ef22bb800d967616c7638d204bc1b425beac7f5f Author: Paulo Alcantara Date: Sat Nov 25 23:55:10 2023 -0300 smb: client: fix missing mode bits for SMB symlinks When instantiating inodes for SMB symlinks, add the mode bits from @cifs_sb->ctx->file_mode as we already do for the other special files. Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 52fdb99cc436014a417750150928c8ff1f69ae66 Author: Gustavo A. R. Silva Date: Thu Nov 16 12:11:43 2023 -0600 nouveau/gsp: replace zero-length array with flex-array member and use __counted_by Fake flexible arrays (zero-length and one-element arrays) are deprecated, and should be replaced by flexible-array members. So, replace zero-length array with a flexible-array member in `struct PACKED_REGISTRY_TABLE`. Also annotate array `entries` with `__counted_by()` to prepare for the coming implementation by GCC and Clang of the `__counted_by` attribute. Flexible array members annotated with `__counted_by` can have their accesses bounds-checked at run-time via `CONFIG_UBSAN_BOUNDS` (for array indexing) and `CONFIG_FORTIFY_SOURCE` (for strcpy/memcpy-family functions). This fixes multiple -Warray-bounds warnings: drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1069:29: warning: array subscript 0 is outside array bounds of 'PACKED_REGISTRY_ENTRY[0]' [-Warray-bounds=] drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1070:29: warning: array subscript 0 is outside array bounds of 'PACKED_REGISTRY_ENTRY[0]' [-Warray-bounds=] drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1071:29: warning: array subscript 0 is outside array bounds of 'PACKED_REGISTRY_ENTRY[0]' [-Warray-bounds=] drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1072:29: warning: array subscript 0 is outside array bounds of 'PACKED_REGISTRY_ENTRY[0]' [-Warray-bounds=] While there, also make use of the struct_size() helper, and address checkpatch.pl warning: WARNING: please, no spaces at the start of a line This results in no differences in binary output. Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/ZVZbX7C5suLMiBf+@work .../drm/nouveau/include/nvrm/535.113.01/nvidia/generated/g_os_nvoc.h | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 45b7955b774f82680db71f460fa01bfcdaaeb514 Author: Dan Carpenter Date: Mon Nov 27 15:56:33 2023 +0300 nouveau/gsp/r535: remove a stray unlock in r535_gsp_rpc_send() This unlock doesn't belong here and it leads to a double unlock in the caller, r535_gsp_rpc_push(). Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM") Signed-off-by: Dan Carpenter Reviewed-by: Timur Tabi Signed-off-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/a0293812-c05d-45f0-a535-3f24fe582c02@moroto.mountain drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit e9ba37d9f9a6872b069dd893bd86a7d77ba8c153 Author: Dave Airlie Date: Fri Aug 11 13:15:20 2023 +1000 nouveau: find the smallest page allocation to cover a buffer alloc. With the new uapi we don't have the comp flags on the allocation, so we shouldn't be using the first size that works, we should be iterating until we get the correct one. This reduces allocations from 2MB to 64k in lots of places. Fixes dEQP-VK.memory.allocation.basic.size_8KiB.forward.count_4000 on my ampere/gsp system. Cc: stable@vger.kernel.org # v6.6 Signed-off-by: Dave Airlie Reviewed-by: Faith Ekstrand Signed-off-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/20230811031520.248341-1-airlied@gmail.com drivers/gpu/drm/nouveau/nouveau_bo.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit dc761f11af2e39119d3a7942e3d10615f3d900e7 Author: Stefan Wahren Date: Sat Nov 18 13:42:52 2023 +0100 ARM: dts: bcm2711-rpi-400: Fix delete-node of led_act The LED ACT which is included from bcm2711-rpi-4-b doesn't exists on the Raspberry Pi 400. So the bcm2711-rpi-400.dts tries to use the delete-node directive in order to remove the complete node. Unfortunately the usage get broken in commit 1156e3a78bcc ("ARM: dts: bcm283x: Move ACT LED into separate dtsi") and now ACT and PWR LED using the same GPIO and this prevent probing of led-gpios on Raspberry Pi 400: leds-gpio: probe of leds failed with error -16 So fix the delete-node directive. Fixes: 1156e3a78bcc ("ARM: dts: bcm283x: Move ACT LED into separate dtsi") Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/20231118124252.14838-3-wahrenst@gmx.net Signed-off-by: Florian Fainelli arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit ae4d612cc1f23a6137d0978b1620a2af2e201c1a Author: Kent Overstreet Date: Sun Nov 26 21:13:54 2023 -0500 bcachefs: trace_move_extent_start_fail() now includes errcode Renamed from trace_move_extent_alloc_mem_fail, because there are other reasons we colud fail (disk space allocation failure). Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs_format.h | 2 +- fs/bcachefs/move.c | 23 ++++++++++------------- fs/bcachefs/trace.h | 6 +++--- 3 files changed, 14 insertions(+), 17 deletions(-) commit 5510a4af521c34df339fcceb0f26ace5b1090ad6 Author: Kent Overstreet Date: Sun Nov 26 18:31:11 2023 -0500 bcachefs: Fix split_race livelock bch2_btree_update_start() calculates which nodes are going to have to be split/rewritten, so that we know how many nodes to reserve and how deep in the tree we have to take locks. But btree node merges require inserting two keys into the parent node, not just splits. Signed-off-by: Kent Overstreet fs/bcachefs/btree_update_interior.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 03013bb0c6b157630018800a456a08646655ea97 Author: Kent Overstreet Date: Sat Nov 25 23:55:26 2023 -0500 bcachefs: Fix bucket data type for stripe buckets Signed-off-by: Kent Overstreet fs/bcachefs/buckets.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit d5bd37872a93e07ef3f9cbd4e2044ba4e17b5021 Author: Kent Overstreet Date: Sat Nov 25 21:42:08 2023 -0500 bcachefs: Add missing validation for jset_entry_data_usage Validation was completely missing for replicas entries in the journal (not the superblock replicas section) - we can't have replicas entries pointing to invalid devices. Signed-off-by: Kent Overstreet fs/bcachefs/errcode.h | 1 + fs/bcachefs/journal_io.c | 12 ++++++++- fs/bcachefs/replicas.c | 69 +++++++++++++++++++++++++++--------------------- fs/bcachefs/replicas.h | 2 ++ 4 files changed, 53 insertions(+), 31 deletions(-) commit bbc3a46065d08f9ab3412b1f26bbfa778c444833 Author: Kent Overstreet Date: Fri Nov 24 23:12:45 2023 -0500 bcachefs: Fix zstd compress workspace size zstd apparently lies about the size of the compression workspace it requires; if we double it compression succeeds. Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 2 +- fs/bcachefs/compress.c | 16 ++++++++++------ 2 files changed, 11 insertions(+), 7 deletions(-) commit af54d778a03853801d681c98c0c2a6c316ef9ca7 Author: Mukesh Ojha Date: Fri Nov 17 20:19:32 2023 +0530 devcoredump: Send uevent once devcd is ready dev_coredumpm() creates a devcoredump device and adds it to the core kernel framework which eventually end up sending uevent to the user space and later creates a symbolic link to the failed device. An application running in userspace may be interested in this symbolic link to get the name of the failed device. In a issue scenario, once uevent sent to the user space it start reading '/sys/class/devcoredump/devcdX/failing_device' to get the actual name of the device which might not been created and it is in its path of creation. To fix this, suppress sending uevent till the failing device symbolic link gets created and send uevent once symbolic link is created successfully. Fixes: 833c95456a70 ("device coredump: add new device coredump class") Signed-off-by: Mukesh Ojha Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/1700232572-25823-1-git-send-email-quic_mojha@quicinc.com Signed-off-by: Greg Kroah-Hartman drivers/base/devcoredump.c | 3 +++ 1 file changed, 3 insertions(+) commit 18d46e76d7c2eedd8577fae67e3f1d4db25018b0 Merge: df60cee26a2e 0ac1d13a55eb Author: Linus Torvalds Date: Tue Nov 28 11:16:04 2023 -0800 Merge tag 'for-6.7-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A few fixes and message updates: - for simple quotas, handle the case when a snapshot is created and the target qgroup already exists - fix a warning when file descriptor given to send ioctl is not writable - fix off-by-one condition when checking chunk maps - free pages when page array allocation fails during compression read, other cases were handled - fix memory leak on error handling path in ref-verify debugging feature - copy missing struct member 'version' in 64/32bit compat send ioctl - tree-checker verifies inline backref ordering - print messages to syslog on first mount and last unmount - update error messages when reading chunk maps" * tag 'for-6.7-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: send: ensure send_fd is writable btrfs: free the allocated memory if btrfs_alloc_page_array() fails btrfs: fix 64bit compat send ioctl arguments not initializing version member btrfs: make error messages more clear when getting a chunk map btrfs: fix off-by-one when checking chunk map includes logical address btrfs: ref-verify: fix memory leaks in btrfs_ref_tree_mod() btrfs: add dmesg output for first mount and last unmount of a filesystem btrfs: do not abort transaction if there is already an existing qgroup btrfs: tree-checker: add type and sequence check for inline backrefs commit 67d995e069535c32829f5d368d919063492cec6e Author: Yu Kuai Date: Tue Nov 28 20:30:27 2023 +0800 block: warn once for each partition in bio_check_ro() Commit 1b0a151c10a6 ("blk-core: use pr_warn_ratelimited() in bio_check_ro()") fix message storm by limit the rate, however, there will still be lots of message in the long term. Fix it better by warn once for each partition. Signed-off-by: Yu Kuai Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20231128123027.971610-3-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe block/blk-core.c | 14 +++++++++++--- include/linux/blk_types.h | 1 + 2 files changed, 12 insertions(+), 3 deletions(-) commit fad907cffd4bde7384812cf32fcf69becab805cc Author: Ming Lei Date: Tue Nov 28 20:30:26 2023 +0800 block: move .bd_inode into 1st cacheline of block_device The .bd_inode field of block_device is used in IO fast path of blkdev_write_iter() and blkdev_llseek(), so it is more efficient to keep it into the 1st cacheline. .bd_openers is only touched in open()/close(), and .bd_size_lock is only for updating bdev capacity, which is in slow path too. So swap .bd_inode layout with .bd_openers & .bd_size_lock to move .bd_inode into the 1st cache line. Cc: Yu Kuai Signed-off-by: Ming Lei Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20231128123027.971610-2-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe include/linux/blk_types.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 73363c262d6a7d26063da96610f61baf69a70f7c Author: Jens Axboe Date: Tue Nov 28 10:29:58 2023 -0700 io_uring: use fget/fput consistently Normally within a syscall it's fine to use fdget/fdput for grabbing a file from the file table, and it's fine within io_uring as well. We do that via io_uring_enter(2), io_uring_register(2), and then also for cancel which is invoked from the latter. io_uring cannot close its own file descriptors as that is explicitly rejected, and for the cancel side of things, the file itself is just used as a lookup cookie. However, it is more prudent to ensure that full references are always grabbed. For anything threaded, either explicitly in the application itself or through use of the io-wq worker threads, this is what happens anyway. Generalize it and use fget/fput throughout. Also see the below link for more details. Link: https://lore.kernel.org/io-uring/CAG48ez1htVSO3TqmrF8QcX2WFuYTRM-VZ_N10i-VZgbtg=NNqw@mail.gmail.com/ Suggested-by: Jann Horn Signed-off-by: Jens Axboe io_uring/cancel.c | 11 ++++++----- io_uring/io_uring.c | 36 ++++++++++++++++++------------------ 2 files changed, 24 insertions(+), 23 deletions(-) commit 5cf4f52e6d8aa2d3b7728f568abbf9d42a3af252 Author: Jens Axboe Date: Mon Nov 27 17:54:40 2023 -0700 io_uring: free io_buffer_list entries via RCU mmap_lock nests under uring_lock out of necessity, as we may be doing user copies with uring_lock held. However, for mmap of provided buffer rings, we attempt to grab uring_lock with mmap_lock already held from do_mmap(). This makes lockdep, rightfully, complain: WARNING: possible circular locking dependency detected 6.7.0-rc1-00009-gff3337ebaf94-dirty #4438 Not tainted ------------------------------------------------------ buf-ring.t/442 is trying to acquire lock: ffff00020e1480a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_uring_validate_mmap_request.isra.0+0x4c/0x140 but task is already holding lock: ffff0000dc226190 (&mm->mmap_lock){++++}-{3:3}, at: vm_mmap_pgoff+0x124/0x264 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&mm->mmap_lock){++++}-{3:3}: __might_fault+0x90/0xbc io_register_pbuf_ring+0x94/0x488 __arm64_sys_io_uring_register+0x8dc/0x1318 invoke_syscall+0x5c/0x17c el0_svc_common.constprop.0+0x108/0x130 do_el0_svc+0x2c/0x38 el0_svc+0x4c/0x94 el0t_64_sync_handler+0x118/0x124 el0t_64_sync+0x168/0x16c -> #0 (&ctx->uring_lock){+.+.}-{3:3}: __lock_acquire+0x19a0/0x2d14 lock_acquire+0x2e0/0x44c __mutex_lock+0x118/0x564 mutex_lock_nested+0x20/0x28 io_uring_validate_mmap_request.isra.0+0x4c/0x140 io_uring_mmu_get_unmapped_area+0x3c/0x98 get_unmapped_area+0xa4/0x158 do_mmap+0xec/0x5b4 vm_mmap_pgoff+0x158/0x264 ksys_mmap_pgoff+0x1d4/0x254 __arm64_sys_mmap+0x80/0x9c invoke_syscall+0x5c/0x17c el0_svc_common.constprop.0+0x108/0x130 do_el0_svc+0x2c/0x38 el0_svc+0x4c/0x94 el0t_64_sync_handler+0x118/0x124 el0t_64_sync+0x168/0x16c From that mmap(2) path, we really just need to ensure that the buffer list doesn't go away from underneath us. For the lower indexed entries, they never go away until the ring is freed and we can always sanely reference those as long as the caller has a file reference. For the higher indexed ones in our xarray, we just need to ensure that the buffer list remains valid while we return the address of it. Free the higher indexed io_buffer_list entries via RCU. With that we can avoid needing ->uring_lock inside mmap(2), and simply hold the RCU read lock around the buffer list lookup and address check. To ensure that the arrayed lookup either returns a valid fully formulated entry via RCU lookup, add an 'is_ready' flag that we access with store and release memory ordering. This isn't needed for the xarray lookups, but doesn't hurt either. Since this isn't a fast path, retain it across both types. Similarly, for the allocated array inside the ctx, ensure we use the proper load/acquire as setup could in theory be running in parallel with mmap. While in there, add a few lockdep checks for documentation purposes. Cc: stable@vger.kernel.org Fixes: c56e022c0a27 ("io_uring: add support for user mapped provided buffer ring") Signed-off-by: Jens Axboe io_uring/io_uring.c | 4 ++-- io_uring/kbuf.c | 64 ++++++++++++++++++++++++++++++++++++++++++----------- io_uring/kbuf.h | 3 +++ 3 files changed, 56 insertions(+), 15 deletions(-) commit 07d6063d3d3beb3168d3ac9fdef7bca81254d983 Author: Jens Axboe Date: Mon Nov 27 17:02:48 2023 -0700 io_uring/kbuf: prune deferred locked cache when tearing down We used to just use our page list for final teardown, which would ensure that we got all the buffers, even the ones that were not on the normal cached list. But while moving to slab for the io_buffers, we know only prune this list, not the deferred locked list that we have. This can cause a leak of memory, if the workload ends up using the intermediate locked list. Fix this by always pruning both lists when tearing down. Fixes: b3a4dbc89d40 ("io_uring/kbuf: Use slab for struct io_buffer objects") Signed-off-by: Jens Axboe io_uring/kbuf.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit b10b73c102a2eab91e1cd62a03d6446f1dfecc64 Author: Jens Axboe Date: Tue Nov 28 11:17:25 2023 -0700 io_uring/kbuf: recycle freed mapped buffer ring entries Right now we stash any potentially mmap'ed provided ring buffer range for freeing at release time, regardless of when they get unregistered. Since we're keeping track of these ranges anyway, keep track of their registration state as well, and use that to recycle ranges when appropriate rather than always allocate new ones. The lookup is a basic scan of entries, checking for the best matching free entry. Fixes: c392cbecd8ec ("io_uring/kbuf: defer release of mapped buffer rings") Signed-off-by: Jens Axboe io_uring/kbuf.c | 77 ++++++++++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 66 insertions(+), 11 deletions(-) commit cff5f49d433fcd0063c8be7dd08fa5bf190c6c37 Author: Tim Van Patten Date: Wed Nov 15 09:20:43 2023 -0700 cgroup_freezer: cgroup_freezing: Check if not frozen __thaw_task() was recently updated to warn if the task being thawed was part of a freezer cgroup that is still currently freezing: void __thaw_task(struct task_struct *p) { ... if (WARN_ON_ONCE(freezing(p))) goto unlock; This has exposed a bug in cgroup1 freezing where when CGROUP_FROZEN is asserted, the CGROUP_FREEZING bits are not also cleared at the same time. Meaning, when a cgroup is marked FROZEN it continues to be marked FREEZING as well. This causes the WARNING to trigger, because cgroup_freezing() thinks the cgroup is still freezing. There are two ways to fix this: 1. Whenever FROZEN is set, clear FREEZING for the cgroup and all children cgroups. 2. Update cgroup_freezing() to also verify that FROZEN is not set. This patch implements option (2), since it's smaller and more straightforward. Signed-off-by: Tim Van Patten Tested-by: Mark Hasemeyer Fixes: f5d39b020809 ("freezer,sched: Rewrite core freezer logic") Cc: stable@vger.kernel.org # v6.1+ Signed-off-by: Tejun Heo kernel/cgroup/legacy_freezer.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit c392cbecd8eca4c53f2bf508731257d9d0a21c2d Author: Jens Axboe Date: Mon Nov 27 16:47:04 2023 -0700 io_uring/kbuf: defer release of mapped buffer rings If a provided buffer ring is setup with IOU_PBUF_RING_MMAP, then the kernel allocates the memory for it and the application is expected to mmap(2) this memory. However, io_uring uses remap_pfn_range() for this operation, so we cannot rely on normal munmap/release on freeing them for us. Stash an io_buf_free entry away for each of these, if any, and provide a helper to free them post ->release(). Cc: stable@vger.kernel.org Fixes: c56e022c0a27 ("io_uring: add support for user mapped provided buffer ring") Reported-by: Jann Horn Signed-off-by: Jens Axboe include/linux/io_uring_types.h | 3 +++ io_uring/io_uring.c | 2 ++ io_uring/kbuf.c | 44 +++++++++++++++++++++++++++++++++++++----- io_uring/kbuf.h | 2 ++ 4 files changed, 46 insertions(+), 5 deletions(-) commit b817f1488fca548fe50e2654d84a1956a16a1a8a Author: Lukasz Luba Date: Mon Nov 27 09:28:19 2023 +0000 powercap: DTPM: Fix unneeded conversions to micro-Watts The power values coming from the Energy Model are already in uW. The PowerCap and DTPM frameworks operate on uW, so all places should just use the values from the EM. Fix the code by removing all of the conversion to uW still present in it. Fixes: ae6ccaa65038 (PM: EM: convert power field to micro-Watts precision and align drivers) Cc: 5.19+ # v5.19+ Signed-off-by: Lukasz Luba [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki drivers/powercap/dtpm_cpu.c | 6 +----- drivers/powercap/dtpm_devfreq.c | 11 +++-------- 2 files changed, 4 insertions(+), 13 deletions(-) commit bb87be267b8ee9b40917fb5bf51be5ddb33c37c2 Author: Gautham R. Shenoy Date: Mon Nov 27 16:41:21 2023 +0530 cpufreq/amd-pstate: Fix the return value of amd_pstate_fast_switch() cpufreq_driver->fast_switch() callback expects a frequency as a return value. amd_pstate_fast_switch() was returning the return value of amd_pstate_update_freq(), which only indicates a success or failure. Fix this by making amd_pstate_fast_switch() return the target_freq when the call to amd_pstate_update_freq() is successful, and return the current frequency from policy->cur when the call to amd_pstate_update_freq() is unsuccessful. Fixes: 4badf2eb1e98 ("cpufreq: amd-pstate: Add ->fast_switch() callback") Acked-by: Huang Rui Reviewed-by: Wyes Karny Reviewed-by: Perry Yuan Cc: 6.4+ # v6.4+ Signed-off-by: Gautham R. Shenoy Signed-off-by: Rafael J. Wysocki drivers/cpufreq/amd-pstate.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit e0894ff038d86f30614ec16ec26dacb88c8d2bd4 Author: Luke D. Jones Date: Mon Nov 27 12:05:21 2023 +1300 platform/x86: asus-wmi: disable USB0 hub on ROG Ally before suspend ASUS have worked around an issue in XInput where it doesn't support USB selective suspend, which causes suspend issues in Windows. They worked around this by adjusting the MCU firmware to disable the USB0 hub when the screen is switched off during the Microsoft DSM suspend path in ACPI. The issue we have with this however is one of timing - the call the tells the MCU to this isn't able to complete before suspend is done so we call this in a prepare() and add a small msleep() to ensure it is done. This must be done before the screen is switched off to prevent a variety of possible races. Further to this the MCU powersave option must also be disabled as it can cause a number of issues such as: - unreliable resume connection of N-Key - complete loss of N-Key if the power is plugged in while suspended Disabling the powersave option prevents this. Without this the MCU is unable to initialise itself correctly on resume. Signed-off-by: "Luke D. Jones" Tested-by: Philip Mueller Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20231126230521.125708-2-luke@ljones.dev Signed-off-by: Ilpo Järvinen drivers/platform/x86/asus-wmi.c | 50 ++++++++++++++++++++++++++++++ include/linux/platform_data/x86/asus-wmi.h | 3 ++ 2 files changed, 53 insertions(+) commit 5e1d824f9a283cbf90f25241b66d1f69adb3835b Author: Timothy Pearson Date: Sun Nov 19 09:18:02 2023 -0600 powerpc: Don't clobber f0/vs0 during fp|altivec register save During floating point and vector save to thread data f0/vs0 are clobbered by the FPSCR/VSCR store routine. This has been obvserved to lead to userspace register corruption and application data corruption with io-uring. Fix it by restoring f0/vs0 after FPSCR/VSCR store has completed for all the FP, altivec, VMX register save paths. Tested under QEMU in kvm mode, running on a Talos II workstation with dual POWER9 DD2.2 CPUs. Additional detail (mpe): Typically save_fpu() is called from __giveup_fpu() which saves the FP regs and also *turns off FP* in the tasks MSR, meaning the kernel will reload the FP regs from the thread struct before letting the task use FP again. So in that case save_fpu() is free to clobber f0 because the FP regs no longer hold live values for the task. There is another case though, which is the path via: sys_clone() ... copy_process() dup_task_struct() arch_dup_task_struct() flush_all_to_thread() save_all() That path saves the FP regs but leaves them live. That's meant as an optimisation for a process that's using FP/VSX and then calls fork(), leaving the regs live means the parent process doesn't have to take a fault after the fork to get its FP regs back. The optimisation was added in commit 8792468da5e1 ("powerpc: Add the ability to save FPU without giving it up"). That path does clobber f0, but f0 is volatile across function calls, and typically programs reach copy_process() from userspace via a syscall wrapper function. So in normal usage f0 being clobbered across a syscall doesn't cause visible data corruption. But there is now a new path, because io-uring can call copy_process() via create_io_thread() from the signal handling path. That's OK if the signal is handled as part of syscall return, but it's not OK if the signal is handled due to some other interrupt. That path is: interrupt_return_srr_user() interrupt_exit_user_prepare() interrupt_exit_user_prepare_main() do_notify_resume() get_signal() task_work_run() create_worker_cb() create_io_worker() copy_process() dup_task_struct() arch_dup_task_struct() flush_all_to_thread() save_all() if (tsk->thread.regs->msr & MSR_FP) save_fpu() # f0 is clobbered and potentially live in userspace Note the above discussion applies equally to save_altivec(). Fixes: 8792468da5e1 ("powerpc: Add the ability to save FPU without giving it up") Cc: stable@vger.kernel.org # v4.6+ Closes: https://lore.kernel.org/all/480932026.45576726.1699374859845.JavaMail.zimbra@raptorengineeringinc.com/ Closes: https://lore.kernel.org/linuxppc-dev/480221078.47953493.1700206777956.JavaMail.zimbra@raptorengineeringinc.com/ Tested-by: Timothy Pearson Tested-by: Jens Axboe Signed-off-by: Timothy Pearson [mpe: Reword change log to describe exact path of corruption & other minor tweaks] Signed-off-by: Michael Ellerman Link: https://msgid.link/1921539696.48534988.1700407082933.JavaMail.zimbra@raptorengineeringinc.com arch/powerpc/kernel/fpu.S | 13 +++++++++++++ arch/powerpc/kernel/vector.S | 2 ++ 2 files changed, 15 insertions(+) commit 91d3d149978ba7b238198dd80e4b823756aa7cfa Author: Heiner Kallweit Date: Sun Nov 26 23:01:02 2023 +0100 r8169: prevent potential deadlock in rtl8169_close ndo_stop() is RTNL-protected by net core, and the worker function takes RTNL as well. Therefore we will deadlock when trying to execute a pending work synchronously. To fix this execute any pending work asynchronously. This will do no harm because netif_running() is false in ndo_stop(), and therefore the work function is effectively a no-op. However we have to ensure that no task is running or pending after rtl_remove_one(), therefore add a call to cancel_work_sync(). Fixes: abe5fc42f9ce ("r8169: use RTNL to protect critical sections") Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/12395867-1d17-4cac-aa7d-c691938fcddf@gmail.com Signed-off-by: Paolo Abeni drivers/net/ethernet/realtek/r8169_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 59d395ed606d8df14615712b0cdcdadb2d962175 Author: Heiner Kallweit Date: Sun Nov 26 19:36:46 2023 +0100 r8169: fix deadlock on RTL8125 in jumbo mtu mode The original change results in a deadlock if jumbo mtu mode is used. Reason is that the phydev lock is held when rtl_reset_work() is called here, and rtl_jumbo_config() calls phy_start_aneg() which also tries to acquire the phydev lock. Fix this by calling rtl_reset_work() asynchronously. Fixes: 621735f59064 ("r8169: fix rare issue with broken rx after link-down on RTL8125") Reported-by: Ian Chen Tested-by: Ian Chen Cc: stable@vger.kernel.org Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/caf6a487-ef8c-4570-88f9-f47a659faf33@gmail.com Signed-off-by: Paolo Abeni drivers/net/ethernet/realtek/r8169_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 01b1e3ca0e5ce47bbae8217d47376ad01b331b07 Author: Michael Roth Date: Fri Nov 3 10:13:54 2023 -0500 efi/unaccepted: Fix off-by-one when checking for overlapping ranges When a task needs to accept memory it will scan the accepting_list to see if any ranges already being processed by other tasks overlap with its range. Due to an off-by-one in the range comparisons, a task might falsely determine that an overlapping range is being accepted, leading to an unnecessary delay before it begins processing the range. Fix the off-by-one in the range comparison to prevent this and slightly improve performance. Fixes: 50e782a86c98 ("efi/unaccepted: Fix soft lockups caused by parallel memory acceptance") Link: https://lore.kernel.org/linux-mm/20231101004523.vseyi5bezgfaht5i@amd.com/T/#me2eceb9906fcae5fe958b3fe88e41f920f8335b6 Reviewed-by: Kirill A. Shutemov Signed-off-by: Michael Roth Acked-by: Vlastimil Babka Signed-off-by: Ard Biesheuvel drivers/firmware/efi/unaccepted_memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7f3da4b698bcc21a6df0e7f114af71d53a3e26ac Author: Dan Carpenter Date: Tue Nov 28 09:52:41 2023 +0300 xen/events: fix error code in xen_bind_pirq_msi_to_irq() Return -ENOMEM if xen_irq_init() fails. currently the code returns an uninitialized variable or zero. Fixes: 5dd9ad32d775 ("xen/events: drop xen_allocate_irqs_dynamic()") Signed-off-by: Dan Carpenter Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/3b9ab040-a92e-4e35-b687-3a95890a9ace@moroto.mountain Signed-off-by: Juergen Gross drivers/xen/events/events_base.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit db2832309a82b9acc4b8cc33a1831d36507ec13e Author: Juergen Gross Date: Fri Nov 24 08:48:52 2023 +0100 x86/xen: fix percpu vcpu_info allocation Today the percpu struct vcpu_info is allocated via DEFINE_PER_CPU(), meaning that it could cross a page boundary. In this case registering it with the hypervisor will fail, resulting in a panic(). This can easily be fixed by using DEFINE_PER_CPU_ALIGNED() instead, as struct vcpu_info is guaranteed to have a size of 64 bytes, matching the cache line size of x86 64-bit processors (Xen doesn't support 32-bit processors). Fixes: 5ead97c84fa7 ("xen: Core Xen implementation") Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20231124074852.25161-1-jgross@suse.com Signed-off-by: Juergen Gross arch/x86/xen/enlighten.c | 6 +++++- arch/x86/xen/xen-ops.h | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) commit 45b3fae4675dc1d4ee2d7aefa19d85ee4f891377 Author: Gustavo A. R. Silva Date: Sat Nov 25 15:33:58 2023 -0600 neighbour: Fix __randomize_layout crash in struct neighbour Previously, one-element and zero-length arrays were treated as true flexible arrays, even though they are actually "fake" flex arrays. The __randomize_layout would leave them untouched at the end of the struct, similarly to proper C99 flex-array members. However, this approach changed with commit 1ee60356c2dc ("gcc-plugins: randstruct: Only warn about true flexible arrays"). Now, only C99 flexible-array members will remain untouched at the end of the struct, while one-element and zero-length arrays will be subject to randomization. Fix a `__randomize_layout` crash in `struct neighbour` by transforming zero-length array `primary_key` into a proper C99 flexible-array member. Fixes: 1ee60356c2dc ("gcc-plugins: randstruct: Only warn about true flexible arrays") Closes: https://lore.kernel.org/linux-hardening/20231124102458.GB1503258@e124191.cambridge.arm.com/ Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Tested-by: Joey Gouly Link: https://lore.kernel.org/r/ZWJoRsJGnCPdJ3+2@work Signed-off-by: Paolo Abeni include/net/neighbour.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fd7f98b2e12a3d96a92bde6640657ec7116f4372 Author: Subbaraya Sundeep Date: Sat Nov 25 22:06:57 2023 +0530 octeontx2-pf: Restore TC ingress police rules when interface is up TC ingress policer rules depends on interface receive queue contexts since the bandwidth profiles are attached to RQ contexts. When an interface is brought down all the queue contexts are freed. This in turn frees bandwidth profiles in hardware causing ingress police rules non-functional after the interface is brought up. Fix this by applying all the ingress police rules config to hardware in otx2_open. Also allow adding ingress rules only when interface is running since no contexts exist for the interface when it is down. Fixes: 68fbff68dbea ("octeontx2-pf: Add police action for TC flower") Signed-off-by: Subbaraya Sundeep Link: https://lore.kernel.org/r/1700930217-5707-1-git-send-email-sbhatta@marvell.com Signed-off-by: Paolo Abeni drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 3 + .../ethernet/marvell/octeontx2/nic/otx2_common.h | 2 + .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 + .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 120 ++++++++++++++++----- 4 files changed, 102 insertions(+), 25 deletions(-) commit 51597219e0cd5157401d4d0ccb5daa4d9961676f Author: Geetha sowjanya Date: Sat Nov 25 22:04:02 2023 +0530 octeontx2-pf: Fix adding mbox work queue entry when num_vfs > 64 When more than 64 VFs are enabled for a PF then mbox communication between VF and PF is not working as mbox work queueing for few VFs are skipped due to wrong calculation of VF numbers. Fixes: d424b6c02415 ("octeontx2-pf: Enable SRIOV and added VF mbox handling") Signed-off-by: Geetha sowjanya Signed-off-by: Subbaraya Sundeep Link: https://lore.kernel.org/r/1700930042-5400-1-git-send-email-sbhatta@marvell.com Signed-off-by: Paolo Abeni drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit f71f6ff8c1f682a1cae4e8d7bdeed9d7f76b8f75 Author: Tony Lindgren Date: Fri Nov 24 10:50:56 2023 +0200 bus: ti-sysc: Flush posted write only after srst_udelay Commit 34539b442b3b ("bus: ti-sysc: Flush posted write on enable before reset") caused a regression reproducable on omap4 duovero where the ISS target module can produce interconnect errors on boot. Turns out the registers are not accessible until after a delay for devices needing a ti,sysc-delay-us value. Let's fix this by flushing the posted write only after the reset delay. We do flushing also for ti,sysc-delay-us using devices as that should trigger an interconnect error if the delay is not properly configured. Let's also add some comments while at it. Fixes: 34539b442b3b ("bus: ti-sysc: Flush posted write on enable before reset") Cc: stable@vger.kernel.org Signed-off-by: Tony Lindgren drivers/bus/ti-sysc.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) commit e54d628a2721bfbb002c19f6e8ca6746cec7640f Author: Furong Xu <0x1207@gmail.com> Date: Sat Nov 25 14:01:26 2023 +0800 net: stmmac: xgmac: Disable FPE MMC interrupts Commit aeb18dd07692 ("net: stmmac: xgmac: Disable MMC interrupts by default") tries to disable MMC interrupts to avoid a storm of unhandled interrupts, but leaves the FPE(Frame Preemption) MMC interrupts enabled, FPE MMC interrupts can cause the same problem. Now we mask FPE TX and RX interrupts to disable all MMC interrupts. Fixes: aeb18dd07692 ("net: stmmac: xgmac: Disable MMC interrupts by default") Reviewed-by: Larysa Zaremba Signed-off-by: Furong Xu <0x1207@gmail.com> Reviewed-by: Serge Semin Reviewed-by: Wojciech Drewek Link: https://lore.kernel.org/r/20231125060126.2328690-1-0x1207@gmail.com Signed-off-by: Paolo Abeni drivers/net/ethernet/stmicro/stmmac/mmc_core.c | 4 ++++ 1 file changed, 4 insertions(+) commit b9c02e1052650af56d4487efa5fade3fb70e3653 Author: Thomas Hellström Date: Mon Nov 6 12:48:27 2023 +0100 drm/gpuvm: Fix deprecated license identifier "GPL-2.0-only" in the license header was incorrectly changed to the now deprecated "GPL-2.0". Fix. Cc: Maxime Ripard Cc: Danilo Krummrich Reported-by: David Edelsohn Closes: https://lore.kernel.org/dri-devel/5lfrhdpkwhpgzipgngojs3tyqfqbesifzu5nf4l5q3nhfdhcf2@25nmiq7tfrew/T/#m5c356d68815711eea30dd94cc6f7ea8cd4344fe3 Fixes: f7749a549b4f ("drm/gpuvm: Dual-licence the drm_gpuvm code GPL-2.0 OR MIT") Signed-off-by: Thomas Hellström Acked-by: Maxime Ripard Acked-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/20231106114827.62492-1-thomas.hellstrom@linux.intel.com drivers/gpu/drm/drm_gpuvm.c | 2 +- include/drm/drm_gpuvm.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 9b6a59e5db87c2c6b3ca0391176ed4358623d5e4 Author: Linus Walleij Date: Tue Nov 28 00:10:21 2023 +0100 Revert "drm/bridge: panel: Add a device link between drm device and panel device" This reverts commit 199cf07ebd2b0d41185ac79b895547d45610b681. This patch creates bugs on devices where the DRM device is the ancestor of the panel devices. Attempts to fix this have failed because it leads to using device core functionality which is questionable. Reported-by: Linus Walleij Link: https://lore.kernel.org/lkml/CACRpkdaGzXD6HbiX7mVUNJAJtMEPG00Pp6+nJ1P0JrfJ-ArMvQ@mail.gmail.com/T/ Signed-off-by: Linus Walleij Acked-by: Neil Armstrong Link: https://lore.kernel.org/r/20231128-revert-panel-fix-v1-3-69bb05048dae@linaro.org Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20231128-revert-panel-fix-v1-3-69bb05048dae@linaro.org drivers/gpu/drm/bridge/panel.c | 17 ----------------- 1 file changed, 17 deletions(-) commit 8dd926689dfa9d8ee64e4fce202d0fdc91fd69fd Author: Linus Walleij Date: Tue Nov 28 00:10:19 2023 +0100 Revert "driver core: Export device_is_dependent() to modules" This reverts commit 1d5e8f4bf06da86b71cc9169110d1a0e1e7af337. Greg says: "why exactly is this needed? Nothing outside of the driver core should be needing this function, it shouldn't be public at all (I missed that before.) So please, revert it for now, let's figure out why DRM thinks this is needed for it's devices, and yet no other bus/subsystem does." Link: https://lore.kernel.org/dri-devel/2023112739-willing-sighing-6bdd@gregkh/ Signed-off-by: Linus Walleij Acked-by: Neil Armstrong Link: https://lore.kernel.org/r/20231128-revert-panel-fix-v1-1-69bb05048dae@linaro.org Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20231128-revert-panel-fix-v1-1-69bb05048dae@linaro.org drivers/base/core.c | 1 - 1 file changed, 1 deletion(-) commit c13f87efa7488fcd5f4d6e89c8f9d5bb072f9e6e Author: Linus Walleij Date: Tue Nov 28 00:10:20 2023 +0100 Revert "drm/bridge: panel: Check device dependency before managing device link" This reverts commit 39d5b6a64ace77d0c11c398d272218df5f939abb. This patch was causing build errors by using an unexported function from the device core, which Greg questions the saneness in exporting. Link: https://lore.kernel.org/lkml/CACRpkdaGzXD6HbiX7mVUNJAJtMEPG00Pp6+nJ1P0JrfJ-ArMvQ@mail.gmail.com/T/ Signed-off-by: Linus Walleij Acked-by: Neil Armstrong Link: https://lore.kernel.org/r/20231128-revert-panel-fix-v1-2-69bb05048dae@linaro.org Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20231128-revert-panel-fix-v1-2-69bb05048dae@linaro.org drivers/gpu/drm/bridge/panel.c | 27 +++++++++------------------ 1 file changed, 9 insertions(+), 18 deletions(-) commit 0c349b5001f8bdcead844484c15a0c4dfb341157 Author: Alex Bee Date: Mon Nov 27 19:46:44 2023 +0100 ARM: dts: rockchip: Fix sdmmc_pwren's pinmux setting for RK3128 RK3128's reference design uses sdmmc_pwren pincontrol as GPIO - see [0]. Let's change it in the SoC DT as well. [0] https://github.com/rockchip-linux/kernel/commit/8c62deaf6025 Fixes: a0201bff6259 ("ARM: dts: rockchip: add rk3128 soc dtsi") Signed-off-by: Alex Bee Link: https://lore.kernel.org/r/20231127184643.13314-2-knaerzche@gmail.com Signed-off-by: Heiko Stuebner arch/arm/boot/dts/rockchip/rk3128.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 393cae5f32d640b9798903702018a48c7a45e59f Author: Chao Song Date: Mon Nov 27 20:47:35 2023 +0800 soundwire: intel_ace2x: fix AC timing setting for ACE2.x Start from ACE1.x, DOAISE is added to AC timing control register bit 5, it combines with DOAIS to get effective timing, and has the default value 1. The current code fills DOAIS, DACTQE and DODS bits to a variable initialized to zero, and updates the variable to AC timing control register. With this operation, We change DOAISE to 0, and force a much more aggressive timing. The timing is even unable to form a working waveform on SDA pin. This patch uses read-modify-write operation for the AC timing control register access, thus makes sure those bits not supposed and intended to change are not touched. Signed-off-by: Chao Song Reviewed-by: Pierre-Louis Bossart Signed-off-by: Bard Liao Link: https://lore.kernel.org/r/20231127124735.2080562-1-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul drivers/soundwire/intel_ace2x.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit ad31c629ca3c87f6d557488c1f9faaebfbcd203c Author: Elena Salomatkina Date: Sat Nov 25 00:08:02 2023 +0300 octeontx2-af: Fix possible buffer overflow A loop in rvu_mbox_handler_nix_bandprof_free() contains a break if (idx == MAX_BANDPROF_PER_PFFUNC), but if idx may reach MAX_BANDPROF_PER_PFFUNC buffer '(*req->prof_idx)[layer]' overflow happens before that check. The patch moves the break to the beginning of the loop. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: e8e095b3b370 ("octeontx2-af: cn10k: Bandwidth profiles config support"). Signed-off-by: Elena Salomatkina Reviewed-by: Simon Horman Reviewed-by: Subbaraya Sundeep Link: https://lore.kernel.org/r/20231124210802.109763-1-elena.salomatkina.cmc@gmail.com Signed-off-by: Paolo Abeni drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 99fe9ee56bd2f7358f1bc72551c2f3a6bbddf80a Author: Alex Bee Date: Mon Nov 27 19:14:18 2023 +0100 clk: rockchip: rk3128: Fix SCLK_SDMMC's clock name SCLK_SDMMC is the parent for SCLK_SDMMC_DRV and SCLK_SDMMC_SAMPLE, but used with the (more) correct name sclk_sdmmc. SD card tuning does currently fail as the parent can't be found under that name. There is no need to suffix the name with '0' since RK312x SoCs do have a single sdmmc controller - so rename it to the name which is already used by it's children. Fixes: f6022e88faca ("clk: rockchip: add clock controller for rk3128") Signed-off-by: Alex Bee Link: https://lore.kernel.org/r/20231127181415.11735-6-knaerzche@gmail.com Signed-off-by: Heiko Stuebner drivers/clk/rockchip/clk-rk3128.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 98dcc6be3859fb15257750b8e1d4e0eefd2c5e1e Author: Finley Xiao Date: Mon Nov 27 19:14:16 2023 +0100 clk: rockchip: rk3128: Fix aclk_peri_src's parent According to the TRM there are no specific gpll_peri, cpll_peri, gpll_div2_peri or gpll_div3_peri gates, but a single clk_peri_src gate. Instead mux_clk_peri_src directly connects to the plls respectively the pll divider clocks. Fix this by creating a single gated composite. Also rename all occurrences of aclk_peri_src to clk_peri_src, since it is the parent for peri aclks, pclks and hclks. That name also matches the one used in the TRM. Fixes: f6022e88faca ("clk: rockchip: add clock controller for rk3128") Signed-off-by: Finley Xiao [renamed aclk_peri_src -> clk_peri_src and added commit message] Signed-off-by: Alex Bee Link: https://lore.kernel.org/r/20231127181415.11735-4-knaerzche@gmail.com Signed-off-by: Heiko Stuebner drivers/clk/rockchip/clk-rk3128.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) commit baaacbff64d9f34b64f294431966d035aeadb81c Author: Kailang Yang Date: Wed Oct 25 15:24:06 2023 +0800 ALSA: hda/realtek: Headset Mic VREF to 100% This platform need to set Mic VREF to 100%. Signed-off-by: Kailang Yang Cc: Link: https://lore.kernel.org/r/0916af40f08a4348a3298a9a59e6967e@realtek.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit e199bf52ffda8f98f129728d57244a9cd9ad5623 Author: Krzysztof Kozlowski Date: Fri Nov 24 19:01:36 2023 +0100 soundwire: stream: fix NULL pointer dereference for multi_link If bus is marked as multi_link, but number of masters in the stream is not higher than bus->hw_sync_min_links (bus->multi_link && m_rt_count >= bus->hw_sync_min_links), bank switching should not happen. The first part of do_bank_switch() code properly takes these conditions into account, but second part (sdw_ml_sync_bank_switch()) relies purely on bus->multi_link property. This is not balanced and leads to NULL pointer dereference: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ... Call trace: wait_for_completion_timeout+0x124/0x1f0 do_bank_switch+0x370/0x6f8 sdw_prepare_stream+0x2d0/0x438 qcom_snd_sdw_prepare+0xa0/0x118 sm8450_snd_prepare+0x128/0x148 snd_soc_link_prepare+0x5c/0xe8 __soc_pcm_prepare+0x28/0x1ec dpcm_be_dai_prepare+0x1e0/0x2c0 dpcm_fe_dai_prepare+0x108/0x28c snd_pcm_do_prepare+0x44/0x68 snd_pcm_action_single+0x54/0xc0 snd_pcm_action_nonatomic+0xe4/0xec snd_pcm_prepare+0xc4/0x114 snd_pcm_common_ioctl+0x1154/0x1cc0 snd_pcm_ioctl+0x54/0x74 Fixes: ce6e74d008ff ("soundwire: Add support for multi link bank switch") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20231124180136.390621-1-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul drivers/soundwire/stream.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit edecf1689768452ba1a64b7aaf3a47a817da651a Author: Jens Axboe Date: Mon Nov 27 20:53:52 2023 -0700 io_uring: enable io_mem_alloc/free to be used in other parts In preparation for using these helpers, make them non-static and add them to our internal header. Signed-off-by: Jens Axboe io_uring/io_uring.c | 4 ++-- io_uring/io_uring.h | 3 +++ 2 files changed, 5 insertions(+), 2 deletions(-) commit ec2610b129b49fd3ba0fbbf1fe988774a1af4a2a Merge: ccf49cebe595 00a4f8fd9c75 Author: Jakub Kicinski Date: Mon Nov 27 18:12:09 2023 -0800 Merge branch 'selftests-net-fix-a-few-small-compiler-warnings' Willem de Bruijn says: ==================== selftests/net: fix a few small compiler warnings Observed a clang warning when backporting cmsg_sender. Ran the same build against all the .c files under selftests/net. This is clang-14 with -Wall Which is what tools/testing/selftests/net/Makefile also enables. ==================== Link: https://lore.kernel.org/r/20231124171645.1011043-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski commit 00a4f8fd9c750f20d8fd4535c71c9caa7ef5ff2f Author: Willem de Bruijn Date: Fri Nov 24 12:15:22 2023 -0500 selftests/net: mptcp: fix uninitialized variable warnings Same init_rng() in both tests. The function reads /dev/urandom to initialize srand(). In case of failure, it falls back onto the entropy in the uninitialized variable. Not sure if this is on purpose. But failure reading urandom should be rare, so just fail hard. While at it, convert to getrandom(). Which man 4 random suggests is simpler and more robust. mptcp_inq.c:525:6: mptcp_connect.c:1131:6: error: variable 'foo' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp") Fixes: b51880568f20 ("selftests: mptcp: add inq test case") Cc: Florian Westphal Signed-off-by: Willem de Bruijn ---- When input is randomized because this is expected to meaningfully explore edge cases, should we also add 1. logging the random seed to stdout and 2. adding a command line argument to replay from a specific seed I can do this in net-next, if authors find it useful in this case. Reviewed-by: Matthieu Baerts Link: https://lore.kernel.org/r/20231124171645.1011043-5-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski tools/testing/selftests/net/mptcp/mptcp_connect.c | 11 ++++------- tools/testing/selftests/net/mptcp/mptcp_inq.c | 11 ++++------- 2 files changed, 8 insertions(+), 14 deletions(-) commit 59fef379d453781f0dabfa1f1a1e86e78aee919a Author: Willem de Bruijn Date: Fri Nov 24 12:15:21 2023 -0500 selftests/net: unix: fix unused variable compiler warning Remove an unused variable. diag_uid.c:151:24: error: unused variable 'udr' [-Werror,-Wunused-variable] Fixes: ac011361bd4f ("af_unix: Add test for sock_diag and UDIAG_SHOW_UID.") Signed-off-by: Willem de Bruijn Link: https://lore.kernel.org/r/20231124171645.1011043-4-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski tools/testing/selftests/net/af_unix/diag_uid.c | 1 - 1 file changed, 1 deletion(-) commit 7b29828c5af6841bdeb9fafa32fdfeff7ab9c407 Author: Willem de Bruijn Date: Fri Nov 24 12:15:20 2023 -0500 selftests/net: fix a char signedness issue Signedness of char is signed on x86_64, but unsigned on arm64. Fix the warning building cmsg_sender.c on signed platforms or forced with -fsigned-char: msg_sender.c:455:12: error: implicit conversion from 'int' to 'char' changes value from 128 to -128 [-Werror,-Wconstant-conversion] buf[0] = ICMPV6_ECHO_REQUEST; constant ICMPV6_ECHO_REQUEST is 128. Link: https://lwn.net/Articles/911914 Fixes: de17e305a810 ("selftests: net: cmsg_sender: support icmp and raw sockets") Signed-off-by: Willem de Bruijn Link: https://lore.kernel.org/r/20231124171645.1011043-3-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski tools/testing/selftests/net/cmsg_sender.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 088559815477c6f623a5db5993491ddd7facbec7 Author: Willem de Bruijn Date: Fri Nov 24 12:15:19 2023 -0500 selftests/net: ipsec: fix constant out of range Fix a small compiler warning. nr_process must be a signed long: it is assigned a signed long by strtol() and is compared against LONG_MIN and LONG_MAX. ipsec.c:2280:65: error: result of comparison of constant -9223372036854775808 with expression of type 'unsigned int' is always false [-Werror,-Wtautological-constant-out-of-range-compare] if ((errno == ERANGE && (nr_process == LONG_MAX || nr_process == LONG_MIN)) Fixes: bc2652b7ae1e ("selftest/net/xfrm: Add test for ipsec tunnel") Signed-off-by: Willem de Bruijn Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com> Link: https://lore.kernel.org/r/20231124171645.1011043-2-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski tools/testing/selftests/net/ipsec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit df60cee26a2e3d937a319229e335cb3f9c1f16d2 Merge: d095b18f3e22 cd80ce7e68f1 Author: Linus Torvalds Date: Mon Nov 27 17:17:23 2023 -0800 Merge tag '6.7-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Memory leak fix - Fix possible deadlock in open - Multiple SMB3 leasing (caching) fixes including: - incorrect open count (found via xfstest generic/002 with leases) - lease breaking incorrect serialization - lease break error handling fix - fix sending async response when lease pending - Async command fix * tag '6.7-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd: ksmbd: don't update ->op_state as OPLOCK_STATE_NONE on error ksmbd: move setting SMB2_FLAGS_ASYNC_COMMAND and AsyncId ksmbd: release interim response after sending status pending response ksmbd: move oplock handling after unlock parent dir ksmbd: separately allocate ci per dentry ksmbd: fix possible deadlock in smb2_open ksmbd: prevent memory leak on error return commit d71f22365a9caca82d424f3a33445de46567e198 Author: Gustavo A. R. Silva Date: Sat Nov 25 15:49:12 2023 -0600 gcc-plugins: randstruct: Update code comment in relayout_struct() Update code comment to clarify that the only element whose layout is not randomized is a proper C99 flexible-array member. This update is complementary to commit 1ee60356c2dc ("gcc-plugins: randstruct: Only warn about true flexible arrays") Signed-off-by: "Gustavo A. R. Silva" Link: https://lore.kernel.org/r/ZWJr2MWDjXLHE8ap@work Fixes: 1ee60356c2dc ("gcc-plugins: randstruct: Only warn about true flexible arrays") Signed-off-by: Kees Cook scripts/gcc-plugins/randomize_layout_plugin.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit d095b18f3e22257ab5fb0d1eae76bf1c0f5260f8 Merge: 2cc14f52aeb7 32138be394e5 Author: Linus Torvalds Date: Mon Nov 27 16:26:10 2023 -0800 Merge tag 'media/v6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab. * tag 'media/v6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: pci: mgb4: add COMMON_CLK dependency media: v4l2-subdev: Fix a 64bit bug media: mgb4: Added support for T200 card variant media: vsp1: Remove unbalanced .s_stream(0) calls commit 4e86f32a13af1970d21be94f659cae56bbe487ee Author: Dmitry Antipov Date: Mon Nov 20 14:05:08 2023 +0300 uapi: propagate __struct_group() attributes to the container union Recently the kernel test robot has reported an ARM-specific BUILD_BUG_ON() in an old and unmaintained wil6210 wireless driver. The problem comes from the structure packing rules of old ARM ABI ('-mabi=apcs-gnu'). For example, the following structure is packed to 18 bytes instead of 16: struct poorly_packed { unsigned int a; unsigned int b; unsigned short c; union { struct { unsigned short d; unsigned int e; } __attribute__((packed)); struct { unsigned short d; unsigned int e; } __attribute__((packed)) inner; }; } __attribute__((packed)); To fit it into 16 bytes, it's required to add packed attribute to the container union as well: struct poorly_packed { unsigned int a; unsigned int b; unsigned short c; union { struct { unsigned short d; unsigned int e; } __attribute__((packed)); struct { unsigned short d; unsigned int e; } __attribute__((packed)) inner; } __attribute__((packed)); } __attribute__((packed)); Thanks to Andrew Pinski of GCC team for sorting the things out at https://gcc.gnu.org/pipermail/gcc/2023-November/242888.html. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311150821.cI4yciFE-lkp@intel.com Signed-off-by: Dmitry Antipov Link: https://lore.kernel.org/r/20231120110607.98956-1-dmantipov@yandex.ru Fixes: 50d7bd38c3aa ("stddef: Introduce struct_group() helper macro") Signed-off-by: Kees Cook include/uapi/linux/stddef.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9099184dec26669bea16ab86e586ad0f90aa7197 Author: ndesaulniers@google.com Date: Fri Nov 17 11:24:02 2023 -0800 MAINTAINERS: refresh LLVM support As discussed at the ClangBuiltLinux '23 meetup (co-located with Linux Plumbers Conf '23), I'll be taking a step back from kernel work to focus on my growing family and helping Google figure out its libc story. So I think it's time to formally hand over the reigns to my co-maintainer Nathan. As such, remove myself from reviewer for: - CLANG CONTROL FLOW INTEGRITY SUPPORT - COMPILER ATTRIBUTES - KERNEL BUILD For CLANG/LLVM BUILD SUPPORT I'm bumping myself down from maintainer to reviewer, adding Bill and Justin, and removing Tom (Tom and I confirmed this via private email; thanks for the work done Tom, ++beers_owed). It has been my pleasure to work with everyone to improve the toolchain portability of the Linux kernel, and to help bring LLVM to the table as a competitor. The work here is not done. I have a few last LLVM patches in the works to improve stack usage of clang which has been our longest standing open issue (getting "rm" inline asm constraints to DTRT is part of that). But looking back I'm incredibly proud of where we are to today relative to where we were when we started the ClangBuiltLinux journey, and am confident that the team and processes we have put in place will continue to be successful. I continue to believe that a rising tide will lift all boats. I identify first and foremost as a Linux kernel developer, and an LLVM dev second. May it be a cold day in hell when that changes. Wake me when you need me. Signed-off-by: Nick Desaulniers Acked-by: Miguel Ojeda Acked-by: Bill Wendling Acked-by: Masahiro Yamada Acked-by: Nathan Chancellor Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20231117-maintainers-v1-1-85f2a7422ed9@google.com Signed-off-by: Kees Cook MAINTAINERS | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit 6f007b1406637d3d73d42e41d7e8d9b245185e69 Author: Jens Axboe Date: Mon Nov 27 17:08:19 2023 -0700 io_uring: don't guard IORING_OFF_PBUF_RING with SETUP_NO_MMAP This flag only applies to the SQ and CQ rings, it's perfectly valid to use a mmap approach for the provided ring buffers. Move the check into where it belongs. Cc: stable@vger.kernel.org Fixes: 03d89a2de25b ("io_uring: support for user allocated memory for rings/sqes") Signed-off-by: Jens Axboe io_uring/io_uring.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 0bad281d0ecdf8391b0f42678b663336e7c3ceb0 Author: Daniel Borkmann Date: Mon Nov 27 21:05:33 2023 +0100 netkit: Reject IFLA_NETKIT_PEER_INFO in netkit_change_link The IFLA_NETKIT_PEER_INFO attribute can only be used during device creation, but not via changelink callback. Hence reject it there. Fixes: 35dfaad7188c ("netkit, bpf: Add bpf programmable net device") Signed-off-by: Daniel Borkmann Acked-by: Nikolay Aleksandrov Cc: Jakub Kicinski Reviewed-by: Jakub Kicinski Link: https://lore.kernel.org/r/e86a277a1e8d3b19890312779e42f790b0605ea4.1701115314.git.daniel@iogearbox.net Signed-off-by: Martin KaFai Lau drivers/net/netkit.c | 6 ++++++ 1 file changed, 6 insertions(+) commit e8d66d02defd3256a31c0ec09af63382b8682c0e Author: Jagadeesh Kona Date: Tue Nov 7 12:15:45 2023 +0530 clk: qcom: Fix SM_CAMCC_8550 dependencies SM_GCC_8550 depends on ARM64 but it is selected by SM_CAMCC_8550, which should have the same dependencies as SM_GCC_8550 to avoid the below Kconfig warning reported by kernel test robot. WARNING: unmet direct dependencies detected for SM_GCC_8550 Depends on [n]: COMMON_CLK [=y] && COMMON_CLK_QCOM [=y] && (ARM64 || COMPILE_TEST [=n]) Selected by [y]: - SM_CAMCC_8550 [=y] && COMMON_CLK [=y] && COMMON_CLK_QCOM [=y] Fixes: ccc4e6a061a2 ("clk: qcom: camcc-sm8550: Add camera clock controller driver for SM8550") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311062309.XugQH7AH-lkp@intel.com/ Signed-off-by: Jagadeesh Kona Link: https://lore.kernel.org/r/20231107064545.13120-1-quic_jkona@quicinc.com Reviewed-by: Dmitry Baryshkov Tested-by: Randy Dunlap Reviewed-by: Randy Dunlap Signed-off-by: Stephen Boyd drivers/clk/qcom/Kconfig | 1 + 1 file changed, 1 insertion(+) commit d8b90d600aff181936457f032d116dbd8534db06 Author: Ewan D. Milne Date: Mon Nov 27 15:56:57 2023 -0500 nvme: check for valid nvme_identify_ns() before using it When scanning namespaces, it is possible to get valid data from the first call to nvme_identify_ns() in nvme_alloc_ns(), but not from the second call in nvme_update_ns_info_block(). In particular, if the NSID becomes inactive between the two commands, a storage device may return a buffer filled with zero as per 4.1.5.1. In this case, we can get a kernel crash due to a divide-by-zero in blk_stack_limits() because ns->lba_shift will be set to zero. PID: 326 TASK: ffff95fec3cd8000 CPU: 29 COMMAND: "kworker/u98:10" #0 [ffffad8f8702f9e0] machine_kexec at ffffffff91c76ec7 #1 [ffffad8f8702fa38] __crash_kexec at ffffffff91dea4fa #2 [ffffad8f8702faf8] crash_kexec at ffffffff91deb788 #3 [ffffad8f8702fb00] oops_end at ffffffff91c2e4bb #4 [ffffad8f8702fb20] do_trap at ffffffff91c2a4ce #5 [ffffad8f8702fb70] do_error_trap at ffffffff91c2a595 #6 [ffffad8f8702fbb0] exc_divide_error at ffffffff928506e6 #7 [ffffad8f8702fbd0] asm_exc_divide_error at ffffffff92a00926 [exception RIP: blk_stack_limits+434] RIP: ffffffff92191872 RSP: ffffad8f8702fc80 RFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff95efa0c91800 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 RBP: 00000000ffffffff R8: ffff95fec7df35a8 R9: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff95fed33c09a8 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #8 [ffffad8f8702fce0] nvme_update_ns_info_block at ffffffffc06d3533 [nvme_core] #9 [ffffad8f8702fd18] nvme_scan_ns at ffffffffc06d6fa7 [nvme_core] This happened when the check for valid data was moved out of nvme_identify_ns() into one of the callers. Fix this by checking in both callers. Link: https://bugzilla.kernel.org/show_bug.cgi?id=218186 Fixes: 0dd6fff2aad4 ("nvme: bring back auto-removal of deleted namespaces during sequential scan") Cc: stable@vger.kernel.org Signed-off-by: Ewan D. Milne Signed-off-by: Keith Busch drivers/nvme/host/core.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit d79972789d17499b6091ded2fc0c6763c501a5ba Author: Luca Ceresoli Date: Thu Nov 23 15:47:18 2023 +0100 of: dynamic: Fix of_reconfig_get_state_change() return value documentation The documented numeric return values do not match the actual returned values. Fix them by using the enum names instead of raw numbers. Fixes: b53a2340d0d3 ("of/reconfig: Add of_reconfig_get_state_change() of notifier helper.") Signed-off-by: Luca Ceresoli Link: https://lore.kernel.org/r/20231123-fix-of_reconfig_get_state_change-docs-v1-1-f51892050ff9@bootlin.com Signed-off-by: Rob Herring drivers/of/dynamic.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 6ba21d02ae99b216b41a689b20edb5329e684b31 Merge: 2cc14f52aeb7 8f96e29aae31 Author: Rafael J. Wysocki Date: Mon Nov 27 21:36:17 2023 +0100 Merge branch 'cpufreq/arm/linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Merge ARM cpufreq fixes for 6.7-rc4 from Viresh Kumar. These fix issues related to power domains in the qcom cpufreq driver and an OPP-related issue in the imx6q cpufreq driver. * 'cpufreq/arm/linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: pmdomain: qcom: rpmpd: Set GENPD_FLAG_ACTIVE_WAKEUP cpufreq: qcom-nvmem: Preserve PM domain votes in system suspend cpufreq: qcom-nvmem: Enable virtual power domain devices cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily commit 172c48caed91a978bca078042222d09baea13717 Author: Hans de Goede Date: Mon Nov 27 15:37:41 2023 +0100 ACPI: video: Use acpi_video_device for cooling-dev driver data The acpi_video code was storing the acpi_video_device as driver_data in the acpi_device children of the acpi_video_bus acpi_device. But the acpi_video driver only binds to the bus acpi_device. It uses, but does not bind to, the children. Since it is not the driver it should not be using the driver_data of the children's acpi_device-s. Since commit 0d16710146a1 ("ACPI: bus: Set driver_data to NULL every time .add() fails") the childen's driver_data ends up getting set to NULL after a driver fails to bind to the children leading to a NULL pointer deref in video_get_max_state when registering the cooling-dev: [ 3.148958] BUG: kernel NULL pointer dereference, address: 0000000000000090 [ 3.149015] Hardware name: Sony Corporation VPCSB2X9R/VAIO, BIOS R2087H4 06/15/2012 [ 3.149021] RIP: 0010:video_get_max_state+0x17/0x30 [video] [ 3.149105] Call Trace: [ 3.149110] [ 3.149114] ? __die+0x23/0x70 [ 3.149126] ? page_fault_oops+0x171/0x4e0 [ 3.149137] ? exc_page_fault+0x7f/0x180 [ 3.149147] ? asm_exc_page_fault+0x26/0x30 [ 3.149158] ? video_get_max_state+0x17/0x30 [video 9b6f3f0d19d7b4a0e2df17a2d8b43bc19c2ed71f] [ 3.149176] ? __pfx_video_get_max_state+0x10/0x10 [video 9b6f3f0d19d7b4a0e2df17a2d8b43bc19c2ed71f] [ 3.149192] __thermal_cooling_device_register.part.0+0xf2/0x2f0 [ 3.149205] acpi_video_bus_register_backlight.part.0.isra.0+0x414/0x570 [video 9b6f3f0d19d7b4a0e2df17a2d8b43bc19c2ed71f] [ 3.149227] acpi_video_register_backlight+0x57/0x80 [video 9b6f3f0d19d7b4a0e2df17a2d8b43bc19c2ed71f] [ 3.149245] intel_acpi_video_register+0x68/0x90 [i915 1f3a758130b32ef13d301d4f8f78c7d766d57f2a] [ 3.149669] intel_display_driver_register+0x28/0x50 [i915 1f3a758130b32ef13d301d4f8f78c7d766d57f2a] [ 3.150064] i915_driver_probe+0x790/0xb90 [i915 1f3a758130b32ef13d301d4f8f78c7d766d57f2a] [ 3.150402] local_pci_probe+0x45/0xa0 [ 3.150412] pci_device_probe+0xc1/0x260 Fix this by directly using the acpi_video_device as devdata for the cooling-device, which avoids the need to set driver-data on the children at all. Fixes: 0d16710146a1 ("ACPI: bus: Set driver_data to NULL every time .add() fails") Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/9718 Cc: 6.6+ # 6.6+ Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki drivers/acpi/acpi_video.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) commit 95ba893c9f4feb836ddce627efd0bb6af6667031 Author: Christian König Date: Tue Nov 14 13:37:09 2023 +0100 dma-buf: fix check in dma_resv_add_fence It's valid to add the same fence multiple times to a dma-resv object and we shouldn't need one extra slot for each. Signed-off-by: Christian König Reviewed-by: Thomas Hellström Fixes: a3f7c10a269d5 ("dma-buf/dma-resv: check if the new fence is really later") Cc: stable@vger.kernel.org # v5.19+ Link: https://patchwork.freedesktop.org/patch/msgid/20231115093035.1889-1-christian.koenig@amd.com drivers/dma-buf/dma-resv.c | 2 +- include/linux/dma-fence.h | 15 +++++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) commit e3139cef8257fcab1725441e2fd5fd0ccb5481b1 Author: Maurizio Lombardi Date: Thu Nov 23 15:07:41 2023 +0100 nvme-core: fix a memory leak in nvme_ns_info_from_identify() In case of error, free the nvme_id_ns structure that was allocated by nvme_identify_ns(). Signed-off-by: Maurizio Lombardi Reviewed-by: Sagi Grimberg Reviewed-by: Kanchan Joshi Signed-off-by: Keith Busch drivers/nvme/host/core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 136cfcb8dce9bc7a17a8d32e497f4dfe80dd357d Author: Mark O'Donovan Date: Fri Nov 24 20:56:59 2023 +0000 nvme: fine-tune sending of first keep-alive Keep-alive commands are sent half-way through the kato period. This normally works well but fails when the keep-alive system is started when we are more than half way through the kato. This can happen on larger setups or due to host delays. With this change we now time the initial keep-alive command from the controller initialisation time, rather than the keep-alive mechanism activation time. Signed-off-by: Mark O'Donovan Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch drivers/nvme/host/core.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit 76cab6f4fd63129e852eb15e14d6d359b57e797f Author: Yi Zhang Date: Mon Nov 27 12:00:26 2023 +0800 ndtest: fix typo class_regster -> class_register Fixes: dd6cad2dcb58 ("testing: nvdimm: make struct class structures constant") Signed-off-by: Yi Zhang Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20231127040026.362729-1-yi.zhang@redhat.com Signed-off-by: Greg Kroah-Hartman tools/testing/nvdimm/test/ndtest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ded965834b156c93dd914b0c6952e8f77929cf84 Author: Michael Walle Date: Thu Nov 23 14:49:27 2023 +0100 dt-bindings: display: mediatek: dsi: remove Xinlei's mail Xinlei Lee's mail is bouncing: : host mailgw02.mediatek.com[216.200.240.185] said: 550 Relaying mail to xinlei.lee@mediatek.com is not allowed (in reply to RCPT TO command) Remove it. Signed-off-by: Michael Walle Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20231123134927.2034024-1-mwalle@kernel.org Signed-off-by: Rob Herring Documentation/devicetree/bindings/display/mediatek/mediatek,dsi.yaml | 1 - 1 file changed, 1 deletion(-) commit 93dc6cd15f207be502739072ad122fa5ac812908 Author: Krzysztof Kozlowski Date: Fri Nov 24 10:50:31 2023 +0100 arm64: dts: rockchip: minor whitespace cleanup around '=' The DTS code coding style expects exactly one space before and after '=' sign. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231124095031.58555-2-krzysztof.kozlowski@linaro.org Signed-off-by: Heiko Stuebner arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts | 2 +- arch/arm64/boot/dts/rockchip/rk3588s-orangepi-5.dts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 076a948f5ad0da8a4438fdb3ec1b4a473084b40a Author: Krzysztof Kozlowski Date: Fri Nov 24 10:50:30 2023 +0100 ARM: dts: rockchip: minor whitespace cleanup around '=' The DTS code coding style expects exactly one space before and after '=' sign. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231124095031.58555-1-krzysztof.kozlowski@linaro.org Signed-off-by: Heiko Stuebner arch/arm/boot/dts/rockchip/rk322x.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit ae2667cd8a479bb5abd6e24c12fcc9ef5bc06d75 Author: Brett Creeley Date: Wed Nov 22 11:25:32 2023 -0800 vfio/pds: Fix possible sleep while in atomic context The driver could possibly sleep while in atomic context resulting in the following call trace while CONFIG_DEBUG_ATOMIC_SLEEP=y is set: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2817, name: bash preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 Call Trace: dump_stack_lvl+0x36/0x50 __might_resched+0x123/0x170 mutex_lock+0x1e/0x50 pds_vfio_put_lm_file+0x1e/0xa0 [pds_vfio_pci] pds_vfio_put_save_file+0x19/0x30 [pds_vfio_pci] pds_vfio_state_mutex_unlock+0x2e/0x80 [pds_vfio_pci] pci_reset_function+0x4b/0x70 reset_store+0x5b/0xa0 kernfs_fop_write_iter+0x137/0x1d0 vfs_write+0x2de/0x410 ksys_write+0x5d/0xd0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 This can happen if pds_vfio_put_restore_file() and/or pds_vfio_put_save_file() grab the mutex_lock(&lm_file->lock) while the spin_lock(&pds_vfio->reset_lock) is held, which can happen during while calling pds_vfio_state_mutex_unlock(). Fix this by changing the reset_lock to reset_mutex so there are no such conerns. Also, make sure to destroy the reset_mutex in the driver specific VFIO device release function. This also fixes a spinlock bad magic BUG that was caused by not calling spinlock_init() on the reset_lock. Since, the lock is being changed to a mutex, make sure to call mutex_init() on it. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/kvm/1f9bc27b-3de9-4891-9687-ba2820c1b390@moroto.mountain/ Fixes: bb500dbe2ac6 ("vfio/pds: Add VFIO live migration support") Signed-off-by: Brett Creeley Reviewed-by: Shannon Nelson Link: https://lore.kernel.org/r/20231122192532.25791-3-brett.creeley@amd.com Signed-off-by: Alex Williamson drivers/vfio/pci/pds/pci_drv.c | 4 ++-- drivers/vfio/pci/pds/vfio_dev.c | 14 ++++++++------ drivers/vfio/pci/pds/vfio_dev.h | 2 +- 3 files changed, 11 insertions(+), 9 deletions(-) commit 91aeb563bd4332e2988f8c0f64f125c4ecb5bcb3 Author: Brett Creeley Date: Wed Nov 22 11:25:31 2023 -0800 vfio/pds: Fix mutex lock->magic != lock warning The following BUG was found when running on a kernel with CONFIG_DEBUG_MUTEXES=y set: DEBUG_LOCKS_WARN_ON(lock->magic != lock) RIP: 0010:mutex_trylock+0x10d/0x120 Call Trace: ? __warn+0x85/0x140 ? mutex_trylock+0x10d/0x120 ? report_bug+0xfc/0x1e0 ? handle_bug+0x3f/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? mutex_trylock+0x10d/0x120 ? mutex_trylock+0x10d/0x120 pds_vfio_reset+0x3a/0x60 [pds_vfio_pci] pci_reset_function+0x4b/0x70 reset_store+0x5b/0xa0 kernfs_fop_write_iter+0x137/0x1d0 vfs_write+0x2de/0x410 ksys_write+0x5d/0xd0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 As shown, lock->magic != lock. This is because mutex_init(&pds_vfio->state_mutex) is called in the VFIO open path. So, if a reset is initiated before the VFIO device is opened the mutex will have never been initialized. Fix this by calling mutex_init(&pds_vfio->state_mutex) in the VFIO init path. Also, don't destroy the mutex on close because the device may be re-opened, which would cause mutex to be uninitialized. Fix this by implementing a driver specific vfio_device_ops.release callback that destroys the mutex before calling vfio_pci_core_release_dev(). Fixes: bb500dbe2ac6 ("vfio/pds: Add VFIO live migration support") Signed-off-by: Brett Creeley Reviewed-by: Shannon Nelson Link: https://lore.kernel.org/r/20231122192532.25791-2-brett.creeley@amd.com Signed-off-by: Alex Williamson drivers/vfio/pci/pds/vfio_dev.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) commit 7b4c93a50a2ebbbaf656cc4fa6aca74a6166d85b Author: Peter Ujfalusi Date: Mon Nov 27 13:16:58 2023 +0200 ALSA: hda: intel-nhlt: Ignore vbps when looking for DMIC 32 bps format When looking up DMIC blob from the NHLT table and the format is 32 bits, ignore the vbps matching for 32 bps for DMIC since some NHLT table have the vbps as 24, some have it as 32. The DMIC hardware supports only one type of 32 bit sample size, which is 24 bit sampling on the MSB side and bits[1:0] is used for indicating the channel number. Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20231127111658.17275-1-peter.ujfalusi@linux.intel.com Signed-off-by: Takashi Iwai sound/hda/intel-nhlt.c | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) commit 1d5e8f4bf06da86b71cc9169110d1a0e1e7af337 Author: Liu Ying Date: Mon Nov 27 13:14:13 2023 +0800 driver core: Export device_is_dependent() to modules Export device_is_dependent() since the drm_kms_helper module is starting to use it. Signed-off-by: Liu Ying Signed-off-by: Linus Walleij Link: https://patchwork.freedesktop.org/patch/msgid/20231127051414.3783108-2-victor.liu@nxp.com drivers/base/core.c | 1 + 1 file changed, 1 insertion(+) commit 820d070feb668aab5bc9413c285a1dda2a70e076 Author: Jens Axboe Date: Fri Nov 24 21:02:01 2023 -0700 io_uring: don't allow discontig pages for IORING_SETUP_NO_MMAP io_sqes_map() is used rather than io_mem_alloc(), if the application passes in memory for mapping rather than have the kernel allocate it and then mmap(2) the ranges. This then calls __io_uaddr_map() to perform the page mapping and pinning, which checks if we end up with the same pages, if more than one page is mapped. But this check is incorrect and only checks if the first and last pages are the same, where it really should be checking if the mapped pages are contigous. This allows mapping a single normal page, or a huge page range. Down the line we can add support for remapping pages to be virtually contigous, which is really all that io_uring cares about. Cc: stable@vger.kernel.org Fixes: 03d89a2de25b ("io_uring: support for user allocated memory for rings/sqes") Reported-by: Jann Horn Signed-off-by: Jens Axboe io_uring/io_uring.c | 39 +++++++++++++++++++++------------------ 1 file changed, 21 insertions(+), 18 deletions(-) commit 0cb19e50a911aaadf49eed120392e429d6e1fa0c Author: Ulf Hansson Date: Mon Nov 27 14:50:33 2023 +0100 pmdomain: arm: Avoid polling for scmi_perf_domain It was a mistake to prefer polling based mode when setting a performance level for a domain. Let's instead rely on the protocol to decide what is best and thus avoid polling when possible. Reported-by: Nikunj Kela Fixes: 2af23ceb8624 ("pmdomain: arm: Add the SCMI performance domain") Signed-off-by: Ulf Hansson Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20231127135033.136442-1-ulf.hansson@linaro.org drivers/pmdomain/arm/scmi_perf_domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ee6236027218f8531916f1c5caa5dc330379f287 Author: Su Hui Date: Mon Nov 20 17:55:26 2023 +0800 misc: mei: client.c: fix problem of return '-EOVERFLOW' in mei_cl_write Clang static analyzer complains that value stored to 'rets' is never read.Let 'buf_len = -EOVERFLOW' to make sure we can return '-EOVERFLOW'. Fixes: 8c8d964ce90f ("mei: move hbuf_depth from the mei device to the hw modules") Signed-off-by: Su Hui Link: https://lore.kernel.org/r/20231120095523.178385-2-suhui@nfschina.com Signed-off-by: Greg Kroah-Hartman drivers/misc/mei/client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8f06aee8089cf42fd99a20184501bd1347ce61b9 Author: Su Hui Date: Mon Nov 20 17:55:23 2023 +0800 misc: mei: client.c: return negative error code in mei_cl_write mei_msg_hdr_init() return negative error code, rets should be 'PTR_ERR(mei_hdr)' rather than '-PTR_ERR(mei_hdr)'. Fixes: 0cd7c01a60f8 ("mei: add support for mei extended header.") Signed-off-by: Su Hui Link: https://lore.kernel.org/r/20231120095523.178385-1-suhui@nfschina.com Signed-off-by: Greg Kroah-Hartman drivers/misc/mei/client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit be6f9a39969a4ad01f0051a9b94af6e7f4d2d7ac Author: Alexander Usyskin Date: Sun Nov 26 11:24:49 2023 +0200 mei: pxp: fix mei_pxp_send_message return value mei_pxp_send_message() should return zero on success and cannot propagate number of bytes as returned by internally called mei_cldev_send(). Fixes: ee5cb39348e6 ("mei: pxp: recover from recv fail under memory pressure") Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20231126092449.88310-1-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman drivers/misc/mei/pxp/mei_pxp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 2a9c713825b3127ece11984abf973672c9779518 Author: Su Hui Date: Mon Nov 20 17:10:47 2023 +0800 phy: sunplus: return negative error code in sp_usb_phy_probe devm_phy_create() return negative error code, 'ret' should be 'PTR_ERR(phy)' rather than '-PTR_ERR(phy)'. Fixes: 99d9ccd97385 ("phy: usb: Add USB2.0 phy driver for Sunplus SP7021") Signed-off-by: Su Hui Link: https://lore.kernel.org/r/20231120091046.163781-1-suhui@nfschina.com Signed-off-by: Vinod Koul drivers/phy/sunplus/phy-sunplus-usb2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 06f76e464ac81c6915430b7155769ea4ef16efe4 Author: Michael Walle Date: Thu Nov 23 12:02:02 2023 +0100 phy: mediatek: mipi: mt8183: fix minimal supported frequency The lowest supported clock frequency of the PHY is 125MHz (see also mtk_mipi_tx_pll_enable()), but the clamping in .round_rate() has the wrong minimal value, which will make the .enable() op return -EINVAL on low frequencies. Fix the minimal clamping value. Fixes: efda51a58b4a ("drm/mediatek: add mipi_tx driver for mt8183") Signed-off-by: Michael Walle Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20231123110202.2025585-1-mwalle@kernel.org Signed-off-by: Vinod Koul drivers/phy/mediatek/phy-mtk-mipi-dsi-mt8183.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ac43c9122e4287bbdbe91e980fc2528acb72cc1e Author: Yaxiong Tian Date: Wed Nov 22 16:02:43 2023 +0800 thunderbolt: Fix memory leak in margining_port_remove() The dentry returned by debugfs_lookup() needs to be released by calling dput() which is missing in margining_port_remove(). Fix this by calling debugfs_lookup_and_remove() that combines both and avoids the memory leak. Fixes: d0f1e0c2a699 ("thunderbolt: Add support for receiver lane margining") Cc: stable@vger.kernel.org Signed-off-by: Yaxiong Tian Signed-off-by: Mika Westerberg drivers/thunderbolt/debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4ded3bfe1db655367642aadba91aee770cbab317 Author: Johannes Berg Date: Fri Nov 24 17:25:29 2023 +0100 wifi: mac80211: use wiphy locked debugfs for sdata/link The debugfs files for netdevs (sdata) and links are removed with the wiphy mutex held, which may deadlock. Use the new wiphy locked debugfs to avoid that. Signed-off-by: Johannes Berg net/mac80211/debugfs_netdev.c | 150 +++++++++++++++++++++++++++++------------- 1 file changed, 105 insertions(+), 45 deletions(-) commit 3d529cd11f2b6c1c3b8e084269152eb30fbb96f5 Author: Johannes Berg Date: Fri Nov 24 17:25:28 2023 +0100 wifi: mac80211: use wiphy locked debugfs helpers for agg_status The read is currently with RCU and the write can deadlock, convert both for the sake of illustration. Make mac80211 depend on cfg80211 debugfs to get the helpers, but mac80211 debugfs without it does nothing anyway. This also required some adjustments in ath9k. Signed-off-by: Johannes Berg drivers/net/wireless/ath/ath9k/Kconfig | 4 +- net/mac80211/Kconfig | 2 +- net/mac80211/debugfs_sta.c | 74 +++++++++++++++++++--------------- 3 files changed, 44 insertions(+), 36 deletions(-) commit b590b9ae1efc30e52f81d95cdb2519a4c248b965 Author: Johannes Berg Date: Fri Nov 24 17:25:27 2023 +0100 wifi: cfg80211: add locked debugfs wrappers Add wrappers for debugfs files that should be called with the wiphy mutex held, while the file is also to be removed under the wiphy mutex. This could otherwise deadlock when a file is trying to acquire the wiphy mutex while the code removing it holds the mutex but waits for the removal. This actually works by pushing the execution of the read or write handler to a wiphy work that can be cancelled using the debugfs cancellation API. Signed-off-by: Johannes Berg include/net/cfg80211.h | 46 ++++++++++++++ net/wireless/debugfs.c | 160 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 206 insertions(+) commit 8c88a474357ead632b07c70bf7f119ace8c3b39e Author: Johannes Berg Date: Fri Nov 24 17:25:26 2023 +0100 debugfs: add API to allow debugfs operations cancellation In some cases there might be longer-running hardware accesses in debugfs files, or attempts to acquire locks, and we want to still be able to quickly remove the files. Introduce a cancellations API to use inside the debugfs handler functions to be able to cancel such operations on a per-file basis. Acked-by: Greg Kroah-Hartman Signed-off-by: Johannes Berg fs/debugfs/file.c | 82 +++++++++++++++++++++++++++++++++++++++++++++++++ fs/debugfs/inode.c | 32 ++++++++++++++++++- fs/debugfs/internal.h | 5 +++ include/linux/debugfs.h | 19 ++++++++++++ 4 files changed, 137 insertions(+), 1 deletion(-) commit f4acfcd4deb158b96595250cc332901b282d15b0 Author: Johannes Berg Date: Fri Nov 24 17:25:25 2023 +0100 debugfs: annotate debugfs handlers vs. removal with lockdep When you take a lock in a debugfs handler but also try to remove the debugfs file under that lock, things can deadlock since the removal has to wait for all users to finish. Add lockdep annotations in debugfs_file_get()/_put() to catch such issues. Acked-by: Greg Kroah-Hartman Signed-off-by: Johannes Berg fs/debugfs/file.c | 10 ++++++++++ fs/debugfs/inode.c | 12 ++++++++++++ fs/debugfs/internal.h | 6 ++++++ 3 files changed, 28 insertions(+) commit 0ed04a1847a10297595ac24dc7d46b35fb35f90a Author: Johannes Berg Date: Fri Nov 24 17:25:24 2023 +0100 debugfs: fix automount d_fsdata usage debugfs_create_automount() stores a function pointer in d_fsdata, but since commit 7c8d469877b1 ("debugfs: add support for more elaborate ->d_fsdata") debugfs_release_dentry() will free it, now conditionally on DEBUGFS_FSDATA_IS_REAL_FOPS_BIT, but that's not set for the function pointer in automount. As a result, removing an automount dentry would attempt to free the function pointer. Luckily, the only user of this (tracing) never removes it. Nevertheless, it's safer if we just handle the fsdata in one way, namely either DEBUGFS_FSDATA_IS_REAL_FOPS_BIT or allocated. Thus, change the automount to allocate it, and use the real_fops in the data to indicate whether or not automount is filled, rather than adding a type tag. At least for now this isn't actually needed, but the next changes will require it. Also check in debugfs_file_get() that it gets only called on regular files, just to make things clearer. Acked-by: Greg Kroah-Hartman Signed-off-by: Johannes Berg fs/debugfs/file.c | 8 ++++++++ fs/debugfs/inode.c | 27 ++++++++++++++++++++------- fs/debugfs/internal.h | 10 ++++++++-- 3 files changed, 36 insertions(+), 9 deletions(-) commit e378c7de74620051c3be899a8c2506c25d23049d Author: Kunwu Chan Date: Wed Nov 22 11:26:08 2023 +0800 iommu/vt-d: Set variable intel_dirty_ops to static Fix the following warning: drivers/iommu/intel/iommu.c:302:30: warning: symbol 'intel_dirty_ops' was not declared. Should it be static? This variable is only used in its defining file, so it should be static. Fixes: f35f22cc760e ("iommu/vt-d: Access/Dirty bit support for SS domains") Signed-off-by: Kunwu Chan Reviewed-by: Jason Gunthorpe Reviewed-by: Joao Martins Link: https://lore.kernel.org/r/20231120101025.1103404-1-chentao@kylinos.cn Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel drivers/iommu/intel/iommu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e7ad6c2a4b1aa710db94060b716f53c812cef565 Author: Lu Baolu Date: Wed Nov 22 11:26:07 2023 +0800 iommu/vt-d: Fix incorrect cache invalidation for mm notification Commit 6bbd42e2df8f ("mmu_notifiers: call invalidate_range() when invalidating TLBs") moved the secondary TLB invalidations into the TLB invalidation functions to ensure that all secondary TLB invalidations happen at the same time as the CPU invalidation and added a flush-all type of secondary TLB invalidation for the batched mode, where a range of [0, -1UL) is used to indicates that the range extends to the end of the address space. However, using an end address of -1UL caused an overflow in the Intel IOMMU driver, where the end address was rounded up to the next page. As a result, both the IOTLB and device ATC were not invalidated correctly. Add a flush all helper function and call it when the invalidation range is from 0 to -1UL, ensuring that the entire caches are invalidated correctly. Fixes: 6bbd42e2df8f ("mmu_notifiers: call invalidate_range() when invalidating TLBs") Cc: stable@vger.kernel.org Cc: Huang Ying Cc: Alistair Popple Tested-by: Luo Yuzhang # QAT Tested-by: Tony Zhu # DSA Reviewed-by: Jason Gunthorpe Reviewed-by: Alistair Popple Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20231117090933.75267-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel drivers/iommu/intel/svm.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) commit 85b80fdffa867d75dfb9084a839e7949e29064e8 Author: Abdul Halim, Mohd Syazwan Date: Wed Nov 22 11:26:06 2023 +0800 iommu/vt-d: Add MTL to quirk list to skip TE disabling The VT-d spec requires (10.4.4 Global Command Register, TE field) that: Hardware implementations supporting DMA draining must drain any in-flight DMA read/write requests queued within the Root-Complex before switching address translation on or off and reflecting the status of the command through the TES field in the Global Status register. Unfortunately, some integrated graphic devices fail to do so after some kind of power state transition. As the result, the system might stuck in iommu_disable_translation(), waiting for the completion of TE transition. Add MTL to the quirk list for those devices and skips TE disabling if the qurik hits. Fixes: b1012ca8dc4f ("iommu/vt-d: Skip TE disabling on quirky gfx dedicated iommu") Cc: stable@vger.kernel.org Signed-off-by: Abdul Halim, Mohd Syazwan Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20231116022324.30120-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel drivers/iommu/intel/iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9a16ab9d640274b20813d2d17475e18d3e99d834 Author: Lu Baolu Date: Wed Nov 22 11:26:05 2023 +0800 iommu/vt-d: Make context clearing consistent with context mapping In the iommu probe_device path, domain_context_mapping() allows setting up the context entry for a non-PCI device. However, in the iommu release_device path, domain_context_clear() only clears context entries for PCI devices. Make domain_context_clear() behave consistently with domain_context_mapping() by clearing context entries for both PCI and non-PCI devices. Fixes: 579305f75d34 ("iommu/vt-d: Update to use PCI DMA aliases") Signed-off-by: Lu Baolu Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20231114011036.70142-4-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel drivers/iommu/intel/iommu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit da37dddcf4caf015c400a930301d2ee27a7a15fb Author: Lu Baolu Date: Wed Nov 22 11:26:04 2023 +0800 iommu/vt-d: Disable PCI ATS in legacy passthrough mode When IOMMU hardware operates in legacy mode, the TT field of the context entry determines the translation type, with three supported types (Section 9.3 Context Entry): - DMA translation without device TLB support - DMA translation with device TLB support - Passthrough mode with translated and translation requests blocked Device TLB support is absent when hardware is configured in passthrough mode. Disable the PCI ATS feature when IOMMU is configured for passthrough translation type in legacy (non-scalable) mode. Fixes: 0faa19a1515f ("iommu/vt-d: Decouple PASID & PRI enabling from SVA") Signed-off-by: Lu Baolu Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20231114011036.70142-3-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel drivers/iommu/intel/iommu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 0f5432a9b839847dcfe9fa369d72e3d646102ddf Author: Lu Baolu Date: Wed Nov 22 11:26:03 2023 +0800 iommu/vt-d: Omit devTLB invalidation requests when TES=0 The latest VT-d spec indicates that when remapping hardware is disabled (TES=0 in Global Status Register), upstream ATS Invalidation Completion requests are treated as UR (Unsupported Request). Consequently, the spec recommends in section 4.3 Handling of Device-TLB Invalidations that software refrain from submitting any Device-TLB invalidation requests when address remapping hardware is disabled. Verify address remapping hardware is enabled prior to submitting Device- TLB invalidation requests. Fixes: 792fb43ce2c9 ("iommu/vt-d: Enable Intel IOMMU scalable mode by default") Signed-off-by: Lu Baolu Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20231114011036.70142-2-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel drivers/iommu/intel/dmar.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) commit e645c20e8e9cde549bc233435d3c1338e1cd27fe Author: Lu Baolu Date: Wed Nov 22 11:26:02 2023 +0800 iommu/vt-d: Support enforce_cache_coherency only for empty domains The enforce_cache_coherency callback ensures DMA cache coherency for devices attached to the domain. Intel IOMMU supports enforced DMA cache coherency when the Snoop Control bit in the IOMMU's extended capability register is set. Supporting it differs between legacy and scalable modes. In legacy mode, it's supported page-level by setting the SNP field in second-stage page-table entries. In scalable mode, it's supported in PASID-table granularity by setting the PGSNP field in PASID-table entries. In legacy mode, mappings before attaching to a device have SNP fields cleared, while mappings after the callback have them set. This means partial DMAs are cache coherent while others are not. One possible fix is replaying mappings and flipping SNP bits when attaching a domain to a device. But this seems to be over-engineered, given that all real use cases just attach an empty domain to a device. To meet practical needs while reducing mode differences, only support enforce_cache_coherency on a domain without mappings if SNP field is used. Fixes: fc0051cb9590 ("iommu/vt-d: Check domain force_snooping against attached devices") Signed-off-by: Lu Baolu Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20231114011036.70142-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel drivers/iommu/intel/iommu.c | 5 ++++- drivers/iommu/intel/iommu.h | 3 +++ 2 files changed, 7 insertions(+), 1 deletion(-) commit 487635756198cad563feb47539c6a37ea57f1dae Author: Helge Deller Date: Mon Nov 27 10:39:26 2023 +0100 parisc: Fix asm operand number out of range build error in bug table Build is broken if CONFIG_DEBUG_BUGVERBOSE=n. Fix it be using the correct asm operand number. Signed-off-by: Helge Deller Reported-by: Linux Kernel Functional Testing Fixes: fe76a1349f23 ("parisc: Use natural CPU alignment for bug_table") Cc: stable@vger.kernel.org # v6.0+ arch/parisc/include/asm/bug.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a2e7e59a94269484a83386972ca07c22fd188854 Author: Robin Murphy Date: Wed Nov 15 18:25:44 2023 +0000 iommu: Avoid more races around device probe It turns out there are more subtle races beyond just the main part of __iommu_probe_device() itself running in parallel - the dev_iommu_free() on the way out of an unsuccessful probe can still manage to trip up concurrent accesses to a device's fwspec. Thus, extend the scope of iommu_probe_device_lock() to also serialise fwspec creation and initial retrieval. Reported-by: Zhenhua Huang Link: https://lore.kernel.org/linux-iommu/e2e20e1c-6450-4ac5-9804-b0000acdf7de@quicinc.com/ Fixes: 01657bc14a39 ("iommu: Avoid races around device probe") Signed-off-by: Robin Murphy Acked-by: Greg Kroah-Hartman Reviewed-by: André Draszik Tested-by: André Draszik Link: https://lore.kernel.org/r/16f433658661d7cadfea51e7c65da95826112a2b.1700071477.git.robin.murphy@arm.com Cc: stable@vger.kernel.org Signed-off-by: Joerg Roedel drivers/acpi/scan.c | 7 ++++++- drivers/iommu/iommu.c | 20 ++++++++++---------- drivers/iommu/of_iommu.c | 12 +++++++++--- include/linux/iommu.h | 1 + 4 files changed, 26 insertions(+), 14 deletions(-) commit a99583e2aff64baf27b04b7d3a0341a52bf8e047 Author: Dmitry Baryshkov Date: Sat Nov 4 00:54:13 2023 +0200 MAINTAINERS: list all Qualcomm IOMMU drivers in the QUALCOMM IOMMU entry For historical reasons the 'QUALCOMM IOMMU' entry lists only one Qualcomm IOMMU driver. However there are also the historical MSM IOMMU driver, which is used for old 32-bit platforms, and the Qualcomm-specific customisations for the generic ARM SMMU driver. List all these files under the QUALCOMM IOMMU entry. Signed-off-by: Dmitry Baryshkov Acked-by: Will Deacon Acked-by: Konrad Dybcio Link: https://lore.kernel.org/r/20231103225413.1479857-1-dmitry.baryshkov@linaro.org Signed-off-by: Joerg Roedel MAINTAINERS | 2 ++ 1 file changed, 2 insertions(+) commit 34e2dccbb30baf7e5502bae382722aacbbfddc5b Author: Jason Gunthorpe Date: Wed Nov 1 20:28:11 2023 -0300 iommu: Flow ERR_PTR out from __iommu_domain_alloc() Most of the calling code now has error handling that can carry an error code further up the call chain. Keep the exported interface iommu_domain_alloc() returning NULL and reflow the internal code to use ERR_PTR not NULL for domain allocation failure. Optionally allow drivers to return ERR_PTR from any of the alloc ops. Many of the new ops (user, sva, etc) already return ERR_PTR, so having two rules is confusing and hard on drivers. This fixes a bug in DART that was returning ERR_PTR. Fixes: 482feb5c6492 ("iommu/dart: Call apple_dart_finalize_domain() as part of alloc_paging()") Reported-by: Dan Carpenter Link: https://lore.kernel.org/linux-iommu/b85e0715-3224-4f45-ad6b-ebb9f08c015d@moroto.mountain/ Signed-off-by: Jason Gunthorpe Reviewed-by: Jerry Snitselaar Link: https://lore.kernel.org/r/0-v2-55ae413017b8+97-domain_alloc_err_ptr_jgg@nvidia.com Signed-off-by: Joerg Roedel drivers/iommu/iommu.c | 59 ++++++++++++++++++++++++++++++++++----------------- 1 file changed, 39 insertions(+), 20 deletions(-) commit 2cc14f52aeb78ce3f29677c2de1f06c0e91471ab Author: Linus Torvalds Date: Sun Nov 26 19:59:33 2023 -0800 Linux 6.7-rc3 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5b2b1173a93fa056b4539ef52e5f03148345d498 Merge: d2da77f431ac 76d9eafff448 Author: Linus Torvalds Date: Sun Nov 26 19:48:20 2023 -0800 Merge tag 'trace-v6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt:: "Eventfs fixes: - With the usage of simple_recursive_remove() recommended by Al Viro, the code should not be calling "d_invalidate()" itself. Doing so is causing crashes. The code was calling d_invalidate() on the race of trying to look up a file while the parent was being deleted. This was detected, and the added dentry was having d_invalidate() called on it, but the deletion of the directory was also calling d_invalidate() on that same dentry. - A fix to not free the eventfs_inode (ei) until the last dput() was called on its ei->dentry made the ei->dentry exist even after it was marked for free by setting the ei->is_freed. But code elsewhere still was checking if ei->dentry was NULL if ei->is_freed is set and would trigger WARN_ON if that was the case. That's no longer true and there should not be any warnings when it is true. - Use GFP_NOFS for allocations done under eventfs_mutex. The eventfs_mutex can be taken on file system reclaim, make sure that allocations done under that mutex do not trigger file system reclaim. - Clean up code by moving the taking of inode_lock out of the helper functions and into where they are needed, and not use the parameter to know to take it or not. It must always be held but some callers of the helper function have it taken when they were called. - Warn if the inode_lock is not held in the helper functions. - Warn if eventfs_start_creating() is called without a parent. As eventfs is underneath tracefs, all files created will have a parent (the top one will have a tracefs parent). Tracing update: - Add Mathieu Desnoyers as an official reviewer of the tracing subsystem" * tag 'trace-v6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: MAINTAINERS: TRACING: Add Mathieu Desnoyers as Reviewer eventfs: Make sure that parent->d_inode is locked in creating files/dirs eventfs: Do not allow NULL parent to eventfs_start_creating() eventfs: Move taking of inode_lock into dcache_dir_open_wrapper() eventfs: Use GFP_NOFS for allocation when eventfs_mutex is held eventfs: Do not invalidate dentry in create_file/dir_dentry() eventfs: Remove expectation that ei->is_freed means ei->dentry == NULL commit 6552218f4dc47ba3c6c5b58cc1e9eb208a2b438b Author: Stefan Kerkmann Date: Wed Nov 1 12:03:37 2023 +0100 ARM: dts: imx6q: skov: fix ethernet clock regression A regression was introduced in the Skov specific i.MX6 flavor reve-mi1010ait-1cp1 device tree causing the external ethernet controller to not being selected as the clock source for the i.MX6 ethernet MAC, resulting in a none functional ethernet interface. The root cause is that the ethernet clock selection is now part of the clocks node, which is overwritten in the specific device tree and wasn't updated to contain these ethernet clocks. Fixes: c89614079e44 ("ARM: dts: imx6qdl-skov-cpu: configure ethernet reference clock parent") Signed-off-by: Stefan Kerkmann Signed-off-by: Shawn Guo arch/arm/boot/dts/nxp/imx/imx6q-skov-reve-mi1010ait-1cp1.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 2bfba37b3d90d6d2d499d5b0dfe99c05c38b1b54 Author: Alexander Stein Date: Thu Oct 19 08:32:17 2023 +0200 arm64: dt: imx93: tqma9352-mba93xxla: Fix LPUART2 pad config LPUART2_RTS# has an external pull-down, so do not enable the internal pull-up at the same time, use a pull-down instead. Fixes: c982ecfa7992a ("arm64: dts: freescale: add initial device tree for MBa93xxLA SBC board") Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 75a442581d05edaee168222ffbe00d4389785636 Author: Hou Tao Date: Sat Nov 11 12:38:21 2023 +0800 bpf: Add missed allocation hint for bpf_mem_cache_alloc_flags() bpf_mem_cache_alloc_flags() may call __alloc() directly when there is no free object in free list, but it doesn't initialize the allocation hint for the returned pointer. It may lead to bad memory dereference when freeing the pointer, so fix it by initializing the allocation hint. Fixes: 822fb26bdb55 ("bpf: Add a hint to allocated objects.") Signed-off-by: Hou Tao Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20231111043821.2258513-1-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov kernel/bpf/memalloc.c | 2 ++ 1 file changed, 2 insertions(+) commit d2da77f431ac49b5763b88751a75f70daa46296c Merge: 4892711acee0 43266838515d Author: Linus Torvalds Date: Sun Nov 26 09:59:39 2023 -0800 Merge tag 'parisc-for-6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture fixes from Helge Deller: "This patchset fixes and enforces correct section alignments for the ex_table, altinstructions, parisc_unwind, jump_table and bug_table which are created by inline assembly. Due to not being correctly aligned at link & load time they can trigger unnecessarily the kernel unaligned exception handler at runtime. While at it, I switched the bug table to use relative addresses which reduces the size of the table by half on 64-bit. We still had the ENOSYM and EREMOTERELEASE errno symbols as left-overs from HP-UX, which now trigger build-issues with glibc. We can simply remove them. Most of the patches are tagged for stable kernel series. Summary: - Drop HP-UX ENOSYM and EREMOTERELEASE return codes to avoid glibc build issues - Fix section alignments for ex_table, altinstructions, parisc unwind table, jump_table and bug_table - Reduce size of bug_table on 64-bit kernel by using relative pointers" * tag 'parisc-for-6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Reduce size of the bug_table on 64-bit kernel by half parisc: Drop the HP-UX ENOSYM and EREMOTERELEASE error codes parisc: Use natural CPU alignment for bug_table parisc: Ensure 32-bit alignment on parisc unwind section parisc: Mark lock_aligned variables 16-byte aligned on SMP parisc: Mark jump_table naturally aligned parisc: Mark altinstructions read-only and 32-bit aligned parisc: Mark ex_table entries 32-bit aligned in uaccess.h parisc: Mark ex_table entries 32-bit aligned in assembly.h commit bce61476dc82f114e24e9c2e11fb064781ec563c Author: David Lechner Date: Tue Oct 31 16:05:19 2023 -0500 iio: triggered-buffer: prevent possible freeing of wrong buffer Commit ee708e6baacd ("iio: buffer: introduce support for attaching more IIO buffers") introduced support for multiple buffers per indio_dev but left indio_dev->buffer for a few legacy use cases. In the case of the triggered buffer, iio_triggered_buffer_cleanup() still assumes that indio_dev->buffer points to the buffer allocated by iio_triggered_buffer_setup_ext(). However, since iio_triggered_buffer_setup_ext() now calls iio_device_attach_buffer() to attach the buffer, indio_dev->buffer will only point to the buffer allocated by iio_device_attach_buffer() if it the first buffer attached. This adds a check to make sure that no other buffer has been attached yet to ensure that indio_dev->buffer will be assigned when iio_device_attach_buffer() is called. As per discussion in the review thread, we may want to deal with multiple triggers per device, but this is a fix for the issue in the meantime and any such support would be unlikely to be suitable for a backport. Fixes: ee708e6baacd ("iio: buffer: introduce support for attaching more IIO buffers") Signed-off-by: David Lechner Acked-by: Nuno Sa Link: https://lore.kernel.org/r/20231031210521.1661552-1-dlechner@baylibre.com Cc: Signed-off-by: Jonathan Cameron drivers/iio/buffer/industrialio-triggered-buffer.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit c3df0e29fb7788c4b3ddf37d5ed87dda2b822943 Author: Su Hui Date: Mon Oct 30 10:02:19 2023 +0800 iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw inv_mpu6050_sensor_show() can return -EINVAL or IIO_VAL_INT. Return the true value rather than only return IIO_VAL_INT. Fixes: d5098447147c ("iio: imu: mpu6050: add calibration offset support") Signed-off-by: Su Hui Link: https://lore.kernel.org/r/20231030020218.65728-1-suhui@nfschina.com Signed-off-by: Jonathan Cameron drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1cd2fe4fd63e54b799a68c0856bda18f2e40caa8 Author: Nuno Sa Date: Mon Nov 6 16:07:30 2023 +0100 iio: imu: adis16475: use bit numbers in assign_bit() assign_bit() expects a bit number and not a mask like BIT(x). Hence, just remove the BIT() macro from the #defines. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202311060647.i9XyO4ej-lkp@intel.com/ Fixes: fff7352bf7a3ce ("iio: imu: Add support for adis16475") Signed-off-by: Nuno Sa Link: https://lore.kernel.org/r/20231106150730.945-1-nuno.sa@analog.com Cc: Signed-off-by: Jonathan Cameron drivers/iio/imu/adis16475.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4892711acee0915a8a4ae02e1af3dc70ce000024 Merge: e81fe505202f 080990aa3344 Author: Linus Torvalds Date: Sun Nov 26 08:42:42 2023 -0800 Merge tag 'x86-urgent-2023-11-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 microcode fixes from Ingo Molnar: "Fix/enhance x86 microcode version reporting: fix the bootup log spam, and remove the driver version announcement to avoid version confusion when distros backport fixes" * tag 'x86-urgent-2023-11-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode: Rework early revisions reporting x86/microcode: Remove the driver announcement and version commit ee4d79055aeea27f1b8c42233cc0c90d0a8b5355 Author: Nuno Sa Date: Thu Nov 2 13:52:58 2023 +0100 iio: imu: adis16475: add spi_device_id table This prevents the warning message "SPI driver has no spi_device_id for..." when registering the driver. More importantly, it makes sure that module autoloading works as spi relies on spi: modaliases and not of. While at it, move the of_device_id table to it's natural place. Fixes: fff7352bf7a3c ("iio: imu: Add support for adis16475") Signed-off-by: Nuno Sa Link: https://lore.kernel.org/r/20231102125258.3284830-1-nuno.sa@analog.com Cc: Signed-off-by: Jonathan Cameron drivers/iio/imu/adis16475.c | 117 +++++++++++++++++++++++++++----------------- 1 file changed, 72 insertions(+), 45 deletions(-) commit e81fe505202fdc07b1925aa70fca5e2a714eb259 Merge: 1d0dbc3d16e8 e8df9d9f4209 Author: Linus Torvalds Date: Sun Nov 26 08:34:12 2023 -0800 Merge tag 'perf-urgent-2023-11-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 perf event fix from Ingo Molnar: "Fix a bug in the Intel hybrid CPUs hardware-capabilities enumeration code resulting in non-working events on those platforms" * tag 'perf-urgent-2023-11-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel: Correct incorrect 'or' operation for PMU capabilities commit 1d0dbc3d16e8215838d9898d0191e8c0d2cc77af Merge: 4515866db134 bca4104b00fe Author: Linus Torvalds Date: Sun Nov 26 08:30:11 2023 -0800 Merge tag 'locking-urgent-2023-11-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Ingo Molnar: "Fix lockdep block chain corruption resulting in KASAN warnings" * tag 'locking-urgent-2023-11-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: lockdep: Fix block chain corruption commit 4515866db1346d0b3d7c53214c60ff5373e39bb7 Merge: 090472ed9c92 b0348e459c83 Author: Linus Torvalds Date: Sun Nov 26 08:22:27 2023 -0800 Merge tag '6.7-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - use after free fix in releasing multichannel interfaces - fixes for special file types (report char, block, FIFOs properly when created e.g. by NFS to Windows) - fixes for reporting various special file types and symlinks properly when using SMB1 * tag '6.7-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: introduce cifs_sfu_make_node() smb: client: set correct file type from NFS reparse points smb: client: introduce ->parse_reparse_point() smb: client: implement ->query_reparse_point() for SMB1 cifs: fix use after free for iface while disabling secondary channels commit ccf49cebe595e081761f9973f5cabf1afc8b0f23 Merge: a524eabcd72d beb1930f966d Author: David S. Miller Date: Sun Nov 26 15:18:57 2023 +0000 Merge branch 'dpaa2-eth-fixes' Ioana Ciornei says: ==================== dpaa2-eth: various fixes The first patch fixes a memory corruption issue happening between the Tx and Tx confirmation of a packet by making the Tx alignment at 64bytes mandatory instead of optional as it was previously. The second patch fixes the Rx copybreak code path which recycled the initial data buffer before all processing was done on the packet. Changes in v2: - squashed patches #1 and #2 ==================== Signed-off-by: David S. Miller commit beb1930f966d1517921488bd5d64147f58f79abf Author: Ioana Ciornei Date: Fri Nov 24 12:28:05 2023 +0200 dpaa2-eth: recycle the RX buffer only after all processing done The blamed commit added support for Rx copybreak. This meant that for certain frame sizes, a new skb was allocated and the initial data buffer was recycled. Instead of waiting to recycle the Rx buffer only after all processing was done on it (like accessing the parse results or timestamp information), the code path just went ahead and re-used the buffer right away. This sometimes lead to corrupted HW and SW annotation areas. Fix this by delaying the moment when the buffer is recycled. Fixes: 50f826999a80 ("dpaa2-eth: add rx copybreak support") Signed-off-by: Ioana Ciornei Signed-off-by: David S. Miller drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit f422abe3f23d483cf01f386819f26fb3fe0dbb2b Author: Ioana Ciornei Date: Fri Nov 24 12:28:04 2023 +0200 dpaa2-eth: increase the needed headroom to account for alignment Increase the needed headroom to account for a 64 byte alignment restriction which, with this patch, we make mandatory on the Tx path. The case in which the amount of headroom needed is not available is already handled by the driver which instead sends a S/G frame with the first buffer only holding the SW and HW annotation areas. Without this patch, we can empirically see data corruption happening between Tx and Tx confirmation which sometimes leads to the SW annotation area being overwritten. Since this is an old IP where the hardware team cannot help to understand the underlying behavior, we make the Tx alignment mandatory for all frames to avoid the crash on Tx conf. Also, remove the comment that suggested that this is just an optimization. This patch also sets the needed_headroom net device field to the usual value that the driver would need on the Tx path: - 64 bytes for the software annotation area - 64 bytes to account for a 64 byte aligned buffer address Fixes: 6e2387e8f19e ("staging: fsl-dpaa2/eth: Add Freescale DPAA2 Ethernet driver") Closes: https://lore.kernel.org/netdev/aa784d0c-85eb-4e5d-968b-c8f74fa86be6@gin.de/ Signed-off-by: Ioana Ciornei Signed-off-by: David S. Miller drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 8 ++++---- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) commit 79997eda0d31bc68203c95ecb978773ee6ce7a1f Author: Conor Dooley Date: Sun Nov 26 11:40:54 2023 +0000 riscv: dts: microchip: move timebase-frequency to mpfs.dtsi The timebase-frequency on PolarFire SoC is not set by an oscillator on the board, but rather by an internal divider, so move the property to mpfs.dtsi. This looks to be copy-pasta from the SiFive Unleashed as the comments in both places were almost identical. In the Unleashed's case this looks to actually be valid, as the clock is provided by a crystal on the PCB. Signed-off-by: Conor Dooley --- CC: Conor Dooley CC: Daire McNamara CC: Rob Herring CC: Krzysztof Kozlowski CC: Paul Walmsley CC: Palmer Dabbelt CC: linux-riscv@lists.infradead.org CC: devicetree@vger.kernel.org arch/riscv/boot/dts/microchip/mpfs-icicle-kit.dts | 7 ------- arch/riscv/boot/dts/microchip/mpfs-m100pfsevp.dts | 7 ------- arch/riscv/boot/dts/microchip/mpfs-polarberry.dts | 7 ------- arch/riscv/boot/dts/microchip/mpfs-sev-kit.dts | 7 ------- arch/riscv/boot/dts/microchip/mpfs-tysom-m.dts | 7 ------- arch/riscv/boot/dts/microchip/mpfs.dtsi | 1 + 6 files changed, 1 insertion(+), 35 deletions(-) commit a524eabcd72d28425d9db242cf375d0389d74eba Author: Greg Ungerer Date: Fri Nov 24 14:15:29 2023 +1000 net: dsa: mv88e6xxx: fix marvell 6350 probe crash As of commit b92143d4420f ("net: dsa: mv88e6xxx: add infrastructure for phylink_pcs") probing of a Marvell 88e6350 switch causes a NULL pointer de-reference like this example: ... mv88e6085 d0072004.mdio-mii:11: switch 0x3710 detected: Marvell 88E6350, revision 2 8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read [00000000] *pgd=00000000 Internal error: Oops: 5 [#1] ARM Modules linked in: CPU: 0 PID: 8 Comm: kworker/u2:0 Not tainted 6.7.0-rc2-dirty #26 Hardware name: Marvell Armada 370/XP (Device Tree) Workqueue: events_unbound deferred_probe_work_func PC is at mv88e6xxx_port_setup+0x1c/0x44 LR is at dsa_port_devlink_setup+0x74/0x154 pc : [] lr : [] psr: a0000013 sp : c184fce0 ip : c542b8f4 fp : 00000000 r10: 00000001 r9 : c542a540 r8 : c542bc00 r7 : c542b838 r6 : c5244580 r5 : 00000005 r4 : c5244580 r3 : 00000000 r2 : c542b840 r1 : 00000005 r0 : c1a02040 ... The Marvell 6350 switch has no SERDES interface and so has no corresponding pcs_ops defined for it. But during probing a call is made to mv88e6xxx_port_setup() which unconditionally expects pcs_ops to exist - though the presence of the pcs_ops->pcs_init function is optional. Modify code to check for pcs_ops first, before checking for and calling pcs_ops->pcs_init. Modify checking and use of pcs_ops->pcs_teardown which may potentially suffer the same problem. Fixes: b92143d4420f ("net: dsa: mv88e6xxx: add infrastructure for phylink_pcs") Signed-off-by: Greg Ungerer Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit b3f1a164c7f742503dc7159011f7ad6b092b660e Author: Greg Ungerer Date: Fri Nov 24 14:15:28 2023 +1000 net: dsa: mv88e6xxx: fix marvell 6350 switch probing As of commit de5c9bf40c45 ("net: phylink: require supported_interfaces to be filled") Marvell 88e6350 switches fail to be probed: ... mv88e6085 d0072004.mdio-mii:11: switch 0x3710 detected: Marvell 88E6350, revision 2 mv88e6085 d0072004.mdio-mii:11: phylink: error: empty supported_interfaces error creating PHYLINK: -22 mv88e6085: probe of d0072004.mdio-mii:11 failed with error -22 ... The problem stems from the use of mv88e6185_phylink_get_caps() to get the device capabilities. Create a new dedicated phylink_get_caps for the 6351 family (which the 6350 is one of) to properly support their set of capabilities. According to chip.h the 6351 switch family includes the 6171, 6175, 6350 and 6351 switches, so update each of these to use the correct phylink_get_caps. Fixes: de5c9bf40c45 ("net: phylink: require supported_interfaces to be filled") Signed-off-by: Greg Ungerer Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) commit 3f3ae1250e739fb446639efad0ba916ba0a012f0 Author: Kent Overstreet Date: Sat Nov 25 12:16:22 2023 -0500 bcachefs: bpos is misaligned on big endian bkey embeds a bpos that is misaligned on big endian; this is so that bch2_bkey_swab() works correctly without having to differentiate between packed and non-packed keys (a debatable design decision). This means it can't have the __aligned() tag on big endian. Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs_format.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit e4f72bb46a774b449ffe864fa6fffa7ecbf8f3f7 Author: Kent Overstreet Date: Fri Nov 24 21:52:06 2023 -0500 bcachefs: Fix ec + durability calculation Durability of an erasure coded pointer doesn't add the device durability; durability is the same for any extent in that stripe so the calculation only comes from the stripe. Signed-off-by: Kent Overstreet fs/bcachefs/extents.c | 30 ++++++++++++------------------ 1 file changed, 12 insertions(+), 18 deletions(-) commit 7d9f8468ff7589073981b3eb8b175945c7dcd13c Author: Kent Overstreet Date: Fri Nov 24 21:51:45 2023 -0500 bcachefs: Data update path won't accidentaly grow replicas Previously, there was a bug where if an extent had greater durability than required (because we needed to move a durability=1 pointer and ended up putting it on a durability 2 device), we would submit a write for replicas=2 - the durability of the pointer being rewritten - instead of the number of replicas required to bring it back up to the data_replicas option. This, plus the allocation path sometimes allocating on a greater durability device than requested, meant that extents could continue having more and more replicas added as they were being rewritten. Signed-off-by: Kent Overstreet fs/bcachefs/data_update.c | 92 +++++++++++++++++++++++++++++++++++++++++------ fs/bcachefs/data_update.h | 9 +++-- fs/bcachefs/errcode.h | 2 +- fs/bcachefs/io_read.c | 2 +- fs/bcachefs/move.c | 58 +++--------------------------- 5 files changed, 96 insertions(+), 67 deletions(-) commit 936e4d49ecbc8c404790504386e1422b599dec39 Author: Hans de Goede Date: Fri Nov 24 19:59:24 2023 -0800 Input: atkbd - skip ATKBD_CMD_GETID in translated mode There have been multiple reports of keyboard issues on recent laptop models which can be worked around by setting i8042.dumbkbd, with the downside being this breaks the capslock LED. It seems that these issues are caused by recent laptops getting confused by ATKBD_CMD_GETID. Rather then adding and endless growing list of quirks for this, just skip ATKBD_CMD_GETID alltogether on laptops in translated mode. The main goal of sending ATKBD_CMD_GETID is to skip binding to ps/2 mice/touchpads and those are never used in translated mode. Examples of laptop models which benefit from skipping ATKBD_CMD_GETID: * "HP Laptop 15s-fq2xxx", "HP laptop 15s-fq4xxx" and "HP Laptop 15-dy2xxx" models the kbd stops working for the first 2 - 5 minutes after boot (waiting for EC watchdog reset?) * On "HP Spectre x360 13-aw2xxx" atkbd fails to probe the keyboard * At least 9 different Lenovo models have issues with ATKBD_CMD_GETID, see: https://github.com/yescallop/atkbd-nogetid This has been tested on: 1. A MSI B550M PRO-VDH WIFI desktop, where the i8042 controller is not in translated mode when no keyboard is plugged in and with a ps/2 kbd a "AT Translated Set 2 keyboard" /dev/input/event# node shows up 2. A Lenovo ThinkPad X1 Yoga gen 8 (always has a translated set 2 keyboard) Reported-by: Shang Ye Closes: https://lore.kernel.org/linux-input/886D6167733841AE+20231017135318.11142-1-yesh25@mail2.sysu.edu.cn/ Closes: https://github.com/yescallop/atkbd-nogetid Reported-by: gurevitch Closes: https://lore.kernel.org/linux-input/2iAJTwqZV6lQs26cTb38RNYqxvsink6SRmrZ5h0cBUSuf9NT0tZTsf9fEAbbto2maavHJEOP8GA1evlKa6xjKOsaskDhtJWxjcnrgPigzVo=@gurevit.ch/ Reported-by: Egor Ignatov Closes: https://lore.kernel.org/all/20210609073333.8425-1-egori@altlinux.org/ Reported-by: Anton Zhilyaev Closes: https://lore.kernel.org/linux-input/20210201160336.16008-1-anton@cpp.in/ Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2086156 Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20231115174625.7462-1-hdegoede@redhat.com Signed-off-by: Dmitry Torokhov drivers/input/keyboard/atkbd.c | 46 ++++++++++++++++++++++++++++++++++++++---- 1 file changed, 42 insertions(+), 4 deletions(-) commit 090472ed9c922e699dc61dd601a9b376a64f4390 Merge: b46ae77f6787 cb9a830e8717 Author: Linus Torvalds Date: Sat Nov 25 18:22:42 2023 -0800 Merge tag 'usb-6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / PHY / Thunderbolt fixes from Greg KH: "Here are a number of reverts, fixes, and new device ids for 6.7-rc3 for the USB, PHY, and Thunderbolt driver subsystems. Include in here are: - reverts of some PHY drivers that went into 6.7-rc1 that shouldn't have been merged yet, the author is reworking them based on review comments as they were using older apis that shouldn't be used anymore for newer drivers - small thunderbolt driver fixes for reported issues - USB driver fixes for a variety of small issues in dwc3, typec, xhci, and other smaller drivers. - new device ids for usb-serial and onboard_usb_hub drivers. All of these have been in linux-next with no reported issues" * tag 'usb-6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (33 commits) USB: serial: option: add Luat Air72*U series products USB: dwc3: qcom: fix ACPI platform device leak USB: dwc3: qcom: fix software node leak on probe errors USB: dwc3: qcom: fix resource leaks on probe deferral USB: dwc3: qcom: simplify wakeup interrupt setup USB: dwc3: qcom: fix wakeup after probe deferral dt-bindings: usb: qcom,dwc3: fix example wakeup interrupt types usb: misc: onboard-hub: add support for Microchip USB5744 dt-bindings: usb: microchip,usb5744: Add second supply usb: misc: ljca: Fix enumeration error on Dell Latitude 9420 USB: serial: option: add Fibocom L7xx modules USB: xhci-plat: fix legacy PHY double init usb: typec: tipd: Supply also I2C driver data usb: xhci-mtk: fix in-ep's start-split check failure usb: dwc3: set the dma max_seg_size usb: config: fix iteration issue in 'usb_get_bos_descriptor()' usb: dwc3: add missing of_node_put and platform_device_put USB: dwc2: write HCINT with INTMASK applied usb: misc: ljca: Drop _ADR support to get ljca children devices usb: cdnsp: Fix deadlock issue during using NCM gadget ... commit fe4c5f662097978b6c91c23a13c24ed92339a180 Author: Jason-JH.Lin Date: Wed Sep 20 17:06:58 2023 +0800 drm/mediatek: Add spinlock for setting vblank event in atomic_begin Add spinlock protection to avoid race condition on vblank event between mtk_drm_crtc_atomic_begin() and mtk_drm_finish_page_flip(). Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") Signed-off-by: Jason-JH.Lin Suggested-by: AngeloGioacchino Del Regno Reviewed-by: Alexandre Mergnat Reviewed-by: Fei Shao Tested-by: Fei Shao Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20230920090658.31181-1-jason-jh.lin@mediatek.com/ Signed-off-by: Chun-Kuang Hu drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 5 +++++ 1 file changed, 5 insertions(+) commit b46ae77f67874918c540feb1e37a63308b2c9290 Merge: 2821c393d4fd 9c235dfc3d3f Author: Linus Torvalds Date: Sat Nov 25 08:57:09 2023 -0800 Merge tag 'xfs-6.7-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fix from Chandan Babu: - Validate quota records recovered from the log before writing them to the disk. * tag 'xfs-6.7-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: dquot recovery does not validate the recovered dquot xfs: clean up dqblk extraction commit 2821c393d4fdfc75a96a2fad3bec76cf3107b88a Merge: 00cff7b29b1d c0a857420405 Author: Linus Torvalds Date: Sat Nov 25 08:43:46 2023 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Fix "rodata=on" not disabling "rodata=full" on arm64 - Add arm64 make dependency between vmlinuz.efi and Image, leading to occasional build failures previously (with parallel building) - Add newline to the output formatting of the za-fork kselftest * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: add dependency between vmlinuz.efi and Image kselftest/arm64: Fix output formatting for za-fork arm64: mm: Fix "rodata=on" when CONFIG_RODATA_FULL_DEFAULT_ENABLED=y commit 00cff7b29b1dbc4ff48ae9278eb1aa4dc0bfad6a Merge: 0f5cc96c367f 7bf9a6b46549 Author: Linus Torvalds Date: Sat Nov 25 08:32:44 2023 -0800 Merge tag 'for-linus-6.7a-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - A small cleanup patch for the Xen privcmd driver - A fix for the swiotlb-xen driver which was missing the advertising of the maximum mapping length - A fix for Xen on Arm for a longstanding bug, which happened to occur only recently: a structure in percpu memory crossed a page boundary, which was rejected by the hypervisor * tag 'for-linus-6.7a-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: arm/xen: fix xen_vcpu_info allocation alignment xen: privcmd: Replace zero-length array with flex-array member and use __counted_by swiotlb-xen: provide the "max_mapping_size" method commit 3b8157ec4573e304a29b7bced627e144dbc3dfdb Author: Javier Carrasco Date: Tue Nov 21 06:48:39 2023 +0100 iio: tmag5273: fix temperature offset The current offset has the scale already applied to it. The ABI documentation defines the offset parameter as "offset to be added to [Y]_raw prior to scaling by [Y]_scale in order to obtain value in the units as specified in [Y]_raw documentation" The right value is obtained at 0 degrees Celsius by the formula provided in the datasheet: T = Tsens_t0 + (Tadc_t - Tadc_t0) / Tadc_res where: T = 0 degrees Celsius Tsens_t0 (reference temperature) = 25 degrees Celsius Tadc_t0 (16-bit format for Tsens_t0) = 17508 Tadc_res = 60.1 LSB/degree Celsius The resulting offset is 16005.5, which has been truncated to 16005 to provide an integer value with a precision loss smaller than the 1-LSB measurement precision. Fix the offset to apply its value prior to scaling. Signed-off-by: Javier Carrasco Link: https://lore.kernel.org/r/9879beec-05fc-4fc6-af62-d771e238954e@wolfvision.net Cc: Signed-off-by: Jonathan Cameron drivers/iio/magnetometer/tmag5273.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f83d38def6b1b00c9bb17173837045b41df7e7d7 Author: Chancel Liu Date: Sat Nov 25 14:53:00 2023 +0800 ASoC: imx-rpmsg: SND_SOC_IMX_RPMSG should depend on OF and I2C SND_SOC_IMX_RPMSG should depend on OF and I2C. It fixes the following error reported by kernel test robot: ld: sound/soc/fsl/imx-rpmsg.o: in function `imx_rpmsg_late_probe': imx-rpmsg.c:(.text+0x4f): undefined reference to `i2c_find_device_by_fwnode' Fixes: 5d9f746ca64c ("ASoC: imx-rpmsg: Force codec power on in low power audio mode") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311230506.DPF9vvYY-lkp@intel.com/ Signed-off-by: Chancel Liu Link: https://lore.kernel.org/r/20231125065300.6385-1-chancel.liu@nxp.com Signed-off-by: Mark Brown sound/soc/fsl/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 43266838515d30dc0c45d5c7e6e7edacee6cce92 Author: Helge Deller Date: Thu Nov 23 21:57:19 2023 +0100 parisc: Reduce size of the bug_table on 64-bit kernel by half Enable GENERIC_BUG_RELATIVE_POINTERS which will store 32-bit relative offsets to the bug address and the source file name instead of 64-bit absolute addresses. This effectively reduces the size of the bug_table[] array by half on 64-bit kernels. Signed-off-by: Helge Deller arch/parisc/Kconfig | 7 +++++-- arch/parisc/include/asm/bug.h | 34 +++++++++++++++++----------------- 2 files changed, 22 insertions(+), 19 deletions(-) commit e5f3e299a2b1e9c3ece24a38adfc089aef307e8a Author: Helge Deller Date: Thu Nov 23 20:28:27 2023 +0100 parisc: Drop the HP-UX ENOSYM and EREMOTERELEASE error codes Those return codes are only defined for the parisc architecture and are leftovers from when we wanted to be HP-UX compatible. They are not returned by any Linux kernel syscall but do trigger problems with the glibc strerrorname_np() and strerror() functions as reported in glibc issue #31080. There is no need to keep them, so simply remove them. Signed-off-by: Helge Deller Reported-by: Bruno Haible Closes: https://sourceware.org/bugzilla/show_bug.cgi?id=31080 Cc: stable@vger.kernel.org arch/parisc/include/uapi/asm/errno.h | 2 -- lib/errname.c | 6 ------ tools/arch/parisc/include/uapi/asm/errno.h | 2 -- 3 files changed, 10 deletions(-) commit fe76a1349f235969381832c83d703bc911021eb6 Author: Helge Deller Date: Mon Nov 20 23:30:49 2023 +0100 parisc: Use natural CPU alignment for bug_table Make sure that the __bug_table section gets 32- or 64-bit aligned, depending if a 32- or 64-bit kernel is being built. Mark it non-writeable and use .blockz instead of the .org assembler directive to pad the struct. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v6.0+ arch/parisc/include/asm/bug.h | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) commit c9fcb2b65c2849e8ff3be23fd8828312fb68dc19 Author: Helge Deller Date: Sat Nov 25 09:16:02 2023 +0100 parisc: Ensure 32-bit alignment on parisc unwind section Make sure the .PARISC.unwind section will be 32-bit aligned. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v6.0+ arch/parisc/kernel/vmlinux.lds.S | 1 + 1 file changed, 1 insertion(+) commit b28fc0d8739c03e7b6c44914a9d00d4c6dddc0ea Author: Helge Deller Date: Sat Nov 25 09:11:56 2023 +0100 parisc: Mark lock_aligned variables 16-byte aligned on SMP On parisc we need 16-byte alignment for variables which are used for locking. Mark the __lock_aligned attribute acordingly so that the .data..lock_aligned section will get that alignment in the generated object files. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v6.0+ arch/parisc/include/asm/ldcw.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 07eecff8ae78df7f28800484d31337e1f9bfca3a Author: Helge Deller Date: Mon Nov 20 23:14:39 2023 +0100 parisc: Mark jump_table naturally aligned The jump_table stores two 32-bit words and one 32- (on 32-bit kernel) or one 64-bit word (on 64-bit kernel). Ensure that the last word is always 64-bit aligned on a 64-bit kernel by aligning the whole structure on sizeof(long). Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v6.0+ arch/parisc/include/asm/jump_label.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 33f806da2df68606f77d7b892cd1298ba3d463e8 Author: Helge Deller Date: Mon Nov 20 23:10:20 2023 +0100 parisc: Mark altinstructions read-only and 32-bit aligned Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v6.0+ arch/parisc/include/asm/alternative.h | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit a80aeb86542a50aa8521729ea4cc731ee7174f03 Author: Helge Deller Date: Mon Nov 20 15:39:03 2023 +0100 parisc: Mark ex_table entries 32-bit aligned in uaccess.h Add an align statement to tell the linker that all ex_table entries and as such the whole ex_table section should be 32-bit aligned in vmlinux and modules. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v6.0+ arch/parisc/include/asm/uaccess.h | 1 + 1 file changed, 1 insertion(+) commit e11d4cccd094a7cd4696c8c42e672c76c092dad5 Author: Helge Deller Date: Mon Nov 20 15:37:50 2023 +0100 parisc: Mark ex_table entries 32-bit aligned in assembly.h Add an align statement to tell the linker that all ex_table entries and as such the whole ex_table section should be 32-bit aligned in vmlinux and modules. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v6.0+ arch/parisc/include/asm/assembly.h | 1 + 1 file changed, 1 insertion(+) commit b09d7f8fd50f6e93cbadd8d27fde178f745b42a1 Author: Damien Le Moal Date: Tue Nov 21 07:56:31 2023 +0900 scsi: sd: Fix system start for ATA devices It is not always possible to keep a device in the runtime suspended state when a system level suspend/resume cycle is executed. E.g. for ATA devices connected to AHCI adapters, system resume resets the ATA ports, which causes connected devices to spin up. In such case, a runtime suspended disk will incorrectly be seen with a suspended runtime state because the device is not resumed by sd_resume_system(). The power state seen by the user is different than the actual device physical power state. Fix this issue by introducing the struct scsi_device flag force_runtime_start_on_system_start. When set, this flag causes sd_resume_system() to request a runtime resume operation for runtime suspended devices. This results in the user seeing the device runtime_state as active after a system resume, thus correctly reflecting the device physical power state. Fixes: 9131bff6a9f1 ("scsi: core: pm: Only runtime resume if necessary") Cc: Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20231120225631.37938-3-dlemoal@kernel.org Signed-off-by: Martin K. Petersen drivers/ata/libata-scsi.c | 5 +++++ drivers/scsi/sd.c | 9 ++++++++- include/scsi/scsi_device.h | 6 ++++++ 3 files changed, 19 insertions(+), 1 deletion(-) commit 6371be7aeb986905bb60ec73d002fc02343393b4 Author: Damien Le Moal Date: Tue Nov 21 07:56:30 2023 +0900 scsi: Change SCSI device boolean fields to single bit flags Commit 3cc2ffe5c16d ("scsi: sd: Differentiate system and runtime start/stop management") changed the single bit manage_start_stop flag into 2 boolean fields of the SCSI device structure. Commit 24eca2dce0f8 ("scsi: sd: Introduce manage_shutdown device flag") introduced the manage_shutdown boolean field for the same structure. Together, these 2 commits increase the size of struct scsi_device by 8 bytes by using booleans instead of defining the manage_xxx fields as single bit flags, similarly to other flags of this structure. Avoid this unnecessary structure size increase and be consistent with the definition of other flags by reverting the definitions of the manage_xxx fields as single bit flags. Fixes: 3cc2ffe5c16d ("scsi: sd: Differentiate system and runtime start/stop management") Fixes: 24eca2dce0f8 ("scsi: sd: Introduce manage_shutdown device flag") Cc: Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20231120225631.37938-2-dlemoal@kernel.org Reviewed-by: Niklas Cassel Signed-off-by: Martin K. Petersen drivers/ata/libata-scsi.c | 4 ++-- drivers/firewire/sbp2.c | 6 +++--- include/scsi/scsi_device.h | 6 +++--- 3 files changed, 8 insertions(+), 8 deletions(-) commit 93e6c0e19d5bb12b49534a411c85e21d333731fa Author: Peter Wang Date: Wed Nov 15 21:10:24 2023 +0800 scsi: ufs: core: Clear cmd if abort succeeds in MCQ mode In MCQ mode, if cmd is pending in device and abort succeeds, response will not be returned by device. So we need clear the cmd, otherwise timeout will happen and next time we use same tag we will get a WARN_ON(lrbp->cmd). Below is error log: <3>[ 2277.447611][T21376] ufshcd-mtk 112b0000.ufshci: ufshcd_try_to_abort_task: cmd pending in the device. tag = 7 <3>[ 2277.476954][T21376] ufshcd-mtk 112b0000.ufshci: Aborting tag 7 / CDB 0x2a succeeded <6>[ 2307.551263][T30974] ufshcd-mtk 112b0000.ufshci: ufshcd_abort: Device abort task at tag 7 <4>[ 2307.623264][ T327] WARNING: CPU: 5 PID: 327 at source/drivers/ufs/core/ufshcd.c:3021 ufshcd_queuecommand+0x66c/0xe34 Fixes: ab248643d3d6 ("scsi: ufs: core: Add error handling for MCQ mode") Cc: Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20231115131024.15829-1-peter.wang@mediatek.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 39d5b6a64ace77d0c11c398d272218df5f939abb Author: Liu Ying Date: Thu Nov 23 11:26:15 2023 +0800 drm/bridge: panel: Check device dependency before managing device link Some panel devices already depend on DRM device, like the panel in arch/arm/boot/dts/st/ste-ux500-samsung-skomer.dts, because DRM device is the ancestor of those panel devices. device_link_add() would fail by returning a NULL pointer for those panel devices because of the existing dependency. So, check the dependency by calling device_is_dependent() before adding or deleting device link between panel device and DRM device so that the link is managed only for independent panel devices. Fixes: 887878014534 ("drm/bridge: panel: Fix device link for DRM_BRIDGE_ATTACH_NO_CONNECTOR") Fixes: 199cf07ebd2b ("drm/bridge: panel: Add a device link between drm device and panel device") Reported-by: Linus Walleij Closes: https://lore.kernel.org/lkml/CACRpkdaGzXD6HbiX7mVUNJAJtMEPG00Pp6+nJ1P0JrfJ-ArMvQ@mail.gmail.com/T/ Tested-by: Linus Walleij Signed-off-by: Liu Ying Signed-off-by: Linus Walleij Link: https://patchwork.freedesktop.org/patch/msgid/20231123032615.3760488-1-victor.liu@nxp.com drivers/gpu/drm/bridge/panel.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) commit 0f5cc96c367f2e780eb492cc9cab84e3b2ca88da Merge: 1bcc68971947 aab1f809d754 Author: Linus Torvalds Date: Fri Nov 24 11:44:50 2023 -0800 Merge tag 's390-6.7-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Alexander Gordeev: - Remove unnecessary assignment of the performance event last_tag. - Create missing /sys/firmware/ipl/* attributes when kernel is booted in dump mode using List-directed ECKD IPL. - Remove odd comment. - Fix s390-specific part of scripts/checkstack.pl script that only matches three-digit numbers starting with 3 or any higher number and skips any stack sizes smaller than 304 bytes. * tag 's390-6.7-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: scripts/checkstack.pl: match all stack sizes for s390 s390: remove odd comment s390/ipl: add missing IPL_TYPE_ECKD_DUMP case to ipl_init() s390/pai: cleanup event initialization commit 1bcc689719473873e961ed91df7e929fae71cbbb Merge: b345fd55a2b7 e37470624e00 Author: Linus Torvalds Date: Fri Nov 24 11:30:35 2023 -0800 Merge tag 'acpi-6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These add an ACPI IRQ override quirk for ASUS ExpertBook B1402CVA and fix an ACPI processor idle issue leading to triple-faults in Xen HVM guests and an ACPI backlight driver issue that causes GPUs to misbehave while their children power is being fixed up. Specifics: - Avoid powering up GPUs while attempting to fix up power for their children (Hans de Goede) - Use raw_safe_halt() instead of safe_halt() in acpi_idle_play_dead() so as to avoid triple-falts during CPU online in Xen HVM guests due to the setting of the hardirqs_enabled flag in safe_halt() (David Woodhouse) - Add an ACPI IRQ override quirk for ASUS ExpertBook B1402CVA (Hans de Goede)" * tag 'acpi-6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA ACPI: video: Use acpi_device_fix_up_power_children() ACPI: PM: Add acpi_device_fix_up_power_children() function ACPI: processor_idle: use raw_safe_halt() in acpi_idle_play_dead() commit b345fd55a2b79d6aa92042b19be802425fc353cb Merge: 5b7ad877e4d8 b85e2dab33ce Author: Linus Torvalds Date: Fri Nov 24 11:26:00 2023 -0800 Merge tag 'pm-6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Fix a syntax error in the sleepgraph utility which causes it to exit early on every invocation (David Woodhouse)" * tag 'pm-6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: tools: Fix sleepgraph syntax error commit 5b7ad877e4d81f8904ce83982b1ba5c6e83deccb Merge: fa2b906f5148 68516f60c1d8 Author: Linus Torvalds Date: Fri Nov 24 10:40:03 2023 -0800 Merge tag 'afs-fixes-20231124' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull AFS fixes from David Howells: - Fix the afs_server_list struct to be cleaned up with RCU - Fix afs to translate a no-data result from a DNS lookup into ENOENT, not EDESTADDRREQ for consistency with OpenAFS - Fix afs to translate a negative DNS lookup result into ENOENT rather than EDESTADDRREQ - Fix file locking on R/O volumes to operate in local mode as the server doesn't handle exclusive locks on such files - Set SB_RDONLY on superblocks for RO and Backup volumes so that the VFS can see that they're read only * tag 'afs-fixes-20231124' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: afs: Mark a superblock for an R/O or Backup volume as SB_RDONLY afs: Fix file locking on R/O volumes to operate in local mode afs: Return ENOENT if no cell DNS record can be found afs: Make error on cell lookup failure consistent with OpenAFS afs: Fix afs_server_list to be cleaned up with RCU commit e37470624e008579fec020c6be062dd200877129 Merge: bd911485294a c93695494606 9bb69ba4c177 Author: Rafael J. Wysocki Date: Fri Nov 24 19:16:22 2023 +0100 Merge branches 'acpi-video' and 'acpi-processor' into acpi Merge ACPI backlight driver fixes and an ACPI processor driver fix for 6.7-rc3: - Avoid powering up GPUs while attempting to fix up power for their children (Hans de Goede). - Use raw_safe_halt() instead of safe_halt() in acpi_idle_play_dead() so as to avoid triple-falts during CPU online in Xen HVM guests due to the setting of the hardirqs_enabled flag in safe_halt() (David Woodhouse). * acpi-video: ACPI: video: Use acpi_device_fix_up_power_children() ACPI: PM: Add acpi_device_fix_up_power_children() function * acpi-processor: ACPI: processor_idle: use raw_safe_halt() in acpi_idle_play_dead() commit 0ac1d13a55eb37d398b63e6ff6db4a09a2c9128c Author: Jann Horn Date: Fri Nov 24 17:48:31 2023 +0100 btrfs: send: ensure send_fd is writable kernel_write() requires the caller to ensure that the file is writable. Let's do that directly after looking up the ->send_fd. We don't need a separate bailout path because the "out" path already does fput() if ->send_filp is non-NULL. This has no security impact for two reasons: - the ioctl requires CAP_SYS_ADMIN - __kernel_write() bails out on read-only files - but only since 5.8, see commit a01ac27be472 ("fs: check FMODE_WRITE in __kernel_write") Reported-and-tested-by: syzbot+12e098239d20385264d3@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=12e098239d20385264d3 Fixes: 31db9f7c23fb ("Btrfs: introduce BTRFS_IOC_SEND for btrfs send/receive") CC: stable@vger.kernel.org # 4.14+ Signed-off-by: Jann Horn Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/send.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 94dbf7c0871f7ae6349ba4b0341ce8f5f98a071d Author: Qu Wenruo Date: Fri Nov 24 14:53:50 2023 +1030 btrfs: free the allocated memory if btrfs_alloc_page_array() fails [BUG] If btrfs_alloc_page_array() fail to allocate all pages but part of the slots, then the partially allocated pages would be leaked in function btrfs_submit_compressed_read(). [CAUSE] As explicitly stated, if btrfs_alloc_page_array() returned -ENOMEM, caller is responsible to free the partially allocated pages. For the existing call sites, most of them are fine: - btrfs_raid_bio::stripe_pages Handled by free_raid_bio(). - extent_buffer::pages[] Handled btrfs_release_extent_buffer_pages(). - scrub_stripe::pages[] Handled by release_scrub_stripe(). But there is one exception in btrfs_submit_compressed_read(), if btrfs_alloc_page_array() failed, we didn't cleanup the array and freed the array pointer directly. Initially there is still the error handling in commit dd137dd1f2d7 ("btrfs: factor out allocating an array of pages"), but later in commit 544fe4a903ce ("btrfs: embed a btrfs_bio into struct compressed_bio"), the error handling is removed, leading to the possible memory leak. [FIX] This patch would add back the error handling first, then to prevent such situation from happening again, also Make btrfs_alloc_page_array() to free the allocated pages as a extra safety net, then we don't need to add the error handling to btrfs_submit_compressed_read(). Fixes: 544fe4a903ce ("btrfs: embed a btrfs_bio into struct compressed_bio") CC: stable@vger.kernel.org # 6.4+ Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent_io.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 5de0434bc064606d6b7467ec3e5ad22963a18c04 Author: David Sterba Date: Tue Nov 14 17:44:11 2023 +0100 btrfs: fix 64bit compat send ioctl arguments not initializing version member When the send protocol versioning was added in 5.16 e77fbf990316 ("btrfs: send: prepare for v2 protocol"), the 32/64bit compat code was not updated (added by 2351f431f727 ("btrfs: fix send ioctl on 32bit with 64bit kernel")), missing the version struct member. The compat code is probably rarely used, nobody reported any bugs. Found by tool https://github.com/jirislaby/clang-struct . Fixes: e77fbf990316 ("btrfs: send: prepare for v2 protocol") CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/ioctl.c | 1 + 1 file changed, 1 insertion(+) commit fa2b906f5148883e2d0be8952767469c2e3de274 Merge: afa0f6ee000a 796432efab1e Author: Linus Torvalds Date: Fri Nov 24 09:45:40 2023 -0800 Merge tag 'vfs-6.7-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Avoid calling back into LSMs from vfs_getattr_nosec() calls. IMA used to query inode properties accessing raw inode fields without dedicated helpers. That was finally fixed a few releases ago by forcing IMA to use vfs_getattr_nosec() helpers. The goal of the vfs_getattr_nosec() helper is to query for attributes without calling into the LSM layer which would be quite problematic because incredibly IMA is called from __fput()... __fput() -> ima_file_free() What it does is to call back into the filesystem to update the file's IMA xattr. Querying the inode without using vfs_getattr_nosec() meant that IMA didn't handle stacking filesystems such as overlayfs correctly. So the switch to vfs_getattr_nosec() is quite correct. But the switch to vfs_getattr_nosec() revealed another bug when used on stacking filesystems: __fput() -> ima_file_free() -> vfs_getattr_nosec() -> i_op->getattr::ovl_getattr() -> vfs_getattr() -> i_op->getattr::$WHATEVER_UNDERLYING_FS_getattr() -> security_inode_getattr() # calls back into LSMs Now, if that __fput() happens from task_work_run() of an exiting task current->fs and various other pointer could already be NULL. So anything in the LSM layer relying on that not being NULL would be quite surprised. Fix that by passing the information that this is a security request through to the stacking filesystem by adding a new internal ATT_GETATTR_NOSEC flag. Now the callchain becomes: __fput() -> ima_file_free() -> vfs_getattr_nosec() -> i_op->getattr::ovl_getattr() -> if (AT_GETATTR_NOSEC) vfs_getattr_nosec() else vfs_getattr() -> i_op->getattr::$WHATEVER_UNDERLYING_FS_getattr() - Fix a bug introduced with the iov_iter rework from last cycle. This broke /proc/kcore by copying too much and without the correct offset. - Add a missing NULL check when allocating the root inode in autofs_fill_super(). - Fix stable writes for multi-device filesystems (xfs, btrfs etc) and the block device pseudo filesystem. Stable writes used to be a superblock flag only, making it a per filesystem property. Add an additional AS_STABLE_WRITES mapping flag to allow for fine-grained control. - Ensure that offset_iterate_dir() returns 0 after reaching the end of a directory so it adheres to getdents() convention. * tag 'vfs-6.7-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: libfs: getdents() should return 0 after reaching EOD xfs: respect the stable writes flag on the RT device xfs: clean up FS_XFLAG_REALTIME handling in xfs_ioctl_setattr_xflags block: update the stable_writes flag in bdev_add filemap: add a per-mapping stable writes flag autofs: add: new_inode check in autofs_fill_super() iov_iter: fix copy_page_to_iter_nofault() fs: Pass AT_GETATTR_NOSEC flag to getattr interface function commit 00f7d153f3358a7c7e35aef66fcd9ceb95d90430 Author: Ben Greear Date: Thu Nov 9 10:22:01 2023 -0800 wifi: mac80211: handle 320 MHz in ieee80211_ht_cap_ie_to_sta_ht_cap The new 320 MHz channel width wasn't handled, so connecting a station to a 320 MHz AP would limit the station to 20 MHz (on HT) after a warning, handle 320 MHz to fix that. Signed-off-by: Ben Greear Link: https://lore.kernel.org/r/20231109182201.495381-1-greearb@candelatech.com [write a proper commit message] Signed-off-by: Johannes Berg net/mac80211/ht.c | 1 + 1 file changed, 1 insertion(+) commit ef5828805842204dd0259ecfc132b5916c8a77ae Author: Michael-CY Lee Date: Wed Nov 22 11:02:37 2023 +0800 wifi: avoid offset calculation on NULL pointer ieee80211_he_6ghz_oper() can be passed a NULL pointer and checks for that, but already did the calculation to inside of it before. Move it after the check. Signed-off-by: Michael-CY Lee Link: https://lore.kernel.org/r/20231122030237.31276-1-michael-cy.lee@mediatek.com [rewrite commit message] Signed-off-by: Johannes Berg include/linux/ieee80211.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit afa0f6ee000abd220a8160f0375b5b8d3e4284f2 Merge: f1a09972a45a b3ca8a08d8ed Author: Linus Torvalds Date: Fri Nov 24 09:36:33 2023 -0800 Merge tag 'drm-fixes-2023-11-24' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Back to regular scheduled fixes pull request, mainly a bunch of msm, some i915 and otherwise a few scattered, one memory crasher in the nouveau GSP paths is helping stabilise that work. msm: - Fix the VREG_CTRL_1 for 4nm CPHY to match downstream - Remove duplicate call to drm_kms_helper_poll_init() in msm_drm_init() - Fix the safe_lut_tbl[] for sc8280xp to match downstream - Don't attach the drm_dp_set_subconnector_property() for eDP - Fix to attach drm_dp_set_subconnector_property() for DP. Otherwise there is a bootup crash on multiple targets - Remove unnecessary NULL check left behind during cleanup i915: - Fix race between DP MST connectore registration and setup - Fix GT memory leak on probe error path panel: - Fixes for innolux and auo,b101uan08.3 panel. - Fix Himax83102-j02 timings. ivpu: - Fix ivpu MMIO reset. ast: - AST fix on connetor disconnection. nouveau: - gsp memory corruption fix rockchip: - color fix" * tag 'drm-fixes-2023-11-24' of git://anongit.freedesktop.org/drm/drm: nouveau/gsp: allocate enough space for all channel ids. drm/panel: boe-tv101wum-nl6: Fine tune Himax83102-j02 panel HFP and HBP drm/ast: Disconnect BMC if physical connector is connected accel/ivpu/37xx: Fix hangs related to MMIO reset drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full drm/i915: do not clean GT table on error path drm/i915/dp_mst: Fix race between connector registration and setup drm/panel: simple: Fix Innolux G101ICE-L01 timings drm/panel: simple: Fix Innolux G101ICE-L01 bus flags drm/msm: remove unnecessary NULL check drm/panel: auo,b101uan08.3: Fine tune the panel power sequence drm/msm/dp: attach the DP subconnector property drm/msm/dp: don't touch DP subconnector property in eDP case drm/msm/dpu: Add missing safe_lut_tbl in sc8280xp catalog drm/msm: remove exra drm_kms_helper_poll_init() call drm/msm/dsi: use the correct VREG_CTRL_1 value for 4nm cphy commit 103317670e6bf2542309db28d52444a83d84ed28 Author: Johannes Berg Date: Wed Nov 15 13:06:16 2023 +0100 wifi: cfg80211: hold wiphy mutex for send_interface Given all the locking rework in mac80211, we pretty much need to get into the driver with the wiphy mutex held in all callbacks. This is already mostly the case, but as Johan reported, in the get_txpower it may not be true. Lock the wiphy mutex around nl80211_send_iface(), then is also around callers of nl80211_notify_iface(). This is easy to do, fixes the problem, and aligns the locking between various calls to it in different parts of the code of cfg80211. Fixes: 0e8185ce1dde ("wifi: mac80211: check wiphy mutex in ops") Reported-by: Johan Hovold Closes: https://lore.kernel.org/r/ZVOXX6qg4vXEx8dX@hovoldconsulting.com Tested-by: Johan Hovold Signed-off-by: Johannes Berg net/wireless/core.c | 4 ++-- net/wireless/nl80211.c | 5 +++++ 2 files changed, 7 insertions(+), 2 deletions(-) commit 8e2f6f2366219b3304b227bdd2f04b64c92e3e12 Author: Johannes Berg Date: Wed Nov 8 13:41:25 2023 +0100 wifi: cfg80211: lock wiphy mutex for rfkill poll We want to guarantee the mutex is held for pretty much all operations, so ensure that here as well. Reported-by: syzbot+7e59a5bfc7a897247e18@syzkaller.appspotmail.com Signed-off-by: Johannes Berg net/wireless/core.c | 2 ++ 1 file changed, 2 insertions(+) commit 7e7efdda6adb385fbdfd6f819d76bc68c923c394 Author: Johannes Berg Date: Mon Nov 6 23:17:16 2023 +0100 wifi: cfg80211: fix CQM for non-range use My prior race fix here broke CQM when ranges aren't used, as the reporting worker now requires the cqm_config to be set in the wdev, but isn't set when there's no range configured. Rather than continuing to special-case the range version, set the cqm_config always and configure accordingly, also tracking if range was used or not to be able to clear the configuration appropriately with the same API, which was actually not right if both were implemented by a driver for some reason, as is the case with mac80211 (though there the implementations are equivalent so it doesn't matter.) Also, the original multiple-RSSI commit lost checking for the callback, so might have potentially crashed if a driver had neither implementation, and userspace tried to use it despite not being advertised as supported. Cc: stable@vger.kernel.org Fixes: 4a4b8169501b ("cfg80211: Accept multiple RSSI thresholds for CQM") Fixes: 37c20b2effe9 ("wifi: cfg80211: fix cqm_config access race") Signed-off-by: Johannes Berg net/wireless/core.h | 1 + net/wireless/nl80211.c | 50 +++++++++++++++++++++++++++++++------------------- 2 files changed, 32 insertions(+), 19 deletions(-) commit 3e3a2b645c043f7e3e488d5011478cefb69bbe8b Author: Oldřich Jedlička Date: Sat Nov 4 15:13:33 2023 +0100 wifi: mac80211: do not pass AP_VLAN vif pointer to drivers during flush This fixes WARN_ONs when using AP_VLANs after station removal. The flush call passed AP_VLAN vif to driver, but because these vifs are virtual and not registered with drivers, we need to translate to the correct AP vif first. Closes: https://github.com/openwrt/openwrt/issues/12420 Fixes: 0b75a1b1e42e ("wifi: mac80211: flush queues on STA removal") Fixes: d00800a289c9 ("wifi: mac80211: add flush_sta method") Tested-by: Konstantin Demin Tested-by: Koen Vandeputte Signed-off-by: Oldřich Jedlička Link: https://lore.kernel.org/r/20231104141333.3710-1-oldium.pro@gmail.com Signed-off-by: Johannes Berg net/mac80211/driver-ops.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 71b5e40651d89a8685bea1592dfcd2aa61559628 Author: Dan Carpenter Date: Wed Sep 27 15:40:41 2023 +0300 wifi: iwlwifi: mvm: fix an error code in iwl_mvm_mld_add_sta() This error path should return -EINVAL instead of success. Fixes: 57974a55d995 ("wifi: iwlwifi: mvm: refactor iwl_mvm_mac_sta_state_common()") Signed-off-by: Dan Carpenter Acked-by: Gregory Greenman Link: https://lore.kernel.org/r/75e4ea09-db58-462f-bd4e-5ad4e5e5dcb5@moroto.mountain Signed-off-by: Johannes Berg drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit bb6cc253861bd5a7cf8439e2118659696df9619f Author: Markus Weippert Date: Fri Nov 24 16:14:37 2023 +0100 bcache: revert replacing IS_ERR_OR_NULL with IS_ERR Commit 028ddcac477b ("bcache: Remove unnecessary NULL point check in node allocations") replaced IS_ERR_OR_NULL by IS_ERR. This leads to a NULL pointer dereference. BUG: kernel NULL pointer dereference, address: 0000000000000080 Call Trace: ? __die_body.cold+0x1a/0x1f ? page_fault_oops+0xd2/0x2b0 ? exc_page_fault+0x70/0x170 ? asm_exc_page_fault+0x22/0x30 ? btree_node_free+0xf/0x160 [bcache] ? up_write+0x32/0x60 btree_gc_coalesce+0x2aa/0x890 [bcache] ? bch_extent_bad+0x70/0x170 [bcache] btree_gc_recurse+0x130/0x390 [bcache] ? btree_gc_mark_node+0x72/0x230 [bcache] bch_btree_gc+0x5da/0x600 [bcache] ? cpuusage_read+0x10/0x10 ? bch_btree_gc+0x600/0x600 [bcache] bch_gc_thread+0x135/0x180 [bcache] The relevant code starts with: new_nodes[0] = NULL; for (i = 0; i < nodes; i++) { if (__bch_keylist_realloc(&keylist, bkey_u64s(&r[i].b->key))) goto out_nocoalesce; // ... out_nocoalesce: // ... for (i = 0; i < nodes; i++) if (!IS_ERR(new_nodes[i])) { // IS_ERR_OR_NULL before 028ddcac477b btree_node_free(new_nodes[i]); // new_nodes[0] is NULL rw_unlock(true, new_nodes[i]); } This patch replaces IS_ERR() by IS_ERR_OR_NULL() to fix this. Fixes: 028ddcac477b ("bcache: Remove unnecessary NULL point check in node allocations") Link: https://lore.kernel.org/all/3DF4A87A-2AC1-4893-AE5F-E921478419A9@suse.de/ Cc: stable@vger.kernel.org Cc: Zheng Wang Cc: Coly Li Signed-off-by: Markus Weippert Signed-off-by: Jens Axboe drivers/md/bcache/btree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cb9a830e871779b4f9b8d5f76a2abf24915cd007 Merge: 9cf87666fc6e da90e45d5afc Author: Greg Kroah-Hartman Date: Fri Nov 24 16:30:38 2023 +0000 Merge tag 'usb-serial-6.7-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for 6.7-rc3 Here are a couple of modem device entry fixes and some new modem device ids. All have been in linux-next with no reported issues. * tag 'usb-serial-6.7-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: (329 commits) USB: serial: option: add Luat Air72*U series products USB: serial: option: add Fibocom L7xx modules USB: serial: option: fix FM101R-GL defines USB: serial: option: don't claim interface 4 for ZTE MF290 Linux 6.7-rc2 prctl: Disable prctl(PR_SET_MDWE) on parisc parisc/power: Fix power soft-off when running on qemu parisc: Replace strlcpy() with strscpy() NFSD: Fix checksum mismatches in the duplicate reply cache NFSD: Fix "start of NFS reply" pointer passed to nfsd_cache_update() NFSD: Update nfsd_cache_append() to use xdr_stream nfsd: fix file memleak on client_opens_release dm-crypt: start allocating with MAX_ORDER dm-verity: don't use blocking calls from tasklets dm-bufio: fix no-sleep mode dm-delay: avoid duplicate logic dm-delay: fix bugs introduced by kthread mode dm-delay: fix a race between delay_presuspend and delay_bio drm/amdgpu/gmc9: disable AGP aperture drm/amdgpu/gmc10: disable AGP aperture ... commit 1805a6d269bea9a8c8a60b6a36eb48ec91ccd3cf Merge: fba293488ccb 31ed8da1c8e5 Author: Mark Brown Date: Fri Nov 24 16:12:06 2023 +0000 ASoC: SOF: Extend the enabled DSP core handling Merge series from Peter Ujfalusi : In the current code, we enable a widget core when it is set up and disable it when it is freed. This is problematic with IPC4 because widget free is essentially a NOP and all widgets are freed in the firmware when the pipeline is deleted. This results in a crash during pipeline deletion when one of it's widgets is scheduled to run on a secondary core and is powered off when widget is freed. So, change the logic to enable all cores needed by all the modules in a pipeline when the pipeline widget is set up and disable them after the pipeline widget is freed. commit e2b706c691905fe78468c361aaabc719d0a496f1 Author: Zhengchao Shao Date: Thu Nov 23 15:13:14 2023 +0800 ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet When I perform the following test operations: 1.ip link add br0 type bridge 2.brctl addif br0 eth0 3.ip addr add 239.0.0.1/32 dev eth0 4.ip addr add 239.0.0.1/32 dev br0 5.ip addr add 224.0.0.1/32 dev br0 6.while ((1)) do ifconfig br0 up ifconfig br0 down done 7.send IGMPv2 query packets to port eth0 continuously. For example, ./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00 1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00" The preceding tests may trigger the refcnt uaf issue of the mc list. The stack is as follows: refcount_t: addition on 0; use-after-free. WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25) CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty #80 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:refcount_warn_saturate (lib/refcount.c:25) RSP: 0018:ffffb68f00657910 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908 RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900 RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680 R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00 FS: 0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0 Call Trace: igmp_heard_query (net/ipv4/igmp.c:1068) igmp_rcv (net/ipv4/igmp.c:1132) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205) ip_local_deliver_finish (net/ipv4/ip_input.c:234) __netif_receive_skb_one_core (net/core/dev.c:5529) netif_receive_skb_internal (net/core/dev.c:5729) netif_receive_skb (net/core/dev.c:5788) br_handle_frame_finish (net/bridge/br_input.c:216) nf_hook_bridge_pre (net/bridge/br_input.c:294) __netif_receive_skb_core (net/core/dev.c:5423) __netif_receive_skb_list_core (net/core/dev.c:5606) __netif_receive_skb_list (net/core/dev.c:5674) netif_receive_skb_list_internal (net/core/dev.c:5764) napi_gro_receive (net/core/gro.c:609) e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467) e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805) __napi_poll (net/core/dev.c:6533) net_rx_action (net/core/dev.c:6735) __do_softirq (kernel/softirq.c:554) run_ksoftirqd (kernel/softirq.c:913) smpboot_thread_fn (kernel/smpboot.c:164) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S:250) The root causes are as follows: Thread A Thread B ... netif_receive_skb br_dev_stop ... br_multicast_leave_snoopers ... __ip_mc_dec_group ... __igmp_group_dropped igmp_rcv igmp_stop_timer igmp_heard_query //ref = 1 ip_ma_put igmp_mod_timer refcount_dec_and_test igmp_start_timer //ref = 0 ... refcount_inc //ref increases from 0 When the device receives an IGMPv2 Query message, it starts the timer immediately, regardless of whether the device is running. If the device is down and has left the multicast group, it will cause the mc list refcount uaf issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zhengchao Shao Reviewed-by: Eric Dumazet Reviewed-by: Hangbin Liu Signed-off-by: David S. Miller net/ipv4/igmp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 237ff253f2d4f6307b7b20434d7cbcc67693298b Author: Edward Adam Davis Date: Thu Nov 23 09:23:39 2023 +0800 mptcp: fix uninit-value in mptcp_incoming_options Added initialization use_ack to mptcp_parse_option(). Reported-by: syzbot+b834a6b2decad004cfa1@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Acked-by: Paolo Abeni Signed-off-by: David S. Miller net/mptcp/options.c | 1 + 1 file changed, 1 insertion(+) commit 68516f60c1d8b0a71e516d630f66b99cb50e0150 Author: David Howells Date: Thu Nov 2 16:24:00 2023 +0000 afs: Mark a superblock for an R/O or Backup volume as SB_RDONLY Mark a superblock that is for for an R/O or Backup volume as SB_RDONLY when mounting it. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org fs/afs/super.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit b590eb41be766c5a63acc7e8896a042f7a4e8293 Author: David Howells Date: Wed Nov 1 22:03:28 2023 +0000 afs: Fix file locking on R/O volumes to operate in local mode AFS doesn't really do locking on R/O volumes as fileservers don't maintain state with each other and thus a lock on a R/O volume file on one fileserver will not be be visible to someone looking at the same file on another fileserver. Further, the server may return an error if you try it. Fix this by doing what other AFS clients do and handle filelocking on R/O volume files entirely within the client and don't touch the server. Fixes: 6c6c1d63c243 ("afs: Provide mount-time configurable byte-range file locking emulation") Signed-off-by: David Howells Reviewed-by: Marc Dionne cc: linux-afs@lists.infradead.org fs/afs/super.c | 2 ++ 1 file changed, 2 insertions(+) commit 0167236e7d66c5e1e85d902a6abc2529b7544539 Author: David Howells Date: Thu Oct 26 01:25:07 2023 +0100 afs: Return ENOENT if no cell DNS record can be found Make AFS return error ENOENT if no cell SRV or AFSDB DNS record (or cellservdb config file record) can be found rather than returning EDESTADDRREQ. Also add cell name lookup info to the cursor dump. Fixes: d5c32c89b208 ("afs: Fix cell DNS lookup") Reported-by: Markus Suvanto Link: https://bugzilla.kernel.org/show_bug.cgi?id=216637 Signed-off-by: David Howells Reviewed-by: Marc Dionne cc: linux-afs@lists.infradead.org fs/afs/vl_rotate.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 31ed8da1c8e5e504710bb36863700e3389f8fc81 Author: Ranjani Sridharan Date: Fri Nov 24 15:57:43 2023 +0200 ASoC: SOF: sof-audio: Modify logic for enabling/disabling topology cores In the current code, we enable a widget core when it is set up and disable it when it is freed. This is problematic with IPC4 because widget free is essentially a NOP and all widgets are freed in the firmware when the pipeline is deleted. This results in a crash during pipeline deletion when one of it's widgets is scheduled to run on a secondary core and is powered off when widget is freed. So, change the logic to enable all cores needed by all the modules in a pipeline when the pipeline widget is set up and disable them after the pipeline widget is freed. Signed-off-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Péter Ujfalusi Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20231124135743.24674-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown sound/soc/sof/sof-audio.c | 65 ++++++++++++++++++++++++++++++----------------- 1 file changed, 41 insertions(+), 24 deletions(-) commit 0376b995bb7a65fb0c056f3adc5e9695ad0c1805 Author: Ranjani Sridharan Date: Fri Nov 24 15:57:42 2023 +0200 ASoC: SOF: ipc4-topology: Add core_mask in struct snd_sof_pipeline With IPC4, a pipeline may contain multiple modules in the data processing domain and they can be scheduled to run on different cores. Add a new field in struct snd_sof_pipeline to keep track of all the cores that are associated with the modules in the pipeline. Set the pipeline core mask for IPC3 when initializing the pipeline widget IPC structure. For IPC4, set the core mark when initializing the pipeline widget and initializing processing modules in the data processing domain. Signed-off-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Péter Ujfalusi Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20231124135743.24674-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown sound/soc/sof/ipc3-topology.c | 2 ++ sound/soc/sof/ipc4-topology.c | 9 +++++++++ sound/soc/sof/sof-audio.h | 2 ++ 3 files changed, 13 insertions(+) commit 54bed6bafa0f38daf9697af50e3aff5ff1354fe1 Author: Amelie Delaunay Date: Mon Nov 6 14:48:32 2023 +0100 dmaengine: stm32-dma: avoid bitfield overflow assertion stm32_dma_get_burst() returns a negative error for invalid input, which gets turned into a large u32 value in stm32_dma_prep_dma_memcpy() that in turn triggers an assertion because it does not fit into a two-bit field: drivers/dma/stm32-dma.c: In function 'stm32_dma_prep_dma_memcpy': include/linux/compiler_types.h:354:38: error: call to '__compiletime_assert_282' declared with attribute error: FIELD_PREP: value too large for the field _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:335:4: note: in definition of macro '__compiletime_assert' prefix ## suffix(); \ ^~~~~~ include/linux/compiler_types.h:354:2: note: in expansion of macro '_compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^~~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert' #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg) ^~~~~~~~~~~~~~~~~~ include/linux/bitfield.h:68:3: note: in expansion of macro 'BUILD_BUG_ON_MSG' BUILD_BUG_ON_MSG(__builtin_constant_p(_val) ? \ ^~~~~~~~~~~~~~~~ include/linux/bitfield.h:114:3: note: in expansion of macro '__BF_FIELD_CHECK' __BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_PREP: "); \ ^~~~~~~~~~~~~~~~ drivers/dma/stm32-dma.c:1237:4: note: in expansion of macro 'FIELD_PREP' FIELD_PREP(STM32_DMA_SCR_PBURST_MASK, dma_burst) | ^~~~~~~~~~ As an easy workaround, assume the error can happen, so try to handle this by failing stm32_dma_prep_dma_memcpy() before the assertion. It replicates what is done in stm32_dma_set_xfer_param() where stm32_dma_get_burst() is also used. Fixes: 1c32d6c37cc2 ("dmaengine: stm32-dma: use bitfield helpers") Fixes: a2b6103b7a8a ("dmaengine: stm32-dma: Improve memory burst management") Signed-off-by: Arnd Bergmann Signed-off-by: Amelie Delaunay Cc: stable@vger.kernel.org Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311060135.Q9eMnpCL-lkp@intel.com/ Link: https://lore.kernel.org/r/20231106134832.1470305-1-amelie.delaunay@foss.st.com Signed-off-by: Vinod Koul drivers/dma/stm32-dma.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit fba293488ccb1902e715da328e71aa868dd561f6 Author: Peter Ujfalusi Date: Fri Nov 24 14:40:32 2023 +0200 ASoC: Intel: sof_sdw: Always register the HDMI dai links The topology files for SDW devices require HDMI dai links to be present and this is granted under normal conditions but in case of special use cases the display (i915) driver might not be enabled due to deny-listing, booting with nomodeset or just not compiled at all. This should not block the non HDMI audio to be usable so register the dai links unconditionally. The code has been prepared for this and in case of no HDMI audio the link is created with dummy codec. Closes: https://github.com/thesofproject/linux/issues/4594 Closes: https://github.com/thesofproject/linux/issues/4648 Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20231124124032.15946-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown sound/soc/intel/boards/sof_sdw.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) commit 3d1dc8b1030df8ca0fdfd4905c88ee10db943bf8 Author: Peter Ujfalusi Date: Fri Nov 24 14:40:15 2023 +0200 ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not available When the HDMI is not present due to disabled display support we will use dummy codec and the HDMI routes will refer to non existent DAPM widgets. Trim the route list from the HDMI routes to be able to probe the card even if the HDMI dais are not registered. Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Kai Vehmanen Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20231124124015.15878-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 ++ 1 file changed, 2 insertions(+) commit 3448397a47c08c291c3fccb7ac5f0f429fd547e0 Author: Xiaolei Wang Date: Tue Nov 14 06:57:13 2023 +0800 dmaengine: fsl-edma: Add judgment on enabling round robin arbitration Add judgment on enabling round robin arbitration to avoid exceptions if this function is not supported. Call trace: fsl_edma_resume_early+0x1d4/0x208 dpm_run_callback+0xd4/0x304 device_resume_early+0xb0/0x208 dpm_resume_early+0x224/0x528 suspend_devices_and_enter+0x3e4/0xd00 pm_suspend+0x3c4/0x910 state_store+0x90/0x124 kobj_attr_store+0x48/0x64 sysfs_kf_write+0x84/0xb4 kernfs_fop_write_iter+0x19c/0x264 vfs_write+0x664/0x858 ksys_write+0xc8/0x180 __arm64_sys_write+0x44/0x58 invoke_syscall+0x5c/0x178 el0_svc_common.constprop.0+0x11c/0x14c do_el0_svc+0x30/0x40 el0_svc+0x58/0xa8 el0t_64_sync_handler+0xc0/0xc4 el0t_64_sync+0x190/0x194 Fixes: 72f5801a4e2b ("dmaengine: fsl-edma: integrate v3 support") Signed-off-by: Xiaolei Wang Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20231113225713.1892643-3-xiaolei.wang@windriver.com Signed-off-by: Vinod Koul drivers/dma/fsl-edma-main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 2838a897654c4810153cc51646414ffa54fd23b0 Author: Xiaolei Wang Date: Tue Nov 14 06:57:12 2023 +0800 dmaengine: fsl-edma: Do not suspend and resume the masked dma channel when the system is sleeping Some channels may be masked. When the system is suspended, if these masked channels are not filtered out, this will lead to null pointer operations and system crash: Unable to handle kernel NULL pointer dereference at virtual address Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000894300000 [00000000000002a0] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 989 Comm: sh Tainted: G B 6.6.0-16203-g557fb7a3ec4c-dirty #70 Hardware name: Freescale i.MX8QM MEK (DT) pstate: 400000c5 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc: fsl_edma_disable_request+0x3c/0x78 lr: fsl_edma_disable_request+0x3c/0x78 sp:ffff800089ae7690 x29: ffff800089ae7690 x28: ffff000807ab5440 x27: ffff000807ab5830 x26: 0000000000000008 x25: 0000000000000278 x24: 0000000000000001 23: ffff000807ab4328 x22: 0000000000000000 x21: 0000000000000009 x20: ffff800082616940 x19: 0000000000000000 x18: 0000000000000000 x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d x14: 3d3d3d3d3d3d3d3d x13: 3d3d3d3d3d3d3d3d x12: 1ffff00010d45724 x11: ffff700010d45724 x10: dfff800000000000 x9: dfff800000000000 x8: 00008fffef2ba8dc x7: 0000000000000001 x6: ffff800086a2b927 x5: ffff800086a2b920 x4: ffff700010d45725 x3: ffff8000800d5bbc x2 : 0000000000000000 x1 : ffff000800c1d880 x0 : 0000000000000001 Call trace: fsl_edma_disable_request+0x3c/0x78 fsl_edma_suspend_late+0x128/0x12c dpm_run_callback+0xd4/0x304 __device_suspend_late+0xd0/0x240 dpm_suspend_late+0x174/0x59c suspend_devices_and_enter+0x194/0xd00 pm_suspend+0x3c4/0x910 Fixes: 72f5801a4e2b ("dmaengine: fsl-edma: integrate v3 support") Signed-off-by: Xiaolei Wang Link: https://lore.kernel.org/r/20231113225713.1892643-2-xiaolei.wang@windriver.com Signed-off-by: Vinod Koul drivers/dma/fsl-edma-main.c | 4 ++++ 1 file changed, 4 insertions(+) commit b5ec294472794ed9ecba0cb4b8208372842e7e0d Author: Krzysztof Kozlowski Date: Thu Aug 10 11:13:00 2023 +0200 reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning 'type' is an enum, thus cast of pointer on 64-bit compile test with W=1 causes: hi6220_reset.c:166:9: error: cast to smaller integer type 'enum hi6220_reset_ctrl_type' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230810091300.70197-1-krzysztof.kozlowski@linaro.org Signed-off-by: Philipp Zabel drivers/reset/hisilicon/hi6220_reset.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 90785ea8158b6923c5d6a024f2b1c076110577b5 Author: Chester Lin Date: Thu Nov 16 08:19:13 2023 +0800 dt-bindings: pinctrl: s32g2: change a maintainer email address I am leaving SUSE so the current email address will be disabled soon. will be my new address for handling emails, patches and pull requests from upstream and communities. Cc: Chester Lin Cc: NXP S32 Linux Team Cc: Ghennadi Procopciuc Cc: Linus Walleij Cc: Rob Herring Cc: Krzysztof Kozlowski Cc: Conor Dooley Signed-off-by: Chester Lin Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20231116001913.16121-1-clin@suse.com Signed-off-by: Linus Walleij Documentation/devicetree/bindings/pinctrl/nxp,s32g2-siul2-pinctrl.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bca4104b00fec60be330cd32818dd5c70db3d469 Author: Peter Zijlstra Date: Tue Nov 21 12:41:26 2023 +0100 lockdep: Fix block chain corruption Kent reported an occasional KASAN splat in lockdep. Mark then noted: > I suspect the dodgy access is to chain_block_buckets[-1], which hits the last 4 > bytes of the redzone and gets (incorrectly/misleadingly) attributed to > nr_large_chain_blocks. That would mean @size == 0, at which point size_to_bucket() returns -1 and the above happens. alloc_chain_hlocks() has 'size - req', for the first with the precondition 'size >= rq', which allows the 0. This code is trying to split a block, del_chain_block() takes what we need, and add_chain_block() puts back the remainder, except in the above case the remainder is 0 sized and things go sideways. Fixes: 810507fe6fd5 ("locking/lockdep: Reuse freed chain_hlocks entries") Reported-by: Kent Overstreet Signed-off-by: Peter Zijlstra (Intel) Tested-by: Kent Overstreet Link: https://lkml.kernel.org/r/20231121114126.GH8262@noisy.programming.kicks-ass.net kernel/locking/lockdep.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 38a285d5d446ce80b21f997cdc747cc11678b4e0 Author: Tzuyi Chang Date: Tue Nov 21 17:11:07 2023 +0800 pinctrl: realtek: Fix logical error when finding descriptor The pin descriptor should be returned if the name has been found in the descriptor table. Remove the negation in the if statement for accurate retrieval. Fixes: e99ce78030db ("pinctrl: realtek: Add common pinctrl driver for Realtek DHC RTD SoCs") Signed-off-by: Tzuyi Chang Link: https://lore.kernel.org/r/20231121091107.5564-1-tychang@realtek.com Signed-off-by: Linus Walleij drivers/pinctrl/realtek/pinctrl-rtd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit be37542afbfcd27b3bb99a135abf9b4736b96f75 Author: Jai Luthra Date: Thu Nov 23 14:57:31 2023 +0530 dmaengine: ti: k3-psil-am62a: Fix SPI PDMA data AM62Ax has 3 SPI channels where each channel has 4x TX and 4x RX threads. Also fix the thread numbers to match what the firmware expects according to the PSI-L device description. Link: http://downloads.ti.com/tisci/esd/latest/5_soc_doc/am62ax/psil_cfg.html [1] Fixes: aac6db7e243a ("dmaengine: ti: k3-psil-am62a: Add AM62Ax PSIL and PDMA data") Signed-off-by: Jai Luthra Link: https://lore.kernel.org/r/20231123-psil_fix-v1-1-6604d80819be@ti.com Signed-off-by: Vinod Koul drivers/dma/ti/k3-psil-am62a.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 0af8a06a4ce823e380385cdd9538cdd968a1ffae Author: Kent Overstreet Date: Mon Nov 20 18:23:26 2023 -0500 bcachefs: deallocate_extra_replicas() When allocating from devices with different durability, we might end up with more replicas than required; this changes bch2_alloc_sectors_start() to check for this, and drop replicas that aren't needed to hit the number of replicas requested. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_foreground.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) commit 8a443d3ea1327fea5ac3be77d2e39ebe35bfe9cf Author: Kent Overstreet Date: Fri Nov 17 23:13:49 2023 -0500 bcachefs: Proper refcounting for journal_keys The btree iterator code overlays keys from the journal until journal replay is finished; since we're now starting copygc/rebalance etc. before replay is finished, this is multithreaded access and thus needs refcounting. Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 2 ++ fs/bcachefs/btree_iter.c | 6 +++++- fs/bcachefs/btree_journal_iter.c | 18 +++++++++++++++--- fs/bcachefs/btree_journal_iter.h | 10 +++++++++- fs/bcachefs/recovery.c | 11 +++++++---- fs/bcachefs/super.c | 6 ++++-- 6 files changed, 42 insertions(+), 11 deletions(-) commit 63807d951803e422cea8bfb4fdd36f57de191ada Author: Brian Foster Date: Thu Nov 16 12:13:43 2023 -0500 bcachefs: preserve device path as device name Various userspace scripts/tools may expect mount entries in /proc/mounts to reflect the device path names used to mount the associated filesystem. bcachefs seems to normalize the device path to the underlying device name based on the block device. This confuses tools like fstests when the test devices might be lvm or device-mapper based. The default behavior for show_vfsmnt() appers to be to use the string passed to alloc_vfsmnt(), so tweak bcachefs to copy the path at device superblock read time and to display it via ->show_devname(). Signed-off-by: Brian Foster Signed-off-by: Kent Overstreet fs/bcachefs/fs.c | 3 +-- fs/bcachefs/super-io.c | 5 +++++ fs/bcachefs/super_types.h | 1 + 3 files changed, 7 insertions(+), 2 deletions(-) commit 0a11adfb7aceb65831ff1c4d129d611e54fc3f57 Author: Kent Overstreet Date: Sat Nov 11 16:31:20 2023 -0500 bcachefs: Fix an endianness conversion cpu_to_le32(), not le32_to_cpu() - fixes a sparse complaint. Signed-off-by: Kent Overstreet fs/bcachefs/snapshot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 468035ca4b83fd49be99a67b5aac3960d577c7c5 Author: Kent Overstreet Date: Fri Nov 24 00:55:59 2023 -0500 bcachefs: Start gc, copygc, rebalance threads after initing writes ref This fixes a bug where copygc would occasionally race with going read-write and die, thinking we were read only, because it couldn't take a ref on c->writes. It's not necessary for copygc (or rebalance, or copygc) to take write refs; they could run with BCH_TRANS_COMMIT_nocheck_rw, but this is an easier fix that making sure that flag is passed correctly everywhere. Signed-off-by: Kent Overstreet fs/bcachefs/super.c | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) commit 202a7c292ec65d5a602aa356f4fa4f50ff84cdee Author: Kent Overstreet Date: Fri Nov 24 00:54:43 2023 -0500 bcachefs: Don't stop copygc thread on device resize copygc no longer has to scan the buckets, so it's no longer a problem if the number of buckets is changing while it's running. This also fixes a bug where we forgot to restart copygc. Signed-off-by: Kent Overstreet fs/bcachefs/buckets.c | 2 -- 1 file changed, 2 deletions(-) commit 261af2f1c6b668586325a37df02f904c1c273a7d Author: Kent Overstreet Date: Wed Nov 22 23:44:47 2023 -0500 bcachefs: Make sure bch2_move_ratelimit() also waits for move_ops This adds move_ctxt_wait_event_timeout(), which can sleep for a timeout while also issueing pending moves as reads complete. Co-developed-by: Daniel Hill Signed-off-by: Kent Overstreet fs/bcachefs/move.c | 17 ++++------------- fs/bcachefs/move.h | 19 +++++++++++++++++++ 2 files changed, 23 insertions(+), 13 deletions(-) commit 50e029c6390a6795869b742a5fce1e57d6a76c82 Author: Kent Overstreet Date: Mon Nov 20 17:24:32 2023 -0500 bcachefs: bch2_moving_ctxt_flush_all() Introduce a new helper to flush all move IOs, and use it in a few places where we should have been. The new helper also drops btree locks before waiting on outstanding move writes, avoiding potential deadlocks. Signed-off-by: Kent Overstreet fs/bcachefs/move.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) commit 6201d91ee32cf92e9bcca69a3cf73461827b5ce5 Author: Kent Overstreet Date: Thu Nov 23 17:56:14 2023 -0500 bcachefs: Put erasure coding behind an EXPERIMENTAL kconfig option We still have disk space accounting changes coming for erasure coding, and the changes won't be as strictly backwards compatible as they'd ought to be - specifically, we need to start accounting striped data under a separate counter in bch_alloc (which describes buckets). A fsck will suffice for upgrading/downgrading, but since erasure coding is the most incomplete major feature of bcachefs it still makes sense to put behind a separate kconfig option, so that users are fully aware. Signed-off-by: Kent Overstreet fs/bcachefs/Kconfig | 12 ++++++++++++ fs/bcachefs/alloc_foreground.c | 3 +++ 2 files changed, 15 insertions(+) commit d4e3b928ab487a8aecd1f6a140b40ac365116cfb Author: Kent Overstreet Date: Fri Nov 17 19:13:27 2023 -0500 closures: CLOSURE_CALLBACK() to fix type punning Control flow integrity is now checking that type signatures match on indirect function calls. That breaks closures, which embed a work_struct in a closure in such a way that a closure_fn may also be used as a workqueue fn by the underlying closure code. So we have to change closure fns to take a work_struct as their argument - but that results in a loss of clarity, as closure fns have different semantics from normal workqueue functions (they run owning a ref on the closure, which must be released with continue_at() or closure_return()). Thus, this patc introduces CLOSURE_CALLBACK() and closure_type() macros as suggested by Kees, to smooth things over a bit. Suggested-by: Kees Cook Cc: Coly Li Signed-off-by: Kent Overstreet drivers/md/bcache/btree.c | 14 +++---- drivers/md/bcache/journal.c | 20 +++++----- drivers/md/bcache/movinggc.c | 16 ++++---- drivers/md/bcache/request.c | 74 ++++++++++++++++++------------------- drivers/md/bcache/request.h | 2 +- drivers/md/bcache/super.c | 40 ++++++++++---------- drivers/md/bcache/writeback.c | 16 ++++---- fs/bcachefs/btree_io.c | 7 ++-- fs/bcachefs/btree_update_interior.c | 4 +- fs/bcachefs/fs-io-direct.c | 8 ++-- fs/bcachefs/io_write.c | 14 +++---- fs/bcachefs/io_write.h | 3 +- fs/bcachefs/journal_io.c | 17 ++++----- fs/bcachefs/journal_io.h | 2 +- include/linux/closure.h | 9 ++++- lib/closure.c | 5 ++- 16 files changed, 127 insertions(+), 124 deletions(-) commit cd80ce7e68f1624ac29cd0a6b057789d1236641e Author: Namjae Jeon Date: Wed Nov 22 23:01:43 2023 +0900 ksmbd: don't update ->op_state as OPLOCK_STATE_NONE on error ksmbd set ->op_state as OPLOCK_STATE_NONE on lease break ack error. op_state of lease should not be updated because client can send lease break ack again. This patch fix smb2.lease.breaking2 test failure. Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2pdu.c | 1 - 1 file changed, 1 deletion(-) commit 9ac45ac7cf65b0623ceeab9b28b307a08efa22dc Author: Namjae Jeon Date: Wed Nov 22 23:00:59 2023 +0900 ksmbd: move setting SMB2_FLAGS_ASYNC_COMMAND and AsyncId Directly set SMB2_FLAGS_ASYNC_COMMAND flags and AsyncId in smb2 header of interim response instead of current response header. Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2pdu.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit 2a3f7857ec742e212d6cee7fbbf7b0e2ae7f5161 Author: Namjae Jeon Date: Wed Nov 22 23:00:22 2023 +0900 ksmbd: release interim response after sending status pending response Add missing release async id and delete interim response entry after sending status pending response. This only cause when smb2 lease is enable. Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/ksmbd_work.c | 3 +++ fs/smb/server/oplock.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) commit 2e450920d58b4991a436c8cecf3484bcacd8e535 Author: Namjae Jeon Date: Mon Nov 20 23:39:39 2023 +0900 ksmbd: move oplock handling after unlock parent dir ksmbd should process secound parallel smb2 create request during waiting oplock break ack. parent lock range that is too large in smb2_open() causes smb2_open() to be serialized. Move the oplock handling to the bottom of smb2_open() and make it called after parent unlock. This fixes the failure of smb2.lease.breaking1 testcase. Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2pdu.c | 121 ++++++++++++++++++++++++++---------------------- 1 file changed, 65 insertions(+), 56 deletions(-) commit 4274a9dc6aeb9fea66bffba15697a35ae8983b6a Author: Namjae Jeon Date: Mon Nov 20 09:13:54 2023 +0900 ksmbd: separately allocate ci per dentry xfstests generic/002 test fail when enabling smb2 leases feature. This test create hard link file, but removeal failed. ci has a file open count to count file open through the smb client, but in the case of hard link files, The allocation of ci per inode cause incorrectly open count for file deletion. This patch allocate ci per dentry to counts open counts for hard link. Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2pdu.c | 2 +- fs/smb/server/vfs.c | 2 +- fs/smb/server/vfs_cache.c | 33 +++++++++++++-------------------- fs/smb/server/vfs_cache.h | 6 +++--- 4 files changed, 18 insertions(+), 25 deletions(-) commit 864fb5d3716303a045c3ffb397f651bfd37bfb36 Author: Namjae Jeon Date: Mon Nov 20 09:23:09 2023 +0900 ksmbd: fix possible deadlock in smb2_open [ 8743.393379] ====================================================== [ 8743.393385] WARNING: possible circular locking dependency detected [ 8743.393391] 6.4.0-rc1+ #11 Tainted: G OE [ 8743.393397] ------------------------------------------------------ [ 8743.393402] kworker/0:2/12921 is trying to acquire lock: [ 8743.393408] ffff888127a14460 (sb_writers#8){.+.+}-{0:0}, at: ksmbd_vfs_setxattr+0x3d/0xd0 [ksmbd] [ 8743.393510] but task is already holding lock: [ 8743.393515] ffff8880360d97f0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: ksmbd_vfs_kern_path_locked+0x181/0x670 [ksmbd] [ 8743.393618] which lock already depends on the new lock. [ 8743.393623] the existing dependency chain (in reverse order) is: [ 8743.393628] -> #1 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}: [ 8743.393648] down_write_nested+0x9a/0x1b0 [ 8743.393660] filename_create+0x128/0x270 [ 8743.393670] do_mkdirat+0xab/0x1f0 [ 8743.393680] __x64_sys_mkdir+0x47/0x60 [ 8743.393690] do_syscall_64+0x5d/0x90 [ 8743.393701] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 8743.393711] -> #0 (sb_writers#8){.+.+}-{0:0}: [ 8743.393728] __lock_acquire+0x2201/0x3b80 [ 8743.393737] lock_acquire+0x18f/0x440 [ 8743.393746] mnt_want_write+0x5f/0x240 [ 8743.393755] ksmbd_vfs_setxattr+0x3d/0xd0 [ksmbd] [ 8743.393839] ksmbd_vfs_set_dos_attrib_xattr+0xcc/0x110 [ksmbd] [ 8743.393924] compat_ksmbd_vfs_set_dos_attrib_xattr+0x39/0x50 [ksmbd] [ 8743.394010] smb2_open+0x3432/0x3cc0 [ksmbd] [ 8743.394099] handle_ksmbd_work+0x2c9/0x7b0 [ksmbd] [ 8743.394187] process_one_work+0x65a/0xb30 [ 8743.394198] worker_thread+0x2cf/0x700 [ 8743.394209] kthread+0x1ad/0x1f0 [ 8743.394218] ret_from_fork+0x29/0x50 This patch add mnt_want_write() above parent inode lock and remove nested mnt_want_write calls in smb2_open(). Fixes: 40b268d384a2 ("ksmbd: add mnt_want_write to ksmbd vfs functions") Cc: stable@vger.kernel.org Reported-by: Marios Makassikis Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2pdu.c | 47 ++++++++++++++++------------------ fs/smb/server/smbacl.c | 7 ++--- fs/smb/server/smbacl.h | 2 +- fs/smb/server/vfs.c | 68 +++++++++++++++++++++++++++++-------------------- fs/smb/server/vfs.h | 10 +++++--- 5 files changed, 75 insertions(+), 59 deletions(-) commit 90044481e7cca6cb3125b3906544954a25f1309f Author: Zongmin Zhou Date: Mon Nov 20 23:48:17 2023 +0900 ksmbd: prevent memory leak on error return When allocated memory for 'new' failed,just return will cause memory leak of 'ar'. Fixes: 1819a9042999 ("ksmbd: reorganize ksmbd_iov_pin_rsp()") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202311031837.H3yo7JVl-lkp@intel.com/ Signed-off-by: Zongmin Zhou Acked-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/ksmbd_work.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit c9213ddad2bdb43ef17d86f07ad6c45ca2b4acd5 Merge: d3fa86b1a7b4 782486af9b5b Author: David S. Miller Date: Fri Nov 24 01:52:36 2023 +0000 Merge branch 'rswitch-fixes' Yoshihiro Shimoda says: ==================== net: rswitch: Fix issues in rswitch_start_xmit() This patch series is based on the latest net.git / main branch. Changes from v2: https://lore.kernel.org/all/20231122012556.3645840-1-yoshihiro.shimoda.uh@renesas.com/ - Keep reverse christmas tree of local variable declarations in patch 1/3. Changes from v1: https://lore.kernel.org/all/20231121055255.3627949-1-yoshihiro.shimoda.uh@renesas.com/ - Separate a patch because fixing 2 issues. - Add fixing wrong type of return value. - Use goto for improving code readability. ==================== Signed-off-by: David S. Miller commit 782486af9b5b76493012711413c141509ac45dec Author: Yoshihiro Shimoda Date: Wed Nov 22 14:11:43 2023 +0900 net: rswitch: Fix missing dev_kfree_skb_any() in error path Before returning the rswitch_start_xmit() in the error path, dev_kfree_skb_any() should be called. So, fix it. Fixes: 33f5d733b589 ("net: renesas: rswitch: Improve TX timestamp accuracy") Signed-off-by: Yoshihiro Shimoda Reviewed-by: Wojciech Drewek Signed-off-by: David S. Miller drivers/net/ethernet/renesas/rswitch.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) commit 1aaef8634a20b322c82e84f12a9b6aec1e2fd4fa Author: Yoshihiro Shimoda Date: Wed Nov 22 14:11:42 2023 +0900 net: rswitch: Fix return value in rswitch_start_xmit() This .ndo_start_xmit() function should return netdev_tx_t value, not -ENOMEM. So, fix it. Fixes: 33f5d733b589 ("net: renesas: rswitch: Improve TX timestamp accuracy") Signed-off-by: Yoshihiro Shimoda Reviewed-by: Wojciech Drewek Signed-off-by: David S. Miller drivers/net/ethernet/renesas/rswitch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 109b25d13e0054337860d44841b990d11b32d262 Author: Yoshihiro Shimoda Date: Wed Nov 22 14:11:41 2023 +0900 net: rswitch: Fix type of ret in rswitch_start_xmit() The type of ret in rswitch_start_xmit() should be netdev_tx_t. So, fix it. Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"") Signed-off-by: Yoshihiro Shimoda Reviewed-by: Wojciech Drewek Signed-off-by: David S. Miller drivers/net/ethernet/renesas/rswitch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f1a09972a45ae63efbd1587337c4be13b1893330 Merge: bc893f744ef0 a6925165ea82 Author: Linus Torvalds Date: Thu Nov 23 17:45:49 2023 -0800 Merge tag 'ata-6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata fix from Damien Le Moal: - Add a missing error check in the adapter initialization of the pata_isapnp driver (Chen) * tag 'ata-6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: pata_isapnp: Add missing error check for devm_ioport_map() commit bc893f744ef04e118f7bcf848fd33f8016b63f7d Merge: 004442384416 0e6c4fe782e6 Author: Linus Torvalds Date: Thu Nov 23 17:40:15 2023 -0800 Merge tag 'block-6.7-2023-11-23' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "A bit bigger than usual at this time, but nothing really earth shattering: - NVMe pull request via Keith: - TCP TLS fixes (Hannes) - Authentifaction fixes (Mark, Hannes) - Properly terminate target names (Christoph) - MD pull request via Song, fixing a raid5 corruption issue - Disentanglement of the dependency mess in nvme introduced with the tls additions. Now it should actually build on all configs (Arnd) - Series of bcache fixes (Coly) - Removal of a dead helper (Damien) - s390 dasd fix (Muhammad, Jan) - lockdep blk-cgroup fixes (Ming)" * tag 'block-6.7-2023-11-23' of git://git.kernel.dk/linux: (33 commits) nvme: tcp: fix compile-time checks for TLS mode nvme: target: fix Kconfig select statements nvme: target: fix nvme_keyring_id() references nvme: move nvme_stop_keep_alive() back to original position nbd: pass nbd_sock to nbd_read_reply() instead of index s390/dasd: protect device queue against concurrent access s390/dasd: resolve spelling mistake block/null_blk: Fix double blk_mq_start_request() warning nvmet-tcp: always initialize tls_handshake_tmo_work nvmet: nul-terminate the NQNs passed in the connect command nvme: blank out authentication fabrics options if not configured nvme: catch errors from nvme_configure_metadata() nvme-tcp: only evaluate 'tls' option if TLS is selected nvme-auth: set explanation code for failure2 msgs nvme-auth: unlock mutex in one place only block: Remove blk_set_runtime_active() nbd: fix null-ptr-dereference while accessing 'nbd->config' nbd: factor out a helper to get nbd_config without holding 'config_lock' nbd: fold nbd config initialization into nbd_alloc_config() bcache: avoid NULL checking to c->root in run_cache_set() ... commit 004442384416cbb3cedf99eb8ab5f10c32e4dd34 Merge: 1f342790ad3c d6fef34ee4d1 Author: Linus Torvalds Date: Thu Nov 23 17:36:29 2023 -0800 Merge tag 'io_uring-6.7-2023-11-23' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "A fix for ensuring that LINKAT always propagates flags correctly, and a fix for an off-by-one in segment skipping for registered buffers. Both heading to stable as well" * tag 'io_uring-6.7-2023-11-23' of git://git.kernel.dk/linux: io_uring: fix off-by one bvec index io_uring/fs: consider link->flags when getting path for LINKAT commit 1f342790ad3c2456e15351829ad5d8919cccc03f Merge: d3fa86b1a7b4 9ffccb691adb Author: Linus Torvalds Date: Thu Nov 23 17:31:53 2023 -0800 Merge tag 'for-linus-2023112301' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - revert of commit that caused regression to many Logitech unifying receiver users (Jiri Kosina) - power management fix for hid-mcp2221 (Hamish Martin) - fix for race condition between HID core and HID debug (Charles Yi) - a couple of assorted device-ID-specific quirks * tag 'for-linus-2023112301' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad HID: hid-asus: reset the backlight brightness level on resume HID: hid-asus: add const to read-only outgoing usb buffer Revert "HID: logitech-dj: Add support for a new lightspeed receiver iteration" HID: add ALWAYS_POLL quirk for Apple kb HID: glorious: fix Glorious Model I HID report HID: fix HID device resource race between HID core and debugging support HID: apple: add Jamesdonkey and A3R to non-apple keyboards list HID: mcp2221: Allow IO to start during probe HID: mcp2221: Set driver data before I2C adapter add commit b3ca8a08d8ed0dc8a9e236d9294efd58554a7b05 Merge: 8692160904c9 0561794b6b64 Author: Dave Airlie Date: Fri Nov 24 11:18:28 2023 +1000 Merge tag 'drm-intel-fixes-2023-11-23' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v6.7-rc3: - Fix race between DP MST connectore registration and setup - Fix GT memory leak on probe error path Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87y1eol98h.fsf@intel.com commit 8692160904c9b8653b36e508c26be3cd9b79402a Merge: fca9a8056358 ab93edb2f94c Author: Dave Airlie Date: Fri Nov 24 11:14:56 2023 +1000 Merge tag 'drm-misc-fixes-2023-11-23' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Fixes for v6.7-rc3: - Panel fixes for innolux and auo,b101uan08.3 panel. - Fix ivpu MMIO reset. - AST fix on connetor disconnection. - nouveau gsp fix. - rockchip color fix. - Fix Himax83102-j02 timings. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/12322257-2e0c-43d3-8241-876aafc10e4a@linux.intel.com commit fca9a80563581468b67017acc0a27a9626822600 Merge: 98b1cc82c4af 56466f653cb5 Author: Dave Airlie Date: Fri Nov 24 10:37:45 2023 +1000 Merge tag 'drm-msm-fixes-2023-11-21' of https://gitlab.freedesktop.org/drm/msm into drm-fixes Fixes for v6.7-rc3: - Fix the VREG_CTRL_1 for 4nm CPHY to match downstream - Remove duplicate call to drm_kms_helper_poll_init() in msm_drm_init() - Fix the safe_lut_tbl[] for sc8280xp to match downstream - Don't attach the drm_dp_set_subconnector_property() for eDP - Fix to attach drm_dp_set_subconnector_property() for DP. Otherwise there is a bootup crash on multiple targets - Remove unnecessary NULL check left behind during cleanup Signed-off-by: Dave Airlie From: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGtkna3P3mvaF53n2ARJACaXQU+OFfShayTrsUVmqCOmNQ@mail.gmail.com commit 7d410d5efe04e42a6cd959bfe6d59d559fdf8b25 Author: Filipe Manana Date: Tue Nov 21 13:38:33 2023 +0000 btrfs: make error messages more clear when getting a chunk map When getting a chunk map, at btrfs_get_chunk_map(), we do some sanity checks to verify we found a chunk map and that map found covers the logical address the caller passed in. However the messages aren't very clear in the sense that don't mention the issue is with a chunk map and one of them prints the 'length' argument as if it were the end offset of the requested range (while the in the string format we use %llu-%llu which suggests a range, and the second %llu-%llu is actually a range for the chunk map). So improve these two details in the error messages. CC: stable@vger.kernel.org # 5.4+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/volumes.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 5fba5a571858ce2d787fdaf55814e42725bfa895 Author: Filipe Manana Date: Tue Nov 21 13:38:32 2023 +0000 btrfs: fix off-by-one when checking chunk map includes logical address At btrfs_get_chunk_map() we get the extent map for the chunk that contains the given logical address stored in the 'logical' argument. Then we do sanity checks to verify the extent map contains the logical address. One of these checks verifies if the extent map covers a range with an end offset behind the target logical address - however this check has an off-by-one error since it will consider an extent map whose start offset plus its length matches the target logical address as inclusive, while the fact is that the last byte it covers is behind the target logical address (by 1). So fix this condition by using '<=' rather than '<' when comparing the extent map's "start + length" against the target logical address. CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/volumes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f91192cd68591c6b037da345bc9fcd5e50540358 Author: Bragatheswaran Manickavel Date: Sat Nov 18 14:40:12 2023 +0530 btrfs: ref-verify: fix memory leaks in btrfs_ref_tree_mod() In btrfs_ref_tree_mod(), when !parent 're' was allocated through kmalloc(). In the following code, if an error occurs, the execution will be redirected to 'out' or 'out_unlock' and the function will be exited. However, on some of the paths, 're' are not deallocated and may lead to memory leaks. For example: lookup_block_entry() for 'be' returns NULL, the out label will be invoked. During that flow ref and 'ra' are freed but not 're', which can potentially lead to a memory leak. CC: stable@vger.kernel.org # 5.10+ Reported-and-tested-by: syzbot+d66de4cbf532749df35f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d66de4cbf532749df35f Signed-off-by: Bragatheswaran Manickavel Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ref-verify.c | 2 ++ 1 file changed, 2 insertions(+) commit 2db313205f8b96eea467691917138d646bb50aef Author: Qu Wenruo Date: Thu Nov 2 07:54:50 2023 +1030 btrfs: add dmesg output for first mount and last unmount of a filesystem There is a feature request to add dmesg output when unmounting a btrfs. There are several alternative methods to do the same thing, but with their own problems: - Use eBPF to watch btrfs_put_super()/open_ctree() Not end user friendly, they have to dip their head into the source code. - Watch for directory /sys/fs// This is way more simple, but still requires some simple device -> uuid lookups. And a script needs to use inotify to watch /sys/fs/. Compared to all these, directly outputting the information into dmesg would be the most simple one, with both device and UUID included. And since we're here, also add the output when mounting a filesystem for the first time for parity. A more fine grained monitoring of subvolume mounts should be done by another layer, like audit. Now mounting a btrfs with all default mkfs options would look like this: [81.906566] BTRFS info (device dm-8): first mount of filesystem 633b5c16-afe3-4b79-b195-138fe145e4f2 [81.907494] BTRFS info (device dm-8): using crc32c (crc32c-intel) checksum algorithm [81.908258] BTRFS info (device dm-8): using free space tree [81.912644] BTRFS info (device dm-8): auto enabling async discard [81.913277] BTRFS info (device dm-8): checking UUID tree [91.668256] BTRFS info (device dm-8): last unmount of filesystem 633b5c16-afe3-4b79-b195-138fe145e4f2 CC: stable@vger.kernel.org # 5.4+ Link: https://github.com/kdave/btrfs-progs/issues/689 Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Reviewed-by: David Sterba [ update changelog ] Signed-off-by: David Sterba fs/btrfs/disk-io.c | 1 + fs/btrfs/super.c | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) commit c0c6bde586c7dce82719b4ff32a2db6af9ee3d65 Author: Stanislav Fomichev Date: Mon Nov 13 20:54:52 2023 -0800 netdevsim: Don't accept device bound programs Commit 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs") introduced device-bound programs by largely reusing existing offloading infrastructure. This changed the semantics of 'prog->aux->offload' a bit. Now, it's non-NULL for both offloaded and device-bound programs. Instead of looking at 'prog->aux->offload' let's call bpf_prog_is_offloaded which should be true iff the program is offloaded and not merely device-bound. Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs") Reported-by: syzbot+44c2416196b7c607f226@syzkaller.appspotmail.com Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann Reviewed-by: Jakub Kicinski Cc: Dipendra Khadka Link: https://lore.kernel.org/bpf/20231114045453.1816995-2-sdf@google.com Signed-off-by: Alexei Starovoitov drivers/net/netdevsim/bpf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 58ac1b3799799069d53f5bf95c093f2fe8dd3cc5 Author: Arnd Bergmann Date: Wed Nov 22 18:15:03 2023 +0100 ARM: PL011: Fix DMA support Since there is no guarantee that the memory returned by dma_alloc_coherent() is associated with a 'struct page', using the architecture specific phys_to_page() is wrong, but using virt_to_page() would be as well. Stop using sg lists altogether and just use the *_single() functions instead. This also simplifies the code a bit since the scatterlists in this driver always have only one entry anyway. https://lore.kernel.org/lkml/86db0fe5-930d-4cbb-bd7d-03367da38951@app.fastmail.com/ Use consistent names for dma buffers gc: Add a commit log from the initial thread: https://lore.kernel.org/lkml/86db0fe5-930d-4cbb-bd7d-03367da38951@app.fastmail.com/ Use consistent names for dma buffers Fixes: cb06ff102e2d7 ("ARM: PL011: Add support for Rx DMA buffer polling.") Signed-off-by: Arnd Bergmann Tested-by: Gregory CLEMENT Signed-off-by: Gregory CLEMENT Cc: stable Link: https://lore.kernel.org/r/20231122171503.235649-1-gregory.clement@bootlin.com Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/amba-pl011.c | 112 +++++++++++++++++++--------------------- 1 file changed, 54 insertions(+), 58 deletions(-) commit 08ce9a1b72e38cf44c300a44ac5858533eb3c860 Author: Daniel Mack Date: Thu Nov 23 08:28:18 2023 +0100 serial: sc16is7xx: address RX timeout interrupt errata This device has a silicon bug that makes it report a timeout interrupt but no data in the FIFO. The datasheet states the following in the errata section 18.1.4: "If the host reads the receive FIFO at the same time as a time-out interrupt condition happens, the host might read 0xCC (time-out) in the Interrupt Indication Register (IIR), but bit 0 of the Line Status Register (LSR) is not set (means there is no data in the receive FIFO)." The errata description seems to indicate it concerns only polled mode of operation when reading bit 0 of the LSR register. However, tests have shown and NXP has confirmed that the RXLVL register also yields 0 when the bug is triggered, and hence the IRQ driven implementation in this driver is equally affected. This bug has hit us on production units and when it does, sc16is7xx_irq() would spin forever because sc16is7xx_port_irq() keeps seeing an interrupt in the IIR register that is not cleared because the driver does not call into sc16is7xx_handle_rx() unless the RXLVL register reports at least one byte in the FIFO. Fix this by always reading one byte from the FIFO when this condition is detected in order to clear the interrupt. This approach was confirmed to be correct by NXP through their support channels. Tested by: Hugo Villeneuve Signed-off-by: Daniel Mack Co-Developed-by: Maxim Popov Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20231123072818.1394539-1-daniel@zonque.org Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/sc16is7xx.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 8973ab7a2441b286218f4a5c4c33680e2f139996 Author: Ronald Wahl Date: Tue Oct 31 12:09:09 2023 +0100 serial: 8250: 8250_omap: Clear UART_HAS_RHR_IT_DIS bit This fixes commit 439c7183e5b9 ("serial: 8250: 8250_omap: Disable RX interrupt after DMA enable") which unfortunately set the UART_HAS_RHR_IT_DIS bit in the UART_OMAP_IER2 register and never cleared it. Cc: stable@vger.kernel.org Fixes: 439c7183e5b9 ("serial: 8250: 8250_omap: Disable RX interrupt after DMA enable") Signed-off-by: Ronald Wahl Reviewed-by: Vignesh Raghavendra Link: https://lore.kernel.org/r/20231031110909.11695-1-rwahl@gmx.de Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/8250/8250_omap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8e42c301ce64e0dcca547626eb486877d502d336 Author: Ronald Wahl Date: Tue Oct 31 14:12:42 2023 +0100 serial: 8250_omap: Add earlycon support for the AM654 UART controller Currently there is no support for earlycon on the AM654 UART controller. This commit adds it. Signed-off-by: Ronald Wahl Reviewed-by: Vignesh Raghavendra Link: https://lore.kernel.org/r/20231031131242.15516-1-rwahl@gmx.de Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/8250/8250_early.c | 1 + 1 file changed, 1 insertion(+) commit c6bb057418876cdfdd29a6f7b8cef54539ee8811 Author: Ronald Wahl Date: Wed Nov 1 18:14:31 2023 +0100 serial: 8250: 8250_omap: Do not start RX DMA on THRI interrupt Starting RX DMA on THRI interrupt is too early because TX may not have finished yet. This change is inspired by commit 90b8596ac460 ("serial: 8250: Prevent starting up DMA Rx on THRI interrupt") and fixes DMA issues I had with an AM62 SoC that is using the 8250 OMAP variant. Cc: stable@vger.kernel.org Fixes: c26389f998a8 ("serial: 8250: 8250_omap: Add DMA support for UARTs on K3 SoCs") Signed-off-by: Ronald Wahl Reviewed-by: Vignesh Raghavendra Link: https://lore.kernel.org/r/20231101171431.16495-1-rwahl@gmx.de Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/8250/8250_omap.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit c0a8574204054effad6ac83cc75c02576e2985fe Author: Masahiro Yamada Date: Sun Nov 19 14:32:34 2023 +0900 arm64: add dependency between vmlinuz.efi and Image A common issue in Makefile is a race in parallel building. You need to be careful to prevent multiple threads from writing to the same file simultaneously. Commit 3939f3345050 ("ARM: 8418/1: add boot image dependencies to not generate invalid images") addressed such a bad scenario. A similar symptom occurs with the following command: $ make -j$(nproc) ARCH=arm64 Image vmlinuz.efi [ snip ] SORTTAB vmlinux OBJCOPY arch/arm64/boot/Image OBJCOPY arch/arm64/boot/Image AS arch/arm64/boot/zboot-header.o PAD arch/arm64/boot/vmlinux.bin GZIP arch/arm64/boot/vmlinuz OBJCOPY arch/arm64/boot/vmlinuz.o LD arch/arm64/boot/vmlinuz.efi.elf OBJCOPY arch/arm64/boot/vmlinuz.efi The log "OBJCOPY arch/arm64/boot/Image" is displayed twice. It indicates that two threads simultaneously enter arch/arm64/boot/ and write to arch/arm64/boot/Image. It occasionally leads to a build failure: $ make -j$(nproc) ARCH=arm64 Image vmlinuz.efi [ snip ] SORTTAB vmlinux OBJCOPY arch/arm64/boot/Image PAD arch/arm64/boot/vmlinux.bin truncate: Invalid number: 'arch/arm64/boot/vmlinux.bin' make[2]: *** [drivers/firmware/efi/libstub/Makefile.zboot:13: arch/arm64/boot/vmlinux.bin] Error 1 make[2]: *** Deleting file 'arch/arm64/boot/vmlinux.bin' make[1]: *** [arch/arm64/Makefile:163: vmlinuz.efi] Error 2 make[1]: *** Waiting for unfinished jobs.... make: *** [Makefile:234: __sub-make] Error 2 vmlinuz.efi depends on Image, but such a dependency is not specified in arch/arm64/Makefile. Signed-off-by: Masahiro Yamada Acked-by: Ard Biesheuvel Reviewed-by: SImon Glass Link: https://lore.kernel.org/r/20231119053234.2367621-1-masahiroy@kernel.org Signed-off-by: Catalin Marinas arch/arm64/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d3fa86b1a7b4cdc4367acacea16b72e0a200b3d7 Merge: 9b6de136b5f0 39f04b1406b2 Author: Linus Torvalds Date: Thu Nov 23 10:40:13 2023 -0800 Merge tag 'net-6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bpf. Current release - regressions: - Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E" - kselftest: rtnetlink: fix ip route command typo Current release - new code bugs: - s390/ism: make sure ism driver implies smc protocol in kconfig - two build fixes for tools/net Previous releases - regressions: - rxrpc: couple of ACK/PING/RTT handling fixes Previous releases - always broken: - bpf: verify bpf_loop() callbacks as if they are called unknown number of times - improve stability of auto-bonding with Hyper-V - account BPF-neigh-redirected traffic in interface statistics Misc: - net: fill in some more MODULE_DESCRIPTION()s" * tag 'net-6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (58 commits) tools: ynl: fix duplicate op name in devlink tools: ynl: fix header path for nfsd net: ipa: fix one GSI register field width tls: fix NULL deref on tls_sw_splice_eof() with empty record net: axienet: Fix check for partial TX checksum vsock/test: fix SEQPACKET message bounds test i40e: Fix adding unsupported cloud filters ice: restore timestamp configuration after device reset ice: unify logic for programming PFINT_TSYN_MSK ice: remove ptp_tx ring parameter flag amd-xgbe: propagate the correct speed and duplex status amd-xgbe: handle the corner-case during tx completion amd-xgbe: handle corner-case during sfp hotplug net: veth: fix ethtool stats reporting octeontx2-pf: Fix ntuple rule creation to direct packet to VF with higher Rx queue than its PF net: usb: qmi_wwan: claim interface 4 for ZTE MF290 Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E" net/smc: avoid data corruption caused by decline nfc: virtual_ncidev: Add variable to check if ndev is running dpll: Fix potential msg memleak when genlmsg_put_reply failed ... commit b0348e459c836abdb0f4b967e006d15c77cf1c87 Author: Paulo Alcantara Date: Tue Nov 21 20:12:55 2023 -0300 smb: client: introduce cifs_sfu_make_node() Remove duplicate code and add new helper for creating special files in SFU (Services for UNIX) format that can be shared by SMB1+ code. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/cifsproto.h | 3 ++ fs/smb/client/smb1ops.c | 80 +++++------------------------------------- fs/smb/client/smb2ops.c | 89 ++++++++++++++++++++++------------------------- 3 files changed, 52 insertions(+), 120 deletions(-) commit 45e724022e2704b5a5193fd96f378822b0448e07 Author: Paulo Alcantara Date: Tue Nov 21 20:12:54 2023 -0300 smb: client: set correct file type from NFS reparse points Handle all file types in NFS reparse points as specified in MS-FSCC 2.1.2.6 Network File System (NFS) Reparse Data Buffer. The client is now able to set all file types based on the parsed NFS reparse point, which used to support only symlinks. This works for SMB1+. Before patch: $ mount.cifs //srv/share /mnt -o ... $ ls -l /mnt ls: cannot access 'block': Operation not supported ls: cannot access 'char': Operation not supported ls: cannot access 'fifo': Operation not supported ls: cannot access 'sock': Operation not supported total 1 l????????? ? ? ? ? ? block l????????? ? ? ? ? ? char -rwxr-xr-x 1 root root 5 Nov 18 23:22 f0 l????????? ? ? ? ? ? fifo l--------- 1 root root 0 Nov 18 23:23 link -> f0 l????????? ? ? ? ? ? sock After patch: $ mount.cifs //srv/share /mnt -o ... $ ls -l /mnt total 1 brwxr-xr-x 1 root root 123, 123 Nov 18 00:34 block crwxr-xr-x 1 root root 1234, 1234 Nov 18 00:33 char -rwxr-xr-x 1 root root 5 Nov 18 23:22 f0 prwxr-xr-x 1 root root 0 Nov 18 23:23 fifo lrwxr-xr-x 1 root root 0 Nov 18 23:23 link -> f0 srwxr-xr-x 1 root root 0 Nov 19 2023 sock Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/cifsglob.h | 8 +++- fs/smb/client/cifspdu.h | 2 +- fs/smb/client/cifsproto.h | 4 +- fs/smb/client/inode.c | 51 ++++++++++++++++++++--- fs/smb/client/readdir.c | 6 ++- fs/smb/client/smb1ops.c | 3 +- fs/smb/client/smb2inode.c | 2 +- fs/smb/client/smb2ops.c | 101 ++++++++++++++++++++++++---------------------- 8 files changed, 116 insertions(+), 61 deletions(-) commit 539aad7f14dab7f947e5ab81901c0b20513a50db Author: Paulo Alcantara Date: Tue Nov 21 20:12:53 2023 -0300 smb: client: introduce ->parse_reparse_point() Parse reparse point into cifs_open_info_data structure and feed it through cifs_open_info_to_fattr(). Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/cifsglob.h | 6 ++++-- fs/smb/client/inode.c | 23 ++++++++++++++--------- fs/smb/client/smb1ops.c | 41 +++++++++++++++++++++++------------------ fs/smb/client/smb2ops.c | 28 +++++++++++++++------------- 4 files changed, 56 insertions(+), 42 deletions(-) commit ed3e0a149b58ea8cfd10cc4f7cefb39877ff07ac Author: Paulo Alcantara Date: Tue Nov 21 20:12:52 2023 -0300 smb: client: implement ->query_reparse_point() for SMB1 Reparse points are not limited to symlinks, so implement ->query_reparse_point() in order to handle different file types. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/cifspdu.h | 2 +- fs/smb/client/cifsproto.h | 9 +++ fs/smb/client/cifssmb.c | 193 ++++++++++++++++++---------------------------- fs/smb/client/smb1ops.c | 49 +++--------- fs/smb/client/smb2ops.c | 35 ++++----- 5 files changed, 113 insertions(+), 175 deletions(-) commit a15ccef82d3de9a37dc25898c60a394209368dc8 Author: Ritvik Budhiraja Date: Tue Nov 21 19:13:47 2023 +0530 cifs: fix use after free for iface while disabling secondary channels We were deferencing iface after it has been released. Fix is to release after all dereference instances have been encountered. Signed-off-by: Ritvik Budhiraja Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202311110815.UJaeU3Tt-lkp@intel.com/ Signed-off-by: Steve French fs/smb/client/sess.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit da90e45d5afc4da2de7cd3ea7943d0f1baa47cc2 Author: Asuna Yang Date: Wed Nov 22 22:18:03 2023 +0800 USB: serial: option: add Luat Air72*U series products Update the USB serial option driver support for Luat Air72*U series products. ID 1782:4e00 Spreadtrum Communications Inc. UNISOC-8910 T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1782 ProdID=4e00 Rev=00.00 S: Manufacturer=UNISOC S: Product=UNISOC-8910 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=400mA I: If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=4096ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms If#= 2: AT If#= 3: PPP + AT If#= 4: Debug Co-developed-by: Yangyu Chen Signed-off-by: Yangyu Chen Signed-off-by: Asuna Yang Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+) commit 477865af60b2117ceaa1d558e03559108c15c78c Author: Wenchao Chen Date: Wed Nov 15 16:34:06 2023 +0800 mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled With cat regulator_summary, we found that vqmmc was not shutting down after the card was pulled. cat /sys/kernel/debug/regulator/regulator_summary 1.before fix 1)Insert SD card vddsdio 1 1 0 unknown 3500mV 0mA 1200mV 3750mV 71100000.mmc-vqmmc 1 0mA 3500mV 3600mV 2)Pull out the SD card vddsdio 1 1 0 unknown 3500mV 0mA 1200mV 3750mV 71100000.mmc-vqmmc 1 0mA 3500mV 3600mV 2.after fix 1)Insert SD cardt vddsdio 1 1 0 unknown 3500mV 0mA 1200mV 3750mV 71100000.mmc-vqmmc 1 0mA 3500mV 3600mV 2)Pull out the SD card vddsdio 0 1 0 unknown 3500mV 0mA 1200mV 3750mV 71100000.mmc-vqmmc 0 0mA 3500mV 3600mV Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller") Signed-off-by: Wenchao Chen Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20231115083406.7368-1-wenchao.chen@unisoc.com Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-sprd.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) commit d9ed644f58670865cf067351deb71010bd87a52f Author: Kornel Dulęba Date: Tue Nov 14 11:54:49 2023 +0000 mmc: sdhci-pci-gli: Disable LPM during initialization To address IO performance commit f9e5b33934ce ("mmc: host: Improve I/O read/write performance for GL9763E") limited LPM negotiation to runtime suspend state. The problem is that it only flips the switch in the runtime PM resume/suspend logic. Disable LPM negotiation in gl9763e_add_host. This helps in two ways: 1. It was found that the LPM switch stays in the same position after warm reboot. Having it set in init helps with consistency. 2. Disabling LPM during the first runtime resume leaves us susceptible to the performance issue in the time window between boot and the first runtime suspend. Fixes: f9e5b33934ce ("mmc: host: Improve I/O read/write performance for GL9763E") Cc: stable@vger.kernel.org Signed-off-by: Kornel Dulęba Reviewed-by: Sven van Ashbrook Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20231114115516.1585361-1-korneld@chromium.org Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-pci-gli.c | 54 +++++++++++++++++++++------------------- 1 file changed, 29 insertions(+), 25 deletions(-) commit 39f04b1406b23fcc129a67e70d6205d5a7322f38 Author: Jakub Kicinski Date: Wed Nov 22 19:05:58 2023 -0800 tools: ynl: fix duplicate op name in devlink We don't support CRUD-inspired message types in YNL too well. One aspect that currently trips us up is the fact that single message ID can be used in multiple commands (as the response). This leads to duplicate entries in the id-to-string tables: devlink-user.c:19:34: warning: initialized field overwritten [-Woverride-init] 19 | [DEVLINK_CMD_PORT_NEW] = "port-new", | ^~~~~~~~~~ devlink-user.c:19:34: note: (near initialization for ‘devlink_op_strmap[7]’) Fixes tag points at where the code was generated, the "real" problem is that the code generator does not support CRUD. Fixes: f2f9dd164db0 ("netlink: specs: devlink: add the remaining command to generate complete split_ops") Link: https://lore.kernel.org/r/20231123030558.1611831-1-kuba@kernel.org Signed-off-by: Jakub Kicinski tools/net/ynl/generated/devlink-user.c | 2 +- tools/net/ynl/ynl-gen-c.py | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) commit 2be35a619482c1f4e5bc7a2d84049b8d7d171882 Author: Jakub Kicinski Date: Wed Nov 22 19:06:24 2023 -0800 tools: ynl: fix header path for nfsd The makefile dependency is trying to include the wrong header: : fatal error: ../../../../include/uapi//linux/nfsd.h: No such file or directory The guard also looks wrong. Fixes: f14122b2c2ac ("tools: ynl: Add source files for nfsd netlink protocol") Reviewed-by: Chuck Lever Link: https://lore.kernel.org/r/20231123030624.1611925-1-kuba@kernel.org Signed-off-by: Jakub Kicinski tools/net/ynl/Makefile.deps | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 37f0205538baf70beb57cdcb6c7d14aa13257926 Author: Alex Elder Date: Wed Nov 22 17:17:08 2023 -0600 net: ipa: fix one GSI register field width The width of the R_LENGTH field of the EV_CH_E_CNTXT_1 GSI register is 24 bits (not 20 bits) starting with IPA v5.0. Fix this. Fixes: faf0678ec8a0 ("net: ipa: add IPA v5.0 GSI register definitions") Signed-off-by: Alex Elder Link: https://lore.kernel.org/r/20231122231708.896632-1-elder@linaro.org Signed-off-by: Jakub Kicinski drivers/net/ipa/reg/gsi_reg-v5.0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 53f2cb491b500897a619ff6abd72f565933760f0 Author: Jann Horn Date: Wed Nov 22 22:44:47 2023 +0100 tls: fix NULL deref on tls_sw_splice_eof() with empty record syzkaller discovered that if tls_sw_splice_eof() is executed as part of sendfile() when the plaintext/ciphertext sk_msg are empty, the send path gets confused because the empty ciphertext buffer does not have enough space for the encryption overhead. This causes tls_push_record() to go on the `split = true` path (which is only supposed to be used when interacting with an attached BPF program), and then get further confused and hit the tls_merge_open_record() path, which then assumes that there must be at least one populated buffer element, leading to a NULL deref. It is possible to have empty plaintext/ciphertext buffers if we previously bailed from tls_sw_sendmsg_locked() via the tls_trim_both_msgs() path. tls_sw_push_pending_record() already handles this case correctly; let's do the same check in tls_sw_splice_eof(). Fixes: df720d288dbb ("tls/sw: Use splice_eof() to flush") Cc: stable@vger.kernel.org Reported-by: syzbot+40d43509a099ea756317@syzkaller.appspotmail.com Signed-off-by: Jann Horn Link: https://lore.kernel.org/r/20231122214447.675768-1-jannh@google.com Signed-off-by: Jakub Kicinski net/tls/tls_sw.c | 3 +++ 1 file changed, 3 insertions(+) commit fd0413bbf8b11f56e8aa842783b0deda0dfe2926 Author: Samuel Holland Date: Tue Nov 21 16:42:17 2023 -0800 net: axienet: Fix check for partial TX checksum Due to a typo, the code checked the RX checksum feature in the TX path. Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver") Signed-off-by: Samuel Holland Reviewed-by: Andrew Lunn Reviewed-by: Radhey Shyam Pandey Link: https://lore.kernel.org/r/20231122004219.3504219-1-samuel.holland@sifive.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f0863888f6cfef33e3117dccfe94fa78edf76be4 Author: Arseniy Krasnov Date: Wed Nov 22 00:16:42 2023 +0300 vsock/test: fix SEQPACKET message bounds test Tune message length calculation to make this test work on machines where 'getpagesize()' returns >32KB. Now maximum message length is not hardcoded (on machines above it was smaller than 'getpagesize()' return value, thus we get negative value and test fails), but calculated at runtime and always bigger than 'getpagesize()' result. Reproduced on aarch64 with 64KB page size. Fixes: 5c338112e48a ("test/vsock: rework message bounds test") Signed-off-by: Arseniy Krasnov Reported-by: Bogdan Marcynkov Reviewed-by: Stefano Garzarella Link: https://lore.kernel.org/r/20231121211642.163474-1-avkrasnov@salutedevices.com Signed-off-by: Jakub Kicinski tools/testing/vsock/vsock_test.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) commit 4e20655e503e3a478cd1682bf25e3202dd823da8 Author: Ivan Vecera Date: Tue Nov 21 13:13:36 2023 -0800 i40e: Fix adding unsupported cloud filters If a VF tries to add unsupported cloud filter through virtchnl then i40e_add_del_cloud_filter(_big_buf) returns -ENOTSUPP but this error code is stored in 'ret' instead of 'aq_ret' that is used as error code sent back to VF. In this scenario where one of the mentioned functions fails the value of 'aq_ret' is zero so the VF will incorrectly receive a 'success'. Use 'aq_ret' to store return value and remove 'ret' local variable. Additionally fix the issue when filter allocation fails, in this case no notification is sent back to the VF. Fixes: e284fc280473 ("i40e: Add and delete cloud filter") Reviewed-by: Simon Horman Signed-off-by: Ivan Vecera Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20231121211338.3348677-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) commit 4662817aed5a9d6c695658d0105d8ff4b84ac6cb Author: Michael Walle Date: Tue Sep 5 10:49:21 2023 +0200 drm/mediatek: fix kernel oops if no crtc is found drm_crtc_from_index(0) might return NULL if there are no CRTCs registered at all which will lead to a kernel oops in mtk_drm_crtc_dma_dev_get(). Add the missing return value check. Fixes: 0d9eee9118b7 ("drm/mediatek: Add drm ovl_adaptor sub driver for MT8195") Signed-off-by: Michael Walle Reviewed-by: Nícolas F. R. A. Prado Tested-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Tested-by: Eugen Hristev Reviewed-by: Eugen Hristev Link: https://patchwork.kernel.org/project/dri-devel/patch/20230905084922.3908121-1-mwalle@kernel.org/ Signed-off-by: Chun-Kuang Hu drivers/gpu/drm/mediatek/mtk_drm_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 9aa6a662c309e6f8770972840948af963bd6ff34 Author: AngeloGioacchino Del Regno Date: Wed Oct 25 12:49:40 2023 +0200 drm/mediatek: mtk_disp_gamma: Fix breakage due to merge issue While the commit that was sent to the mailing lists was fine, something happened during merge and the mtk_gamma_set() function got broken as a writel() was turned into a readl(). Fix that by changing that back to the expected writel(). Fixes: a6b39cd248f3 ("drm/mediatek: De-commonize disp_aal/disp_gamma gamma_set functions") Signed-off-by: AngeloGioacchino Del Regno Link: https://patchwork.kernel.org/project/dri-devel/patch/20231025104940.140605-1-angelogioacchino.delregno@collabora.com/ Signed-off-by: Chun-Kuang Hu drivers/gpu/drm/mediatek/mtk_disp_gamma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e50a8061feac92edd7cb9315a078edd03a96715f Merge: d9775fb6d011 7758017911a4 Author: Paolo Abeni Date: Thu Nov 23 15:27:35 2023 +0100 Merge branch 'ice-restore-timestamp-config-after-reset' Tony Nguyen says: ==================== ice: restore timestamp config after reset Jake Keller says: We recently discovered during internal validation that the ice driver has not been properly restoring Tx timestamp configuration after a device reset, which resulted in application failures after a device reset. After some digging, it turned out this problem is two-fold. Since the introduction of the PTP support the driver has been clobbering the storage of the current timestamp configuration during reset. Thus after a reset, the driver will no longer perform Tx or Rx timestamps, and will report timestamp configuration as disabled if SIOCGHWTSTAMP ioctl is issued. In addition, the recently merged auxiliary bus support code missed that PFINT_TSYN_MSK must be reprogrammed on the clock owner for E822 devices. Failure to restore this register configuration results in the driver no longer responding to interrupts from other ports. Depending on the traffic pattern, this can either result in increased latency responding to timestamps on the non-owner ports, or it can result in the driver never reporting any timestamps. The configuration of PFINT_TSYN_MSK was only done during initialization. Due to this, the Tx timestamp issue persists even if userspace reconfigures timestamping. This series fixes both issues, as well as removes a redundant Tx ring field since we can rely on the skb flag as the primary detector for a Tx timestamp request. Note that I don't think this series will directly apply to older stable releases (even v6.6) as we recently refactored a lot of the PTP code to support auxiliary bus. Patch 2/3 only matters for the post-auxiliary bus implementation. The principle of patch 1/3 and 3/3 could apply as far back as the initial PTP support, but I don't think it will apply cleanly as-is. ==================== Link: https://lore.kernel.org/r/20231121211259.3348630-1-anthony.l.nguyen@intel.com Signed-off-by: Paolo Abeni commit 7758017911a4f2578d54c318e8fe77bcb5899054 Author: Jacob Keller Date: Tue Nov 21 13:12:57 2023 -0800 ice: restore timestamp configuration after device reset The driver calls ice_ptp_cfg_timestamp() during ice_ptp_prepare_for_reset() to disable timestamping while the device is resetting. This operation destroys the user requested configuration. While the driver does call ice_ptp_cfg_timestamp in ice_rebuild() to restore some hardware settings after a reset, it unconditionally passes true or false, resulting in failure to restore previous user space configuration. This results in a device reset forcibly disabling timestamp configuration regardless of current user settings. This was not detected previously due to a quirk of the LinuxPTP ptp4l application. If ptp4l detects a missing timestamp, it enters a fault state and performs recovery logic which includes executing SIOCSHWTSTAMP again, restoring the now accidentally cleared configuration. Not every application does this, and for these applications, timestamps will mysteriously stop after a PF reset, without being restored until an application restart. Fix this by replacing ice_ptp_cfg_timestamp() with two new functions: 1) ice_ptp_disable_timestamp_mode() which unconditionally disables the timestamping logic in ice_ptp_prepare_for_reset() and ice_ptp_release() 2) ice_ptp_restore_timestamp_mode() which calls ice_ptp_restore_tx_interrupt() to restore Tx timestamping configuration, calls ice_set_rx_tstamp() to restore Rx timestamping configuration, and issues an immediate TSYN_TX interrupt to ensure that timestamps which may have occurred during the device reset get processed. Modify the ice_ptp_set_timestamp_mode to directly save the user configuration and then call ice_ptp_restore_timestamp_mode. This way, reset no longer destroys the saved user configuration. This obsoletes the ice_set_tx_tstamp() function which can now be safely removed. With this change, all devices should now restore Tx and Rx timestamping functionality correctly after a PF reset without application intervention. Fixes: 77a781155a65 ("ice: enable receive hardware timestamping") Fixes: ea9b847cda64 ("ice: enable transmit timestamps for E810 devices") Signed-off-by: Jacob Keller Reviewed-by: Jesse Brandeburg Reviewed-by: Simon Horman Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Signed-off-by: Paolo Abeni drivers/net/ethernet/intel/ice/ice_main.c | 12 ++--- drivers/net/ethernet/intel/ice/ice_ptp.c | 74 +++++++++++++++++++------------ drivers/net/ethernet/intel/ice/ice_ptp.h | 5 +-- 3 files changed, 51 insertions(+), 40 deletions(-) commit 7d606a1e2d0575b6c3a2600f43f90d1e409f9661 Author: Jacob Keller Date: Tue Nov 21 13:12:56 2023 -0800 ice: unify logic for programming PFINT_TSYN_MSK Commit d938a8cca88a ("ice: Auxbus devices & driver for E822 TS") modified how Tx timestamps are handled for E822 devices. On these devices, only the clock owner handles reading the Tx timestamp data from firmware. To do this, the PFINT_TSYN_MSK register is modified from the default value to one which enables reacting to a Tx timestamp on all PHY ports. The driver currently programs PFINT_TSYN_MSK in different places depending on whether the port is the clock owner or not. For the clock owner, the PFINT_TSYN_MSK value is programmed during ice_ptp_init_owner just before calling ice_ptp_tx_ena_intr to program the PHY ports. For the non-clock owner ports, the PFINT_TSYN_MSK is programmed during ice_ptp_init_port. If a large enough device reset occurs, the PFINT_TSYN_MSK register will be reset to the default value in which only the PHY associated directly with the PF will cause the Tx timestamp interrupt to trigger. The driver lacks logic to reprogram the PFINT_TSYN_MSK register after a device reset. For the E822 device, this results in the PF no longer responding to interrupts for other ports. This results in failure to deliver Tx timestamps to user space applications. Rename ice_ptp_configure_tx_tstamp to ice_ptp_cfg_tx_interrupt, and unify the logic for programming PFINT_TSYN_MSK and PFINT_OICR_ENA into one place. This function will program both registers according to the combination of user configuration and device requirements. This ensures that PFINT_TSYN_MSK is always restored when we configure the Tx timestamp interrupt. Fixes: d938a8cca88a ("ice: Auxbus devices & driver for E822 TS") Signed-off-by: Jacob Keller Reviewed-by: Jesse Brandeburg Reviewed-by: Simon Horman Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Signed-off-by: Paolo Abeni drivers/net/ethernet/intel/ice/ice_ptp.c | 60 ++++++++++++++++++-------------- 1 file changed, 34 insertions(+), 26 deletions(-) commit 0ffb08b1a45bd6b7694e01da0e1d9e3e788418fb Author: Jacob Keller Date: Tue Nov 21 13:12:55 2023 -0800 ice: remove ptp_tx ring parameter flag Before performing a Tx timestamp in ice_stamp(), the driver checks a ptp_tx ring variable to see if timestamping is enabled on that ring. This value is set for all rings whenever userspace configures Tx timestamping. Ostensibly this was done to avoid wasting cycles checking other fields when timestamping has not been enabled. However, for Tx timestamps we already get an individual per-SKB flag indicating whether userspace wants to request a timestamp on that packet. We do not gain much by also having a separate flag to check for whether timestamping was enabled. In fact, the driver currently fails to restore the field after a PF reset. Because of this, if a PF reset occurs, timestamps will be disabled. Since this flag doesn't add value in the hotpath, remove it and always provide a timestamp if the SKB flag has been set. A following change will fix the reset path to properly restore user timestamping configuration completely. This went unnoticed for some time because one of the most common applications using Tx timestamps, ptp4l, will reconfigure the socket as part of its fault recovery logic. Fixes: ea9b847cda64 ("ice: enable transmit timestamps for E810 devices") Signed-off-by: Jacob Keller Reviewed-by: Jesse Brandeburg Reviewed-by: Simon Horman Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Signed-off-by: Paolo Abeni drivers/net/ethernet/intel/ice/ice_ptp.c | 14 -------------- drivers/net/ethernet/intel/ice/ice_txrx.c | 3 --- drivers/net/ethernet/intel/ice/ice_txrx.h | 1 - 3 files changed, 18 deletions(-) commit 460e462d22542adfafd8a5bc979437df73f1cbf3 Author: Mark Brown Date: Thu Nov 16 12:52:29 2023 +0000 kselftest/arm64: Fix output formatting for za-fork The za-fork test does not output a newline when reporting the result of the one test it runs, causing the counts printed by kselftest to be included in the test name. Add the newline. Fixes: 266679ffd867 ("kselftest/arm64: Convert za-fork to use kselftest.h") Cc: # 6.4.x Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20231116-arm64-fix-za-fork-output-v1-1-42c03d4f5759@kernel.org Signed-off-by: Catalin Marinas tools/testing/selftests/arm64/fp/za-fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d9775fb6d011cb97b4106c40840dc982be99fec3 Merge: 818ad9cc90d4 7a2323ac24a5 Author: Paolo Abeni Date: Thu Nov 23 13:47:25 2023 +0100 Merge branch 'amd-xgbe-fixes-to-handle-corner-cases' Raju Rangoju says: ==================== amd-xgbe: fixes to handle corner-cases This series include bug fixes to amd-xgbe driver. ==================== Link: https://lore.kernel.org/r/20231121191435.4049995-1-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit 7a2323ac24a50311f64a3a9b54ed5bef5821ecae Author: Raju Rangoju Date: Wed Nov 22 00:44:35 2023 +0530 amd-xgbe: propagate the correct speed and duplex status xgbe_get_link_ksettings() does not propagate correct speed and duplex information to ethtool during cable unplug. Due to which ethtool reports incorrect values for speed and duplex. Address this by propagating correct information. Fixes: 7c12aa08779c ("amd-xgbe: Move the PHY support into amd-xgbe") Acked-by: Shyam Sundar S K Signed-off-by: Raju Rangoju Reviewed-by: Wojciech Drewek Signed-off-by: Paolo Abeni drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 7121205d5330c6a3cb3379348886d47c77b78d06 Author: Raju Rangoju Date: Wed Nov 22 00:44:34 2023 +0530 amd-xgbe: handle the corner-case during tx completion The existing implementation uses software logic to accumulate tx completions until the specified time (1ms) is met and then poll them. However, there exists a tiny gap which leads to a race between resetting and checking the tx_activate flag. Due to this the tx completions are not reported to upper layer and tx queue timeout kicks-in restarting the device. To address this, introduce a tx cleanup mechanism as part of the periodic maintenance process. Fixes: c5aa9e3b8156 ("amd-xgbe: Initial AMD 10GbE platform driver") Acked-by: Shyam Sundar S K Signed-off-by: Raju Rangoju Reviewed-by: Wojciech Drewek Signed-off-by: Paolo Abeni drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit 676ec53844cbdf2f47e68a076cdff7f0ec6cbe3f Author: Raju Rangoju Date: Wed Nov 22 00:44:33 2023 +0530 amd-xgbe: handle corner-case during sfp hotplug Force the mode change for SFI in Fixed PHY configurations. Fixed PHY configurations needs PLL to be enabled while doing mode set. When the SFP module isn't connected during boot, driver assumes AN is ON and attempts auto-negotiation. However, if the connected SFP comes up in Fixed PHY configuration the link will not come up as PLL isn't enabled while the initial mode set command is issued. So, force the mode change for SFI in Fixed PHY configuration to fix link issues. Fixes: e57f7a3feaef ("amd-xgbe: Prepare for working with more than one type of phy") Acked-by: Shyam Sundar S K Signed-off-by: Raju Rangoju Reviewed-by: Wojciech Drewek Signed-off-by: Paolo Abeni drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) commit 347ecf29a68cc8958fbcbd26ef410d07fe9d82f4 Author: Shengjiu Wang Date: Thu Nov 23 09:14:53 2023 +0800 ASoC: fsl_xcvr: refine the requested phy clock frequency As the input phy clock frequency will divided by 2 by default on i.MX8MP with the implementation of clk-imx8mp-audiomix driver, So the requested frequency need to be updated. The relation of phy clock is: sai_pll_ref_sel sai_pll sai_pll_bypass sai_pll_out sai_pll_out_div2 earc_phy_cg Signed-off-by: Shengjiu Wang Reviewed-by: Iuliana Prodan Link: https://lore.kernel.org/r/1700702093-8008-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown sound/soc/fsl/fsl_xcvr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 505c83212da5bfca95109421b8f5d9f8c6cdfef2 Author: AngeloGioacchino Del Regno Date: Thu Nov 23 09:44:54 2023 +0100 ASoC: SOF: mediatek: mt8186: Add Google Steelix topology compatible Add the machine compatible and topology filename for the Google Steelix MT8186 Chromebook to load the correct SOF topology file. Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20231123084454.20471-1-angelogioacchino.delregno@collabora.com Signed-off-by: Mark Brown sound/soc/sof/mediatek/mt8186/mt8186.c | 3 +++ 1 file changed, 3 insertions(+) commit 3841d8a563a7473ceb7415ecfe577e20b2a66d37 Author: Johan Hovold Date: Thu Nov 23 10:18:15 2023 +0100 ASoC: soc-pcm: fix up bad merge A recent change to address pops and clicks with codecs like WSA883X touched the same code paths as a fix for clearing DAI parameters and resulted in a bad merge. Specifically, commit f0220575e65a ("ASoC: soc-dai: add flag to mute and unmute stream during trigger") made mute at stream close conditional, while commit 3efcb471f871 ("ASoC: soc-pcm.c: Make sure DAI parameters cleared if the DAI becomes inactive") moved that same mute call back to soc_pcm_hw_clean(). Fix up the bad merge by dropping the second mute call from soc_pcm_clean() and making sure that the call in soc_pcm_hw_clean() is conditional as intended. Fixes: bdb7e1922052 ("ASoC: Merge up workaround for CODECs that play noise on stopped stream") Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20231123091815.21933-1-johan+linaro@kernel.org Signed-off-by: Mark Brown sound/soc/soc-pcm.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit fb103b90e944ecd664577c0fd37a069282dcd294 Author: Hans de Goede Date: Mon Nov 20 16:42:35 2023 +0100 platform/x86: asus-wmi: Filter Volume key presses if also reported via atkbd Use the i8042-filter to check if Volume key presses are also reported via atkbd and if yes then filter out the WMI events to avoid reporting each key-press twice. Note depending on in which order the PS/2 data vs the WMI event are handled the first volume key press may still be reported twice. This is a compromise versus DMI quirks (unmaintainable) or other more complex solutions. Closes: https://bbs.archlinux.org/viewtopic.php?pid=2128536#p2128536 Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20231120154235.610808-4-hdegoede@redhat.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/asus-nb-wmi.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) commit 6db829fa2f1295aaad51a3c00f6fc57a27c444bb Author: Hans de Goede Date: Mon Nov 20 16:42:34 2023 +0100 platform/x86: asus-wmi: Change q500a_i8042_filter() into a generic i8042-filter Change asus_q500a_i8042_filter() into a generic i8042-filter, using a new filter_i8042_e1_extended_codes flag in the quirks struct to decide if e1 extended codes should be filtered out or not. This is a preparation patch for adding support for filtering volume key events being reported twice through both the PS/2 keyboard and asus-wmi. Note while modifying the code also drop the unnecessary unlikely() annotations, this is not in a hot path so those are not necessary. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20231120154235.610808-3-hdegoede@redhat.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/asus-nb-wmi.c | 27 +++++++++++++++------------ drivers/platform/x86/asus-wmi.c | 8 ++++---- drivers/platform/x86/asus-wmi.h | 7 ++++--- 3 files changed, 23 insertions(+), 19 deletions(-) commit b52cbca22cbf6c9d2700c1e576d0ddcc670e49d5 Author: Hans de Goede Date: Mon Nov 20 16:42:33 2023 +0100 platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code asus-nb-wmi calls i8042_install_filter() in some cases, but it never calls i8042_remove_filter(). This means that a dangling pointer to the filter function is left after rmmod leading to crashes. Fix this by moving the i8042-filter installation to the shared asus-wmi code and also remove it from the shared code on driver unbind. Fixes: b5643539b825 ("platform/x86: asus-wmi: Filter buggy scan codes on ASUS Q500A") Cc: Oleksij Rempel Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20231120154235.610808-2-hdegoede@redhat.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/Kconfig | 2 +- drivers/platform/x86/asus-nb-wmi.c | 11 ----------- drivers/platform/x86/asus-wmi.c | 8 ++++++++ 3 files changed, 9 insertions(+), 12 deletions(-) commit 818ad9cc90d4a7165caaee7e32800c50d0564ec3 Author: Lorenzo Bianconi Date: Tue Nov 21 20:08:44 2023 +0100 net: veth: fix ethtool stats reporting Fix a possible misalignment between page_pool stats and tx xdp_stats reported in veth_get_ethtool_stats routine. The issue can be reproduced configuring the veth pair with the following tx/rx queues: $ip link add v0 numtxqueues 2 numrxqueues 4 type veth peer name v1 \ numtxqueues 1 numrxqueues 1 and loading a simple XDP program on v0 that just returns XDP_PASS. In this case on v0 the page_pool stats overwrites tx xdp_stats for queue 1. Fix the issue incrementing pp_idx of dev->real_num_tx_queues * VETH_TQ_STATS_LEN since we always report xdp_stats for all tx queues in ethtool. Fixes: 4fc418053ec7 ("net: veth: add page_pool stats") Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/c5b5d0485016836448453f12846c7c4ab75b094a.1700593593.git.lorenzo@kernel.org Signed-off-by: Paolo Abeni drivers/net/veth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4aa1d8f89b10cdc25a231dabf808d8935e0b137a Author: Suman Ghosh Date: Tue Nov 21 22:26:24 2023 +0530 octeontx2-pf: Fix ntuple rule creation to direct packet to VF with higher Rx queue than its PF It is possible to add a ntuple rule which would like to direct packet to a VF whose number of queues are greater/less than its PF's queue numbers. For example a PF can have 2 Rx queues but a VF created on that PF can have 8 Rx queues. As of today, ntuple rule will reject rule because it is checking the requested queue number against PF's number of Rx queues. As a part of this fix if the action of a ntuple rule is to move a packet to a VF's queue then the check is removed. Also, a debug information is printed to aware user that it is user's responsibility to cross check if the requested queue number on that VF is a valid one. Fixes: f0a1913f8a6f ("octeontx2-pf: Add support for ethtool ntuple filters") Signed-off-by: Suman Ghosh Reviewed-by: Wojciech Drewek Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20231121165624.3664182-1-sumang@marvell.com Signed-off-by: Paolo Abeni .../net/ethernet/marvell/octeontx2/nic/otx2_flows.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) commit 744f5e7b69710701dc225020769138f8ca2894df Author: Ronald Wahl Date: Mon Oct 30 20:01:13 2023 +0100 dmaengine: ti: k3-psil-am62: Fix SPI PDMA data AM62x has 3 SPI channels where each channel has 4 TX and 4 RX threads. This also fixes the thread numbers. Signed-off-by: Ronald Wahl Fixes: 5ac6bfb58777 ("dmaengine: ti: k3-psil: Add AM62x PSIL and PDMA data") Reviewed-by: Jai Luthra Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20231030190113.16782-1-rwahl@gmx.de Signed-off-by: Vinod Koul drivers/dma/ti/k3-psil-am62.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 7bf9a6b46549852a37e6d07e52c601c3c706b562 Author: Stefano Stabellini Date: Wed Nov 22 15:07:41 2023 -0800 arm/xen: fix xen_vcpu_info allocation alignment xen_vcpu_info is a percpu area than needs to be mapped by Xen. Currently, it could cross a page boundary resulting in Xen being unable to map it: [ 0.567318] kernel BUG at arch/arm64/xen/../../arm/xen/enlighten.c:164! [ 0.574002] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Fix the issue by using __alloc_percpu and requesting alignment for the memory allocation. Signed-off-by: Stefano Stabellini Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2311221501340.2053963@ubuntu-linux-20-04-desktop Fixes: 24d5373dda7c ("arm/xen: Use alloc_percpu rather than __alloc_percpu") Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/arm/xen/enlighten.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 99360d9620f09fb8bc15548d855011bbb198c680 Author: Lech Perczak Date: Sat Nov 18 00:19:18 2023 +0100 net: usb: qmi_wwan: claim interface 4 for ZTE MF290 Interface 4 is used by for QMI interface in stock firmware of MF28D, the router which uses MF290 modem. Rebind it to qmi_wwan after freeing it up from option driver. The proper configuration is: Interface mapping is: 0: QCDM, 1: (unknown), 2: AT (PCUI), 2: AT (Modem), 4: QMI T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=19d2 ProdID=0189 Rev= 0.00 S: Manufacturer=ZTE, Incorporated S: Product=ZTE LTE Technologies MSM C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms Cc: Bjørn Mork Signed-off-by: Lech Perczak Link: https://lore.kernel.org/r/20231117231918.100278-3-lech.perczak@gmail.com Signed-off-by: Paolo Abeni drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+) commit 8f96e29aae31354191227ad476dc7f6147ef1d75 Author: Stephan Gerhold Date: Tue Nov 14 11:07:45 2023 +0100 pmdomain: qcom: rpmpd: Set GENPD_FLAG_ACTIVE_WAKEUP Set GENPD_FLAG_ACTIVE_WAKEUP for all RPM power domains so that power domains necessary for wakeup/"awake path" devices are kept on across suspend. This is needed for example for the *_AO ("active-only") variants of the RPMPDs used by the CPU. Those should maintain their votes also across system suspend to ensure the CPU can keep running for the whole suspend process (ending in a firmware call). When the RPM firmware detects that the CPUs are in a deep idle state it will drop those votes automatically. Signed-off-by: Stephan Gerhold Reviewed-by: Ulf Hansson Signed-off-by: Viresh Kumar drivers/pmdomain/qcom/rpmpd.c | 1 + 1 file changed, 1 insertion(+) commit d6048a19a7104ce90dcc140d03dbe5796af3acd4 Author: Stephan Gerhold Date: Tue Nov 14 11:07:44 2023 +0100 cpufreq: qcom-nvmem: Preserve PM domain votes in system suspend >From the Linux point of view, the power domains used by the CPU must stay always-on. This is because we still need the CPU to keep running until the last instruction, which will typically be a firmware call that shuts down the CPU cleanly. At the moment the power domain votes (enable + performance state) are dropped during system suspend, which means the CPU could potentially malfunction while entering suspend. We need to distinguish between two different setups used with qcom-cpufreq-nvmem: 1. CPR power domain: The backing regulator used by CPR should stay always-on in Linux; it is typically disabled automatically by hardware when the CPU enters a deep idle state. However, we should pause the CPR state machine during system suspend. 2. RPMPD: The power domains used by the CPU should stay always-on in Linux (also across system suspend). The CPU typically only uses the *_AO ("active-only") variants of the power domains in RPMPD. For those, the RPM firmware will automatically drop the votes internally when the CPU enters a deep idle state. Make this work correctly by calling device_set_awake_path() on the virtual genpd devices, so that the votes are maintained across system suspend. The power domain drivers need to set GENPD_FLAG_ACTIVE_WAKEUP to opt into staying on during system suspend. For now we only set this for the RPMPD case. For CPR, not setting it will ensure the state machine is still paused during system suspend, while the backing regulator will stay on with "regulator-always-on". Signed-off-by: Stephan Gerhold Reviewed-by: Ulf Hansson Signed-off-by: Viresh Kumar drivers/cpufreq/qcom-cpufreq-nvmem.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) commit 5cbff51e709a72a60b0416b00521b835a1f9a3d5 Author: Stephan Gerhold Date: Tue Nov 14 11:07:43 2023 +0100 cpufreq: qcom-nvmem: Enable virtual power domain devices The genpd core caches performance state votes from devices that are runtime suspended as of commit 3c5a272202c2 ("PM: domains: Improve runtime PM performance state handling"). They get applied once the device becomes active again. To attach the power domains needed by qcom-cpufreq-nvmem the OPP core calls genpd_dev_pm_attach_by_id(). This results in "virtual" dummy devices that use runtime PM only to control the enable and performance state for the attached power domain. However, at the moment nothing ever resumes the virtual devices created for qcom-cpufreq-nvmem. They remain permanently runtime suspended. This means that performance state votes made during cpufreq scaling get always cached and never applied to the hardware. Fix this by enabling the devices after attaching them. Without this fix performance states votes are silently ignored, and the CPU/CPR voltage is never adjusted. This has been broken since 5.14 but for some reason no one noticed this on QCS404 so far. Fixes: 1cb8339ca225 ("cpufreq: qcom: Add support for qcs404 on nvmem driver") Signed-off-by: Stephan Gerhold Reviewed-by: Ulf Hansson Signed-off-by: Viresh Kumar drivers/cpufreq/qcom-cpufreq-nvmem.c | 46 +++++++++++++++++++++++++++++++++--- 1 file changed, 43 insertions(+), 3 deletions(-) commit 2e4e0984c7d696cc74cf2fd7e7f62997f0e9ebe6 Author: Christoph Niedermaier Date: Wed Nov 22 14:41:13 2023 +0100 cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily For a 900MHz i.MX6ULL CPU the 792MHz OPP is disabled. There is no convincing reason to disable this OPP. If a CPU can run at 900MHz, it should also be able to cope with 792MHz. Looking at the voltage level of 792MHz in [1] (page 24, table 10. "Operating Ranges") the current defined OPP is above the minimum. So the voltage level shouldn't be a problem. However in [2] (page 24, table 10. "Operating Ranges"), it is not mentioned that 792MHz OPP isn't allowed. Change it to only disable 792MHz OPP for i.MX6ULL types below 792 MHz. [1] https://www.nxp.com/docs/en/data-sheet/IMX6ULLIEC.pdf [2] https://www.nxp.com/docs/en/data-sheet/IMX6ULLCEC.pdf Fixes: 0aa9abd4c212 ("cpufreq: imx6q: check speed grades for i.MX6ULL") Signed-off-by: Christoph Niedermaier Reviewed-by: Marek Vasut Reviewed-by: Fabio Estevam [ Viresh: Edited subject ] Signed-off-by: Viresh Kumar drivers/cpufreq/imx6q-cpufreq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0e6c4fe782e683ff55a27fbb10e9c6b5c241533b Author: Arnd Bergmann Date: Wed Nov 22 23:47:19 2023 +0100 nvme: tcp: fix compile-time checks for TLS mode When CONFIG_NVME_KEYRING is enabled as a loadable module, but the TCP host code is built-in, it fails to link: arm-linux-gnueabi-ld: drivers/nvme/host/tcp.o: in function `nvme_tcp_setup_ctrl': tcp.c:(.text+0x1940): undefined reference to `nvme_tls_psk_default' The problem is that the compile-time conditionals are inconsistent here, using a mix of #ifdef CONFIG_NVME_TCP_TLS, IS_ENABLED(CONFIG_NVME_TCP_TLS) and IS_ENABLED(CONFIG_NVME_KEYRING) checks, with CONFIG_NVME_KEYRING controlling whether the implementation is actually built. Change it to use IS_ENABLED(CONFIG_NVME_KEYRING) checks consistently, which should help readability and make it less error-prone. Combining it with the check for the ctrl->opts->tls flag lets the compiler drop all the TLS code in configurations without this feature, which also helps runtime behavior in addition to avoiding the link failure. To make it possible for the compiler to build the dead code, both the tls_handshake_timeout variable and the TLS specific members of nvme_tcp_queue need to be moved out of the #ifdef block as well, but at least the former of these gets optimized out again. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20231122224719.4042108-4-arnd@kernel.org Signed-off-by: Jens Axboe drivers/nvme/host/tcp.c | 31 ++++++++++++++----------------- 1 file changed, 14 insertions(+), 17 deletions(-) commit 65e2a74c44ddfa174b700f5da2d1d29b4ba6639b Author: Arnd Bergmann Date: Wed Nov 22 23:47:18 2023 +0100 nvme: target: fix Kconfig select statements When the NVME target code is built-in but its TCP frontend is a loadable module, enabling keyring support causes a link failure: x86_64-linux-ld: vmlinux.o: in function `nvmet_ports_make': configfs.c:(.text+0x100a211): undefined reference to `nvme_keyring_id' The problem is that CONFIG_NVME_TARGET_TCP_TLS is a 'bool' symbol that depends on the tristate CONFIG_NVME_TARGET_TCP, so any 'select' from it inherits the state of the tristate symbol rather than the intended CONFIG_NVME_TARGET one that contains the actual call. The same thing is true for CONFIG_KEYS, which itself is required for NVME_KEYRING. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20231122224719.4042108-3-arnd@kernel.org Signed-off-by: Jens Axboe drivers/nvme/target/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d78abcbabe7e98bb4baa4dea87550806944790ed Author: Arnd Bergmann Date: Wed Nov 22 23:47:17 2023 +0100 nvme: target: fix nvme_keyring_id() references In configurations without CONFIG_NVME_TARGET_TCP_TLS, the keyring code might not be available, or using it will result in a runtime failure: x86_64-linux-ld: vmlinux.o: in function `nvmet_ports_make': configfs.c:(.text+0x100a211): undefined reference to `nvme_keyring_id' Add a check to ensure we only check the keyring if there is a chance of it being used, which avoids both the runtime and link-time problems. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20231122224719.4042108-2-arnd@kernel.org Signed-off-by: Jens Axboe drivers/nvme/target/configfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 36a1c2ee50f573972aea3c3019555f47ee0094c0 Author: Dave Jiang Date: Fri Nov 17 13:18:48 2023 -0700 cxl/hdm: Fix a benign lockdep splat The new helper "cxl_num_decoders_committed()" added a lockdep assertion to validate that port->commit_end is protected against modification. That assertion fires in init_hdm_decoder() where it is initializing port->commit_end. Given that it is both accessing and writing that property it obstensibly needs the lock. In practice, CXL decoder commit rules (must commit in order) and the in-order discovery of device decoders makes the manipulation of ->commit_end in init_hdm_decoder() safe. However, rather than rely on the subtle rules of CXL hardware, just make the implementation obviously correct from a software perspective. The Fixes: tag is only for cleaning up a lockdep splat, there is no functional issue addressed by this fix. Fixes: 458ba8189cb4 ("cxl: Add cxl_decoders_committed() helper") Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/170025232811.2147250.16376901801315194121.stgit@djiang5-mobl3 Acked-by: Davidlohr Bueso Signed-off-by: Dan Williams drivers/cxl/core/hdm.c | 2 ++ 1 file changed, 2 insertions(+) commit 76d9eafff4484547ed9e606c8227ac9799a9f2da Author: Mathieu Desnoyers Date: Wed Nov 15 10:50:18 2023 -0500 MAINTAINERS: TRACING: Add Mathieu Desnoyers as Reviewer In order to make sure I get CC'd on tracing changes for which my input would be relevant, add my name as reviewer of the TRACING subsystem. Link: https://lore.kernel.org/linux-trace-kernel/20231115155018.8236-1-mathieu.desnoyers@efficios.com Acked-by: Masami Hiramatsu (Google) Signed-off-by: Mathieu Desnoyers Signed-off-by: Steven Rostedt (Google) MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit f49f950c217bfb40f11662bab39cb388d41e4cfb Author: Steven Rostedt (Google) Date: Tue Nov 21 18:10:07 2023 -0500 eventfs: Make sure that parent->d_inode is locked in creating files/dirs Since the locking of the parent->d_inode has been moved outside the creation of the files and directories (as it use to be locked via a conditional), add a WARN_ON_ONCE() to the case that it's not locked. Link: https://lkml.kernel.org/r/20231121231112.853962542@goodmis.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Andrew Morton Reviewed-by: Josef Bacik Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 4 ++++ 1 file changed, 4 insertions(+) commit fc4561226feaad5fcdcb55646c348d77b8ee69c5 Author: Steven Rostedt (Google) Date: Tue Nov 21 18:10:06 2023 -0500 eventfs: Do not allow NULL parent to eventfs_start_creating() The eventfs directory is dynamically created via the meta data supplied by the existing trace events. All files and directories in eventfs has a parent. Do not allow NULL to be passed into eventfs_start_creating() as the parent because that should never happen. Warn if it does. Link: https://lkml.kernel.org/r/20231121231112.693841807@goodmis.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Andrew Morton Reviewed-by: Josef Bacik Signed-off-by: Steven Rostedt (Google) fs/tracefs/inode.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) commit bcae32c5632fc0a0dbce46fa731cd23403117e66 Author: Steven Rostedt (Google) Date: Tue Nov 21 18:10:05 2023 -0500 eventfs: Move taking of inode_lock into dcache_dir_open_wrapper() The both create_file_dentry() and create_dir_dentry() takes a boolean parameter "lookup", as on lookup the inode_lock should already be taken, but for dcache_dir_open_wrapper() it is not taken. There's no reason that the dcache_dir_open_wrapper() can't take the inode_lock before calling these functions. In fact, it's better if it does, as the lock can be held throughout both directory and file creations. This also simplifies the code, and possibly prevents unexpected race conditions when the lock is released. Link: https://lkml.kernel.org/r/20231121231112.528544825@goodmis.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Andrew Morton Fixes: 5790b1fb3d672 ("eventfs: Remove eventfs_file and just use eventfs_inode") Reviewed-by: Josef Bacik Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) commit 4763d635c907baed212664dc579dde1663bb2676 Author: Steven Rostedt (Google) Date: Tue Nov 21 18:10:04 2023 -0500 eventfs: Use GFP_NOFS for allocation when eventfs_mutex is held If memory reclaim happens, it can reclaim file system pages. The file system pages from eventfs may take the eventfs_mutex on reclaim. This means that allocation while holding the eventfs_mutex must not call into filesystem reclaim. A lockdep splat uncovered this. Link: https://lkml.kernel.org/r/20231121231112.373501894@goodmis.org Cc: Masami Hiramatsu Cc: Andrew Morton Fixes: 28e12c09f5aa0 ("eventfs: Save ownership and mode") Fixes: 5790b1fb3d672 ("eventfs: Remove eventfs_file and just use eventfs_inode") Reported-by: Mark Rutland Reviewed-by: Josef Bacik Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 57686a72da08ae555d93148aa8756b16417a6aff Author: Arnaldo Carvalho de Melo Date: Thu Nov 9 16:34:09 2023 -0300 tools: Disable __packed attribute compiler warning due to -Werror=attributes Noticed on several perf tools cross build test containers: [perfbuilder@five ~]$ grep FAIL ~/dm.log/summary 19 10.18 debian:experimental-x-mips : FAIL gcc version 12.3.0 (Debian 12.3.0-6) 20 11.21 debian:experimental-x-mips64 : FAIL gcc version 12.3.0 (Debian 12.3.0-6) 21 11.30 debian:experimental-x-mipsel : FAIL gcc version 12.3.0 (Debian 12.3.0-6) 37 12.07 ubuntu:18.04-x-arm : FAIL gcc version 7.5.0 (Ubuntu/Linaro 7.5.0-3ubuntu1~18.04) 42 11.91 ubuntu:18.04-x-riscv64 : FAIL gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04) 44 13.17 ubuntu:18.04-x-sh4 : FAIL gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04) 45 12.09 ubuntu:18.04-x-sparc64 : FAIL gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04) [perfbuilder@five ~]$ In file included from util/intel-pt-decoder/intel-pt-pkt-decoder.c:10: /tmp/perf-6.6.0-rc1/tools/include/asm-generic/unaligned.h: In function 'get_unaligned_le16': /tmp/perf-6.6.0-rc1/tools/include/asm-generic/unaligned.h:13:29: error: packed attribute causes inefficient alignment for 'x' [-Werror=attributes] 13 | const struct { type x; } __packed *__pptr = (typeof(__pptr))(ptr); \ | ^ /tmp/perf-6.6.0-rc1/tools/include/asm-generic/unaligned.h:27:28: note: in expansion of macro '__get_unaligned_t' 27 | return le16_to_cpu(__get_unaligned_t(__le16, p)); | ^~~~~~~~~~~~~~~~~ This comes from the kernel, where the -Wattributes and -Wpacked isn't used, -Wpacked is already disabled, do it for the attributes as well. Fixes: a91c987254651443 ("perf tools: Add get_unaligned_leNN()") Suggested-by: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/7c5b626c-1de9-4c12-a781-e44985b4a797@intel.com Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim tools/include/asm-generic/unaligned.h | 1 + 1 file changed, 1 insertion(+) commit 35732699f5d2922ff674e711e566cf44a4bd86d2 Author: Dave Jiang Date: Wed Nov 22 08:33:53 2023 -0700 ACPI: Fix ARM32 platforms compile issue introduced by fw_table changes Linus reported that: After commit a103f46633fd the kernel stopped compiling for several ARM32 platforms that I am building with a bare metal compiler. Bare metal compilers (arm-none-eabi-) don't define __linux__. This is because the header is now in the include path for : CC arch/arm/kernel/irq.o CC kernel/sysctl.o CC crypto/api.o In file included from ../include/acpi/acpi.h:22, from ../include/linux/fw_table.h:29, from ../include/linux/acpi.h:18, from ../include/linux/irqchip.h:14, from ../arch/arm/kernel/irq.c:25: ../include/acpi/platform/acenv.h:218:2: error: #error Unknown target environment 218 | #error Unknown target environment | ^~~~~ The issue is caused by the introducing of splitting out the ACPI code to support the new generic fw_table code. Rafael suggested [1] moving the fw_table.h include in linux/acpi.h to below the linux/mutex.h. Remove the two includes in fw_table.h. Replace linux/fw_table.h include in fw_table.c with linux/acpi.h. Link: https://lore.kernel.org/linux-acpi/CAJZ5v0idWdJq3JSqQWLG5q+b+b=zkEdWR55rGYEoxh7R6N8kFQ@mail.gmail.com/ Fixes: a103f46633fd ("acpi: Move common tables helper functions to common lib") Closes: https://lore.kernel.org/linux-acpi/20231114-arm-build-bug-v1-1-458745fe32a4@linaro.org/ Reported-by: Linus Walleij Suggested-by: Rafael J. Wysocki Tested-by: Linus Walleij Signed-off-by: Dave Jiang Acked-by: Rafael J. Wysocki Signed-off-by: Rafael J. Wysocki include/linux/acpi.h | 22 +++++++++++----------- include/linux/fw_table.h | 3 --- lib/fw_table.c | 2 +- 3 files changed, 12 insertions(+), 15 deletions(-) commit a29ee6aea7030786a63fde0d6d83a8f477b060fb Author: Oliver Upton Date: Tue Nov 21 19:29:56 2023 +0000 perf build: Ensure sysreg-defs Makefile respects output dir Currently the sysreg-defs are written out to the source tree unconditionally, ignoring the specified output directory. Correct the build rule to emit the header to the output directory. Opportunistically reorganize the rules to avoid interleaving with the set of beauty make rules. Reported-by: Ian Rogers Signed-off-by: Oliver Upton Link: https://lore.kernel.org/r/20231121192956.919380-3-oliver.upton@linux.dev Signed-off-by: Namhyung Kim tools/arch/arm64/tools/Makefile | 2 +- tools/perf/Makefile.perf | 24 +++++++++++++++--------- tools/perf/util/Build | 2 +- tools/testing/selftests/kvm/Makefile | 5 +++-- 4 files changed, 20 insertions(+), 13 deletions(-) commit ef5c958090a909c9f2ab717ba6abb86869e42da7 Author: Oliver Upton Date: Tue Nov 21 19:29:55 2023 +0000 tools perf: Add arm64 sysreg files to MANIFEST Ian pointed out that source tarballs are incomplete as of commit e2bdd172e665 ("perf build: Generate arm64's sysreg-defs.h and add to include path"), since the source files needed from the kernel tree do not appear in the manifest. Add them. Reported-by: Ian Rogers Fixes: e2bdd172e665 ("perf build: Generate arm64's sysreg-defs.h and add to include path") Signed-off-by: Oliver Upton Link: https://lore.kernel.org/r/20231121192956.919380-2-oliver.upton@linux.dev Signed-off-by: Namhyung Kim tools/perf/MANIFEST | 2 ++ 1 file changed, 2 insertions(+) commit 027905fe5baec70a00e00890e982d035d6c8b6b3 Author: Namhyung Kim Date: Tue Nov 21 14:56:49 2023 -0800 tools/perf: Update tools's copy of mips syscall table tldr; Just FYI, I'm carrying this on the perf tools tree. Full explanation: There used to be no copies, with tools/ code using kernel headers directly. From time to time tools/perf/ broke due to legitimate kernel hacking. At some point Linus complained about such direct usage. Then we adopted the current model. The way these headers are used in perf are not restricted to just including them to compile something. There are sometimes used in scripts that convert defines into string tables, etc, so some change may break one of these scripts, or new MSRs may use some different #define pattern, etc. E.g.: $ ls -1 tools/perf/trace/beauty/*.sh | head -5 tools/perf/trace/beauty/arch_errno_names.sh tools/perf/trace/beauty/drm_ioctl.sh tools/perf/trace/beauty/fadvise.sh tools/perf/trace/beauty/fsconfig.sh tools/perf/trace/beauty/fsmount.sh $ $ tools/perf/trace/beauty/fadvise.sh static const char *fadvise_advices[] = { [0] = "NORMAL", [1] = "RANDOM", [2] = "SEQUENTIAL", [3] = "WILLNEED", [4] = "DONTNEED", [5] = "NOREUSE", }; $ The tools/perf/check-headers.sh script, part of the tools/ build process, points out changes in the original files. So its important not to touch the copies in tools/ when doing changes in the original kernel headers, that will be done later, when check-headers.sh inform about the change to the perf tools hackers. Cc: Thomas Bogendoerfer Cc: linux-mips@vger.kernel.org Signed-off-by: Namhyung Kim Link: https://lore.kernel.org/r/20231121225650.390246-14-namhyung@kernel.org tools/perf/arch/mips/entry/syscalls/syscall_n64.tbl | 4 ++++ 1 file changed, 4 insertions(+) commit d3968c974a2453de9289bdb9d34130b2ce323628 Author: Namhyung Kim Date: Tue Nov 21 14:56:48 2023 -0800 tools/perf: Update tools's copy of s390 syscall table tldr; Just FYI, I'm carrying this on the perf tools tree. Full explanation: There used to be no copies, with tools/ code using kernel headers directly. From time to time tools/perf/ broke due to legitimate kernel hacking. At some point Linus complained about such direct usage. Then we adopted the current model. The way these headers are used in perf are not restricted to just including them to compile something. There are sometimes used in scripts that convert defines into string tables, etc, so some change may break one of these scripts, or new MSRs may use some different #define pattern, etc. E.g.: $ ls -1 tools/perf/trace/beauty/*.sh | head -5 tools/perf/trace/beauty/arch_errno_names.sh tools/perf/trace/beauty/drm_ioctl.sh tools/perf/trace/beauty/fadvise.sh tools/perf/trace/beauty/fsconfig.sh tools/perf/trace/beauty/fsmount.sh $ $ tools/perf/trace/beauty/fadvise.sh static const char *fadvise_advices[] = { [0] = "NORMAL", [1] = "RANDOM", [2] = "SEQUENTIAL", [3] = "WILLNEED", [4] = "DONTNEED", [5] = "NOREUSE", }; $ The tools/perf/check-headers.sh script, part of the tools/ build process, points out changes in the original files. So its important not to touch the copies in tools/ when doing changes in the original kernel headers, that will be done later, when check-headers.sh inform about the change to the perf tools hackers. Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Alexander Gordeev Cc: Christian Borntraeger Cc: Sven Schnelle Cc: linux-s390@vger.kernel.org Signed-off-by: Namhyung Kim Link: https://lore.kernel.org/r/20231121225650.390246-13-namhyung@kernel.org tools/perf/arch/s390/entry/syscalls/syscall.tbl | 4 ++++ 1 file changed, 4 insertions(+) commit 3483d2440538aa2575c3cddac0b7f42d488570cf Author: Namhyung Kim Date: Tue Nov 21 14:56:47 2023 -0800 tools/perf: Update tools's copy of powerpc syscall table tldr; Just FYI, I'm carrying this on the perf tools tree. Full explanation: There used to be no copies, with tools/ code using kernel headers directly. From time to time tools/perf/ broke due to legitimate kernel hacking. At some point Linus complained about such direct usage. Then we adopted the current model. The way these headers are used in perf are not restricted to just including them to compile something. There are sometimes used in scripts that convert defines into string tables, etc, so some change may break one of these scripts, or new MSRs may use some different #define pattern, etc. E.g.: $ ls -1 tools/perf/trace/beauty/*.sh | head -5 tools/perf/trace/beauty/arch_errno_names.sh tools/perf/trace/beauty/drm_ioctl.sh tools/perf/trace/beauty/fadvise.sh tools/perf/trace/beauty/fsconfig.sh tools/perf/trace/beauty/fsmount.sh $ $ tools/perf/trace/beauty/fadvise.sh static const char *fadvise_advices[] = { [0] = "NORMAL", [1] = "RANDOM", [2] = "SEQUENTIAL", [3] = "WILLNEED", [4] = "DONTNEED", [5] = "NOREUSE", }; $ The tools/perf/check-headers.sh script, part of the tools/ build process, points out changes in the original files. So its important not to touch the copies in tools/ when doing changes in the original kernel headers, that will be done later, when check-headers.sh inform about the change to the perf tools hackers. Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Christophe Leroy Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Namhyung Kim Link: https://lore.kernel.org/r/20231121225650.390246-12-namhyung@kernel.org tools/perf/arch/powerpc/entry/syscalls/syscall.tbl | 4 ++++ 1 file changed, 4 insertions(+) commit b3b11aed147af8f7c3d79c5b0b7474505d1dde7b Author: Namhyung Kim Date: Tue Nov 21 14:56:46 2023 -0800 tools/perf: Update tools's copy of x86 syscall table tldr; Just FYI, I'm carrying this on the perf tools tree. Full explanation: There used to be no copies, with tools/ code using kernel headers directly. From time to time tools/perf/ broke due to legitimate kernel hacking. At some point Linus complained about such direct usage. Then we adopted the current model. The way these headers are used in perf are not restricted to just including them to compile something. There are sometimes used in scripts that convert defines into string tables, etc, so some change may break one of these scripts, or new MSRs may use some different #define pattern, etc. E.g.: $ ls -1 tools/perf/trace/beauty/*.sh | head -5 tools/perf/trace/beauty/arch_errno_names.sh tools/perf/trace/beauty/drm_ioctl.sh tools/perf/trace/beauty/fadvise.sh tools/perf/trace/beauty/fsconfig.sh tools/perf/trace/beauty/fsmount.sh $ $ tools/perf/trace/beauty/fadvise.sh static const char *fadvise_advices[] = { [0] = "NORMAL", [1] = "RANDOM", [2] = "SEQUENTIAL", [3] = "WILLNEED", [4] = "DONTNEED", [5] = "NOREUSE", }; $ The tools/perf/check-headers.sh script, part of the tools/ build process, points out changes in the original files. So its important not to touch the copies in tools/ when doing changes in the original kernel headers, that will be done later, when check-headers.sh inform about the change to the perf tools hackers. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: x86@kernel.org Cc: "H. Peter Anvin" Signed-off-by: Namhyung Kim Link: https://lore.kernel.org/r/20231121225650.390246-11-namhyung@kernel.org tools/perf/arch/x86/entry/syscalls/syscall_64.tbl | 3 +++ 1 file changed, 3 insertions(+) commit e1d7426bb9156d34d385d0516a7309c8f33c55bc Author: Namhyung Kim Date: Tue Nov 21 14:56:45 2023 -0800 tools headers: Update tools's copy of s390/asm headers tldr; Just FYI, I'm carrying this on the perf tools tree. Full explanation: There used to be no copies, with tools/ code using kernel headers directly. From time to time tools/perf/ broke due to legitimate kernel hacking. At some point Linus complained about such direct usage. Then we adopted the current model. The way these headers are used in perf are not restricted to just including them to compile something. There are sometimes used in scripts that convert defines into string tables, etc, so some change may break one of these scripts, or new MSRs may use some different #define pattern, etc. E.g.: $ ls -1 tools/perf/trace/beauty/*.sh | head -5 tools/perf/trace/beauty/arch_errno_names.sh tools/perf/trace/beauty/drm_ioctl.sh tools/perf/trace/beauty/fadvise.sh tools/perf/trace/beauty/fsconfig.sh tools/perf/trace/beauty/fsmount.sh $ $ tools/perf/trace/beauty/fadvise.sh static const char *fadvise_advices[] = { [0] = "NORMAL", [1] = "RANDOM", [2] = "SEQUENTIAL", [3] = "WILLNEED", [4] = "DONTNEED", [5] = "NOREUSE", }; $ The tools/perf/check-headers.sh script, part of the tools/ build process, points out changes in the original files. So its important not to touch the copies in tools/ when doing changes in the original kernel headers, that will be done later, when check-headers.sh inform about the change to the perf tools hackers. Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Alexander Gordeev Cc: Christian Borntraeger Cc: Sven Schnelle Cc: linux-s390@vger.kernel.org Signed-off-by: Namhyung Kim Link: https://lore.kernel.org/r/20231121225650.390246-10-namhyung@kernel.org tools/arch/s390/include/uapi/asm/kvm.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit fad8afdcc18ff72e1d90c558be364f26534b8a5b Author: Namhyung Kim Date: Tue Nov 21 14:56:44 2023 -0800 tools headers: Update tools's copy of arm64/asm headers tldr; Just FYI, I'm carrying this on the perf tools tree. Full explanation: There used to be no copies, with tools/ code using kernel headers directly. From time to time tools/perf/ broke due to legitimate kernel hacking. At some point Linus complained about such direct usage. Then we adopted the current model. The way these headers are used in perf are not restricted to just including them to compile something. There are sometimes used in scripts that convert defines into string tables, etc, so some change may break one of these scripts, or new MSRs may use some different #define pattern, etc. E.g.: $ ls -1 tools/perf/trace/beauty/*.sh | head -5 tools/perf/trace/beauty/arch_errno_names.sh tools/perf/trace/beauty/drm_ioctl.sh tools/perf/trace/beauty/fadvise.sh tools/perf/trace/beauty/fsconfig.sh tools/perf/trace/beauty/fsmount.sh $ $ tools/perf/trace/beauty/fadvise.sh static const char *fadvise_advices[] = { [0] = "NORMAL", [1] = "RANDOM", [2] = "SEQUENTIAL", [3] = "WILLNEED", [4] = "DONTNEED", [5] = "NOREUSE", }; $ The tools/perf/check-headers.sh script, part of the tools/ build process, points out changes in the original files. So its important not to touch the copies in tools/ when doing changes in the original kernel headers, that will be done later, when check-headers.sh inform about the change to the perf tools hackers. Cc: Catalin Marinas Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Namhyung Kim Link: https://lore.kernel.org/r/20231121225650.390246-9-namhyung@kernel.org tools/arch/arm64/include/asm/cputype.h | 5 ++++- tools/arch/arm64/include/uapi/asm/kvm.h | 32 +++++++++++++++++++++++++++ tools/arch/arm64/include/uapi/asm/perf_regs.h | 10 +++++---- 3 files changed, 42 insertions(+), 5 deletions(-) commit c23708f37652b74570409725e0bd70a81c275867 Author: Namhyung Kim Date: Tue Nov 21 14:56:43 2023 -0800 tools headers: Update tools's copy of x86/asm headers tldr; Just FYI, I'm carrying this on the perf tools tree. Full explanation: There used to be no copies, with tools/ code using kernel headers directly. From time to time tools/perf/ broke due to legitimate kernel hacking. At some point Linus complained about such direct usage. Then we adopted the current model. The way these headers are used in perf are not restricted to just including them to compile something. There are sometimes used in scripts that convert defines into string tables, etc, so some change may break one of these scripts, or new MSRs may use some different #define pattern, etc. E.g.: $ ls -1 tools/perf/trace/beauty/*.sh | head -5 tools/perf/trace/beauty/arch_errno_names.sh tools/perf/trace/beauty/drm_ioctl.sh tools/perf/trace/beauty/fadvise.sh tools/perf/trace/beauty/fsconfig.sh tools/perf/trace/beauty/fsmount.sh $ $ tools/perf/trace/beauty/fadvise.sh static const char *fadvise_advices[] = { [0] = "NORMAL", [1] = "RANDOM", [2] = "SEQUENTIAL", [3] = "WILLNEED", [4] = "DONTNEED", [5] = "NOREUSE", }; $ The tools/perf/check-headers.sh script, part of the tools/ build process, points out changes in the original files. So its important not to touch the copies in tools/ when doing changes in the original kernel headers, that will be done later, when check-headers.sh inform about the change to the perf tools hackers. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: x86@kernel.org Cc: "H. Peter Anvin" Signed-off-by: Namhyung Kim Link: https://lore.kernel.org/r/20231121225650.390246-8-namhyung@kernel.org tools/arch/x86/include/asm/cpufeatures.h | 16 +++++++++++++++- tools/arch/x86/include/asm/disabled-features.h | 16 ++++++++++++++-- tools/arch/x86/include/asm/msr-index.h | 23 +++++++++++++++++++---- tools/arch/x86/include/uapi/asm/prctl.h | 12 ++++++++++++ 4 files changed, 60 insertions(+), 7 deletions(-) commit fd2ddee727d1ae9296b3875087410cc3698885f0 Author: Namhyung Kim Date: Tue Nov 21 14:56:42 2023 -0800 tools headers: Update tools's copy of socket.h header tldr; Just FYI, I'm carrying this on the perf tools tree. Full explanation: There used to be no copies, with tools/ code using kernel headers directly. From time to time tools/perf/ broke due to legitimate kernel hacking. At some point Linus complained about such direct usage. Then we adopted the current model. The way these headers are used in perf are not restricted to just including them to compile something. There are sometimes used in scripts that convert defines into string tables, etc, so some change may break one of these scripts, or new MSRs may use some different #define pattern, etc. E.g.: $ ls -1 tools/perf/trace/beauty/*.sh | head -5 tools/perf/trace/beauty/arch_errno_names.sh tools/perf/trace/beauty/drm_ioctl.sh tools/perf/trace/beauty/fadvise.sh tools/perf/trace/beauty/fsconfig.sh tools/perf/trace/beauty/fsmount.sh $ $ tools/perf/trace/beauty/fadvise.sh static const char *fadvise_advices[] = { [0] = "NORMAL", [1] = "RANDOM", [2] = "SEQUENTIAL", [3] = "WILLNEED", [4] = "DONTNEED", [5] = "NOREUSE", }; $ The tools/perf/check-headers.sh script, part of the tools/ build process, points out changes in the original files. So its important not to touch the copies in tools/ when doing changes in the original kernel headers, that will be done later, when check-headers.sh inform about the change to the perf tools hackers. Cc: netdev@vger.kernel.org Signed-off-by: Namhyung Kim Link: https://lore.kernel.org/r/20231121225650.390246-7-namhyung@kernel.org tools/perf/trace/beauty/include/linux/socket.h | 1 + 1 file changed, 1 insertion(+) commit 91c97b36bd6939a5c3c29de9e83e6359146c6939 Author: Namhyung Kim Date: Tue Nov 21 14:56:41 2023 -0800 tools headers UAPI: Update tools's copy of unistd.h header tldr; Just FYI, I'm carrying this on the perf tools tree. Full explanation: There used to be no copies, with tools/ code using kernel headers directly. From time to time tools/perf/ broke due to legitimate kernel hacking. At some point Linus complained about such direct usage. Then we adopted the current model. The way these headers are used in perf are not restricted to just including them to compile something. There are sometimes used in scripts that convert defines into string tables, etc, so some change may break one of these scripts, or new MSRs may use some different #define pattern, etc. E.g.: $ ls -1 tools/perf/trace/beauty/*.sh | head -5 tools/perf/trace/beauty/arch_errno_names.sh tools/perf/trace/beauty/drm_ioctl.sh tools/perf/trace/beauty/fadvise.sh tools/perf/trace/beauty/fsconfig.sh tools/perf/trace/beauty/fsmount.sh $ $ tools/perf/trace/beauty/fadvise.sh static const char *fadvise_advices[] = { [0] = "NORMAL", [1] = "RANDOM", [2] = "SEQUENTIAL", [3] = "WILLNEED", [4] = "DONTNEED", [5] = "NOREUSE", }; $ The tools/perf/check-headers.sh script, part of the tools/ build process, points out changes in the original files. So its important not to touch the copies in tools/ when doing changes in the original kernel headers, that will be done later, when check-headers.sh inform about the change to the perf tools hackers. Cc: Arnd Bergmann Cc: linux-arch@vger.kernel.org Signed-off-by: Namhyung Kim Link: https://lore.kernel.org/r/20231121225650.390246-6-namhyung@kernel.org tools/include/uapi/asm-generic/unistd.h | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit daa97513415525e4d17c4978f3c47a7b7e935b36 Author: Namhyung Kim Date: Tue Nov 21 14:56:40 2023 -0800 tools headers UAPI: Update tools's copy of vhost.h header tldr; Just FYI, I'm carrying this on the perf tools tree. Full explanation: There used to be no copies, with tools/ code using kernel headers directly. From time to time tools/perf/ broke due to legitimate kernel hacking. At some point Linus complained about such direct usage. Then we adopted the current model. The way these headers are used in perf are not restricted to just including them to compile something. There are sometimes used in scripts that convert defines into string tables, etc, so some change may break one of these scripts, or new MSRs may use some different #define pattern, etc. E.g.: $ ls -1 tools/perf/trace/beauty/*.sh | head -5 tools/perf/trace/beauty/arch_errno_names.sh tools/perf/trace/beauty/drm_ioctl.sh tools/perf/trace/beauty/fadvise.sh tools/perf/trace/beauty/fsconfig.sh tools/perf/trace/beauty/fsmount.sh $ $ tools/perf/trace/beauty/fadvise.sh static const char *fadvise_advices[] = { [0] = "NORMAL", [1] = "RANDOM", [2] = "SEQUENTIAL", [3] = "WILLNEED", [4] = "DONTNEED", [5] = "NOREUSE", }; $ The tools/perf/check-headers.sh script, part of the tools/ build process, points out changes in the original files. So its important not to touch the copies in tools/ when doing changes in the original kernel headers, that will be done later, when check-headers.sh inform about the change to the perf tools hackers. Cc: "Michael S. Tsirkin" Cc: Jason Wang Cc: kvm@vger.kernel.org Cc: virtualization@lists.linux.dev Cc: netdev@vger.kernel.org Signed-off-by: Namhyung Kim Link: https://lore.kernel.org/r/20231121225650.390246-5-namhyung@kernel.org tools/include/uapi/linux/vhost.h | 8 ++++++++ 1 file changed, 8 insertions(+) commit fb3648a6a87b674540f0ba7701a353006c408065 Author: Namhyung Kim Date: Tue Nov 21 14:56:39 2023 -0800 tools headers UAPI: Update tools's copy of mount.h header tldr; Just FYI, I'm carrying this on the perf tools tree. Full explanation: There used to be no copies, with tools/ code using kernel headers directly. From time to time tools/perf/ broke due to legitimate kernel hacking. At some point Linus complained about such direct usage. Then we adopted the current model. The way these headers are used in perf are not restricted to just including them to compile something. There are sometimes used in scripts that convert defines into string tables, etc, so some change may break one of these scripts, or new MSRs may use some different #define pattern, etc. E.g.: $ ls -1 tools/perf/trace/beauty/*.sh | head -5 tools/perf/trace/beauty/arch_errno_names.sh tools/perf/trace/beauty/drm_ioctl.sh tools/perf/trace/beauty/fadvise.sh tools/perf/trace/beauty/fsconfig.sh tools/perf/trace/beauty/fsmount.sh $ $ tools/perf/trace/beauty/fadvise.sh static const char *fadvise_advices[] = { [0] = "NORMAL", [1] = "RANDOM", [2] = "SEQUENTIAL", [3] = "WILLNEED", [4] = "DONTNEED", [5] = "NOREUSE", }; $ The tools/perf/check-headers.sh script, part of the tools/ build process, points out changes in the original files. So its important not to touch the copies in tools/ when doing changes in the original kernel headers, that will be done later, when check-headers.sh inform about the change to the perf tools hackers. Cc: Alexander Viro Cc: Christian Brauner Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Namhyung Kim Link: https://lore.kernel.org/r/20231121225650.390246-4-namhyung@kernel.org tools/include/uapi/linux/mount.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 5a9f95b67059dda160f65ab41c48587103b3b3a0 Author: Namhyung Kim Date: Tue Nov 21 14:56:38 2023 -0800 tools headers UAPI: Update tools's copy of kvm.h header tldr; Just FYI, I'm carrying this on the perf tools tree. Full explanation: There used to be no copies, with tools/ code using kernel headers directly. From time to time tools/perf/ broke due to legitimate kernel hacking. At some point Linus complained about such direct usage. Then we adopted the current model. The way these headers are used in perf are not restricted to just including them to compile something. There are sometimes used in scripts that convert defines into string tables, etc, so some change may break one of these scripts, or new MSRs may use some different #define pattern, etc. E.g.: $ ls -1 tools/perf/trace/beauty/*.sh | head -5 tools/perf/trace/beauty/arch_errno_names.sh tools/perf/trace/beauty/drm_ioctl.sh tools/perf/trace/beauty/fadvise.sh tools/perf/trace/beauty/fsconfig.sh tools/perf/trace/beauty/fsmount.sh $ $ tools/perf/trace/beauty/fadvise.sh static const char *fadvise_advices[] = { [0] = "NORMAL", [1] = "RANDOM", [2] = "SEQUENTIAL", [3] = "WILLNEED", [4] = "DONTNEED", [5] = "NOREUSE", }; $ The tools/perf/check-headers.sh script, part of the tools/ build process, points out changes in the original files. So its important not to touch the copies in tools/ when doing changes in the original kernel headers, that will be done later, when check-headers.sh inform about the change to the perf tools hackers. Cc: Paolo Bonzini Cc: kvm@vger.kernel.org Signed-off-by: Namhyung Kim Link: https://lore.kernel.org/r/20231121225650.390246-3-namhyung@kernel.org tools/include/uapi/linux/kvm.h | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) commit 111844666672347747585e24d6cebda640bd1284 Author: Namhyung Kim Date: Tue Nov 21 14:56:37 2023 -0800 tools headers UAPI: Update tools's copy of fscrypt.h header tldr; Just FYI, I'm carrying this on the perf tools tree. Full explanation: There used to be no copies, with tools/ code using kernel headers directly. From time to time tools/perf/ broke due to legitimate kernel hacking. At some point Linus complained about such direct usage. Then we adopted the current model. The way these headers are used in perf are not restricted to just including them to compile something. There are sometimes used in scripts that convert defines into string tables, etc, so some change may break one of these scripts, or new MSRs may use some different #define pattern, etc. E.g.: $ ls -1 tools/perf/trace/beauty/*.sh | head -5 tools/perf/trace/beauty/arch_errno_names.sh tools/perf/trace/beauty/drm_ioctl.sh tools/perf/trace/beauty/fadvise.sh tools/perf/trace/beauty/fsconfig.sh tools/perf/trace/beauty/fsmount.sh $ $ tools/perf/trace/beauty/fadvise.sh static const char *fadvise_advices[] = { [0] = "NORMAL", [1] = "RANDOM", [2] = "SEQUENTIAL", [3] = "WILLNEED", [4] = "DONTNEED", [5] = "NOREUSE", }; $ The tools/perf/check-headers.sh script, part of the tools/ build process, points out changes in the original files. So its important not to touch the copies in tools/ when doing changes in the original kernel headers, that will be done later, when check-headers.sh inform about the change to the perf tools hackers. Cc: Eric Biggers Cc: "Theodore Y. Ts'o" Cc: Jaegeuk Kim Cc: linux-fscrypt@vger.kernel.org Signed-off-by: Namhyung Kim Link: https://lore.kernel.org/r/20231121225650.390246-2-namhyung@kernel.org tools/include/uapi/linux/fscrypt.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 1041dfe6109fcb24e9a3d5d4ca9218e64dc0ed29 Author: Namhyung Kim Date: Tue Nov 21 14:56:36 2023 -0800 tools headers UAPI: Update tools's copy of drm headers tldr; Just FYI, I'm carrying this on the perf tools tree. Full explanation: There used to be no copies, with tools/ code using kernel headers directly. From time to time tools/perf/ broke due to legitimate kernel hacking. At some point Linus complained about such direct usage. Then we adopted the current model. The way these headers are used in perf are not restricted to just including them to compile something. There are sometimes used in scripts that convert defines into string tables, etc, so some change may break one of these scripts, or new MSRs may use some different #define pattern, etc. E.g.: $ ls -1 tools/perf/trace/beauty/*.sh | head -5 tools/perf/trace/beauty/arch_errno_names.sh tools/perf/trace/beauty/drm_ioctl.sh tools/perf/trace/beauty/fadvise.sh tools/perf/trace/beauty/fsconfig.sh tools/perf/trace/beauty/fsmount.sh $ $ tools/perf/trace/beauty/fadvise.sh static const char *fadvise_advices[] = { [0] = "NORMAL", [1] = "RANDOM", [2] = "SEQUENTIAL", [3] = "WILLNEED", [4] = "DONTNEED", [5] = "NOREUSE", }; $ The tools/perf/check-headers.sh script, part of the tools/ build process, points out changes in the original files. So its important not to touch the copies in tools/ when doing changes in the original kernel headers, that will be done later, when check-headers.sh inform about the change to the perf tools hackers. Cc: David Airlie Cc: Daniel Vetter Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org Signed-off-by: Namhyung Kim Link: https://lore.kernel.org/r/20231121225650.390246-1-namhyung@kernel.org tools/include/uapi/drm/drm.h | 20 ++++++++++++++++++++ tools/include/uapi/drm/i915_drm.h | 8 ++++---- 2 files changed, 24 insertions(+), 4 deletions(-) commit acfa60dbe03802d6afd28401aa47801270e82021 Author: Will Deacon Date: Fri Nov 17 13:14:22 2023 +0000 arm64: mm: Fix "rodata=on" when CONFIG_RODATA_FULL_DEFAULT_ENABLED=y When CONFIG_RODATA_FULL_DEFAULT_ENABLED=y, passing "rodata=on" on the kernel command-line (rather than "rodata=full") should turn off the "full" behaviour, leaving writable linear aliases of read-only kernel memory. Unfortunately, the option has no effect in this situation and the only way to disable the "rodata=full" behaviour is to disable rodata protection entirely by passing "rodata=off". Fix this by parsing the "on" and "off" options in the arch code, additionally enforcing that 'rodata_full' cannot be set without also setting 'rodata_enabled', allowing us to simplify a couple of checks in the process. Fixes: 2e8cff0a0eee ("arm64: fix rodata=full") Cc: Ard Biesheuvel Cc: Mark Rutland Signed-off-by: Will Deacon Reviewed-by: "Russell King (Oracle)" Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20231117131422.29663-1-will@kernel.org Signed-off-by: Catalin Marinas arch/arm64/include/asm/setup.h | 17 +++++++++++++++-- arch/arm64/mm/pageattr.c | 7 +++---- 2 files changed, 18 insertions(+), 6 deletions(-) commit 9b6de136b5f0158c60844f85286a593cb70fb364 Merge: 05c8c94ed407 c517fd2738f4 Author: Linus Torvalds Date: Wed Nov 22 10:20:17 2023 -0800 Merge tag 'loongarch-fixes-6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Fix several build errors, a potential kernel panic, a cpu hotplug issue and update links in documentations" * tag 'loongarch-fixes-6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: Docs/zh_CN/LoongArch: Update links in LoongArch introduction.rst Docs/LoongArch: Update links in LoongArch introduction.rst LoongArch: Implement constant timer shutdown interface LoongArch: Mark {dmw,tlb}_virt_to_page() exports as non-GPL LoongArch: Silence the boot warning about 'nokaslr' LoongArch: Add __percpu annotation for __percpu_read()/__percpu_write() LoongArch: Record pc instead of offset in la_abs relocation LoongArch: Explicitly set -fdirect-access-external-data for vmlinux LoongArch: Add dependency between vmlinuz.efi and vmlinux.efi commit 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 Author: Darrick J. Wong Date: Mon Nov 20 10:31:44 2023 -0800 xfs: dquot recovery does not validate the recovered dquot When we're recovering ondisk quota records from the log, we need to validate the recovered buffer contents before writing them to disk. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Chandan Babu R fs/xfs/xfs_dquot_item_recover.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit ed17f7da5f0c8b65b7b5f7c98beb0aadbc0546ee Author: Darrick J. Wong Date: Mon Nov 20 10:31:38 2023 -0800 xfs: clean up dqblk extraction Since the introduction of xfs_dqblk in V5, xfs really ought to find the dqblk pointer from the dquot buffer, then compute the xfs_disk_dquot pointer from the dqblk pointer. Fix the open-coded xfs_buf_offset calls and do the type checking in the correct order. Note that this has made no practical difference since the start of the xfs_disk_dquot is coincident with the start of the xfs_dqblk. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Chandan Babu R fs/xfs/xfs_dquot.c | 5 +++-- fs/xfs/xfs_dquot_item_recover.c | 7 ++++--- 2 files changed, 7 insertions(+), 5 deletions(-) commit 05c8c94ed407499279b2a552e7ee9bb03e859b7b Merge: 125b0bb95dd6 18286883e779 Author: Linus Torvalds Date: Wed Nov 22 09:56:26 2023 -0800 Merge tag 'hyperv-fixes-signed-20231121' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv fixes from Wei Liu: - One fix for the KVP daemon (Ani Sinha) - Fix for the detection of E820_TYPE_PRAM in a Gen2 VM (Saurabh Sengar) - Micro-optimization for hv_nmi_unknown() (Uros Bizjak) * tag 'hyperv-fixes-signed-20231121' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: x86/hyperv: Use atomic_try_cmpxchg() to micro-optimize hv_nmi_unknown() x86/hyperv: Fix the detection of E820_TYPE_PRAM in a Gen2 VM hv/hv_kvp_daemon: Some small fixes for handling NM keyfiles commit 125b0bb95dd6bec81b806b997a4ccb026eeecf8f Author: Linus Torvalds Date: Thu Nov 9 22:22:13 2023 -0800 asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation We really don't want to do atomic_read() or anything like that, since we already have the value, not the lock. The whole point of this is that we've loaded the lock from memory, and we want to check whether the value we loaded was a locked one or not. The main use of this is the lockref code, which loads both the lock and the reference count in one atomic operation, and then works on that combined value. With the atomic_read(), the compiler would pointlessly spill the value to the stack, in order to then be able to read it back "atomically". This is the qspinlock version of commit c6f4a9002252 ("asm-generic: ticket-lock: Optimize arch_spin_value_unlocked()") which fixed this same bug for ticket locks. Cc: Guo Ren Cc: Ingo Molnar Cc: Waiman Long Link: https://lore.kernel.org/all/CAHk-=whNRv0v6kQiV5QO6DJhjH4KEL36vWQ6Re8Csrnh4zbRkQ@mail.gmail.com/ Signed-off-by: Linus Torvalds include/asm-generic/qspinlock.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cdba4301adda7c60a2064bf808e48fccd352aaa9 Author: Shuming Fan Date: Wed Nov 22 18:01:23 2023 +0800 ASoC: rt5650: add mutex to avoid the jack detection failure This patch adds the jd_mutex to protect the jack detection control flow. And only the headset type could check the button status. Signed-off-by: Shuming Fan Link: https://lore.kernel.org/r/20231122100123.2831753-1-shumingf@realtek.com Signed-off-by: Mark Brown sound/soc/codecs/rt5645.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit 55072cd7ce36d6e3af949608bcb0e734d5a4b0c2 Merge: 98c598afc22d 3af755a46881 Author: Jens Axboe Date: Wed Nov 22 10:19:27 2023 -0700 Merge tag 'nvme-6.7-2023-11-22' of git://git.infradead.org/nvme into block-6.7 Pull NVMe fixes from Keith: "nvme fixes for Linux 6.7 - TCP TLS fixes (Hannes) - Authentifaction fixes (Mark, Hannes) - Properly terminate target names (Christoph)" * tag 'nvme-6.7-2023-11-22' of git://git.infradead.org/nvme: nvme: move nvme_stop_keep_alive() back to original position nvmet-tcp: always initialize tls_handshake_tmo_work nvmet: nul-terminate the NQNs passed in the connect command nvme: blank out authentication fabrics options if not configured nvme: catch errors from nvme_configure_metadata() nvme-tcp: only evaluate 'tls' option if TLS is selected nvme-auth: set explanation code for failure2 msgs nvme-auth: unlock mutex in one place only commit 4a6c5607d4502ccd1b15b57d57f17d12b6f257a7 Author: Tejun Heo Date: Tue Nov 21 11:39:36 2023 -1000 workqueue: Make sure that wq_unbound_cpumask is never empty During boot, depending on how the housekeeping and workqueue.unbound_cpus masks are set, wq_unbound_cpumask can end up empty. Since 8639ecebc9b1 ("workqueue: Implement non-strict affinity scope for unbound workqueues"), this may end up feeding -1 as a CPU number into scheduler leading to oopses. BUG: unable to handle page fault for address: ffffffff8305e9c0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page ... Call Trace: select_idle_sibling+0x79/0xaf0 select_task_rq_fair+0x1cb/0x7b0 try_to_wake_up+0x29c/0x5c0 wake_up_process+0x19/0x20 kick_pool+0x5e/0xb0 __queue_work+0x119/0x430 queue_work_on+0x29/0x30 ... An empty wq_unbound_cpumask is a clear misconfiguration and already disallowed once system is booted up. Let's warn on and ignore unbound_cpumask restrictions which lead to no unbound cpus. While at it, also remove now unncessary empty check on wq_unbound_cpumask in wq_select_unbound_cpu(). Signed-off-by: Tejun Heo Reported-and-Tested-by: Yong He Link: http://lkml.kernel.org/r/20231120121623.119780-1-alexyonghe@tencent.com Fixes: 8639ecebc9b1 ("workqueue: Implement non-strict affinity scope for unbound workqueues") Cc: stable@vger.kernel.org # v6.6+ Reviewed-by: Waiman Long kernel/workqueue.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) commit 3af755a46881c32fecaecfdeaf3a8f0a869deca5 Author: Hannes Reinecke Date: Tue Nov 21 09:01:03 2023 +0100 nvme: move nvme_stop_keep_alive() back to original position Stopping keep-alive not only stops the keep-alive workqueue, but also needs to be synchronized with I/O termination as we must not send a keep-alive command after all I/O had been terminated. So to avoid any regressions move the call to stop_keep_alive() back to its original position and ensure that keep-alive is correctly stopped failing to setup the admin queue. Fixes: 4733b65d82bd ("nvme: start keep-alive after admin queue setup") Suggested-by: Sagi Grimberg Signed-off-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 19 ++++++++----------- drivers/nvme/host/rdma.c | 1 + drivers/nvme/host/tcp.c | 1 + 4 files changed, 11 insertions(+), 12 deletions(-) commit 695bfba7ca781dd41b5225148cc8cebd74c553c2 Author: Lorenzo Bianconi Date: Mon Nov 13 11:06:33 2023 +0100 wifi: mt76: mt7925: fix typo in mt7925_init_he_caps Use iftype for interface type switch in mt7925_init_he_caps routine. This found during code review but later Coverity reported this with id 1549845. Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Lorenzo Bianconi Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/7de6e939dc75ee08f05bf1ee73253aa7eeccf28e.1699869649.git.lorenzo@kernel.org drivers/net/wireless/mediatek/mt76/mt7925/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit aab1f809d7540def24498e81347740a7239a74d5 Author: Heiko Carstens Date: Mon Nov 20 13:00:00 2023 +0100 scripts/checkstack.pl: match all stack sizes for s390 For some unknown reason the regular expression for checkstack only matches three digit numbers starting with the number "3", or any higher number. Which means that it skips any stack sizes smaller than 304 bytes. This makes the checkstack script a bit less useful than it could be. Change the script to match any number. To be filtered out stack sizes can be configured with the min_stack variable, which omits any stack frame sizes smaller than 100 bytes by default. Tested-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev scripts/checkstack.pl | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 732c678eb021dbc514a699be1815e194692fdd5c Author: Richard Fitzgerald Date: Tue Nov 21 15:44:19 2023 +0000 ALSA: hda: cs35l56: Enable low-power hibernation mode on SPI SPI hibernation is now supported with the latest hibernation/wake sequences in the shared ASoC code. This has a functional dependency on two commits: commit 3df761bdbc8b ("ASoC: cs35l56: Wake transactions need to be issued twice") commit a47cf4dac7dc ("ASoC: cs35l56: Change hibernate sequence to use allow auto hibernate") To protect against this, enabling hibernation is conditional on CS35L56_WAKE_HOLD_TIME_US being defined, which indicates that the new hibernation sequences are available. Signed-off-by: Richard Fitzgerald Link: https://lore.kernel.org/r/20231121154419.19435-1-rf@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l56_hda_spi.c | 4 ++++ 1 file changed, 4 insertions(+) commit 0a9ace1117bbaa25687468af703b472235f5c210 Author: Heiko Carstens Date: Wed Nov 15 11:39:02 2023 +0100 s390: remove odd comment In the meantime hopefully most people got used to forward declarations, therefore remove the explanation. Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev arch/s390/include/asm/processor.h | 1 - 1 file changed, 1 deletion(-) commit 673752a839694133a328610fcbc54f3d59ae87f3 Author: Mikhail Zaslonko Date: Wed Nov 8 18:18:52 2023 +0100 s390/ipl: add missing IPL_TYPE_ECKD_DUMP case to ipl_init() Add missing IPL_TYPE_ECKD_DUMP case to ipl_init() creating ECKD ipl device attribute group similar to IPL_TYPE_ECKD case. Commit e2d2a2968f2a ("s390/ipl: add eckd dump support") should have had it from the beginning. Fixes: e2d2a2968f2a ("s390/ipl: add eckd dump support") Signed-off-by: Mikhail Zaslonko Reviewed-by: Sven Schnelle Signed-off-by: Alexander Gordeev arch/s390/kernel/ipl.c | 1 + 1 file changed, 1 insertion(+) commit 4711b7b8f99583f6105a33e91f106125134beacb Author: Thomas Richter Date: Mon Oct 30 11:41:33 2023 +0100 s390/pai: cleanup event initialization Setting event::hw.last_tag to zero is not necessary. The memory for each event is dynamically allocated by the kernel common code and initialized to zero already. Remove this unnecessary assignment. Move the comment to function paicrypt_start() for clarification. Suggested-by: Sumanth Korikkar Acked-by: Sumanth Korikkar Signed-off-by: Thomas Richter Signed-off-by: Alexander Gordeev arch/s390/kernel/perf_pai_crypto.c | 11 +++++------ arch/s390/kernel/perf_pai_ext.c | 1 - 2 files changed, 5 insertions(+), 7 deletions(-) commit ad2ab1297d0c80899125a842bb7a078abfe1e6ce Author: Mike Tipton Date: Wed Oct 25 07:58:29 2023 -0700 interconnect: Treat xlate() returning NULL node as an error Currently, if provider->xlate() or provider->xlate_extended() "successfully" return a NULL node, then of_icc_get_from_provider() won't consider that an error and will successfully return the NULL node. This bypasses error handling in of_icc_get_by_index() and leads to NULL dereferences in path_find(). This could be avoided by ensuring provider callbacks always return an error for NULL nodes, but it's better to explicitly protect against this in the common framework. Fixes: 87e3031b6fbd ("interconnect: Allow endpoints translation via DT") Signed-off-by: Mike Tipton Link: https://lore.kernel.org/r/20231025145829.11603-1-quic_mdtipton@quicinc.com Signed-off-by: Georgi Djakov drivers/interconnect/core.c | 3 +++ 1 file changed, 3 insertions(+) commit 9cf87666fc6e08572341fe08ecd909935998fbbd Author: Johan Hovold Date: Fri Nov 17 18:36:50 2023 +0100 USB: dwc3: qcom: fix ACPI platform device leak Make sure to free the "urs" platform device, which is created for some ACPI platforms, on probe errors and on driver unbind. Compile-tested only. Fixes: c25c210f590e ("usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot") Cc: Shawn Guo Signed-off-by: Johan Hovold Acked-by: Andrew Halaney Acked-by: Shawn Guo Link: https://lore.kernel.org/r/20231117173650.21161-4-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc3/dwc3-qcom.c | 37 ++++++++++++++++++++++++++++++------- 1 file changed, 30 insertions(+), 7 deletions(-) commit 9feefbf57d92e8ee293dad67585d351c7d0b6e37 Author: Johan Hovold Date: Fri Nov 17 18:36:49 2023 +0100 USB: dwc3: qcom: fix software node leak on probe errors Make sure to remove the software node also on (ACPI) probe errors to avoid leaking the underlying resources. Note that the software node is only used for ACPI probe so the driver unbind tear down is updated to match probe. Fixes: 8dc6e6dd1bee ("usb: dwc3: qcom: Constify the software node") Cc: stable@vger.kernel.org # 5.12 Cc: Heikki Krogerus Signed-off-by: Johan Hovold Acked-by: Heikki Krogerus Acked-by: Andrew Halaney Link: https://lore.kernel.org/r/20231117173650.21161-3-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc3/dwc3-qcom.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 51392a1879ff06dc21b68aef4825f6ef68a7be42 Author: Johan Hovold Date: Fri Nov 17 18:36:48 2023 +0100 USB: dwc3: qcom: fix resource leaks on probe deferral The driver needs to deregister and free the newly allocated dwc3 core platform device on ACPI probe errors (e.g. probe deferral) and on driver unbind but instead it leaked those resources while erroneously dropping a reference to the parent platform device which is still in use. For OF probing the driver takes a reference to the dwc3 core platform device which has also always been leaked. Fix the broken ACPI tear down and make sure to drop the dwc3 core reference for both OF and ACPI. Fixes: 8fd95da2cfb5 ("usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()") Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI") Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver") Cc: stable@vger.kernel.org # 4.18 Cc: Christophe JAILLET Cc: Lee Jones Signed-off-by: Johan Hovold Acked-by: Andrew Halaney Link: https://lore.kernel.org/r/20231117173650.21161-2-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc3/dwc3-qcom.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit aee70a1d711327dae409671035a0368c1dc4a2ea Author: Johan Hovold Date: Mon Nov 20 17:16:07 2023 +0100 USB: dwc3: qcom: simplify wakeup interrupt setup Use the IRQF_NO_AUTOEN irq flag when requesting the wakeup interrupts instead of setting it separately. No functional change intended. Signed-off-by: Johan Hovold Reviewed-by: Andrew Halaney Link: https://lore.kernel.org/r/20231120161607.7405-4-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc3/dwc3-qcom.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) commit 41f5a0973259db9e4e3c9963d36505f80107d1a0 Author: Johan Hovold Date: Mon Nov 20 17:16:06 2023 +0100 USB: dwc3: qcom: fix wakeup after probe deferral The Qualcomm glue driver is overriding the interrupt trigger types defined by firmware when requesting the wakeup interrupts during probe. This can lead to a failure to map the DP/DM wakeup interrupts after a probe deferral as the firmware defined trigger types do not match the type used for the initial mapping: irq: type mismatch, failed to map hwirq-14 for interrupt-controller@b220000! irq: type mismatch, failed to map hwirq-15 for interrupt-controller@b220000! Fix this by not overriding the firmware provided trigger types when requesting the wakeup interrupts. Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver") Cc: stable@vger.kernel.org # 4.18 Signed-off-by: Johan Hovold Reviewed-by: Andrew Halaney Link: https://lore.kernel.org/r/20231120161607.7405-3-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc3/dwc3-qcom.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 0c2671f33a9c975d752216739d6a05cb88e98aa4 Author: Johan Hovold Date: Mon Nov 20 17:16:05 2023 +0100 dt-bindings: usb: qcom,dwc3: fix example wakeup interrupt types The DP/DM wakeup interrupts are edge triggered and which edge to trigger on depends on use-case and whether a Low speed or Full/High speed device is connected. Fixes: 3828026c9ec8 ("dt-bindings: usb: qcom,dwc3: Convert USB DWC3 bindings") Signed-off-by: Johan Hovold Acked-by: Krzysztof Kozlowski Reviewed-by: Andrew Halaney Link: https://lore.kernel.org/r/20231120161607.7405-2-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman Documentation/devicetree/bindings/usb/qcom,dwc3.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6972b38ca05235f6142715db7062ecc87a422e22 Author: Stefan Eichenberger Date: Mon Nov 13 15:59:21 2023 +0100 usb: misc: onboard-hub: add support for Microchip USB5744 Add support for the Microchip USB5744 USB3.0 and USB2.0 Hub. The Microchip USB5744 supports two power supplies, one for 1V2 and one for 3V3. According to the datasheet there is no need for a delay between power on and reset, so this value is set to 0. Signed-off-by: Stefan Eichenberger Signed-off-by: Francesco Dolcini Cc: stable Acked-by: Matthias Kaehlcke Link: https://lore.kernel.org/r/20231113145921.30104-3-francesco@dolcini.it Signed-off-by: Greg Kroah-Hartman drivers/usb/misc/onboard_usb_hub.c | 2 ++ drivers/usb/misc/onboard_usb_hub.h | 7 +++++++ 2 files changed, 9 insertions(+) commit d0c930b745cafde8e7d25d0356c648bca669556a Author: Stefan Eichenberger Date: Mon Nov 13 15:59:20 2023 +0100 dt-bindings: usb: microchip,usb5744: Add second supply The USB5744 has two power supplies one for 3V3 and one for 1V2. Add the second supply to the USB5744 DT binding. Signed-off-by: Stefan Eichenberger Signed-off-by: Francesco Dolcini Acked-by: Conor Dooley Cc: stable Link: https://lore.kernel.org/r/20231113145921.30104-2-francesco@dolcini.it Signed-off-by: Greg Kroah-Hartman Documentation/devicetree/bindings/usb/microchip,usb5744.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 6a26310273c323380da21eb23fcfd50e31140913 Author: Heiner Kallweit Date: Tue Nov 21 09:09:33 2023 +0100 Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E" This reverts commit efa5f1311c4998e9e6317c52bc5ee93b3a0f36df. I couldn't reproduce the reported issue. What I did, based on a pcap packet log provided by the reporter: - Used same chip version (RTL8168h) - Set MAC address to the one used on the reporters system - Replayed the EAPOL unicast packet that, according to the reporter, was filtered out by the mc filter. The packet was properly received. Therefore the root cause of the reported issue seems to be somewhere else. Disabling mc filtering completely for the most common chip version is a quite big hammer. Therefore revert the change and wait for further analysis results from the reporter. Cc: stable@vger.kernel.org Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller drivers/net/ethernet/realtek/r8169_main.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 372ee6a3368ec6ff46ee4e6ff4ffe2fe1e059dbb Author: Hans de Goede Date: Tue Nov 21 21:32:05 2023 +0100 usb: misc: ljca: Fix enumeration error on Dell Latitude 9420 Not all LJCA chips implement SPI and on chips without SPI reading the SPI descriptors will timeout. On laptop models like the Dell Latitude 9420, this is expected behavior and not an error. Modify the driver to continue without instantiating a SPI auxbus child, instead of failing to probe() the whole LJCA chip. Fixes: acd6199f195d ("usb: Add support for Intel LJCA device") Signed-off-by: Hans de Goede Reviewed-by: Wentong Wu Link: https://lore.kernel.org/r/20231104175104.38786-1-hdegoede@redhat.com Link: https://lore.kernel.org/r/20231121203205.223047-1-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman drivers/usb/misc/usb-ljca.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e6d71b437abc2f249e3b6a1ae1a7228e09c6e563 Author: D. Wythe Date: Wed Nov 22 10:37:05 2023 +0800 net/smc: avoid data corruption caused by decline We found a data corruption issue during testing of SMC-R on Redis applications. The benchmark has a low probability of reporting a strange error as shown below. "Error: Protocol error, got "\xe2" as reply type byte" Finally, we found that the retrieved error data was as follows: 0xE2 0xD4 0xC3 0xD9 0x04 0x00 0x2C 0x20 0xA6 0x56 0x00 0x16 0x3E 0x0C 0xCB 0x04 0x02 0x01 0x00 0x00 0x20 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xE2 It is quite obvious that this is a SMC DECLINE message, which means that the applications received SMC protocol message. We found that this was caused by the following situations: client server ¦ clc proposal -------------> ¦ clc accept <------------- ¦ clc confirm -------------> wait llc confirm send llc confirm ¦failed llc confirm ¦ x------ (after 2s)timeout wait llc confirm rsp wait decline (after 1s) timeout (after 2s) timeout ¦ decline --------------> ¦ decline <-------------- As a result, a decline message was sent in the implementation, and this message was read from TCP by the already-fallback connection. This patch double the client timeout as 2x of the server value, With this simple change, the Decline messages should never cross or collide (during Confirm link timeout). This issue requires an immediate solution, since the protocol updates involve a more long-term solution. Fixes: 0fb0b02bd6fd ("net/smc: adapt SMC client code to use the LLC flow") Signed-off-by: D. Wythe Reviewed-by: Wen Gu Reviewed-by: Wenjia Zhang Signed-off-by: David S. Miller net/smc/af_smc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit c33fd110424dfcb544cf55a1b312f43fe1918235 Author: Shengjiu Wang Date: Wed Nov 22 09:42:53 2023 +0800 ASoC: fsl_xcvr: Enable 2 * TX bit clock for spdif only case The bit 10 in TX_DPTH_CTRL register controls the TX clock rate. If this bit is set, TX datapath clock should be = 2* TX bit rate. If this bit is not set, TX datapath clock should be 10* TX bit rate. As the spdif only case, we always use 2 * TX bit clock, so this bit need to be set. Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1700617373-6472-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown sound/soc/fsl/fsl_xcvr.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 2b78832f50c4d711e161b166d7d8790968051546 Author: Shifeng Li Date: Tue Nov 21 02:12:36 2023 -0800 RDMA/irdma: Fix UAF in irdma_sc_ccq_get_cqe_info() When removing the irdma driver or unplugging its aux device, the ccq queue is released before destorying the cqp_cmpl_wq queue. But in the window, there may still be completion events for wqes. That will cause a UAF in irdma_sc_ccq_get_cqe_info(). [34693.333191] BUG: KASAN: use-after-free in irdma_sc_ccq_get_cqe_info+0x82f/0x8c0 [irdma] [34693.333194] Read of size 8 at addr ffff889097f80818 by task kworker/u67:1/26327 [34693.333194] [34693.333199] CPU: 9 PID: 26327 Comm: kworker/u67:1 Kdump: loaded Tainted: G O --------- -t - 4.18.0 #1 [34693.333200] Hardware name: SANGFOR Inspur/NULL, BIOS 4.1.13 08/01/2016 [34693.333211] Workqueue: cqp_cmpl_wq cqp_compl_worker [irdma] [34693.333213] Call Trace: [34693.333220] dump_stack+0x71/0xab [34693.333226] print_address_description+0x6b/0x290 [34693.333238] ? irdma_sc_ccq_get_cqe_info+0x82f/0x8c0 [irdma] [34693.333240] kasan_report+0x14a/0x2b0 [34693.333251] irdma_sc_ccq_get_cqe_info+0x82f/0x8c0 [irdma] [34693.333264] ? irdma_free_cqp_request+0x151/0x1e0 [irdma] [34693.333274] irdma_cqp_ce_handler+0x1fb/0x3b0 [irdma] [34693.333285] ? irdma_ctrl_init_hw+0x2c20/0x2c20 [irdma] [34693.333290] ? __schedule+0x836/0x1570 [34693.333293] ? strscpy+0x83/0x180 [34693.333296] process_one_work+0x56a/0x11f0 [34693.333298] worker_thread+0x8f/0xf40 [34693.333301] ? __kthread_parkme+0x78/0xf0 [34693.333303] ? rescuer_thread+0xc50/0xc50 [34693.333305] kthread+0x2a0/0x390 [34693.333308] ? kthread_destroy_worker+0x90/0x90 [34693.333310] ret_from_fork+0x1f/0x40 Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions") Signed-off-by: Shifeng Li Link: https://lore.kernel.org/r/20231121101236.581694-1-lishifeng1992@126.com Acked-by: Shiraz Saleem Signed-off-by: Leon Romanovsky drivers/infiniband/hw/irdma/hw.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 422b19f7f006e813ee0865aadce6a62b3c263c42 Author: Kalesh AP Date: Tue Nov 21 00:29:47 2023 -0800 RDMA/bnxt_re: Correct module description string The word "Driver" is repeated twice in the "modinfo bnxt_re" output description. Fix it. Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") Signed-off-by: Kalesh AP Signed-off-by: Selvin Xavier Link: https://lore.kernel.org/r/1700555387-6277-1-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Leon Romanovsky drivers/infiniband/hw/bnxt_re/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8f2244c9af245ff72185c0473827125ee6b2d1a5 Author: Takashi Iwai Date: Tue Nov 21 17:23:59 2023 +0100 leds: class: Don't expose color sysfs entry The commit c7d80059b086 ("leds: class: Store the color index in struct led_classdev") introduced a new sysfs entry "color" that is commonly created for the led classdev. Unfortunately, this conflicts with the "color" sysfs entry of already existing drivers such as Logitech HID or System76 ACPI drivers. The driver probe fails due to the conflict, hence it leads to a severe regression with the missing keyboard, for example. This patch reverts partially the change in the commit above for removing the led class color sysfs entries again for addressing the regressions. The newly introduced led_classdev.color field is kept as it's already used by other driver. Fixes: c7d80059b086 ("leds: class: Store the color index in struct led_classdev") Reported-by: Johannes Penßel Closes: https://lore.kernel.org/r/b5646db3-acff-45aa-baef-df3f660486fb@gmail.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=218045 Link: https://bugzilla.kernel.org/show_bug.cgi?id=218155 Link: https://bugzilla.suse.com/show_bug.cgi?id=1217172 Signed-off-by: Takashi Iwai Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20231121162359.9332-1-tiwai@suse.de Signed-off-by: Lee Jones Documentation/ABI/testing/sysfs-class-led | 9 --------- drivers/leds/led-class.c | 14 -------------- 2 files changed, 23 deletions(-) commit 0c8bb6eb70ca41031f663b4481aac9ac78b53bc6 Author: Jack Wang Date: Mon Nov 20 16:41:44 2023 +0100 RDMA/rtrs-clt: Remove the warnings for req in_use check As we chain the WR during write request: memory registration, rdma write, local invalidate, if only the last WR fail to send due to send queue overrun, the server can send back the reply, while client mark the req->in_use to false in case of error in rtrs_clt_req when error out from rtrs_post_rdma_write_sg. Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality") Signed-off-by: Jack Wang Reviewed-by: Md Haris Iqbal Signed-off-by: Grzegorz Prajsner Link: https://lore.kernel.org/r/20231120154146.920486-8-haris.iqbal@ionos.com Signed-off-by: Leon Romanovsky drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6d09f6f7d7584e099633282ea915988914f86529 Author: Jack Wang Date: Mon Nov 20 16:41:43 2023 +0100 RDMA/rtrs-clt: Fix the max_send_wr setting For each write request, we need Request, Response Memory Registration, Local Invalidate. Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality") Signed-off-by: Jack Wang Reviewed-by: Md Haris Iqbal Signed-off-by: Grzegorz Prajsner Link: https://lore.kernel.org/r/20231120154146.920486-7-haris.iqbal@ionos.com Signed-off-by: Leon Romanovsky drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c4d32e77fc1006f99eeb78417efc3d81a384072a Author: Md Haris Iqbal Date: Mon Nov 20 16:41:42 2023 +0100 RDMA/rtrs-srv: Destroy path files after making sure no IOs in-flight Destroying path files may lead to the freeing of rdma_stats. This creates the following race. An IO is in-flight, or has just passed the session state check in process_read/process_write. The close_work gets triggered and the function rtrs_srv_close_work() starts and does destroy path which frees the rdma_stats. After this the function process_read/process_write resumes and tries to update the stats through the function rtrs_srv_update_rdma_stats This commit solves the problem by moving the destroy path function to a later point. This point makes sure any inflights are completed. This is done by qp drain, and waiting for all in-flights through ops_id. Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality") Signed-off-by: Md Haris Iqbal Signed-off-by: Santosh Kumar Pradhan Signed-off-by: Grzegorz Prajsner Link: https://lore.kernel.org/r/20231120154146.920486-6-haris.iqbal@ionos.com Signed-off-by: Leon Romanovsky drivers/infiniband/ulp/rtrs/rtrs-srv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3a71cd6ca0ce33d1af019ecf1d7167406fa54400 Author: Md Haris Iqbal Date: Mon Nov 20 16:41:41 2023 +0100 RDMA/rtrs-srv: Free srv_mr iu only when always_invalidate is true Since srv_mr->iu is allocated and used only when always_invalidate is true, free it only when always_invalidate is true. Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality") Signed-off-by: Md Haris Iqbal Signed-off-by: Jack Wang Signed-off-by: Grzegorz Prajsner Link: https://lore.kernel.org/r/20231120154146.920486-5-haris.iqbal@ionos.com Signed-off-by: Leon Romanovsky drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit ed1e52aefa16f15dc2f04054a3baf11726a7460e Author: Md Haris Iqbal Date: Mon Nov 20 16:41:40 2023 +0100 RDMA/rtrs-srv: Check return values while processing info request While processing info request, it could so happen that the srv_path goes to CLOSING state, cause of any of the error events from RDMA. That state change should be picked up while trying to change the state in process_info_req, by checking the return value. In case the state change call in process_info_req fails, we fail the processing. We should also check the return value for rtrs_srv_path_up, since it sends a link event to the client above, and the client can fail for any reason. Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality") Signed-off-by: Md Haris Iqbal Signed-off-by: Jack Wang Signed-off-by: Grzegorz Prajsner Link: https://lore.kernel.org/r/20231120154146.920486-4-haris.iqbal@ionos.com Signed-off-by: Leon Romanovsky drivers/infiniband/ulp/rtrs/rtrs-srv.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) commit 3e44a61b5db873612e20e7b7922468d7d1ac2d22 Author: Jack Wang Date: Mon Nov 20 16:41:39 2023 +0100 RDMA/rtrs-clt: Start hb after path_up If we start hb too early, it will confuse server side to close the session. Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality") Signed-off-by: Jack Wang Reviewed-by: Md Haris Iqbal Signed-off-by: Grzegorz Prajsner Link: https://lore.kernel.org/r/20231120154146.920486-3-haris.iqbal@ionos.com Signed-off-by: Leon Romanovsky drivers/infiniband/ulp/rtrs/rtrs-clt.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 3ee7ecd712048ade6482bea4b2f3dcaf039c0348 Author: Jack Wang Date: Mon Nov 20 16:41:38 2023 +0100 RDMA/rtrs-srv: Do not unconditionally enable irq When IO is completed, rtrs can be called in softirq context, unconditionally enabling irq could cause panic. To be on safe side, use spin_lock_irqsave and spin_unlock_irqrestore instread. Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality") Signed-off-by: Jack Wang Signed-off-by: Florian-Ewald Mueller Signed-off-by: Md Haris Iqbal Signed-off-by: Grzegorz Prajsner Link: https://lore.kernel.org/r/20231120154146.920486-2-haris.iqbal@ionos.com Signed-off-by: Leon Romanovsky drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 84d2db91f14a32dc856a5972e3f0907089093c7a Author: Nguyen Dinh Phi Date: Tue Nov 21 15:53:57 2023 +0800 nfc: virtual_ncidev: Add variable to check if ndev is running syzbot reported an memory leak that happens when an skb is add to send_buff after virtual nci closed. This patch adds a variable to track if the ndev is running before handling new skb in send function. Signed-off-by: Nguyen Dinh Phi Reported-by: syzbot+6eb09d75211863f15e3e@syzkaller.appspotmail.com Closes: https://lore.kernel.org/lkml/00000000000075472b06007df4fb@google.com Reviewed-by: Bongsu Jeon Reviewed-by: Krzysztof Kozlowski Signed-off-by: David S. Miller drivers/nfc/virtual_ncidev.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 9ffccb691adb854e7b7f3ee57fbbda12ff70533f Author: Aoba K Date: Tue Nov 21 20:23:11 2023 +0800 HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad Honor MagicBook 13 2023 has a touchpad which do not switch to the multitouch mode until the input mode feature is written by the host. The touchpad do report the input mode at touchpad(3), while itself working under mouse mode. As a workaround, it is possible to call MT_QUIRE_FORCE_GET_FEATURE to force set feature in mt_set_input_mode for such device. The touchpad reports as BLTP7853, which cannot retrive any useful manufacture information on the internel by this string at present. As the serial number of the laptop is GLO-G52, while DMI info reports the laptop serial number as GLO-GXXX, this workaround should applied to all models which has the GLO-GXXX. Signed-off-by: Aoba K Signed-off-by: Jiri Kosina drivers/hid/hid-multitouch.c | 5 +++++ 1 file changed, 5 insertions(+) commit 546edbd26cff7ae990e480a59150e801a06f77b1 Author: Denis Benato Date: Fri Nov 17 14:15:56 2023 +1300 HID: hid-asus: reset the backlight brightness level on resume Some devices managed by this driver automatically set brightness to 0 before entering a suspended state and reset it back to a default brightness level after the resume: this has the effect of having the kernel report wrong brightness status after a sleep, and on some devices (like the Asus RC71L) that brightness is the intensity of LEDs directly facing the user. Fix the above issue by setting back brightness to the level it had before entering a sleep state. Signed-off-by: Denis Benato Signed-off-by: Luke D. Jones Signed-off-by: Jiri Kosina drivers/hid/hid-asus.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) commit 06ae5afce8cc1f7621cc5c7751e449ce20d68af7 Author: Denis Benato Date: Fri Nov 17 14:15:55 2023 +1300 HID: hid-asus: add const to read-only outgoing usb buffer In the function asus_kbd_set_report the parameter buf is read-only as it gets copied in a memory portion suitable for USB transfer, but the parameter is not marked as const: add the missing const and mark const immutable buffers passed to that function. Signed-off-by: Denis Benato Signed-off-by: Luke D. Jones Signed-off-by: Jiri Kosina drivers/hid/hid-asus.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 8abc712ea4867a81c860853048f24e511bbc20f2 Author: Ritesh Harjani (IBM) Date: Wed Nov 22 14:32:15 2023 +0530 ext2: Fix ki_pos update for DIO buffered-io fallback case Commit "filemap: update ki_pos in generic_perform_write", made updating of ki_pos into common code in generic_perform_write() function. This also causes generic/091 to fail. This happened due to an in-flight collision with: fb5de4358e1a ("ext2: Move direct-io to use iomap"). I have chosen fixes tag based on which commit got landed later to upstream kernel. Fixes: 182c25e9c157 ("filemap: update ki_pos in generic_perform_write") Cc: stable@vger.kernel.org Reviewed-by: Christoph Hellwig Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Jan Kara Message-Id: fs/ext2/file.c | 1 - 1 file changed, 1 deletion(-) commit e389fe8b68137344562fb6e4d53d8a89ef6212dd Author: Victor Fragoso Date: Tue Nov 21 21:05:56 2023 +0000 USB: serial: option: add Fibocom L7xx modules Add support for Fibocom L716-EU module series. L716-EU is a Fibocom module based on ZTE's V3E/V3T chipset. Device creates multiple interfaces when connected to PC as follows: - Network Interface: ECM or RNDIS (set by FW or AT Command) - ttyUSB0: AT port - ttyUSB1: Modem port - ttyUSB2: AT2 port - ttyUSB3: Trace port for log information - ADB: ADB port for debugging. ("Driver=usbfs" when ADB server enabled) Here are the outputs of lsusb and usb-devices: $ ls /dev/ttyUSB* /dev/ttyUSB0 /dev/ttyUSB1 /dev/ttyUSB2 /dev/ttyUSB3 usb-devices: L716-EU (ECM mode): T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 51 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2cb7 ProdID=0001 Rev= 1.00 S: Manufacturer=Fibocom,Incorporated S: Product=Fibocom Mobile Boardband S: SerialNumber=1234567890ABCDEF C:* #Ifs= 7 Cfg#= 1 Atr=e0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=87(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms L716-EU (RNDIS mode): T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 49 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2cb7 ProdID=0001 Rev= 1.00 S: Manufacturer=Fibocom,Incorporated S: Product=Fibocom Mobile Boardband S: SerialNumber=1234567890ABCDEF C:* #Ifs= 7 Cfg#= 1 Atr=e0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=02 Prot=ff Driver=rndis_host E: Ad=87(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Victor Fragoso Reviewed-by: Lars Melin Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold drivers/usb/serial/option.c | 1 + 1 file changed, 1 insertion(+) commit 18286883e779fb79b413a7462968ee3f6768f19c Author: Uros Bizjak Date: Tue Nov 14 17:59:28 2023 +0100 x86/hyperv: Use atomic_try_cmpxchg() to micro-optimize hv_nmi_unknown() Use atomic_try_cmpxchg() instead of atomic_cmpxchg(*ptr, old, new) == old in hv_nmi_unknown(). On x86 the CMPXCHG instruction returns success in the ZF flag, so this change saves a compare after CMPXCHG. The generated asm code improves from: 3e: 65 8b 15 00 00 00 00 mov %gs:0x0(%rip),%edx 45: b8 ff ff ff ff mov $0xffffffff,%eax 4a: f0 0f b1 15 00 00 00 lock cmpxchg %edx,0x0(%rip) 51: 00 52: 83 f8 ff cmp $0xffffffff,%eax 55: 0f 95 c0 setne %al to: 3e: 65 8b 15 00 00 00 00 mov %gs:0x0(%rip),%edx 45: b8 ff ff ff ff mov $0xffffffff,%eax 4a: f0 0f b1 15 00 00 00 lock cmpxchg %edx,0x0(%rip) 51: 00 52: 0f 95 c0 setne %al No functional change intended. Cc: "K. Y. Srinivasan" Cc: Haiyang Zhang Cc: Wei Liu Cc: Dexuan Cui Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: "H. Peter Anvin" Signed-off-by: Uros Bizjak Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20231114170038.381634-1-ubizjak@gmail.com Signed-off-by: Wei Liu Message-ID: <20231114170038.381634-1-ubizjak@gmail.com> arch/x86/kernel/cpu/mshyperv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit b6fe6f03716da246b453369f98a553d4ab21447c Author: Hao Ge Date: Tue Nov 21 09:37:09 2023 +0800 dpll: Fix potential msg memleak when genlmsg_put_reply failed We should clean the skb resource if genlmsg_put_reply failed. Fixes: 9d71b54b65b1 ("dpll: netlink: Add DPLL framework base functions") Signed-off-by: Hao Ge Reviewed-by: Vadim Fedorenko Link: https://lore.kernel.org/r/20231121013709.73323-1-gehao@kylinos.cn Signed-off-by: Jakub Kicinski drivers/dpll/dpll_netlink.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) commit b2d66643dcf2c395207f9373c624e0ab32166e57 Merge: 495ec91b48e4 acb12c859ac7 Author: Jakub Kicinski Date: Tue Nov 21 15:49:30 2023 -0800 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2023-11-21 We've added 19 non-merge commits during the last 4 day(s) which contain a total of 18 files changed, 1043 insertions(+), 416 deletions(-). The main changes are: 1) Fix BPF verifier to validate callbacks as if they are called an unknown number of times in order to fix not detecting some unsafe programs, from Eduard Zingerman. 2) Fix bpf_redirect_peer() handling which missed proper stats accounting for veth and netkit and also generally fix missing stats for the latter, from Peilin Ye, Daniel Borkmann et al. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: check if max number of bpf_loop iterations is tracked bpf: keep track of max number of bpf_loop callback iterations selftests/bpf: test widening for iterating callbacks bpf: widening for callback iterators selftests/bpf: tests for iterating callbacks bpf: verify callbacks as if they are called unknown number of times bpf: extract setup_func_entry() utility function bpf: extract __check_reg_arg() utility function selftests/bpf: fix bpf_loop_bench for new callback verification scheme selftests/bpf: track string payload offset as scalar in strobemeta selftests/bpf: track tcp payload offset as scalar in xdp_synproxy selftests/bpf: Add netkit to tc_redirect selftest selftests/bpf: De-veth-ize the tc_redirect test case bpf, netkit: Add indirect call wrapper for fetching peer dev bpf: Fix dev's rx stats for bpf_redirect_peer traffic veth: Use tstats per-CPU traffic counters netkit: Add tstats per-CPU traffic counters net: Move {l,t,d}stats allocation to core and convert veth & vrf net, vrf: Move dstats structure to core ==================== Link: https://lore.kernel.org/r/20231121193113.11796-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 495ec91b48e489afefb2ad714f0d9b68c3016c6c Author: Jakub Kicinski Date: Mon Nov 20 12:01:09 2023 -0800 docs: netdev: try to guide people on dealing with silence There has been more than a few threads which went idle before the merge window and now people came back to them and started asking about next steps. We currently tell people to be patient and not to repost too often. Our "not too often", however, is still a few orders of magnitude faster than other subsystems. Or so I feel after hearing people talk about review rates at LPC. Clarify in the doc that if the discussion went idle for a week on netdev, 95% of the time there's no point waiting longer. Link: https://lore.kernel.org/r/20231120200109.620392-1-kuba@kernel.org Signed-off-by: Jakub Kicinski Documentation/process/maintainer-netdev.rst | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) commit 0739af07d1d947af27c877f797cb82ceee702515 Author: Jose Ignacio Tornos Martinez Date: Mon Nov 20 13:06:29 2023 +0100 net: usb: ax88179_178a: fix failed operations during ax88179_reset Using generic ASIX Electronics Corp. AX88179 Gigabit Ethernet device, the following test cycle has been implemented: - power on - check logs - shutdown - after detecting the system shutdown, disconnect power - after approximately 60 seconds of sleep, power is restored Running some cycles, sometimes error logs like this appear: kernel: ax88179_178a 2-9:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -19 kernel: ax88179_178a 2-9:1.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -19 ... These failed operation are happening during ax88179_reset execution, so the initialization could not be correct. In order to avoid this, we need to increase the delay after reset and clock initial operations. By using these larger values, many cycles have been run and no failed operations appear. It would be better to check some status register to verify when the operation has finished, but I do not have found any available information (neither in the public datasheets nor in the manufacturer's driver). The only available information for the necessary delays is the maufacturer's driver (original values) but the proposed values are not enough for the tested devices. Fixes: e2ca90c276e1f ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver") Reported-by: Herb Wei Tested-by: Herb Wei Signed-off-by: Jose Ignacio Tornos Martinez Link: https://lore.kernel.org/r/20231120120642.54334-1-jtornosm@redhat.com Signed-off-by: Jakub Kicinski drivers/net/usb/ax88179_178a.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ab93edb2f94c3c0d5965be3815782472adbe3f52 Author: Dave Airlie Date: Wed Nov 22 06:11:09 2023 +1000 nouveau/gsp: allocate enough space for all channel ids. This probably isn't the ideal fix, but we ended up using chids sparsely, and lots of things rely on indexing into the full range, so just allocate the full range up front. The GSP code fixes 8 channels into a userd page, but we end up using a single userd page per channel so end up sparsely using the range. Fixes a few crashes seen with multiple channels. Link: https://gitlab.freedesktop.org/drm/nouveau/-/issues/277 Signed-off-by: Dave Airlie Signed-off-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/20231121201109.2988516-1-airlied@gmail.com drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c2d5304e6c648ebcf653bace7e51e0e6742e46c8 Merge: 6b6552231648 a6584711e64d Author: Linus Torvalds Date: Tue Nov 21 11:56:57 2023 -0800 Merge tag 'platform-drivers-x86-v6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform drivers fixes from Ilpo Järvinen: "Just a few fixes (one with two non-fix deps) plus tidying up MAINTAINERS" * tag 'platform-drivers-x86-v6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: intel_telemetry: Fix kernel doc descriptions MAINTAINERS: Drop Mark Gross as maintainer for x86 platform drivers platform/x86/amd/pmc: adjust getting DRAM size behavior platform/x86: hp-bioscfg: Remove unused obj in hp_add_other_attributes() platform/x86: hp-bioscfg: Fix error handling in hp_add_other_attributes() platform/x86: hp-bioscfg: move mutex_lock() down in hp_add_other_attributes() platform/x86: hp-bioscfg: Simplify return check in hp_add_other_attributes() platform/x86: ideapad-laptop: Set max_brightness before using it MAINTAINERS: Remove stale entry for SBL platform driver commit 6b65522316489ff0b2be65d00fbcecbc781017c9 Merge: 98b1cc82c4af 62b241efff99 Author: Linus Torvalds Date: Tue Nov 21 11:45:48 2023 -0800 Merge tag 'erofs-for-6.7-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: - Tidy up erofs_read_inode() for simplicity - Fix broken fscache mode due to NULL dereference of dif->bdev_handle - Add the EROFS webpage to MAINTAINERS, documentation, and Kconfig * tag 'erofs-for-6.7-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: MAINTAINERS: erofs: add EROFS webpage erofs: fix NULL dereference of dif->bdev_handle in fscache mode erofs: simplify erofs_read_inode() commit cea7008190ad65b4aaae6e94667a358d2c10a696 Author: Cong Yang Date: Mon Nov 20 10:01:09 2023 +0800 drm/panel: boe-tv101wum-nl6: Fine tune Himax83102-j02 panel HFP and HBP The refresh reported by modetest is 60.46Hz, and the actual measurement is 60.01Hz, which is outside the expected tolerance. Adjust hporch and pixel clock to fix it. After repair, modetest and actual measurement were all 60.01Hz. Modetest refresh = Pixel CLK/ htotal* vtotal, but measurement frame rate is HS->LP cycle time(Vblanking). Measured frame rate is not only affecte by Htotal/Vtotal/pixel clock, also affected by Lane-num/PixelBit/LineTime /DSI CLK. Assume that the DSI controller could not make the mode that we requested(presumably it's PLL couldn't generate the exact pixel clock?). If you use a different DSI controller, you may need to readjust these parameters. Now this panel looks like it's only used by me on the MTK platform, so let's change this set of parameters. Fixes: 1bc2ef065f13 ("drm/panel: Support for Starry-himax83102-j02 TDDI MIPI-DSI panel") Signed-off-by: Cong Yang Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patchwork.freedesktop.org/patch/msgid/20231120020109.3216343-1-yangcong5@huaqin.corp-partner.google.com drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 29b8e94dcf2575c17541f843741ee96691ff1ded Author: Yang Jihong Date: Sat Nov 18 02:48:57 2023 +0000 perf lock contention: Fix a build error on 32-bit Fix a build error on 32-bit system: util/bpf_lock_contention.c: In function 'lock_contention_get_name': util/bpf_lock_contention.c:253:50: error: format '%lu' expects argument of type 'long unsigned int', but argument 4 has type 'u64 {aka long long unsigned int}' [-Werror=format=] snprintf(name_buf, sizeof(name_buf), "cgroup:%lu", cgrp_id); ~~^ %llu cc1: all warnings being treated as errors Fixes: d0c502e46e97 ("perf lock contention: Prepare to handle cgroups") Signed-off-by: Yang Jihong Acked-by: Namhyung Kim Cc: avagin@google.com Cc: daniel.diaz@linaro.org Link: https://lore.kernel.org/r/20231118024858.1567039-3-yangjihong1@huawei.com Signed-off-by: Namhyung Kim tools/perf/util/bpf_lock_contention.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit a6dda77a752d918b35ef4a3f94e6b8c7d7ba4a73 Author: Yang Jihong Date: Sat Nov 18 02:48:56 2023 +0000 perf kwork: Fix a build error on 32-bit lkft reported a build error for 32-bit system: builtin-kwork.c: In function 'top_print_work': builtin-kwork.c:1646:28: error: format '%ld' expects argument of type 'long int', but argument 3 has type 'u64' {aka 'long long unsigned int'} [-Werror=format=] 1646 | ret += printf(" %*ld ", PRINT_PID_WIDTH, work->id); | ~~~^ ~~~~~~~~ | | | | long int u64 {aka long long unsigned int} | %*lld cc1: all warnings being treated as errors make[3]: *** [/builds/linux/tools/build/Makefile.build:106: /home/tuxbuild/.cache/tuxmake/builds/1/build/builtin-kwork.o] Error 1 Fix it. Fixes: 55c40e505234 ("perf kwork top: Introduce new top utility") Reported-by: Linux Kernel Functional Testing Signed-off-by: Yang Jihong Acked-by: Namhyung Kim Cc: avagin@google.com Cc: daniel.diaz@linaro.org Link: https://lore.kernel.org/r/20231118024858.1567039-2-yangjihong1@huawei.com Signed-off-by: Namhyung Kim tools/perf/builtin-kwork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 080990aa3344123673f686cda2df0d1b0deee046 Author: Borislav Petkov (AMD) Date: Wed Nov 15 22:02:12 2023 +0100 x86/microcode: Rework early revisions reporting The AMD side of the loader issues the microcode revision for each logical thread on the system, which can become really noisy on huge machines. And doing that doesn't make a whole lot of sense - the microcode revision is already in /proc/cpuinfo. So in case one is interested in the theoretical support of mixed silicon steppings on AMD, one can check there. What is also missing on the AMD side - something which people have requested before - is showing the microcode revision the CPU had *before* the early update. So abstract that up in the main code and have the BSP on each vendor provide those revision numbers. Then, dump them only once on driver init. On Intel, do not dump the patch date - it is not needed. Reported-by: Linus Torvalds Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Thomas Gleixner Link: https://lore.kernel.org/r/CAHk-=wg=%2B8rceshMkB4VnKxmRccVLtBLPBawnewZuuqyx5U=3A@mail.gmail.com arch/x86/kernel/cpu/microcode/amd.c | 39 +++++++++----------------------- arch/x86/kernel/cpu/microcode/core.c | 11 +++++++-- arch/x86/kernel/cpu/microcode/intel.c | 17 ++++++-------- arch/x86/kernel/cpu/microcode/internal.h | 14 ++++++++---- 4 files changed, 37 insertions(+), 44 deletions(-) commit 2e569ada424c40ce27c99bfab4f9780619061c83 Author: Borislav Petkov (AMD) Date: Wed Nov 15 22:02:11 2023 +0100 x86/microcode: Remove the driver announcement and version First of all, the print is useless. The driver will either load and say which microcode revision the machine has or issue an error. Then, the version number is meaningless and actively confusing, as Yazen mentioned recently: when a subset of patches are backported to a distro kernel, one can't assume the driver version is the same as the upstream one. And besides, the version number of the loader hasn't been used and incremented for a long time. So drop it. Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Thomas Gleixner Link: https://lore.kernel.org/r/20231115210212.9981-2-bp@alien8.de arch/x86/kernel/cpu/microcode/core.c | 4 ---- 1 file changed, 4 deletions(-) commit 98c598afc22d4e43c2ad91860b65996d0c099a5d Author: Li Nan Date: Mon Sep 11 10:33:08 2023 +0800 nbd: pass nbd_sock to nbd_read_reply() instead of index If a socket is processing ioctl 'NBD_SET_SOCK', config->socks might be krealloc in nbd_add_socket(), and a garbage request is received now, a UAF may occurs. T1 nbd_ioctl __nbd_ioctl nbd_add_socket blk_mq_freeze_queue T2 recv_work nbd_read_reply sock_xmit krealloc config->socks def config->socks Pass nbd_sock to nbd_read_reply(). And introduce a new function sock_xmit_recv(), which differs from sock_xmit only in the way it get socket. ================================================================== BUG: KASAN: use-after-free in sock_xmit+0x525/0x550 Read of size 8 at addr ffff8880188ec428 by task kworker/u12:1/18779 Workqueue: knbd4-recv recv_work Call Trace: __dump_stack dump_stack+0xbe/0xfd print_address_description.constprop.0+0x19/0x170 __kasan_report.cold+0x6c/0x84 kasan_report+0x3a/0x50 sock_xmit+0x525/0x550 nbd_read_reply+0xfe/0x2c0 recv_work+0x1c2/0x750 process_one_work+0x6b6/0xf10 worker_thread+0xdd/0xd80 kthread+0x30a/0x410 ret_from_fork+0x22/0x30 Allocated by task 18784: kasan_save_stack+0x1b/0x40 kasan_set_track set_alloc_info __kasan_kmalloc __kasan_kmalloc.constprop.0+0xf0/0x130 slab_post_alloc_hook slab_alloc_node slab_alloc __kmalloc_track_caller+0x157/0x550 __do_krealloc krealloc+0x37/0xb0 nbd_add_socket +0x2d3/0x880 __nbd_ioctl nbd_ioctl+0x584/0x8e0 __blkdev_driver_ioctl blkdev_ioctl+0x2a0/0x6e0 block_ioctl+0xee/0x130 vfs_ioctl __do_sys_ioctl __se_sys_ioctl+0x138/0x190 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x61/0xc6 Freed by task 18784: kasan_save_stack+0x1b/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x20/0x40 __kasan_slab_free.part.0+0x13f/0x1b0 slab_free_hook slab_free_freelist_hook slab_free kfree+0xcb/0x6c0 krealloc+0x56/0xb0 nbd_add_socket+0x2d3/0x880 __nbd_ioctl nbd_ioctl+0x584/0x8e0 __blkdev_driver_ioctl blkdev_ioctl+0x2a0/0x6e0 block_ioctl+0xee/0x130 vfs_ioctl __do_sys_ioctl __se_sys_ioctl+0x138/0x190 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x61/0xc6 Signed-off-by: Li Nan Reviewed-by: Yu Kuai Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20230911023308.3467802-1-linan666@huaweicloud.com Signed-off-by: Jens Axboe drivers/block/nbd.c | 35 ++++++++++++++++++++++------------- 1 file changed, 22 insertions(+), 13 deletions(-) commit 16b7e0cccb243033de4406ffb4d892365041a1e7 Author: Johan Hovold Date: Fri Nov 3 17:43:23 2023 +0100 USB: xhci-plat: fix legacy PHY double init Commits 7b8ef22ea547 ("usb: xhci: plat: Add USB phy support") and 9134c1fd0503 ("usb: xhci: plat: Add USB 3.0 phy support") added support for looking up legacy PHYs from the sysdev devicetree node and initialising them. This broke drivers such as dwc3 which manages PHYs themself as the PHYs would now be initialised twice, something which specifically can lead to resources being left enabled during suspend (e.g. with the usb_phy_generic PHY driver). As the dwc3 driver uses driver-name matching for the xhci platform device, fix this by only looking up and initialising PHYs for devices that have been matched using OF. Note that checking that the platform device has a devicetree node would currently be sufficient, but that could lead to subtle breakages in case anyone ever tries to reuse an ancestor's node. Fixes: 7b8ef22ea547 ("usb: xhci: plat: Add USB phy support") Fixes: 9134c1fd0503 ("usb: xhci: plat: Add USB 3.0 phy support") Cc: stable@vger.kernel.org # 4.1 Cc: Maxime Ripard Cc: Stanley Chang Signed-off-by: Johan Hovold Tested-by: Stefan Eichenberger Tested-by: Stanley Chang Link: https://lore.kernel.org/r/20231103164323.14294-1-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-plat.c | 50 ++++++++++++++++++++++++++------------------ 1 file changed, 30 insertions(+), 20 deletions(-) commit 4b435764f7c2922822962e7f6343cce645d502f1 Author: Heikki Krogerus Date: Tue Nov 21 13:46:47 2023 +0200 usb: typec: tipd: Supply also I2C driver data If there is no fwnode, device_get_match_data() does not return anything making the probe to always fail. Using i2c_get_match_data() when there is no fwnode to fix that. Fixes: 5bd4853da049 ("USB: typec: tps6598x: Add device data to of_device_id") Signed-off-by: Heikki Krogerus Link: https://lore.kernel.org/r/20231121114647.2005011-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/tipd/core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 61d2cf0db741827724d33079b4a54bf99a32b8e5 Author: Chunfeng Yun Date: Sat Nov 18 11:30:11 2023 +0800 usb: xhci-mtk: fix in-ep's start-split check failure It's wrong to use the data length in a CS (in uframe x) to check whether there is a SS (in uframe x-2), because for a isoc-in ep, it may need some CS to receive data; Save the count of SS in a uframe for isoc/intr in-eps to fix the issue. Fixes: 5c954e030f55 ("usb: xhci-mtk: improve split scheduling by separate IN/OUT budget") Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20231118033011.22033-1-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-mtk-sch.c | 13 ++++++++++--- drivers/usb/host/xhci-mtk.h | 2 ++ 2 files changed, 12 insertions(+), 3 deletions(-) commit 8bbae288a85abed6a1cf7d185d8b9dc2f5dcb12c Author: Ricardo Ribalda Date: Fri Oct 27 11:28:20 2023 +0000 usb: dwc3: set the dma max_seg_size Allow devices to have dma operations beyond 4K, and avoid warnings such as: DMA-API: dwc3 a600000.usb: mapping sg segment longer than device claims to support [len=86016] [max=65536] Cc: stable@vger.kernel.org Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") Reported-by: Zubin Mithra Signed-off-by: Ricardo Ribalda Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20231026-dwc3-v2-1-1d4fd5c3e067@chromium.org Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc3/core.c | 2 ++ 1 file changed, 2 insertions(+) commit 974bba5c118f4c2baf00de0356e3e4f7928b4cbc Author: Niklas Neronin Date: Wed Nov 15 14:13:25 2023 +0200 usb: config: fix iteration issue in 'usb_get_bos_descriptor()' The BOS descriptor defines a root descriptor and is the base descriptor for accessing a family of related descriptors. Function 'usb_get_bos_descriptor()' encounters an iteration issue when skipping the 'USB_DT_DEVICE_CAPABILITY' descriptor type. This results in the same descriptor being read repeatedly. To address this issue, a 'goto' statement is introduced to ensure that the pointer and the amount read is updated correctly. This ensures that the function iterates to the next descriptor instead of reading the same descriptor repeatedly. Cc: stable@vger.kernel.org Fixes: 3dd550a2d365 ("USB: usbcore: Fix slab-out-of-bounds bug during device reset") Signed-off-by: Niklas Neronin Acked-by: Mathias Nyman Reviewed-by: Alan Stern Link: https://lore.kernel.org/r/20231115121325.471454-1-niklas.neronin@linux.intel.com Signed-off-by: Greg Kroah-Hartman drivers/usb/core/config.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 791cd7afe51b0c770264836ab0607766e3e80f52 Author: Stanley Chang Date: Fri Nov 17 15:03:05 2023 +0800 usb: dwc3: add missing of_node_put and platform_device_put of_get_compatible_child performs an of_node_get, so an of_node_put is required. Add platform_device_put to match with of_find_device_by_node. Fixes: 34c200483569 ("usb: dwc3: add Realtek DHC RTD SoC dwc3 glue layer driver") Signed-off-by: Stanley Chang Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20231117070311.32502-1-stanley_chang@realtek.com Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc3/dwc3-rtk.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 0583bc776ca5b5a3f5752869fc31cf7322df2b35 Author: Oliver Neukum Date: Wed Nov 15 15:45:07 2023 +0100 USB: dwc2: write HCINT with INTMASK applied dwc2_hc_n_intr() writes back INTMASK as read but evaluates it with intmask applied. In stress testing this causes spurious interrupts like this: [Mon Aug 14 10:51:07 2023] dwc2 3f980000.usb: dwc2_hc_chhltd_intr_dma: Channel 7 - ChHltd set, but reason is unknown [Mon Aug 14 10:51:07 2023] dwc2 3f980000.usb: hcint 0x00000002, intsts 0x04600001 [Mon Aug 14 10:51:08 2023] dwc2 3f980000.usb: dwc2_hc_chhltd_intr_dma: Channel 0 - ChHltd set, but reason is unknown [Mon Aug 14 10:51:08 2023] dwc2 3f980000.usb: hcint 0x00000002, intsts 0x04600001 [Mon Aug 14 10:51:08 2023] dwc2 3f980000.usb: dwc2_hc_chhltd_intr_dma: Channel 4 - ChHltd set, but reason is unknown [Mon Aug 14 10:51:08 2023] dwc2 3f980000.usb: hcint 0x00000002, intsts 0x04600001 [Mon Aug 14 10:51:08 2023] dwc2 3f980000.usb: dwc2_update_urb_state_abn(): trimming xfer length Applying INTMASK prevents this. The issue exists in all versions of the driver. Signed-off-by: Oliver Neukum Tested-by: Ivan Ivanov Tested-by: Andrea della Porta Link: https://lore.kernel.org/r/20231115144514.15248-1-oneukum@suse.com Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc2/hcd_intr.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit 30ce1c03a083c9dc131d09d28ba1bcaafa3d8df2 Author: Wentong Wu Date: Tue Nov 14 15:25:31 2023 +0800 usb: misc: ljca: Drop _ADR support to get ljca children devices Currently the shipped platforms use only _HID to distinguish ljca children devices. The _ADR support here is for future HW. This patch is to drop _ADR support and we can then re-introduce it (revert this patch) if future HW actually starts using _ADR to distinguish children devices. Signed-off-by: Wentong Wu Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231114072531.1366753-1-wentong.wu@intel.com Signed-off-by: Greg Kroah-Hartman drivers/usb/misc/usb-ljca.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) commit 58f2fcb3a845fcbbad2f3196bb37d744e0506250 Author: Pawel Laszczak Date: Wed Nov 8 10:31:25 2023 +0100 usb: cdnsp: Fix deadlock issue during using NCM gadget The interrupt service routine registered for the gadget is a primary handler which mask the interrupt source and a threaded handler which handles the source of the interrupt. Since the threaded handler is voluntary threaded, the IRQ-core does not disable bottom halves before invoke the handler like it does for the forced-threaded handler. Due to changes in networking it became visible that a network gadget's completions handler may schedule a softirq which remains unprocessed. The gadget's completion handler is usually invoked either in hard-IRQ or soft-IRQ context. In this context it is enough to just raise the softirq because the softirq itself will be handled once that context is left. In the case of the voluntary threaded handler, there is nothing that will process pending softirqs. Which means it remain queued until another random interrupt (on this CPU) fires and handles it on its exit path or another thread locks and unlocks a lock with the bh suffix. Worst case is that the CPU goes idle and the NOHZ complains about unhandled softirqs. Disable bottom halves before acquiring the lock (and disabling interrupts) and enable them after dropping the lock. This ensures that any pending softirqs will handled right away. cc: stable@vger.kernel.org Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") Signed-off-by: Pawel Laszczak Acked-by: Peter Chen Link: https://lore.kernel.org/r/20231108093125.224963-1-pawell@cadence.com Signed-off-by: Greg Kroah-Hartman drivers/usb/cdns3/cdnsp-ring.c | 3 +++ 1 file changed, 3 insertions(+) commit 187fb003c57c964ea61ac9fbfe41abf3ca9973eb Author: Badhri Jagan Sridharan Date: Wed Nov 1 01:28:45 2023 +0000 usb: typec: tcpm: Fix sink caps op current check TCPM checks for sink caps operational current even when PD is disabled. This incorrectly sets tcpm_set_charge() when PD is disabled. Check for sink caps only when PD is enabled. [ 97.572342] Start toggling [ 97.578949] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected] [ 99.571648] CC1: 0 -> 0, CC2: 0 -> 4 [state TOGGLING, polarity 0, connected] [ 99.571658] state change TOGGLING -> SNK_ATTACH_WAIT [rev3 NONE_AMS] [ 99.571673] pending state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED @ 170 ms [rev3 NONE_AMS] [ 99.741778] state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED [delayed 170 ms] [ 99.789283] CC1: 0 -> 0, CC2: 4 -> 5 [state SNK_DEBOUNCED, polarity 0, connected] [ 99.789306] state change SNK_DEBOUNCED -> SNK_DEBOUNCED [rev3 NONE_AMS] [ 99.903584] VBUS on [ 99.903591] state change SNK_DEBOUNCED -> SNK_ATTACHED [rev3 NONE_AMS] [ 99.903600] polarity 1 [ 99.910155] enable vbus discharge ret:0 [ 99.910160] Requesting mux state 1, usb-role 2, orientation 2 [ 99.946791] state change SNK_ATTACHED -> SNK_STARTUP [rev3 NONE_AMS] [ 99.946798] state change SNK_STARTUP -> SNK_DISCOVERY [rev3 NONE_AMS] [ 99.946800] Setting voltage/current limit 5000 mV 500 mA [ 99.946803] vbus=0 charge:=1 [ 100.027139] state change SNK_DISCOVERY -> SNK_READY [rev3 NONE_AMS] [ 100.027145] Setting voltage/current limit 5000 mV 3000 mA [ 100.466830] VBUS on Cc: stable@vger.kernel.org Fixes: 803b1c8a0cea ("usb: typec: tcpm: not sink vbus if operational current is 0mA") Signed-off-by: Badhri Jagan Sridharan Reviewed-by: Guenter Roeck Acked-by: Heikki Krogerus Tested-by: Will McVicker Link: https://lore.kernel.org/r/20231101012845.2701348-1-badhri@google.com Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/tcpm/tcpm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 10d510abd096d620b9fda2dd3e0047c5efc4ad2b Author: Alexander Stein Date: Wed Oct 25 11:51:10 2023 +0200 usb: dwc3: Fix default mode initialization The default mode, configurable by DT, shall be set before usb role switch driver is registered. Otherwise there is a race between default mode and mode set by usb role switch driver. Fixes: 98ed256a4dbad ("usb: dwc3: Add support for role-switch-default-mode binding") Cc: stable Signed-off-by: Alexander Stein Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20231025095110.2405281-1-alexander.stein@ew.tq-group.com Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc3/drd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cdd0cde8d8837de3d234bb08115d5f196e0ac8dd Author: Christophe JAILLET Date: Mon Oct 30 07:56:40 2023 +0100 USB: typec: tps6598x: Fix a memory leak in an error handling path All error handling end to the error handling path, except these ones. Go to 'release_fw' as well here, otherwise 'fw' is leaking. Fixes: 7e7a3c815d22 ("USB: typec: tps6598x: Add TPS25750 support") Signed-off-by: Christophe JAILLET Acked-by: Heikki Krogerus Link: https://lore.kernel.org/r/23168336f18a9f6cb1a5b47130fc134dc0510d7f.1698648980.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/tipd/core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit a6fe37f428c19dd164c2111157d4a1029bd853aa Author: Badhri Jagan Sridharan Date: Wed Nov 1 02:19:09 2023 +0000 usb: typec: tcpm: Skip hard reset when in error recovery Hard reset queued prior to error recovery (or) received during error recovery will make TCPM to prematurely exit error recovery sequence. Ignore hard resets received during error recovery (or) port reset sequence. ``` [46505.459688] state change SNK_READY -> ERROR_RECOVERY [rev3 NONE_AMS] [46505.459706] state change ERROR_RECOVERY -> PORT_RESET [rev3 NONE_AMS] [46505.460433] disable vbus discharge ret:0 [46505.461226] Setting usb_comm capable false [46505.467244] Setting voltage/current limit 0 mV 0 mA [46505.467262] polarity 0 [46505.470695] Requesting mux state 0, usb-role 0, orientation 0 [46505.475621] cc:=0 [46505.476012] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev3 NONE_AMS] [46505.476020] Received hard reset [46505.476024] state change PORT_RESET -> HARD_RESET_START [rev3 HARD_RESET] ``` Cc: stable@vger.kernel.org Fixes: f0690a25a140 ("staging: typec: USB Type-C Port Manager (tcpm)") Signed-off-by: Badhri Jagan Sridharan Acked-by: Heikki Krogeus Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20231101021909.2962679-1-badhri@google.com Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/tcpm/tcpm.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 41058707bea93b979c4854bdb857e46f2b85df92 Author: Johan Hovold Date: Fri Nov 10 14:48:02 2023 +0100 dt-bindings: usb: hcd: add missing phy name to example The example host controller node has two PHYs and therefore needs two PHY names. Fixes: 3aa3c66aedef ("dt-bindings: usb: Bring back phy-names") Signed-off-by: Johan Hovold Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231110134802.32060-1-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman Documentation/devicetree/bindings/usb/usb-hcd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9c6dc13106f2dd2d6819d66618b25a6f41f0ee6a Author: Simon Horman Date: Mon Nov 20 08:28:40 2023 +0000 MAINTAINERS: Add indirect_call_wrapper.h to NETWORKING [GENERAL] indirect_call_wrapper.h is not, strictly speaking, networking specific. However, it's git history indicates that in practice changes go through netdev and thus the netdev maintainers have effectively been taking responsibility for it. Formalise this by adding it to the NETWORKING [GENERAL] section in the MAINTAINERS file. It is not clear how many other files under include/linux fall into this category and it would be interesting, as a follow-up, to audit that and propose further updates to the MAINTAINERS file as appropriate. Link: https://lore.kernel.org/netdev/20231116010310.4664dd38@kernel.org/ Signed-off-by: Simon Horman Link: https://lore.kernel.org/r/20231120-indirect_call_wrapper-maintainer-v1-1-0a6bb1f7363e@kernel.org Signed-off-by: Paolo Abeni MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit 5b4ffb176d7979ac66b349addf3f7de433335e00 Author: Jiri Kosina Date: Tue Nov 21 14:38:11 2023 +0100 Revert "HID: logitech-dj: Add support for a new lightspeed receiver iteration" This reverts commit 9d1bd9346241cd6963b58da7ffb7ed303285f684. Multiple people reported misbehaving devices and reverting this commit fixes the problem for them. As soon as the original commit author starts reacting again, we can try to figure out why he hasn't seen the issues (mismatching report descriptors?), but for the time being, fix for 6.7 by reverting. Link: https://bugzilla.kernel.org/show_bug.cgi?id=218172 Link: https://bugzilla.kernel.org/show_bug.cgi?id=218094 Cc: Signed-off-by: Jiri Kosina drivers/hid/hid-ids.h | 1 - drivers/hid/hid-logitech-dj.c | 11 +++-------- 2 files changed, 3 insertions(+), 9 deletions(-) commit a1092619dd28ac0fcf23016160a2fdccd98ef935 Author: Puliang Lu Date: Thu Oct 26 20:35:06 2023 +0800 USB: serial: option: fix FM101R-GL defines Modify the definition of the two Fibocom FM101R-GL PID macros, which had their PIDs switched. The correct PIDs are: - VID:PID 413C:8213, FM101R-GL ESIM are laptop M.2 cards (with MBIM interfaces for Linux) - VID:PID 413C:8215, FM101R-GL are laptop M.2 cards (with MBIM interface for Linux) 0x8213: mbim, tty 0x8215: mbim, tty Signed-off-by: Puliang Lu Fixes: 52480e1f1a25 ("USB: serial: option: add Fibocom to DELL custom modem FM101R-GL") Link: https://lore.kernel.org/lkml/TYZPR02MB508845BAD7936A62A105CE5D89DFA@TYZPR02MB5088.apcprd02.prod.outlook.com/ Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold drivers/usb/serial/option.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8771127e25d6c20d458ad27cf32f7fcfc1755e05 Author: Lech Perczak Date: Sat Nov 18 00:19:17 2023 +0100 USB: serial: option: don't claim interface 4 for ZTE MF290 Interface 4 is used by for QMI interface in stock firmware of MF28D, the router which uses MF290 modem. Free the interface up, to rebind it to qmi_wwan driver. The proper configuration is: Interface mapping is: 0: QCDM, 1: (unknown), 2: AT (PCUI), 2: AT (Modem), 4: QMI T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=19d2 ProdID=0189 Rev= 0.00 S: Manufacturer=ZTE, Incorporated S: Product=ZTE LTE Technologies MSM C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms Cc: Bjørn Mork Signed-off-by: Lech Perczak Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold drivers/usb/serial/option.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e8df9d9f4209c04161321d8c12640ae560f65939 Author: Dapeng Mi Date: Tue Nov 21 09:46:28 2023 +0800 perf/x86/intel: Correct incorrect 'or' operation for PMU capabilities When running perf-stat command on Intel hybrid platform, perf-stat reports the following errors: sudo taskset -c 7 ./perf stat -vvvv -e cpu_atom/instructions/ sleep 1 Opening: cpu/cycles/:HG ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0xa00000000 disabled 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 sys_perf_event_open failed, error -16 Performance counter stats for 'sleep 1': cpu_atom/instructions/ It looks the cpu_atom/instructions/ event can't be enabled on atom PMU even when the process is pinned on atom core. Investigation shows that exclusive_event_init() helper always returns -EBUSY error in the perf event creation. That's strange since the atom PMU should not be an exclusive PMU. Further investigation shows the issue was introduced by commit: 97588df87b56 ("perf/x86/intel: Add common intel_pmu_init_hybrid()") The commit originally intents to clear the bit PERF_PMU_CAP_AUX_OUTPUT from PMU capabilities if intel_cap.pebs_output_pt_available is not set, but it incorrectly uses 'or' operation and leads to all PMU capabilities bits are set to 1 except bit PERF_PMU_CAP_AUX_OUTPUT. Testing this fix on Intel hybrid platforms, the observed issues disappear. Fixes: 97588df87b56 ("perf/x86/intel: Add common intel_pmu_init_hybrid()") Signed-off-by: Dapeng Mi Signed-off-by: Ingo Molnar Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20231121014628.729989-1-dapeng1.mi@linux.intel.com arch/x86/events/intel/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 54d4434da824460a190d547404530eff12a7907d Merge: c0e2926266af c807d6cd089d Author: Paolo Abeni Date: Tue Nov 21 13:15:04 2023 +0100 Merge branch 'hv_netvsc-fix-race-of-netvsc-vf-register-and-slave-bit' Haiyang Zhang says: ==================== hv_netvsc: fix race of netvsc, VF register, and slave bit There are some races between netvsc probe, set notifier, VF register, and slave bit setting. This patch set fixes them. ==================== Link: https://lore.kernel.org/r/1700411023-14317-1-git-send-email-haiyangz@microsoft.com Signed-off-by: Paolo Abeni commit c807d6cd089d2f4951baa838081ec5ae3e2360f8 Author: Long Li Date: Sun Nov 19 08:23:43 2023 -0800 hv_netvsc: Mark VF as slave before exposing it to user-mode When a VF is being exposed form the kernel, it should be marked as "slave" before exposing to the user-mode. The VF is not usable without netvsc running as master. The user-mode should never see a VF without the "slave" flag. This commit moves the code of setting the slave flag to the time before VF is exposed to user-mode. Cc: stable@vger.kernel.org Fixes: 0c195567a8f6 ("netvsc: transparent VF management") Signed-off-by: Long Li Signed-off-by: Haiyang Zhang Acked-by: Stephen Hemminger Acked-by: Dexuan Cui Signed-off-by: Paolo Abeni drivers/net/hyperv/netvsc_drv.c | 32 +++++++++++++++++++++++--------- 1 file changed, 23 insertions(+), 9 deletions(-) commit 85520856466ed6bc3b1ccb013cddac70ceb437db Author: Haiyang Zhang Date: Sun Nov 19 08:23:42 2023 -0800 hv_netvsc: Fix race of register_netdevice_notifier and VF register If VF NIC is registered earlier, NETDEV_REGISTER event is replayed, but NETDEV_POST_INIT is not. Move register_netdevice_notifier() earlier, so the call back function is set before probing. Cc: stable@vger.kernel.org Fixes: e04e7a7bbd4b ("hv_netvsc: Fix a deadlock by getting rtnl lock earlier in netvsc_probe()") Reported-by: Dexuan Cui Signed-off-by: Haiyang Zhang Reviewed-by: Wojciech Drewek Reviewed-by: Dexuan Cui Signed-off-by: Paolo Abeni drivers/net/hyperv/netvsc_drv.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit d30fb712e52964f2cf9a9c14cf67078394044837 Author: Haiyang Zhang Date: Sun Nov 19 08:23:41 2023 -0800 hv_netvsc: fix race of netvsc and VF register_netdevice The rtnl lock also needs to be held before rndis_filter_device_add() which advertises nvsp_2_vsc_capability / sriov bit, and triggers VF NIC offering and registering. If VF NIC finished register_netdev() earlier it may cause name based config failure. To fix this issue, move the call to rtnl_lock() before rndis_filter_device_add(), so VF will be registered later than netvsc / synthetic NIC, and gets a name numbered (ethX) after netvsc. Cc: stable@vger.kernel.org Fixes: e04e7a7bbd4b ("hv_netvsc: Fix a deadlock by getting rtnl lock earlier in netvsc_probe()") Reported-by: Dexuan Cui Signed-off-by: Haiyang Zhang Reviewed-by: Wojciech Drewek Reviewed-by: Simon Horman Reviewed-by: Dexuan Cui Signed-off-by: Paolo Abeni drivers/net/hyperv/netvsc_drv.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) commit c0e2926266af3b5acf28df0a8fc6e4d90effe0bb Author: Kunwu Chan Date: Sun Nov 19 22:17:59 2023 +0800 ipv4: Correct/silence an endian warning in __ip_do_redirect net/ipv4/route.c:783:46: warning: incorrect type in argument 2 (different base types) net/ipv4/route.c:783:46: expected unsigned int [usertype] key net/ipv4/route.c:783:46: got restricted __be32 [usertype] new_gw Fixes: 969447f226b4 ("ipv4: use new_gw for redirect neigh lookup") Suggested-by: Eric Dumazet Signed-off-by: Kunwu Chan Link: https://lore.kernel.org/r/20231119141759.420477-1-chentao@kylinos.cn Signed-off-by: Paolo Abeni net/ipv4/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4e7a8dbd2bc0aec4605a5069df7a779bd9e64db1 Author: Florian Fainelli Date: Mon Nov 13 08:46:32 2023 -0800 pwm: bcm2835: Fix NPD in suspend/resume When 119a508c4dc9 ("pwm: bcm2835: Add support for suspend/resume") was sent out on October 11th,, there was still a call to platform_set_drvdata() which would ensure that the driver private data structure could be used in bcm2835_pwm_{suspend,resume}. A cleanup now merged as commit commit 2ce7b7f6704c ("pwm: bcm2835: Simplify using devm functions") removed that call which would now cause a NPD in bcm2835_pwm_{suspend,resume} as a consequence. Fixes: 119a508c4dc9 ("pwm: bcm2835: Add support for suspend/resume") Signed-off-by: Florian Fainelli Reviewed-by: Uwe Kleine-König Link: https://lore.kernel.org/linux-pwm/20231113164632.2439400-1-florian.fainelli@broadcom.com Signed-off-by: Uwe Kleine-König drivers/pwm/pwm-bcm2835.c | 2 ++ 1 file changed, 2 insertions(+) commit c55092187d9ad7b2f8f5a8645286fa03997d442f Author: Oliver Neukum Date: Tue Nov 14 15:54:30 2023 +0100 HID: add ALWAYS_POLL quirk for Apple kb These devices disconnect if suspended without remote wakeup. They can operate with the standard driver. Signed-off-by: Oliver Neukum Signed-off-by: Jiri Kosina drivers/hid/hid-quirks.c | 1 + 1 file changed, 1 insertion(+) commit 8d6ef26501b97243ee6c16b8187c5b38cb69b77d Author: Thomas Zimmermann Date: Thu Nov 16 14:02:12 2023 +0100 drm/ast: Disconnect BMC if physical connector is connected Many user-space compositors fail with mode setting if a CRTC has more than one connected connector. This is the case with the BMC on Aspeed systems. Work around this problem by setting the BMC's connector status to disconnected when the physical connector has a display attached. This way compositors will only see one connected connector at a time; either the physical one or the BMC. Suggested-by: Jocelyn Falempe Fixes: e329cb53b45d ("drm/ast: Add BMC virtual connector") Signed-off-by: Thomas Zimmermann Cc: # v6.6+ Reviewed-by: Jocelyn Falempe Link: https://patchwork.freedesktop.org/patch/msgid/20231116130217.22931-1-tzimmermann@suse.de drivers/gpu/drm/ast/ast_drv.h | 13 ++++++++- drivers/gpu/drm/ast/ast_mode.c | 62 +++++++++++++++++++++++++++++++++++++----- 2 files changed, 67 insertions(+), 8 deletions(-) commit a5e913c25b6b2b6ae02acef6d9400645ac03dfdf Author: Brett Raye Date: Thu Nov 2 18:10:38 2023 -0700 HID: glorious: fix Glorious Model I HID report The Glorious Model I mouse has a buggy HID report descriptor for its keyboard endpoint (used for programmable buttons). For report ID 2, there is a mismatch between Logical Minimum and Usage Minimum in the array that reports keycodes. The offending portion of the descriptor: (from hid-decode) 0x95, 0x05, // Report Count (5) 30 0x75, 0x08, // Report Size (8) 32 0x15, 0x00, // Logical Minimum (0) 34 0x25, 0x65, // Logical Maximum (101) 36 0x05, 0x07, // Usage Page (Keyboard) 38 0x19, 0x01, // Usage Minimum (1) 40 0x29, 0x65, // Usage Maximum (101) 42 0x81, 0x00, // Input (Data,Arr,Abs) 44 This bug shifts all programmed keycodes up by 1. Importantly, this causes "empty" array indexes of 0x00 to be interpreted as 0x01, ErrorRollOver. The presence of ErrorRollOver causes the system to ignore all keypresses from the endpoint and breaks the ability to use the programmable buttons. Setting byte 41 to 0x00 fixes this, and causes keycodes to be interpreted correctly. Also, USB_VENDOR_ID_GLORIOUS is changed to USB_VENDOR_ID_SINOWEALTH, and a new ID for Laview Technology is added. Glorious seems to be white-labeling controller boards or mice from these vendors. There isn't a single canonical vendor ID for Glorious products. Signed-off-by: Brett Raye Signed-off-by: Jiri Kosina drivers/hid/hid-glorious.c | 16 ++++++++++++++-- drivers/hid/hid-ids.h | 11 +++++++---- 2 files changed, 21 insertions(+), 6 deletions(-) commit fc43e9c857b7aa55efba9398419b14d9e35dcc7d Author: Charles Yi Date: Tue Oct 31 12:32:39 2023 +0800 HID: fix HID device resource race between HID core and debugging support hid_debug_events_release releases resources bound to the HID device instance. hid_device_release releases the underlying HID device instance potentially before hid_debug_events_release has completed releasing debug resources bound to the same HID device instance. Reference count to prevent the HID device instance from being torn down preemptively when HID debugging support is used. When count reaches zero, release core resources of HID device instance using hiddev_free. The crash: [ 120.728477][ T4396] kernel BUG at lib/list_debug.c:53! [ 120.728505][ T4396] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 120.739806][ T4396] Modules linked in: bcmdhd dhd_static_buf 8822cu pcie_mhi r8168 [ 120.747386][ T4396] CPU: 1 PID: 4396 Comm: hidt_bridge Not tainted 5.10.110 #257 [ 120.754771][ T4396] Hardware name: Rockchip RK3588 EVB4 LP4 V10 Board (DT) [ 120.761643][ T4396] pstate: 60400089 (nZCv daIf +PAN -UAO -TCO BTYPE=--) [ 120.768338][ T4396] pc : __list_del_entry_valid+0x98/0xac [ 120.773730][ T4396] lr : __list_del_entry_valid+0x98/0xac [ 120.779120][ T4396] sp : ffffffc01e62bb60 [ 120.783126][ T4396] x29: ffffffc01e62bb60 x28: ffffff818ce3a200 [ 120.789126][ T4396] x27: 0000000000000009 x26: 0000000000980000 [ 120.795126][ T4396] x25: ffffffc012431000 x24: ffffff802c6d4e00 [ 120.801125][ T4396] x23: ffffff8005c66f00 x22: ffffffc01183b5b8 [ 120.807125][ T4396] x21: ffffff819df2f100 x20: 0000000000000000 [ 120.813124][ T4396] x19: ffffff802c3f0700 x18: ffffffc01d2cd058 [ 120.819124][ T4396] x17: 0000000000000000 x16: 0000000000000000 [ 120.825124][ T4396] x15: 0000000000000004 x14: 0000000000003fff [ 120.831123][ T4396] x13: ffffffc012085588 x12: 0000000000000003 [ 120.837123][ T4396] x11: 00000000ffffbfff x10: 0000000000000003 [ 120.843123][ T4396] x9 : 455103d46b329300 x8 : 455103d46b329300 [ 120.849124][ T4396] x7 : 74707572726f6320 x6 : ffffffc0124b8cb5 [ 120.855124][ T4396] x5 : ffffffffffffffff x4 : 0000000000000000 [ 120.861123][ T4396] x3 : ffffffc011cf4f90 x2 : ffffff81fee7b948 [ 120.867122][ T4396] x1 : ffffffc011cf4f90 x0 : 0000000000000054 [ 120.873122][ T4396] Call trace: [ 120.876259][ T4396] __list_del_entry_valid+0x98/0xac [ 120.881304][ T4396] hid_debug_events_release+0x48/0x12c [ 120.886617][ T4396] full_proxy_release+0x50/0xbc [ 120.891323][ T4396] __fput+0xdc/0x238 [ 120.895075][ T4396] ____fput+0x14/0x24 [ 120.898911][ T4396] task_work_run+0x90/0x148 [ 120.903268][ T4396] do_exit+0x1bc/0x8a4 [ 120.907193][ T4396] do_group_exit+0x8c/0xa4 [ 120.911458][ T4396] get_signal+0x468/0x744 [ 120.915643][ T4396] do_signal+0x84/0x280 [ 120.919650][ T4396] do_notify_resume+0xd0/0x218 [ 120.924262][ T4396] work_pending+0xc/0x3f0 [ Rahul Rameshbabu : rework changelog ] Fixes: cd667ce24796 ("HID: use debugfs for events/reports dumping") Signed-off-by: Charles Yi Signed-off-by: Jiri Kosina drivers/hid/hid-core.c | 12 ++++++++++-- drivers/hid/hid-debug.c | 3 +++ include/linux/hid.h | 3 +++ 3 files changed, 16 insertions(+), 2 deletions(-) commit 113f736655e4f20633e107d731dd5bd097d5938c Author: Yihong Cao Date: Mon Oct 30 01:05:38 2023 +0800 HID: apple: add Jamesdonkey and A3R to non-apple keyboards list Jamesdonkey A3R keyboard is identified as "Jamesdonkey A3R" in wired mode, "A3R-U" in wireless mode and "A3R" in bluetooth mode. Adding them to non-apple keyboards fixes function key. Signed-off-by: Yihong Cao Signed-off-by: Jiri Kosina drivers/hid/hid-apple.c | 2 ++ 1 file changed, 2 insertions(+) commit 73ce9f1f2741a38f5d27393e627702ae2c46e6f2 Author: Hamish Martin Date: Wed Oct 25 16:55:11 2023 +1300 HID: mcp2221: Allow IO to start during probe During the probe we add an I2C adapter and as soon as we add that adapter it may be used for a transfer (e.g via the code in i2cdetect()). Those transfers are not able to complete and time out. This is because the HID raw_event callback (mcp2221_raw_event) will not be invoked until the HID device's 'driver_input_lock' is marked up at the completion of the probe in hid_device_probe(). This starves the driver of the responses it is waiting for. In order to allow the I2C transfers to complete while we are still in the probe, start the IO once we have completed init of the HID device. This issue seems to have been seen before and a patch was submitted but it seems it was never accepted. See: https://lore.kernel.org/all/20221103222714.21566-3-Enrik.Berkhan@inka.de/ Signed-off-by: Hamish Martin Signed-off-by: Jiri Kosina drivers/hid/hid-mcp2221.c | 2 ++ 1 file changed, 2 insertions(+) commit f2d4a5834638bbc967371b9168c0b481519f7c5e Author: Hamish Martin Date: Wed Oct 25 16:55:10 2023 +1300 HID: mcp2221: Set driver data before I2C adapter add The process of adding an I2C adapter can invoke I2C accesses on that new adapter (see i2c_detect()). Ensure we have set the adapter's driver data to avoid null pointer dereferences in the xfer functions during the adapter add. This has been noted in the past and the same fix proposed but not completed. See: https://lore.kernel.org/lkml/ef597e73-ed71-168e-52af-0d19b03734ac@vigem.de/ Signed-off-by: Hamish Martin Signed-off-by: Jiri Kosina drivers/hid/hid-mcp2221.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3f7c0634926daf48cd2f6db6c1197a1047074088 Author: Jacek Lawrynowicz Date: Wed Nov 15 12:10:04 2023 +0100 accel/ivpu/37xx: Fix hangs related to MMIO reset There is no need to call MMIO reset using VPU_37XX_BUTTRESS_VPU_IP_RESET register. IP will be reset by FLR or by entering d0i3. Also IP reset during power_up is not needed as the VPU is already in reset. Removing MMIO reset improves stability as it a partial device reset that is not safe in some corner cases. This change also brings back ivpu_boot_pwr_domain_disable() that helps to properly power down VPU when it is hung by a buggy workload. Signed-off-by: Jacek Lawrynowicz Fixes: 828d63042aec ("accel/ivpu: Don't enter d0i3 during FLR") Reviewed-by: Jeffrey Hugo Link: https://patchwork.freedesktop.org/patch/msgid/20231115111004.1304092-1-jacek.lawrynowicz@linux.intel.com drivers/accel/ivpu/ivpu_hw_37xx.c | 46 +++++++++++++++++++-------------------- 1 file changed, 22 insertions(+), 24 deletions(-) commit a6584711e64d9d12ab79a450ec3628fd35e4f476 Author: Andy Shevchenko Date: Mon Nov 20 17:07:56 2023 +0200 platform/x86: intel_telemetry: Fix kernel doc descriptions LKP found issues with a kernel doc in the driver: core.c:116: warning: Function parameter or member 'ioss_evtconfig' not described in 'telemetry_update_events' core.c:188: warning: Function parameter or member 'ioss_evtconfig' not described in 'telemetry_get_eventconfig' It looks like it were copy'n'paste typos when these descriptions had been introduced. Fix the typos. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202310070743.WALmRGSY-lkp@intel.com/ Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231120150756.1661425-1-andriy.shevchenko@linux.intel.com Reviewed-by: Rajneesh Bhardwaj Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/intel/telemetry/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8d9ce3e53bbd2d6241213e9a4deb310499c929ff Author: Hans de Goede Date: Mon Nov 20 16:45:45 2023 +0100 MAINTAINERS: Drop Mark Gross as maintainer for x86 platform drivers Mark has not really been active as maintainer for x86 platform drivers lately, drop Mark from the MAINTAINERS entries for drivers/platform/x86, drivers/platform/mellanox and drivers/platform/surface. Cc: Mark Gross Signed-off-by: Hans de Goede Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231120154548.611041-1-hdegoede@redhat.com Signed-off-by: Ilpo Järvinen MAINTAINERS | 3 --- 1 file changed, 3 deletions(-) commit 849d3f985e73196a24273f810a134b3ebed1efad Merge: 1a229d8690a0 480713b1ba8e Author: Greg Kroah-Hartman Date: Tue Nov 21 08:13:55 2023 +0100 Merge tag 'thunderbolt-for-v6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: thunderbolt: Fixes for v6.7-rc3 This includes following USB4/Thunderbolt fixes for v6.7-rc3: - Fix a lane bonding issue on ASMedia USB4 device - Send uevents when link is switched to asymmetric or symmetric - Only add device router DP IN adapters to the head of resource list to avoid issues during system resume. All these have been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.7-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: (1451 commits) thunderbolt: Only add device router DP IN to the head of the DP resource list thunderbolt: Send uevent after asymmetric/symmetric switch thunderbolt: Set lane bonding bit only for downstream port commit c517fd2738f472eb0d1db60a70d91629349a9bf8 Author: Yanteng Si Date: Tue Nov 21 15:03:26 2023 +0800 Docs/zh_CN/LoongArch: Update links in LoongArch introduction.rst LoongArch-Vol1 has been updated to v1.10, the links in the documentation are out of date, let's update it. Signed-off-by: Yanteng Si Signed-off-by: Huacai Chen Documentation/translations/zh_CN/arch/loongarch/introduction.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 10301780c96e70b694eca86a3ccfa1893a4a6d3e Author: Yanteng Si Date: Tue Nov 21 15:03:25 2023 +0800 Docs/LoongArch: Update links in LoongArch introduction.rst LoongArch-Vol1 has been updated to v1.10, the links in the documentation are out of date, let's update it. Signed-off-by: Yanteng Si Signed-off-by: Huacai Chen Documentation/arch/loongarch/introduction.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d43f37b73468c172bc89ac4824a1511b411f0778 Author: Bibo Mao Date: Tue Nov 21 15:03:25 2023 +0800 LoongArch: Implement constant timer shutdown interface When a cpu is hot-unplugged, it is put in idle state and the function arch_cpu_idle_dead() is called. The timer interrupt for this processor should be disabled, otherwise there will be pending timer interrupt for the unplugged cpu, so that vcpu is prevented from giving up scheduling when system is running in vm mode. This patch implements the timer shutdown interface so that the constant timer will be properly disabled when a CPU is hot-unplugged. Reviewed-by: WANG Xuerui Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen arch/loongarch/kernel/time.c | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) commit 19d86a496233731882aea7ec24505ce6641b1c0c Author: Huacai Chen Date: Tue Nov 21 15:03:25 2023 +0800 LoongArch: Mark {dmw,tlb}_virt_to_page() exports as non-GPL Mark {dmw,tlb}_virt_to_page() exports as non-GPL, in order to let out-of-tree modules (e.g. OpenZFS) be built without errors. Otherwise we get: ERROR: modpost: GPL-incompatible module zfs.ko uses GPL-only symbol 'dmw_virt_to_page' ERROR: modpost: GPL-incompatible module zfs.ko uses GPL-only symbol 'tlb_virt_to_page' Reported-by: Haowu Ge Signed-off-by: Huacai Chen arch/loongarch/mm/pgtable.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 902d75cdf0cf0a3fb58550089ee519abf12566f5 Author: Huacai Chen Date: Tue Nov 21 15:03:25 2023 +0800 LoongArch: Silence the boot warning about 'nokaslr' The kernel parameter 'nokaslr' is handled before start_kernel(), so we don't need early_param() to mark it technically. But it can cause a boot warning as follows: Unknown kernel command line parameters "nokaslr", will be passed to user space. When we use 'init=/bin/bash', 'nokaslr' which passed to user space will even cause a kernel panic. So we use early_param() to mark 'nokaslr', simply print a notice and silence the boot warning (also fix a potential panic). This logic is similar to RISC-V. Signed-off-by: Huacai Chen arch/loongarch/kernel/relocate.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit ee2daf7102f42007b7bf5dbd1ae76478ee62c512 Author: Huacai Chen Date: Tue Nov 21 15:03:25 2023 +0800 LoongArch: Add __percpu annotation for __percpu_read()/__percpu_write() When build kernel with C=1, we get: arch/loongarch/kernel/process.c:234:46: warning: incorrect type in argument 1 (different address spaces) arch/loongarch/kernel/process.c:234:46: expected void *ptr arch/loongarch/kernel/process.c:234:46: got unsigned long [noderef] __percpu * arch/loongarch/kernel/process.c:234:46: warning: incorrect type in argument 1 (different address spaces) arch/loongarch/kernel/process.c:234:46: expected void *ptr arch/loongarch/kernel/process.c:234:46: got unsigned long [noderef] __percpu * arch/loongarch/kernel/process.c:234:46: warning: incorrect type in argument 1 (different address spaces) arch/loongarch/kernel/process.c:234:46: expected void *ptr arch/loongarch/kernel/process.c:234:46: got unsigned long [noderef] __percpu * arch/loongarch/kernel/process.c:234:46: warning: incorrect type in argument 1 (different address spaces) arch/loongarch/kernel/process.c:234:46: expected void *ptr arch/loongarch/kernel/process.c:234:46: got unsigned long [noderef] __percpu * Add __percpu annotation for __percpu_read()/__percpu_write() can avoid such warnings. __percpu_xchg() and other functions don't need annotation because their wrapper, i.e. _pcp_protect(), already suppresses warnings. Also adjust the indentations in this file. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311080409.LlOfTR3m-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202311080840.Vc2kXhfp-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202311081340.3k72KKdg-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202311120926.cjYHyoYw-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202311152142.g6UyNx1R-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202311160339.DbhaH8LX-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202311181454.CTPrSYmQ-lkp@intel.com/ Signed-off-by: Huacai Chen arch/loongarch/include/asm/percpu.h | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit aa0cbc1b506b090c3a775b547c693ada108cc0d7 Author: WANG Rui Date: Tue Nov 21 15:03:25 2023 +0800 LoongArch: Record pc instead of offset in la_abs relocation To clarify, the previous version functioned flawlessly. However, it's worth noting that the LLVM's LoongArch backend currently lacks support for cross-section label calculations. With this patch, we enable the use of clang to compile relocatable kernels. Tested-by: Nathan Chancellor Signed-off-by: WANG Rui Signed-off-by: Huacai Chen arch/loongarch/include/asm/asmmacro.h | 3 +-- arch/loongarch/include/asm/setup.h | 2 +- arch/loongarch/kernel/relocate.c | 2 +- 3 files changed, 3 insertions(+), 4 deletions(-) commit cbfd44bd5c6eec0aada0c39130f0b8d7ecba0529 Author: WANG Rui Date: Tue Nov 21 15:03:25 2023 +0800 LoongArch: Explicitly set -fdirect-access-external-data for vmlinux After this llvm commit [1], The -fno-pic does not imply direct access external data. Explicitly set -fdirect-access-external-data for vmlinux that can avoids GOT entries. Link: https://github.com/llvm/llvm-project/commit/47eeee297775347cbdb7624d6a766c2a3eec4a59 Suggested-by: Xi Ruoyao Signed-off-by: WANG Rui Signed-off-by: Huacai Chen arch/loongarch/Makefile | 1 + 1 file changed, 1 insertion(+) commit d3ec75bc635cb0cb8185b63293d33a3d1b942d22 Author: Masahiro Yamada Date: Tue Nov 21 15:03:25 2023 +0800 LoongArch: Add dependency between vmlinuz.efi and vmlinux.efi A common issue in Makefile is a race in parallel building. You need to be careful to prevent multiple threads from writing to the same file simultaneously. Commit 3939f3345050 ("ARM: 8418/1: add boot image dependencies to not generate invalid images") addressed such a bad scenario. A similar symptom occurs with the following command: $ make -j$(nproc) ARCH=loongarch vmlinux.efi vmlinuz.efi [ snip ] SORTTAB vmlinux OBJCOPY arch/loongarch/boot/vmlinux.efi OBJCOPY arch/loongarch/boot/vmlinux.efi PAD arch/loongarch/boot/vmlinux.bin GZIP arch/loongarch/boot/vmlinuz OBJCOPY arch/loongarch/boot/vmlinuz.o LD arch/loongarch/boot/vmlinuz.efi.elf OBJCOPY arch/loongarch/boot/vmlinuz.efi The log "OBJCOPY arch/loongarch/boot/vmlinux.efi" is displayed twice. It indicates that two threads simultaneously enter arch/loongarch/boot/ and write to arch/loongarch/boot/vmlinux.efi. It occasionally leads to a build failure: $ make -j$(nproc) ARCH=loongarch vmlinux.efi vmlinuz.efi [ snip ] SORTTAB vmlinux OBJCOPY arch/loongarch/boot/vmlinux.efi PAD arch/loongarch/boot/vmlinux.bin truncate: Invalid number: ‘arch/loongarch/boot/vmlinux.bin’ make[2]: *** [drivers/firmware/efi/libstub/Makefile.zboot:13: arch/loongarch/boot/vmlinux.bin] Error 1 make[2]: *** Deleting file 'arch/loongarch/boot/vmlinux.bin' make[1]: *** [arch/loongarch/Makefile:146: vmlinuz.efi] Error 2 make[1]: *** Waiting for unfinished jobs.... make: *** [Makefile:234: __sub-make] Error 2 vmlinuz.efi depends on vmlinux.efi, but such a dependency is not specified in arch/loongarch/Makefile. Signed-off-by: Masahiro Yamada Signed-off-by: Huacai Chen arch/loongarch/Makefile | 2 ++ 1 file changed, 2 insertions(+) commit acb12c859ac7c36d6d7632280fd1e263188cb07f Merge: fcb905d83133 57e2a52deeb1 Author: Alexei Starovoitov Date: Mon Nov 20 18:33:36 2023 -0800 Merge branch 'verify-callbacks-as-if-they-are-called-unknown-number-of-times' Eduard Zingerman says: ==================== verify callbacks as if they are called unknown number of times This series updates verifier logic for callback functions handling. Current master simulates callback body execution exactly once, which leads to verifier not detecting unsafe programs like below: static int unsafe_on_zero_iter_cb(__u32 idx, struct num_context *ctx) { ctx->i = 0; return 0; } SEC("?raw_tp") int unsafe_on_zero_iter(void *unused) { struct num_context loop_ctx = { .i = 32 }; __u8 choice_arr[2] = { 0, 1 }; bpf_loop(100, unsafe_on_zero_iter_cb, &loop_ctx, 0); return choice_arr[loop_ctx.i]; } This was reported previously in [0]. The basic idea of the fix is to schedule callback entry state for verification in env->head until some identical, previously visited state in current DFS state traversal is found. Same logic as with open coded iterators, and builds on top recent fixes [1] for those. The series is structured as follows: - patches #1,2,3 update strobemeta, xdp_synproxy selftests and bpf_loop_bench benchmark to allow convergence of the bpf_loop callback states; - patches #4,5 just shuffle the code a bit; - patch #6 is the main part of the series; - patch #7 adds test cases for #6; - patch #8 extend patch #6 with same speculative scalar widening logic, as used for open coded iterators; - patch #9 adds test cases for #8; - patch #10 extends patch #6 to track maximal number of callback executions specifically for bpf_loop(); - patch #11 adds test cases for #10. Veristat results comparing this series to master+patches #1,2,3 using selftests show the following difference: File Program States (A) States (B) States (DIFF) ------------------------- ------------- ---------- ---------- ------------- bpf_loop_bench.bpf.o benchmark 1 2 +1 (+100.00%) pyperf600_bpf_loop.bpf.o on_event 322 407 +85 (+26.40%) strobemeta_bpf_loop.bpf.o on_event 113 151 +38 (+33.63%) xdp_synproxy_kern.bpf.o syncookie_tc 341 291 -50 (-14.66%) xdp_synproxy_kern.bpf.o syncookie_xdp 344 301 -43 (-12.50%) Veristat results comparing this series to master using Tetragon BPF files [2] also show some differences. States diff varies from +2% to +15% on 23 programs out of 186, no new failures. Changelog: - V3 [5] -> V4, changes suggested by Andrii: - validate mark_chain_precision() result in patch #10; - renaming s/cumulative_callback_depth/callback_unroll_depth/. - V2 [4] -> V3: - fixes in expected log messages for test cases: - callback_result_precise; - parent_callee_saved_reg_precise_with_callback; - parent_stack_slot_precise_with_callback; - renamings (suggested by Alexei): - s/callback_iter_depth/cumulative_callback_depth/ - s/is_callback_iter_next/calls_callback/ - s/mark_callback_iter_next/mark_calls_callback/ - prepare_func_exit() updated to exit with -EFAULT when callee->in_callback_fn is true but calls_callback() is not true for callsite; - test case 'bpf_loop_iter_limit_nested' rewritten to use return value check instead of verifier log message checks (suggested by Alexei). - V1 [3] -> V2, changes suggested by Andrii: - small changes for error handling code in __check_func_call(); - callback body processing log is now matched in relevant verifier_subprog_precision.c tests; - R1 passed to bpf_loop() is now always marked as precise; - log level 2 message for bpf_loop() iteration termination instead of iteration depth messages; - __no_msg macro removed; - bpf_loop_iter_limit_nested updated to avoid using __no_msg; - commit message for patch #3 updated according to Alexei's request. [0] https://lore.kernel.org/bpf/CA+vRuzPChFNXmouzGG+wsy=6eMcfr1mFG0F3g7rbg-sedGKW3w@mail.gmail.com/ [1] https://lore.kernel.org/bpf/20231024000917.12153-1-eddyz87@gmail.com/ [2] git@github.com:cilium/tetragon.git [3] https://lore.kernel.org/bpf/20231116021803.9982-1-eddyz87@gmail.com/T/#t [4] https://lore.kernel.org/bpf/20231118013355.7943-1-eddyz87@gmail.com/T/#t [5] https://lore.kernel.org/bpf/20231120225945.11741-1-eddyz87@gmail.com/T/#t ==================== Link: https://lore.kernel.org/r/20231121020701.26440-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 57e2a52deeb12ab84c15c6d0fb93638b5b94001b Author: Eduard Zingerman Date: Tue Nov 21 04:07:01 2023 +0200 selftests/bpf: check if max number of bpf_loop iterations is tracked Check that even if bpf_loop() callback simulation does not converge to a specific state, verification could proceed via "brute force" simulation of maximal number of callback calls. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20231121020701.26440-12-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov .../bpf/progs/verifier_iterating_callbacks.c | 75 ++++++++++++++++++++++ 1 file changed, 75 insertions(+) commit bb124da69c47dd98d69361ec13244ece50bec63e Author: Eduard Zingerman Date: Tue Nov 21 04:07:00 2023 +0200 bpf: keep track of max number of bpf_loop callback iterations In some cases verifier can't infer convergence of the bpf_loop() iteration. E.g. for the following program: static int cb(__u32 idx, struct num_context* ctx) { ctx->i++; return 0; } SEC("?raw_tp") int prog(void *_) { struct num_context ctx = { .i = 0 }; __u8 choice_arr[2] = { 0, 1 }; bpf_loop(2, cb, &ctx, 0); return choice_arr[ctx.i]; } Each 'cb' simulation would eventually return to 'prog' and reach 'return choice_arr[ctx.i]' statement. At which point ctx.i would be marked precise, thus forcing verifier to track multitude of separate states with {.i=0}, {.i=1}, ... at bpf_loop() callback entry. This commit allows "brute force" handling for such cases by limiting number of callback body simulations using 'umax' value of the first bpf_loop() parameter. For this, extend bpf_func_state with 'callback_depth' field. Increment this field when callback visiting state is pushed to states traversal stack. For frame #N it's 'callback_depth' field counts how many times callback with frame depth N+1 had been executed. Use bpf_func_state specifically to allow independent tracking of callback depths when multiple nested bpf_loop() calls are present. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20231121020701.26440-11-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov include/linux/bpf_verifier.h | 11 +++++++ kernel/bpf/verifier.c | 19 ++++++++++-- .../bpf/progs/verifier_subprog_precision.c | 35 +++++++++++++++------- 3 files changed, 53 insertions(+), 12 deletions(-) commit 9f3330aa644d6d979eb064c46e85c62d4b4eac75 Author: Eduard Zingerman Date: Tue Nov 21 04:06:59 2023 +0200 selftests/bpf: test widening for iterating callbacks A test case to verify that imprecise scalars widening is applied to callback entering state, when callback call is simulated repeatedly. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20231121020701.26440-10-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov .../bpf/progs/verifier_iterating_callbacks.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) commit cafe2c21508a38cdb3ed22708842e957b2572c3e Author: Eduard Zingerman Date: Tue Nov 21 04:06:58 2023 +0200 bpf: widening for callback iterators Callbacks are similar to open coded iterators, so add imprecise widening logic for callback body processing. This makes callback based loops behave identically to open coded iterators, e.g. allowing to verify programs like below: struct ctx { u32 i; }; int cb(u32 idx, struct ctx* ctx) { ++ctx->i; return 0; } ... struct ctx ctx = { .i = 0 }; bpf_loop(100, cb, &ctx, 0); ... Acked-by: Andrii Nakryiko Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20231121020701.26440-9-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) commit 958465e217dbf5fc6677d42d8827fb3073d86afd Author: Eduard Zingerman Date: Tue Nov 21 04:06:57 2023 +0200 selftests/bpf: tests for iterating callbacks A set of test cases to check behavior of callback handling logic, check if verifier catches the following situations: - program not safe on second callback iteration; - program not safe on zero callback iterations; - infinite loop inside a callback. Verify that callback logic works for bpf_loop, bpf_for_each_map_elem, bpf_user_ringbuf_drain, bpf_find_vma. Acked-by: Andrii Nakryiko Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20231121020701.26440-8-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/prog_tests/verifier.c | 2 + .../bpf/progs/verifier_iterating_callbacks.c | 147 +++++++++++++++++++++ 2 files changed, 149 insertions(+) commit ab5cfac139ab8576fb54630d4cca23c3e690ee90 Author: Eduard Zingerman Date: Tue Nov 21 04:06:56 2023 +0200 bpf: verify callbacks as if they are called unknown number of times Prior to this patch callbacks were handled as regular function calls, execution of callback body was modeled exactly once. This patch updates callbacks handling logic as follows: - introduces a function push_callback_call() that schedules callback body verification in env->head stack; - updates prepare_func_exit() to reschedule callback body verification upon BPF_EXIT; - as calls to bpf_*_iter_next(), calls to callback invoking functions are marked as checkpoints; - is_state_visited() is updated to stop callback based iteration when some identical parent state is found. Paths with callback function invoked zero times are now verified first, which leads to necessity to modify some selftests: - the following negative tests required adding release/unlock/drop calls to avoid previously masked unrelated error reports: - cb_refs.c:underflow_prog - exceptions_fail.c:reject_rbtree_add_throw - exceptions_fail.c:reject_with_cp_reference - the following precision tracking selftests needed change in expected log trace: - verifier_subprog_precision.c:callback_result_precise (note: r0 precision is no longer propagated inside callback and I think this is a correct behavior) - verifier_subprog_precision.c:parent_callee_saved_reg_precise_with_callback - verifier_subprog_precision.c:parent_stack_slot_precise_with_callback Reported-by: Andrew Werner Closes: https://lore.kernel.org/bpf/CA+vRuzPChFNXmouzGG+wsy=6eMcfr1mFG0F3g7rbg-sedGKW3w@mail.gmail.com/ Acked-by: Andrii Nakryiko Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20231121020701.26440-7-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov include/linux/bpf_verifier.h | 5 + kernel/bpf/verifier.c | 274 +++++++++++++-------- tools/testing/selftests/bpf/progs/cb_refs.c | 1 + .../testing/selftests/bpf/progs/exceptions_fail.c | 2 + .../bpf/progs/verifier_subprog_precision.c | 71 ++++-- 5 files changed, 240 insertions(+), 113 deletions(-) commit 58124a98cb8eda69d248d7f1de954c8b2767c945 Author: Eduard Zingerman Date: Tue Nov 21 04:06:55 2023 +0200 bpf: extract setup_func_entry() utility function Move code for simulated stack frame creation to a separate utility function. This function would be used in the follow-up change for callbacks handling. Acked-by: Andrii Nakryiko Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20231121020701.26440-6-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 84 +++++++++++++++++++++++++++++---------------------- 1 file changed, 48 insertions(+), 36 deletions(-) commit 683b96f9606ab7308ffb23c46ab43cecdef8a241 Author: Eduard Zingerman Date: Tue Nov 21 04:06:54 2023 +0200 bpf: extract __check_reg_arg() utility function Split check_reg_arg() into two utility functions: - check_reg_arg() operating on registers from current verifier state; - __check_reg_arg() operating on a specific set of registers passed as a parameter; The __check_reg_arg() function would be used by a follow-up change for callbacks handling. Acked-by: Andrii Nakryiko Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20231121020701.26440-5-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) commit f40bfd1679446b22d321e64a1fa98b7d07d2be08 Author: Eduard Zingerman Date: Tue Nov 21 04:06:53 2023 +0200 selftests/bpf: fix bpf_loop_bench for new callback verification scheme This is a preparatory change. A follow-up patch "bpf: verify callbacks as if they are called unknown number of times" changes logic for callbacks handling. While previously callbacks were verified as a single function call, new scheme takes into account that callbacks could be executed unknown number of times. This has dire implications for bpf_loop_bench: SEC("fentry/" SYS_PREFIX "sys_getpgid") int benchmark(void *ctx) { for (int i = 0; i < 1000; i++) { bpf_loop(nr_loops, empty_callback, NULL, 0); __sync_add_and_fetch(&hits, nr_loops); } return 0; } W/o callbacks change verifier sees it as a 1000 calls to empty_callback(). However, with callbacks change things become exponential: - i=0: state exploring empty_callback is scheduled with i=0 (a); - i=1: state exploring empty_callback is scheduled with i=1; ... - i=999: state exploring empty_callback is scheduled with i=999; - state (a) is popped from stack; - i=1: state exploring empty_callback is scheduled with i=1; ... Avoid this issue by rewriting outer loop as bpf_loop(). Unfortunately, this adds a function call to a loop at runtime, which negatively affects performance: throughput latency before: 149.919 ± 0.168 M ops/s, 6.670 ns/op after : 137.040 ± 0.187 M ops/s, 7.297 ns/op Acked-by: Andrii Nakryiko Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20231121020701.26440-4-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/progs/bpf_loop_bench.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 87eb0152bcc102ecbda866978f4e54db5a3be1ef Author: Eduard Zingerman Date: Tue Nov 21 04:06:52 2023 +0200 selftests/bpf: track string payload offset as scalar in strobemeta This change prepares strobemeta for update in callbacks verification logic. To allow bpf_loop() verification converge when multiple callback iterations are considered: - track offset inside strobemeta_payload->payload directly as scalar value; - at each iteration make sure that remaining strobemeta_payload->payload capacity is sufficient for execution of read_{map,str}_var functions; - make sure that offset is tracked as unbound scalar between iterations, otherwise verifier won't be able infer that bpf_loop callback reaches identical states. Acked-by: Andrii Nakryiko Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20231121020701.26440-3-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/progs/strobemeta.h | 78 ++++++++++++++++---------- 1 file changed, 48 insertions(+), 30 deletions(-) commit 977bc146d4eb7070118d8a974919b33bb52732b4 Author: Eduard Zingerman Date: Tue Nov 21 04:06:51 2023 +0200 selftests/bpf: track tcp payload offset as scalar in xdp_synproxy This change prepares syncookie_{tc,xdp} for update in callbakcs verification logic. To allow bpf_loop() verification converge when multiple callback itreations are considered: - track offset inside TCP payload explicitly, not as a part of the pointer; - make sure that offset does not exceed MAX_PACKET_OFF enforced by verifier; - make sure that offset is tracked as unbound scalar between iterations, otherwise verifier won't be able infer that bpf_loop callback reaches identical states. Acked-by: Andrii Nakryiko Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20231121020701.26440-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov .../selftests/bpf/progs/xdp_synproxy_kern.c | 84 +++++++++++++--------- 1 file changed, 52 insertions(+), 32 deletions(-) commit 98594181944daa201481ad63242806beb7c89ff4 Author: Robin Murphy Date: Thu Nov 16 16:52:15 2023 +0000 iommufd/selftest: Fix _test_mock_dirty_bitmaps() The ASSERT_EQ() macro sneakily expands to two statements, so the loop here needs braces to ensure it captures both and actually terminates the test upon failure. Where these tests are currently failing on my arm64 machine, this reduces the number of logged lines from a rather unreasonable ~197,000 down to 10. While we're at it, we can also clean up the tautologous "count" calculations whose assertions can never fail unless mathematics and/or the C language become fundamentally broken. Fixes: a9af47e382a4 ("iommufd/selftest: Test IOMMU_HWPT_GET_DIRTY_BITMAP") Link: https://lore.kernel.org/r/90e083045243ef407dd592bb1deec89cd1f4ddf2.1700153535.git.robin.murphy@arm.com Signed-off-by: Robin Murphy Reviewed-by: Kevin Tian Reviewed-by: Joao Martins Tested-by: Joao Martins Signed-off-by: Jason Gunthorpe tools/testing/selftests/iommu/iommufd_utils.h | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit 71cade82f2b553a74d046c015c986f2df165696f Author: Steven Rostedt (Google) Date: Mon Nov 20 18:51:07 2023 -0500 eventfs: Do not invalidate dentry in create_file/dir_dentry() With the call to simple_recursive_removal() on the entire eventfs sub system when the directory is removed, it performs the d_invalidate on all the dentries when it is removed. There's no need to do clean ups when a dentry is being created while the directory is being deleted. As dentries are cleaned up by the simpler_recursive_removal(), trying to do d_invalidate() in these functions will cause the dentry to be invalidated twice, and crash the kernel. Link: https://lore.kernel.org/all/20231116123016.140576-1-naresh.kamboju@linaro.org/ Link: https://lkml.kernel.org/r/20231120235154.422970988@goodmis.org Cc: Masami Hiramatsu Cc: Andrew Morton Fixes: 407c6726ca71 ("eventfs: Use simple_recursive_removal() to clean up dentries") Reported-by: Mark Rutland Reported-by: Naresh Kamboju Reported-by: Linux Kernel Functional Testing Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) commit 88903daecacf03b1e5636e1b5f18bda5b07030fc Author: Steven Rostedt (Google) Date: Mon Nov 20 18:51:06 2023 -0500 eventfs: Remove expectation that ei->is_freed means ei->dentry == NULL The logic to free the eventfs_inode (ei) use to set is_freed and clear the "dentry" field under the eventfs_mutex. But that changed when a race was found where the ei->dentry needed to be cleared when the last dput() was called on it. But there was still logic that checked if ei->dentry was not NULL and is_freed is set, and would warn if it was. But since that situation was changed and the ei->dentry isn't cleared until the last dput() is called on it while the ei->is_freed is set, do not test for that condition anymore, and change the comments to reflect that. Link: https://lkml.kernel.org/r/20231120235154.265826243@goodmis.org Cc: Masami Hiramatsu Cc: Andrew Morton Fixes: 020010fbfa20 ("eventfs: Delete eventfs_inode when the last dentry is freed") Reported-by: Mark Rutland Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) commit d6fef34ee4d102be448146f24caf96d7b4a05401 Author: Keith Busch Date: Mon Nov 20 14:18:31 2023 -0800 io_uring: fix off-by one bvec index If the offset equals the bv_len of the first registered bvec, then the request does not include any of that first bvec. Skip it so that drivers don't have to deal with a zero length bvec, which was observed to break NVMe's PRP list creation. Cc: stable@vger.kernel.org Fixes: bd11b3a391e3 ("io_uring: don't use iov_iter_advance() for fixed buffers") Signed-off-by: Keith Busch Link: https://lore.kernel.org/r/20231120221831.2646460-1-kbusch@meta.com Signed-off-by: Jens Axboe io_uring/rsrc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8e4ece6889a5b1836b6a135827ac831a5350602a Author: Kunkun Jiang Date: Mon Nov 20 21:12:10 2023 +0800 KVM: arm64: GICv4: Do not perform a map to a mapped vLPI Before performing a map, let's check whether the vLPI has been mapped. Fixes: 196b136498b3 ("KVM: arm/arm64: GICv4: Wire mapping/unmapping of VLPIs in VFIO irq bypass") Signed-off-by: Kunkun Jiang Acked-by: Marc Zyngier Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/r/20231120131210.2039-1-jiangkunkun@huawei.com Signed-off-by: Oliver Upton arch/arm64/kvm/vgic/vgic-v4.c | 4 ++++ 1 file changed, 4 insertions(+) commit db46cd1e0426f52999d50fa72cfa97fa39952885 Author: Jan Höppner Date: Wed Oct 25 15:24:37 2023 +0200 s390/dasd: protect device queue against concurrent access In dasd_profile_start() the amount of requests on the device queue are counted. The access to the device queue is unprotected against concurrent access. With a lot of parallel I/O, especially with alias devices enabled, the device queue can change while dasd_profile_start() is accessing the queue. In the worst case this leads to a kernel panic due to incorrect pointer accesses. Fix this by taking the device lock before accessing the queue and counting the requests. Additionally the check for a valid profile data pointer can be done earlier to avoid unnecessary locking in a hot path. Cc: Fixes: 4fa52aa7a82f ("[S390] dasd: add enhanced DASD statistics interface") Reviewed-by: Stefan Haberland Signed-off-by: Jan Höppner Signed-off-by: Stefan Haberland Link: https://lore.kernel.org/r/20231025132437.1223363-3-sth@linux.ibm.com Signed-off-by: Jens Axboe drivers/s390/block/dasd.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) commit 5029c5e4f20d8d6b41cefbde4b3eeadaec4662c6 Author: Muhammad Muzammil Date: Wed Oct 25 15:24:36 2023 +0200 s390/dasd: resolve spelling mistake resolve typing mistake from pimary to primary Signed-off-by: Muhammad Muzammil Link: https://lore.kernel.org/r/20231010043140.28416-1-m.muzzammilashraf@gmail.com Signed-off-by: Stefan Haberland Link: https://lore.kernel.org/r/20231025132437.1223363-2-sth@linux.ibm.com Signed-off-by: Jens Axboe drivers/s390/block/dasd_int.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fcb905d831336ee0a67dd953837a904173cf7390 Merge: 76df934c6d5f adfeae2d243d Author: Martin KaFai Lau Date: Mon Nov 20 10:15:17 2023 -0800 Merge branch 'bpf_redirect_peer fixes' Daniel Borkmann says: ==================== This fixes bpf_redirect_peer stats accounting for veth and netkit, and adds tstats in the first place for the latter. Utilise indirect call wrapper for bpf_redirect_peer, and improve test coverage of the latter also for netkit devices. Details in the patches, thanks! The series was targeted at bpf originally, and is done here as well, so it can trigger BPF CI. Jakub, if you think directly going via net is better since the majority of the diff touches net anyway, that is fine, too. Thanks! v2 -> v3: - Add kdoc for pcpu_stat_type (Simon) - Reject invalid type value in netdev_do_alloc_pcpu_stats (Simon) - Add Reviewed-by tags from list v1 -> v2: - Move stats allocation/freeing into net core (Jakub) - As prepwork for the above, move vrf's dstats over into the core - Add a check into stats alloc to enforce tstats upon implementing ndo_get_peer_dev - Add Acked-by tags from list Daniel Borkmann (6): net, vrf: Move dstats structure to core net: Move {l,t,d}stats allocation to core and convert veth & vrf netkit: Add tstats per-CPU traffic counters bpf, netkit: Add indirect call wrapper for fetching peer dev selftests/bpf: De-veth-ize the tc_redirect test case selftests/bpf: Add netkit to tc_redirect selftest ==================== Signed-off-by: Martin KaFai Lau commit adfeae2d243d9e5b83d094af481d189156b11779 Author: Daniel Borkmann Date: Tue Nov 14 01:42:20 2023 +0100 selftests/bpf: Add netkit to tc_redirect selftest Extend the existing tc_redirect selftest to also cover netkit devices for exercising the bpf_redirect_peer() code paths, so that we have both veth as well as netkit covered, all tests still pass after this change. Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Reviewed-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20231114004220.6495-9-daniel@iogearbox.net Signed-off-by: Martin KaFai Lau .../testing/selftests/bpf/prog_tests/tc_redirect.c | 52 ++++++++++++++++++++++ 1 file changed, 52 insertions(+) commit eee82da79f036bb49ff80d3088b9530e3c2e57eb Author: Daniel Borkmann Date: Tue Nov 14 01:42:19 2023 +0100 selftests/bpf: De-veth-ize the tc_redirect test case No functional changes to the test case, but just renaming various functions, variables, etc, to remove veth part of their name for making it more generic and reusable later on (e.g. for netkit). Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Reviewed-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20231114004220.6495-8-daniel@iogearbox.net Signed-off-by: Martin KaFai Lau .../testing/selftests/bpf/prog_tests/tc_redirect.c | 263 +++++++++++---------- 1 file changed, 137 insertions(+), 126 deletions(-) commit 2c225425704078282e152ba692649237f78b3d7a Author: Daniel Borkmann Date: Tue Nov 14 01:42:18 2023 +0100 bpf, netkit: Add indirect call wrapper for fetching peer dev ndo_get_peer_dev is used in tcx BPF fast path, therefore make use of indirect call wrapper and therefore optimize the bpf_redirect_peer() internal handling a bit. Add a small skb_get_peer_dev() wrapper which utilizes the INDIRECT_CALL_1() macro instead of open coding. Future work could potentially add a peer pointer directly into struct net_device in future and convert veth and netkit over to use it so that eventually ndo_get_peer_dev can be removed. Co-developed-by: Nikolay Aleksandrov Signed-off-by: Nikolay Aleksandrov Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/r/20231114004220.6495-7-daniel@iogearbox.net Signed-off-by: Martin KaFai Lau drivers/net/netkit.c | 3 ++- include/net/netkit.h | 6 ++++++ net/core/filter.c | 18 +++++++++++++----- 3 files changed, 21 insertions(+), 6 deletions(-) commit 024ee930cb3c9ae49e4266aee89cfde0ebb407e1 Author: Peilin Ye Date: Tue Nov 14 01:42:17 2023 +0100 bpf: Fix dev's rx stats for bpf_redirect_peer traffic Traffic redirected by bpf_redirect_peer() (used by recent CNIs like Cilium) is not accounted for in the RX stats of supported devices (that is, veth and netkit), confusing user space metrics collectors such as cAdvisor [0], as reported by Youlun. Fix it by calling dev_sw_netstats_rx_add() in skb_do_redirect(), to update RX traffic counters. Devices that support ndo_get_peer_dev _must_ use the @tstats per-CPU counters (instead of @lstats, or @dstats). To make this more fool-proof, error out when ndo_get_peer_dev is set but @tstats are not selected. [0] Specifically, the "container_network_receive_{byte,packet}s_total" counters are affected. Fixes: 9aa1206e8f48 ("bpf: Add redirect_peer helper") Reported-by: Youlun Zhang Signed-off-by: Peilin Ye Co-developed-by: Daniel Borkmann Signed-off-by: Daniel Borkmann Reviewed-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20231114004220.6495-6-daniel@iogearbox.net Signed-off-by: Martin KaFai Lau net/core/dev.c | 8 ++++++++ net/core/filter.c | 1 + 2 files changed, 9 insertions(+) commit 6f2684bf2b4460c84d0d34612a939f78b96b03fc Author: Peilin Ye Date: Tue Nov 14 01:42:16 2023 +0100 veth: Use tstats per-CPU traffic counters Currently veth devices use the lstats per-CPU traffic counters, which only cover TX traffic. veth_get_stats64() actually populates RX stats of a veth device from its peer's TX counters, based on the assumption that a veth device can _only_ receive packets from its peer, which is no longer true: For example, recent CNIs (like Cilium) can use the bpf_redirect_peer() BPF helper to redirect traffic from NIC's tc ingress to veth's tc ingress (in a different netns), skipping veth's peer device. Unfortunately, this kind of traffic isn't currently accounted for in veth's RX stats. In preparation for the fix, use tstats (instead of lstats) to maintain both RX and TX counters for each veth device. We'll use RX counters for bpf_redirect_peer() traffic, and keep using TX counters for the usual "peer-to-peer" traffic. In veth_get_stats64(), calculate RX stats by _adding_ RX count to peer's TX count, in order to cover both kinds of traffic. veth_stats_rx() might need a name change (perhaps to "veth_stats_xdp()") for less confusion, but let's leave it to another patch to keep the fix minimal. Signed-off-by: Peilin Ye Co-developed-by: Daniel Borkmann Signed-off-by: Daniel Borkmann Reviewed-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20231114004220.6495-5-daniel@iogearbox.net Signed-off-by: Martin KaFai Lau drivers/net/veth.c | 30 +++++++++++------------------- 1 file changed, 11 insertions(+), 19 deletions(-) commit ae1658272c6491a31ac968e39882fc569f312ac3 Author: Daniel Borkmann Date: Tue Nov 14 01:42:15 2023 +0100 netkit: Add tstats per-CPU traffic counters Add dev->tstats traffic accounting to netkit. The latter contains per-CPU RX and TX counters. The dev's TX counters are bumped upon pass/unspec as well as redirect verdicts, in other words, on everything except for drops. The dev's RX counters are bumped upon successful __netif_rx(), as well as from skb_do_redirect() (not part of this commit here). Using dev->lstats with having just a single packets/bytes counter and inferring one another's RX counters from the peer dev's lstats is not possible given skb_do_redirect() can also bump the device's stats. Signed-off-by: Daniel Borkmann Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20231114004220.6495-4-daniel@iogearbox.net Signed-off-by: Martin KaFai Lau drivers/net/netkit.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) commit 34d21de99cea9cb17967874313e5b0262527833c Author: Daniel Borkmann Date: Tue Nov 14 01:42:14 2023 +0100 net: Move {l,t,d}stats allocation to core and convert veth & vrf Move {l,t,d}stats allocation to the core and let netdevs pick the stats type they need. That way the driver doesn't have to bother with error handling (allocation failure checking, making sure free happens in the right spot, etc) - all happening in the core. Co-developed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Borkmann Reviewed-by: Nikolay Aleksandrov Cc: David Ahern Link: https://lore.kernel.org/r/20231114004220.6495-3-daniel@iogearbox.net Signed-off-by: Martin KaFai Lau drivers/net/veth.c | 16 ++-------------- drivers/net/vrf.c | 14 +++----------- include/linux/netdevice.h | 20 +++++++++++++++---- net/core/dev.c | 49 ++++++++++++++++++++++++++++++++++++++++++++++- 4 files changed, 69 insertions(+), 30 deletions(-) commit 79e0c5be8c73a674c92bd4ba77b75f4f8c91d32e Author: Daniel Borkmann Date: Tue Nov 14 01:42:13 2023 +0100 net, vrf: Move dstats structure to core Just move struct pcpu_dstats out of the vrf into the core, and streamline the field names slightly, so they better align with the {t,l}stats ones. No functional change otherwise. A conversion of the u64s to u64_stats_t could be done at a separate point in future. This move is needed as we are moving the {t,l,d}stats allocation/freeing to the core. Signed-off-by: Daniel Borkmann Reviewed-by: Nikolay Aleksandrov Cc: Jakub Kicinski Cc: David Ahern Link: https://lore.kernel.org/r/20231114004220.6495-2-daniel@iogearbox.net Signed-off-by: Martin KaFai Lau drivers/net/vrf.c | 24 +++++++----------------- include/linux/netdevice.h | 10 ++++++++++ 2 files changed, 17 insertions(+), 17 deletions(-) commit 53f2bca2609237f910531f2c1a7779b16ce7952d Author: Chengming Zhou Date: Mon Nov 20 03:25:21 2023 +0000 block/null_blk: Fix double blk_mq_start_request() warning When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, null_queue_rq() would return BLK_STS_RESOURCE or BLK_STS_DEV_RESOURCE for the request, which has been marked as MQ_RQ_IN_FLIGHT by blk_mq_start_request(). Then null_queue_rqs() put these requests in the rqlist, return back to the block layer core, which would try to queue them individually again, so the warning in blk_mq_start_request() triggered. Fix it by splitting the null_queue_rq() into two parts: the first is the preparation of request, the second is the handling of request. We put the blk_mq_start_request() after the preparation part, which may fail and return back to the block layer core. The throttling also belongs to the preparation part, so move it before blk_mq_start_request(). And change the return type of null_handle_cmd() to void, since it always return BLK_STS_OK now. Reported-by: Closes: https://lore.kernel.org/all/0000000000000e6aac06098aee0c@google.com/ Fixes: d78bfa1346ab ("block/null_blk: add queue_rqs() support") Suggested-by: Bart Van Assche Signed-off-by: Chengming Zhou Link: https://lore.kernel.org/r/20231120032521.1012037-1-chengming.zhou@linux.dev Signed-off-by: Jens Axboe drivers/block/null_blk/main.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) commit 11b9d0b4999705105d1fb7f0e8ac969e0f41b1b8 Author: Hannes Reinecke Date: Fri Oct 20 07:06:06 2023 +0200 nvmet-tcp: always initialize tls_handshake_tmo_work The TLS handshake timeout work item should always be initialized to avoid a crash when cancelling the workqueue. Fixes: 675b453e0241 ("nvmet-tcp: enable TLS handshake upcall") Suggested-by: Maurizio Lombardi Signed-off-by: Hannes Reinecke Tested-by: Shin'ichiro Kawasaki Tested-by: Yi Zhang Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch drivers/nvme/target/tcp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 1c22e0295a5eb571c27b53c7371f95699ef705ff Author: Christoph Hellwig Date: Fri Nov 17 08:13:36 2023 -0500 nvmet: nul-terminate the NQNs passed in the connect command The host and subsystem NQNs are passed in the connect command payload and interpreted as nul-terminated strings. Ensure they actually are nul-terminated before using them. Fixes: a07b4970f464 "nvmet: add a generic NVMe target") Reported-by: Alon Zahavi Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/target/fabrics-cmd.c | 4 ++++ 1 file changed, 4 insertions(+) commit c7ca9757bda35ff9ce27ab42f2cb8b84d983e6ad Author: Hannes Reinecke Date: Thu Nov 16 13:14:35 2023 +0100 nvme: blank out authentication fabrics options if not configured If the config option NVME_HOST_AUTH is not selected we should not accept the corresponding fabrics options. This allows userspace to detect if NVMe authentication has been enabled for the kernel. Cc: Shin'ichiro Kawasaki Fixes: f50fff73d620 ("nvme: implement In-Band authentication") Signed-off-by: Hannes Reinecke Tested-by: Shin'ichiro Kawasaki Reviewed-by: Daniel Wagner Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/host/fabrics.c | 2 ++ 1 file changed, 2 insertions(+) commit cd9aed606088d36a7ffff3e808db4e76b1854285 Author: Hannes Reinecke Date: Tue Nov 14 14:27:01 2023 +0100 nvme: catch errors from nvme_configure_metadata() nvme_configure_metadata() is issuing I/O, so we might incur an I/O error which will cause the connection to be reset. But in that case any further probing will race with reset and cause UAF errors. So return a status from nvme_configure_metadata() and abort probing if there was an I/O error. Signed-off-by: Hannes Reinecke Signed-off-by: Keith Busch drivers/nvme/host/core.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) commit 23441536b63677cb2ed9b1637d8ca70315e44bd0 Author: Hannes Reinecke Date: Tue Nov 14 14:18:21 2023 +0100 nvme-tcp: only evaluate 'tls' option if TLS is selected We only need to evaluate the 'tls' connect option if TLS is enabled; otherwise we might be getting a link error. Fixes: 706add13676d ("nvme: keyring: fix conditional compilation") Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202311140426.0eHrTXBr-lkp@intel.com/ Signed-off-by: Hannes Reinecke Signed-off-by: Keith Busch drivers/nvme/host/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 38ce1570e2c46e7e9af983aa337edd7e43723aa2 Author: Mark O'Donovan Date: Wed Oct 11 08:45:12 2023 +0000 nvme-auth: set explanation code for failure2 msgs Some error cases were not setting an auth-failure-reason-code-explanation. This means an AUTH_Failure2 message will be sent with an explanation value of 0 which is a reserved value. Signed-off-by: Mark O'Donovan Reviewed-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch drivers/nvme/host/auth.c | 2 ++ 1 file changed, 2 insertions(+) commit 616add70bfdc0274a253e84fc78155c27aacde91 Author: Mark O'Donovan Date: Wed Oct 11 08:45:11 2023 +0000 nvme-auth: unlock mutex in one place only Signed-off-by: Mark O'Donovan Reviewed-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Reviewed-by: Hannes Reinecke Signed-off-by: Keith Busch drivers/nvme/host/auth.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit c96b8175522a2c52e297ee0a49827a668f95e1e8 Author: Damien Le Moal Date: Mon Nov 20 16:06:11 2023 +0900 block: Remove blk_set_runtime_active() The function blk_set_runtime_active() is called only from blk_post_runtime_resume(), so there is no need for that function to be exported. Open-code this function directly in blk_post_runtime_resume() and remove it. Signed-off-by: Damien Le Moal Reviewed-by: Bart Van Assche Reviewed-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20231120070611.33951-1-dlemoal@kernel.org Signed-off-by: Jens Axboe block/blk-pm.c | 33 +++++---------------------------- include/linux/blk-pm.h | 1 - 2 files changed, 5 insertions(+), 29 deletions(-) commit c2da049f419417808466c529999170f5c3ef7d3d Author: Li Nan Date: Fri Nov 17 00:23:16 2023 +0800 nbd: fix null-ptr-dereference while accessing 'nbd->config' Memory reordering may occur in nbd_genl_connect(), causing config_refs to be set to 1 while nbd->config is still empty. Opening nbd at this time will cause null-ptr-dereference. T1 T2 nbd_open nbd_get_config_unlocked nbd_genl_connect nbd_alloc_and_init_config //memory reordered refcount_set(&nbd->config_refs, 1) // 2 nbd->config ->null point nbd->config = config // 1 Fix it by adding smp barrier to guarantee the execution sequence. Signed-off-by: Li Nan Reviewed-by: Josef Bacik Link: https://lore.kernel.org/r/20231116162316.1740402-4-linan666@huaweicloud.com Signed-off-by: Jens Axboe drivers/block/nbd.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) commit 3123ac77923341774ca3ad1196ad20bb0732bf70 Author: Li Nan Date: Fri Nov 17 00:23:15 2023 +0800 nbd: factor out a helper to get nbd_config without holding 'config_lock' There are no functional changes, just to make code cleaner and prepare to fix null-ptr-dereference while accessing 'nbd->config'. Signed-off-by: Li Nan Reviewed-by: Josef Bacik Link: https://lore.kernel.org/r/20231116162316.1740402-3-linan666@huaweicloud.com Signed-off-by: Jens Axboe drivers/block/nbd.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) commit 1b59860540a4018e8071dc18d4893ec389506b7d Author: Li Nan Date: Fri Nov 17 00:23:14 2023 +0800 nbd: fold nbd config initialization into nbd_alloc_config() There are no functional changes, make the code cleaner and prepare to fix null-ptr-dereference while accessing 'nbd->config'. Signed-off-by: Li Nan Reviewed-by: Josef Bacik Link: https://lore.kernel.org/r/20231116162316.1740402-2-linan666@huaweicloud.com Signed-off-by: Jens Axboe drivers/block/nbd.c | 41 +++++++++++++++++++---------------------- 1 file changed, 19 insertions(+), 22 deletions(-) commit b85e2dab33ce467e8dcf1cb6c0c587132ff17f56 Author: David Woodhouse Date: Wed Nov 15 11:47:51 2023 -0500 PM: tools: Fix sleepgraph syntax error The sleepgraph tool currently fails: File "/usr/bin/sleepgraph", line 4155 or re.match('psci: CPU(?P[0-9]*) killed.*', msg)): ^ SyntaxError: unmatched ')' Fixes: 34ea427e01ea ("PM: tools: sleepgraph: Recognize "CPU killed" messages") Signed-off-by: David Woodhouse Reviewed-by: Wolfram Sang Signed-off-by: Rafael J. Wysocki tools/power/pm-graph/sleepgraph.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8a554c6234731d63014391331127480755d6cac4 Merge: 3eba5e0b2422 45b478951b2b Author: Jens Axboe Date: Mon Nov 20 09:45:31 2023 -0700 Merge tag 'md-fixes-20231120' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-6.7 Pull MD fix from Song. * tag 'md-fixes-20231120' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: md: fix bi_status reporting in md_end_clone_io commit bd911485294a6f0596e4592ed442438015cffc8a Author: Hans de Goede Date: Wed Nov 15 19:02:22 2023 +0100 ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA Like various other ASUS ExpertBook-s, the ASUS ExpertBook B1402CVA has an ACPI DSDT table that describes IRQ 1 as ActiveLow while the kernel overrides it to EdgeHigh. This prevents the keyboard from working. To fix this issue, add this laptop to the skip_override_table so that the kernel does not override IRQ 1. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218114 Cc: All applicable Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+) commit c93695494606326d7fd72b46a2a657139ccb0dec Author: Hans de Goede Date: Sun Nov 12 21:36:27 2023 +0100 ACPI: video: Use acpi_device_fix_up_power_children() Commit 89c290ea7589 ("ACPI: video: Put ACPI video and its child devices into D0 on boot") introduced calling acpi_device_fix_up_power_extended() on the video card for which the ACPI video bus is the companion device. This unnecessarily touches the power-state of the GPU itself, while the issue it tries to address only requires calling _PS0 on the child devices. Touching the power-state of the GPU itself is causing suspend / resume issues on e.g. a Lenovo ThinkPad W530. Instead use acpi_device_fix_up_power_children(), which only touches the child devices, to fix this. Fixes: 89c290ea7589 ("ACPI: video: Put ACPI video and its child devices into D0 on boot") Reported-by: Owen T. Heisler Closes: https://lore.kernel.org/regressions/9f36fb06-64c4-4264-aaeb-4e1289e764c4@owenh.net/ Closes: https://gitlab.freedesktop.org/drm/nouveau/-/issues/273 Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218124 Tested-by: Kai-Heng Feng Tested-by: Owen T. Heisler Signed-off-by: Hans de Goede Cc: 6.6+ # 6.6+ Signed-off-by: Rafael J. Wysocki drivers/acpi/acpi_video.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 37ba91a82e3b9de35f64348c62b5ec7d74e3a41c Author: Hans de Goede Date: Sun Nov 12 21:36:26 2023 +0100 ACPI: PM: Add acpi_device_fix_up_power_children() function In some cases it is necessary to fix-up the power-state of an ACPI device's children without touching the ACPI device itself add a new acpi_device_fix_up_power_children() function for this. Signed-off-by: Hans de Goede Cc: 6.6+ # 6.6+ Signed-off-by: Rafael J. Wysocki drivers/acpi/device_pm.c | 13 +++++++++++++ include/acpi/acpi_bus.h | 1 + 2 files changed, 14 insertions(+) commit 9bb69ba4c177dccaa1f5b5cbdf80b67813328348 Author: David Woodhouse Date: Fri Oct 27 19:36:51 2023 +0100 ACPI: processor_idle: use raw_safe_halt() in acpi_idle_play_dead() Xen HVM guests were observed taking triple-faults when attempting to online a previously offlined vCPU. Investigation showed that the fault was coming from a failing call to lockdep_assert_irqs_disabled(), in load_current_idt() which was too early in the CPU bringup to actually catch the exception and report the failure cleanly. This was a false positive, caused by acpi_idle_play_dead() setting the per-cpu hardirqs_enabled flag by calling safe_halt(). Switch it to use raw_safe_halt() instead, which doesn't do so. Signed-off-by: David Woodhouse Acked-by: Peter Zijlstra (Intel) Cc: 6.6+ # 6.6+ Signed-off-by: Rafael J. Wysocki drivers/acpi/processor_idle.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3eba5e0b2422aec3c9e79822029599961fdcab97 Author: Coly Li Date: Mon Nov 20 13:25:03 2023 +0800 bcache: avoid NULL checking to c->root in run_cache_set() In run_cache_set() after c->root returned from bch_btree_node_get(), it is checked by IS_ERR_OR_NULL(). Indeed it is unncessary to check NULL because bch_btree_node_get() will not return NULL pointer to caller. This patch replaces IS_ERR_OR_NULL() by IS_ERR() for the above reason. Signed-off-by: Coly Li Link: https://lore.kernel.org/r/20231120052503.6122-11-colyli@suse.de Signed-off-by: Jens Axboe drivers/md/bcache/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 31f5b956a197d4ec25c8a07cb3a2ab69d0c0b82f Author: Coly Li Date: Mon Nov 20 13:25:02 2023 +0800 bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() This patch adds code comments to bch_btree_node_get() and __bch_btree_node_alloc() that NULL pointer will not be returned and it is unnecessary to check NULL pointer by the callers of these routines. Signed-off-by: Coly Li Link: https://lore.kernel.org/r/20231120052503.6122-10-colyli@suse.de Signed-off-by: Jens Axboe drivers/md/bcache/btree.c | 7 +++++++ 1 file changed, 7 insertions(+) commit f72f4312d4388376fc8a1f6cf37cb21a0d41758b Author: Coly Li Date: Mon Nov 20 13:25:01 2023 +0800 bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce() Commit 028ddcac477b ("bcache: Remove unnecessary NULL point check in node allocations") do the following change inside btree_gc_coalesce(), 31 @@ -1340,7 +1340,7 @@ static int btree_gc_coalesce( 32 memset(new_nodes, 0, sizeof(new_nodes)); 33 closure_init_stack(&cl); 34 35 - while (nodes < GC_MERGE_NODES && !IS_ERR_OR_NULL(r[nodes].b)) 36 + while (nodes < GC_MERGE_NODES && !IS_ERR(r[nodes].b)) 37 keys += r[nodes++].keys; 38 39 blocks = btree_default_blocks(b->c) * 2 / 3; At line 35 the original r[nodes].b is not always allocatored from __bch_btree_node_alloc(), and possibly initialized as NULL pointer by caller of btree_gc_coalesce(). Therefore the change at line 36 is not correct. This patch replaces the mistaken IS_ERR() by IS_ERR_OR_NULL() to avoid potential issue. Fixes: 028ddcac477b ("bcache: Remove unnecessary NULL point check in node allocations") Cc: # 6.5+ Cc: Zheng Wang Signed-off-by: Coly Li Link: https://lore.kernel.org/r/20231120052503.6122-9-colyli@suse.de Signed-off-by: Jens Axboe drivers/md/bcache/btree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2faac25d7958c4761bb8cec54adb79f806783ad6 Author: Mingzhe Zou Date: Mon Nov 20 13:25:00 2023 +0800 bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race We get a kernel crash about "unable to handle kernel paging request": ```dmesg [368033.032005] BUG: unable to handle kernel paging request at ffffffffad9ae4b5 [368033.032007] PGD fc3a0d067 P4D fc3a0d067 PUD fc3a0e063 PMD 8000000fc38000e1 [368033.032012] Oops: 0003 [#1] SMP PTI [368033.032015] CPU: 23 PID: 55090 Comm: bch_dirtcnt[0] Kdump: loaded Tainted: G OE --------- - - 4.18.0-147.5.1.es8_24.x86_64 #1 [368033.032017] Hardware name: Tsinghua Tongfang THTF Chaoqiang Server/072T6D, BIOS 2.4.3 01/17/2017 [368033.032027] RIP: 0010:native_queued_spin_lock_slowpath+0x183/0x1d0 [368033.032029] Code: 8b 02 48 85 c0 74 f6 48 89 c1 eb d0 c1 e9 12 83 e0 03 83 e9 01 48 c1 e0 05 48 63 c9 48 05 c0 3d 02 00 48 03 04 cd 60 68 93 ad <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 02 [368033.032031] RSP: 0018:ffffbb48852abe00 EFLAGS: 00010082 [368033.032032] RAX: ffffffffad9ae4b5 RBX: 0000000000000246 RCX: 0000000000003bf3 [368033.032033] RDX: ffff97b0ff8e3dc0 RSI: 0000000000600000 RDI: ffffbb4884743c68 [368033.032034] RBP: 0000000000000001 R08: 0000000000000000 R09: 000007ffffffffff [368033.032035] R10: ffffbb486bb01000 R11: 0000000000000001 R12: ffffffffc068da70 [368033.032036] R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 [368033.032038] FS: 0000000000000000(0000) GS:ffff97b0ff8c0000(0000) knlGS:0000000000000000 [368033.032039] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [368033.032040] CR2: ffffffffad9ae4b5 CR3: 0000000fc3a0a002 CR4: 00000000003626e0 [368033.032042] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [368033.032043] bcache: bch_cached_dev_attach() Caching rbd479 as bcache462 on set 8cff3c36-4a76-4242-afaa-7630206bc70b [368033.032045] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [368033.032046] Call Trace: [368033.032054] _raw_spin_lock_irqsave+0x32/0x40 [368033.032061] __wake_up_common_lock+0x63/0xc0 [368033.032073] ? bch_ptr_invalid+0x10/0x10 [bcache] [368033.033502] bch_dirty_init_thread+0x14c/0x160 [bcache] [368033.033511] ? read_dirty_submit+0x60/0x60 [bcache] [368033.033516] kthread+0x112/0x130 [368033.033520] ? kthread_flush_work_fn+0x10/0x10 [368033.034505] ret_from_fork+0x35/0x40 ``` The crash occurred when call wake_up(&state->wait), and then we want to look at the value in the state. However, bch_sectors_dirty_init() is not found in the stack of any task. Since state is allocated on the stack, we guess that bch_sectors_dirty_init() has exited, causing bch_dirty_init_thread() to be unable to handle kernel paging request. In order to verify this idea, we added some printing information during wake_up(&state->wait). We find that "wake up" is printed twice, however we only expect the last thread to wake up once. ```dmesg [ 994.641004] alcache: bch_dirty_init_thread() wake up [ 994.641018] alcache: bch_dirty_init_thread() wake up [ 994.641523] alcache: bch_sectors_dirty_init() init exit ``` There is a race. If bch_sectors_dirty_init() exits after the first wake up, the second wake up will trigger this bug("unable to handle kernel paging request"). Proceed as follows: bch_sectors_dirty_init kthread_run ==============> bch_dirty_init_thread(bch_dirtcnt[0]) ... ... atomic_inc(&state.started) ... ... ... atomic_read(&state.enough) ... ... atomic_set(&state->enough, 1) kthread_run ======================================================> bch_dirty_init_thread(bch_dirtcnt[1]) ... atomic_dec_and_test(&state->started) ... atomic_inc(&state.started) ... ... ... wake_up(&state->wait) ... atomic_read(&state.enough) atomic_dec_and_test(&state->started) ... ... wait_event(state.wait, atomic_read(&state.started) == 0) ... return ... wake_up(&state->wait) We believe it is very common to wake up twice if there is no dirty, but crash is an extremely low probability event. It's hard for us to reproduce this issue. We attached and detached continuously for a week, with a total of more than one million attaches and only one crash. Putting atomic_inc(&state.started) before kthread_run() can avoid waking up twice. Fixes: b144e45fc576 ("bcache: make bch_sectors_dirty_init() to be multithreaded") Signed-off-by: Mingzhe Zou Cc: Signed-off-by: Coly Li Link: https://lore.kernel.org/r/20231120052503.6122-8-colyli@suse.de Signed-off-by: Jens Axboe drivers/md/bcache/writeback.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e34820f984512b433ee1fc291417e60c47d56727 Author: Mingzhe Zou Date: Mon Nov 20 13:24:59 2023 +0800 bcache: fixup lock c->root error We had a problem with io hung because it was waiting for c->root to release the lock. crash> cache_set.root -l cache_set.list ffffa03fde4c0050 root = 0xffff802ef454c800 crash> btree -o 0xffff802ef454c800 | grep rw_semaphore [ffff802ef454c858] struct rw_semaphore lock; crash> struct rw_semaphore ffff802ef454c858 struct rw_semaphore { count = { counter = -4294967297 }, wait_list = { next = 0xffff00006786fc28, prev = 0xffff00005d0efac8 }, wait_lock = { raw_lock = { { val = { counter = 0 }, { locked = 0 '\000', pending = 0 '\000' }, { locked_pending = 0, tail = 0 } } } }, osq = { tail = { counter = 0 } }, owner = 0xffffa03fdc586603 } The "counter = -4294967297" means that lock count is -1 and a write lock is being attempted. Then, we found that there is a btree with a counter of 1 in btree_cache_freeable. crash> cache_set -l cache_set.list ffffa03fde4c0050 -o|grep btree_cache [ffffa03fde4c1140] struct list_head btree_cache; [ffffa03fde4c1150] struct list_head btree_cache_freeable; [ffffa03fde4c1160] struct list_head btree_cache_freed; [ffffa03fde4c1170] unsigned int btree_cache_used; [ffffa03fde4c1178] wait_queue_head_t btree_cache_wait; [ffffa03fde4c1190] struct task_struct *btree_cache_alloc_lock; crash> list -H ffffa03fde4c1140|wc -l 973 crash> list -H ffffa03fde4c1150|wc -l 1123 crash> cache_set.btree_cache_used -l cache_set.list ffffa03fde4c0050 btree_cache_used = 2097 crash> list -s btree -l btree.list -H ffffa03fde4c1140|grep -E -A2 "^ lock = {" > btree_cache.txt crash> list -s btree -l btree.list -H ffffa03fde4c1150|grep -E -A2 "^ lock = {" > btree_cache_freeable.txt [root@node-3 127.0.0.1-2023-08-04-16:40:28]# pwd /var/crash/127.0.0.1-2023-08-04-16:40:28 [root@node-3 127.0.0.1-2023-08-04-16:40:28]# cat btree_cache.txt|grep counter|grep -v "counter = 0" [root@node-3 127.0.0.1-2023-08-04-16:40:28]# cat btree_cache_freeable.txt|grep counter|grep -v "counter = 0" counter = 1 We found that this is a bug in bch_sectors_dirty_init() when locking c->root: (1). Thread X has locked c->root(A) write. (2). Thread Y failed to lock c->root(A), waiting for the lock(c->root A). (3). Thread X bch_btree_set_root() changes c->root from A to B. (4). Thread X releases the lock(c->root A). (5). Thread Y successfully locks c->root(A). (6). Thread Y releases the lock(c->root B). down_write locked ---(1)----------------------┐ | | | down_read waiting ---(2)----┐ | | | ┌-------------┐ ┌-------------┐ bch_btree_set_root ===(3)========>> | c->root A | | c->root B | | | └-------------┘ └-------------┘ up_write ---(4)---------------------┘ | | | | | down_read locked ---(5)-----------┘ | | | up_read ---(6)-----------------------------┘ Since c->root may change, the correct steps to lock c->root should be the same as bch_root_usage(), compare after locking. static unsigned int bch_root_usage(struct cache_set *c) { unsigned int bytes = 0; struct bkey *k; struct btree *b; struct btree_iter iter; goto lock_root; do { rw_unlock(false, b); lock_root: b = c->root; rw_lock(false, b, b->level); } while (b != c->root); for_each_key_filter(&b->keys, k, &iter, bch_ptr_bad) bytes += bkey_bytes(k); rw_unlock(false, b); return (bytes * 100) / btree_bytes(c); } Fixes: b144e45fc576 ("bcache: make bch_sectors_dirty_init() to be multithreaded") Signed-off-by: Mingzhe Zou Cc: Signed-off-by: Coly Li Link: https://lore.kernel.org/r/20231120052503.6122-7-colyli@suse.de Signed-off-by: Jens Axboe drivers/md/bcache/writeback.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit 7cc47e64d3d69786a2711a4767e26b26ba63d7ed Author: Mingzhe Zou Date: Mon Nov 20 13:24:58 2023 +0800 bcache: fixup init dirty data errors We found that after long run, the dirty_data of the bcache device will have errors. This error cannot be eliminated unless re-register. We also found that reattach after detach, this error can accumulate. In bch_sectors_dirty_init(), all inode <= d->id keys will be recounted again. This is wrong, we only need to count the keys of the current device. Fixes: b144e45fc576 ("bcache: make bch_sectors_dirty_init() to be multithreaded") Signed-off-by: Mingzhe Zou Cc: Signed-off-by: Coly Li Link: https://lore.kernel.org/r/20231120052503.6122-6-colyli@suse.de Signed-off-by: Jens Axboe drivers/md/bcache/writeback.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 2c7f497ac274a14330208b18f6f734000868ebf9 Author: Rand Deeb Date: Mon Nov 20 13:24:57 2023 +0800 bcache: prevent potential division by zero error In SHOW(), the variable 'n' is of type 'size_t.' While there is a conditional check to verify that 'n' is not equal to zero before executing the 'do_div' macro, concerns arise regarding potential division by zero error in 64-bit environments. The concern arises when 'n' is 64 bits in size, greater than zero, and the lower 32 bits of it are zeros. In such cases, the conditional check passes because 'n' is non-zero, but the 'do_div' macro casts 'n' to 'uint32_t,' effectively truncating it to its lower 32 bits. Consequently, the 'n' value becomes zero. To fix this potential division by zero error and ensure precise division handling, this commit replaces the 'do_div' macro with div64_u64(). div64_u64() is designed to work with 64-bit operands, guaranteeing that division is performed correctly. This change enhances the robustness of the code, ensuring that division operations yield accurate results in all scenarios, eliminating the possibility of division by zero, and improving compatibility across different 64-bit environments. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Rand Deeb Cc: Signed-off-by: Coly Li Link: https://lore.kernel.org/r/20231120052503.6122-5-colyli@suse.de Signed-off-by: Jens Axboe drivers/md/bcache/sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit be93825f0e6428c2d3f03a6e4d447dc48d33d7ff Author: Colin Ian King Date: Mon Nov 20 13:24:56 2023 +0800 bcache: remove redundant assignment to variable cur_idx Variable cur_idx is being initialized with a value that is never read, it is being re-assigned later in a while-loop. Remove the redundant assignment. Cleans up clang scan build warning: drivers/md/bcache/writeback.c:916:2: warning: Value stored to 'cur_idx' is never read [deadcode.DeadStores] Signed-off-by: Colin Ian King Reviewed-by: Coly Li Signed-off-by: Coly Li Link: https://lore.kernel.org/r/20231120052503.6122-4-colyli@suse.de Signed-off-by: Jens Axboe drivers/md/bcache/writeback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 777967e7e9f6f5f3e153abffb562bffaf4430d26 Author: Coly Li Date: Mon Nov 20 13:24:55 2023 +0800 bcache: check return value from btree_node_alloc_replacement() In btree_gc_rewrite_node(), pointer 'n' is not checked after it returns from btree_gc_rewrite_node(). There is potential possibility that 'n' is a non NULL ERR_PTR(), referencing such error code is not permitted in following code. Therefore a return value checking is necessary after 'n' is back from btree_node_alloc_replacement(). Signed-off-by: Coly Li Reported-by: Dan Carpenter Cc: Link: https://lore.kernel.org/r/20231120052503.6122-3-colyli@suse.de Signed-off-by: Jens Axboe drivers/md/bcache/btree.c | 2 ++ 1 file changed, 2 insertions(+) commit baf8fb7e0e5ec54ea0839f0c534f2cdcd79bea9c Author: Coly Li Date: Mon Nov 20 13:24:54 2023 +0800 bcache: avoid oversize memory allocation by small stripe_size Arraies bcache->stripe_sectors_dirty and bcache->full_dirty_stripes are used for dirty data writeback, their sizes are decided by backing device capacity and stripe size. Larger backing device capacity or smaller stripe size make these two arraies occupies more dynamic memory space. Currently bcache->stripe_size is directly inherited from queue->limits.io_opt of underlying storage device. For normal hard drives, its limits.io_opt is 0, and bcache sets the corresponding stripe_size to 1TB (1<<31 sectors), it works fine 10+ years. But for devices do declare value for queue->limits.io_opt, small stripe_size (comparing to 1TB) becomes an issue for oversize memory allocations of bcache->stripe_sectors_dirty and bcache->full_dirty_stripes, while the capacity of hard drives gets much larger in recent decade. For example a raid5 array assembled by three 20TB hardrives, the raid device capacity is 40TB with typical 512KB limits.io_opt. After the math calculation in bcache code, these two arraies will occupy 400MB dynamic memory. Even worse Andrea Tomassetti reports that a 4KB limits.io_opt is declared on a new 2TB hard drive, then these two arraies request 2GB and 512MB dynamic memory from kzalloc(). The result is that bcache device always fails to initialize on his system. To avoid the oversize memory allocation, bcache->stripe_size should not directly inherited by queue->limits.io_opt from the underlying device. This patch defines BCH_MIN_STRIPE_SZ (4MB) as minimal bcache stripe size and set bcache device's stripe size against the declared limits.io_opt value from the underlying storage device, - If the declared limits.io_opt > BCH_MIN_STRIPE_SZ, bcache device will set its stripe size directly by this limits.io_opt value. - If the declared limits.io_opt < BCH_MIN_STRIPE_SZ, bcache device will set its stripe size by a value multiplying limits.io_opt and euqal or large than BCH_MIN_STRIPE_SZ. Then the minimal stripe size of a bcache device will always be >= 4MB. For a 40TB raid5 device with 512KB limits.io_opt, memory occupied by bcache->stripe_sectors_dirty and bcache->full_dirty_stripes will be 50MB in total. For a 2TB hard drive with 4KB limits.io_opt, memory occupied by these two arraies will be 2.5MB in total. Such mount of memory allocated for bcache->stripe_sectors_dirty and bcache->full_dirty_stripes is reasonable for most of storage devices. Reported-by: Andrea Tomassetti Signed-off-by: Coly Li Reviewed-by: Eric Wheeler Link: https://lore.kernel.org/r/20231120052503.6122-2-colyli@suse.de Signed-off-by: Jens Axboe drivers/md/bcache/bcache.h | 1 + drivers/md/bcache/super.c | 2 ++ 2 files changed, 3 insertions(+) commit bb0a05acd6121ff0e810b44fdc24dbdfaa46b642 Author: Jonas Karlman Date: Thu Oct 26 19:14:58 2023 +0000 drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full Use of DRM_FORMAT_RGB888 and DRM_FORMAT_BGR888 on e.g. RK3288, RK3328 and RK3399 result in wrong colors being displayed. The issue can be observed using modetest: modetest -s @:1920x1080-60@RG24 modetest -s @:1920x1080-60@BG24 Vendor 4.4 kernel apply an inverted rb swap for these formats on VOP full framework (IP version 3.x) compared to VOP little framework (2.x). Fix colors by applying different rb swap for VOP full framework (3.x) and VOP little framework (2.x) similar to vendor 4.4 kernel. Fixes: 85a359f25388 ("drm/rockchip: Add BGR formats to VOP") Signed-off-by: Jonas Karlman Tested-by: Diederik de Haas Reviewed-by: Christopher Obbard Tested-by: Christopher Obbard Signed-off-by: Heiko Stuebner Link: https://patchwork.freedesktop.org/patch/msgid/20231026191500.2994225-1-jonas@kwiboo.se drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit 8479063f1fbee201a8739130e816cc331b675838 Author: Charles Mirabile Date: Mon Nov 20 05:55:45 2023 -0500 io_uring/fs: consider link->flags when getting path for LINKAT In order for `AT_EMPTY_PATH` to work as expected, the fact that the user wants that behavior needs to make it to `getname_flags` or it will return ENOENT. Fixes: cf30da90bc3a ("io_uring: add support for IORING_OP_LINKAT") Cc: Link: https://github.com/axboe/liburing/issues/995 Signed-off-by: Charles Mirabile Link: https://lore.kernel.org/r/20231120105545.1209530-1-cmirabil@redhat.com Signed-off-by: Jens Axboe io_uring/fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 796432efab1e372d404e7a71cc6891a53f105051 Author: Chuck Lever Date: Sun Nov 19 18:56:17 2023 -0500 libfs: getdents() should return 0 after reaching EOD The new directory offset helpers don't conform with the convention of getdents() returning no more entries once a directory file descriptor has reached the current end-of-directory. To address this, copy the logic from dcache_readdir() to mark the open directory file descriptor once EOD has been reached. Seeking resets the mark. Reported-by: Tavian Barnes Closes: https://lore.kernel.org/linux-fsdevel/20231113180616.2831430-1-tavianator@tavianator.com/ Fixes: 6faddda69f62 ("libfs: Add directory operations for stable offsets") Signed-off-by: Chuck Lever Link: https://lore.kernel.org/r/170043792492.4628.15646203084646716134.stgit@bazille.1015granger.net Signed-off-by: Christian Brauner fs/libfs.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit 9c04138414c00ae61421f36ada002712c4bac94a Author: Christoph Hellwig Date: Wed Oct 25 16:10:20 2023 +0200 xfs: respect the stable writes flag on the RT device Update the per-folio stable writes flag dependening on which device an inode resides on. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20231025141020.192413-5-hch@lst.de Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner fs/xfs/xfs_inode.h | 8 ++++++++ fs/xfs/xfs_ioctl.c | 8 ++++++++ fs/xfs/xfs_iops.c | 7 +++++++ 3 files changed, 23 insertions(+) commit c421df0b19430417a04f68919fc3d1943d20ac04 Author: Christoph Hellwig Date: Wed Oct 25 16:10:19 2023 +0200 xfs: clean up FS_XFLAG_REALTIME handling in xfs_ioctl_setattr_xflags Introduce a local boolean variable if FS_XFLAG_REALTIME to make the checks for it more obvious, and de-densify a few of the conditionals using it to make them more readable while at it. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20231025141020.192413-4-hch@lst.de Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner fs/xfs/xfs_ioctl.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) commit 1898efcdbed32bb1c67269c985a50bab0dbc9493 Author: Christoph Hellwig Date: Wed Oct 25 16:10:18 2023 +0200 block: update the stable_writes flag in bdev_add Propagate the per-queue stable_write flags into each bdev inode in bdev_add. This makes sure devices that require stable writes have it set for I/O on the block device node as well. Note that this doesn't cover the case of a flag changing on a live device yet. We should handle that as well, but I plan to cover it as part of a more general rework of how changing runtime paramters on block devices works. Fixes: 1cb039f3dc16 ("bdi: replace BDI_CAP_STABLE_WRITES with a queue and a sb flag") Reported-by: Ilya Dryomov Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20231025141020.192413-3-hch@lst.de Tested-by: Ilya Dryomov Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner block/bdev.c | 2 ++ 1 file changed, 2 insertions(+) commit 762321dab9a72760bf9aec48362f932717c9424d Author: Christoph Hellwig Date: Wed Oct 25 16:10:17 2023 +0200 filemap: add a per-mapping stable writes flag folio_wait_stable waits for writeback to finish before modifying the contents of a folio again, e.g. to support check summing of the data in the block integrity code. Currently this behavior is controlled by the SB_I_STABLE_WRITES flag on the super_block, which means it is uniform for the entire file system. This is wrong for the block device pseudofs which is shared by all block devices, or file systems that can use multiple devices like XFS witht the RT subvolume or btrfs (although btrfs currently reimplements folio_wait_stable anyway). Add a per-address_space AS_STABLE_WRITES flag to control the behavior in a more fine grained way. The existing SB_I_STABLE_WRITES is kept to initialize AS_STABLE_WRITES to the existing default which covers most cases. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20231025141020.192413-2-hch@lst.de Tested-by: Ilya Dryomov Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner fs/inode.c | 2 ++ include/linux/pagemap.h | 17 +++++++++++++++++ mm/page-writeback.c | 2 +- 3 files changed, 20 insertions(+), 1 deletion(-) commit 66917f85db6002ed09cd24186258892fcfca64b6 Author: Ian Kent Date: Mon Nov 20 06:53:19 2023 +0800 autofs: add: new_inode check in autofs_fill_super() Add missing NULL check of root_inode in autofs_fill_super(). While we are at it simplify the logic by taking advantage of the VFS cleanup procedures and get rid of the goto error handling, as suggested by Al Viro. Signed-off-by: Ian Kent Link: https://lore.kernel.org/r/20231119225319.331156-1-raven@themaw.net Reviewed-by: Bill O'Donnell Cc: Al Viro Cc: Christian Brauner Cc: Bill O'Donnell Reported-by: Signed-off-by: Christian Brauner fs/autofs/inode.c | 56 +++++++++++++++++++++---------------------------------- 1 file changed, 21 insertions(+), 35 deletions(-) commit 14e8442e0789598514f3c9de014950de9feda7a4 Author: Shengjiu Wang Date: Mon Nov 20 18:05:35 2023 +0800 ASoC: fsl_sai: Fix no frame sync clock issue on i.MX8MP On i.MX8MP, when the TERE and FSD_MSTR enabled before configuring the word width, there will be no frame sync clock issue, because old word width impact the generation of frame sync. TERE enabled earlier only for i.MX8MP case for the hardware limitation, So need to disable FSD_MSTR before configuring word width, then enable FSD_MSTR bit for this specific case. Fixes: 3e4a82612998 ("ASoC: fsl_sai: MCLK bind with TX/RX enable bit") Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1700474735-3863-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown sound/soc/fsl/fsl_sai.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) commit d04ce4113cb4e5c2deddcb161db42a25917f285f Author: Stefan Binding Date: Fri Nov 17 16:36:09 2023 +0000 ALSA: cs35l41: Fix for old systems which do not support command Some older laptops using cs35l41 use firmware which does not support the CSPL_MBOX_CMD_SPK_OUT_ENABLE command. Firmware versions v0.28.0 and older do not support this command. Fixes: fa3efcc36aac ("ALSA: cs35l41: Use mbox command to enable speaker output for external boost") Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231117163609.823627-3-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai include/sound/cs35l41.h | 2 +- sound/pci/hda/cs35l41_hda.c | 4 ++-- sound/soc/codecs/cs35l41-lib.c | 6 ++++-- sound/soc/codecs/cs35l41.c | 4 ++-- 4 files changed, 9 insertions(+), 7 deletions(-) commit 37f67abe08557a79c3aabf684a49c6b99dbc259a Author: Stefan Binding Date: Fri Nov 17 16:36:08 2023 +0000 ALSA: hda: cs35l41: Remove unnecessary boolean state variable firmware_running This state duplicates the running state inside cs_dsp, so is not necessary. Remove it, and use cs_dsp.running instead. This brings the CS35L41 HDA driver more inline with its ASoC version, allowing the same state to be used when calling library functions. Fixes: fa3efcc36aac ("ALSA: cs35l41: Use mbox command to enable speaker output for external boost") Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231117163609.823627-2-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda.c | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-) commit 7c9caa299335df94ad1c58f70a22f16a540eab60 Author: Vasiliy Kovalev Date: Fri Nov 17 20:09:23 2023 +0300 ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro This patch corrected the speaker and headset mic pin config to the more appropriate values. Signed-off-by: Vasiliy Kovalev Link: https://lore.kernel.org/r/20231117170923.106822-1-kovalev@altlinux.org Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 0561794b6b642b84b879bf97061c4b4fa692839e Author: Andrzej Hajda Date: Wed Nov 15 11:54:03 2023 +0100 drm/i915: do not clean GT table on error path The only task of intel_gt_release_all is to zero gt table. Calling it on error path prevents intel_gt_driver_late_release_all (called from i915_driver_late_release) to cleanup GTs, causing leakage. After i915_driver_late_release GT array is not used anymore so it does not need cleaning at all. Sample leak report: BUG i915_request (...): Objects remaining in i915_request on __kmem_cache_shutdown() ... Object 0xffff888113420040 @offset=64 Allocated in __i915_request_create+0x75/0x610 [i915] age=18339 cpu=1 pid=1454 kmem_cache_alloc+0x25b/0x270 __i915_request_create+0x75/0x610 [i915] i915_request_create+0x109/0x290 [i915] __engines_record_defaults+0xca/0x440 [i915] intel_gt_init+0x275/0x430 [i915] i915_gem_init+0x135/0x2c0 [i915] i915_driver_probe+0x8d1/0xdc0 [i915] v2: removed whole intel_gt_release_all Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8489 Fixes: bec68cc9ea42 ("drm/i915: Prepare for multiple GTs") Signed-off-by: Andrzej Hajda Reviewed-by: Tvrtko Ursulin Reviewed-by: Nirmoy Das Reviewed-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20231115-dont_clean_gt_on_error_path-v2-1-54250125470a@intel.com (cherry picked from commit e899505533852bf1da133f2f4c9a9655ff77f7e5) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/gt/intel_gt.c | 11 ----------- drivers/gpu/drm/i915/i915_driver.c | 4 +--- 2 files changed, 1 insertion(+), 14 deletions(-) commit 018903e1cec3421a6198589fabd30682eb277904 Author: Imre Deak Date: Mon Oct 30 01:13:08 2023 +0200 drm/i915/dp_mst: Fix race between connector registration and setup After drm_connector_init() is called the connector is visible to the rest of the kernel via the drm_mode_config::connector_list. Make sure that the DSC AUX device and capabilities are setup by that time. Another race condition is adding the connector to the connector list before drm_connector_helper_add() sets the connector helper functions. That's an unrelated issue, for which the fix is for a follow-up. One solution would be adding the connector to the connector list only during its registration in drm_connector_register(). Cc: Stanislav Lisovskiy Cc: Ville Syrjälä Fixes: 808b43fa7e56 ("drm/i915/dp_mst: Set connector DSC capabilities and decompression AUX") Reviewed-by: Stanislav Lisovskiy Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20231030155843.2251023-2-imre.deak@intel.com (cherry picked from commit 560ea72c76eb6d0c59f77580414e64cc09f1093d) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/intel_dp_mst.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 45b478951b2ba5aea70b2850c49c1aa83aedd0d2 Author: Song Liu Date: Fri Nov 17 15:56:30 2023 -0800 md: fix bi_status reporting in md_end_clone_io md_end_clone_io() may overwrite error status in orig_bio->bi_status with BLK_STS_OK. This could happen when orig_bio has BIO_CHAIN (split by md_submit_bio => bio_split_to_limits, for example). As a result, upper layer may miss error reported from md (or the device) and consider the failed IO was successful. Fix this by only update orig_bio->bi_status when current bio reports error and orig_bio is BLK_STS_OK. This is the same behavior as __bio_chain_endio(). Fixes: 10764815ff47 ("md: add io accounting for raid0 and raid5") Cc: stable@vger.kernel.org # v5.14+ Reported-by: Bhanu Victor DiCara <00bvd0+linux@gmail.com> Closes: https://lore.kernel.org/regressions/5727380.DvuYhMxLoT@bvd0/ Signed-off-by: Song Liu Tested-by: Xiao Ni Reviewed-by: Yu Kuai Acked-by: Guoqing Jiang drivers/md/md.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit a6925165ea82b7765269ddd8dcad57c731aa00de Author: Chen Ni Date: Tue Oct 31 04:00:07 2023 +0000 ata: pata_isapnp: Add missing error check for devm_ioport_map() Add missing error return check for devm_ioport_map() and return the error if this function call fails. Fixes: 0d5ff566779f ("libata: convert to iomap") Signed-off-by: Chen Ni Reviewed-by: Sergey Shtylyov Signed-off-by: Damien Le Moal drivers/ata/pata_isapnp.c | 3 +++ 1 file changed, 3 insertions(+) commit 98b1cc82c4affc16f5598d4fa14b1858671b2263 Author: Linus Torvalds Date: Sun Nov 19 15:02:14 2023 -0800 Linux 6.7-rc2 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit eb3479bc23fafbc408558cd8450b35f07fad2a63 Merge: 46a29dd14621 ae1eff0349f2 Author: Linus Torvalds Date: Sun Nov 19 13:54:28 2023 -0800 Merge tag 'kbuild-fixes-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Fix section mismatch warning messages for riscv and loongarch - Remove CONFIG_IA64 left-over from linux/export-internal.h - Fix the location of the quotes for UIMAGE_NAME - Fix a memory leak bug in Kconfig * tag 'kbuild-fixes-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kconfig: fix memory leak from range properties kbuild: Move the single quotes for image name linux/export: clean up the IA-64 KSYM_FUNC macro modpost: fix section mismatch message for RELA commit 46a29dd1462198e67bf939c32a2faf4e9bf9ac63 Merge: cd557bc0a2d0 d3badb15613c Author: Linus Torvalds Date: Sun Nov 19 13:49:32 2023 -0800 Merge tag 'irq_urgent_for_v6.7_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Borislav Petkov: - Flush the translation service tables to prevent unpredictable behavior on non-coherent GIC devices * tag 'irq_urgent_for_v6.7_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gic-v3-its: Flush ITS tables correctly in non-coherent GIC designs commit cd557bc0a2d0f36c41b6040c27f31da5c5b76f49 Merge: b0014556a2a1 ec9aedb2aa1a Author: Linus Torvalds Date: Sun Nov 19 13:46:17 2023 -0800 Merge tag 'x86_urgent_for_v6.7_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Ignore invalid x2APIC entries in order to not waste per-CPU data - Fix a back-to-back signals handling scenario when shadow stack is in use - A documentation fix - Add Kirill as TDX maintainer * tag 'x86_urgent_for_v6.7_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/acpi: Ignore invalid x2APIC entries x86/shstk: Delay signal entry SSP write until after user accesses x86/Documentation: Indent 'note::' directive for protocol version number note MAINTAINERS: Add Intel TDX entry commit b0014556a2a1991df08b2b5d586a1bcc9e762ffd Merge: 2a0adc49548e 5c0930ccaad5 Author: Linus Torvalds Date: Sun Nov 19 13:35:07 2023 -0800 Merge tag 'timers_urgent_for_v6.7_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Borislav Petkov: - Do the push of pending hrtimers away from a CPU which is being offlined earlier in the offlining process in order to prevent a deadlock * tag 'timers_urgent_for_v6.7_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: hrtimers: Push pending hrtimers away from outgoing CPU earlier commit 2a0adc49548e9116fdf9d7a39f5e0d8c1e16bef6 Merge: 2f84f8232ed3 6d7e4782bcf5 Author: Linus Torvalds Date: Sun Nov 19 13:32:00 2023 -0800 Merge tag 'sched_urgent_for_v6.7_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Borislav Petkov: - Fix virtual runtime calculation when recomputing a sched entity's weights - Fix wrongly rejected unprivileged poll requests to the cgroup psi pressure files - Make sure the load balancing is done by only one CPU * tag 'sched_urgent_for_v6.7_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Fix the decision for load balance sched: psi: fix unprivileged polling against cgroups sched/eevdf: Fix vruntime adjustment on reweight commit 2f84f8232ed3bfb772dcf30d8a0acbb8ee7ffb73 Merge: c8b3443cbde9 c9bd1568d546 Author: Linus Torvalds Date: Sun Nov 19 13:30:21 2023 -0800 Merge tag 'locking_urgent_for_v6.7_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Borislav Petkov: - Fix a hardcoded futex flags case which lead to one robust futex test failure * tag 'locking_urgent_for_v6.7_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Fix hardcoded flags commit c8b3443cbde91251970893fe4d5dc465c1a76a7e Merge: 037266a5f723 889c58b3155f Author: Linus Torvalds Date: Sun Nov 19 13:26:42 2023 -0800 Merge tag 'perf_urgent_for_v6.7_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Borislav Petkov: - Make sure the context refcount is transferred too when migrating perf events * tag 'perf_urgent_for_v6.7_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fix cpuctx refcounting commit 938dbead34cd139c50c5d51cc58e18ef2f1c3d2c Author: Jakub Kicinski Date: Sat Nov 18 19:30:06 2023 -0800 net: fill in MODULE_DESCRIPTION()s for SOCK_DIAG modules W=1 builds now warn if module is built without a MODULE_DESCRIPTION(). Add descriptions to all the sock diag modules in one fell swoop. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller net/ipv4/inet_diag.c | 1 + net/ipv4/raw_diag.c | 1 + net/ipv4/tcp_diag.c | 1 + net/ipv4/udp_diag.c | 1 + net/mptcp/mptcp_diag.c | 1 + net/packet/diag.c | 1 + net/sctp/diag.c | 1 + net/smc/smc_diag.c | 1 + net/tipc/diag.c | 1 + net/unix/diag.c | 1 + net/vmw_vsock/diag.c | 1 + net/xdp/xsk_diag.c | 1 + 12 files changed, 12 insertions(+) commit 5f228d7c8a539714c1e9b7e7534f76bb7979f268 Author: Suman Ghosh Date: Fri Nov 17 16:10:18 2023 +0530 octeontx2-pf: Fix memory leak during interface down During 'ifconfig down' one RSS memory was not getting freed. This patch fixes the same. Fixes: 81a4362016e7 ("octeontx2-pf: Add RSS multi group support") Signed-off-by: Suman Ghosh Reviewed-by: Simon Horman Signed-off-by: David S. Miller drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 ++ 1 file changed, 2 insertions(+) commit 93da8d75a66568ba4bb5b14ad2833acd7304cd02 Author: Eric Dumazet Date: Fri Nov 17 14:17:33 2023 +0000 wireguard: use DEV_STATS_INC() wg_xmit() can be called concurrently, KCSAN reported [1] some device stats updates can be lost. Use DEV_STATS_INC() for this unlikely case. [1] BUG: KCSAN: data-race in wg_xmit / wg_xmit read-write to 0xffff888104239160 of 8 bytes by task 1375 on cpu 0: wg_xmit+0x60f/0x680 drivers/net/wireguard/device.c:231 __netdev_start_xmit include/linux/netdevice.h:4918 [inline] netdev_start_xmit include/linux/netdevice.h:4932 [inline] xmit_one net/core/dev.c:3543 [inline] dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3559 ... read-write to 0xffff888104239160 of 8 bytes by task 1378 on cpu 1: wg_xmit+0x60f/0x680 drivers/net/wireguard/device.c:231 __netdev_start_xmit include/linux/netdevice.h:4918 [inline] netdev_start_xmit include/linux/netdevice.h:4932 [inline] xmit_one net/core/dev.c:3543 [inline] dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3559 ... v2: also change wg_packet_consume_data_done() (Hangbin Liu) and wg_packet_purge_staged_packets() Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Jason A. Donenfeld Cc: Hangbin Liu Signed-off-by: Jason A. Donenfeld Reviewed-by: Hangbin Liu Signed-off-by: David S. Miller drivers/net/wireguard/device.c | 4 ++-- drivers/net/wireguard/receive.c | 12 ++++++------ drivers/net/wireguard/send.c | 3 ++- 3 files changed, 10 insertions(+), 9 deletions(-) commit 8ba2c459668cfe2aaacc5ebcd35b4b9ef8643013 Author: Jiawen Wu Date: Fri Nov 17 18:11:08 2023 +0800 net: wangxun: fix kernel panic due to null pointer When the device uses a custom subsystem vendor ID, the function wx_sw_init() returns before the memory of 'wx->mac_table' is allocated. The null pointer will causes the kernel panic. Fixes: 79625f45ca73 ("net: wangxun: Move MAC address handling to libwx") Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Signed-off-by: David S. Miller drivers/net/ethernet/wangxun/libwx/wx_hw.c | 8 +++++--- drivers/net/ethernet/wangxun/ngbe/ngbe_main.c | 4 +--- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 4 +--- 3 files changed, 7 insertions(+), 9 deletions(-) commit 3f9a91b6c00e655d27bd785dcda1742dbdc31bda Author: Marek Vasut Date: Mon Oct 9 00:32:56 2023 +0200 drm/panel: simple: Fix Innolux G101ICE-L01 timings The Innolux G101ICE-L01 datasheet [1] page 17 table 6.1 INPUT SIGNAL TIMING SPECIFICATIONS indicates that maximum vertical blanking time is 40 lines. Currently the driver uses 29 lines. Fix it, and since this panel is a DE panel, adjust the timings to make them less hostile to controllers which cannot do 1 px HSA/VSA, distribute the delays evenly between all three parts. [1] https://www.data-modul.com/sites/default/files/products/G101ICE-L01-C2-specification-12042389.pdf Fixes: 1e29b840af9f ("drm/panel: simple: Add Innolux G101ICE-L01 panel") Signed-off-by: Marek Vasut Reviewed-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20231008223256.279196-1-marex@denx.de drivers/gpu/drm/panel/panel-simple.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 06fc41b09cfbc02977acd9189473593a37d82d9b Author: Marek Vasut Date: Mon Oct 9 00:33:15 2023 +0200 drm/panel: simple: Fix Innolux G101ICE-L01 bus flags Add missing .bus_flags = DRM_BUS_FLAG_DE_HIGH to this panel description, ones which match both the datasheet and the panel display_timing flags . Fixes: 1e29b840af9f ("drm/panel: simple: Add Innolux G101ICE-L01 panel") Signed-off-by: Marek Vasut Reviewed-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20231008223315.279215-1-marex@denx.de drivers/gpu/drm/panel/panel-simple.c | 1 + 1 file changed, 1 insertion(+) commit b6f09b16558f31d93cdcda3cab90a2d309a7c823 Author: Junxian Huang Date: Fri Nov 17 16:06:57 2023 +0800 MAINTAINERS: Add Chengchang Tang as Hisilicon RoCE maintainer Add Chengchang Tang as Hisilicon RoCE maintainer. Signed-off-by: Junxian Huang Link: https://lore.kernel.org/r/20231117080657.1844316-1-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit 037266a5f7239ead1530266f7d7af153d2a867fa Merge: 2254005ef147 2a0508d9d08f Author: Linus Torvalds Date: Sat Nov 18 15:20:58 2023 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Seven small fixes, six in drivers and one in sd. The sd fix is so large because it changes a struct pointer to a struct but otherwise is fairly simple" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: qcom-ufs: dt-bindings: Document the SM8650 UFS Controller scsi: sd: Fix sshdr use in sd_suspend_common() scsi: scsi_debug: Delete some bogus error checking scsi: scsi_debug: Fix some bugs in sdebug_error_write() scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR scsi: ufs: core: Expand MCQ queue slot to DeviceQueueDepth + 1 scsi: qla2xxx: Fix system crash due to bad pointer access commit 2254005ef1474d59b706f2ea574d8552071631b1 Merge: b8f1fa2419c1 793838138c15 Author: Linus Torvalds Date: Sat Nov 18 15:13:10 2023 -0800 Merge tag 'parisc-for-6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fixes from Helge Deller: "On parisc we still sometimes need writeable stacks, e.g. if programs aren't compiled with gcc-14. To avoid issues with the upcoming systemd-254 we therefore have to disable prctl(PR_SET_MDWE) for now (for parisc only). The other two patches are minor: a bugfix for the soft power-off on qemu with 64-bit kernel and prefer strscpy() over strlcpy(): - Fix power soft-off on qemu - Disable prctl(PR_SET_MDWE) since parisc sometimes still needs writeable stacks - Use strscpy instead of strlcpy in show_cpuinfo()" * tag 'parisc-for-6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: prctl: Disable prctl(PR_SET_MDWE) on parisc parisc/power: Fix power soft-off when running on qemu parisc: Replace strlcpy() with strscpy() commit b9622937d95809ef89904583191571a9fa326402 Author: Chukun Pan Date: Sun Oct 29 15:40:09 2023 +0800 arm64: dts: allwinner: h616: update emac for Orange Pi Zero 3 The current emac setting is not suitable for Orange Pi Zero 3, move it back to Orange Pi Zero 2 DT. Also update phy mode and delay values for emac on Orange Pi Zero 3. With these changes, Ethernet now looks stable. Fixes: 322bf103204b ("arm64: dts: allwinner: h616: Split Orange Pi Zero 2 DT") Signed-off-by: Chukun Pan Reviewed-by: Jernej Skrabec Link: https://lore.kernel.org/r/20231029074009.7820-2-amadeus@jmu.edu.cn Signed-off-by: Jernej Skrabec arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero.dtsi | 3 --- arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero2.dts | 3 +++ arch/arm64/boot/dts/allwinner/sun50i-h618-orangepi-zero3.dts | 2 ++ 3 files changed, 5 insertions(+), 3 deletions(-) commit b8f1fa2419c19c81bc386a6b350879ba54a573e1 Merge: bb28378af392 7930d9e10370 Author: Linus Torvalds Date: Sat Nov 18 11:28:28 2023 -0800 Merge tag 'xfs-6.7-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Chandan Babu: - Fix deadlock arising due to intent items in AIL not being cleared when log recovery fails - Fix stale data exposure bug when remapping COW fork extents to data fork - Fix deadlock when data device flush fails - Fix AGFL minimum size calculation - Select DEBUG_FS instead of XFS_DEBUG when XFS_ONLINE_SCRUB_STATS is selected - Fix corruption of log inode's extent count field when NREXT64 feature is enabled * tag 'xfs-6.7-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: recovery should not clear di_flushiter unconditionally xfs: inode recovery does not validate the recovered inode xfs: fix again select in kconfig XFS_ONLINE_SCRUB_STATS xfs: fix internal error from AGFL exhaustion xfs: up(ic_sema) if flushing data device fails xfs: only remap the written blocks in xfs_reflink_end_cow_extent XFS: Update MAINTAINERS to catch all XFS documentation xfs: abort intent items when recovery intents fail xfs: factor out xfs_defer_pending_abort commit bb28378af3921ea50f316d025acd1f7290873b51 Merge: 33b63f159a43 bf51c52a1f3c Author: Linus Torvalds Date: Sat Nov 18 11:23:32 2023 -0800 Merge tag 'nfsd-6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - Fix several long-standing bugs in the duplicate reply cache - Fix a memory leak * tag 'nfsd-6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: NFSD: Fix checksum mismatches in the duplicate reply cache NFSD: Fix "start of NFS reply" pointer passed to nfsd_cache_update() NFSD: Update nfsd_cache_append() to use xdr_stream nfsd: fix file memleak on client_opens_release commit 33b63f159a435c6dcaaf2cd0f312b28c76b61373 Merge: 05aa69b096a0 5eef12c4e323 Author: Linus Torvalds Date: Sat Nov 18 11:18:46 2023 -0800 Merge tag '6.7-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - multichannel fixes (including a lock ordering fix and an important refcounting fix) - spnego fix * tag '6.7-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: fix lock ordering while disabling multichannel cifs: fix leak of iface for primary channel cifs: fix check of rc in function generate_smb3signingkey cifs: spnego: add ';' in HOST_KEY_LEN commit 793838138c157d4c49f4fb744b170747e3dabf58 Author: Helge Deller Date: Sat Nov 18 19:33:35 2023 +0100 prctl: Disable prctl(PR_SET_MDWE) on parisc systemd-254 tries to use prctl(PR_SET_MDWE) for it's MemoryDenyWriteExecute functionality, but fails on parisc which still needs executable stacks in certain combinations of gcc/glibc/kernel. Disable prctl(PR_SET_MDWE) by returning -EINVAL for now on parisc, until userspace has catched up. Signed-off-by: Helge Deller Co-developed-by: Linus Torvalds Reported-by: Sam James Closes: https://github.com/systemd/systemd/issues/29775 Tested-by: Sam James Link: https://lore.kernel.org/all/875y2jro9a.fsf@gentoo.org/ Cc: # v6.3+ kernel/sys.c | 4 ++++ 1 file changed, 4 insertions(+) commit 05aa69b096a089dc85391e36ccdce76961694e22 Merge: 23dfa043f6d5 13648e04a9b8 Author: Linus Torvalds Date: Sat Nov 18 10:02:16 2023 -0800 Merge tag 'for-6.7/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Various fixes for the DM delay target to address regressions introduced during the 6.7 merge window - Fixes to both DM bufio and the verity target for no-sleep mode, to address sleeping while atomic issues - Update DM crypt target in response to the treewide change that made MAX_ORDER inclusive * tag 'for-6.7/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm-crypt: start allocating with MAX_ORDER dm-verity: don't use blocking calls from tasklets dm-bufio: fix no-sleep mode dm-delay: avoid duplicate logic dm-delay: fix bugs introduced by kthread mode dm-delay: fix a race between delay_presuspend and delay_bio commit 6ad6e15a9c46b8f0932cd99724f26f3db4db1cdf Author: Helge Deller Date: Fri Nov 17 16:43:52 2023 +0100 parisc/power: Fix power soft-off when running on qemu Firmware returns the physical address of the power switch, so need to use gsc_writel() instead of direct memory access. Fixes: d0c219472980 ("parisc/power: Add power soft-off when running on qemu") Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v6.0+ drivers/parisc/power.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 721d28f3dfb3e40c45ce45fbeeff47b72c230bc9 Author: Kees Cook Date: Thu Nov 16 11:13:40 2023 -0800 parisc: Replace strlcpy() with strscpy() strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated[1]. Additionally, it returns the size of the source string, not the resulting size of the destination string. In an effort to remove strlcpy() completely[2], replace strlcpy() here with strscpy(). Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [1] Link: https://github.com/KSPP/linux/issues/89 [2] Cc: "James E.J. Bottomley" Cc: Helge Deller Cc: Azeem Shaikh Cc: linux-parisc@vger.kernel.org Signed-off-by: Kees Cook Signed-off-by: Helge Deller arch/parisc/kernel/processor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 23dfa043f6d5ac9339607f077f2c30cd50798e12 Merge: 9ea991a50dd5 382561d16854 Author: Linus Torvalds Date: Sat Nov 18 09:44:14 2023 -0800 Merge tag 'i2c-for-6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Revert a not-working conversion to generic recovery for PXA, use proper IO accessors for designware, and use proper PM level for ocores to allow accessing interrupt providers late" * tag 'i2c-for-6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: ocores: Move system PM hooks to the NOIRQ phase i2c: designware: Fix corrupted memory seen in the ISR Revert "i2c: pxa: move to generic GPIO recovery" commit 9ea991a50dd559ad2f1a5094d73f9583811979a5 Merge: 791c8ab095f7 b8337e6a780d Author: Linus Torvalds Date: Sat Nov 18 09:09:17 2023 -0800 Merge tag 'turbostat-2023.11.07' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull turbostat updates from Len Brown: - Turbostat features are now table-driven (Rui Zhang) - Add support for some new platforms (Sumeet Pawnikar, Rui Zhang) - Gracefully run in configs when CPUs are limited (Rui Zhang, Srinivas Pandruvada) - misc minor fixes [ This came in during the merge window, but sorting out the signed tag took a while, so thus the late merge - Linus ] * tag 'turbostat-2023.11.07' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: (86 commits) tools/power turbostat: version 2023.11.07 tools/power/turbostat: bugfix "--show IPC" tools/power/turbostat: Add initial support for LunarLake tools/power/turbostat: Add initial support for ArrowLake tools/power/turbostat: Add initial support for GrandRidge tools/power/turbostat: Add initial support for SierraForest tools/power/turbostat: Add initial support for GraniteRapids tools/power/turbostat: Add MSR_CORE_C1_RES support for spr_features tools/power/turbostat: Move process to root cgroup tools/power/turbostat: Handle cgroup v2 cpu limitation tools/power/turbostat: Abstrct function for parsing cpu string tools/power/turbostat: Handle offlined CPUs in cpu_subset tools/power/turbostat: Obey allowed CPUs for system summary tools/power/turbostat: Obey allowed CPUs for primary thread/core detection tools/power/turbostat: Abstract several functions tools/power/turbostat: Obey allowed CPUs during startup tools/power/turbostat: Obey allowed CPUs when accessing CPU counters tools/power/turbostat: Introduce cpu_allowed_set tools/power/turbostat: Remove PC7/PC9 support on ADL/RPL tools/power/turbostat: Enable MSR_CORE_C1_RES on recent Intel client platforms ... commit fe2c34bab6d46469ad3095955dc37e984dc24e38 Author: Omar Sandoval Date: Fri Nov 17 13:38:46 2023 -0800 iov_iter: fix copy_page_to_iter_nofault() The recent conversion to inline functions made two mistakes: 1. It tries to copy the full amount requested (bytes), not just what's available in the kmap'd page (n). 2. It's not applying the offset in the first page. Note that copy_page_to_iter_nofault() is only used by /proc/kcore. This was detected by drgn's test suite. Fixes: f1982740f5e7 ("iov_iter: Convert iterate*() to inline funcs") Signed-off-by: Omar Sandoval Link: https://lore.kernel.org/r/c1616e06b5248013cbbb1881bb4fef85a7a69ccb.1700257019.git.osandov@fb.com Acked-by: David Howells Signed-off-by: Christian Brauner lib/iov_iter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8a924db2d7b5eb69ba08b1a0af46e9f1359a9bdf Author: Stefan Berger Date: Mon Oct 2 08:57:33 2023 -0400 fs: Pass AT_GETATTR_NOSEC flag to getattr interface function When vfs_getattr_nosec() calls a filesystem's getattr interface function then the 'nosec' should propagate into this function so that vfs_getattr_nosec() can again be called from the filesystem's gettattr rather than vfs_getattr(). The latter would add unnecessary security checks that the initial vfs_getattr_nosec() call wanted to avoid. Therefore, introduce the getattr flag GETATTR_NOSEC and allow to pass with the new getattr_flags parameter to the getattr interface function. In overlayfs and ecryptfs use this flag to determine which one of the two functions to call. In a recent code change introduced to IMA vfs_getattr_nosec() ended up calling vfs_getattr() in overlayfs, which in turn called security_inode_getattr() on an exiting process that did not have current->fs set anymore, which then caused a kernel NULL pointer dereference. With this change the call to security_inode_getattr() can be avoided, thus avoiding the NULL pointer dereference. Reported-by: Fixes: db1d1e8b9867 ("IMA: use vfs_getattr_nosec to get the i_version") Cc: Alexander Viro Cc: Cc: Miklos Szeredi Cc: Amir Goldstein Cc: Tyler Hicks Cc: Mimi Zohar Suggested-by: Christian Brauner Co-developed-by: Amir Goldstein Signed-off-by: Stefan Berger Link: https://lore.kernel.org/r/20231002125733.1251467-1-stefanb@linux.vnet.ibm.com Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner fs/ecryptfs/inode.c | 12 ++++++++++-- fs/overlayfs/inode.c | 10 +++++----- fs/overlayfs/overlayfs.h | 8 ++++++++ fs/stat.c | 6 +++++- include/uapi/linux/fcntl.h | 3 +++ 5 files changed, 31 insertions(+), 8 deletions(-) commit 56466f653cb59a8f46e991ad1e285f43afdca7d4 Author: Dan Carpenter Date: Fri Oct 13 11:25:15 2023 +0300 drm/msm: remove unnecessary NULL check This NULL check was required when it was added, but we shuffled the code around and now it's not. The inconsistent NULL checking triggers a Smatch warning: drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c:847 mdp5_init() warn: variable dereferenced before check 'mdp5_kms' (see line 782) Fixes: 1f50db2f3e1e ("drm/msm/mdp5: move resource allocation to the _probe function") Signed-off-by: Dan Carpenter Reviewed-by: Uwe Kleine-König Reviewed-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/562559/ Link: https://lore.kernel.org/r/ZSj+6/J6YsoSpLak@kadam Signed-off-by: Abhinav Kumar drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 3bdaf698a7973156209c00d33b548882784aefe8 Merge: f8ba14b78027 aa7e8e5e4011 Author: Mark Brown Date: Fri Nov 17 23:19:12 2023 +0000 ASoC: Fixes for cs43130 Merge a couple of small fixes for the cs43130, one const correctness issue and one problem with the configuration of left justified format. commit 791c8ab095f71327899023223940dd52257a4173 Merge: 12ee72fe01e4 ba276ce5865b Author: Linus Torvalds Date: Fri Nov 17 14:36:58 2023 -0800 Merge tag 'bcachefs-2023-11-17' of https://evilpiepirate.org/git/bcachefs Pull bcachefs fixes from Kent Overstreet: "Lots of small fixes for minor nits and compiler warnings. Bigger items: - The six locks lost wakeup is finally fixed: six_read_trylock() was checking for the waiting bit before decrementing the number of readers - validated the fix with a torture test. - Fix for a memory reclaim issue: when needing to reallocate a key cache key, we now do our usual GFP_NOWAIT; unlock(); GFP_KERNEL dance. - Multiple deleted inodes btree fixes - Fix an issue in fsck, where i_nlink would be recalculated incorrectly for hardlinked files if a snapshot had ever been taken. - Kill journal pre-reservations: This is a bigger patch than I would normally send at this point, but it deletes code and it fixes some of our tests that would sporadically die with the journal getting stuck, and it's a performance improvement, too" * tag 'bcachefs-2023-11-17' of https://evilpiepirate.org/git/bcachefs: (22 commits) bcachefs: Fix missing locking for dentry->d_parent access bcachefs: six locks: Fix lost wakeup bcachefs: Fix no_data_io mode checksum check bcachefs: Fix bch2_check_nlinks() for snapshots bcachefs: Don't decrease BTREE_ITER_MAX when LOCKDEP=y bcachefs: Disable debug log statements bcachefs: Fix missing transaction commit bcachefs: Fix error path in bch2_mount() bcachefs: Fix potential sleeping during mount bcachefs: Fix iterator leak in may_delete_deleted_inode() bcachefs: Kill journal pre-reservations bcachefs: Check for nonce offset inconsistency in data_update path bcachefs: Make sure to drop/retake btree locks before reclaim bcachefs: btree_trans->write_locked bcachefs: Run btree key cache shrinker less aggressively bcachefs: Split out btree_key_cache_types.h bcachefs: Guard against insufficient devices to create stripes bcachefs: Fix null ptr deref in bch2_backpointer_get_node() bcachefs: Fix multiple -Warray-bounds warnings bcachefs: Use DECLARE_FLEX_ARRAY() helper and fix multiple -Warray-bounds warnings ... commit 12ee72fe01e45a9586b9d130c5501763818c8efc Merge: ffd75bc777b4 afccb0804fc7 Author: Linus Torvalds Date: Fri Nov 17 14:19:46 2023 -0800 Merge tag 'mm-hotfixes-stable-2023-11-17-14-04' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "Thirteen hotfixes. Seven are cc:stable and the remainder pertain to post-6.6 issues or aren't considered suitable for backporting" * tag 'mm-hotfixes-stable-2023-11-17-14-04' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm: more ptep_get() conversion parisc: fix mmap_base calculation when stack grows upwards mm/damon/core.c: avoid unintentional filtering out of schemes mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors mm/damon/sysfs-schemes: handle tried region directory allocation failure mm/damon/sysfs-schemes: handle tried regions sysfs directory allocation failure mm/damon/sysfs: check error from damon_sysfs_update_target() mm: fix for negative counter: nr_file_hugepages selftests/mm: add hugetlb_fault_after_madv to .gitignore selftests/mm: restore number of hugepages selftests: mm: fix some build warnings selftests: mm: skip whole test instead of failure mm/damon/sysfs: eliminate potential uninitialized variable warning commit ffd75bc777b4f86bee0e49a1b9f2c45dc4503001 Merge: 0e413c2a737f b0077e269f6c Author: Linus Torvalds Date: Fri Nov 17 14:08:14 2023 -0800 Merge tag 'block-6.7-2023-11-17' of git://git.kernel.dk/linux Pull block fix from Jens Axboe: "Just a single fix from Christoph/Ming, fixing a case where integrity IO could be called without having an appropriate queue reference" * tag 'block-6.7-2023-11-17' of git://git.kernel.dk/linux: blk-mq: make sure active queue usage is held for bio_integrity_prep() commit 0e413c2a737f4ce8924645ee80438c3be7c44ee3 Merge: e63fe2d35ee0 a0d45c3f596b Author: Linus Torvalds Date: Fri Nov 17 14:03:18 2023 -0800 Merge tag 'io_uring-6.7-2023-11-17' of git://git.kernel.dk/linux Pull io_uring fix from Jens Axboe: "Just a single fixup for a change we made in this release, which caused a regression in sometimes missing fdinfo output if the SQPOLL thread had the lock held when fdinfo output was retrieved. This brings us back on par with what we had before, where just the main uring_lock will prevent that output. We'd love to get rid of that too, but that is beyond the scope of this release and will have to wait for 6.8" * tag 'io_uring-6.7-2023-11-17' of git://git.kernel.dk/linux: io_uring/fdinfo: remove need for sqpoll lock for thread/pid retrieval commit e63fe2d35ee095b483adf936747dbc7d85f3de38 Merge: 6bc40e44f1dd 86d8f905f24d Author: Linus Torvalds Date: Fri Nov 17 13:58:26 2023 -0800 Merge tag 'drm-fixes-2023-11-17' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Daniel Vetter: "This is a 'blast from the bast' fixes pull, because it contains a bunch of AGP fixes for amdgpu. Otherwise nothing out of the ordinary. Next week is back to Dave unless he's knocked out by some conference bug. - amdgpu: fixes all over, including a set of AGP fixes - nouvea: GSP + other bugfixes - ivpu build fix - lenovo legion go panel orientation quirk" * tag 'drm-fixes-2023-11-17' of git://anongit.freedesktop.org/drm/drm: (30 commits) drm/amdgpu/gmc9: disable AGP aperture drm/amdgpu/gmc10: disable AGP aperture drm/amdgpu/gmc11: disable AGP aperture drm/amdgpu: add a module parameter to control the AGP aperture drm/amdgpu/gmc11: fix logic typo in AGP check drm/amd/display: Fix encoder disable logic drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox drm/amdgpu: add and populate the port num into xgmi topology info drm/amd/display: Negate IPS allow and commit bits drm/amd/pm: Don't send unload message for reset drm/amdgpu: fix ras err_data null pointer issue in amdgpu_ras.c drm/amd/display: Clear dpcd_sink_ext_caps if not set drm/amd/display: Enable fast plane updates on DCN3.2 and above drm/amd/display: fix NULL dereference drm/amd/display: fix a NULL pointer dereference in amdgpu_dm_i2c_xfer() drm/amd/display: Add null checks for 8K60 lightup drm/amd/pm: Fill pcie error counters for gpu v1_4 drm/amd/pm: Update metric table for smu v13_0_6 drm/amdgpu: correct chunk_ptr to a pointer to chunk. drm/amd/display: Fix DSC not Enabled on Direct MST Sink ... commit 6965809e526917b73c8f9178173184dcf13cec4b Author: Xuxin Xiong Date: Tue Nov 14 12:42:05 2023 +0800 drm/panel: auo,b101uan08.3: Fine tune the panel power sequence For "auo,b101uan08.3" this panel, it is stipulated in the panel spec that MIPI needs to keep the LP11 state before the lcm_reset pin is pulled high. Fixes: 56ad624b4cb5 ("drm/panel: support for auo, b101uan08.3 wuxga dsi video mode panel") Signed-off-by: Xuxin Xiong Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patchwork.freedesktop.org/patch/msgid/20231114044205.613421-1-xuxinxiong@huaqin.corp-partner.google.com drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 1 + 1 file changed, 1 insertion(+) commit bf51c52a1f3c238d72c64e14d5e7702d3a245b82 Author: Chuck Lever Date: Fri Nov 10 11:28:45 2023 -0500 NFSD: Fix checksum mismatches in the duplicate reply cache nfsd_cache_csum() currently assumes that the server's RPC layer has been advancing rq_arg.head[0].iov_base as it decodes an incoming request, because that's the way it used to work. On entry, it expects that buf->head[0].iov_base points to the start of the NFS header, and excludes the already-decoded RPC header. These days however, head[0].iov_base now points to the start of the RPC header during all processing. It no longer points at the NFS Call header when execution arrives at nfsd_cache_csum(). In a retransmitted RPC the XID and the NFS header are supposed to be the same as the original message, but the contents of the retransmitted RPC header can be different. For example, for krb5, the GSS sequence number will be different between the two. Thus if the RPC header is always included in the DRC checksum computation, the checksum of the retransmitted message might not match the checksum of the original message, even though the NFS part of these messages is identical. The result is that, even if a matching XID is found in the DRC, the checksum mismatch causes the server to execute the retransmitted RPC transaction again. Reviewed-by: Jeff Layton Tested-by: Jeff Layton Signed-off-by: Chuck Lever fs/nfsd/cache.h | 4 ++-- fs/nfsd/nfscache.c | 64 ++++++++++++++++++++++++++++++++++++------------------ fs/nfsd/nfssvc.c | 10 ++++++++- 3 files changed, 54 insertions(+), 24 deletions(-) commit 1caf5f61dd8430ae5a0b4538afe4953ce7517cbb Author: Chuck Lever Date: Fri Nov 10 11:28:33 2023 -0500 NFSD: Fix "start of NFS reply" pointer passed to nfsd_cache_update() The "statp + 1" pointer that is passed to nfsd_cache_update() is supposed to point to the start of the egress NFS Reply header. In fact, it does point there for AUTH_SYS and RPCSEC_GSS_KRB5 requests. But both krb5i and krb5p add fields between the RPC header's accept_stat field and the start of the NFS Reply header. In those cases, "statp + 1" points at the extra fields instead of the Reply. The result is that nfsd_cache_update() caches what looks to the client like garbage. A connection break can occur for a number of reasons, but the most common reason when using krb5i/p is a GSS sequence number window underrun. When an underrun is detected, the server is obliged to drop the RPC and the connection to force a retransmit with a fresh GSS sequence number. The client presents the same XID, it hits in the server's DRC, and the server returns the garbage cache entry. The "statp + 1" argument has been used since the oldest changeset in the kernel history repo, so it has been in nfsd_dispatch() literally since before history began. The problem arose only when the server-side GSS implementation was added twenty years ago. Reviewed-by: Jeff Layton Tested-by: Jeff Layton fs/nfsd/nfssvc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 49cecd8628a9855cd993792a0377559ea32d5e7c Author: Chuck Lever Date: Fri Nov 10 11:28:39 2023 -0500 NFSD: Update nfsd_cache_append() to use xdr_stream When inserting a DRC-cached response into the reply buffer, ensure that the reply buffer's xdr_stream is updated properly. Otherwise the server will send a garbage response. Cc: stable@vger.kernel.org # v6.3+ Reviewed-by: Jeff Layton Tested-by: Jeff Layton Signed-off-by: Chuck Lever fs/nfsd/nfscache.c | 23 ++++++++--------------- 1 file changed, 8 insertions(+), 15 deletions(-) commit bc1b5acb40201a0746d68a7d7cfc141899937f4f Author: Mahmoud Adam Date: Fri Nov 10 19:21:04 2023 +0100 nfsd: fix file memleak on client_opens_release seq_release should be called to free the allocated seq_file Cc: stable@vger.kernel.org # v5.3+ Signed-off-by: Mahmoud Adam Reviewed-by: Jeff Layton Fixes: 78599c42ae3c ("nfsd4: add file to display list of client's opens") Reviewed-by: NeilBrown Tested-by: Jeff Layton Signed-off-by: Chuck Lever fs/nfsd/nfs4state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 13648e04a9b831b3dfa5cf3887dfa6cf8fe5fe69 Author: Mikulas Patocka Date: Fri Nov 17 18:38:33 2023 +0100 dm-crypt: start allocating with MAX_ORDER Commit 23baf831a32c ("mm, treewide: redefine MAX_ORDER sanely") changed the meaning of MAX_ORDER from exclusive to inclusive. So, we can allocate compound pages with up to 1 << MAX_ORDER pages. Reflect this change in dm-crypt and start trying to allocate compound pages with MAX_ORDER. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-crypt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 28f07f2ab4b3a2714f1fefcc58ada4bcc195f806 Author: Mikulas Patocka Date: Fri Nov 17 18:37:25 2023 +0100 dm-verity: don't use blocking calls from tasklets The commit 5721d4e5a9cd enhanced dm-verity, so that it can verify blocks from tasklets rather than from workqueues. This reportedly improves performance significantly. However, dm-verity was using the flag CRYPTO_TFM_REQ_MAY_SLEEP from tasklets which resulted in warnings about sleeping function being called from non-sleeping context. BUG: sleeping function called from invalid context at crypto/internal.h:206 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0 preempt_count: 100, expected: 0 RCU nest depth: 0, expected: 0 CPU: 0 PID: 14 Comm: ksoftirqd/0 Tainted: G W 6.7.0-rc1 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Call Trace: dump_stack_lvl+0x32/0x50 __might_resched+0x110/0x160 crypto_hash_walk_done+0x54/0xb0 shash_ahash_update+0x51/0x60 verity_hash_update.isra.0+0x4a/0x130 [dm_verity] verity_verify_io+0x165/0x550 [dm_verity] ? free_unref_page+0xdf/0x170 ? psi_group_change+0x113/0x390 verity_tasklet+0xd/0x70 [dm_verity] tasklet_action_common.isra.0+0xb3/0xc0 __do_softirq+0xaf/0x1ec ? smpboot_thread_fn+0x1d/0x200 ? sort_range+0x20/0x20 run_ksoftirqd+0x15/0x30 smpboot_thread_fn+0xed/0x200 kthread+0xdc/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x28/0x40 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork_asm+0x11/0x20 This commit fixes dm-verity so that it doesn't use the flags CRYPTO_TFM_REQ_MAY_SLEEP and CRYPTO_TFM_REQ_MAY_BACKLOG from tasklets. The crypto API would do GFP_ATOMIC allocation instead, it could return -ENOMEM and we catch -ENOMEM in verity_tasklet and requeue the request to the workqueue. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org # v6.0+ Fixes: 5721d4e5a9cd ("dm verity: Add optional "try_verify_in_tasklet" feature") Signed-off-by: Mike Snitzer drivers/md/dm-verity-fec.c | 4 ++-- drivers/md/dm-verity-target.c | 23 ++++++++++++----------- drivers/md/dm-verity.h | 2 +- 3 files changed, 15 insertions(+), 14 deletions(-) commit 2a695062a5a42aead8c539a344168d4806b3fda2 Author: Mikulas Patocka Date: Fri Nov 17 18:36:34 2023 +0100 dm-bufio: fix no-sleep mode dm-bufio has a no-sleep mode. When activated (with the DM_BUFIO_CLIENT_NO_SLEEP flag), the bufio client is read-only and we could call dm_bufio_get from tasklets. This is used by dm-verity. Unfortunately, commit 450e8dee51aa ("dm bufio: improve concurrent IO performance") broke this and the kernel would warn that cache_get() was calling down_read() from no-sleeping context. The bug can be reproduced by using "veritysetup open" with the "--use-tasklets" flag. This commit fixes dm-bufio, so that the tasklet mode works again, by expanding use of the 'no_sleep_enabled' static_key to conditionally use either a rw_semaphore or rwlock_t (which are colocated in the buffer_tree structure using a union). Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org # v6.4 Fixes: 450e8dee51aa ("dm bufio: improve concurrent IO performance") Signed-off-by: Mike Snitzer drivers/md/dm-bufio.c | 87 ++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 62 insertions(+), 25 deletions(-) commit ccadc8a21ef13eb80006ecff6a7466810e4f0dd6 Author: Mikulas Patocka Date: Fri Nov 17 18:24:04 2023 +0100 dm-delay: avoid duplicate logic This is small refactoring of dm-delay - we avoid duplicate logic in flush_delayed_bios and flush_delayed_bios_fast and join these two functions into one. We also add cond_resched() to flush_delayed_bios because the list may have unbounded number of entries. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-delay.c | 65 +++++++++++++++++---------------------------------- 1 file changed, 21 insertions(+), 44 deletions(-) commit 38cfff568169ff9f99784948f79f62ca1af5a187 Author: Mikulas Patocka Date: Fri Nov 17 18:22:47 2023 +0100 dm-delay: fix bugs introduced by kthread mode This commit fixes the following bugs introduced by commit 70bbeb29fab0 ("dm delay: for short delays, use kthread instead of timers and wq"): * the function flush_worker_fn has no exit path - on unload, this function will just loop and consume 100% CPU without any progress * the wake-up mechanism in flush_worker_fn is racy - a wake up will be missed if the process adds entries to the delayed_bios list just before set_current_state(TASK_INTERRUPTIBLE) * flush_delayed_bios_fast submits a bio while holding a global mutex; this may deadlock if we have multiple stacked dm-delay devices and the underlying device attempts to acquire the mutex too * if the target constructor fails, it will call delay_dtr. delay_dtr would attempt to free dc->timer_lock without it being initialized by the constructor. * if the target constructor's kthread allocation fails, delay_dtr would crash trying to dereference dc->worker because it is non-NULL due to ERR_PTR. Fixes: 70bbeb29fab0 ("dm delay: for short delays, use kthread instead of timers and wq") Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-delay.c | 61 +++++++++++++++++++++++++++++---------------------- 1 file changed, 35 insertions(+), 26 deletions(-) commit 6fc45b6ed921dc00dfb264dc08c7d67ee63d2656 Author: Mikulas Patocka Date: Fri Nov 17 18:21:14 2023 +0100 dm-delay: fix a race between delay_presuspend and delay_bio In delay_presuspend, we set the atomic variable may_delay and then stop the timer and flush pending bios. The intention here is to prevent the delay target from re-arming the timer again. However, this test is racy. Suppose that one thread goes to delay_bio, sees that dc->may_delay is one and proceeds; now, another thread executes delay_presuspend, it sets dc->may_delay to zero, deletes the timer and flushes pending bios. Then, the first thread continues and adds the bio to delayed->list despite the fact that dc->may_delay is false. Fix this bug by changing may_delay's type from atomic_t to bool and only access it while holding the delayed_bios_lock mutex. Note that we don't have to grab the mutex in delay_resume because there are no bios in flight at this point. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Signed-off-by: Mike Snitzer drivers/md/dm-delay.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) commit e63a57303599b17290cd8bc48e6f20b24289a8bc Author: Ming Lei Date: Fri Nov 17 10:35:24 2023 +0800 blk-cgroup: bypass blkcg_deactivate_policy after destroying blkcg_deactivate_policy() can be called after blkg_destroy_all() returns, and it isn't necessary since blkg_destroy_all has covered policy deactivation. Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20231117023527.3188627-4-ming.lei@redhat.com Signed-off-by: Jens Axboe block/blk-cgroup.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 35a99d6557cacbc177314735342f77a2dda41872 Author: Ming Lei Date: Fri Nov 17 10:35:23 2023 +0800 blk-cgroup: avoid to warn !rcu_read_lock_held() in blkg_lookup() So far, all callers either holds spin lock or rcu read explicitly, and most of the caller has added WARN_ON_ONCE(!rcu_read_lock_held()) or lockdep_assert_held(&disk->queue->queue_lock). Remove WARN_ON_ONCE(!rcu_read_lock_held()) from blkg_lookup() for killing the false positive warning from blkg_conf_prep(). Reported-by: Changhui Zhong Fixes: 83462a6c971c ("blkcg: Drop unnecessary RCU read [un]locks from blkg_conf_prep/finish()") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20231117023527.3188627-3-ming.lei@redhat.com Signed-off-by: Jens Axboe block/blk-cgroup.h | 2 -- 1 file changed, 2 deletions(-) commit 27b13e209ddca5979847a1b57890e0372c1edcee Author: Ming Lei Date: Fri Nov 17 10:35:22 2023 +0800 blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" Inside blkg_for_each_descendant_pre(), both css_for_each_descendant_pre() and blkg_lookup() requires RCU read lock, and either cgroup_assert_mutex_or_rcu_locked() or rcu_read_lock_held() is called. Fix the warning by adding rcu read lock. Reported-by: Changhui Zhong Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20231117023527.3188627-2-ming.lei@redhat.com Signed-off-by: Jens Axboe block/blk-throttle.c | 2 ++ 1 file changed, 2 insertions(+) commit aa7e8e5e4011571022dc06e4d7a2f108feb53d1a Author: Maciej Strozek Date: Fri Nov 17 14:13:39 2023 +0000 ASoC: cs43130: Fix incorrect frame delay configuration Signed-off-by: Maciej Strozek Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20231117141344.64320-3-mstrozek@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs43130.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e7f289a59e76a5890a57bc27b198f69f175f75d9 Author: Maciej Strozek Date: Fri Nov 17 14:13:38 2023 +0000 ASoC: cs43130: Fix the position of const qualifier Signed-off-by: Maciej Strozek Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20231117141344.64320-2-mstrozek@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs43130.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6bc40e44f1ddef16a787f3501b97f1fff909177c Merge: eb9a643c1739 37f32f526438 Author: Linus Torvalds Date: Fri Nov 17 09:18:48 2023 -0500 Merge tag 'ovl-fixes-6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs Pull overlayfs fixes from Amir Goldstein: "A fix to an overlayfs param parsing bug and a misformatted comment" * tag 'ovl-fixes-6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs: ovl: fix memory leak in ovl_parse_param() ovl: fix misformatted comment commit eb9a643c1739b732b90714131962bee76d279600 Merge: bf786e2a78d4 5d639b60971f Author: Linus Torvalds Date: Fri Nov 17 09:05:31 2023 -0500 Merge tag 'sound-6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes: including a regression fix in RC1 wrt HD-audio / i915 component binding, while the rest are HD-audio device-speific fixes / quirks" * tag 'sound-6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: Add quirks for HP Laptops ALSA: hda/realtek: Add quirks for ASUS 2024 Zenbooks ALSA: hda: i915: Alays handle -EPROBE_DEFER ALSA: hda/realtek: Enable Mute LED on HP 255 G10 ALSA: hda: cs35l56: Enable low-power hibernation mode on i2c ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC ALSA: hda/realtek: Enable Mute LED on HP 255 G8 ALSA: hda/realtek - Add Dell ALC295 to pin fall back table commit bf786e2a78d4d3cfc87469c3b31ade257df14fa0 Merge: 7475e51b8796 969d90ec212b Author: Linus Torvalds Date: Fri Nov 17 08:42:05 2023 -0500 Merge tag 'audit-pr-20231116' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit fix from Paul Moore: "One small audit patch to convert a WARN_ON_ONCE() into a normal conditional to avoid scary looking console warnings when eBPF code generates audit records from unexpected places" * tag 'audit-pr-20231116' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare() commit f8ba14b780273fd290ddf7ee0d7d7decb44cc365 Author: Kamil Duljas Date: Thu Nov 16 23:41:13 2023 +0100 ASoC: Intel: Skylake: mem leak in skl register function skl_platform_register() uses krealloc. When krealloc is fail, then previous memory is not freed. The leak is also when soc component registration failed. Signed-off-by: Kamil Duljas Reviewed-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20231116224112.2209-2-kamil.duljas@gmail.com Signed-off-by: Mark Brown sound/soc/intel/skylake/skl-pcm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 31e721fbd194d5723722eaa21df1d14cee7e12b5 Author: Kamil Duljas Date: Thu Nov 16 22:39:17 2023 +0100 ASoC: SOF: topology: Fix mem leak in sof_dai_load() The function has multiple return points at which it is not released previously allocated memory. Signed-off-by: Kamil Duljas Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20231116213926.2034-2-kamil.duljas@gmail.com Signed-off-by: Mark Brown sound/soc/sof/topology.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit c1501f2597dd08601acd42256a4b0a0fc36bf302 Author: David Lin Date: Fri Nov 17 12:30:12 2023 +0800 ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16 This issue is reproduced when W=1 build in compiler gcc-12. The following are sparse warnings: sound/soc/codecs/nau8822.c:199:25: sparse: sparse: incorrect type in assignment sound/soc/codecs/nau8822.c:199:25: sparse: expected unsigned short sound/soc/codecs/nau8822.c:199:25: sparse: got restricted __be16 sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311122320.T1opZVkP-lkp@intel.com/ Signed-off-by: David Lin Link: https://lore.kernel.org/r/20231117043011.1747594-1-CTLIN0@nuvoton.com Signed-off-by: Mark Brown sound/soc/codecs/nau8822.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit d5c65be34df73fa01ed05611aafb73b440d89e29 Author: Kamil Duljas Date: Thu Nov 16 13:51:50 2023 +0100 ASoC: Intel: Skylake: Fix mem leak in few functions The resources should be freed when function return error. Signed-off-by: Kamil Duljas Reviewed-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20231116125150.1436-1-kamil.duljas@gmail.com Signed-off-by: Mark Brown sound/soc/intel/skylake/skl-pcm.c | 4 +++- sound/soc/intel/skylake/skl-sst-ipc.c | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) commit 62b241efff99fc4d88a86f1c67c7516e31f432a3 Author: Gao Xiang Date: Fri Nov 17 16:53:29 2023 +0800 MAINTAINERS: erofs: add EROFS webpage Add a new `W:` field of the EROFS entry points to the documentation site at . In addition, update the in-tree documentation and Kconfig too. Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20231117085329.1624223-1-hsiangkao@linux.alibaba.com Documentation/filesystems/erofs.rst | 4 ++++ MAINTAINERS | 1 + fs/erofs/Kconfig | 2 +- 3 files changed, 6 insertions(+), 1 deletion(-) commit 8bd90b6ae7856dd5000b75691d905b39b9ea5d6b Author: Jingbo Xu Date: Tue Nov 14 15:07:04 2023 +0800 erofs: fix NULL dereference of dif->bdev_handle in fscache mode Avoid NULL dereference of dif->bdev_handle, as dif->bdev_handle is NULL in fscache mode. BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:erofs_map_dev+0xbd/0x1c0 Call Trace: erofs_fscache_data_read_slice+0xa7/0x340 erofs_fscache_data_read+0x11/0x30 erofs_fscache_readahead+0xd9/0x100 read_pages+0x47/0x1f0 page_cache_ra_order+0x1e5/0x270 filemap_get_pages+0xf2/0x5f0 filemap_read+0xb8/0x2e0 vfs_read+0x18d/0x2b0 ksys_read+0x53/0xd0 do_syscall_64+0x42/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Reported-by: Yiqun Leng Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=7245 Fixes: 49845720080d ("erofs: Convert to use bdev_open_by_path()") Signed-off-by: Jingbo Xu Reviewed-by: Gao Xiang Reviewed-by: Yue Hu Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20231114070704.23398-1-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang fs/erofs/data.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 914fa861e3d7803c9bbafc229652c2a69edb8b60 Author: Ferry Meng Date: Thu Nov 9 19:18:22 2023 +0800 erofs: simplify erofs_read_inode() After commit 1c7f49a76773 ("erofs: tidy up EROFS on-disk naming"), there is a unique `union erofs_inode_i_u` so that we could parse the union directly. Besides, it also replaces `inode->i_sb` with `sb` for simplicity. Signed-off-by: Ferry Meng Reviewed-by: Gao Xiang Reviewed-by: Yue Hu Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20231109111822.17944-1-mengferry@linux.alibaba.com Signed-off-by: Gao Xiang fs/erofs/inode.c | 98 ++++++++++++++++++++------------------------------------ 1 file changed, 35 insertions(+), 63 deletions(-) commit 480713b1ba8eac4617936f8404da34bda991c30e Author: Mika Westerberg Date: Mon Nov 13 12:49:13 2023 +0200 thunderbolt: Only add device router DP IN to the head of the DP resource list When pairing DP IN and DP OUT adapters for DisplayPort tunneling, we should prioritize the possible external GPU DP IN adapters to take advantage of the its capabilities. However the commit in question did this for host router DP IN adapters too and that changes ordering of the initial DP IN resources in such way that resuming from suspend may end up using different resource and that may confuse the user. Fix this so that we only put DP IN adapters of device routers to the top of the resource list and leave host routers as is. Fixes: 274baf695b08 ("thunderbolt: Add DP IN added last in the head of the list of DP resources") Reported-by: Pengfei Xu Signed-off-by: Mika Westerberg drivers/thunderbolt/tb.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) commit 5391bcfa56c79a891734e4d22aa0ca3217b86491 Author: Mika Westerberg Date: Tue Nov 7 14:34:27 2023 +0200 thunderbolt: Send uevent after asymmetric/symmetric switch We should send uevent to userspace whenever the link speed or width changes but tb_switch_asym_enable() and tb_switch_asym_disable() set the sw->link_width already so tb_switch_update_link_attributes() never noticed the change. Fix this so that we let tb_switch_update_link_attributes() update the fields accordingly. Fixes: 81af2952e606 ("thunderbolt: Add support for asymmetric link") Reported-by: Pengfei Xu Tested-by: Pengfei Xu Signed-off-by: Mika Westerberg drivers/thunderbolt/switch.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 24d85bb3be373b5831699bddf698b392bd2b904d Author: Gil Fine Date: Tue Nov 7 12:22:40 2023 +0200 thunderbolt: Set lane bonding bit only for downstream port Fix the lane bonding procedure to follow the steps described in USB4 Connection Manager guide. Hence, set the lane bonding bit only for downstream port. This is needed for certain ASMedia device, otherwise lane bonding fails and the device disconnects. Cc: stable@vger.kernel.org Signed-off-by: Gil Fine Signed-off-by: Mika Westerberg drivers/thunderbolt/switch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 86d8f905f24d223e15587365f07849635458c5d9 Merge: 63957f6beba0 e8c2d3e25b84 Author: Daniel Vetter Date: Fri Nov 17 11:46:06 2023 +0100 Merge tag 'amd-drm-fixes-6.7-2023-11-17' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.7-2023-11-17: amdgpu: - DMCUB fixes - SR-IOV fix - GMC9 fix - Documentation fix - DSC MST fix - CS chunk parsing fix - SMU13.0.6 fixes - 8K tiled display fix - Fix potential NULL pointer dereferences - Cursor lag fix - Backlight fix - DCN s0ix fix - XGMI fix - DCN encoder disable logic fix - AGP aperture fixes Signed-off-by: Daniel Vetter From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20231117063441.4883-1-alexander.deucher@amd.com commit 63957f6beba0771a1cf0545a491479d20fdc492b Merge: b85ea95d0864 ae1aadb1eb8d Author: Daniel Vetter Date: Fri Nov 17 11:04:52 2023 +0100 Merge tag 'drm-misc-fixes-2023-11-16' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Assorted fixes for v6.7-rc2: - Nouveau GSP fixes. - Fix nouveau driver load without display. - Use rwlock for nouveau's event lock to break a lockdep splat. - Add orientation quirk for Lenovo Legion Go. - Fix build failure in IVPU. Signed-off-by: Daniel Vetter From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/98fc82d3-8714-45e7-bd12-c95ba8c6c35f@linux.intel.com commit c6ea14d557343cd3af6c6be2f5a78c98bdb281bb Author: Shyam Sundar S K Date: Thu Nov 16 22:31:21 2023 +0530 platform/x86/amd/pmc: adjust getting DRAM size behavior amd_pmc_get_dram_size() is used to get the DRAM size information. But in the current code, mailbox command to get the DRAM size info is sent based on the values of dev->major and dev->minor. But dev->major and dev->minor will have either junk or zero assigned to them until at least once a call to amd_pmc_get_smu_version() is made which ideally populates dev->major and dev->minor. However, adding a amd_pmc_get_smu_version() call to amd_pmc_get_dram_size() has a downside of elevating the boot times. After talking to the PMFW team, it's understood that the "get dram size" mbox command would only be supported on specific platforms (like Mendocino) and not all. So, adjust getting DRAM size behavior such that, - if running on Rembrandt or Mendocino and the underlying PMFW knows how to execute the "get dram size" command it shall give the custom dram size. - if the underlying FW does not report the dram size, we just proceed further and assign the default dram size. The simplest way to address this is to remove amd_pmc_get_dram_size() function and directly call the "get dram size" command in the amd_pmc_s2d_init(). Reported-by: Mark Hasemeyer Fixes: be8325fb3d8c ("platform/x86/amd: pmc: Get STB DRAM size from PMFW") Cc: stable@vger.kernel.org Suggested-by: Sanket Goswami Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20231116170121.3372222-1-Shyam-sundar.S-k@amd.com Reviewed-by: Mario Limonciello Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/amd/pmc/pmc.c | 31 ++----------------------------- 1 file changed, 2 insertions(+), 29 deletions(-) commit 295b202227e98edb2fb5cc29b6ec4b96b2792d9c Author: Gustavo A. R. Silva Date: Thu Nov 16 12:54:59 2023 -0600 xen: privcmd: Replace zero-length array with flex-array member and use __counted_by Fake flexible arrays (zero-length and one-element arrays) are deprecated, and should be replaced by flexible-array members. So, replace zero-length array with a flexible-array member in `struct privcmd_kernel_ioreq`. Also annotate array `ports` with `__counted_by()` to prepare for the coming implementation by GCC and Clang of the `__counted_by` attribute. Flexible array members annotated with `__counted_by` can have their accesses bounds-checked at run-time via `CONFIG_UBSAN_BOUNDS` (for array indexing) and `CONFIG_FORTIFY_SOURCE` (for strcpy/memcpy-family functions). This fixes multiple -Warray-bounds warnings: drivers/xen/privcmd.c:1239:30: warning: array subscript i is outside array bounds of 'struct ioreq_port[0]' [-Warray-bounds=] drivers/xen/privcmd.c:1240:30: warning: array subscript i is outside array bounds of 'struct ioreq_port[0]' [-Warray-bounds=] drivers/xen/privcmd.c:1241:30: warning: array subscript i is outside array bounds of 'struct ioreq_port[0]' [-Warray-bounds=] drivers/xen/privcmd.c:1245:33: warning: array subscript i is outside array bounds of 'struct ioreq_port[0]' [-Warray-bounds=] drivers/xen/privcmd.c:1258:67: warning: array subscript i is outside array bounds of 'struct ioreq_port[0]' [-Warray-bounds=] This results in no differences in binary output. Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/ZVZlg3tPMPCRdteh@work Signed-off-by: Juergen Gross drivers/xen/privcmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2a842c4e2f76736f4ed2da9f02ca3ae3330d6b11 Author: Sascha Hauer Date: Wed Oct 18 08:17:11 2023 +0200 dt-bindings: soc: rockchip: grf: add rockchip,rk3588-pmugrf Add rockchip,rk3588-pmugrf compatible string. Acked-by: Conor Dooley Signed-off-by: Sascha Hauer Link: https://lore.kernel.org/r/20231018061714.3553817-24-s.hauer@pengutronix.de Signed-off-by: Heiko Stuebner Documentation/devicetree/bindings/soc/rockchip/grf.yaml | 1 + 1 file changed, 1 insertion(+) commit bff2a2d453a1b683378b4508b86b84389f551a00 Author: Keith Busch Date: Mon Nov 6 18:12:30 2023 +0100 swiotlb-xen: provide the "max_mapping_size" method There's a bug that when using the XEN hypervisor with bios with large multi-page bio vectors on NVMe, the kernel deadlocks [1]. The deadlocks are caused by inability to map a large bio vector - dma_map_sgtable always returns an error, this gets propagated to the block layer as BLK_STS_RESOURCE and the block layer retries the request indefinitely. XEN uses the swiotlb framework to map discontiguous pages into contiguous runs that are submitted to the PCIe device. The swiotlb framework has a limitation on the length of a mapping - this needs to be announced with the max_mapping_size method to make sure that the hardware drivers do not create larger mappings. Without max_mapping_size, the NVMe block driver would create large mappings that overrun the maximum mapping size. Reported-by: Marek Marczykowski-Górecki Link: https://lore.kernel.org/stable/ZTNH0qtmint%2FzLJZ@mail-itl/ [1] Tested-by: Marek Marczykowski-Górecki Suggested-by: Christoph Hellwig Cc: stable@vger.kernel.org Signed-off-by: Keith Busch Signed-off-by: Mikulas Patocka Acked-by: Stefano Stabellini Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/151bef41-e817-aea9-675-a35fdac4ed@redhat.com Signed-off-by: Juergen Gross drivers/xen/swiotlb-xen.c | 1 + 1 file changed, 1 insertion(+) commit 2a4ca1b4b77850544408595e2433f5d7811a9daa Author: David Howells Date: Thu Jun 8 09:43:54 2023 +0100 afs: Make error on cell lookup failure consistent with OpenAFS When kafs tries to look up a cell in the DNS or the local config, it will translate a lookup failure into EDESTADDRREQ whereas OpenAFS translates it into ENOENT. Applications such as West expect the latter behaviour and fail if they see the former. This can be seen by trying to mount an unknown cell: # mount -t afs %example.com:cell.root /mnt mount: /mnt: mount(2) system call failed: Destination address required. Fixes: 4d673da14533 ("afs: Support the AFS dynamic root") Reported-by: Markus Suvanto Link: https://bugzilla.kernel.org/show_bug.cgi?id=216637 Signed-off-by: David Howells Reviewed-by: Jeffrey Altman cc: Marc Dionne cc: linux-afs@lists.infradead.org fs/afs/dynroot.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e6bace7313d61e31f2b16fa3d774fd8cb3cb869e Author: David Howells Date: Thu Nov 2 16:26:59 2023 +0000 afs: Fix afs_server_list to be cleaned up with RCU afs_server_list is accessed with the rcu_read_lock() held from volume->servers, so it needs to be cleaned up correctly. Fix this by using kfree_rcu() instead of kfree(). Fixes: 8a070a964877 ("afs: Detect cell aliases 1 - Cells with root volumes") Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org fs/afs/internal.h | 1 + fs/afs/server_list.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) commit e8c2d3e25b844ad8f7c8b269a7cfd65285329264 Author: Alex Deucher Date: Thu Nov 9 15:40:00 2023 -0500 drm/amdgpu/gmc9: disable AGP aperture We've had misc reports of random IOMMU page faults when this is used. It's just a rarely used optimization anyway, so let's just disable it. It can still be toggled via the module parameter for testing. v2: leave it configurable via module parameter Reviewed-by: Yang Wang (v1) Acked-by: Christian König Reviewed-by: Mario Limonciello Tested-by: Mario Limonciello # PHX & Navi33 Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 61fc93695bbfde218d5f9f0b8051ce36eb649669 Author: Alex Deucher Date: Thu Nov 9 15:38:54 2023 -0500 drm/amdgpu/gmc10: disable AGP aperture We've had misc reports of random IOMMU page faults when this is used. It's just a rarely used optimization anyway, so let's just disable it. It can still be toggled via the module parameter for testing. v2: leave it configurable via module parameter Reviewed-by: Yang Wang (v1) Acked-by: Christian König Reviewed-by: Mario Limonciello Tested-by: Mario Limonciello # PHX & Navi33 Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0db062eac3e0846c6f120867a79df83b4c3db46f Author: Alex Deucher Date: Thu Nov 9 15:34:19 2023 -0500 drm/amdgpu/gmc11: disable AGP aperture We've had misc reports of random IOMMU page faults when this is used. It's just a rarely used optimization anyway, so let's just disable it. It can still be toggled via the module parameter for testing. v2: leave it configurable via module parameter Fixes: 67318cb84341 ("drm/amdgpu/gmc11: set gart placement GC11") Reviewed-by: Yang Wang (v1) Acked-by: Christian König Reviewed-by: Mario Limonciello Tested-by: Mario Limonciello # PHX & Navi33 Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6ba5b613837c5d997ad8297b22fc46cd0be58d76 Author: Alex Deucher Date: Thu Nov 9 15:31:00 2023 -0500 drm/amdgpu: add a module parameter to control the AGP aperture Add a module parameter to control the AGP aperture. The AGP aperture is an aperture in the GPU's internal address space which provides direct non-paged access to the platform address space. This access is non-snooped so only uncached memory can be accessed. Add a knob so that we can toggle this for debugging. Fixes: 67318cb84341 ("drm/amdgpu/gmc11: set gart placement GC11") Acked-by: Christian König Reviewed-by: Mario Limonciello Tested-by: Mario Limonciello # PHX & Navi33 Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 10 ++++++++++ drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 3 ++- drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 2 +- 5 files changed, 15 insertions(+), 3 deletions(-) commit 564ca1b53ece166b5915c2ac90f3e9313100f4ea Author: Alex Deucher Date: Tue Nov 14 11:36:56 2023 -0500 drm/amdgpu/gmc11: fix logic typo in AGP check Should be && rather than ||. Fixes: b2e1cbe6281f ("drm/amdgpu/gmc11: disable AGP on GC 11.5") Acked-by: Christian König Reviewed-by: Mario Limonciello Tested-by: Mario Limonciello # PHX & Navi33 Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0ee057e66c4b782809a0a9265cdac5542e646706 Author: Nicholas Susanto Date: Wed Nov 1 15:30:10 2023 -0400 drm/amd/display: Fix encoder disable logic [WHY] DENTIST hangs when OTG is off and encoder is on. We were not disabling the encoder properly when switching from extended mode to external monitor only. [HOW] Disable the encoder using an existing enable/disable fifo helper instead of enc35_stream_encoder_enable. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Nicholas Kazlauskas Acked-by: Alex Hung Signed-off-by: Nicholas Susanto Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher .../gpu/drm/amd/display/dc/dcn35/dcn35_dio_stream_encoder.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit 5911d02cac70d7fb52009fbd37423e63f8f6f9bc Author: Lewis Huang Date: Thu Oct 19 17:22:21 2023 +0800 drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox [WHY] Flush command sent to DMCUB spends more time for execution on a dGPU than on an APU. This causes cursor lag when using high refresh rate mouses. [HOW] 1. Change the DMCUB mailbox memory location from FB to inbox. 2. Only change windows memory to inbox. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Nicholas Kazlauskas Acked-by: Alex Hung Signed-off-by: Lewis Huang Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 13 ++++----- drivers/gpu/drm/amd/display/dmub/dmub_srv.h | 22 ++++++++++------ drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c | 32 +++++++++++++++++------ 3 files changed, 45 insertions(+), 22 deletions(-) commit 9ddea8c9775d9379d71e6ac1519c552461b90b07 Author: Shiwu Zhang Date: Tue Oct 31 11:02:49 2023 +0800 drm/amdgpu: add and populate the port num into xgmi topology info The port num info is firstly introduced with 20.00.01.13 xgmi ta and make them as part of topology info. Signed-off-by: Shiwu Zhang Reviewed-by: Le Ma Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 +++++ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h | 1 + 2 files changed, 6 insertions(+) commit 5e8a0d3598b47ee5a57708072bdef08816264538 Author: Duncan Ma Date: Wed Oct 25 19:07:21 2023 -0400 drm/amd/display: Negate IPS allow and commit bits [WHY] On s0i3, IPS mask isn't saved and restored. It is reset to zero on exit. If it is cleared unexpectedly, driver will proceed operations while DCN is in IPS2 and cause a hang. [HOW] Negate the bit logic. Default value of zero indicates it is still in IPS2. Driver must poll for the bit to assert. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Charlene Liu Acked-by: Alex Hung Signed-off-by: Duncan Ma Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher .../drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 18 +++++++++--------- drivers/gpu/drm/amd/display/dc/core/dc.c | 4 ++-- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 +++++----- 3 files changed, 16 insertions(+), 16 deletions(-) commit 0f216364625cb453b4f933deacfa92df7f2a2fc9 Author: Lijo Lazar Date: Fri Nov 10 13:15:39 2023 +0530 drm/amd/pm: Don't send unload message for reset No need to notify about unload during reset. Also remove the FW version check. Signed-off-by: Lijo Lazar Reviewed-by: Yang Wang Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 07ee43faeb7eb088e49a7549fcabcae94c443d3b Author: Yang Wang Date: Mon Nov 13 14:34:55 2023 +0800 drm/amdgpu: fix ras err_data null pointer issue in amdgpu_ras.c fix ras err_data null pointer issue in amdgpu_ras.c Fixes: 8cc0f5669eb6 ("drm/amdgpu: Support multiple error query modes") Signed-off-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 923bbfe6c888812db1088d684bd30c24036226d2 Author: Paul Hsieh Date: Wed Oct 25 10:53:35 2023 +0800 drm/amd/display: Clear dpcd_sink_ext_caps if not set [WHY] Some eDP panels' ext caps don't set initial values and the value of dpcd_addr (0x317) is random. It means that sometimes the eDP can be OLED, miniLED and etc, and cause incorrect backlight control interface. [HOW] Add remove_sink_ext_caps to remove sink ext caps (HDR, OLED and etc) Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Anthony Koo Acked-by: Alex Hung Signed-off-by: Paul Hsieh Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dc_types.h | 1 + drivers/gpu/drm/amd/display/dc/link/link_detection.c | 3 +++ 2 files changed, 4 insertions(+) commit 435f5b369657cffee4b04db1f5805b48599f4dbe Author: Tianci Yin Date: Wed Nov 1 09:47:13 2023 +0800 drm/amd/display: Enable fast plane updates on DCN3.2 and above [WHY] When cursor moves across screen boarder, lag cursor observed, since subvp settings need to sync up with vblank that causes cursor updates being delayed. [HOW] Enable fast plane updates on DCN3.2 to fix it. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Aurabindo Pillai Acked-by: Alex Hung Signed-off-by: Tianci Yin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 270b301beca58e427a0fda7523a71a9562e644bb Author: José Pekkarinen Date: Tue Nov 14 17:27:51 2023 +0200 drm/amd/display: fix NULL dereference The following patch will fix a minor issue where a debug message is referencing an struct that has just being checked whether is null or not. This has been noticed by using coccinelle, in the following output: drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c:540:25-29: ERROR: aconnector is NULL but dereferenced. Fixes: 5d72e247e58c ("drm/amd/display: switch DC over to the new DRM logging macros") Signed-off-by: José Pekkarinen Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit b71f4ade1b8900d30c661d6c27f87c35214c398c Author: Mario Limonciello Date: Wed Nov 8 13:31:57 2023 -0600 drm/amd/display: fix a NULL pointer dereference in amdgpu_dm_i2c_xfer() When ddc_service_construct() is called, it explicitly checks both the link type and whether there is something on the link which will dictate whether the pin is marked as hw_supported. If the pin isn't set or the link is not set (such as from unloading/reloading amdgpu in an IGT test) then fail the amdgpu_dm_i2c_xfer() call. Cc: stable@vger.kernel.org Fixes: 22676bc500c2 ("drm/amd/display: Fix dmub soft hang for PSR 1") Link: https://github.com/fwupd/fwupd/issues/6327 Signed-off-by: Mario Limonciello Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +++ 1 file changed, 3 insertions(+) commit 9725a4f9eb495bfa6c7f5ccdb49440ff06dba0a1 Author: Muhammad Ahmed Date: Tue Oct 31 16:03:21 2023 -0400 drm/amd/display: Add null checks for 8K60 lightup [WHY & HOW] Add some null checks to fix an issue where 8k60 tiled display fails to light up. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Charlene Liu Acked-by: Alex Hung Signed-off-by: Muhammad Ahmed Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) commit e4d0be18243ca006258b5c7c148796c0b43505c4 Author: Asad Kamal Date: Tue Nov 14 16:17:17 2023 +0800 drm/amd/pm: Fill pcie error counters for gpu v1_4 Fill PCIE error counters & instantaneous bandwidth in gpu metrics v1_4 for smu v_13_0_6 Signed-off-by: Asad Kamal Reviewed-by: Le Ma Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 786c355797b3942725829d02ce9e2e6a9eba11fe Author: Asad Kamal Date: Tue Oct 31 03:14:02 2023 +0800 drm/amd/pm: Update metric table for smu v13_0_6 Update pmfw metric table to include pcie instantaneous bandwidth & pcie error counters Signed-off-by: Asad Kamal Reviewed-by: Le Ma Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/swsmu/inc/pmfw_if/smu_v13_0_6_pmfw.h | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit 50d51374b498457c4dea26779d32ccfed12ddaff Author: YuanShang Date: Tue Oct 31 10:32:37 2023 +0800 drm/amdgpu: correct chunk_ptr to a pointer to chunk. The variable "chunk_ptr" should be a pointer pointing to a struct drm_amdgpu_cs_chunk instead of to a pointer of that. Signed-off-by: YuanShang Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a58555359a9f870543aaddef277c3396159895ce Author: Fangzhi Zuo Date: Mon Oct 23 13:57:32 2023 -0400 drm/amd/display: Fix DSC not Enabled on Direct MST Sink [WHY & HOW] For the scenario when a dsc capable MST sink device is directly connected, it needs to use max dsc compression as the link bw constraint. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Roman Li Acked-by: Alex Hung Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 29 +++++++++++----------- 1 file changed, 14 insertions(+), 15 deletions(-) commit 8a0173cd90984835645022bf1997abd1bcd81aae Author: Srinivasan Shanmugam Date: Sun Nov 12 09:51:19 2023 +0530 drm/amdgpu: Address member 'ring' not described in 'amdgpu_ vce, uvd_entity_init()' Fixes the following: drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c:237: warning: Function parameter or member 'ring' not described in 'amdgpu_vce_entity_init' drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c:405: warning: Function parameter or member 'ring' not described in 'amdgpu_uvd_entity_init' Cc: Christian König Cc: Alex Deucher Cc: "Pan, Xinhui" Signed-off-by: Srinivasan Shanmugam Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 1 + 2 files changed, 2 insertions(+) commit bdb72185d310fc8049c7ea95221d640e9e7165e5 Author: Le Ma Date: Mon Nov 13 18:05:34 2023 +0800 drm/amdgpu: finalizing mem_partitions at the end of GMC v9 sw_fini The valid num_mem_partitions is required during ttm pool fini, thus move the cleanup at the end of the function. Signed-off-by: Le Ma Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 0288603040c38ccfeb5342f34a52673366d90038 Author: Victor Lu Date: Wed Oct 4 14:24:15 2023 -0400 drm/amdgpu: Do not program VF copy regs in mmhub v1.8 under SRIOV (v2) MC_VM_AGP_* registers should not be programmed by guest driver. v2: move early return outside of loop Signed-off-by: Victor Lu Reviewed-by: Samir Dhume Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 1ffa8602e39b89469dc703ebab7a7e44c33da0f7 Author: Nicholas Kazlauskas Date: Wed Sep 13 16:18:44 2023 -0400 drm/amd/display: Guard against invalid RPTR/WPTR being set [WHY] HW can return invalid values on register read, guard against these being set and causing us to access memory out of range and page fault. [HOW] Guard at sync_inbox1 and guard at pushing commands. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Hansen Dsouza Acked-by: Alex Hung Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) commit ae1eff0349f2e908fc083630e8441ea6dc434dc0 Author: Masahiro Yamada Date: Wed Nov 15 13:16:53 2023 +0900 kconfig: fix memory leak from range properties Currently, sym_validate_range() duplicates the range string using xstrdup(), which is overwritten by a subsequent sym_calc_value() call. It results in a memory leak. Instead, only the pointer should be copied. Below is a test case, with a summary from Valgrind. [Test Kconfig] config FOO int "foo" range 10 20 [Test .config] CONFIG_FOO=0 [Before] LEAK SUMMARY: definitely lost: 3 bytes in 1 blocks indirectly lost: 0 bytes in 0 blocks possibly lost: 0 bytes in 0 blocks still reachable: 17,465 bytes in 21 blocks suppressed: 0 bytes in 0 blocks [After] LEAK SUMMARY: definitely lost: 0 bytes in 0 blocks indirectly lost: 0 bytes in 0 blocks possibly lost: 0 bytes in 0 blocks still reachable: 17,462 bytes in 20 blocks suppressed: 0 bytes in 0 blocks Signed-off-by: Masahiro Yamada scripts/kconfig/symbol.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) commit 76020731d4ee897411ce4a73916ed805ea15d946 Author: Simon Glass Date: Fri Nov 10 17:28:01 2023 -0700 kbuild: Move the single quotes for image name Add quotes where UIMAGE_NAME is used, rather than where it is defined. This allows the UIMAGE_NAME variable to be set by the user. Signed-off-by: Simon Glass Signed-off-by: Masahiro Yamada scripts/Makefile.lib | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9e0be3f50c0e8517d0238b62409c20bcb8cd8785 Author: Lukas Bulwahn Date: Fri Nov 10 13:07:22 2023 +0100 linux/export: clean up the IA-64 KSYM_FUNC macro With commit cf8e8658100d ("arch: Remove Itanium (IA-64) architecture"), there is no need to keep the IA-64 definition of the KSYM_FUNC macro. Clean up the IA-64 definition of the KSYM_FUNC macro. Signed-off-by: Lukas Bulwahn Reviewed-by: Nathan Chancellor Signed-off-by: Masahiro Yamada include/linux/export-internal.h | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 76df934c6d5f5c93ba7a0112b1818620ddc10b19 Author: Kees Cook Date: Thu Nov 16 12:11:51 2023 -0800 MAINTAINERS: Add netdev subsystem profile link The netdev subsystem has had a subsystem process document for a while now. Link it appropriately in MAINTAINERS with the P: tag. Cc: Jakub Kicinski Cc: "David S. Miller" Cc: Eric Dumazet Cc: Paolo Abeni Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook Signed-off-by: David S. Miller MAINTAINERS | 2 ++ 1 file changed, 2 insertions(+) commit 3c15504a97a1bcabec5459e604dcc20c7313c8ea Merge: 75a50c4f5b95 1a01319feef7 Author: David S. Miller Date: Fri Nov 17 02:50:33 2023 +0000 Merge branch 'rxrpc-ack-fixes' David Howells says: ==================== rxrpc: ACK handling fixes Here are a couple of patches to fix ACK handling in AF_RXRPC: (1) Allow RTT determination to use an ACK of any type as the response from which to calculate RTT, provided ack.serial matches the serial number of the outgoing packet. (2) Defer the response to a PING ACK packet (or any ACK with the REQUEST_ACK flag set) until after we've parsed the packet so that we carry up to date information if the Tx or Rx rings are advanced. ==================== Signed-off-by: David S. Miller commit 1a01319feef7047aa2ba400ffa3e047776aa29ca Author: David Howells Date: Thu Nov 16 13:12:59 2023 +0000 rxrpc: Defer the response to a PING ACK until we've parsed it Defer the generation of a PING RESPONSE ACK in response to a PING ACK until we've parsed the PING ACK so that we pick up any changes to the packet queue so that we can update ackinfo. This is also applied to an ACK generated in response to an ACK with the REQUEST_ACK flag set. Note that whilst the problem was added in commit 248f219cb8bc, it didn't really matter at that point because the ACK was proposed in softirq mode and generated asynchronously later in process context, taking the latest values at the time. But this fix is only needed since the move to parse incoming packets in an I/O thread rather than in softirq and generate the ACK at point of proposal (b0346843b1076b34a0278ff601f8f287535cb064). Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code") Signed-off-by: David Howells cc: Marc Dionne cc: "David S. Miller" cc: Eric Dumazet cc: Jakub Kicinski cc: Paolo Abeni cc: linux-afs@lists.infradead.org cc: netdev@vger.kernel.org Signed-off-by: David S. Miller net/rxrpc/input.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) commit 3798680f2fbbe0ca3ab6138b34e0d161c36497ee Author: David Howells Date: Thu Nov 16 13:12:58 2023 +0000 rxrpc: Fix RTT determination to use any ACK as a source Fix RTT determination to be able to use any type of ACK as the response from which RTT can be calculated provided its ack.serial is non-zero and matches the serial number of an outgoing DATA or ACK packet. This shouldn't be limited to REQUESTED-type ACKs as these can have other types substituted for them for things like duplicate or out-of-order packets. Fixes: 4700c4d80b7b ("rxrpc: Fix loss of RTT samples due to interposed ACK") Signed-off-by: David Howells cc: Marc Dionne cc: "David S. Miller" cc: Eric Dumazet cc: Jakub Kicinski cc: Paolo Abeni cc: linux-afs@lists.infradead.org cc: netdev@vger.kernel.org Signed-off-by: David S. Miller include/trace/events/rxrpc.h | 2 +- net/rxrpc/input.c | 35 ++++++++++++++++------------------- 2 files changed, 17 insertions(+), 20 deletions(-) commit 75a50c4f5b957a34dedb7c8cce52b582a9162828 Author: Paolo Abeni Date: Thu Nov 16 18:01:41 2023 +0100 kselftest: rtnetlink: fix ip route command typo The blamed commit below introduced a typo causing 'gretap' test-case failures: ./rtnetlink.sh -t kci_test_gretap -v COMMAND: ip link add name test-dummy0 type dummy COMMAND: ip link set test-dummy0 up COMMAND: ip netns add testns COMMAND: ip link help gretap 2>&1 | grep -q '^Usage:' COMMAND: ip -netns testns link add dev gretap00 type gretap seq key 102 local 172.16.1.100 remote 172.16.1.200 COMMAND: ip -netns testns addr add dev gretap00 10.1.1.100/24 COMMAND: ip -netns testns link set dev gretap00 ups Error: either "dev" is duplicate, or "ups" is a garbage. COMMAND: ip -netns testns link del gretap00 COMMAND: ip -netns testns link add dev gretap00 type gretap external COMMAND: ip -netns testns link del gretap00 FAIL: gretap Fix it by using the correct keyword. Fixes: 9c2a19f71515 ("kselftest: rtnetlink.sh: add verbose flag") Signed-off-by: Paolo Abeni Reviewed-by: Hangbin Liu Signed-off-by: David S. Miller tools/testing/selftests/net/rtnetlink.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d565fa4300d9ebd5ba3bbd259ce841f8dab609d6 Author: Gerd Bayer Date: Wed Nov 15 16:59:58 2023 +0100 s390/ism: ism driver implies smc protocol Since commit a72178cfe855 ("net/smc: Fix dependency of SMC on ISM") you can build the ism code without selecting the SMC network protocol. That leaves some ism functions be reported as unused. Move these functions under the conditional compile with CONFIG_SMC. Also codify the suggestion to also configure the SMC protocol in ism's Kconfig - but with an "imply" rather than a "select" as SMC depends on other config options and allow for a deliberate decision not to build SMC. Also, mention that in ISM's help. Fixes: a72178cfe855 ("net/smc: Fix dependency of SMC on ISM") Reported-by: Randy Dunlap Closes: https://lore.kernel.org/netdev/afd142a2-1fa0-46b9-8b2d-7652d41d3ab8@infradead.org/ Signed-off-by: Gerd Bayer Reviewed-by: Wenjia Zhang Reviewed-by: Simon Horman Acked-by: Randy Dunlap Tested-by: Randy Dunlap # build-tested Signed-off-by: David S. Miller drivers/s390/net/Kconfig | 3 +- drivers/s390/net/ism_drv.c | 93 +++++++++++++++++++++++----------------------- 2 files changed, 48 insertions(+), 48 deletions(-) commit 0c3bd086d12d185650d095a906662593ec607bd0 Author: David Howells Date: Wed Nov 15 17:15:40 2023 +0000 rxrpc: Fix some minor issues with bundle tracing Fix some superficial issues with the tracing of rxrpc_bundle structs, including: (1) Set the debug_id when the bundle is allocated rather than when it is set up so that the "NEW" trace line displays the correct bundle ID. (2) Show the refcount when emitting the "FREE" traceline. Signed-off-by: David Howells cc: Marc Dionne cc: "David S. Miller" cc: Eric Dumazet cc: Jakub Kicinski cc: Paolo Abeni cc: linux-afs@lists.infradead.org cc: netdev@vger.kernel.org Signed-off-by: David S. Miller net/rxrpc/conn_client.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 7fbd5fc2b35a8f559a6b380dfa9bcd964a758186 Author: Jean Delvare Date: Wed Nov 15 11:53:31 2023 +0100 stmmac: dwmac-loongson: Add architecture dependency Only present the DWMAC_LOONGSON option on architectures where it can actually be used. This follows the same logic as the DWMAC_INTEL option. Signed-off-by: Jean Delvare Cc: Keguang Zhang Reviewed-by: Simon Horman Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ccab434e674ca95d483788b1895a70c21b7f016a Author: Oliver Neukum Date: Wed Nov 15 11:08:57 2023 +0100 usb: aqc111: check packet for fixup for true limit If a device sends a packet that is inbetween 0 and sizeof(u64) the value passed to skb_trim() as length will wrap around ending up as some very large value. The driver will then proceed to parse the header located at that position, which will either oops or process some random value. The fix is to check against sizeof(u64) rather than 0, which the driver currently does. The issue exists since the introduction of the driver. Signed-off-by: Oliver Neukum Signed-off-by: David S. Miller drivers/net/usb/aqc111.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit ba276ce5865b5a22ee96c4c5664bfefd9c1bb593 Author: Kent Overstreet Date: Tue Nov 14 19:11:04 2023 -0500 bcachefs: Fix missing locking for dentry->d_parent access Reported-by: Al Viro Signed-off-by: Kent Overstreet fs/bcachefs/xattr.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit e80ed63affc9a9b4aacb44180ecd7ed601839599 Author: Conor Dooley Date: Tue Oct 24 09:20:35 2023 +0100 riscv: dts: sophgo: remove address-cells from intc node A recent submission [1] from Rob has added additionalProperties: false to the interrupt-controller child node of RISC-V cpus, highlighting that the new cv1800b DT has been incorrectly using #address-cells. It has no child nodes, so #address-cells is not needed. Remove it. Link: https://patchwork.kernel.org/project/linux-riscv/patch/20230915201946.4184468-1-robh@kernel.org/ [1] Fixes: c3dffa879cca ("riscv: dts: sophgo: add initial CV1800B SoC device tree") Reviewed-by: Jisheng Zhang Acked-by: Chen Wang Signed-off-by: Conor Dooley arch/riscv/boot/dts/sophgo/cv1800b.dtsi | 1 - 1 file changed, 1 deletion(-) commit 21133266ca12f82b6e59c9711258cca2097c167c Author: Dmitry Baryshkov Date: Wed Oct 25 12:23:10 2023 +0300 drm/msm/dp: attach the DP subconnector property While developing and testing the commit bfcc3d8f94f4 ("drm/msm/dp: support setting the DP subconnector type") I had the patch [1] in my tree. I haven't noticed that it was a dependency for the commit in question. Mea culpa. Since the patch has not landed yet (and even was not reviewed) and since one of the bridges erroneously uses USB connector type instead of DP, attach the property directly from the MSM DP driver. This fixes the following oops on DP HPD event: drm_object_property_set_value (drivers/gpu/drm/drm_mode_object.c:288) dp_display_process_hpd_high (drivers/gpu/drm/msm/dp/dp_display.c:402) dp_hpd_plug_handle.isra.0 (drivers/gpu/drm/msm/dp/dp_display.c:604) hpd_event_thread (drivers/gpu/drm/msm/dp/dp_display.c:1110) kthread (kernel/kthread.c:388) ret_from_fork (arch/arm64/kernel/entry.S:858) [1] https://patchwork.freedesktop.org/patch/555530/ Fixes: bfcc3d8f94f4 ("drm/msm/dp: support setting the DP subconnector type") Reviewed-by: Abhinav Kumar Signed-off-by: Dmitry Baryshkov Tested-by: Jessica Zhang # SC7280 Reviewed-by: Johan Hovold Tested-by: Johan Hovold Patchwork: https://patchwork.freedesktop.org/patch/564286/ Link: https://lore.kernel.org/r/20231025092711.851168-3-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar drivers/gpu/drm/msm/dp/dp_drm.c | 3 +++ 1 file changed, 3 insertions(+) commit ebfa85c504cb34f2fd3257c6f5d54158a0ff1bf6 Author: Abel Vesa Date: Wed Oct 25 12:23:09 2023 +0300 drm/msm/dp: don't touch DP subconnector property in eDP case In case of the eDP connection there is no subconnetor and as such no subconnector property. Put drm_dp_set_subconnector_property() calls under the !is_edp condition. Fixes: bfcc3d8f94f4 ("drm/msm/dp: support setting the DP subconnector type") Signed-off-by: Abel Vesa Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Tested-by: Jessica Zhang # SC7280 Reviewed-by: Johan Hovold Tested-by: Johan Hovold Patchwork: https://patchwork.freedesktop.org/patch/564284/ Link: https://lore.kernel.org/r/20231025092711.851168-2-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar drivers/gpu/drm/msm/dp/dp_display.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) commit a33b2431d11b4df137bbcfdd5a5adfa054c2479e Author: Bjorn Andersson Date: Mon Oct 30 16:23:20 2023 -0700 drm/msm/dpu: Add missing safe_lut_tbl in sc8280xp catalog During USB transfers on the SC8280XP __arm_smmu_tlb_sync() is seen to typically take 1-2ms to complete. As expected this results in poor performance, something that has been mitigated by proposing running the iommu in non-strict mode (boot with iommu.strict=0). This turns out to be related to the SAFE logic, and programming the QOS SAFE values in the DPU (per suggestion from Rob and Doug) reduces the TLB sync time to below 10us, which means significant less time spent with interrupts disabled and a significant boost in throughput. Fixes: 4a352c2fc15a ("drm/msm/dpu: Introduce SC8280XP") Cc: stable@vger.kernel.org Suggested-by: Doug Anderson Suggested-by: Rob Clark Signed-off-by: Bjorn Andersson Tested-by: Johan Hovold Tested-by: Steev Klimaszewski Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/565094/ Link: https://lore.kernel.org/r/20231030-sc8280xp-dpu-safe-lut-v1-1-6d485d7b428f@quicinc.com Signed-off-by: Abhinav Kumar drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_0_sc8280xp.h | 1 + 1 file changed, 1 insertion(+) commit 3944e343e54b93d3fef30eacc4738e77fdf5444e Author: Dmitry Baryshkov Date: Tue Nov 7 13:14:13 2023 +0200 drm/msm: remove exra drm_kms_helper_poll_init() call It seems during rebases I have left a call to drm_kms_helper_poll_init() which is not guarded by the (priv->kms_init) check. This leads to the crash for the boards which don't have KMS output. Drop this call, as there is a correctly guarded one next to the one being removed. Fixes: 506efcba3129 ("drm/msm: carve out KMS code from msm_drv.c") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/566299/ Link: https://lore.kernel.org/r/20231107111413.2212942-1-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar drivers/gpu/drm/msm/msm_drv.c | 2 -- 1 file changed, 2 deletions(-) commit b3e0f94d15700ac8e8c1c2355834f5d5c753c41d Author: Jonathan Marek Date: Thu Nov 9 19:02:14 2023 -0500 drm/msm/dsi: use the correct VREG_CTRL_1 value for 4nm cphy Use the same value as the downstream driver. This change is needed for CPHY mode to work correctly. Fixes: 8b034e677111 ("drm/msm/dsi: add support for DSI-PHY on SM8550") Signed-off-by: Jonathan Marek Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/566987/ Link: https://lore.kernel.org/r/20231110000216.29979-1-jonathan@marek.ca Signed-off-by: Abhinav Kumar drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c6c5a5580dcb6631aa6369dabe12ef3ce784d1d2 Author: Weihao Li Date: Tue Oct 31 19:18:16 2023 +0800 clk: rockchip: rk3128: Fix HCLK_OTG gate register The HCLK_OTG gate control is in CRU_CLKGATE5_CON, not CRU_CLKGATE3_CON. Signed-off-by: Weihao Li Link: https://lore.kernel.org/r/20231031111816.8777-1-cn.liweihao@gmail.com Signed-off-by: Heiko Stuebner drivers/clk/rockchip/clk-rk3128.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1af27671f62ce919f1fb76082ed81f71cb090989 Author: Chris Morgan Date: Wed Oct 18 10:33:55 2023 -0500 clk: rockchip: rk3568: Add PLL rate for 292.5MHz Add support for a PLL rate of 292.5MHz so that the Powkiddy RGB30 panel can run at a requested 60hz (59.96, close enough). I have confirmed this rate fits with all the constraints listed in the TRM for the VPLL (as an integer PLL) in Part 1 "Chapter 2 Clock & Reset Unit (CRU)." Signed-off-by: Chris Morgan Link: https://lore.kernel.org/r/20231018153357.343142-2-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner drivers/clk/rockchip/clk-rk3568.c | 1 + 1 file changed, 1 insertion(+) commit 3cee9c635f27d1003d46f624d816f3455698b625 Author: Heiko Stuebner Date: Tue Nov 14 16:38:34 2023 +0100 arm64: dts: rockchip: fix rk356x pcie msg interrupt name The expected name by the binding at this position is "msg" and the SoC's manual also calls the interrupt in question "msg", so fix the rk356x dtsi to use the correct name. Reviewed-by: Sebastian Reichel Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20231114153834.934978-1-heiko@sntech.de arch/arm64/boot/dts/rockchip/rk356x.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 35938c18291b5da7422b2fac6dac0af11aa8d0d7 Author: Alex Bee Date: Sun Nov 5 23:36:16 2023 +0000 arm64: dts: rockchip: Expand reg size of vdec node for RK3399 Expand the reg size for the vdec node to include cache/performance registers the rkvdec driver writes to. Also add missing clocks to the related power-domain. Fixes: cbd7214402ec ("arm64: dts: rockchip: Define the rockchip Video Decoder node on rk3399") Signed-off-by: Alex Bee Signed-off-by: Jonas Karlman Link: https://lore.kernel.org/r/20231105233630.3927502-10-jonas@kwiboo.se Signed-off-by: Heiko Stuebner arch/arm64/boot/dts/rockchip/rk3399.dtsi | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 0b6240d697a96eaa45a2a5503a274ebb4f162fa3 Author: Jonas Karlman Date: Sun Nov 5 23:36:15 2023 +0000 arm64: dts: rockchip: Expand reg size of vdec node for RK3328 Expand the reg size for the vdec node to include cache/performance registers the rkvdec driver writes to. Fixes: 17408c9b119d ("arm64: dts: rockchip: Add vdec support for RK3328") Signed-off-by: Jonas Karlman Link: https://lore.kernel.org/r/20231105233630.3927502-9-jonas@kwiboo.se Signed-off-by: Heiko Stuebner arch/arm64/boot/dts/rockchip/rk3328.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 54cf39ec16335dadbe1ba008d8e5e98dae3e26f8 Author: Javier Carrasco Date: Thu Oct 26 17:44:49 2023 +0200 iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table The HTU21 offers 4 sampling frequencies: 20, 40, 70 and 120, which are associated to an index that is used to select the right measurement resolution and its corresponding measurement time. The current implementation selects the measurement resolution and the temperature measurement time properly, but it does not select the right humidity measurement time in all cases. In summary, the 40 and 70 humidity measurement times are swapped. The reason for that is probably the unusual coding for the measurement resolution. According to the datasheet, the bits [7,0] of the "user register" are used as follows to select the bit resolution: -------------------------------------------------- | Bit 7 | Bit 0 | RH | Temp | Trh (us) | Tt (us) | -------------------------------------------------- | 0 | 0 | 12 | 14 | 16000 | 50000 | -------------------------------------------------- | 0 | 1 | 8 | 12 | 3000 | 13000 | -------------------------------------------------- | 1 | 0 | 10 | 13 | 5000 | 25000 | -------------------------------------------------- | 1 | 1 | 11 | 11 | 8000 | 7000 | -------------------------------------------------- *This table is available in the official datasheet, page 13/21. I have just appended the times provided in the humidity/temperature tables, pages 3/21, 5/21. Note that always a pair of resolutions is selected. The sampling frequencies [20, 40, 70, 120] are assigned to a linear index [0..3] which is then coded as follows [1]: Index [7,0] -------------- idx 0 0,0 idx 1 1,0 idx 2 0,1 idx 3 1,1 That is done that way because the temperature measurements are being used as the reference for the sampling frequency (the frequencies and the temperature measurement times are correlated), so increasing the index always reduces the temperature measurement time and its resolution. Therefore, the temperature measurement time array is as simple as [50000, 25000, 13000, 7000] On the other hand, the humidity resolution cannot follow the same pattern because of the way it is coded in the "user register", where both resolutions are selected at the same time. The humidity measurement time array is the following: [16000, 3000, 5000, 8000], which defines the following assignments: Index [7,0] Trh ----------------------- idx 0 0,0 16000 -> right, [0,0] selects 12 bits (Trh = 16000) idx 1 1,0 3000 -> wrong! [1,0] selects 10 bits (Trh = 5000) idx 2 0,1 5000 -> wrong! [0,1] selects 8 bits (Trh = 3000) idx 3 1,1 8000 -> right, [1,1] selects 11 bits (Trh = 8000) The times have been ordered as if idx = 1 -> [0,1] and idx = 2 -> [1,0], which is not the case for the reason explained above. So a simple modification is required to obtain the right humidity measurement time array, swapping the values in the positions 1 and 2. The right table should be the following: [16000, 5000, 3000, 8000] Fix the humidity measurement time array with the right idex/value coding. [1] The actual code that makes this coding and assigns it to the current value of the "user register" is the following: config_reg &= 0x7E; config_reg |= ((i & 1) << 7) + ((i & 2) >> 1); Fixes: d574a87cc311 ("Add meas-spec sensors common part") Signed-off-by: Javier Carrasco Link: https://lore.kernel.org/r/20231026-topic-htu21_conversion_time-v1-1-bd257dc44209@gmail.com Cc: Signed-off-by: Jonathan Cameron drivers/iio/common/ms_sensors/ms_sensors_i2c.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 92bfa4ab1b79be95c4f52d13f5386390f0a513c2 Author: Matti Vaittinen Date: Thu Oct 19 16:23:56 2023 +0300 iio: kx022a: Fix acceleration value scaling The IIO ABI mandates acceleration values from accelerometer to be emitted in m/s^2. The KX022A was emitting values in micro m/s^2. Fix driver to report the correct scale values. Signed-off-by: Matti Vaittinen Reported-by: Jagath Jog J Fixes: 7c1d1677b322 ("iio: accel: Support Kionix/ROHM KX022A accelerometer") Tested-by: Jagath Jog J Link: https://lore.kernel.org/r/ZTEt7NqfDHPOkm8j@dc78bmyyyyyyyyyyyyydt-3.rev.dnainternet.fi Cc: Signed-off-by: Jonathan Cameron drivers/iio/accel/kionix-kx022a.c | 37 ++++++++++++++++++++++++++----------- 1 file changed, 26 insertions(+), 11 deletions(-) commit 6588732445ff19f6183f0fa72ddedf67e5a5be32 Author: Charles Keepax Date: Wed Nov 15 16:28:53 2023 +0000 pinctrl: lochnagar: Don't build on MIPS MIPS appears to define a RST symbol at a high level, which clashes with some register naming in the driver. Since there is currently no case for running this driver on MIPS devices simply cut off the build of this driver on MIPS. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311071303.JJMAOjy4-lkp@intel.com/ Suggested-by: Linus Walleij Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20231115162853.1891940-1-ckeepax@opensource.cirrus.com Signed-off-by: Linus Walleij drivers/pinctrl/cirrus/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 32138be394e5d32c095a413949e6ab4875b2aec0 Merge: 173d167ce350 42d62b7e47d5 Author: Hans Verkuil Date: Thu Nov 16 14:28:44 2023 +0100 Merge tag 'media-renesas-fixes-20231113' of git://git.kernel.org/pub/scm/linux/kernel/git/pinchartl/linux.git Laurent Pinchart says: ---------------------------------------------------------------- Renesas R-Car VSP1 driver regression fix ---------------------------------------------------------------- Laurent Pinchart (1): media: vsp1: Remove unbalanced .s_stream(0) calls Link: https://lore.kernel.org/linux-media/20231113020054.GA18039@pendragon.ideasonboard.com/ Signed-off-by: Hans Verkuil commit 173d167ce350961d7d689a4d59d66a5f2ad70a76 Author: Arnd Bergmann Date: Mon Oct 23 18:05:31 2023 +0200 media: pci: mgb4: add COMMON_CLK dependency This driver fails to build when HAVE_CLK and COMMON_CLK are disabled: x86_64-linux-ld: vmlinux.o: in function `mgb4_remove': mgb4_core.c:(.text+0x1915e8c): undefined reference to `clkdev_drop' x86_64-linux-ld: mgb4_core.c:(.text+0x1915e98): undefined reference to `clk_hw_unregister' Add a Kconfig dependency to enforce a clean build. Fixes: 0ab13674a9bd ("media: pci: mgb4: Added Digiteq Automotive MGB4 driver") Signed-off-by: Arnd Bergmann Reviewed-by: Martin Tůma Signed-off-by: Hans Verkuil drivers/media/pci/mgb4/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 5d33213fac5929a2e7766c88d78779fd443b0fe8 Author: Dan Carpenter Date: Fri Nov 3 10:39:24 2023 +0300 media: v4l2-subdev: Fix a 64bit bug The problem is this line here from subdev_do_ioctl(). client_cap->capabilities &= ~V4L2_SUBDEV_CLIENT_CAP_STREAMS; The "client_cap->capabilities" variable is a u64. The AND operation is supposed to clear out the V4L2_SUBDEV_CLIENT_CAP_STREAMS flag. But because it's a 32 bit variable it accidentally clears out the high 32 bits as well. Currently we only use the first bit and none of the upper bits so this doesn't affect runtime behavior. Fixes: f57fa2959244 ("media: v4l2-subdev: Add new ioctl for client capabilities") Signed-off-by: Dan Carpenter Reviewed-by: Tomi Valkeinen Signed-off-by: Hans Verkuil include/uapi/linux/v4l2-subdev.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9ea7be95d3d4d76df63cef13b4360cd58548b2ef Author: Martin Tůma Date: Wed Oct 25 18:51:47 2023 +0200 media: mgb4: Added support for T200 card variant T200 card variants use the XC7A200T FPGA instead of XC7A100T. The SPI FLASH memory layout is different as the FPGA requires bigger FW images. Signed-off-by: Martin Tůma Signed-off-by: Hans Verkuil drivers/media/pci/mgb4/mgb4_core.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) commit 7475e51b87969e01a6812eac713a1c8310372e8a Merge: 6eb1acd9766a cff088d924df Author: Linus Torvalds Date: Thu Nov 16 07:51:26 2023 -0500 Merge tag 'net-6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from BPF and netfilter. Current release - regressions: - core: fix undefined behavior in netdev name allocation - bpf: do not allocate percpu memory at init stage - netfilter: nf_tables: split async and sync catchall in two functions - mptcp: fix possible NULL pointer dereference on close Current release - new code bugs: - eth: ice: dpll: fix initial lock status of dpll Previous releases - regressions: - bpf: fix precision backtracking instruction iteration - af_unix: fix use-after-free in unix_stream_read_actor() - tipc: fix kernel-infoleak due to uninitialized TLV value - eth: bonding: stop the device in bond_setup_by_slave() - eth: mlx5: - fix double free of encap_header - avoid referencing skb after free-ing in drop path - eth: hns3: fix VF reset - eth: mvneta: fix calls to page_pool_get_stats Previous releases - always broken: - core: set SOCK_RCU_FREE before inserting socket into hashtable - bpf: fix control-flow graph checking in privileged mode - eth: ppp: limit MRU to 64K - eth: stmmac: avoid rx queue overrun - eth: icssg-prueth: fix error cleanup on failing initialization - eth: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs - eth: cortina: handle large frames Misc: - selftests: gso: support CONFIG_MAX_SKB_FRAGS up to 45" * tag 'net-6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (78 commits) macvlan: Don't propagate promisc change to lower dev in passthru net: sched: do not offload flows with a helper in act_ct net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors net/mlx5e: Check return value of snprintf writing to fw_version buffer net/mlx5e: Reduce the size of icosq_str net/mlx5: Increase size of irq name buffer net/mlx5e: Update doorbell for port timestamping CQ before the software counter net/mlx5e: Track xmit submission to PTP WQ after populating metadata map net/mlx5e: Avoid referencing skb after free-ing in drop path of mlx5e_sq_xmit_wqe net/mlx5e: Don't modify the peer sent-to-vport rules for IPSec offload net/mlx5e: Fix pedit endianness net/mlx5e: fix double free of encap_header in update funcs net/mlx5e: fix double free of encap_header net/mlx5: Decouple PHC .adjtime and .adjphase implementations net/mlx5: DR, Allow old devices to use multi destination FTE net/mlx5: Free used cpus mask when an IRQ is released Revert "net/mlx5: DR, Supporting inline WQE when possible" bpf: Do not allocate percpu memory at init stage net: Fix undefined behavior in netdev name allocation dt-bindings: net: ethernet-controller: Fix formatting error ... commit 6eb1acd9766a0dc9d85927843d85787408395e15 Merge: 372bed5fbb87 cee96422e863 Author: Linus Torvalds Date: Thu Nov 16 07:44:34 2023 -0500 Merge tag 'for-linus-6.7a-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - A fix in the Xen events driver avoiding the use of RCU after the call to rcu_report_dead() when taking a cpu down - A fix for running as Xen dom0 to line up ACPI's idea of power management capabilities with the one of Xen - A cleanup eliminating several kernel-doc warnings in Xen related code - A cleanup series of the Xen events driver * tag 'for-linus-6.7a-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/events: remove some info_for_irq() calls in pirq handling xen/events: modify internal [un]bind interfaces xen/events: drop xen_allocate_irqs_dynamic() xen/events: remove some simple helpers from events_base.c xen/events: reduce externally visible helper functions xen/events: remove unused functions xen/events: fix delayed eoi list handling xen/shbuf: eliminate 17 kernel-doc warnings acpi/processor: sanitize _OSC/_PDC capabilities for Xen dom0 xen/events: avoid using info_for_irq() in xen_send_IPI_one() commit 372bed5fbb87314abf410c3916e51578cd382cd1 Merge: c42d9eeef8e5 e07754e0a1ea Author: Linus Torvalds Date: Thu Nov 16 07:39:37 2023 -0500 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "Bugfixes all over the place" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vhost-vdpa: fix use after free in vhost_vdpa_probe() virtio_pci: Switch away from deprecated irq_set_affinity_hint riscv, qemu_fw_cfg: Add support for RISC-V architecture vdpa_sim_blk: allocate the buffer zeroed virtio_pci: move structure to a header commit 0f40d5099cd6d828fd7de6227d3eabe86016724c Author: Andrew Davis Date: Wed Oct 25 09:33:02 2023 -0500 phy: ti: gmii-sel: Fix register offset when parent is not a syscon node When the node for this phy selector is a child node of a syscon node then the property 'reg' is used as an offset into the parent regmap. When the node is standalone and gets its own regmap this offset is pre-applied. So we need to track which method was used to get the regmap and not apply the offset in the standalone case. Fixes: 1fdfa7cccd35 ("phy: ti: gmii-sel: Allow parent to not be syscon node") Signed-off-by: Andrew Davis Reviewed-by: Roger Quadros Link: https://lore.kernel.org/r/20231025143302.1265633-1-afd@ti.com Signed-off-by: Vinod Koul drivers/phy/ti/phy-gmii-sel.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 1c4a7587d1bbee0fd53b63af60e4244a62775f57 Author: Masahiro Yamada Date: Wed Nov 1 02:46:27 2023 +0900 modpost: fix section mismatch message for RELA The section mismatch check prints a bogus symbol name on some architectures. [test code] #include int __initdata foo; int get_foo(void) { return foo; } If you compile it with GCC for riscv or loongarch, modpost will show an incorrect symbol name: WARNING: modpost: vmlinux: section mismatch in reference: get_foo+0x8 (section: .text) -> done (section: .init.data) To get the correct symbol address, the st_value must be added. This issue has never been noticed since commit 93684d3b8062 ("kbuild: include symbol names in section mismatch warnings") presumably because st_value becomes zero on most architectures when the referenced symbol is looked up. It is not true for riscv or loongarch, at least. With this fix, modpost will show the correct symbol name: WARNING: modpost: vmlinux: section mismatch in reference: get_foo+0x8 (section: .text) -> foo (section: .init.data) Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers scripts/mod/modpost.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit cff088d924df871296412e6b819823f42d1bb9a5 Merge: 7e1caeace041 8837ba3e58ea Author: Paolo Abeni Date: Thu Nov 16 11:02:52 2023 +0100 Merge tag 'nf-23-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Remove unused variable causing compilation warning in nft_set_rbtree, from Yang Li. This unused variable is a left over from previous merge window. 2) Possible return of uninitialized in nf_conntrack_bridge, from Linkui Xiao. This is there since nf_conntrack_bridge is available. 3) Fix incorrect pointer math in nft_byteorder, from Dan Carpenter. Problem has been there since 2016. 4) Fix bogus error in destroy set element command. Problem is there since this new destroy command was added. 5) Fix race condition in ipset between swap and destroy commands and add/del/test control plane. This problem is there since ipset was merged. 6) Split async and sync catchall GC in two function to fix unsafe iteration over RCU. This is a fix-for-fix that was included in the previous pull request. * tag 'nf-23-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: split async and sync catchall in two functions netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test netfilter: nf_tables: bogus ENOENT when destroying element which does not exist netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() netfilter: nf_conntrack_bridge: initialize err to 0 netfilter: nft_set_rbtree: Remove unused variable nft_net ==================== Link: https://lore.kernel.org/r/20231115184514.8965-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit 862c135bde8bc185e8aae2110374175e6a1b6ed5 Author: Junhao He Date: Tue Nov 14 21:33:45 2023 +0800 coresight: ultrasoc-smb: Fix uninitialized before use buf_hw_base In smb_reset_buffer, the sdb->buf_hw_base variable is uninitialized before use, which initializes it in smb_init_data_buffer. And the SMB regiester are set in smb_config_inport. So move the call after smb_config_inport. Fixes: 06f5c2926aaa ("drivers/coresight: Add UltraSoc System Memory Buffer driver") Signed-off-by: Junhao He Reviewed-by: James Clark Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20231114133346.30489-4-hejunhao3@huawei.com drivers/hwtracing/coresight/ultrasoc-smb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 830a7f54db102c889a3fe1c0a225f369ac05f07f Author: Junhao He Date: Tue Nov 14 21:33:44 2023 +0800 coresight: ultrasoc-smb: Config SMB buffer before register sink The SMB dirver register the enable/disable sysfs interface in function smb_register_sink(), however the buffer depends on the following configuration to work well. So it'll be possible for user to access an unreset one. Move the config buffer operation to before register_sink(). Ignore the return value, if smb_config_inport() fails. That will cause the hardwares disable trace path to fail, should not affect SMB driver remove. So we make smb_remove() return success, Fixes: 06f5c2926aaa ("drivers/coresight: Add UltraSoc System Memory Buffer driver") Signed-off-by: Junhao He Reviewed-by: James Clark Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20231114133346.30489-3-hejunhao3@huawei.com drivers/hwtracing/coresight/ultrasoc-smb.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-) commit b8411287aef4a994eff0c68f5597910c4194dfe3 Author: Junhao He Date: Tue Nov 14 21:33:43 2023 +0800 coresight: ultrasoc-smb: Fix sleep while close preempt in enable_smb When we to enable the SMB by perf, the perf sched will call perf_ctx_lock() to close system preempt in event_function_call(). But SMB::enable_smb() use mutex to lock the critical section, which may sleep. BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 153023, name: perf preempt_count: 2, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. irq event stamp: 0 hardirqs last enabled at (0): [<0000000000000000>] 0x0 hardirqs last disabled at (0): [] copy_process+0xae8/0x2b48 softirqs last enabled at (0): [] copy_process+0xae8/0x2b48 softirqs last disabled at (0): [<0000000000000000>] 0x0 CPU: 2 PID: 153023 Comm: perf Kdump: loaded Tainted: G W O 6.5.0-rc4+ #1 Call trace: ... __mutex_lock+0xbc/0xa70 mutex_lock_nested+0x34/0x48 smb_update_buffer+0x58/0x360 [ultrasoc_smb] etm_event_stop+0x204/0x2d8 [coresight] etm_event_del+0x1c/0x30 [coresight] event_sched_out+0x17c/0x3b8 group_sched_out.part.0+0x5c/0x208 __perf_event_disable+0x15c/0x210 event_function+0xe0/0x230 remote_function+0xb4/0xe8 generic_exec_single+0x160/0x268 smp_call_function_single+0x20c/0x2a0 event_function_call+0x20c/0x220 _perf_event_disable+0x5c/0x90 perf_event_for_each_child+0x58/0xc0 _perf_ioctl+0x34c/0x1250 perf_ioctl+0x64/0x98 ... Use spinlock to replace mutex to control driver data access to one at a time. The function copy_to_user() may sleep, it cannot be in a spinlock context, so we can't simply replace it in smb_read(). But we can ensure that only one user gets the SMB device fd by smb_open(), so remove the locks from smb_read() and buffer synchronization is guaranteed by the user. Fixes: 06f5c2926aaa ("drivers/coresight: Add UltraSoc System Memory Buffer driver") Signed-off-by: Junhao He Reviewed-by: James Clark Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20231114133346.30489-2-hejunhao3@huawei.com drivers/hwtracing/coresight/ultrasoc-smb.c | 35 ++++++++++++------------------ drivers/hwtracing/coresight/ultrasoc-smb.h | 6 ++--- 2 files changed, 17 insertions(+), 24 deletions(-) commit 7e1caeace0418381f36b3aa8403dfd82fc57fc53 Author: Vlad Buslov Date: Tue Nov 14 18:59:15 2023 +0100 macvlan: Don't propagate promisc change to lower dev in passthru Macvlan device in passthru mode sets its lower device promiscuous mode according to its MACVLAN_FLAG_NOPROMISC flag instead of synchronizing it to its own promiscuity setting. However, macvlan_change_rx_flags() function doesn't check the mode before propagating such changes to the lower device which can cause net_device->promiscuity counter overflow as illustrated by reproduction example [0] and resulting dmesg log [1]. Fix the issue by first verifying the mode in macvlan_change_rx_flags() function before propagating promiscuous mode change to the lower device. [0]: ip link add macvlan1 link enp8s0f0 type macvlan mode passthru ip link set macvlan1 promisc on ip l set dev macvlan1 up ip link set macvlan1 promisc off ip l set dev macvlan1 down ip l set dev macvlan1 up [1]: [ 5156.281724] macvlan1: entered promiscuous mode [ 5156.285467] mlx5_core 0000:08:00.0 enp8s0f0: entered promiscuous mode [ 5156.287639] macvlan1: left promiscuous mode [ 5156.288339] mlx5_core 0000:08:00.0 enp8s0f0: left promiscuous mode [ 5156.290907] mlx5_core 0000:08:00.0 enp8s0f0: entered promiscuous mode [ 5156.317197] mlx5_core 0000:08:00.0 enp8s0f0: promiscuity touches roof, set promiscuity failed. promiscuity feature of device might be broken. Fixes: efdbd2b30caa ("macvlan: Propagate promiscuity setting to lower devices.") Reviewed-by: Gal Pressman Signed-off-by: Vlad Buslov Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/20231114175915.1649154-1-vladbu@nvidia.com Signed-off-by: Paolo Abeni drivers/net/macvlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e49c0b1401d0d0efc8aeeb9db5a9d54e980d9f69 Author: Vegard Nossum Date: Sun Oct 22 20:58:06 2023 +0200 Documentation: coresight: fix `make refcheckdocs` warning This reference uses a glob pattern to match multiple files, but the asterisk was escaped as \* in order to not be interpreted by sphinx as reStructuredText markup. refcheckdocs/documentation-file-ref-check doesn't know about rST syntax and tries to interpret the \* literally (instead of as a glob). We can work around the warning by putting the Documentation reference inside double backticks (``..``), which allows us to not escape the asterisk. Fixes: c06475910b52 ("Documentation: coresight: Escape coresight bindings file wildcard") Cc: Mathieu Poirier Cc: Suzuki K Poulose Cc: Mike Leach Cc: Leo Yan Cc: Jonathan Corbet Cc: Rob Herring Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Cc: linux-next@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: Stephen Rothwell Cc: Bagas Sanjaya Signed-off-by: Vegard Nossum Reviewed-by: Bagas Sanjaya Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20231022185806.919434-1-vegard.nossum@oracle.com Documentation/trace/coresight/coresight.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7cd5af0e937a197295f3aa3721031f0fbae49cff Author: Xin Long Date: Mon Nov 13 12:53:28 2023 -0500 net: sched: do not offload flows with a helper in act_ct There is no hardware supporting ct helper offload. However, prior to this patch, a flower filter with a helper in the ct action can be successfully set into the HW, for example (eth1 is a bnxt NIC): # tc qdisc add dev eth1 ingress_block 22 ingress # tc filter add block 22 proto ip flower skip_sw ip_proto tcp \ dst_port 21 ct_state -trk action ct helper ipv4-tcp-ftp # tc filter show dev eth1 ingress filter block 22 protocol ip pref 49152 flower chain 0 handle 0x1 eth_type ipv4 ip_proto tcp dst_port 21 ct_state -trk skip_sw in_hw in_hw_count 1 <---- action order 1: ct zone 0 helper ipv4-tcp-ftp pipe index 2 ref 1 bind 1 used_hw_stats delayed This might cause the flower filter not to work as expected in the HW. This patch avoids this problem by simply returning -EOPNOTSUPP in tcf_ct_offload_act_setup() to not allow to offload flows with a helper in act_ct. Fixes: a21b06e73191 ("net: sched: add helper support in act_ct") Signed-off-by: Xin Long Reviewed-by: Jamal Hadi Salim Link: https://lore.kernel.org/r/f8685ec7702c4a448a1371a8b34b43217b583b9d.1699898008.git.lucien.xin@gmail.com Signed-off-by: Paolo Abeni include/net/tc_act/tc_ct.h | 9 +++++++++ net/sched/act_ct.c | 3 +++ 2 files changed, 12 insertions(+) commit bdc454fcdc824062c6f5ebc56e898a462ac66fc6 Merge: a6a6a0a9fdb0 1b2bd0c0264f Author: Jakub Kicinski Date: Wed Nov 15 22:34:31 2023 -0800 Merge branch 'mlx5-fixes-2023-11-13-manual' Saeed Mahameed says: ==================== This series provides bug fixes to mlx5 driver. ==================== Link: https://lore.kernel.org/r/20231114215846.5902-1-saeed@kernel.org/ Signed-off-by: Jakub Kicinski commit 1b2bd0c0264febcd8d47209079a6671c38e6558b Author: Rahul Rameshbabu Date: Tue Nov 14 13:58:46 2023 -0800 net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors Treat the operation as an error case when the return value is equivalent to the size of the name buffer. Failed to write null terminator to the name buffer, making the string malformed and should not be used. Provide a string with only the firmware version when forming the string with the board id fails. This logic for representors is identical to normal flow with ethtool. Without check, will trigger -Wformat-truncation with W=1. drivers/net/ethernet/mellanox/mlx5/core/en_rep.c: In function 'mlx5e_rep_get_drvinfo': drivers/net/ethernet/mellanox/mlx5/core/en_rep.c:78:31: warning: '%.16s' directive output may be truncated writing up to 16 bytes into a region of size between 13 and 22 [-Wformat-truncation=] 78 | "%d.%d.%04d (%.16s)", | ^~~~~ drivers/net/ethernet/mellanox/mlx5/core/en_rep.c:77:9: note: 'snprintf' output between 12 and 37 bytes into a destination of size 32 77 | snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version), | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 78 | "%d.%d.%04d (%.16s)", | ~~~~~~~~~~~~~~~~~~~~~ 79 | fw_rev_maj(mdev), fw_rev_min(mdev), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 80 | fw_rev_sub(mdev), mdev->board_id); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: cf83c8fdcd47 ("net/mlx5e: Add missing ethtool driver info for representors") Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d4ab2e97dcfbcd748ae71761a9d8e5e41cc732c Signed-off-by: Rahul Rameshbabu Reviewed-by: Dragos Tatulea Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20231114215846.5902-16-saeed@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 41e63c2baa11dc2aa71df5dd27a5bd87d11b6bbb Author: Rahul Rameshbabu Date: Tue Nov 14 13:58:45 2023 -0800 net/mlx5e: Check return value of snprintf writing to fw_version buffer Treat the operation as an error case when the return value is equivalent to the size of the name buffer. Failed to write null terminator to the name buffer, making the string malformed and should not be used. Provide a string with only the firmware version when forming the string with the board id fails. Without check, will trigger -Wformat-truncation with W=1. drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c: In function 'mlx5e_ethtool_get_drvinfo': drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c:49:31: warning: '%.16s' directive output may be truncated writing up to 16 bytes into a region of size between 13 and 22 [-Wformat-truncation=] 49 | "%d.%d.%04d (%.16s)", | ^~~~~ drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c:48:9: note: 'snprintf' output between 12 and 37 bytes into a destination of size 32 48 | snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version), | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 49 | "%d.%d.%04d (%.16s)", | ~~~~~~~~~~~~~~~~~~~~~ 50 | fw_rev_maj(mdev), fw_rev_min(mdev), fw_rev_sub(mdev), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 51 | mdev->board_id); | ~~~~~~~~~~~~~~~ Fixes: 84e11edb71de ("net/mlx5e: Show board id in ethtool driver information") Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d4ab2e97dcfbcd748ae71761a9d8e5e41cc732c Signed-off-by: Rahul Rameshbabu Reviewed-by: Dragos Tatulea Signed-off-by: Saeed Mahameed Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit dce94142842e119b982c27c1b62bd20890c7fd21 Author: Saeed Mahameed Date: Tue Nov 14 13:58:44 2023 -0800 net/mlx5e: Reduce the size of icosq_str icosq_str size is unnecessarily too long, and it causes a build warning -Wformat-truncation with W=1. Looking closely, It doesn't need to be 255B, hence this patch reduces the size to 32B which should be more than enough to host the string: "ICOSQ: 0x%x, ". While here, add a missing space in the formatted string. This fixes the following build warning: $ KCFLAGS='-Wall -Werror' $ make O=/tmp/kbuild/linux W=1 -s -j12 drivers/net/ethernet/mellanox/mlx5/core/ drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c: In function 'mlx5e_reporter_rx_timeout': drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c:718:56: error: ', CQ: 0x' directive output may be truncated writing 8 bytes into a region of size between 0 and 255 [-Werror=format-truncation=] 718 | "RX timeout on channel: %d, %sRQ: 0x%x, CQ: 0x%x", | ^~~~~~~~ drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c:717:9: note: 'snprintf' output between 43 and 322 bytes into a destination of size 288 717 | snprintf(err_str, sizeof(err_str), | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 718 | "RX timeout on channel: %d, %sRQ: 0x%x, CQ: 0x%x", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 719 | rq->ix, icosq_str, rq->rqn, rq->cq.mcq.cqn); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: 521f31af004a ("net/mlx5e: Allow RQ outside of channel context") Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d4ab2e97dcfbcd748ae71761a9d8e5e41cc732c Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20231114215846.5902-14-saeed@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3338bebfc26a1e2cebbba82a1cf12c0159608e73 Author: Rahul Rameshbabu Date: Tue Nov 14 13:58:43 2023 -0800 net/mlx5: Increase size of irq name buffer Without increased buffer size, will trigger -Wformat-truncation with W=1 for the snprintf operation writing to the buffer. drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c: In function 'mlx5_irq_alloc': drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c:296:7: error: '@pci:' directive output may be truncated writing 5 bytes into a region of size between 1 and 32 [-Werror=format-truncation=] 296 | "%s@pci:%s", name, pci_name(dev->pdev)); | ^~~~~ drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c:295:2: note: 'snprintf' output 6 or more bytes (assuming 37) into a destination of size 32 295 | snprintf(irq->name, MLX5_MAX_IRQ_NAME, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 296 | "%s@pci:%s", name, pci_name(dev->pdev)); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: ada9f5d00797 ("IB/mlx5: Fix eq names to display nicely in /proc/interrupts") Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d4ab2e97dcfbcd748ae71761a9d8e5e41cc732c Signed-off-by: Rahul Rameshbabu Reviewed-by: Dragos Tatulea Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20231114215846.5902-13-saeed@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c | 6 +++--- drivers/net/ethernet/mellanox/mlx5/core/pci_irq.h | 3 +++ 2 files changed, 6 insertions(+), 3 deletions(-) commit 92214be5979c0961a471b7eaaaeacab41bdf456c Author: Rahul Rameshbabu Date: Tue Nov 14 13:58:42 2023 -0800 net/mlx5e: Update doorbell for port timestamping CQ before the software counter Previously, mlx5e_ptp_poll_ts_cq would update the device doorbell with the incremented consumer index after the relevant software counters in the kernel were updated. In the mlx5e_sq_xmit_wqe context, this would lead to either overrunning the device CQ or exceeding the expected software buffer size in the device CQ if the device CQ size was greater than the software buffer size. Update the relevant software counter only after updating the device CQ consumer index in the port timestamping napi_poll context. Log: mlx5_core 0000:08:00.0: cq_err_event_notifier:517:(pid 0): CQ error on CQN 0x487, syndrome 0x1 mlx5_core 0000:08:00.0 eth2: mlx5e_cq_error_event: cqn=0x000487 event=0x04 Fixes: 1880bc4e4a96 ("net/mlx5e: Add TX port timestamp support") Signed-off-by: Rahul Rameshbabu Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20231114215846.5902-12-saeed@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) commit 7e3f3ba97e6cc6fce5bf62df2ca06c8e59040167 Author: Rahul Rameshbabu Date: Tue Nov 14 13:58:41 2023 -0800 net/mlx5e: Track xmit submission to PTP WQ after populating metadata map Ensure the skb is available in metadata mapping to skbs before tracking the metadata index for detecting undelivered CQEs. If the metadata index is put in the tracking list before putting the skb in the map, the metadata index might be used for detecting undelivered CQEs before the relevant skb is available in the map, which can lead to a null-ptr-deref. Log: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 0 PID: 1243 Comm: kworker/0:2 Not tainted 6.6.0-rc4+ #108 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: events mlx5e_rx_dim_work [mlx5_core] RIP: 0010:mlx5e_ptp_napi_poll+0x9a4/0x2290 [mlx5_core] Code: 8c 24 38 cc ff ff 4c 8d 3c c1 4c 89 f9 48 c1 e9 03 42 80 3c 31 00 0f 85 97 0f 00 00 4d 8b 3f 49 8d 7f 28 48 89 f9 48 c1 e9 03 <42> 80 3c 31 00 0f 85 8b 0f 00 00 49 8b 47 28 48 85 c0 0f 84 05 07 RSP: 0018:ffff8884d3c09c88 EFLAGS: 00010206 RAX: 0000000000000069 RBX: ffff8881160349d8 RCX: 0000000000000005 RDX: ffffed10218f48cf RSI: 0000000000000004 RDI: 0000000000000028 RBP: ffff888122707700 R08: 0000000000000001 R09: ffffed109a781383 R10: 0000000000000003 R11: 0000000000000003 R12: ffff88810c7a7a40 R13: ffff888122707700 R14: dffffc0000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8884d3c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4f878dd6e0 CR3: 000000014d108002 CR4: 0000000000370eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? die_addr+0x3c/0xa0 ? exc_general_protection+0x144/0x210 ? asm_exc_general_protection+0x22/0x30 ? mlx5e_ptp_napi_poll+0x9a4/0x2290 [mlx5_core] ? mlx5e_ptp_napi_poll+0x8f6/0x2290 [mlx5_core] __napi_poll.constprop.0+0xa4/0x580 net_rx_action+0x460/0xb80 ? _raw_spin_unlock_irqrestore+0x32/0x60 ? __napi_poll.constprop.0+0x580/0x580 ? tasklet_action_common.isra.0+0x2ef/0x760 __do_softirq+0x26c/0x827 irq_exit_rcu+0xc2/0x100 common_interrupt+0x7f/0xa0 asm_common_interrupt+0x22/0x40 RIP: 0010:__kmem_cache_alloc_node+0xb/0x330 Code: 41 5d 41 5e 41 5f c3 8b 44 24 14 8b 4c 24 10 09 c8 eb d5 e8 b7 43 ca 01 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 57 <41> 56 41 89 d6 41 55 41 89 f5 41 54 49 89 fc 53 48 83 e4 f0 48 83 RSP: 0018:ffff88812c4079c0 EFLAGS: 00000246 RAX: 1ffffffff083c7fe RBX: ffff888100042dc0 RCX: 0000000000000218 RDX: 00000000ffffffff RSI: 0000000000000dc0 RDI: ffff888100042dc0 RBP: ffff88812c4079c8 R08: ffffffffa0289f96 R09: ffffed1025880ea9 R10: ffff888138839f80 R11: 0000000000000002 R12: 0000000000000dc0 R13: 0000000000000100 R14: 000000000000008c R15: ffff8881271fc450 ? cmd_exec+0x796/0x2200 [mlx5_core] kmalloc_trace+0x26/0xc0 cmd_exec+0x796/0x2200 [mlx5_core] mlx5_cmd_do+0x22/0xc0 [mlx5_core] mlx5_cmd_exec+0x17/0x30 [mlx5_core] mlx5_core_modify_cq_moderation+0x139/0x1b0 [mlx5_core] ? mlx5_add_cq_to_tasklet+0x280/0x280 [mlx5_core] ? lockdep_set_lock_cmp_fn+0x190/0x190 ? process_one_work+0x659/0x1220 mlx5e_rx_dim_work+0x9d/0x100 [mlx5_core] process_one_work+0x730/0x1220 ? lockdep_hardirqs_on_prepare+0x400/0x400 ? max_active_store+0xf0/0xf0 ? assign_work+0x168/0x240 worker_thread+0x70f/0x12d0 ? __kthread_parkme+0xd1/0x1d0 ? process_one_work+0x1220/0x1220 kthread+0x2d9/0x3b0 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x2d/0x70 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork_asm+0x11/0x20 Modules linked in: xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay mlx5_ib ib_uverbs ib_core zram zsmalloc mlx5_core fuse ---[ end trace 0000000000000000 ]--- Fixes: 3178308ad4ca ("net/mlx5e: Make tx_port_ts logic resilient to out-of-order CQEs") Signed-off-by: Rahul Rameshbabu Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20231114215846.5902-11-saeed@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 64f14d16eef1f939000f2617b50c7c996b5117d4 Author: Rahul Rameshbabu Date: Tue Nov 14 13:58:40 2023 -0800 net/mlx5e: Avoid referencing skb after free-ing in drop path of mlx5e_sq_xmit_wqe When SQ is a port timestamping SQ for PTP, do not access tx flags of skb after free-ing the skb. Free the skb only after all references that depend on it have been handled in the dropped WQE path. Fixes: 3178308ad4ca ("net/mlx5e: Make tx_port_ts logic resilient to out-of-order CQEs") Signed-off-by: Rahul Rameshbabu Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20231114215846.5902-10-saeed@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bdf788cf224f61c20a01c58c00685d394d57887f Author: Jianbo Liu Date: Tue Nov 14 13:58:39 2023 -0800 net/mlx5e: Don't modify the peer sent-to-vport rules for IPSec offload As IPSec packet offload in switchdev mode is not supported with LAG, it's unnecessary to modify those sent-to-vport rules to the peer eswitch. Fixes: c6c2bf5db4ea ("net/mlx5e: Support IPsec packet offload for TX in switchdev mode") Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20231114215846.5902-9-saeed@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 0c101a23ca7eaf00eef1328eefb04b3a93401cc8 Author: Vlad Buslov Date: Tue Nov 14 13:58:38 2023 -0800 net/mlx5e: Fix pedit endianness Referenced commit addressed endianness issue in mlx5 pedit implementation in ad hoc manner instead of systematically treating integer values according to their types which left pedit fields of sizes not equal to 4 and where the bytes being modified are not least significant ones broken on big endian machines since wrong bits will be consumed during parsing which leads to following example error when applying pedit to source and destination MAC addresses: [Wed Oct 18 12:52:42 2023] mlx5_core 0001:00:00.1 p1v3_r: attempt to offload an unsupported field (cmd 0) [Wed Oct 18 12:52:42 2023] mask: 00000000330c5b68: 00 00 00 00 ff ff 00 00 00 00 ff ff 00 00 00 00 ................ [Wed Oct 18 12:52:42 2023] mask: 0000000017d22fd9: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [Wed Oct 18 12:52:42 2023] mask: 000000008186d717: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [Wed Oct 18 12:52:42 2023] mask: 0000000029eb6149: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [Wed Oct 18 12:52:42 2023] mask: 000000007ed103e4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [Wed Oct 18 12:52:42 2023] mask: 00000000db8101a6: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [Wed Oct 18 12:52:42 2023] mask: 00000000ec3c08a9: 00 00 00 00 00 00 00 00 00 00 00 00 ............ Treat masks and values of pedit and filter match as network byte order, refactor pointers to them to void pointers instead of confusing u32 pointers and only cast to pointer-to-integer when reading a value from them. Treat pedit mlx5_fields->field_mask as host byte order according to its type u32, change the constants in fields array accordingly. Fixes: 82198d8bcdef ("net/mlx5e: Fix endianness when calculating pedit mask first bit") Signed-off-by: Vlad Buslov Reviewed-by: Gal Pressman Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20231114215846.5902-8-saeed@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 60 +++++++++++++------------ 1 file changed, 32 insertions(+), 28 deletions(-) commit 3a4aa3cb83563df942be49d145ee3b7ddf17d6bb Author: Gavin Li Date: Tue Nov 14 13:58:37 2023 -0800 net/mlx5e: fix double free of encap_header in update funcs Follow up to the previous patch to fix the same issue for mlx5e_tc_tun_update_header_ipv4{6} when mlx5_packet_reformat_alloc() fails. When mlx5_packet_reformat_alloc() fails, the encap_header allocated in mlx5e_tc_tun_update_header_ipv4{6} will be released within it. However, e->encap_header is already set to the previously freed encap_header before mlx5_packet_reformat_alloc(). As a result, the later mlx5e_encap_put() will free e->encap_header again, causing a double free issue. mlx5e_encap_put() --> mlx5e_encap_dealloc() --> kfree(e->encap_header) This patch fix it by not setting e->encap_header until mlx5_packet_reformat_alloc() success. Fixes: a54e20b4fcae ("net/mlx5e: Add basic TC tunnel set action for SRIOV offloads") Signed-off-by: Gavin Li Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20231114215846.5902-7-saeed@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit 6f9b1a0731662648949a1c0587f6acb3b7f8acf1 Author: Dust Li Date: Tue Nov 14 13:58:36 2023 -0800 net/mlx5e: fix double free of encap_header When mlx5_packet_reformat_alloc() fails, the encap_header allocated in mlx5e_tc_tun_create_header_ipv4{6} will be released within it. However, e->encap_header is already set to the previously freed encap_header before mlx5_packet_reformat_alloc(). As a result, the later mlx5e_encap_put() will free e->encap_header again, causing a double free issue. mlx5e_encap_put() --> mlx5e_encap_dealloc() --> kfree(e->encap_header) This happens when cmd: MLX5_CMD_OP_ALLOC_PACKET_REFORMAT_CONTEXT fail. This patch fix it by not setting e->encap_header until mlx5_packet_reformat_alloc() success. Fixes: d589e785baf5e ("net/mlx5e: Allow concurrent creation of encap entries") Reported-by: Cruz Zhao Reported-by: Tianchen Ding Signed-off-by: Dust Li Reviewed-by: Wojciech Drewek Signed-off-by: Saeed Mahameed Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit fd64fd13c49a53012ce9170449dcd9eb71c11284 Author: Rahul Rameshbabu Date: Tue Nov 14 13:58:35 2023 -0800 net/mlx5: Decouple PHC .adjtime and .adjphase implementations When running a phase adjustment operation, the free running clock should not be modified at all. The phase control keyword is intended to trigger an internal servo on the device that will converge to the provided delta. A free running counter cannot implement phase adjustment. Fixes: 8e11a68e2e8a ("net/mlx5: Add adjphase function to support hardware-only offset control") Signed-off-by: Rahul Rameshbabu Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20231114215846.5902-5-saeed@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit ad4d82c3eacdd500a246af736e6e01d96484e35e Author: Erez Shitrit Date: Tue Nov 14 13:58:34 2023 -0800 net/mlx5: DR, Allow old devices to use multi destination FTE The current check isn't aware of old devices that don't have the relevant FW capability. This patch allows multi destination FTE in old cards, as it was before this check. Fixes: f6f46e7173cb ("net/mlx5: DR, Add check for multi destination FTE") Signed-off-by: Erez Shitrit Reviewed-by: Yevgeny Kliteynik Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20231114215846.5902-4-saeed@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 7d2f74d1d4385a5bcf90618537f16a45121c30ae Author: Maher Sanalla Date: Tue Nov 14 13:58:33 2023 -0800 net/mlx5: Free used cpus mask when an IRQ is released Each EQ table maintains a cpumask of the already used CPUs that are mapped to IRQs to ensure that each IRQ gets mapped to a unique CPU. However, on IRQ release, the said cpumask is not updated by clearing the CPU from the mask to allow future IRQ request, causing the following error when a SF is reloaded after it has utilized all CPUs for its IRQs: mlx5_irq_affinity_request:135:(pid 306010): Didn't find a matching IRQ. err = -28 Thus, when releasing an IRQ, clear its mapped CPU from the used CPUs mask, to prevent the case described above. While at it, move the used cpumask update to the EQ layer as it is more fitting and preserves symmetricity of the IRQ request/release API. Fixes: a1772de78d73 ("net/mlx5: Refactor completion IRQ request/release API") Signed-off-by: Maher Sanalla Reviewed-by: Tariq Toukan Reviewed-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20231114215846.5902-3-saeed@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/eq.c | 25 +++++++++---- .../net/ethernet/mellanox/mlx5/core/irq_affinity.c | 42 ---------------------- 2 files changed, 19 insertions(+), 48 deletions(-) commit df3aafe501853c92bc9e25b05dcb030fee072962 Author: Itamar Gozlan Date: Tue Nov 14 13:58:32 2023 -0800 Revert "net/mlx5: DR, Supporting inline WQE when possible" This reverts commit 95c337cce0e11d06a715da73e6796ade9216637f. The revert is required due to the suspicion it cause some tests fail and will be moved to further investigation. Fixes: 95c337cce0e1 ("net/mlx5: DR, Supporting inline WQE when possible") Signed-off-by: Itamar Gozlan Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/r/20231114215846.5902-2-saeed@kernel.org Signed-off-by: Jakub Kicinski .../ethernet/mellanox/mlx5/core/steering/dr_send.c | 115 +++------------------ 1 file changed, 13 insertions(+), 102 deletions(-) commit a6a6a0a9fdb03af10513b5bb48e5419563f54413 Merge: 674e31808946 1fda5bb66ad8 Author: Jakub Kicinski Date: Wed Nov 15 22:28:02 2023 -0800 Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== pull-request: bpf 2023-11-15 We've added 7 non-merge commits during the last 6 day(s) which contain a total of 9 files changed, 200 insertions(+), 49 deletions(-). The main changes are: 1) Do not allocate bpf specific percpu memory unconditionally, from Yonghong. 2) Fix precision backtracking instruction iteration, from Andrii. 3) Fix control flow graph checking, from Andrii. 4) Fix xskxceiver selftest build, from Anders. * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Do not allocate percpu memory at init stage selftests/bpf: add more test cases for check_cfg() bpf: fix control-flow graph checking in privileged mode selftests/bpf: add edge case backtracking logic test bpf: fix precision backtracking instruction iteration bpf: handle ldimm64 properly in check_cfg() selftests: bpf: xskxceiver: ksft_print_msg: fix format type error ==================== Link: https://lore.kernel.org/r/20231115214949.48854-1-alexei.starovoitov@gmail.com Signed-off-by: Jakub Kicinski commit afccb0804fc74ac2f6737af6a139632606cb461d Author: Ryan Roberts Date: Tue Nov 14 15:49:45 2023 +0000 mm: more ptep_get() conversion Commit c33c794828f2 ("mm: ptep_get() conversion") converted all (non-arch) call sites to use ptep_get() instead of doing a direct dereference of the pte. Full rationale can be found in that commit's log. Since then, three new call sites have snuck in, which directly dereference the pte, so let's fix those up. Unfortunately there is no reliable automated mechanism to catch these; I'm relying on a combination of Coccinelle (which throws up a lot of false positives) and some compiler magic to force a compiler error on dereference (While this approach finds dereferences, it also yields a non-booting kernel so can't be committed). Link: https://lkml.kernel.org/r/20231114154945.490401-1-ryan.roberts@arm.com Signed-off-by: Ryan Roberts Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton mm/filemap.c | 2 +- mm/ksm.c | 2 +- mm/userfaultfd.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit 5f74f820f6fc844b95f9e5e406e0a07d97510420 Author: Helge Deller Date: Mon Nov 13 11:12:57 2023 +0100 parisc: fix mmap_base calculation when stack grows upwards Matoro reported various userspace crashes on the parisc platform with kernel 6.6 and bisected it to commit 3033cd430768 ("parisc: Use generic mmap top-down layout and brk randomization"). That commit switched parisc to use the common infrastructure to calculate mmap_base, but missed that the mmap_base() function takes care for architectures where the stack grows downwards only. Fix the mmap_base() calculation to include the stack-grows-upwards case and thus fix the userspace crashes on parisc. Link: https://lkml.kernel.org/r/ZVH2qeS1bG7/1J/l@p100 Fixes: 3033cd430768 ("parisc: Use generic mmap top-down layout and brk randomization") Signed-off-by: Helge Deller Reported-by: matoro Tested-by: matoro Cc: [6.6+] Signed-off-by: Andrew Morton arch/parisc/Kconfig | 6 +++--- arch/parisc/include/asm/elf.h | 10 +--------- arch/parisc/include/asm/processor.h | 2 ++ arch/parisc/kernel/sys_parisc.c | 2 +- mm/util.c | 10 ++++++++++ 5 files changed, 17 insertions(+), 13 deletions(-) commit 13b2a4b22e98ff80b888a160a2acd92d81b05925 Author: Hyeongtak Ji Date: Fri Nov 10 14:37:09 2023 +0900 mm/damon/core.c: avoid unintentional filtering out of schemes The function '__damos_filter_out()' causes DAMON to always filter out schemes whose filter type is anon or memcg if its matching value is set to false. This commit addresses the issue by ensuring that '__damos_filter_out()' no longer applies to filters whose type is 'anon' or 'memcg'. Link: https://lkml.kernel.org/r/1699594629-3816-1-git-send-email-hyeongtak.ji@gmail.com Fixes: ab9bda001b681 ("mm/damon/core: introduce address range type damos filter") Signed-off-by: Hyeongtak Ji Reviewed-by: SeongJae Park Cc: Signed-off-by: Andrew Morton mm/damon/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 24948e3b7b12e0031a6edb4f49bbb9fb2ad1e4e9 Author: Roman Gushchin Date: Tue Nov 7 09:18:02 2023 -0800 mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors Objcg vectors attached to slab pages to store slab object ownership information are allocated using gfp flags for the original slab allocation. Depending on slab page order and the size of slab objects, objcg vector can take several pages. If the original allocation was done with the __GFP_NOFAIL flag, it triggered a warning in the page allocation code. Indeed, order > 1 pages should not been allocated with the __GFP_NOFAIL flag. Fix this by simply dropping the __GFP_NOFAIL flag when allocating the objcg vector. It effectively allows to skip the accounting of a single slab object under a heavy memory pressure. An alternative would be to implement the mechanism to fallback to order-0 allocations for accounting metadata, which is also not perfect because it will increase performance penalty and memory footprint of the kernel memory accounting under memory pressure. Link: https://lkml.kernel.org/r/ZUp8ZFGxwmCx4ZFr@P9FQF9L96D.corp.robot.car Signed-off-by: Roman Gushchin Reported-by: Christoph Lameter Closes: https://lkml.kernel.org/r/6b42243e-f197-600a-5d22-56bd728a5ad8@gentwo.org Acked-by: Shakeel Butt Cc: Matthew Wilcox Cc: Signed-off-by: Andrew Morton mm/memcontrol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit ae636ae2bbfd9279f5681dbf320d1da817e52b68 Author: SeongJae Park Date: Mon Nov 6 23:34:08 2023 +0000 mm/damon/sysfs-schemes: handle tried region directory allocation failure DAMON sysfs interface's before_damos_apply callback (damon_sysfs_before_damos_apply()), which creates the DAMOS tried regions for each DAMOS action applied region, is not handling the allocation failure for the sysfs directory data. As a result, NULL pointer derefeence is possible. Fix it by handling the case. Link: https://lkml.kernel.org/r/20231106233408.51159-4-sj@kernel.org Fixes: f1d13cacabe1 ("mm/damon/sysfs: implement DAMOS tried regions update command") Signed-off-by: SeongJae Park Cc: [6.2+] Signed-off-by: Andrew Morton mm/damon/sysfs-schemes.c | 2 ++ 1 file changed, 2 insertions(+) commit 84055688b6bc075c92a88e2d6c3ad26ab93919f9 Author: SeongJae Park Date: Mon Nov 6 23:34:07 2023 +0000 mm/damon/sysfs-schemes: handle tried regions sysfs directory allocation failure DAMOS tried regions sysfs directory allocation function (damon_sysfs_scheme_regions_alloc()) is not handling the memory allocation failure. In the case, the code will dereference NULL pointer. Handle the failure to avoid such invalid access. Link: https://lkml.kernel.org/r/20231106233408.51159-3-sj@kernel.org Fixes: 9277d0367ba1 ("mm/damon/sysfs-schemes: implement scheme region directory") Signed-off-by: SeongJae Park Cc: [6.2+] Signed-off-by: Andrew Morton mm/damon/sysfs-schemes.c | 3 +++ 1 file changed, 3 insertions(+) commit b4936b544b08ed44949055b92bd25f77759ebafc Author: SeongJae Park Date: Mon Nov 6 23:34:06 2023 +0000 mm/damon/sysfs: check error from damon_sysfs_update_target() Patch series "mm/damon/sysfs: fix unhandled return values". Some of DAMON sysfs interface code is not handling return values from some functions. As a result, confusing user input handling or NULL-dereference is possible. Check those properly. This patch (of 3): damon_sysfs_update_target() returns error code for failures, but its caller, damon_sysfs_set_targets() is ignoring that. The update function seems making no critical change in case of such failures, but the behavior will look like DAMON sysfs is silently ignoring or only partially accepting the user input. Fix it. Link: https://lkml.kernel.org/r/20231106233408.51159-1-sj@kernel.org Link: https://lkml.kernel.org/r/20231106233408.51159-2-sj@kernel.org Fixes: 19467a950b49 ("mm/damon/sysfs: remove requested targets when online-commit inputs") Signed-off-by: SeongJae Park Cc: [5.19+] Signed-off-by: Andrew Morton mm/damon/sysfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit a48d5bdc877b85201e42cef9c2fdf5378164c23a Author: Stefan Roesch Date: Mon Nov 6 10:19:18 2023 -0800 mm: fix for negative counter: nr_file_hugepages While qualifiying the 6.4 release, the following warning was detected in messages: vmstat_refresh: nr_file_hugepages -15664 The warning is caused by the incorrect updating of the NR_FILE_THPS counter in the function split_huge_page_to_list. The if case is checking for folio_test_swapbacked, but the else case is missing the check for folio_test_pmd_mappable. The other functions that manipulate the counter like __filemap_add_folio and filemap_unaccount_folio have the corresponding check. I have a test case, which reproduces the problem. It can be found here: https://github.com/sroeschus/testcase/blob/main/vmstat_refresh/madv.c The test case reproduces on an XFS filesystem. Running the same test case on a BTRFS filesystem does not reproduce the problem. AFAIK version 6.1 until 6.6 are affected by this problem. [akpm@linux-foundation.org: whitespace fix] [shr@devkernel.io: test for folio_test_pmd_mappable()] Link: https://lkml.kernel.org/r/20231108171517.2436103-1-shr@devkernel.io Link: https://lkml.kernel.org/r/20231106181918.1091043-1-shr@devkernel.io Signed-off-by: Stefan Roesch Co-debugged-by: Johannes Weiner Acked-by: Johannes Weiner Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: David Hildenbrand Reviewed-by: Yang Shi Cc: Rik van Riel Cc: Signed-off-by: Andrew Morton mm/huge_memory.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) commit edf14544324dd036183fafe372fe5709708bdddd Author: Breno Leitao Date: Fri Nov 3 10:34:00 2023 -0700 selftests/mm: add hugetlb_fault_after_madv to .gitignore commit 116d57303a05 ("selftests/mm: add a new test for madv and hugetlb") added a new test case, but, it didn't add the binary name in tools/testing/selftests/mm/.gitignore. Add hugetlb_fault_after_madv to tools/testing/selftests/mm/.gitignore. Link: https://lkml.kernel.org/r/20231103173400.1608403-2-leitao@debian.org Fixes: 116d57303a05 ("selftests/mm: add a new test for madv and hugetlb") Signed-off-by: Breno Leitao Reported-by: Ryan Roberts Closes: https://lore.kernel.org/all/662df57e-47f1-4c15-9b84-f2f2d587fc5c@arm.com/ Signed-off-by: Andrew Morton tools/testing/selftests/mm/.gitignore | 1 + 1 file changed, 1 insertion(+) commit dd9b35efd719be242e227f9eebad1e50ea5c914f Author: Breno Leitao Date: Fri Nov 3 10:33:59 2023 -0700 selftests/mm: restore number of hugepages The test mm `hugetlb_fault_after_madv` selftest needs one and only one huge page to run, thus it sets `/proc/sys/vm/nr_hugepages` to 1. The problem is that further tests require the previous number of hugepages allocated in order to succeed. Save the number of huge pages before changing it, and restore it once the test finishes, so, further tests could run successfully. Link: https://lkml.kernel.org/r/20231103173400.1608403-1-leitao@debian.org Fixes: 116d57303a05 ("selftests/mm: add a new test for madv and hugetlb") Signed-off-by: Breno Leitao Reported-by: Ryan Roberts Closes: https://lore.kernel.org/all/662df57e-47f1-4c15-9b84-f2f2d587fc5c@arm.com/ Signed-off-by: Andrew Morton tools/testing/selftests/mm/run_vmtests.sh | 3 +++ 1 file changed, 3 insertions(+) commit 9297e5360c3bd777f95d5146dbeda7fb9ba4273a Author: Muhammad Usama Anjum Date: Fri Nov 3 23:23:42 2023 +0500 selftests: mm: fix some build warnings Fix build warnings: pagemap_ioctl.c:1154:38: warning: format `%s' expects a matching `char *' argument [-Wformat=] pagemap_ioctl.c:1162:51: warning: format `%ld' expects argument of type `long int', but argument 2 has type `int' [-Wformat=] pagemap_ioctl.c:1192:51: warning: format `%ld' expects argument of type `long int', but argument 2 has type `int' [-Wformat=] pagemap_ioctl.c:1600:51: warning: format `%ld' expects argument of type `long int', but argument 2 has type `int' [-Wformat=] pagemap_ioctl.c:1628:51: warning: format `%ld' expects argument of type `long int', but argument 2 has type `int' [-Wformat=] Link: https://lkml.kernel.org/r/20231103182343.2874015-2-usama.anjum@collabora.com Fixes: 46fd75d4a3c9 ("selftests: mm: add pagemap ioctl tests") Signed-off-by: Muhammad Usama Anjum Cc: Shuah Khan Cc: Ryan Roberts Signed-off-by: Andrew Morton tools/testing/selftests/mm/pagemap_ioctl.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 019b277b680f5b95135c042c78dd79318d8f9e3c Author: Muhammad Usama Anjum Date: Fri Nov 3 23:23:41 2023 +0500 selftests: mm: skip whole test instead of failure Some architectures don't support userfaultfd. Skip running the whole test on them instead of registering the failure. Link: https://lkml.kernel.org/r/20231103182343.2874015-1-usama.anjum@collabora.com Fixes: 46fd75d4a3c9 ("selftests: mm: add pagemap ioctl tests") Reported-by: Ryan Roberts Closes: https://lore.kernel.org/all/f8463381-2697-49e9-9460-9dc73452830d@arm.com Signed-off-by: Muhammad Usama Anjum Cc: Shuah Khan Signed-off-by: Andrew Morton tools/testing/selftests/mm/pagemap_ioctl.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit 85c2ceaafbd306814a3a4740bf4d95ac26a8b36a Author: Dan Carpenter Date: Mon Nov 6 17:07:40 2023 +0300 mm/damon/sysfs: eliminate potential uninitialized variable warning The "err" variable is not initialized if damon_target_has_pid(ctx) is false and sys_target->regions->nr is zero. Link: https://lkml.kernel.org/r/739e6aaf-a634-4e33-98a8-16546379ec9f@moroto.mountain Fixes: 0bcd216c4741 ("mm/damon/sysfs: update monitoring target regions for online input commit") Signed-off-by: Dan Carpenter Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton mm/damon/sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5d639b60971f003d3a9b2b31f8ec73b0718b5d57 Author: Stefan Binding Date: Wed Nov 15 16:21:16 2023 +0000 ALSA: hda/realtek: Add quirks for HP Laptops These HP laptops use Realtek HDA codec combined with 2 or 4 CS35L41 Amplifiers using SPI with Internal Boost. Signed-off-by: Stefan Binding Cc: Link: https://lore.kernel.org/r/20231115162116.494968-3-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 3 +++ 1 file changed, 3 insertions(+) commit 61cbc08fdb04fd445458b0f4cba7e6929afdfaef Author: Stefan Binding Date: Wed Nov 15 16:21:15 2023 +0000 ALSA: hda/realtek: Add quirks for ASUS 2024 Zenbooks These ASUS Zenbook laptops use Realtek HDA codec combined with 2xCS35L41 Amplifiers using SPI or I2C with External Boost or Internal Boost. Signed-off-by: Stefan Binding Cc: Link: https://lore.kernel.org/r/20231115162116.494968-2-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 4 ++++ 1 file changed, 4 insertions(+) commit ae1aadb1eb8d3cbc52e42bee71d67bd4a71f9f07 Author: Dave Airlie Date: Thu Nov 16 00:39:33 2023 +1000 nouveau: don't fail driver load if no display hw present. If we get back ENODEV don't fail load. There are nvidia devices that don't have display blocks and the driver should work on those. Fixes: 15740541e8f0 ("drm/nouveau/devinit/tu102-: prepare for GSP-RM") Link: https://gitlab.freedesktop.org/drm/nouveau/-/issues/270 Signed-off-by: Dave Airlie Signed-off-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/20231115143933.261287-1-airlied@gmail.com drivers/gpu/drm/nouveau/nouveau_display.c | 5 +++++ 1 file changed, 5 insertions(+) commit c1f342f35f820b33390571293498c3e2e9bc77ec Author: José Pekkarinen Date: Wed Nov 15 16:50:23 2023 +0000 Input: psmouse - enable Synaptics InterTouch for ThinkPad L14 G1 Observed on dmesg of my laptop I see the following output: [ 19.898700] psmouse serio1: synaptics: queried max coordinates: x [..5678], y [..4694] [ 19.936057] psmouse serio1: synaptics: queried min coordinates: x [1266..], y [1162..] [ 19.936076] psmouse serio1: synaptics: Your touchpad (PNP: LEN0411 PNP0f13) says it can support a different bus. If i2c-hid and hid-rmi are not used, you might want to try setting psmouse.synaptics_intertouch to 1 and report this to linux-input@vger.kernel.org. [ 20.008901] psmouse serio1: synaptics: Touchpad model: 1, fw: 10.32, id: 0x1e2a1, caps: 0xf014a3/0x940300/0x12e800/0x500000, board id: 3471, fw id: 2909640 [ 20.008925] psmouse serio1: synaptics: serio: Synaptics pass-through port at isa0060/serio1/input0 [ 20.053344] input: SynPS/2 Synaptics TouchPad as /devices/platform/i8042/serio1/input/input7 [ 20.397608] mousedev: PS/2 mouse device common for all mice This patch will add its pnp id to the smbus list to produce the setup of intertouch for the device. Signed-off-by: José Pekkarinen Link: https://lore.kernel.org/r/20231114063607.71772-1-jose.pekkarinen@foxhound.fi Signed-off-by: Dmitry Torokhov drivers/input/mouse/synaptics.c | 1 + 1 file changed, 1 insertion(+) commit 8049ba5d0a28c7208285e94e71a8df5e41a2e889 Author: Qu Wenruo Date: Sat Nov 11 07:14:57 2023 +1030 btrfs: do not abort transaction if there is already an existing qgroup [BUG] Syzbot reported a regression that after commit 6ed05643ddb1 ("btrfs: create qgroup earlier in snapshot creation") we can trigger transaction abort during snapshot creation: BTRFS: Transaction aborted (error -17) WARNING: CPU: 0 PID: 5057 at fs/btrfs/transaction.c:1778 create_pending_snapshot+0x25f4/0x2b70 fs/btrfs/transaction.c:1778 Modules linked in: CPU: 0 PID: 5057 Comm: syz-executor225 Not tainted 6.6.0-syzkaller-15365-g305230142ae0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 RIP: 0010:create_pending_snapshot+0x25f4/0x2b70 fs/btrfs/transaction.c:1778 Call Trace: create_pending_snapshots+0x195/0x1d0 fs/btrfs/transaction.c:1967 btrfs_commit_transaction+0xf1c/0x3730 fs/btrfs/transaction.c:2440 create_snapshot+0x4a5/0x7e0 fs/btrfs/ioctl.c:845 btrfs_mksubvol+0x5d0/0x750 fs/btrfs/ioctl.c:995 btrfs_mksnapshot+0xb5/0xf0 fs/btrfs/ioctl.c:1041 __btrfs_ioctl_snap_create+0x344/0x460 fs/btrfs/ioctl.c:1294 btrfs_ioctl_snap_create+0x13c/0x190 fs/btrfs/ioctl.c:1321 btrfs_ioctl+0xbbf/0xd40 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xf8/0x170 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f2f791127b9 [CAUSE] The error number is -EEXIST, which can happen for qgroup if there is already an existing qgroup and then we're trying to create a snapshot for it. [FIX] In that case, we can continue creating the snapshot, although it may lead to qgroup inconsistency, it's not so critical to abort the current transaction. So in this case, we can just ignore the non-critical errors, mostly -EEXIST (there is already a qgroup). Reported-by: syzbot+4d81015bc10889fd12ea@syzkaller.appspotmail.com Fixes: 6ed05643ddb1 ("btrfs: create qgroup earlier in snapshot creation") Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/transaction.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1645c283a87c61f84b2bffd81f50724df959b11a Author: Qu Wenruo Date: Tue Oct 24 12:41:11 2023 +1030 btrfs: tree-checker: add type and sequence check for inline backrefs [BUG] There is a bug report that ntfs2btrfs had a bug that it can lead to transaction abort and the filesystem flips to read-only. [CAUSE] For inline backref items, kernel has a strict requirement for their ordered, they must follow the following rules: - All btrfs_extent_inline_ref::type should be in an ascending order - Within the same type, the items should follow a descending order by their sequence number For EXTENT_DATA_REF type, the sequence number is result from hash_extent_data_ref(). For other types, their sequence numbers are btrfs_extent_inline_ref::offset. Thus if there is any code not following above rules, the resulted inline backrefs can prevent the kernel to locate the needed inline backref and lead to transaction abort. [FIX] Ntrfs2btrfs has already fixed the problem, and btrfs-progs has added the ability to detect such problems. For kernel, let's be more noisy and be more specific about the order, so that the next time kernel hits such problem we would reject it in the first place, without leading to transaction abort. Link: https://github.com/kdave/btrfs-progs/pull/622 Reviewed-by: Josef Bacik Signed-off-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/tree-checker.c | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) commit 430143b0d3611f4a9c8434319e5e504244749e79 Author: Brenton Simpson Date: Tue Nov 14 23:38:59 2023 +0000 drm: panel-orientation-quirks: Add quirk for Lenovo Legion Go The Legion Go has a 2560x1600 portrait screen, with the native "up" facing the right controller (90° CW from the rest of the device). Signed-off-by: Brenton Simpson Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20231114233859.274189-1-appsforartists@google.com drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 1fda5bb66ad8fb24ecb3858e61a13a6548428898 Author: Yonghong Song Date: Fri Nov 10 17:39:28 2023 -0800 bpf: Do not allocate percpu memory at init stage Kirill Shutemov reported significant percpu memory consumption increase after booting in 288-cpu VM ([1]) due to commit 41a5db8d8161 ("bpf: Add support for non-fix-size percpu mem allocation"). The percpu memory consumption is increased from 111MB to 969MB. The number is from /proc/meminfo. I tried to reproduce the issue with my local VM which at most supports upto 255 cpus. With 252 cpus, without the above commit, the percpu memory consumption immediately after boot is 57MB while with the above commit the percpu memory consumption is 231MB. This is not good since so far percpu memory from bpf memory allocator is not widely used yet. Let us change pre-allocation in init stage to on-demand allocation when verifier detects there is a need of percpu memory for bpf program. With this change, percpu memory consumption after boot can be reduced signicantly. [1] https://lore.kernel.org/lkml/20231109154934.4saimljtqx625l3v@box.shutemov.name/ Fixes: 41a5db8d8161 ("bpf: Add support for non-fix-size percpu mem allocation") Reported-and-tested-by: Kirill A. Shutemov Signed-off-by: Yonghong Song Acked-by: Hou Tao Link: https://lore.kernel.org/r/20231111013928.948838-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov include/linux/bpf.h | 2 +- kernel/bpf/core.c | 8 +++----- kernel/bpf/verifier.c | 20 ++++++++++++++++++-- 3 files changed, 22 insertions(+), 8 deletions(-) commit bd6da690c27d75cae432c09162d054b34fa2156f Author: Mustafa Ismail Date: Tue Nov 14 11:02:46 2023 -0600 RDMA/irdma: Add wait for suspend on SQD Currently, there is no wait for the QP suspend to complete on a modify to SQD state. Add a wait, after the modify to SQD state, for the Suspend Complete AE. While we are at it, update the suspend timeout value in irdma_prep_tc_change to use IRDMA_EVENT_TIMEOUT_MS too. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Mustafa Ismail Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20231114170246.238-3-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky drivers/infiniband/hw/irdma/hw.c | 6 +++++- drivers/infiniband/hw/irdma/main.c | 2 +- drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/irdma/verbs.c | 21 +++++++++++++++++++++ drivers/infiniband/hw/irdma/verbs.h | 1 + 5 files changed, 29 insertions(+), 3 deletions(-) commit ba12ab66aa83a2340a51ad6e74b284269745138c Author: Mustafa Ismail Date: Tue Nov 14 11:02:45 2023 -0600 RDMA/irdma: Do not modify to SQD on error Remove the modify to SQD before going to ERROR state. It is not needed. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Mustafa Ismail Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20231114170246.238-2-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky drivers/infiniband/hw/irdma/verbs.c | 7 ------- 1 file changed, 7 deletions(-) commit a0d45c3f596be53c1bd8822a1984532d14fdcea9 Author: Jens Axboe Date: Tue Nov 14 09:55:50 2023 -0700 io_uring/fdinfo: remove need for sqpoll lock for thread/pid retrieval A previous commit added a trylock for getting the SQPOLL thread info via fdinfo, but this introduced a regression where we often fail to get it if the thread is busy. For that case, we end up not printing the current CPU and PID info. Rather than rely on this lock, just print the pid we already stored in the io_sq_data struct, and ensure we update the current CPU every time we've slept or potentially rescheduled. The latter won't potentially be 100% accurate, but that wasn't the case before either as the task can get migrated at any time unless it has been pinned at creation time. We retain keeping the io_sq_data dereference inside the ctx->uring_lock, as it has always been, as destruction of the thread and data happen below that. We could make this RCU safe, but there's little point in doing that. With this, we always print the last valid information we had, rather than have spurious outputs with missing information. Fixes: 7644b1a1c9a7 ("io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid") Signed-off-by: Jens Axboe io_uring/fdinfo.c | 9 ++------- io_uring/sqpoll.c | 12 ++++++++++-- 2 files changed, 12 insertions(+), 9 deletions(-) commit 92c47597db7d8fb500a4b04ebd457ec7360279cc Author: Harshit Mogalapalli Date: Mon Nov 13 12:07:40 2023 -0800 platform/x86: hp-bioscfg: Remove unused obj in hp_add_other_attributes() acpi_object *obj is unused in this function, so delete it, also delete a unnecessary kfree(obj); Signed-off-by: Harshit Mogalapalli Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20231113200742.3593548-4-harshit.m.mogalapalli@oracle.com Signed-off-by: Ilpo Järvinen drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 2 -- 1 file changed, 2 deletions(-) commit f40f939917b2b4cbf18450096c0ce1c58ed59fae Author: Harshit Mogalapalli Date: Mon Nov 13 12:07:39 2023 -0800 platform/x86: hp-bioscfg: Fix error handling in hp_add_other_attributes() 'attr_name_kobj' is allocated using kzalloc, but on all the error paths it is not freed, hence we have a memory leak. Fix the error path before kobject_init_and_add() by adding kfree(). kobject_put() must be always called after passing the object to kobject_init_and_add(). Only the error path which is immediately next to kobject_init_and_add() calls kobject_put() and not any other error path after it. Fix the error handling after kobject_init_and_add() by moving the kobject_put() into the goto label err_other_attr_init that is already used by all the error paths after kobject_init_and_add(). Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg") Cc: stable@vger.kernel.org # 6.6.x: c5dbf0416000: platform/x86: hp-bioscfg: Simplify return check in hp_add_other_attributes() Cc: stable@vger.kernel.org # 6.6.x: 5736aa9537c9: platform/x86: hp-bioscfg: move mutex_lock() down in hp_add_other_attributes() Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202309201412.on0VXJGo-lkp@intel.com/ Signed-off-by: Harshit Mogalapalli [ij: Added the stable dep tags] Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20231113200742.3593548-3-harshit.m.mogalapalli@oracle.com Signed-off-by: Ilpo Järvinen drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 9e88b493157a9901fa498f23cc3c9ab82b43ce83 Author: Maarten Lankhorst Date: Wed Nov 15 13:36:25 2023 +0100 ALSA: hda: i915: Alays handle -EPROBE_DEFER It turns out that even if the comment says that the driver can load fine, it's not really the case and no codecs are detected. Specifically for -EPROBE_DEFER, always fail the probe. This fixes a regression when HDA-intel is loaded before i915. Reported-by: Ville Syrjälä Closes: https://lore.kernel.org/r/ZVNUxZzCGcxQzqJX@intel.com Signed-off-by: Maarten Lankhorst Tested-by: Kai Vehmanen Fixes: e6d0c13e9f46 ("ALSA: hda: i915: Remove extra argument from snd_hdac_i915_init") Link: https://gitlab.freedesktop.org/drm/intel/-/issues/9671 Link: https://lore.kernel.org/r/20231115123625.74286-1-maarten.lankhorst@linux.intel.com Signed-off-by: Takashi Iwai sound/pci/hda/hda_intel.c | 3 +++ 1 file changed, 3 insertions(+) commit 5736aa9537c9b8927dec32d3d47c8c31fe560f62 Author: Harshit Mogalapalli Date: Mon Nov 13 12:07:38 2023 -0800 platform/x86: hp-bioscfg: move mutex_lock() down in hp_add_other_attributes() attr_name_kobj's memory allocation is done with mutex_lock() held, this is not needed. Move allocation outside of mutex_lock() so unlock is not needed when allocation fails. Suggested-by: Ilpo Järvinen Signed-off-by: Harshit Mogalapalli Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20231113200742.3593548-2-harshit.m.mogalapalli@oracle.com Signed-off-by: Ilpo Järvinen drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit c5dbf04160005e07e8ca7232a7faa77ab1547ae0 Author: Harshit Mogalapalli Date: Mon Nov 13 12:07:37 2023 -0800 platform/x86: hp-bioscfg: Simplify return check in hp_add_other_attributes() All cases in switch-case have a same goto on error, move the return check out of the switch. This is a cleanup. Signed-off-by: Harshit Mogalapalli Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20231113200742.3593548-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Ilpo Järvinen drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit 7a3c36eef9a5d13b16aa954da54224c9c6bed339 Author: Stuart Hayhurst Date: Tue Nov 14 11:38:08 2023 +0000 platform/x86: ideapad-laptop: Set max_brightness before using it max_brightness is used in ideapad_kbd_bl_brightness_get() before it's set, causing ideapad_kbd_bl_brightness_get() to return -EINVAL sometimes. Fixes: ecaa1867b524 ("platform/x86: ideapad-laptop: Add support for keyboard backlights using KBLC ACPI symbol") Signed-off-by: Stuart Hayhurst Cc: stable@vger.kernel.org Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20231114114055.6220-2-stuart.a.hayhurst@gmail.com Signed-off-by: Ilpo Järvinen drivers/platform/x86/ideapad-laptop.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 9fadd4509966e375952f31ae954ab5eae76f90fe Author: Jithu Joseph Date: Thu Nov 2 12:52:18 2023 -0700 MAINTAINERS: Remove stale entry for SBL platform driver Maurice is no longer with Intel and his e-mail address is no longer active. Remove the stale entry from Slim boot loader section. Signed-off-by: Jithu Joseph Link: https://lore.kernel.org/r/20231102195218.143440-1-jithu.joseph@intel.com Signed-off-by: Ilpo Järvinen MAINTAINERS | 1 - 1 file changed, 1 deletion(-) commit 674e318089468ece99aef4796eaef7add57f36b2 Author: Gal Pressman Date: Tue Nov 14 09:56:18 2023 +0200 net: Fix undefined behavior in netdev name allocation Cited commit removed the strscpy() call and kept the snprintf() only. It is common to use 'dev->name' as the format string before a netdev is registered, this results in 'res' and 'name' pointers being equal. According to POSIX, if copying takes place between objects that overlap as a result of a call to sprintf() or snprintf(), the results are undefined. Add back the strscpy() and use 'buf' as an intermediate buffer. Fixes: 7ad17b04dc7b ("net: trust the bitmap in __dev_alloc_name()") Cc: Jakub Kicinski Reviewed-by: Vlad Buslov Signed-off-by: Gal Pressman Reviewed-by: Jakub Kicinski Reviewed-by: Simon Horman Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller net/core/dev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 4198a9b571065978632276264e01d71d68000ac5 Author: Maria Yu Date: Wed Nov 15 18:28:24 2023 +0800 pinctrl: avoid reload of p state in list iteration When in the list_for_each_entry iteration, reload of p->state->settings with a local setting from old_state will turn the list iteration into an infinite loop. The typical symptom when the issue happens, will be a printk message like: "not freeing pin xx (xxx) as part of deactivating group xxx - it is already used for some other setting". This is a compiler-dependent problem, one instance occurred using Clang version 10.0 on the arm64 architecture with linux version 4.19. Fixes: 6e5e959dde0d ("pinctrl: API changes to support multiple states per device") Signed-off-by: Maria Yu Cc: Link: https://lore.kernel.org/r/20231115102824.23727-1-quic_aiquny@quicinc.com Signed-off-by: Linus Walleij drivers/pinctrl/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 00a614fc3527ba8846e6d823013bcf724e9a68f6 Author: Arnd Bergmann Date: Fri Oct 27 17:26:23 2023 +0200 accel/ivpu: avoid build failure with CONFIG_PM=n The usage count of struct dev_pm_info is an implementation detail that is only available if CONFIG_PM is enabled, so printing it in a debug message causes a build failure in configurations without PM: In file included from include/linux/device.h:15, from include/linux/pci.h:37, from drivers/accel/ivpu/ivpu_pm.c:8: drivers/accel/ivpu/ivpu_pm.c: In function 'ivpu_rpm_get_if_active': drivers/accel/ivpu/ivpu_pm.c:254:51: error: 'struct dev_pm_info' has no member named 'usage_count' 254 | atomic_read(&vdev->drm.dev->power.usage_count)); | ^ include/linux/dev_printk.h:129:48: note: in definition of macro 'dev_printk' 129 | _dev_printk(level, dev, fmt, ##__VA_ARGS__); \ | ^~~~~~~~~~~ drivers/accel/ivpu/ivpu_drv.h:75:17: note: in expansion of macro 'dev_dbg' 75 | dev_dbg((vdev)->drm.dev, "[%s] " fmt, #type, ##args); \ | ^~~~~~~ drivers/accel/ivpu/ivpu_pm.c:253:9: note: in expansion of macro 'ivpu_dbg' 253 | ivpu_dbg(vdev, RPM, "rpm_get_if_active count %d\n", | ^~~~~~~~ The print message does not seem essential, so the easiest workaround is to just remove it. Fixes: c39dc15191c4 ("accel/ivpu: Read clock rate only if device is up") Signed-off-by: Arnd Bergmann Reviewed-by: Stanislaw Gruszka Signed-off-by: Stanislaw Gruszka Link: https://patchwork.freedesktop.org/patch/msgid/20231027152633.528490-1-arnd@kernel.org (cherry picked from commit 1470acbef122c7e2e588f6346ce459c26d0568a2) Signed-off-by: Jacek Lawrynowicz drivers/accel/ivpu/ivpu_pm.c | 3 --- 1 file changed, 3 deletions(-) commit efc0c8363bc6dab2cd540acc886e6097deee8bb9 Author: Niklas Söderlund Date: Mon Nov 13 17:44:12 2023 +0100 dt-bindings: net: ethernet-controller: Fix formatting error When moving the *-internal-delay-ps properties to only apply for RGMII interface modes there where a typo in the text formatting. Signed-off-by: Niklas Söderlund Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller Documentation/devicetree/bindings/net/ethernet-controller.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9e2e7efbbbff69d8340abb56d375dd79d1f5770f Author: Johnathan Mantey Date: Mon Nov 13 08:30:29 2023 -0800 Revert ncsi: Propagate carrier gain/loss events to the NCSI controller This reverts commit 3780bb29311eccb7a1c9641032a112eed237f7e3. The cited commit introduced unwanted behavior. The intent for the commit was to be able to detect carrier loss/gain for just the NIC connected to the BMC. The unwanted effect is a carrier loss for auxiliary paths also causes the BMC to lose carrier. The BMC never regains carrier despite the secondary NIC regaining a link. This change, when merged, needs to be backported to stable kernels. 5.4-stable, 5.10-stable, 5.15-stable, 6.1-stable, 6.5-stable Fixes: 3780bb29311e ("ncsi: Propagate carrier gain/loss events to the NCSI controller") CC: stable@vger.kernel.org Signed-off-by: Johnathan Mantey Reviewed-by: Simon Horman Signed-off-by: David S. Miller net/ncsi/ncsi-aen.c | 5 ----- 1 file changed, 5 deletions(-) commit cee96422e863f0b0e9d3d0c2d617271ef2255858 Author: Juergen Gross Date: Thu Sep 28 11:25:32 2023 +0200 xen/events: remove some info_for_irq() calls in pirq handling Instead of the IRQ number user the struct irq_info pointer as parameter in the internal pirq related functions. This allows to drop some calls of info_for_irq(). Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Signed-off-by: Juergen Gross drivers/xen/events/events_base.c | 117 +++++++++++++++++++++++---------------- 1 file changed, 68 insertions(+), 49 deletions(-) commit 3fcdaf3d7634338c3f5cbfa7451eb0b6b0024844 Author: Juergen Gross Date: Thu Sep 28 09:09:52 2023 +0200 xen/events: modify internal [un]bind interfaces Modify the internal bind- and unbind-interfaces to take a struct irq_info parameter. When allocating a new IRQ pass the pointer from the allocating function further up. This will reduce the number of info_for_irq() calls and make the code more efficient. Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Signed-off-by: Juergen Gross drivers/xen/events/events_base.c | 259 +++++++++++++++++++-------------------- 1 file changed, 124 insertions(+), 135 deletions(-) commit 5dd9ad32d7758b1a76742f394acf0eb3ac8a636a Author: Juergen Gross Date: Wed Sep 27 10:29:02 2023 +0200 xen/events: drop xen_allocate_irqs_dynamic() Instead of having a common function for allocating a single IRQ or a consecutive number of IRQs, split up the functionality into the callers of xen_allocate_irqs_dynamic(). This allows to handle any allocation error in xen_irq_init() gracefully instead of panicing the system. Let xen_irq_init() return the irq_info pointer or NULL in case of an allocation error. Additionally set the IRQ into irq_info already at allocation time, as otherwise the IRQ would be '0' (which is a valid IRQ number) until being set. Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Signed-off-by: Juergen Gross drivers/xen/events/events_base.c | 74 ++++++++++++++++++++++++---------------- 1 file changed, 44 insertions(+), 30 deletions(-) commit c42d9eeef8e5ba9292eda36fd8e3c11f35ee065c Merge: 86d11b0e20c0 782ce431613c Author: Linus Torvalds Date: Tue Nov 14 23:47:12 2023 -0500 Merge tag 'hardening-v6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: - stackleak: add declarations for global functions (Arnd Bergmann) - gcc-plugins: randstruct: Only warn about true flexible arrays (Kees Cook) - gcc-plugins: latent_entropy: Fix description typo (Konstantin Runov) * tag 'hardening-v6.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: gcc-plugins: latent_entropy: Fix typo (args -> argc) in plugin description gcc-plugins: randstruct: Only warn about true flexible arrays stackleak: add declarations for global functions commit 61b85cb0d773115d9a4b20c3e67286844cf73f34 Author: Kent Overstreet Date: Tue Nov 14 18:52:22 2023 -0500 bcachefs: six locks: Fix lost wakeup In percpu reader mode, trylock() for read had a lost wakeup: on failure to get the lock, we may have caused a writer to fail to get the lock, because we temporarily elevated the reader count. We need to check for waiters after decrementing the read count - not before. Signed-off-by: Kent Overstreet fs/bcachefs/six.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 62d73dfc44d54c97e0df6b947f0bccf6c4b8030e Author: Kent Overstreet Date: Sun Nov 12 21:46:52 2023 -0500 bcachefs: Fix no_data_io mode checksum check In no_data_io mode, we expect data checksums to be wrong - don't want to spew the log with them. Signed-off-by: Kent Overstreet fs/bcachefs/io_write.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit db18ef1a02bc2cd924f86b2582302f2c2711b67c Author: Kent Overstreet Date: Mon Nov 13 21:17:19 2023 -0500 bcachefs: Fix bch2_check_nlinks() for snapshots When searching the link table for the matching inode, we were searching for a specific - incorrect - snapshot ID as well, causing us to fail to find the inode. Signed-off-by: Kent Overstreet fs/bcachefs/fsck.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7125063fc6dfb77138b3a100527f3d8f9203ff2a Author: Kent Overstreet Date: Thu Mar 2 23:52:57 2023 -0500 bcachefs: Don't decrease BTREE_ITER_MAX when LOCKDEP=y Running with fewer max btree paths doesn't work anymore when replication is enabled - as we've added e.g. the freespace and bucket gens btrees, we naturally end up needing more btree paths. This is an issue with lockdep, we end up taking more locks than lockdep will track (the MAX_LOCKD_DEPTH constant). But bcachefs as merged does not yet support lockdep anyways, so we can leave that for later. Signed-off-by: Kent Overstreet fs/bcachefs/btree_types.h | 4 ---- 1 file changed, 4 deletions(-) commit 497c57a303590ea69ace23506e182c489e85694d Author: Kent Overstreet Date: Sun Nov 12 17:02:08 2023 -0500 bcachefs: Disable debug log statements The journal read path had some informational log statements preperatory for ZNS support - they're not of interest to users, so we can turn them off. Signed-off-by: Kent Overstreet fs/bcachefs/journal_io.c | 7 +++++++ 1 file changed, 7 insertions(+) commit f42fa17883e73d8509fff5925781d4157db82f00 Author: Kent Overstreet Date: Sun Nov 12 15:47:02 2023 -0500 bcachefs: Fix missing transaction commit In may_delete_deleted_inode(), there's a corner case when a snapshot was taken while we had an unlinked inode: we don't want to delete the inode in the internal (shared) snapshot node, since it might have been reattached in a descendent snapshot. Instead we propagate the key to any snapshot leaves it doesn't exist in, so that it can be deleted there if necessary, and then clear the unlinked flag in the internal node. But we forgot to commit after clearing the unlinked flag, causing us to go into an infinite loop. Signed-off-by: Kent Overstreet fs/bcachefs/inode.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 178c4873fd06c0361d260547ce70fcdc29b74809 Author: Kent Overstreet Date: Sun Nov 12 14:15:35 2023 -0500 bcachefs: Fix error path in bch2_mount() This fixes a bug discovered by generic/388 where sb->s_fs_info was NULL while the superblock was still active - the error path was entirely fubar, and was trying to do something unclear and unecessary. Signed-off-by: Kent Overstreet fs/bcachefs/fs.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit b783fc4d1366658200bf759e1010655a9e2e145c Author: Daniel J Blueman Date: Sun Nov 12 00:38:41 2023 +0000 bcachefs: Fix potential sleeping during mount During mount, bcachefs mount option processing may sleep while allocating a string buffer. Fix this by reference counting in order to take the atomic path. Signed-off-by: Daniel J Blueman Signed-off-by: Kent Overstreet fs/bcachefs/disk_groups.c | 2 ++ 1 file changed, 2 insertions(+) commit 069749688ea4bbaeff0ca3b229b443ea96b03757 Author: Kent Overstreet Date: Sat Nov 11 22:15:59 2023 -0500 bcachefs: Fix iterator leak in may_delete_deleted_inode() may_delete_deleted_inode() was returning without exiting a btree iterator, eventually causing propagate_key_to_snaphot_leaves() to go into an infinite loop hitting btree_trans_too_many_iters(). Signed-off-by: Kent Overstreet fs/bcachefs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 006ccc3090e2f30f5f97857f3946312692a5279e Author: Kent Overstreet Date: Sat Nov 4 22:54:26 2023 -0400 bcachefs: Kill journal pre-reservations This deletes the complicated and somewhat expensive journal pre-reservation machinery in favor of just using journal watermarks: when the journal is more than half full, we run journal reclaim more aggressively, and when the journal is more than 3/4s full we only allow journal reclaim to get new journal reservations. Signed-off-by: Kent Overstreet fs/bcachefs/btree_iter.c | 2 - fs/bcachefs/btree_key_cache.c | 14 ------ fs/bcachefs/btree_trans_commit.c | 36 +------------- fs/bcachefs/btree_types.h | 3 -- fs/bcachefs/btree_update_interior.c | 30 ------------ fs/bcachefs/btree_update_interior.h | 1 - fs/bcachefs/journal.c | 31 ------------ fs/bcachefs/journal.h | 98 ------------------------------------- fs/bcachefs/journal_reclaim.c | 42 ++++++---------- fs/bcachefs/journal_types.h | 26 ---------- fs/bcachefs/trace.h | 11 +---- 11 files changed, 19 insertions(+), 275 deletions(-) commit 86d11b0e20c09e0a91cd2aa57b115000274e2ac5 Merge: 2e6ef8aaba6b 77618db34645 Author: Linus Torvalds Date: Tue Nov 14 23:35:31 2023 -0500 Merge tag 'zstd-linus-v6.7-rc2' of https://github.com/terrelln/linux Pull Zstd fix from Nick Terrell: "Only a single line change to fix a benign UBSAN warning" * tag 'zstd-linus-v6.7-rc2' of https://github.com/terrelln/linux: zstd: Fix array-index-out-of-bounds UBSAN warning commit a133eae83a1fd614751b1a34752716bad5f6409e Merge: 278a370c1766 7cefbe5e1dac Author: Jakub Kicinski Date: Tue Nov 14 20:10:45 2023 -0800 Merge branch 'mptcp-misc-fixes-for-v6-7' Matthieu Baerts says: ==================== mptcp: misc. fixes for v6.7 Here are a few fixes related to MPTCP: - Patch 1 limits GSO max size to ~64K when MPTCP is being used due to a spec limit. 'gso_max_size' can exceed the max value supported by MPTCP since v5.19. - Patch 2 fixes a possible NULL pointer dereference on close that can happen since v6.7-rc1. - Patch 3 avoids sending a RM_ADDR when the corresponding address is no longer tracked locally. A regression for a fix backported to v5.19. - Patch 4 adds a missing lock when changing the IP TOS with setsockopt(). A fix for v5.17. - Patch 5 fixes an expectation when running MPTCP Join selftest with the checksum option (-C). An issue present since v6.1. ==================== Link: https://lore.kernel.org/r/20231114-upstream-net-20231113-mptcp-misc-fixes-6-7-rc2-v1-0-7b9cd6a7b7f4@kernel.org Signed-off-by: Jakub Kicinski commit 7cefbe5e1dacc7236caa77e9d072423f21422fe2 Author: Paolo Abeni Date: Tue Nov 14 00:16:17 2023 +0100 selftests: mptcp: fix fastclose with csum failure Running the mp_join selftest manually with the following command line: ./mptcp_join.sh -z -C leads to some failures: 002 fastclose server test # ... rtx [fail] got 1 MP_RST[s] TX expected 0 # ... rstrx [fail] got 1 MP_RST[s] RX expected 0 The problem is really in the wrong expectations for the RST checks implied by the csum validation. Note that the same check is repeated explicitly in the same test-case, with the correct expectation and pass successfully. Address the issue explicitly setting the correct expectation for the failing checks. Reported-by: Xiumei Mu Fixes: 6bf41020b72b ("selftests: mptcp: update and extend fastclose test-cases") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Link: https://lore.kernel.org/r/20231114-upstream-net-20231113-mptcp-misc-fixes-6-7-rc2-v1-5-7b9cd6a7b7f4@kernel.org Signed-off-by: Jakub Kicinski tools/testing/selftests/net/mptcp/mptcp_join.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7679d34f97b7a09fd565f5729f79fd61b7c55329 Author: Paolo Abeni Date: Tue Nov 14 00:16:16 2023 +0100 mptcp: fix setsockopt(IP_TOS) subflow locking The MPTCP implementation of the IP_TOS socket option uses the lockless variant of the TOS manipulation helper and does not hold such lock at the helper invocation time. Add the required locking. Fixes: ffcacff87cd6 ("mptcp: Support for IP_TOS for MPTCP setsockopt()") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/457 Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts Link: https://lore.kernel.org/r/20231114-upstream-net-20231113-mptcp-misc-fixes-6-7-rc2-v1-4-7b9cd6a7b7f4@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/sockopt.c | 3 +++ 1 file changed, 3 insertions(+) commit 8df220b29282e8b450ea57be62e1eccd4996837c Author: Geliang Tang Date: Tue Nov 14 00:16:15 2023 +0100 mptcp: add validity check for sending RM_ADDR This patch adds the validity check for sending RM_ADDRs for userspace PM in mptcp_pm_remove_addrs(), only send a RM_ADDR when the address is in the anno_list or conn_list. Fixes: 8b1c94da1e48 ("mptcp: only send RM_ADDR in nl_cmd_remove") Cc: stable@vger.kernel.org Signed-off-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts Link: https://lore.kernel.org/r/20231114-upstream-net-20231113-mptcp-misc-fixes-6-7-rc2-v1-3-7b9cd6a7b7f4@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm_netlink.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit d109a7767273d1706b541c22b83a0323823dfde4 Author: Paolo Abeni Date: Tue Nov 14 00:16:14 2023 +0100 mptcp: fix possible NULL pointer dereference on close After the blamed commit below, the MPTCP release callback can dereference the first subflow pointer via __mptcp_set_connected() and send buffer auto-tuning. Such pointer is always expected to be valid, except at socket destruction time, when the first subflow is deleted and the pointer zeroed. If the connect event is handled by the release callback while the msk socket is finally released, MPTCP hits the following splat: general protection fault, probably for non-canonical address 0xdffffc00000000f2: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000790-0x0000000000000797] CPU: 1 PID: 26719 Comm: syz-executor.2 Not tainted 6.6.0-syzkaller-10102-gff269e2cd5ad #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 RIP: 0010:mptcp_subflow_ctx net/mptcp/protocol.h:542 [inline] RIP: 0010:__mptcp_propagate_sndbuf net/mptcp/protocol.h:813 [inline] RIP: 0010:__mptcp_set_connected+0x57/0x3e0 net/mptcp/subflow.c:424 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8a62323c RDX: 00000000000000f2 RSI: ffffffff8a630116 RDI: 0000000000000790 RBP: ffff88803334b100 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000034 R12: ffff88803334b198 R13: ffff888054f0b018 R14: 0000000000000000 R15: ffff88803334b100 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbcb4f75198 CR3: 000000006afb5000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mptcp_release_cb+0xa2c/0xc40 net/mptcp/protocol.c:3405 release_sock+0xba/0x1f0 net/core/sock.c:3537 mptcp_close+0x32/0xf0 net/mptcp/protocol.c:3084 inet_release+0x132/0x270 net/ipv4/af_inet.c:433 inet6_release+0x4f/0x70 net/ipv6/af_inet6.c:485 __sock_release+0xae/0x260 net/socket.c:659 sock_close+0x1c/0x20 net/socket.c:1419 __fput+0x270/0xbb0 fs/file_table.c:394 task_work_run+0x14d/0x240 kernel/task_work.c:180 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xa92/0x2a20 kernel/exit.c:876 do_group_exit+0xd4/0x2a0 kernel/exit.c:1026 get_signal+0x23ba/0x2790 kernel/signal.c:2900 arch_do_signal_or_restart+0x90/0x7f0 arch/x86/kernel/signal.c:309 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x60 kernel/entry/common.c:296 do_syscall_64+0x4b/0x110 arch/x86/entry/common.c:88 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7fb515e7cae9 Code: Unable to access opcode bytes at 0x7fb515e7cabf. RSP: 002b:00007fb516c560c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: 000000000000003c RBX: 00007fb515f9c120 RCX: 00007fb515e7cae9 RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000006 RBP: 00007fb515ec847a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007fb515f9c120 R15: 00007ffc631eb968 To avoid sparkling unneeded conditionals, address the issue explicitly checking msk->first only in the critical place. Fixes: 8005184fd1ca ("mptcp: refactor sndbuf auto-tuning") Cc: stable@vger.kernel.org Reported-by: Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/454 Reported-by: Eric Dumazet Closes: https://lore.kernel.org/netdev/CANn89iLZUA6S2a=K8GObnS62KK6Jt4B7PsAs7meMFooM8xaTgw@mail.gmail.com/ Signed-off-by: Paolo Abeni Reviewed-by: Eric Dumazet Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts Link: https://lore.kernel.org/r/20231114-upstream-net-20231113-mptcp-misc-fixes-6-7-rc2-v1-2-7b9cd6a7b7f4@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/protocol.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 9fce92f050f448a0d1ddd9083ef967d9930f1e52 Author: Paolo Abeni Date: Tue Nov 14 00:16:13 2023 +0100 mptcp: deal with large GSO size After the blamed commit below, the TCP sockets (and the MPTCP subflows) can build egress packets larger than 64K. That exceeds the maximum DSS data size, the length being misrepresent on the wire and the stream being corrupted, as later observed on the receiver: WARNING: CPU: 0 PID: 9696 at net/mptcp/protocol.c:705 __mptcp_move_skbs_from_subflow+0x2604/0x26e0 CPU: 0 PID: 9696 Comm: syz-executor.7 Not tainted 6.6.0-rc5-gcd8bdf563d46 #45 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. RIP: 0010:__mptcp_move_skbs_from_subflow+0x2604/0x26e0 net/mptcp/protocol.c:705 RSP: 0018:ffffc90000006e80 EFLAGS: 00010246 RAX: ffffffff83e9f674 RBX: ffff88802f45d870 RCX: ffff888102ad0000 netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. RDX: 0000000080000303 RSI: 0000000000013908 RDI: 0000000000003908 RBP: ffffc90000007110 R08: ffffffff83e9e078 R09: 1ffff1100e548c8a R10: dffffc0000000000 R11: ffffed100e548c8b R12: 0000000000013908 R13: dffffc0000000000 R14: 0000000000003908 R15: 000000000031cf29 FS: 00007f239c47e700(0000) GS:ffff88811b200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f239c45cd78 CR3: 000000006a66c006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 PKRU: 55555554 Call Trace: mptcp_data_ready+0x263/0xac0 net/mptcp/protocol.c:819 subflow_data_ready+0x268/0x6d0 net/mptcp/subflow.c:1409 tcp_data_queue+0x21a1/0x7a60 net/ipv4/tcp_input.c:5151 tcp_rcv_established+0x950/0x1d90 net/ipv4/tcp_input.c:6098 tcp_v6_do_rcv+0x554/0x12f0 net/ipv6/tcp_ipv6.c:1483 tcp_v6_rcv+0x2e26/0x3810 net/ipv6/tcp_ipv6.c:1749 ip6_protocol_deliver_rcu+0xd6b/0x1ae0 net/ipv6/ip6_input.c:438 ip6_input+0x1c5/0x470 net/ipv6/ip6_input.c:483 ipv6_rcv+0xef/0x2c0 include/linux/netfilter.h:304 __netif_receive_skb+0x1ea/0x6a0 net/core/dev.c:5532 process_backlog+0x353/0x660 net/core/dev.c:5974 __napi_poll+0xc6/0x5a0 net/core/dev.c:6536 net_rx_action+0x6a0/0xfd0 net/core/dev.c:6603 __do_softirq+0x184/0x524 kernel/softirq.c:553 do_softirq+0xdd/0x130 kernel/softirq.c:454 Address the issue explicitly bounding the maximum GSO size to what MPTCP actually allows. Reported-by: Christoph Paasch Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/450 Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts Link: https://lore.kernel.org/r/20231114-upstream-net-20231113-mptcp-misc-fixes-6-7-rc2-v1-1-7b9cd6a7b7f4@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/protocol.c | 4 ++++ 1 file changed, 4 insertions(+) commit 278a370c1766060d2144d6cf0b06c101e1043b6d Author: Ziwei Xiao Date: Mon Nov 13 16:41:44 2023 -0800 gve: Fixes for napi_poll when budget is 0 Netpoll will explicilty pass the polling call with a budget of 0 to indicate it's clearing the Tx path only. For the gve_rx_poll and gve_xdp_poll, they were mistakenly taking the 0 budget as the indication to do all the work. Add check to avoid the rx path and xdp path being called when budget is 0. And also avoid napi_complete_done being called when budget is 0 for netpoll. Fixes: f5cedc84a30d ("gve: Add transmit and receive support") Signed-off-by: Ziwei Xiao Link: https://lore.kernel.org/r/20231114004144.2022268-1-ziweixiao@google.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/google/gve/gve_main.c | 8 +++++++- drivers/net/ethernet/google/gve/gve_rx.c | 4 ---- drivers/net/ethernet/google/gve/gve_tx.c | 4 ---- 3 files changed, 7 insertions(+), 9 deletions(-) commit 67af0bdcd623586176df15994a605a036cee0223 Merge: 9d350b2b0d58 a778616e4cc2 Author: Jakub Kicinski Date: Tue Nov 14 19:56:30 2023 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-11-13 (ice) This series contains updates to ice driver only. Arkadiusz ensures the device is initialized with valid lock status value. He also removes range checking of dpll priority to allow firmware to process the request; supported values are firmware dependent. Finally, he removes setting of can change capability for pins that cannot be changed. Dan restores ability to load a package which doesn't contain a signature segment. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: fix DDP package download for packages without signature segment ice: dpll: fix output pin capabilities ice: dpll: fix check for dpll input priority range ice: dpll: fix initial lock status of dpll ==================== Link: https://lore.kernel.org/r/20231113230551.548489-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 9d350b2b0d5815a381b558db68a152c6658aad3d Merge: 17dd5efe5f36 7c02f6ae676a Author: Jakub Kicinski Date: Tue Nov 14 19:52:14 2023 -0800 Merge branch 'pds_core-fix-irq-index-bug-and-compiler-warnings' Shannon Nelson says: ==================== pds_core: fix irq index bug and compiler warnings The first patch fixes a bug in our interrupt masking where we used the wrong index. The second patch addresses a couple of kernel test robot string truncation warnings. ==================== Link: https://lore.kernel.org/r/20231113183257.71110-1-shannon.nelson@amd.com Signed-off-by: Jakub Kicinski commit 7c02f6ae676a954216a192612040f9a0cde3adf7 Author: Shannon Nelson Date: Mon Nov 13 10:32:57 2023 -0800 pds_core: fix up some format-truncation complaints Our friendly kernel test robot pointed out a couple of potential string truncation issues. None of which were we worried about, but can be relatively easily fixed to quiet the complaints. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202310211736.66syyDpp-lkp@intel.com/ Fixes: 45d76f492938 ("pds_core: set up device and adminq") Signed-off-by: Shannon Nelson Link: https://lore.kernel.org/r/20231113183257.71110-3-shannon.nelson@amd.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/amd/pds_core/core.h | 2 +- drivers/net/ethernet/amd/pds_core/dev.c | 8 ++++++-- drivers/net/ethernet/amd/pds_core/devlink.c | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) commit 09d4c14c6c5e6e781a3879fed7f8e116a18b8c65 Author: Shannon Nelson Date: Mon Nov 13 10:32:56 2023 -0800 pds_core: use correct index to mask irq Use the qcq's interrupt index, not the irq number, to mask the interrupt. Since the irq number can be out of range from the number of possible interrupts, we can end up accessing and potentially scribbling on out-of-range and/or unmapped memory, making the kernel angry. [ 3116.039364] BUG: unable to handle page fault for address: ffffbeea1c3edf84 [ 3116.047059] #PF: supervisor write access in kernel mode [ 3116.052895] #PF: error_code(0x0002) - not-present page [ 3116.058636] PGD 100000067 P4D 100000067 PUD 1001f2067 PMD 10f82e067 PTE 0 [ 3116.066221] Oops: 0002 [#1] SMP NOPTI [ 3116.092948] RIP: 0010:iowrite32+0x9/0x76 [ 3116.190452] Call Trace: [ 3116.193185] [ 3116.195430] ? show_trace_log_lvl+0x1d6/0x2f9 [ 3116.200298] ? show_trace_log_lvl+0x1d6/0x2f9 [ 3116.205166] ? pdsc_adminq_isr+0x43/0x55 [pds_core] [ 3116.210618] ? __die_body.cold+0x8/0xa [ 3116.214806] ? page_fault_oops+0x16d/0x1ac [ 3116.219382] ? exc_page_fault+0xbe/0x13b [ 3116.223764] ? asm_exc_page_fault+0x22/0x27 [ 3116.228440] ? iowrite32+0x9/0x76 [ 3116.232143] pdsc_adminq_isr+0x43/0x55 [pds_core] [ 3116.237627] __handle_irq_event_percpu+0x3a/0x184 [ 3116.243088] handle_irq_event+0x57/0xb0 [ 3116.247575] handle_edge_irq+0x87/0x225 [ 3116.252062] __common_interrupt+0x3e/0xbc [ 3116.256740] common_interrupt+0x7b/0x98 [ 3116.261216] [ 3116.263745] [ 3116.266268] asm_common_interrupt+0x22/0x27 Reported-by: Joao Martins Fixes: 01ba61b55b20 ("pds_core: Add adminq processing and commands") Signed-off-by: Shannon Nelson Link: https://lore.kernel.org/r/20231113183257.71110-2-shannon.nelson@amd.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/amd/pds_core/adminq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 17dd5efe5f36a96bd78012594fabe21efb01186b Author: Alex Pakhunov Date: Mon Nov 13 10:23:50 2023 -0800 tg3: Increment tx_dropped in tg3_tso_bug() tg3_tso_bug() drops a packet if it cannot be segmented for any reason. The number of discarded frames should be incremented accordingly. Signed-off-by: Alex Pakhunov Signed-off-by: Vincent Wong Reviewed-by: Pavan Chebbi Link: https://lore.kernel.org/r/20231113182350.37472-2-alexey.pakhunov@spacex.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/tg3.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 907d1bdb8b2cc0357d03a1c34d2a08d9943760b1 Author: Alex Pakhunov Date: Mon Nov 13 10:23:49 2023 -0800 tg3: Move the [rt]x_dropped counters to tg3_napi This change moves [rt]x_dropped counters to tg3_napi so that they can be updated by a single writer, race-free. Signed-off-by: Alex Pakhunov Signed-off-by: Vincent Wong Reviewed-by: Michael Chan Link: https://lore.kernel.org/r/20231113182350.37472-1-alexey.pakhunov@spacex.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/tg3.c | 38 ++++++++++++++++++++++++++++++++----- drivers/net/ethernet/broadcom/tg3.h | 4 ++-- 2 files changed, 35 insertions(+), 7 deletions(-) commit b6cb4541853c7ee512111b0e7ddf3cb66c99c137 Author: Baruch Siach Date: Mon Nov 13 19:42:50 2023 +0200 net: stmmac: avoid rx queue overrun dma_rx_size can be set as low as 64. Rx budget might be higher than that. Make sure to not overrun allocated rx buffers when budget is larger. Leave one descriptor unused to avoid wrap around of 'dirty_rx' vs 'cur_rx'. Signed-off-by: Baruch Siach Reviewed-by: Serge Semin Fixes: 47dd7a540b8a ("net: add support for STMicroelectronics Ethernet controllers.") Link: https://lore.kernel.org/r/d95413e44c97d4692e72cec13a75f894abeb6998.1699897370.git.baruch@tkos.co.il Signed-off-by: Jakub Kicinski drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 + 1 file changed, 1 insertion(+) commit fa02de9e75889915b554eda1964a631fd019973b Author: Baruch Siach Date: Mon Nov 13 19:42:49 2023 +0200 net: stmmac: fix rx budget limit check The while loop condition verifies 'count < limit'. Neither value change before the 'count >= limit' check. As is this check is dead code. But code inspection reveals a code path that modifies 'count' and then goto 'drain_data' and back to 'read_again'. So there is a need to verify count value sanity after 'read_again'. Move 'read_again' up to fix the count limit check. Fixes: ec222003bd94 ("net: stmmac: Prepare to add Split Header support") Signed-off-by: Baruch Siach Reviewed-by: Serge Semin Link: https://lore.kernel.org/r/d9486296c3b6b12ab3a0515fcd47d56447a07bfc.1699897370.git.baruch@tkos.co.il Signed-off-by: Jakub Kicinski drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 889c58b3155ff4c8e8671c95daef63d6fabbb6b1 Author: Peter Zijlstra Date: Fri Jun 9 12:34:46 2023 +0200 perf/core: Fix cpuctx refcounting Audit of the refcounting turned up that perf_pmu_migrate_context() fails to migrate the ctx refcount. Fixes: bd2756811766 ("perf: Rewrite core context handling") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lkml.kernel.org/r/20230612093539.085862001@infradead.org Cc: include/linux/perf_event.h | 13 ++++++++----- kernel/events/core.c | 17 +++++++++++++++++ 2 files changed, 25 insertions(+), 5 deletions(-) commit c9bd1568d5462f4108417518ce1af7b924acfb6f Author: Peter Zijlstra Date: Tue Nov 14 21:36:13 2023 +0100 futex: Fix hardcoded flags Xi reported that commit 5694289ce183 ("futex: Flag conversion") broke glibc's robust futex tests. This was narrowed down to the change of FLAGS_SHARED from 0x01 to 0x10, at which point Florian noted that handle_futex_death() has a hardcoded flags argument of 1. Change this to: FLAGS_SIZE_32 | FLAGS_SHARED, matching how futex_to_flags() unconditionally sets FLAGS_SIZE_32 for all legacy futex ops. Reported-by: Xi Ruoyao Reported-by: Florian Weimer Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lkml.kernel.org/r/20231114201402.GA25315@noisy.programming.kicks-ass.net Fixes: 5694289ce183 ("futex: Flag conversion") Cc: kernel/futex/core.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 77618db346455129424fadbbaec596a09feaf3bb Author: Nick Terrell Date: Thu Oct 12 12:55:34 2023 -0700 zstd: Fix array-index-out-of-bounds UBSAN warning Zstd used an array of length 1 to mean a flexible array for C89 compatibility. Switch to a C99 flexible array to fix the UBSAN warning. Tested locally by booting the kernel and writing to and reading from a BtrFS filesystem with zstd compression enabled. I was unable to reproduce the issue before the fix, however it is a trivial change. Link: https://lkml.kernel.org/r/20231012213428.1390905-1-nickrterrell@gmail.com Reported-by: syzbot+1f2eb3e8cd123ffce499@syzkaller.appspotmail.com Reported-by: Eric Biggers Reported-by: Kees Cook Signed-off-by: Nick Terrell Reviewed-by: Kees Cook lib/zstd/common/fse_decompress.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 969d90ec212bae4b45bf9d21d7daa30aa6cf055e Author: Paul Moore Date: Tue Nov 14 17:25:48 2023 -0500 audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare() eBPF can end up calling into the audit code from some odd places, and some of these places don't have @current set properly so we end up tripping the `WARN_ON_ONCE(!current->mm)` near the top of `audit_exe_compare()`. While the basic `!current->mm` check is good, the `WARN_ON_ONCE()` results in some scary console messages so let's drop that and just do the regular `!current->mm` check to avoid problems. Cc: Fixes: 47846d51348d ("audit: don't take task_lock() in audit_exe_compare() code path") Reported-by: Artem Savkov Signed-off-by: Paul Moore kernel/audit_watch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a2e36cd56041e277d7d81d35638fd8d9731e21f5 Author: Dave Airlie Date: Tue Nov 7 15:32:55 2023 +1000 nouveau: use an rwlock for the event lock. This allows it to break the following circular locking dependency. Aug 10 07:01:29 dg1test kernel: ====================================================== Aug 10 07:01:29 dg1test kernel: WARNING: possible circular locking dependency detected Aug 10 07:01:29 dg1test kernel: 6.4.0-rc7+ #10 Not tainted Aug 10 07:01:29 dg1test kernel: ------------------------------------------------------ Aug 10 07:01:29 dg1test kernel: wireplumber/2236 is trying to acquire lock: Aug 10 07:01:29 dg1test kernel: ffff8fca5320da18 (&fctx->lock){-...}-{2:2}, at: nouveau_fence_wait_uevent_handler+0x2b/0x100 [nouveau] Aug 10 07:01:29 dg1test kernel: but task is already holding lock: Aug 10 07:01:29 dg1test kernel: ffff8fca41208610 (&event->list_lock#2){-...}-{2:2}, at: nvkm_event_ntfy+0x50/0xf0 [nouveau] Aug 10 07:01:29 dg1test kernel: which lock already depends on the new lock. Aug 10 07:01:29 dg1test kernel: the existing dependency chain (in reverse order) is: Aug 10 07:01:29 dg1test kernel: -> #3 (&event->list_lock#2){-...}-{2:2}: Aug 10 07:01:29 dg1test kernel: _raw_spin_lock_irqsave+0x4b/0x70 Aug 10 07:01:29 dg1test kernel: nvkm_event_ntfy+0x50/0xf0 [nouveau] Aug 10 07:01:29 dg1test kernel: ga100_fifo_nonstall_intr+0x24/0x30 [nouveau] Aug 10 07:01:29 dg1test kernel: nvkm_intr+0x12c/0x240 [nouveau] Aug 10 07:01:29 dg1test kernel: __handle_irq_event_percpu+0x88/0x240 Aug 10 07:01:29 dg1test kernel: handle_irq_event+0x38/0x80 Aug 10 07:01:29 dg1test kernel: handle_edge_irq+0xa3/0x240 Aug 10 07:01:29 dg1test kernel: __common_interrupt+0x72/0x160 Aug 10 07:01:29 dg1test kernel: common_interrupt+0x60/0xe0 Aug 10 07:01:29 dg1test kernel: asm_common_interrupt+0x26/0x40 Aug 10 07:01:29 dg1test kernel: -> #2 (&device->intr.lock){-...}-{2:2}: Aug 10 07:01:29 dg1test kernel: _raw_spin_lock_irqsave+0x4b/0x70 Aug 10 07:01:29 dg1test kernel: nvkm_inth_allow+0x2c/0x80 [nouveau] Aug 10 07:01:29 dg1test kernel: nvkm_event_ntfy_state+0x181/0x250 [nouveau] Aug 10 07:01:29 dg1test kernel: nvkm_event_ntfy_allow+0x63/0xd0 [nouveau] Aug 10 07:01:29 dg1test kernel: nvkm_uevent_mthd+0x4d/0x70 [nouveau] Aug 10 07:01:29 dg1test kernel: nvkm_ioctl+0x10b/0x250 [nouveau] Aug 10 07:01:29 dg1test kernel: nvif_object_mthd+0xa8/0x1f0 [nouveau] Aug 10 07:01:29 dg1test kernel: nvif_event_allow+0x2a/0xa0 [nouveau] Aug 10 07:01:29 dg1test kernel: nouveau_fence_enable_signaling+0x78/0x80 [nouveau] Aug 10 07:01:29 dg1test kernel: __dma_fence_enable_signaling+0x5e/0x100 Aug 10 07:01:29 dg1test kernel: dma_fence_add_callback+0x4b/0xd0 Aug 10 07:01:29 dg1test kernel: nouveau_cli_work_queue+0xae/0x110 [nouveau] Aug 10 07:01:29 dg1test kernel: nouveau_gem_object_close+0x1d1/0x2a0 [nouveau] Aug 10 07:01:29 dg1test kernel: drm_gem_handle_delete+0x70/0xe0 [drm] Aug 10 07:01:29 dg1test kernel: drm_ioctl_kernel+0xa5/0x150 [drm] Aug 10 07:01:29 dg1test kernel: drm_ioctl+0x256/0x490 [drm] Aug 10 07:01:29 dg1test kernel: nouveau_drm_ioctl+0x5a/0xb0 [nouveau] Aug 10 07:01:29 dg1test kernel: __x64_sys_ioctl+0x91/0xd0 Aug 10 07:01:29 dg1test kernel: do_syscall_64+0x3c/0x90 Aug 10 07:01:29 dg1test kernel: entry_SYSCALL_64_after_hwframe+0x72/0xdc Aug 10 07:01:29 dg1test kernel: -> #1 (&event->refs_lock#4){....}-{2:2}: Aug 10 07:01:29 dg1test kernel: _raw_spin_lock_irqsave+0x4b/0x70 Aug 10 07:01:29 dg1test kernel: nvkm_event_ntfy_state+0x37/0x250 [nouveau] Aug 10 07:01:29 dg1test kernel: nvkm_event_ntfy_allow+0x63/0xd0 [nouveau] Aug 10 07:01:29 dg1test kernel: nvkm_uevent_mthd+0x4d/0x70 [nouveau] Aug 10 07:01:29 dg1test kernel: nvkm_ioctl+0x10b/0x250 [nouveau] Aug 10 07:01:29 dg1test kernel: nvif_object_mthd+0xa8/0x1f0 [nouveau] Aug 10 07:01:29 dg1test kernel: nvif_event_allow+0x2a/0xa0 [nouveau] Aug 10 07:01:29 dg1test kernel: nouveau_fence_enable_signaling+0x78/0x80 [nouveau] Aug 10 07:01:29 dg1test kernel: __dma_fence_enable_signaling+0x5e/0x100 Aug 10 07:01:29 dg1test kernel: dma_fence_add_callback+0x4b/0xd0 Aug 10 07:01:29 dg1test kernel: nouveau_cli_work_queue+0xae/0x110 [nouveau] Aug 10 07:01:29 dg1test kernel: nouveau_gem_object_close+0x1d1/0x2a0 [nouveau] Aug 10 07:01:29 dg1test kernel: drm_gem_handle_delete+0x70/0xe0 [drm] Aug 10 07:01:29 dg1test kernel: drm_ioctl_kernel+0xa5/0x150 [drm] Aug 10 07:01:29 dg1test kernel: drm_ioctl+0x256/0x490 [drm] Aug 10 07:01:29 dg1test kernel: nouveau_drm_ioctl+0x5a/0xb0 [nouveau] Aug 10 07:01:29 dg1test kernel: __x64_sys_ioctl+0x91/0xd0 Aug 10 07:01:29 dg1test kernel: do_syscall_64+0x3c/0x90 Aug 10 07:01:29 dg1test kernel: entry_SYSCALL_64_after_hwframe+0x72/0xdc Aug 10 07:01:29 dg1test kernel: -> #0 (&fctx->lock){-...}-{2:2}: Aug 10 07:01:29 dg1test kernel: __lock_acquire+0x14e3/0x2240 Aug 10 07:01:29 dg1test kernel: lock_acquire+0xc8/0x2a0 Aug 10 07:01:29 dg1test kernel: _raw_spin_lock_irqsave+0x4b/0x70 Aug 10 07:01:29 dg1test kernel: nouveau_fence_wait_uevent_handler+0x2b/0x100 [nouveau] Aug 10 07:01:29 dg1test kernel: nvkm_client_event+0xf/0x20 [nouveau] Aug 10 07:01:29 dg1test kernel: nvkm_event_ntfy+0x9b/0xf0 [nouveau] Aug 10 07:01:29 dg1test kernel: ga100_fifo_nonstall_intr+0x24/0x30 [nouveau] Aug 10 07:01:29 dg1test kernel: nvkm_intr+0x12c/0x240 [nouveau] Aug 10 07:01:29 dg1test kernel: __handle_irq_event_percpu+0x88/0x240 Aug 10 07:01:29 dg1test kernel: handle_irq_event+0x38/0x80 Aug 10 07:01:29 dg1test kernel: handle_edge_irq+0xa3/0x240 Aug 10 07:01:29 dg1test kernel: __common_interrupt+0x72/0x160 Aug 10 07:01:29 dg1test kernel: common_interrupt+0x60/0xe0 Aug 10 07:01:29 dg1test kernel: asm_common_interrupt+0x26/0x40 Aug 10 07:01:29 dg1test kernel: other info that might help us debug this: Aug 10 07:01:29 dg1test kernel: Chain exists of: &fctx->lock --> &device->intr.lock --> &event->list_lock#2 Aug 10 07:01:29 dg1test kernel: Possible unsafe locking scenario: Aug 10 07:01:29 dg1test kernel: CPU0 CPU1 Aug 10 07:01:29 dg1test kernel: ---- ---- Aug 10 07:01:29 dg1test kernel: lock(&event->list_lock#2); Aug 10 07:01:29 dg1test kernel: lock(&device->intr.lock); Aug 10 07:01:29 dg1test kernel: lock(&event->list_lock#2); Aug 10 07:01:29 dg1test kernel: lock(&fctx->lock); Aug 10 07:01:29 dg1test kernel: *** DEADLOCK *** Aug 10 07:01:29 dg1test kernel: 2 locks held by wireplumber/2236: Aug 10 07:01:29 dg1test kernel: #0: ffff8fca53177bf8 (&device->intr.lock){-...}-{2:2}, at: nvkm_intr+0x29/0x240 [nouveau] Aug 10 07:01:29 dg1test kernel: #1: ffff8fca41208610 (&event->list_lock#2){-...}-{2:2}, at: nvkm_event_ntfy+0x50/0xf0 [nouveau] Aug 10 07:01:29 dg1test kernel: stack backtrace: Aug 10 07:01:29 dg1test kernel: CPU: 6 PID: 2236 Comm: wireplumber Not tainted 6.4.0-rc7+ #10 Aug 10 07:01:29 dg1test kernel: Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021 Aug 10 07:01:29 dg1test kernel: Call Trace: Aug 10 07:01:29 dg1test kernel: Aug 10 07:01:29 dg1test kernel: dump_stack_lvl+0x5b/0x90 Aug 10 07:01:29 dg1test kernel: check_noncircular+0xe2/0x110 Aug 10 07:01:29 dg1test kernel: __lock_acquire+0x14e3/0x2240 Aug 10 07:01:29 dg1test kernel: lock_acquire+0xc8/0x2a0 Aug 10 07:01:29 dg1test kernel: ? nouveau_fence_wait_uevent_handler+0x2b/0x100 [nouveau] Aug 10 07:01:29 dg1test kernel: ? lock_acquire+0xc8/0x2a0 Aug 10 07:01:29 dg1test kernel: _raw_spin_lock_irqsave+0x4b/0x70 Aug 10 07:01:29 dg1test kernel: ? nouveau_fence_wait_uevent_handler+0x2b/0x100 [nouveau] Aug 10 07:01:29 dg1test kernel: nouveau_fence_wait_uevent_handler+0x2b/0x100 [nouveau] Aug 10 07:01:29 dg1test kernel: nvkm_client_event+0xf/0x20 [nouveau] Aug 10 07:01:29 dg1test kernel: nvkm_event_ntfy+0x9b/0xf0 [nouveau] Aug 10 07:01:29 dg1test kernel: ga100_fifo_nonstall_intr+0x24/0x30 [nouveau] Aug 10 07:01:29 dg1test kernel: nvkm_intr+0x12c/0x240 [nouveau] Aug 10 07:01:29 dg1test kernel: __handle_irq_event_percpu+0x88/0x240 Aug 10 07:01:29 dg1test kernel: handle_irq_event+0x38/0x80 Aug 10 07:01:29 dg1test kernel: handle_edge_irq+0xa3/0x240 Aug 10 07:01:29 dg1test kernel: __common_interrupt+0x72/0x160 Aug 10 07:01:29 dg1test kernel: common_interrupt+0x60/0xe0 Aug 10 07:01:29 dg1test kernel: asm_common_interrupt+0x26/0x40 Aug 10 07:01:29 dg1test kernel: RIP: 0033:0x7fb66174d700 Aug 10 07:01:29 dg1test kernel: Code: c1 e2 05 29 ca 8d 0c 10 0f be 07 84 c0 75 eb 89 c8 c3 0f 1f 84 00 00 00 00 00 f3 0f 1e fa e9 d7 0f fc ff 0f 1f 80 00 00 00 00 0f 1e fa e9 c7 0f fc> Aug 10 07:01:29 dg1test kernel: RSP: 002b:00007ffdd3c48438 EFLAGS: 00000206 Aug 10 07:01:29 dg1test kernel: RAX: 000055bb758763c0 RBX: 000055bb758752c0 RCX: 00000000000028b0 Aug 10 07:01:29 dg1test kernel: RDX: 000055bb758752c0 RSI: 000055bb75887490 RDI: 000055bb75862950 Aug 10 07:01:29 dg1test kernel: RBP: 00007ffdd3c48490 R08: 000055bb75873b10 R09: 0000000000000001 Aug 10 07:01:29 dg1test kernel: R10: 0000000000000004 R11: 000055bb7587f000 R12: 000055bb75887490 Aug 10 07:01:29 dg1test kernel: R13: 000055bb757f6280 R14: 000055bb758875c0 R15: 000055bb757f6280 Aug 10 07:01:29 dg1test kernel: Signed-off-by: Dave Airlie Tested-by: Danilo Krummrich Reviewed-by: Danilo Krummrich Signed-off-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/20231107053255.2257079-1-airlied@gmail.com drivers/gpu/drm/nouveau/include/nvkm/core/event.h | 4 ++-- drivers/gpu/drm/nouveau/nvkm/core/event.c | 12 ++++++------ 2 files changed, 8 insertions(+), 8 deletions(-) commit 42bd415bd8bd43721d423930b4695c565661e687 Author: Dan Carpenter Date: Wed Nov 8 10:40:21 2023 +0300 nouveau/gsp/r535: Fix a NULL vs error pointer bug The r535_gsp_cmdq_get() function returns error pointers but this code checks for NULL. Also we need to propagate the error pointer back to the callers in r535_gsp_rpc_get(). Returning NULL will lead to a NULL pointer dereference. Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM") Signed-off-by: Dan Carpenter Reviewed-by: Danilo Krummrich Signed-off-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/f71996d9-d1cb-45ea-a4b2-2dfc21312d8c@kili.mountain drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 09f12bf9f790052710bd6e48a1fc1bc4d9e17389 Author: Dan Carpenter Date: Tue Nov 7 18:18:31 2023 +0300 nouveau/gsp/r535: uninitialized variable in r535_gsp_acpi_mux_id() The if we hit the "continue" statement on the first iteration through the loop then "handle_mux" needs to be set to NULL so we continue looping. Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM") Signed-off-by: Dan Carpenter Reviewed-by: Danilo Krummrich Signed-off-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/1d864f6e-43e9-43d8-9d90-30e76c9c843b@moroto.mountain drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6d7e4782bcf549221b4ccfffec2cf4d1a473f1a3 Author: Keisuke Nishimura Date: Tue Oct 31 14:38:22 2023 +0100 sched/fair: Fix the decision for load balance should_we_balance is called for the decision to do load-balancing. When sched ticks invoke this function, only one CPU should return true. However, in the current code, two CPUs can return true. The following situation, where b means busy and i means idle, is an example, because CPU 0 and CPU 2 return true. [0, 1] [2, 3] b b i b This fix checks if there exists an idle CPU with busy sibling(s) after looking for a CPU on an idle core. If some idle CPUs with busy siblings are found, just the first one should do load-balancing. Fixes: b1bfeab9b002 ("sched/fair: Consider the idle state of the whole core for load balance") Signed-off-by: Keisuke Nishimura Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Chen Yu Reviewed-by: Shrikanth Hegde Reviewed-by: Vincent Guittot Link: https://lkml.kernel.org/r/20231031133821.1570861-1-keisuke.nishimura@inria.fr kernel/sched/fair.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 8b39d20eceeda6c4eb23df1497f9ed2fffdc8f69 Author: Johannes Weiner Date: Thu Oct 26 12:41:14 2023 -0400 sched: psi: fix unprivileged polling against cgroups 519fabc7aaba ("psi: remove 500ms min window size limitation for triggers") breaks unprivileged psi polling on cgroups. Historically, we had a privilege check for polling in the open() of a pressure file in /proc, but were erroneously missing it for the open() of cgroup pressure files. When unprivileged polling was introduced in d82caa273565 ("sched/psi: Allow unprivileged polling of N*2s period"), it needed to filter privileges depending on the exact polling parameters, and as such moved the CAP_SYS_RESOURCE check from the proc open() callback to psi_trigger_create(). Both the proc files as well as cgroup files go through this during write(). This implicitly added the missing check for privileges required for HT polling for cgroups. When 519fabc7aaba ("psi: remove 500ms min window size limitation for triggers") followed right after to remove further restrictions on the RT polling window, it incorrectly assumed the cgroup privilege check was still missing and added it to the cgroup open(), mirroring what we used to do for proc files in the past. As a result, unprivileged poll requests that would be supported now get rejected when opening the cgroup pressure file for writing. Remove the cgroup open() check. psi_trigger_create() handles it. Fixes: 519fabc7aaba ("psi: remove 500ms min window size limitation for triggers") Reported-by: Luca Boccassi Signed-off-by: Johannes Weiner Signed-off-by: Peter Zijlstra (Intel) Acked-by: Luca Boccassi Acked-by: Suren Baghdasaryan Cc: stable@vger.kernel.org # 6.5+ Link: https://lore.kernel.org/r/20231026164114.2488682-1-hannes@cmpxchg.org kernel/cgroup/cgroup.c | 12 ------------ 1 file changed, 12 deletions(-) commit eab03c23c2a162085b13200d7942fc5a00b5ccc8 Author: Abel Wu Date: Tue Nov 7 17:05:07 2023 +0800 sched/eevdf: Fix vruntime adjustment on reweight vruntime of the (on_rq && !0-lag) entity needs to be adjusted when it gets re-weighted, and the calculations can be simplified based on the fact that re-weight won't change the w-average of all the entities. Please check the proofs in comments. But adjusting vruntime can also cause position change in RB-tree hence require re-queue to fix up which might be costly. This might be avoided by deferring adjustment to the time the entity actually leaves tree (dequeue/pick), but that will negatively affect task selection and probably not good enough either. Fixes: 147f3efaa241 ("sched/fair: Implement an EEVDF-like scheduling policy") Signed-off-by: Abel Wu Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20231107090510.71322-2-wuyun.abel@bytedance.com kernel/sched/fair.c | 151 ++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 128 insertions(+), 23 deletions(-) commit 1bddcf77ce6668692fc15e968fd0870d5524d112 Author: Richard Fitzgerald Date: Mon Nov 6 17:25:57 2023 +0000 kunit: test: Avoid cast warning when adding kfree() as an action In kunit_log_test() pass the kfree_wrapper() function to kunit_add_action() instead of directly passing kfree(). This prevents a cast warning: lib/kunit/kunit-test.c:565:25: warning: cast from 'void (*)(const void *)' to 'kunit_action_t *' (aka 'void (*)(void *)') converts to incompatible function type [-Wcast-function-type-strict] 564 full_log = string_stream_get_string(test->log); > 565 kunit_add_action(test, (kunit_action_t *)kfree, full_log); Signed-off-by: Richard Fitzgerald Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311070041.kWVYx7YP-lkp@intel.com/ Fixes: 05e2006ce493 ("kunit: Use string_stream for test log") Reviewed-by: David Gow Signed-off-by: Shuah Khan lib/kunit/kunit-test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2e3c94aed51eabbe9c1c0ee515371ea5441c2fa7 Author: Michal Wajdeczko Date: Wed Oct 4 22:57:00 2023 +0200 kunit: Reset suite counter right before running tests Today we reset the suite counter as part of the suite cleanup, called from the module exit callback, but it might not work that well as one can try to collect results without unloading a previous test (either unintentionally or due to dependencies). For easy reproduction try to load the kunit-test.ko and then collect and parse results from the kunit-example-test.ko load. Parser will complain about mismatch of expected test number: [ ] KTAP version 1 [ ] 1..1 [ ] # example: initializing suite [ ] KTAP version 1 [ ] # Subtest: example .. [ ] # example: pass:5 fail:0 skip:4 total:9 [ ] # Totals: pass:6 fail:0 skip:6 total:12 [ ] ok 7 example [ ] [ERROR] Test: example: Expected test number 1 but found 7 [ ] ===================== [PASSED] example ===================== [ ] ============================================================ [ ] Testing complete. Ran 12 tests: passed: 6, skipped: 6, errors: 1 Since we are now printing suite test plan on every module load, right before running suite tests, we should make sure that suite counter will also start from 1. Easiest solution seems to be move counter reset to the __kunit_test_suites_init() function. Signed-off-by: Michal Wajdeczko Cc: David Gow Cc: Rae Moar Reviewed-by: David Gow Signed-off-by: Shuah Khan lib/kunit/test.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f8f2847f739dc899d0e563eac01299dadefa64ff Author: Maxime Ripard Date: Thu Oct 26 10:59:31 2023 +0200 kunit: Warn if tests are slow Kunit recently gained support to setup attributes, the first one being the speed of a given test, then allowing to filter out slow tests. A slow test is defined in the documentation as taking more than one second. There's an another speed attribute called "super slow" but whose definition is less clear. Add support to the test runner to check the test execution time, and report tests that should be marked as slow but aren't. Signed-off-by: Maxime Ripard Reviewed-by: David Gow Signed-off-by: Shuah Khan lib/kunit/test.c | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) commit 27072b8e18a73ffeffb1c140939023915a35134b Author: Claudio Imbrenda Date: Thu Nov 9 13:36:24 2023 +0100 KVM: s390/mm: Properly reset no-dat When the CMMA state needs to be reset, the no-dat bit also needs to be reset. Failure to do so could cause issues in the guest, since the guest expects the bit to be cleared after a reset. Cc: Reviewed-by: Nico Boehr Message-ID: <20231109123624.37314-1-imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda arch/s390/mm/pgtable.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 80aea01c48971a1fffc0252d036995572d84950d Author: Claudio Imbrenda Date: Thu Nov 2 16:35:49 2023 +0100 KVM: s390: vsie: fix wrong VIR 37 when MSO is used When the host invalidates a guest page, it will also check if the page was used to map the prefix of any guest CPUs, in which case they are stopped and marked as needing a prefix refresh. Upon starting the affected CPUs again, their prefix pages are explicitly faulted in and revalidated if they had been invalidated. A bit in the PGSTEs indicates whether or not a page might contain a prefix. The bit is allowed to overindicate. Pages above 2G are skipped, because they cannot be prefixes, since KVM runs all guests with MSO = 0. The same applies for nested guests (VSIE). When the host invalidates a guest page that maps the prefix of the nested guest, it has to stop the affected nested guest CPUs and mark them as needing a prefix refresh. The same PGSTE bit used for the guest prefix is also used for the nested guest. Pages above 2G are skipped like for normal guests, which is the source of the bug. The nested guest runs is the guest primary address space. The guest could be running the nested guest using MSO != 0. If the MSO + prefix for the nested guest is above 2G, the check for nested prefix will skip it. This will cause the invalidation notifier to not stop the CPUs of the nested guest and not mark them as needing refresh. When the nested guest is run again, its prefix will not be refreshed, since it has not been marked for refresh. This will cause a fatal validity intercept with VIR code 37. Fix this by removing the check for 2G for nested guests. Now all invalidations of pages with the notify bit set will always scan the existing VSIE shadow state descriptors. This allows to catch invalidations of nested guest prefix mappings even when the prefix is above 2G in the guest virtual address space. Fixes: a3508fbe9dc6 ("KVM: s390: vsie: initial support for nested virtualization") Tested-by: Nico Boehr Reviewed-by: Nico Boehr Reviewed-by: David Hildenbrand Message-ID: <20231102153549.53984-1-imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda arch/s390/kvm/vsie.c | 4 ---- 1 file changed, 4 deletions(-) commit 5eef12c4e3230f2025dc46ad8c4a3bc19978e5d7 Author: Shyam Prasad N Date: Tue Nov 14 04:58:23 2023 +0000 cifs: fix lock ordering while disabling multichannel The code to handle the case of server disabling multichannel was picking iface_lock with chan_lock held. This goes against the lock ordering rules, as iface_lock is a higher order lock (even if it isn't so obvious). This change fixes the lock ordering by doing the following in that order for each secondary channel: 1. store iface and server pointers in local variable 2. remove references to iface and server in channels 3. unlock chan_lock 4. lock iface_lock 5. dec ref count for iface 6. unlock iface_lock 7. dec ref count for server 8. lock chan_lock again Since this function can only be called in smb2_reconnect, and that cannot be called by two parallel processes, we should not have races due to dropping chan_lock between steps 3 and 8. Fixes: ee1d21794e55 ("cifs: handle when server stops supporting multichannel") Reported-by: Paulo Alcantara Signed-off-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/sess.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) commit 29954d5b1e0d67a4cd61c30c2201030c97e94b1e Author: Shyam Prasad N Date: Tue Nov 14 04:54:12 2023 +0000 cifs: fix leak of iface for primary channel My last change in this area introduced a change which accounted for primary channel in the interface ref count. However, it did not reduce this ref count on deallocation of the primary channel. i.e. during umount. Fixing this leak here, by dropping this ref count for primary channel while freeing up the session. Fixes: fa1d0508bdd4 ("cifs: account for primary channel in the interface list") Cc: stable@vger.kernel.org Reported-by: Paulo Alcantara Signed-off-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/connect.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 782ce431613cf08c3a00dca42ad925c3b1108d09 Author: Konstantin Runov Date: Mon Oct 30 12:45:08 2023 +0300 gcc-plugins: latent_entropy: Fix typo (args -> argc) in plugin description Fix the typo in the plugin description comment. Clearly, "argc" should be used. Signed-off-by: Konstantin Runov Link: https://lore.kernel.org/r/20231030094508.245432-1-runebone1@gmail.com Signed-off-by: Kees Cook scripts/gcc-plugins/latent_entropy_plugin.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 2e6ef8aaba6b709ce91164401fa1c12668510360 Author: Bob Peterson Date: Tue Nov 14 07:57:53 2023 -0600 Remove myself as maintainer of GFS2 I am retiring from Red Hat and will no longer be a maintainer of the gfs2 file system. Signed-off-by: Bob Peterson Signed-off-by: Linus Torvalds MAINTAINERS | 1 - 1 file changed, 1 deletion(-) commit b944aa9d86d5f782bfe5e51336434c960304839c Author: Matus Malych Date: Tue Nov 14 14:35:25 2023 +0100 ALSA: hda/realtek: Enable Mute LED on HP 255 G10 HP 255 G10 has a mute LED that can be made to work using quirk ALC236_FIXUP_HP_MUTE_LED_COEFBIT2. Enable already existing quirk - at correct line to keep order Signed-off-by: Matus Malych Cc: Link: https://lore.kernel.org/r/20231114133524.11340-1-matus@malych.org Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 2a0508d9d08f0c3e354044d4f48466ee0d225041 Merge: b85ea95d0864 e439e4a62a8e Author: Martin K. Petersen Date: Tue Nov 14 11:40:40 2023 -0500 Merge branch '6.7/scsi-staging' into 6.7/scsi-fixes Pull in queued fixes for 6.7 Signed-off-by: Martin K. Petersen commit 1de1b77982e1a1df9707cb11f9b1789e6b8919d4 Author: Adrian Hunter Date: Fri Nov 3 10:47:20 2023 +0200 mmc: cqhci: Fix task clearing in CQE error recovery If a task completion notification (TCN) is received when there is no outstanding task, the cqhci driver issues a "spurious TCN" warning. This was observed to happen right after CQE error recovery. When an error interrupt is received the driver runs recovery logic. It halts the controller, clears all pending tasks, and then re-enables it. On some platforms, like Intel Jasper Lake, a stale task completion event was observed, regardless of the CQHCI_CLEAR_ALL_TASKS bit being set. This results in either: a) Spurious TC completion event for an empty slot. b) Corrupted data being passed up the stack, as a result of premature completion for a newly added task. Rather than add a quirk for affected controllers, ensure tasks are cleared by toggling CQHCI_ENABLE, which would happen anyway if cqhci_clear_all_tasks() timed out. This is simpler and should be safe and effective for all controllers. Fixes: a4080225f51d ("mmc: cqhci: support for command queue enabled host") Cc: stable@vger.kernel.org Reported-by: Kornel Dulęba Tested-by: Kornel Dulęba Co-developed-by: Kornel Dulęba Signed-off-by: Kornel Dulęba Signed-off-by: Adrian Hunter Reviewed-by: Avri Altman Link: https://lore.kernel.org/r/20231103084720.6886-7-adrian.hunter@intel.com Signed-off-by: Ulf Hansson drivers/mmc/host/cqhci-core.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) commit 35597bdb04ec27ef3b1cea007dc69f8ff5df75a5 Author: Adrian Hunter Date: Fri Nov 3 10:47:19 2023 +0200 mmc: cqhci: Warn of halt or task clear failure A correctly operating controller should successfully halt and clear tasks. Failure may result in errors elsewhere, so promote messages from debug to warnings. Fixes: a4080225f51d ("mmc: cqhci: support for command queue enabled host") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Avri Altman Reviewed-by: Avri Altman Link: https://lore.kernel.org/r/20231103084720.6886-6-adrian.hunter@intel.com Signed-off-by: Ulf Hansson drivers/mmc/host/cqhci-core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 8155d1fa3a747baad5caff5f8303321d68ddd48c Author: Adrian Hunter Date: Fri Nov 3 10:47:18 2023 +0200 mmc: block: Retry commands in CQE error recovery It is important that MMC_CMDQ_TASK_MGMT command to discard the queue is successful because otherwise a subsequent reset might fail to flush the cache first. Retry it and the previous STOP command. Fixes: 72a5af554df8 ("mmc: core: Add support for handling CQE requests") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Avri Altman Link: https://lore.kernel.org/r/20231103084720.6886-5-adrian.hunter@intel.com Signed-off-by: Ulf Hansson drivers/mmc/core/core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit c616696a902987352426fdaeec1b0b3240949e6b Author: Adrian Hunter Date: Fri Nov 3 10:47:17 2023 +0200 mmc: block: Be sure to wait while busy in CQE error recovery STOP command does not guarantee to wait while busy, but subsequent command MMC_CMDQ_TASK_MGMT to discard the queue will fail if the card is busy, so be sure to wait by employing mmc_poll_for_busy(). Fixes: 72a5af554df8 ("mmc: core: Add support for handling CQE requests") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Avri Altman Reviewed-by: Christian Loehle Link: https://lore.kernel.org/r/20231103084720.6886-4-adrian.hunter@intel.com Signed-off-by: Ulf Hansson drivers/mmc/core/core.c | 2 ++ 1 file changed, 2 insertions(+) commit b578d5d18e929aa7c007a98cce32657145dde219 Author: Adrian Hunter Date: Fri Nov 3 10:47:16 2023 +0200 mmc: cqhci: Increase recovery halt timeout Failing to halt complicates the recovery. Additionally, unless the card or controller are stuck, which is expected to be very rare, then the halt should succeed, so it is better to wait. Set a large timeout. Fixes: a4080225f51d ("mmc: cqhci: support for command queue enabled host") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Avri Altman Link: https://lore.kernel.org/r/20231103084720.6886-3-adrian.hunter@intel.com Signed-off-by: Ulf Hansson drivers/mmc/host/cqhci-core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 174925d340aac55296318e43fd96c0e1d196e105 Author: Adrian Hunter Date: Fri Nov 3 10:47:15 2023 +0200 mmc: block: Do not lose cache flush during CQE error recovery During CQE error recovery, error-free data commands get requeued if there is any data left to transfer, but non-data commands are completed even though they have not been processed. Requeue them instead. Note the only non-data command is cache flush, which would have resulted in a cache flush being lost if it was queued at the time of CQE recovery. Fixes: 1e8e55b67030 ("mmc: block: Add CQE support") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Avri Altman Link: https://lore.kernel.org/r/20231103084720.6886-2-adrian.hunter@intel.com Signed-off-by: Ulf Hansson drivers/mmc/core/block.c | 2 ++ 1 file changed, 2 insertions(+) commit 8837ba3e58ea1e3d09ae36db80b1e80853aada95 Author: Pablo Neira Ayuso Date: Mon Nov 13 21:13:31 2023 +0100 netfilter: nf_tables: split async and sync catchall in two functions list_for_each_entry_safe() does not work for the async case which runs under RCU, therefore, split GC logic for catchall in two functions instead, one for each of the sync and async GC variants. The catchall sync GC variant never sees a _DEAD bit set on ever, thus, this handling is removed in such case, moreover, allocate GC sync batch via GFP_KERNEL. Fixes: 93995bf4af2c ("netfilter: nf_tables: remove catchall element in GC sync path") Reported-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_tables_api.c | 55 +++++++++++++++++++++++-------------------- 1 file changed, 30 insertions(+), 25 deletions(-) commit 28628fa952fefc7f2072ce6e8016968cc452b1ba Author: Jozsef Kadlecsik Date: Mon Nov 13 21:13:23 2023 +0100 netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test Linkui Xiao reported that there's a race condition when ipset swap and destroy is called, which can lead to crash in add/del/test element operations. Swap then destroy are usual operations to replace a set with another one in a production system. The issue can in some cases be reproduced with the script: ipset create hash_ip1 hash:net family inet hashsize 1024 maxelem 1048576 ipset add hash_ip1 172.20.0.0/16 ipset add hash_ip1 192.168.0.0/16 iptables -A INPUT -m set --match-set hash_ip1 src -j ACCEPT while [ 1 ] do # ... Ongoing traffic... ipset create hash_ip2 hash:net family inet hashsize 1024 maxelem 1048576 ipset add hash_ip2 172.20.0.0/16 ipset swap hash_ip1 hash_ip2 ipset destroy hash_ip2 sleep 0.05 done In the race case the possible order of the operations are CPU0 CPU1 ip_set_test ipset swap hash_ip1 hash_ip2 ipset destroy hash_ip2 hash_net_kadt Swap replaces hash_ip1 with hash_ip2 and then destroy removes hash_ip2 which is the original hash_ip1. ip_set_test was called on hash_ip1 and because destroy removed it, hash_net_kadt crashes. The fix is to force ip_set_swap() to wait for all readers to finish accessing the old set pointers by calling synchronize_rcu(). The first version of the patch was written by Linkui Xiao . v2: synchronize_rcu() is moved into ip_set_swap() in order not to burden ip_set_destroy() unnecessarily when all sets are destroyed. v3: Florian Westphal pointed out that all netfilter hooks run with rcu_read_lock() held and em_ipset.c wraps the entire ip_set_test() in rcu read lock/unlock pair. So there's no need to extend the rcu read locked area in ipset itself. Closes: https://lore.kernel.org/all/69e7963b-e7f8-3ad0-210-7b86eebf7f78@netfilter.org/ Reported by: Linkui Xiao Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso net/netfilter/ipset/ip_set_core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit a7d5a955bfa854ac6b0c53aaf933394b4e6139e4 Author: Pablo Neira Ayuso Date: Mon Nov 13 20:34:56 2023 +0100 netfilter: nf_tables: bogus ENOENT when destroying element which does not exist destroy element command bogusly reports ENOENT in case a set element does not exist. ENOENT errors are skipped, however, err is still set and propagated to userspace. # nft destroy element ip raw BLACKLIST { 1.2.3.4 } Error: Could not process rule: No such file or directory destroy element ip raw BLACKLIST { 1.2.3.4 } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Fixes: f80a612dd77c ("netfilter: nf_tables: add support to destroy operation") Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_tables_api.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63 Author: Dan Carpenter Date: Fri Nov 3 09:42:51 2023 +0300 netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() The problem is in nft_byteorder_eval() where we are iterating through a loop and writing to dst[0], dst[1], dst[2] and so on... On each iteration we are writing 8 bytes. But dst[] is an array of u32 so each element only has space for 4 bytes. That means that every iteration overwrites part of the previous element. I spotted this bug while reviewing commit caf3ef7468f7 ("netfilter: nf_tables: prevent OOB access in nft_byteorder_eval") which is a related issue. I think that the reason we have not detected this bug in testing is that most of time we only write one element. Fixes: ce1e7989d989 ("netfilter: nft_byteorder: provide 64bit le/be conversion") Signed-off-by: Dan Carpenter Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_tables.h | 4 ++-- net/netfilter/nft_byteorder.c | 5 +++-- net/netfilter/nft_meta.c | 2 +- 3 files changed, 6 insertions(+), 5 deletions(-) commit a44af08e3d4d7566eeea98d7a29fe06e7b9de944 Author: Linkui Xiao Date: Wed Nov 1 11:20:18 2023 +0800 netfilter: nf_conntrack_bridge: initialize err to 0 K2CI reported a problem: consume_skb(skb); return err; [nf_br_ip_fragment() error] uninitialized symbol 'err'. err is not initialized, because returning 0 is expected, initialize err to 0. Fixes: 3c171f496ef5 ("netfilter: bridge: add connection tracking system") Reported-by: k2ci Signed-off-by: Linkui Xiao Signed-off-by: Pablo Neira Ayuso net/bridge/netfilter/nf_conntrack_bridge.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 67059b61597c004e23b074547b40604222bee3a0 Author: Yang Li Date: Wed Nov 1 09:33:51 2023 +0800 netfilter: nft_set_rbtree: Remove unused variable nft_net The code that uses nft_net has been removed, and the nft_pernet function is merely obtaining a reference to shared data through the net pointer. The content of the net pointer is not modified or changed, so both of them should be removed. silence the warning: net/netfilter/nft_set_rbtree.c:627:26: warning: variable ‘nft_net’ set but not used Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=7103 Signed-off-by: Yang Li Reviewed-by: Simon Horman Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_set_rbtree.c | 2 -- 1 file changed, 2 deletions(-) commit df572eba4e6211c6187fa81a0cc1199da1902f63 Author: Linus Walleij Date: Tue Nov 14 14:30:04 2023 +0100 pinctrl: cy8c95x0: Fix doc warning One member of struct cy8c95x0_pinctrl is missing kerneldoc, which leads to warnings. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311031342.r4To3GaD-lkp@intel.com/ Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20231114-cy8c95x0-doc-v1-1-31674103ad18@linaro.org drivers/pinctrl/pinctrl-cy8c95x0.c | 1 + 1 file changed, 1 insertion(+) commit 08e8734d877a9a0fb8af1254a4ce58734fbef296 Author: Chester Lin Date: Tue Nov 7 22:10:44 2023 +0800 pinctrl: s32cc: Avoid possible string truncation With "W=1" and "-Wformat-truncation" build options, the kernel test robot found a possible string truncation warning in pinctrl-s32cc.c, which uses an 8-byte char array to hold a memory region name "map%u". Since the maximum number of digits that a u32 value can present is 10, and the "map" string occupies 3 bytes with a termination '\0', which means the rest 4 bytes cannot fully present the integer "X" that exceeds 4 digits. Here we check if the number >= 10000, which is the lowest value that contains more than 4 digits. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311030159.iyUGjNGF-lkp@intel.com/ Signed-off-by: Chester Lin Link: https://lore.kernel.org/r/20231107141044.24058-1-clin@suse.com Signed-off-by: Linus Walleij drivers/pinctrl/nxp/pinctrl-s32cc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit edd48fd9d45370d6c8ba0dd834fcc51ff688cc87 Author: Antonio Borneo Date: Tue Nov 7 12:05:20 2023 +0100 pinctrl: stm32: fix array read out of bound The existing code does not verify if the "tentative" index exceeds the size of the array, causing out of bound read. Issue identified with kasan. Check the index before using it. Signed-off-by: Antonio Borneo Fixes: 32c170ff15b0 ("pinctrl: stm32: set default gpio line names using pin names") Link: https://lore.kernel.org/r/20231107110520.4449-1-antonio.borneo@foss.st.com Signed-off-by: Linus Walleij drivers/pinctrl/stm32/pinctrl-stm32.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 58ebe7fb6eb2deed0fd05cf57911fea3f36124eb Author: Antoniu Miclaus Date: Tue Oct 31 11:13:24 2023 +0200 hwmon: max31827: include regulator header Include `linux/regulator/consumer.h` since the driver is using `devm_regulator_get_enable` function. Signed-off-by: Antoniu Miclaus Link: https://lore.kernel.org/r/20231031091324.23991-1-antoniu.miclaus@analog.com Signed-off-by: Guenter Roeck drivers/hwmon/max31827.c | 1 + 1 file changed, 1 insertion(+) commit d9995cd96928fa72963293fa5ca87350fed16930 Author: Colin Ian King Date: Tue Oct 31 08:42:40 2023 +0000 hwmon: ltc2991: Fix spelling mistake "contiuous" -> "continuous" There is a spelling mistake in a dev_err_probe messages. Fix it. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20231031084240.2148339-1-colin.i.king@gmail.com Signed-off-by: Guenter Roeck drivers/hwmon/ltc2991.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4b7b492615cf3017190f55444f7016812b66611d Author: Eric Dumazet Date: Mon Nov 13 13:49:38 2023 +0000 af_unix: fix use-after-free in unix_stream_read_actor() syzbot reported the following crash [1] After releasing unix socket lock, u->oob_skb can be changed by another thread. We must temporarily increase skb refcount to make sure this other thread will not free the skb under us. [1] BUG: KASAN: slab-use-after-free in unix_stream_read_actor+0xa7/0xc0 net/unix/af_unix.c:2866 Read of size 4 at addr ffff88801f3b9cc4 by task syz-executor107/5297 CPU: 1 PID: 5297 Comm: syz-executor107 Not tainted 6.6.0-syzkaller-15910-gb8e3a87a627b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xc4/0x620 mm/kasan/report.c:475 kasan_report+0xda/0x110 mm/kasan/report.c:588 unix_stream_read_actor+0xa7/0xc0 net/unix/af_unix.c:2866 unix_stream_recv_urg net/unix/af_unix.c:2587 [inline] unix_stream_read_generic+0x19a5/0x2480 net/unix/af_unix.c:2666 unix_stream_recvmsg+0x189/0x1b0 net/unix/af_unix.c:2903 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg+0xe2/0x170 net/socket.c:1066 ____sys_recvmsg+0x21f/0x5c0 net/socket.c:2803 ___sys_recvmsg+0x115/0x1a0 net/socket.c:2845 __sys_recvmsg+0x114/0x1e0 net/socket.c:2875 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7fc67492c559 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc6748ab228 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 000000000000001c RCX: 00007fc67492c559 RDX: 0000000040010083 RSI: 0000000020000140 RDI: 0000000000000004 RBP: 00007fc6749b6348 R08: 00007fc6748ab6c0 R09: 00007fc6748ab6c0 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc6749b6340 R13: 00007fc6749b634c R14: 00007ffe9fac52a0 R15: 00007ffe9fac5388 Allocated by task 5295: kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:763 [inline] slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x180/0x3c0 mm/slub.c:3523 __alloc_skb+0x287/0x330 net/core/skbuff.c:641 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xe4/0x710 net/core/skbuff.c:6331 sock_alloc_send_pskb+0x7e4/0x970 net/core/sock.c:2780 sock_alloc_send_skb include/net/sock.h:1884 [inline] queue_oob net/unix/af_unix.c:2147 [inline] unix_stream_sendmsg+0xb5f/0x10a0 net/unix/af_unix.c:2301 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Freed by task 5295: kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:522 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x15b/0x1b0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1800 [inline] slab_free_freelist_hook+0x114/0x1e0 mm/slub.c:1826 slab_free mm/slub.c:3809 [inline] kmem_cache_free+0xf8/0x340 mm/slub.c:3831 kfree_skbmem+0xef/0x1b0 net/core/skbuff.c:1015 __kfree_skb net/core/skbuff.c:1073 [inline] consume_skb net/core/skbuff.c:1288 [inline] consume_skb+0xdf/0x170 net/core/skbuff.c:1282 queue_oob net/unix/af_unix.c:2178 [inline] unix_stream_sendmsg+0xd49/0x10a0 net/unix/af_unix.c:2301 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b The buggy address belongs to the object at ffff88801f3b9c80 which belongs to the cache skbuff_head_cache of size 240 The buggy address is located 68 bytes inside of freed 240-byte region [ffff88801f3b9c80, ffff88801f3b9d70) The buggy address belongs to the physical page: page:ffffea00007cee40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f3b9 flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000800 ffff888142a60640 dead000000000122 0000000000000000 raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 5299, tgid 5283 (syz-executor107), ts 103803840339, free_ts 103600093431 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x2cf/0x340 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1544 [inline] get_page_from_freelist+0xa25/0x36c0 mm/page_alloc.c:3312 __alloc_pages+0x1d0/0x4a0 mm/page_alloc.c:4568 alloc_pages_mpol+0x258/0x5f0 mm/mempolicy.c:2133 alloc_slab_page mm/slub.c:1870 [inline] allocate_slab+0x251/0x380 mm/slub.c:2017 new_slab mm/slub.c:2070 [inline] ___slab_alloc+0x8c7/0x1580 mm/slub.c:3223 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3322 __slab_alloc_node mm/slub.c:3375 [inline] slab_alloc_node mm/slub.c:3468 [inline] kmem_cache_alloc_node+0x132/0x3c0 mm/slub.c:3523 __alloc_skb+0x287/0x330 net/core/skbuff.c:641 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xe4/0x710 net/core/skbuff.c:6331 sock_alloc_send_pskb+0x7e4/0x970 net/core/sock.c:2780 sock_alloc_send_skb include/net/sock.h:1884 [inline] queue_oob net/unix/af_unix.c:2147 [inline] unix_stream_sendmsg+0xb5f/0x10a0 net/unix/af_unix.c:2301 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1137 [inline] free_unref_page_prepare+0x4f8/0xa90 mm/page_alloc.c:2347 free_unref_page+0x33/0x3b0 mm/page_alloc.c:2487 __unfreeze_partials+0x21d/0x240 mm/slub.c:2655 qlink_free mm/kasan/quarantine.c:168 [inline] qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x18e/0x1d0 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0x65/0x90 mm/kasan/common.c:305 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:763 [inline] slab_alloc_node mm/slub.c:3478 [inline] slab_alloc mm/slub.c:3486 [inline] __kmem_cache_alloc_lru mm/slub.c:3493 [inline] kmem_cache_alloc+0x15d/0x380 mm/slub.c:3502 vm_area_dup+0x21/0x2f0 kernel/fork.c:500 __split_vma+0x17d/0x1070 mm/mmap.c:2365 split_vma mm/mmap.c:2437 [inline] vma_modify+0x25d/0x450 mm/mmap.c:2472 vma_modify_flags include/linux/mm.h:3271 [inline] mprotect_fixup+0x228/0xc80 mm/mprotect.c:635 do_mprotect_pkey+0x852/0xd60 mm/mprotect.c:809 __do_sys_mprotect mm/mprotect.c:830 [inline] __se_sys_mprotect mm/mprotect.c:827 [inline] __x64_sys_mprotect+0x78/0xb0 mm/mprotect.c:827 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Memory state around the buggy address: ffff88801f3b9b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801f3b9c00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc >ffff88801f3b9c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88801f3b9d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc ffff88801f3b9d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb Fixes: 876c14ad014d ("af_unix: fix holding spinlock in oob handling") Reported-and-tested-by: syzbot+7a2d546fa43e49315ed3@syzkaller.appspotmail.com Signed-off-by: Eric Dumazet Cc: Rao Shoaib Reviewed-by: Rao shoaib Link: https://lore.kernel.org/r/20231113134938.168151-1-edumazet@google.com Signed-off-by: Paolo Abeni net/unix/af_unix.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 3bdb0ac350fe5e6301562143e4573971dd01ae0b Author: Juergen Gross Date: Wed Sep 27 08:24:46 2023 +0200 xen/events: remove some simple helpers from events_base.c The helper functions type_from_irq() and cpu_from_irq() are just one line functions used only internally. Open code them where needed. At the same time modify and rename get_evtchn_to_irq() to return a struct irq_info instead of the IRQ number. Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Signed-off-by: Juergen Gross drivers/xen/events/events_base.c | 97 ++++++++++++++++------------------------ 1 file changed, 38 insertions(+), 59 deletions(-) commit 686464514fbebb6c8de4415238319e414c3500a4 Author: Juergen Gross Date: Wed Sep 27 08:58:05 2023 +0200 xen/events: reduce externally visible helper functions get_evtchn_to_irq() has only one external user while irq_from_evtchn() provides the same functionality and is exported for a wider user base. Modify the only external user of get_evtchn_to_irq() to use irq_from_evtchn() instead and make get_evtchn_to_irq() static. evtchn_from_irq() and irq_from_virq() have a single external user and can easily be combined to a new helper irq_evtchn_from_virq() allowing to drop irq_from_virq() and to make evtchn_from_irq() static. Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Signed-off-by: Juergen Gross drivers/xen/events/events_2l.c | 8 ++++---- drivers/xen/events/events_base.c | 13 +++++++++---- drivers/xen/events/events_internal.h | 1 - include/xen/events.h | 4 ++-- 4 files changed, 15 insertions(+), 11 deletions(-) commit 37f32f52643869131ec01bb69bdf9f404f6109fb Author: Amir Goldstein Date: Sun Nov 12 10:11:25 2023 +0200 ovl: fix memory leak in ovl_parse_param() On failure to parse parameters in ovl_parse_param_lowerdir(), it is necessary to update ctx->nr with the correct nr before using ovl_reset_lowerdirs() to release l->name. Reported-and-tested-by: syzbot+26eedf3631650972f17c@syzkaller.appspotmail.com Fixes: c835110b588a ("ovl: remove unused code in lowerdir param parsing") Co-authored-by: Edward Adam Davis Signed-off-by: Amir Goldstein fs/overlayfs/params.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit b28060db7172e6d8912d88b369123eb89e0d36b4 Author: Amir Goldstein Date: Sun Nov 12 11:12:49 2023 +0200 ovl: fix misformatted comment Remove misleading /** prefix from a regular comment. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311121628.byHp8tkv-lkp@intel.com/ Signed-off-by: Amir Goldstein fs/overlayfs/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 48c205c69ac988e818f8800a3ce2cbf574c47f99 Merge: 334e90b8d74f 868c3b95afef Author: Jakub Kicinski Date: Mon Nov 13 21:00:10 2023 -0800 Merge branch 'r8169-fix-dash-devices-network-lost-issue' ChunHao Lin says: ==================== r8169: fix DASH devices network lost issue This series are used to fix network lost issue on systems that support DASH. It has been tested on rtl8168ep and rtl8168fp. ==================== Link: https://lore.kernel.org/r/20231109173400.4573-1-hau@realtek.com Signed-off-by: Jakub Kicinski commit 868c3b95afef4883bfb66c9397482da6840b5baf Author: ChunHao Lin Date: Fri Nov 10 01:34:00 2023 +0800 r8169: fix network lost after resume on DASH systems Device that support DASH may be reseted or powered off during suspend. So driver needs to handle DASH during system suspend and resume. Or DASH firmware will influence device behavior and causes network lost. Fixes: b646d90053f8 ("r8169: magic.") Cc: stable@vger.kernel.org Reviewed-by: Heiner Kallweit Signed-off-by: ChunHao Lin Link: https://lore.kernel.org/r/20231109173400.4573-3-hau@realtek.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/realtek/r8169_main.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 0ab0c45d8aaea5192328bfa6989673aceafc767c Author: ChunHao Lin Date: Fri Nov 10 01:33:59 2023 +0800 r8169: add handling DASH when DASH is disabled For devices that support DASH, even DASH is disabled, there may still exist a default firmware that will influence device behavior. So driver needs to handle DASH for devices that support DASH, no matter the DASH status is. This patch also prepares for "fix network lost after resume on DASH systems". Fixes: ee7a1beb9759 ("r8169:call "rtl8168_driver_start" "rtl8168_driver_stop" only when hardware dash function is enabled") Cc: stable@vger.kernel.org Signed-off-by: ChunHao Lin Reviewed-by: Heiner Kallweit Link: https://lore.kernel.org/r/20231109173400.4573-2-hau@realtek.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/realtek/r8169_main.c | 36 +++++++++++++++++++++---------- 1 file changed, 25 insertions(+), 11 deletions(-) commit 334e90b8d74f83b8cbe5c9b606d1690858b4897b Merge: 3cffa2ddc4d3 dc6c0bfbaa94 Author: Jakub Kicinski Date: Mon Nov 13 20:58:22 2023 -0800 Merge branch 'fix-large-frames-in-the-gemini-ethernet-driver' Linus Walleij says: ==================== Fix large frames in the Gemini ethernet driver This is the result of a bug hunt for a problem with the RTL8366RB DSA switch leading me wrong all over the place. I am indebted to Vladimir Oltean who as usual pointed out where the real problem was, many thanks! Tryig to actually use big ("jumbo") frames on this hardware uncovered the real bugs. Then I tested it on the DSA switch and it indeed fixes the issue. To make sure it also works fine with big frames on non-DSA devices I also copied a large video file over scp to a device with maximum frame size, the data was transported in large TCP packets ending up in 0x7ff sized frames using software checksumming at ~2.0 MB/s. If I set down the MTU to the standard 1500 bytes so that hardware checksumming is used, the scp transfer of the same file was slightly lower, ~1.8-1.9 MB/s. Despite this not being the best test it shows that we can now stress the hardware with large frames and that software checksum works fine. v3: https://lore.kernel.org/r/20231107-gemini-largeframe-fix-v3-0-e3803c080b75@linaro.org v2: https://lore.kernel.org/r/20231105-gemini-largeframe-fix-v2-0-cd3a5aa6c496@linaro.org v1: https://lore.kernel.org/r/20231104-gemini-largeframe-fix-v1-0-9c5513f22f33@linaro.org ==================== Link: https://lore.kernel.org/r/20231109-gemini-largeframe-fix-v4-0-6e611528db08@linaro.org Signed-off-by: Jakub Kicinski commit dc6c0bfbaa947dd7976e30e8c29b10c868b6fa42 Author: Linus Walleij Date: Thu Nov 9 10:03:14 2023 +0100 net: ethernet: cortina: Fix MTU max setting The RX max frame size is over 10000 for the Gemini ethernet, but the TX max frame size is actually just 2047 (0x7ff after checking the datasheet). Reflect this in what we offer to Linux, cap the MTU at the TX max frame minus ethernet headers. We delete the code disabling the hardware checksum for large MTUs as netdev->mtu can no longer be larger than netdev->max_mtu meaning the if()-clause in gmac_fix_features() is never true. Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") Reviewed-by: Andrew Lunn Signed-off-by: Linus Walleij Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20231109-gemini-largeframe-fix-v4-3-6e611528db08@linaro.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/cortina/gemini.c | 17 ++++------------- drivers/net/ethernet/cortina/gemini.h | 2 +- 2 files changed, 5 insertions(+), 14 deletions(-) commit d4d0c5b4d279bfe3585fbd806efefd3e51c82afa Author: Linus Walleij Date: Thu Nov 9 10:03:13 2023 +0100 net: ethernet: cortina: Handle large frames The Gemini ethernet controller provides hardware checksumming for frames up to 1514 bytes including ethernet headers but not FCS. If we start sending bigger frames (after first bumping up the MTU on both interfaces sending and receiving the frames), truncated packets start to appear on the target such as in this tcpdump resulting from ping -s 1474: 23:34:17.241983 14:d6:4d:a8:3c:4f (oui Unknown) > bc:ae:c5:6b:a8:3d (oui Unknown), ethertype IPv4 (0x0800), length 1514: truncated-ip - 2 bytes missing! (tos 0x0, ttl 64, id 32653, offset 0, flags [DF], proto ICMP (1), length 1502) OpenWrt.lan > Fecusia: ICMP echo request, id 1672, seq 50, length 1482 If we bypass the hardware checksumming and provide a software fallback, everything starts working fine up to the max TX MTU of 2047 bytes, for example ping -s2000 192.168.1.2: 00:44:29.587598 bc:ae:c5:6b:a8:3d (oui Unknown) > 14:d6:4d:a8:3c:4f (oui Unknown), ethertype IPv4 (0x0800), length 2042: (tos 0x0, ttl 64, id 51828, offset 0, flags [none], proto ICMP (1), length 2028) Fecusia > OpenWrt.lan: ICMP echo reply, id 1683, seq 4, length 2008 The bit enabling to bypass hardware checksum (or any of the "TSS" bits) are undocumented in the hardware reference manual. The entire hardware checksum unit appears undocumented. The conclusion that we need to use the "bypass" bit was found by trial-and-error. Since no hardware checksum will happen, we slot in a software checksum fallback. Check for the condition where we need to compute checksum on the skb with either hardware or software using == CHECKSUM_PARTIAL instead of != CHECKSUM_NONE which is an incomplete check according to . On the D-Link DIR-685 router this fixes a bug on the conduit interface to the RTL8366RB DSA switch: as the switch needs to add space for its tag it increases the MTU on the conduit interface to 1504 and that means that when the router sends packages of 1500 bytes these get an extra 4 bytes of DSA tag and the transfer fails because of the erroneous hardware checksumming, affecting such basic functionality as the LuCI web interface. Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") Signed-off-by: Linus Walleij Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20231109-gemini-largeframe-fix-v4-2-6e611528db08@linaro.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/cortina/gemini.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) commit 510e35fb931ffc3b100e5d5ae4595cd3beca9f1a Author: Linus Walleij Date: Thu Nov 9 10:03:12 2023 +0100 net: ethernet: cortina: Fix max RX frame define Enumerator 3 is 1548 bytes according to the datasheet. Not 1542. Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") Reviewed-by: Andrew Lunn Signed-off-by: Linus Walleij Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20231109-gemini-largeframe-fix-v4-1-6e611528db08@linaro.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/cortina/gemini.c | 4 ++-- drivers/net/ethernet/cortina/gemini.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) commit 3cffa2ddc4d3fcf70cde361236f5a614f81a09b2 Author: Eric Dumazet Date: Thu Nov 9 18:01:02 2023 +0000 bonding: stop the device in bond_setup_by_slave() Commit 9eed321cde22 ("net: lapbether: only support ethernet devices") has been able to keep syzbot away from net/lapb, until today. In the following splat [1], the issue is that a lapbether device has been created on a bonding device without members. Then adding a non ARPHRD_ETHER member forced the bonding master to change its type. The fix is to make sure we call dev_close() in bond_setup_by_slave() so that the potential linked lapbether devices (or any other devices having assumptions on the physical device) are removed. A similar bug has been addressed in commit 40baec225765 ("bonding: fix panic on non-ARPHRD_ETHER enslave failure") [1] skbuff: skb_under_panic: text:ffff800089508810 len:44 put:40 head:ffff0000c78e7c00 data:ffff0000c78e7bea tail:0x16 end:0x140 dev:bond0 kernel BUG at net/core/skbuff.c:192 ! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6007 Comm: syz-executor383 Not tainted 6.6.0-rc3-syzkaller-gbf6547d8715b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic net/core/skbuff.c:188 [inline] pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202 lr : skb_panic net/core/skbuff.c:188 [inline] lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202 sp : ffff800096a06aa0 x29: ffff800096a06ab0 x28: ffff800096a06ba0 x27: dfff800000000000 x26: ffff0000ce9b9b50 x25: 0000000000000016 x24: ffff0000c78e7bea x23: ffff0000c78e7c00 x22: 000000000000002c x21: 0000000000000140 x20: 0000000000000028 x19: ffff800089508810 x18: ffff800096a06100 x17: 0000000000000000 x16: ffff80008a629a3c x15: 0000000000000001 x14: 1fffe00036837a32 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000201 x10: 0000000000000000 x9 : cb50b496c519aa00 x8 : cb50b496c519aa00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800096a063b8 x4 : ffff80008e280f80 x3 : ffff8000805ad11c x2 : 0000000000000001 x1 : 0000000100000201 x0 : 0000000000000086 Call trace: skb_panic net/core/skbuff.c:188 [inline] skb_under_panic+0x13c/0x140 net/core/skbuff.c:202 skb_push+0xf0/0x108 net/core/skbuff.c:2446 ip6gre_header+0xbc/0x738 net/ipv6/ip6_gre.c:1384 dev_hard_header include/linux/netdevice.h:3136 [inline] lapbeth_data_transmit+0x1c4/0x298 drivers/net/wan/lapbether.c:257 lapb_data_transmit+0x8c/0xb0 net/lapb/lapb_iface.c:447 lapb_transmit_buffer+0x178/0x204 net/lapb/lapb_out.c:149 lapb_send_control+0x220/0x320 net/lapb/lapb_subr.c:251 __lapb_disconnect_request+0x9c/0x17c net/lapb/lapb_iface.c:326 lapb_device_event+0x288/0x4e0 net/lapb/lapb_iface.c:492 notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 call_netdevice_notifiers_info net/core/dev.c:1970 [inline] call_netdevice_notifiers_extack net/core/dev.c:2008 [inline] call_netdevice_notifiers net/core/dev.c:2022 [inline] __dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508 dev_close_many+0x1e0/0x470 net/core/dev.c:1559 dev_close+0x174/0x250 net/core/dev.c:1585 lapbeth_device_event+0x2e4/0x958 drivers/net/wan/lapbether.c:466 notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 call_netdevice_notifiers_info net/core/dev.c:1970 [inline] call_netdevice_notifiers_extack net/core/dev.c:2008 [inline] call_netdevice_notifiers net/core/dev.c:2022 [inline] __dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508 dev_close_many+0x1e0/0x470 net/core/dev.c:1559 dev_close+0x174/0x250 net/core/dev.c:1585 bond_enslave+0x2298/0x30cc drivers/net/bonding/bond_main.c:2332 bond_do_ioctl+0x268/0xc64 drivers/net/bonding/bond_main.c:4539 dev_ifsioc+0x754/0x9ac dev_ioctl+0x4d8/0xd34 net/core/dev_ioctl.c:786 sock_do_ioctl+0x1d4/0x2d0 net/socket.c:1217 sock_ioctl+0x4e8/0x834 net/socket.c:1322 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl fs/ioctl.c:857 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:857 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155 el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 Code: aa1803e6 aa1903e7 a90023f5 94785b8b (d4210000) Fixes: 872254dd6b1f ("net/bonding: Enable bonding to enslave non ARPHRD_ETHER") Reported-by: syzbot Signed-off-by: Eric Dumazet Acked-by: Jay Vosburgh Reviewed-by: Hangbin Liu Link: https://lore.kernel.org/r/20231109180102.4085183-1-edumazet@google.com Signed-off-by: Jakub Kicinski drivers/net/bonding/bond_main.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 73bde5a3294853947252cd9092a3517c7cb0cd2d Author: Eric Dumazet Date: Thu Nov 9 17:48:59 2023 +0000 ptp: annotate data-race around q->head and q->tail As I was working on a syzbot report, I found that KCSAN would probably complain that reading q->head or q->tail without barriers could lead to invalid results. Add corresponding READ_ONCE() and WRITE_ONCE() to avoid load-store tearing. Fixes: d94ba80ebbea ("ptp: Added a brand new class driver for ptp clocks.") Signed-off-by: Eric Dumazet Acked-by: Richard Cochran Link: https://lore.kernel.org/r/20231109174859.3995880-1-edumazet@google.com Signed-off-by: Jakub Kicinski drivers/ptp/ptp_chardev.c | 3 ++- drivers/ptp/ptp_clock.c | 5 +++-- drivers/ptp/ptp_private.h | 8 ++++++-- drivers/ptp/ptp_sysfs.c | 3 ++- 4 files changed, 13 insertions(+), 6 deletions(-) commit 4b3812d90b2c93723adf4b6ce99240d301f7d5f9 Author: Jakub Kicinski Date: Mon Nov 13 20:49:39 2023 -0800 Revert "ptp: Fixes a null pointer dereference in ptp_ioctl" This reverts commit 8a4f030dbced6fc255cbe67b2d0a129947e18493. Richard says: The test itself is harmless, but keeping it will make people think, "oh this pointer can be invalid." In fact the core stack ensures that ioctl() can't be invoked after release(), otherwise Bad Stuff happens. Fixes: 8a4f030dbced ("ptp: Fixes a null pointer dereference in ptp_ioctl") Link: https://lore.kernel.org/all/ZVAf_qdRfDAQYUt-@hoboy.vegasvil.org/ Signed-off-by: Jakub Kicinski drivers/ptp/ptp_chardev.c | 2 -- 1 file changed, 2 deletions(-) commit 701ff57eb3d7c86c9a53de959e0c48fa8ca446d4 Author: Kent Overstreet Date: Fri Nov 3 18:38:35 2023 -0400 bcachefs: Check for nonce offset inconsistency in data_update path We've rarely been seeing a nonce offset inconsistency that doesn't show up in tests: this adds some extra verification code to the data update path that prints out more relevant info when it occurs. Signed-off-by: Kent Overstreet fs/bcachefs/data_update.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) commit 09b0283ee23a02094a43a9b93146d1060c58fc3a Author: Kent Overstreet Date: Sun Nov 5 15:28:44 2023 -0500 bcachefs: Make sure to drop/retake btree locks before reclaim We really don't want to be invoking memory reclaim with btree locks held: even aside from (solvable, but tricky) recursion issues, it can cause painful to diagnose performance edge cases. This fixes a recently reported issue in btree_key_can_insert_cached(). Signed-off-by: Kent Overstreet Reported-by: Mateusz Guzik Fixes: https://lore.kernel.org/linux-bcachefs/CAGudoHEsb_hGRMeWeXh+UF6po0qQuuq_NKSEo+s1sEb6bDLjpA@mail.gmail.com/T/ fs/bcachefs/btree_trans_commit.c | 48 +++++++++++++++++++++++++++++++++++----- 1 file changed, 42 insertions(+), 6 deletions(-) commit 3b8c4507779691984e31e64e0b80abb03cc02d0d Author: Kent Overstreet Date: Mon Nov 6 19:49:47 2023 -0500 bcachefs: btree_trans->write_locked As prep work for the next patch to fix a key cache reclaim issue, we need to start tracking whether we're currently holding write locks - so that we can release and retake the before calling into memory reclaim. Signed-off-by: Kent Overstreet fs/bcachefs/btree_trans_commit.c | 85 +++++++++++++++++++++++----------------- fs/bcachefs/btree_types.h | 1 + 2 files changed, 50 insertions(+), 36 deletions(-) commit c65c13f0eac61218c9ee4635c05661c0b9760e58 Author: Kent Overstreet Date: Mon Nov 6 09:53:14 2023 -0500 bcachefs: Run btree key cache shrinker less aggressively The btree key cache maintains lists of items that have been freed, but can't yet be reclaimed because a bch2_trans_relock() call might find them - we're waiting for SRCU readers to release. Previously, we wouldn't count these items against the number we're attempting to scan for, which would mean we'd evict more live key cache entries - doing quite a bit of potentially unecessary work. With recent work to make sure we don't hold SRCU locks for too long, it should be safe to count all the items on the freelists against number to scan - even if we can't reclaim them yet, we will be able to soon. Signed-off-by: Kent Overstreet fs/bcachefs/btree_key_cache.c | 23 +++++++++++++++++++---- fs/bcachefs/btree_key_cache_types.h | 4 ++++ 2 files changed, 23 insertions(+), 4 deletions(-) commit 1bd5bcc9f5eef968ed021d72b14a157be7abdb49 Author: Kent Overstreet Date: Mon Nov 13 21:44:14 2023 -0500 bcachefs: Split out btree_key_cache_types.h More consistent organization. Signed-off-by: Kent Overstreet fs/bcachefs/btree_key_cache_types.h | 30 ++++++++++++++++++++++++++++++ fs/bcachefs/btree_types.h | 27 +-------------------------- 2 files changed, 31 insertions(+), 26 deletions(-) commit 4d6128dca6d940015fe2aa383ec1a0eeb9632f08 Author: Kent Overstreet Date: Mon Nov 6 11:59:05 2023 -0500 bcachefs: Guard against insufficient devices to create stripes We can't create stripes if we don't have enough devices - this manifested as an integer underflow bug later. Signed-off-by: Kent Overstreet fs/bcachefs/ec.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) commit 03cc1e67a243cbb2c85d5fd84f369449f94d4269 Author: Kent Overstreet Date: Tue Nov 7 10:30:22 2023 -0500 bcachefs: Fix null ptr deref in bch2_backpointer_get_node() bch2_btree_iter_peek_node() can return a NULL ptr (when the tree is shorter than the search depth); handle this with an early return. Signed-off-by: Kent Overstreet Reported-by: Dan Carpenter Fixes: https://lore.kernel.org/linux-bcachefs/5fc3c28b-c232-4ec7-b0ac-4ef220ddf976@moroto.mountain/T/ Signed-off-by: Kent Overstreet fs/bcachefs/backpointers.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 274c2f8fd27158d15524abe63c3df6fb96707dd3 Author: Gustavo A. R. Silva Date: Mon Nov 6 15:40:22 2023 -0600 bcachefs: Fix multiple -Warray-bounds warnings Transform zero-length array `entries` into a proper flexible-array member in `struct journal_seq_blacklist_table`; and fix the following -Warray-bounds warnings: fs/bcachefs/journal_seq_blacklist.c:148:26: warning: array subscript idx is outside array bounds of 'struct journal_seq_blacklist_table_entry[0]' [-Warray-bounds=] fs/bcachefs/journal_seq_blacklist.c:150:30: warning: array subscript idx is outside array bounds of 'struct journal_seq_blacklist_table_entry[0]' [-Warray-bounds=] fs/bcachefs/journal_seq_blacklist.c:154:27: warning: array subscript idx is outside array bounds of 'struct journal_seq_blacklist_table_entry[0]' [-Warray-bounds=] fs/bcachefs/journal_seq_blacklist.c:176:27: warning: array subscript i is outside array bounds of 'struct journal_seq_blacklist_table_entry[0]' [-Warray-bounds=] fs/bcachefs/journal_seq_blacklist.c:177:27: warning: array subscript i is outside array bounds of 'struct journal_seq_blacklist_table_entry[0]' [-Warray-bounds=] fs/bcachefs/journal_seq_blacklist.c:297:34: warning: array subscript i is outside array bounds of 'struct journal_seq_blacklist_table_entry[0]' [-Warray-bounds=] fs/bcachefs/journal_seq_blacklist.c:298:34: warning: array subscript i is outside array bounds of 'struct journal_seq_blacklist_table_entry[0]' [-Warray-bounds=] fs/bcachefs/journal_seq_blacklist.c:300:31: warning: array subscript i is outside array bounds of 'struct journal_seq_blacklist_table_entry[0]' [-Warray-bounds=] This results in no differences in binary output. This helps with the ongoing efforts to globally enable -Warray-bounds. Signed-off-by: Gustavo A. R. Silva Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1b8bc556280d3f4970407480e6a5ff49efe5601b Author: Gustavo A. R. Silva Date: Mon Nov 6 16:27:02 2023 -0600 bcachefs: Use DECLARE_FLEX_ARRAY() helper and fix multiple -Warray-bounds warnings Transform zero-length array `s` into a proper flexible-array member in `struct snapshot_table` via the DECLARE_FLEX_ARRAY() helper; and fix tons of the following -Warray-bounds warnings: fs/bcachefs/snapshot.h:36:21: warning: array subscript is outside array bounds of 'struct snapshot_t[0]' [-Warray-bounds=] fs/bcachefs/snapshot.h:36:21: warning: array subscript is outside array bounds of 'struct snapshot_t[0]' [-Warray-bounds=] fs/bcachefs/snapshot.c:135:70: warning: array subscript is outside array bounds of 'struct snapshot_t[0]' [-Warray-bounds=] fs/bcachefs/snapshot.h:36:21: warning: array subscript is outside array bounds of 'struct snapshot_t[0]' [-Warray-bounds=] fs/bcachefs/snapshot.h:36:21: warning: array subscript is outside array bounds of 'struct snapshot_t[0]' [-Warray-bounds=] fs/bcachefs/snapshot.h:36:21: warning: array subscript is outside array bounds of 'struct snapshot_t[0]' [-Warray-bounds=] This helps with the ongoing efforts to globally enable -Warray-bounds. Signed-off-by: Gustavo A. R. Silva Signed-off-by: Kent Overstreet fs/bcachefs/subvolume_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c4f1f80a0e8d829ce4e29ca52cb7f74b22f67454 Author: Kent Overstreet Date: Sat Nov 11 12:30:19 2023 -0500 bcachefs: Use correct fgf_t type as function argument This quiets a sparse complaint. Signed-off-by: Kent Overstreet fs/bcachefs/fs-io-pagecache.c | 2 +- fs/bcachefs/fs-io-pagecache.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 48d584b7f90f48d2623fb01743b099efbf0d36c2 Author: Jiapeng Chong Date: Mon Nov 6 10:34:01 2023 +0800 bcachefs: make bch2_target_to_text_sb static The bch2_target_to_text_sb are not used outside the file disk_groups.c, so the modification is defined as static. fs/bcachefs/disk_groups.c:583:6: warning: no previous prototype for ‘bch2_target_to_text_sb’. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=7144 Signed-off-by: Jiapeng Chong Signed-off-by: Kent Overstreet fs/bcachefs/disk_groups.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 181724fc72486dec2bec8803459be05b5162aaa8 Author: Ekaterina Esina Date: Mon Nov 13 19:42:41 2023 +0300 cifs: fix check of rc in function generate_smb3signingkey Remove extra check after condition, add check after generating key for encryption. The check is needed to return non zero rc before rewriting it with generating key for decryption. Found by Linux Verification Center (linuxtesting.org) with SVACE. Reviewed-by: Paulo Alcantara (SUSE) Fixes: d70e9fa55884 ("cifs: try opening channels after mounting") Signed-off-by: Ekaterina Esina Co-developed-by: Anastasia Belova Signed-off-by: Anastasia Belova Signed-off-by: Steve French fs/smb/client/smb2transport.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit ff31ba19d732efb9aca3633935d71085e68d5076 Author: Anastasia Belova Date: Mon Nov 13 17:52:32 2023 +0300 cifs: spnego: add ';' in HOST_KEY_LEN "host=" should start with ';' (as in cifs_get_spnego_key) So its length should be 6. Found by Linux Verification Center (linuxtesting.org) with SVACE. Reviewed-by: Paulo Alcantara (SUSE) Fixes: 7c9c3760b3a5 ("[CIFS] add constants for string lengths of keynames in SPNEGO upcall string") Signed-off-by: Anastasia Belova Co-developed-by: Ekaterina Esina Signed-off-by: Ekaterina Esina Signed-off-by: Steve French fs/smb/client/cifs_spnego.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 37e6fd0cebf0b9f71afb38fd95b10408799d1f0b Author: Charles Keepax Date: Mon Nov 13 15:59:16 2023 +0000 ASoC: wm8974: Correct boost mixer inputs Bit 6 of INPPGA (INPPGAMUTE) does not control the Aux path, it controls the input PGA path, as can been seen from Figure 8 Input Boost Stage in the datasheet. Update the naming of things in the driver to match this and update the routing to also reflect this. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20231113155916.1741027-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/wm8974.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit a778616e4cc2d5e3a253c7d8959aafa5218fc5e4 Author: Dan Nowlin Date: Tue Nov 7 12:32:27 2023 -0500 ice: fix DDP package download for packages without signature segment Commit 3cbdb0343022 ("ice: Add support for E830 DDP package segment") incorrectly removed support for package download for packages without a signature segment. These packages include the signature buffer inline in the configurations buffers, and not in a signature segment. Fix package download by providing download support for both packages with (ice_download_pkg_with_sig_seg()) and without signature segment (ice_download_pkg_without_sig_seg()). Fixes: 3cbdb0343022 ("ice: Add support for E830 DDP package segment") Reported-by: Maciej Fijalkowski Closes: https://lore.kernel.org/netdev/ZUT50a94kk2pMGKb@boxer/ Tested-by: Maciej Fijalkowski Reviewed-by: Wojciech Drewek Reviewed-by: Jacob Keller Signed-off-by: Dan Nowlin Signed-off-by: Paul Greenwalt Reviewed-by: Simon Horman Tested-by: Arpana Arland (A Contingent worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_ddp.c | 103 ++++++++++++++++++++++++++++++- 1 file changed, 100 insertions(+), 3 deletions(-) commit 6db5f2cd9ebb12e930a82c01714a6589576cd50f Author: Arkadiusz Kubalewski Date: Tue Oct 31 18:08:00 2023 +0100 ice: dpll: fix output pin capabilities The dpll output pins which are used to feed clock signal of PHY and MAC circuits cannot be disconnected, those integrated circuits require clock signal for operation. By stopping assignment of DPLL_PIN_CAPABILITIES_STATE_CAN_CHANGE pin capability, prevent the user from invoking the state set callback on those pins, setting the state on those pins already returns error, as firmware doesn't allow the change of their state. Fixes: d7999f5ea64b ("ice: implement dpll interface to control cgu") Fixes: 8a3a565ff210 ("ice: add admin commands to access cgu configuration") Reviewed-by: Andrii Staikov Signed-off-by: Arkadiusz Kubalewski Tested-by: Sunitha Mekala (A Contingent worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_dpll.c | 12 ++++--- drivers/net/ethernet/intel/ice/ice_ptp_hw.c | 54 +++++++++++++++++++++++++++++ drivers/net/ethernet/intel/ice/ice_ptp_hw.h | 2 ++ 3 files changed, 64 insertions(+), 4 deletions(-) commit 4a4027f25dc3f39c2aafb3bf8926125c5378c9dc Author: Arkadiusz Kubalewski Date: Tue Oct 31 18:06:54 2023 +0100 ice: dpll: fix check for dpll input priority range Supported priority value for input pins may differ with regard of NIC firmware version. E810T NICs with 3.20/4.00 FW versions would accept priority range 0-31, where firmware 4.10+ would support the range 0-9 and extra value of 255. Remove the in-range check as the driver has no information on supported values from the running firmware, let firmware decide if given value is correct and return extack error if the value is not supported. Fixes: d7999f5ea64b ("ice: implement dpll interface to control cgu") Reviewed-by: Przemek Kitszel Reviewed-by: Jacob Keller Signed-off-by: Arkadiusz Kubalewski Tested-by: Sunitha Mekala (A Contingent worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_dpll.c | 6 ------ drivers/net/ethernet/intel/ice/ice_dpll.h | 1 - 2 files changed, 7 deletions(-) commit 7a1aba89ac54ccf6cad23a91a34c0ab24b1d7997 Author: Arkadiusz Kubalewski Date: Fri Oct 13 12:25:10 2023 +0200 ice: dpll: fix initial lock status of dpll When dpll device is registered and dpll subsystem performs notify of a new device, the lock state value provided to dpll subsystem equals 0 which is invalid value for the `enum dpll_lock_status`. Provide correct value by obtaining it from firmware before registering the dpll device. Fixes: d7999f5ea64b ("ice: implement dpll interface to control cgu") Signed-off-by: Aleksandr Loktionov Signed-off-by: Arkadiusz Kubalewski Tested-by: Sunitha Mekala (A Contingent worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_dpll.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 382561d16854a747e6df71034da08d20d6013dfe Author: Samuel Holland Date: Sun Nov 12 18:32:45 2023 -0800 i2c: ocores: Move system PM hooks to the NOIRQ phase When an I2C device contains a wake IRQ subordinate to a regmap-irq chip, the regmap-irq code must be able to perform I2C transactions during suspend_device_irqs() and resume_device_irqs(). Therefore, the bus must be suspended/resumed during the NOIRQ phase. Signed-off-by: Samuel Holland Acked-by: Peter Korsgaard Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-ocores.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9bacdd8996c77c42ca004440be610692275ff9d0 Merge: 58c09cad1754 d3933152442b Author: Linus Torvalds Date: Mon Nov 13 09:09:12 2023 -0800 Merge tag 'for-6.7-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix potential overflow in returned value from SEARCH_TREE_V2 ioctl on 32bit architecture - zoned mode fixes: - drop unnecessary write pointer check for RAID0/RAID1/RAID10 profiles, now it works because of raid-stripe-tree - wait for finishing the zone when direct IO needs a new allocation - simple quota fixes: - pass correct owning root pointer when cleaning up an aborted transaction - fix leaking some structures when processing delayed refs - change key type number of BTRFS_EXTENT_OWNER_REF_KEY, reorder it before inline refs that are supposed to be sorted, keeping the original number would complicate a lot of things; this change needs an updated version of btrfs-progs to work and filesystems need to be recreated - fix error pointer dereference after failure to allocate fs devices - fix race between accounting qgroup extents and removing a qgroup * tag 'for-6.7-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: make OWNER_REF_KEY type value smallest among inline refs btrfs: fix qgroup record leaks when using simple quotas btrfs: fix race between accounting qgroup extents and removing a qgroup btrfs: fix error pointer dereference after failure to allocate fs devices btrfs: make found_logical_ret parameter mandatory for function queue_scrub_stripe() btrfs: get correct owning_root when dropping snapshot btrfs: zoned: wait for data BG to be finished on direct IO allocation btrfs: zoned: drop no longer valid write pointer check btrfs: directly return 0 on no error code in btrfs_insert_raid_extent() btrfs: use u64 for buffer sizes in the tree search ioctls commit 58c09cad1754c56cb000ef07477e8781e3fad4d3 Author: Linus Torvalds Date: Mon Nov 13 08:52:24 2023 -0800 drm/ci: make github dependabot happy again The drm CI scripts for gitlab have a requirements file that makes the github 'dependabot' worry about a few of the required tooling versions. It wants to update the pip requirements from 23.2.1 to 23.3: "When installing a package from a Mercurial VCS URL, e.g. pip install hg+..., with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the hg clone call (e.g. --config). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial" and upgrade the urllib3 requirements from 2.0.4 to 2.0.7 due to two issues: "urllib3's request body not stripped after redirect from 303 status changes request method to GET" "`Cookie` HTTP header isn't stripped on cross-origin redirects" The file also ends up not having a newline at the end, that my editor ends up wanting to fix automatically. Link: https://github.com/dependabot Tested-by: Helen Koike Signed-off-by: Linus Torvalds drivers/gpu/drm/ci/xfails/requirements.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit d02ef87db9d6137fc2a98231b92f24ead4f7966d Author: Simon Trimmer Date: Mon Nov 13 16:40:29 2023 +0000 ALSA: hda: cs35l56: Enable low-power hibernation mode on i2c This can now be re-enabled as the sequence to reliably wake the device has been implemented in the shared ASoC code. This has a functional dependency on commit 3df761bdbc8b ("ASoC: cs35l56: Wake transactions need to be issued twice") To protect against this, enabling hibernation is conditional on CS35L56_WAKE_HOLD_TIME_US being defined, which indicates that the new hibernation sequences are available. Signed-off-by: Simon Trimmer Signed-off-by: Richard Fitzgerald Link: https://lore.kernel.org/r/20231113164029.1156669-1-rf@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l56_hda_i2c.c | 4 ++++ 1 file changed, 4 insertions(+) commit b0077e269f6c152e807fdac90b58caf012cdbaab Author: Christoph Hellwig Date: Mon Nov 13 11:52:31 2023 +0800 blk-mq: make sure active queue usage is held for bio_integrity_prep() blk_integrity_unregister() can come if queue usage counter isn't held for one bio with integrity prepared, so this request may be completed with calling profile->complete_fn, then kernel panic. Another constraint is that bio_integrity_prep() needs to be called before bio merge. Fix the issue by: - call bio_integrity_prep() with one queue usage counter grabbed reliably - call bio_integrity_prep() before bio merge Fixes: 900e080752025f00 ("block: move queue enter logic into blk_mq_submit_bio()") Reported-by: Yi Zhang Cc: Christoph Hellwig Signed-off-by: Ming Lei Tested-by: Yi Zhang Link: https://lore.kernel.org/r/20231113035231.2708053-1-ming.lei@redhat.com Signed-off-by: Jens Axboe block/blk-mq.c | 75 +++++++++++++++++++++++++++++----------------------------- 1 file changed, 38 insertions(+), 37 deletions(-) commit f96c6c588ca81255566a5168e51c9cbbe7b86def Author: Juergen Gross Date: Tue Sep 26 14:29:54 2023 +0200 xen/events: remove unused functions There are no users of xen_irq_from_pirq() and xen_set_irq_pending(). Remove those functions. Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Signed-off-by: Juergen Gross drivers/xen/events/events_base.c | 30 ------------------------------ include/xen/events.h | 4 ---- 2 files changed, 34 deletions(-) commit 47d970204054f859f35a2237baa75c2d84fcf436 Author: Juergen Gross Date: Mon Sep 25 17:54:13 2023 +0200 xen/events: fix delayed eoi list handling When delaying eoi handling of events, the related elements are queued into the percpu lateeoi list. In case the list isn't empty, the elements should be sorted by the time when eoi handling is to happen. Unfortunately a new element will never be queued at the start of the list, even if it has a handling time lower than all other list elements. Fix that by handling that case the same way as for an empty list. Fixes: e99502f76271 ("xen/events: defer eoi in case of excessive number of events") Reported-by: Jan Beulich Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Signed-off-by: Juergen Gross drivers/xen/events/events_base.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit b0eeba527e704d6023a6cd9103f929226e326b03 Author: Chen Ni Date: Tue Oct 31 08:08:07 2023 +0000 pinctrl: stm32: Add check for devm_kcalloc Add check for the return value of devm_kcalloc() and return the error if it fails in order to avoid NULL pointer dereference. Fixes: 32c170ff15b0 ("pinctrl: stm32: set default gpio line names using pin names") Signed-off-by: Chen Ni Acked-by: Valentin Caron Link: https://lore.kernel.org/r/20231031080807.3600656-1-nichen@iscas.ac.cn Signed-off-by: Linus Walleij drivers/pinctrl/stm32/pinctrl-stm32.c | 5 +++++ 1 file changed, 5 insertions(+) commit 0c6498a59fbbcbf3d0a58c282dd6f0bca0eed92a Author: Matus Malych Date: Sun Nov 12 17:54:04 2023 +0100 ASoC: amd: yc: Add HP 255 G10 into quirk table HP 255 G10's internal microphone array can be made to work by adding it to the quirk table. Signed-off-by: Matus Malych Link: https://lore.kernel.org/r/20231112165403.3221-1-matus@malych.org Signed-off-by: Mark Brown sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+) commit f1ed48ef97e2d12dee21e42db4a6ebb895ed3a79 Author: Lorenzo Pieralisi Date: Wed Nov 8 12:15:49 2023 +0100 firmware: arm_ffa: Fix ffa_notification_info_get() IDs handling To parse the retrieved ID lists appropriately in ffa_notification_info_get() the ids_processed variable should not be pre-incremented - we are dropping an identifier at the beginning of the list. Fix it by using the post-increment operator to increment the number of processed IDs. Fixes: 3522be48d82b ("firmware: arm_ffa: Implement the NOTIFICATION_INFO_GET interface") Signed-off-by: Lorenzo Pieralisi Cc: Sudeep Holla Link: https://lore.kernel.org/r/20231108111549.155974-1-lpieralisi@kernel.org Signed-off-by: Sudeep Holla drivers/firmware/arm_ffa/driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 05857a1eb723190923b091a857184ced17a83770 Author: Sudeep Holla Date: Tue Oct 31 14:13:35 2023 +0000 firmware: arm_ffa: Fix the size of the allocation in ffa_partitions_cleanup() Arry of pointer to struct ffa_dev_part_info needs to be allocated to fetch the pointers stored in XArray. However, currently we allocate the entire structure instead of just pointers. Fix the allocation size. This will also eliminate the below Smatch istatic checker warning: | drivers/firmware/arm_ffa/driver.c:1251 ffa_partitions_cleanup() | warn: double check that we're allocating correct size: 8 vs 88 Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/0e8ddbca-d9da-4a3b-aae3-328993b62ba2@moroto.mountain Link: https://lore.kernel.org/r/20231031141335.3077026-1-sudeep.holla@arm.com Signed-off-by: Sudeep Holla drivers/firmware/arm_ffa/driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6d67cbe67a86a87307df0c6fafa74394a6820ad6 Author: Sudeep Holla Date: Tue Oct 24 11:56:20 2023 +0100 firmware: arm_ffa: Fix FFA notifications cleanup path We allow the FF-A to be initialised successfully even when notification fails. When the notification fails, ffa_notifications_cleanup() gets called on the failure path. However, the driver information about the notifications like the irq, workqueues and cpu hotplug state for enabling and disabling percpu IRQ are not cleared. This may result in unexpected behaviour during CPU hotplug because of percpu IRQ being enabled and disabled or during the driver removal when ffa_notifications_cleanup() gets executed again. Fix the FFA notifications cleanup path by clearing all the notification related driver information. Link: https://lore.kernel.org/r/20231024-ffa-notification-fixes-v1-4-d552c0ec260d@arm.com Tested-by: Jens Wiklander Signed-off-by: Sudeep Holla drivers/firmware/arm_ffa/driver.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) commit f4bfcaee34bc9527274710884f8d14039f3ee506 Author: Sudeep Holla Date: Tue Oct 24 11:56:19 2023 +0100 firmware: arm_ffa: Add checks for the notification enabled state We need to check if the FF-A notifications are enabled or not in all the notification operations that are accessible for the FF-A device from the FF-A driver. This helps to avoid making calls to the FF-A firmware even if the notification setup has failed. Link: https://lore.kernel.org/r/20231024-ffa-notification-fixes-v1-3-d552c0ec260d@arm.com Tested-by: Jens Wiklander Signed-off-by: Sudeep Holla drivers/firmware/arm_ffa/driver.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) commit 6f47023f7a52f3482937e9271ba41570b8752067 Author: Sudeep Holla Date: Tue Oct 24 11:56:18 2023 +0100 firmware: arm_ffa: Setup the partitions after the notification initialisation Currently the notifications are setup of the partitions are probed and FF-A devices are added on the FF-A bus. The FF-A driver probe can be called even before the FF-A notification setup happens which is wrong and may result in failure or misbehaviour in the FF-A partition device probe. In order to ensure the FF-A notifications are setup before the FF-A devices are probed, let us move the FF-A partition setup after the completion of FF-A notification setup. Link: https://lore.kernel.org/r/20231024-ffa-notification-fixes-v1-2-d552c0ec260d@arm.com Tested-by: Jens Wiklander Signed-off-by: Sudeep Holla drivers/firmware/arm_ffa/driver.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) commit 95520fc07743d3f58e8872acd72e928b09fbc143 Author: Sudeep Holla Date: Tue Oct 24 11:56:17 2023 +0100 firmware: arm_ffa: Allow FF-A initialisation even when notification fails FF-A notifications are optional feature in the specification. Currently we allow to continue if the firmware reports no support for the notifications. However, we fail to continue and complete the FF-A driver initialisation if the notification setup fails for any reason. Let us allow the FF-A driver to complete the initialisation even if the notification fails to setup. We will just flag the error and continue to provide other features in the driver. Link: https://lore.kernel.org/r/20231024-ffa-notification-fixes-v1-1-d552c0ec260d@arm.com Tested-by: Jens Wiklander Signed-off-by: Sudeep Holla drivers/firmware/arm_ffa/driver.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) commit 3fad96e9b21bed214c1593d7d7fb3e40d1fbf6f4 Author: Sudeep Holla Date: Tue Oct 24 11:57:15 2023 +0100 firmware: arm_ffa: Declare ffa_bus_type structure in the header smatch reports: drivers/firmware/arm_ffa/bus.c:108:17: warning: symbol 'ffa_bus_type' was not declared. Should it be static? ffa_bus_type is exported to be useful in the FF-A driver. So this warning is not correct. However, declaring the ffa_bus_type structure in the header like many other bus_types do already removes this warning. So let us just do the same and get rid of the warning. Link: https://lore.kernel.org/r/20231024105715.2369638-1-sudeep.holla@arm.com Signed-off-by: Sudeep Holla include/linux/arm_ffa.h | 2 ++ 1 file changed, 2 insertions(+) commit c0a2a1b0d631fc460d830f52d06211838874d655 Author: Willem de Bruijn Date: Sun Nov 12 22:16:32 2023 -0500 ppp: limit MRU to 64K ppp_sync_ioctl allows setting device MRU, but does not sanity check this input. Limit to a sane upper bound of 64KB. No implementation I could find generates larger than 64KB frames. RFC 2823 mentions an upper bound of PPP over SDL of 64KB based on the 16-bit length field. Other protocols will be smaller, such as PPPoE (9KB jumbo frame) and PPPoA (18190 maximum CPCS-SDU size, RFC 2364). PPTP and L2TP encapsulate in IP. Syzbot managed to trigger alloc warning in __alloc_pages: if (WARN_ON_ONCE_GFP(order > MAX_ORDER, gfp)) WARNING: CPU: 1 PID: 37 at mm/page_alloc.c:4544 __alloc_pages+0x3ab/0x4a0 mm/page_alloc.c:4544 __alloc_skb+0x12b/0x330 net/core/skbuff.c:651 __netdev_alloc_skb+0x72/0x3f0 net/core/skbuff.c:715 netdev_alloc_skb include/linux/skbuff.h:3225 [inline] dev_alloc_skb include/linux/skbuff.h:3238 [inline] ppp_sync_input drivers/net/ppp/ppp_synctty.c:669 [inline] ppp_sync_receive+0xff/0x680 drivers/net/ppp/ppp_synctty.c:334 tty_ldisc_receive_buf+0x14c/0x180 drivers/tty/tty_buffer.c:390 tty_port_default_receive_buf+0x70/0xb0 drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:444 [inline] flush_to_ldisc+0x261/0x780 drivers/tty/tty_buffer.c:494 process_one_work+0x884/0x15c0 kernel/workqueue.c:2630 With call ioctl$PPPIOCSMRU1(r1, 0x40047452, &(0x7f0000000100)=0x5e6417a8) Similar code exists in other drivers that implement ppp_channel_ops ioctl PPPIOCSMRU. Those might also be in scope. Notably excluded from this are pppol2tp_ioctl and pppoe_ioctl. This code goes back to the start of git history. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+6177e1f90d92583bcc58@syzkaller.appspotmail.com Signed-off-by: Willem de Bruijn Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller drivers/net/ppp/ppp_synctty.c | 4 ++++ 1 file changed, 4 insertions(+) commit ca8add922f9c7f6e2e3c71039da8e0dcc64b87ed Author: Sven Auhagen Date: Sat Nov 11 05:41:12 2023 +0100 net: mvneta: fix calls to page_pool_get_stats Calling page_pool_get_stats in the mvneta driver without checks leads to kernel crashes. First the page pool is only available if the bm is not used. The page pool is also not allocated when the port is stopped. It can also be not allocated in case of errors. The current implementation leads to the following crash calling ethstats on a port that is down or when calling it at the wrong moment: ble to handle kernel NULL pointer dereference at virtual address 00000070 [00000070] *pgd=00000000 Internal error: Oops: 5 [#1] SMP ARM Hardware name: Marvell Armada 380/385 (Device Tree) PC is at page_pool_get_stats+0x18/0x1cc LR is at mvneta_ethtool_get_stats+0xa0/0xe0 [mvneta] pc : [] lr : [] psr: a0000013 sp : f1439d48 ip : f1439dc0 fp : 0000001d r10: 00000100 r9 : c4816b80 r8 : f0d75150 r7 : bf0b400c r6 : c238f000 r5 : 00000000 r4 : f1439d68 r3 : c2091040 r2 : ffffffd8 r1 : f1439d68 r0 : 00000000 Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 066b004a DAC: 00000051 Register r0 information: NULL pointer Register r1 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 Register r2 information: non-paged memory Register r3 information: slab kmalloc-2k start c2091000 pointer offset 64 size 2048 Register r4 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 Register r5 information: NULL pointer Register r6 information: slab kmalloc-cg-4k start c238f000 pointer offset 0 size 4096 Register r7 information: 15-page vmalloc region starting at 0xbf0a8000 allocated at load_module+0xa30/0x219c Register r8 information: 1-page vmalloc region starting at 0xf0d75000 allocated at ethtool_get_stats+0x138/0x208 Register r9 information: slab task_struct start c4816b80 pointer offset 0 Register r10 information: non-paged memory Register r11 information: non-paged memory Register r12 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 Process snmpd (pid: 733, stack limit = 0x38de3a88) Stack: (0xf1439d48 to 0xf143a000) 9d40: 000000c0 00000001 c238f000 bf0b400c f0d75150 c4816b80 9d60: 00000100 bf0a98d8 00000000 00000000 00000000 00000000 00000000 00000000 9d80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9da0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9dc0: 00000dc0 5335509c 00000035 c238f000 bf0b2214 01067f50 f0d75000 c0b9b9c8 9de0: 0000001d 00000035 c2212094 5335509c c4816b80 c238f000 c5ad6e00 01067f50 9e00: c1b0be80 c4816b80 00014813 c0b9d7f0 00000000 00000000 0000001d 0000001d 9e20: 00000000 00001200 00000000 00000000 c216ed90 c73943b8 00000000 00000000 9e40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9e60: 00000000 c0ad9034 00000000 00000000 00000000 00000000 00000000 00000000 9e80: 00000000 00000000 00000000 5335509c c1b0be80 f1439ee4 00008946 c1b0be80 9ea0: 01067f50 f1439ee3 00000000 00000046 b6d77ae0 c0b383f0 00008946 becc83e8 9ec0: c1b0be80 00000051 0000000b c68ca480 c7172d00 c0ad8ff0 f1439ee3 cf600e40 9ee0: 01600e40 32687465 00000000 00000000 00000000 01067f50 00000000 00000000 9f00: 00000000 5335509c 00008946 00008946 00000000 c68ca480 becc83e8 c05e2de0 9f20: f1439fb0 c03002f0 00000006 5ac3c35a c4816b80 00000006 b6d77ae0 c030caf0 9f40: c4817350 00000014 f1439e1c 0000000c 00000000 00000051 01000000 00000014 9f60: 00003fec f1439edc 00000001 c0372abc b6d77ae0 c0372abc cf600e40 5335509c 9f80: c21e6800 01015c9c 0000000b 00008946 00000036 c03002f0 c4816b80 00000036 9fa0: b6d77ae0 c03000c0 01015c9c 0000000b 0000000b 00008946 becc83e8 00000000 9fc0: 01015c9c 0000000b 00008946 00000036 00000035 010678a0 b6d797ec b6d77ae0 9fe0: b6dbf738 becc838c b6d186d7 b6baa858 40000030 0000000b 00000000 00000000 page_pool_get_stats from mvneta_ethtool_get_stats+0xa0/0xe0 [mvneta] mvneta_ethtool_get_stats [mvneta] from ethtool_get_stats+0x154/0x208 ethtool_get_stats from dev_ethtool+0xf48/0x2480 dev_ethtool from dev_ioctl+0x538/0x63c dev_ioctl from sock_ioctl+0x49c/0x53c sock_ioctl from sys_ioctl+0x134/0xbd8 sys_ioctl from ret_fast_syscall+0x0/0x1c Exception stack(0xf1439fa8 to 0xf1439ff0) 9fa0: 01015c9c 0000000b 0000000b 00008946 becc83e8 00000000 9fc0: 01015c9c 0000000b 00008946 00000036 00000035 010678a0 b6d797ec b6d77ae0 9fe0: b6dbf738 becc838c b6d186d7 b6baa858 Code: e28dd004 e1a05000 e2514000 0a00006a (e5902070) This commit adds the proper checks before calling page_pool_get_stats. Fixes: b3fc79225f05 ("net: mvneta: add support for page_pool_get_stats") Signed-off-by: Sven Auhagen Reported-by: Paulo Da Silva Acked-by: Lorenzo Bianconi Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mvneta.c | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) commit fb317eb23b5ee4c37b0656a9a52a3db58d9dd072 Author: Shigeru Yoshida Date: Sat Nov 11 01:39:47 2023 +0900 tipc: Fix kernel-infoleak due to uninitialized TLV value KMSAN reported the following kernel-infoleak issue: ===================================================== BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x4ec/0x2bc0 lib/iov_iter.c:186 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x4ec/0x2bc0 lib/iov_iter.c:186 copy_to_iter include/linux/uio.h:197 [inline] simple_copy_to_iter net/core/datagram.c:532 [inline] __skb_datagram_iter.5+0x148/0xe30 net/core/datagram.c:420 skb_copy_datagram_iter+0x52/0x210 net/core/datagram.c:546 skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline] netlink_recvmsg+0x43d/0x1630 net/netlink/af_netlink.c:1967 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg net/socket.c:1066 [inline] __sys_recvfrom+0x476/0x860 net/socket.c:2246 __do_sys_recvfrom net/socket.c:2264 [inline] __se_sys_recvfrom net/socket.c:2260 [inline] __x64_sys_recvfrom+0x130/0x200 net/socket.c:2260 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: slab_post_alloc_hook+0x103/0x9e0 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x5f7/0xb50 mm/slub.c:3523 kmalloc_reserve+0x13c/0x4a0 net/core/skbuff.c:560 __alloc_skb+0x2fd/0x770 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1286 [inline] tipc_tlv_alloc net/tipc/netlink_compat.c:156 [inline] tipc_get_err_tlv+0x90/0x5d0 net/tipc/netlink_compat.c:170 tipc_nl_compat_recv+0x1042/0x15d0 net/tipc/netlink_compat.c:1324 genl_family_rcv_msg_doit net/netlink/genetlink.c:972 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline] genl_rcv_msg+0x1220/0x12c0 net/netlink/genetlink.c:1067 netlink_rcv_skb+0x4a4/0x6a0 net/netlink/af_netlink.c:2545 genl_rcv+0x41/0x60 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0xf4b/0x1230 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1242/0x1420 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x997/0xd60 net/socket.c:2588 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2642 __sys_sendmsg net/socket.c:2671 [inline] __do_sys_sendmsg net/socket.c:2680 [inline] __se_sys_sendmsg net/socket.c:2678 [inline] __x64_sys_sendmsg+0x2fa/0x4a0 net/socket.c:2678 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Bytes 34-35 of 36 are uninitialized Memory access of size 36 starts at ffff88802d464a00 Data copied to user address 00007ff55033c0a0 CPU: 0 PID: 30322 Comm: syz-executor.0 Not tainted 6.6.0-14500-g1c41041124bd #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014 ===================================================== tipc_add_tlv() puts TLV descriptor and value onto `skb`. This size is calculated with TLV_SPACE() macro. It adds the size of struct tlv_desc and the length of TLV value passed as an argument, and aligns the result to a multiple of TLV_ALIGNTO, i.e., a multiple of 4 bytes. If the size of struct tlv_desc plus the length of TLV value is not aligned, the current implementation leaves the remaining bytes uninitialized. This is the cause of the above kernel-infoleak issue. This patch resolves this issue by clearing data up to an aligned size. Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat") Signed-off-by: Shigeru Yoshida Reviewed-by: Simon Horman Signed-off-by: David S. Miller net/tipc/netlink_compat.c | 1 + 1 file changed, 1 insertion(+) commit e6daf129ccb79d3781129f623f82bc676f2cb02c Author: Willem de Bruijn Date: Fri Nov 10 10:36:00 2023 -0500 net: gso_test: support CONFIG_MAX_SKB_FRAGS up to 45 The test allocs a single page to hold all the frag_list skbs. This is insufficient on kernels with CONFIG_MAX_SKB_FRAGS=45, due to the increased skb_shared_info frags[] array length. gso_test_func: ASSERTION FAILED at net/core/gso_test.c:210 Expected alloc_size <= ((1UL) << 12), but alloc_size == 5075 (0x13d3) ((1UL) << 12) == 4096 (0x1000) Simplify the logic. Just allocate a page for each frag_list skb. Fixes: 4688ecb1385f ("net: expand skb_segment unit test with frag_list coverage") Signed-off-by: Willem de Bruijn Reviewed-by: Simon Horman Signed-off-by: David S. Miller net/core/gso_test.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) commit 438cbcdf105d84449fceb39a2d0e16d0ec20708f Author: Marek Behún Date: Fri Nov 10 13:05:46 2023 +0100 net: mdio: fix typo in header The quotes symbol in "EEE "link partner ability 1 should be at the end of the register name "EEE link partner ability 1" Signed-off-by: Marek Behún Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller include/linux/mdio.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6979a51ecaec4dfb7c768eb2a77b77df73a74c8e Author: MD Danish Anwar Date: Mon Nov 13 15:16:56 2023 +0530 MAINTAINERS: add entry for TI ICSSG Ethernet driver Add record for TI Industrial Communication Subsystem - Gigabit (ICSSG) Ethernet driver. Also add Roger and myself as maintainer. Signed-off-by: MD Danish Anwar Signed-off-by: David S. Miller MAINTAINERS | 9 +++++++++ 1 file changed, 9 insertions(+) commit f726eaa787e9f9bc858c902d18a09af6bcbfcdaf Author: Jan Bottorff Date: Thu Nov 9 03:19:27 2023 +0000 i2c: designware: Fix corrupted memory seen in the ISR When running on a many core ARM64 server, errors were happening in the ISR that looked like corrupted memory. These corruptions would fix themselves if small delays were inserted in the ISR. Errors reported by the driver included "i2c_designware APMC0D0F:00: i2c_dw_xfer_msg: invalid target address" and "i2c_designware APMC0D0F:00:controller timed out" during in-band IPMI SSIF stress tests. The problem was determined to be memory writes in the driver were not becoming visible to all cores when execution rapidly shifted between cores, like when a register write immediately triggers an ISR. Processors with weak memory ordering, like ARM64, make no guarantees about the order normal memory writes become globally visible, unless barrier instructions are used to control ordering. To solve this, regmap accessor functions configured by this driver were changed to use non-relaxed forms of the low-level register access functions, which include a barrier on platforms that require it. This assures memory writes before a controller register access are visible to all cores. The community concluded defaulting to correct operation outweighed defaulting to the small performance gains from using relaxed access functions. Being a low speed device added weight to this choice of default register access behavior. Signed-off-by: Jan Bottorff Acked-by: Jarkko Nikula Tested-by: Serge Semin Reviewed-by: Serge Semin Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-designware-common.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit aff787f64ad7cbb54614b51b82c682fe06411ef3 Author: Yicong Yang Date: Tue Oct 10 16:47:30 2023 +0800 hwtracing: hisi_ptt: Don't try to attach a task PTT is an uncore PMU and shouldn't be attached to any task. Block the usage in pmu::event_init(). Signed-off-by: Yicong Yang Acked-by: Jonathan Cameron Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20231010084731.30450-5-yangyicong@huawei.com drivers/hwtracing/ptt/hisi_ptt.c | 3 +++ 1 file changed, 3 insertions(+) commit e0dd27ad8af00f147ac3c9de88e0687986afc3ea Author: Yicong Yang Date: Tue Oct 10 16:47:28 2023 +0800 hwtracing: hisi_ptt: Handle the interrupt in hardirq context Handle the trace interrupt in the hardirq context, make sure the irq core won't threaded it by declaring IRQF_NO_THREAD and userspace won't balance it by declaring IRQF_NOBALANCING. Otherwise we may violate the synchronization requirements of the perf core, referenced to the change of arm-ccn PMU commit 0811ef7e2f54 ("bus: arm-ccn: fix PMU interrupt flags"). In the interrupt handler we mainly doing 2 things: - Copy the data from the local DMA buffer to the AUX buffer - Commit the data in the AUX buffer Signed-off-by: Yicong Yang Acked-by: Jonathan Cameron [ Fixed commit description to suppress checkpatch warning ] Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20231010084731.30450-3-yangyicong@huawei.com drivers/hwtracing/ptt/hisi_ptt.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 55e0a2fb0cb5ab7c9c99c1ad4d3e6954de8b73a0 Author: Junhao He Date: Tue Oct 10 16:47:31 2023 +0800 hwtracing: hisi_ptt: Add dummy callback pmu::read() When start trace with perf option "-C $cpu" and immediately stop it with SIGTERM or others, the perf core will invoke pmu::read() while the driver doesn't implement it. Add a dummy pmu::read() to avoid any issues. Fixes: ff0de066b463 ("hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device") Signed-off-by: Junhao He Signed-off-by: Yicong Yang Acked-by: Jonathan Cameron Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20231010084731.30450-6-yangyicong@huawei.com drivers/hwtracing/ptt/hisi_ptt.c | 5 +++++ 1 file changed, 5 insertions(+) commit 287e82cf69aa264a52bc37591bd0eb407e20f85c Author: James Clark Date: Fri Oct 6 14:14:52 2023 +0100 coresight: Fix crash when Perf and sysfs modes are used concurrently Partially revert the change in commit 6148652807ba ("coresight: Enable and disable helper devices adjacent to the path") which changed the bare call from source_ops(csdev)->enable() to coresight_enable_source() for Perf sessions. It was missed that coresight_enable_source() is specifically for the sysfs interface, rather than being a generic call. This interferes with the sysfs reference counting to cause the following crash: $ perf record -e cs_etm/@tmc_etr0/ -C 0 & $ echo 1 > /sys/bus/coresight/devices/tmc_etr0/enable_sink $ echo 1 > /sys/bus/coresight/devices/etm0/enable_source $ echo 0 > /sys/bus/coresight/devices/etm0/enable_source Unable to handle kernel NULL pointer dereference at virtual address 00000000000001d0 Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP ... Call trace: etm4_disable+0x54/0x150 [coresight_etm4x] coresight_disable_source+0x6c/0x98 [coresight] coresight_disable+0x74/0x1c0 [coresight] enable_source_store+0x88/0xa0 [coresight] dev_attr_store+0x20/0x40 sysfs_kf_write+0x4c/0x68 kernfs_fop_write_iter+0x120/0x1b8 vfs_write+0x2dc/0x3b0 ksys_write+0x70/0x108 __arm64_sys_write+0x24/0x38 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x104/0x130 do_el0_svc+0x40/0xb8 el0_svc+0x2c/0xb8 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x1a4/0x1a8 Code: d53cd042 91002000 b9402a81 b8626800 (f940ead5) ---[ end trace 0000000000000000 ]--- This commit linked below also fixes the issue, but has unlocked updates to the mode which could potentially race. So until we come up with a more complete solution that takes all locking and interaction between both modes into account, just revert back to the old behavior for Perf. Reported-by: Junhao He Closes: https://lore.kernel.org/linux-arm-kernel/20230921132904.60996-1-hejunhao3@huawei.com/ Fixes: 6148652807ba ("coresight: Enable and disable helper devices adjacent to the path") Tested-by: Junhao He Signed-off-by: James Clark Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20231006131452.646721-1-james.clark@arm.com drivers/hwtracing/coresight/coresight-etm-perf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 348ddab81f7b0983d9fb158df910254f08d3f887 Author: Uwe Kleine-König Date: Fri Sep 29 10:16:37 2023 +0200 coresight: etm4x: Remove bogous __exit annotation for some functions etm4_platform_driver (which lives in ".data" contains a reference to etm4_remove_platform_dev(). So the latter must not be marked with __exit which results in the function being discarded for a build with CONFIG_CORESIGHT_SOURCE_ETM4X=y which in turn makes the remove pointer contain invalid data. etm4x_amba_driver referencing etm4_remove_amba() has the same issue. Drop the __exit annotations for the two affected functions and a third one that is called by the other two. For reasons I don't understand this isn't catched by building with CONFIG_DEBUG_SECTION_MISMATCH=y. Fixes: c23bc382ef0e ("coresight: etm4x: Refactor probing routine") Fixes: 5214b563588e ("coresight: etm4x: Add support for sysreg only devices") Signed-off-by: Uwe Kleine-König Reviewed-by: James Clark Link: https://lore.kernel.org/all/20230929081540.yija47lsj35xtj4v@pengutronix.de/ Link: https://lore.kernel.org/r/20230929081637.2377335-1-u.kleine-koenig@pengutronix.de Signed-off-by: Suzuki K Poulose drivers/hwtracing/coresight/coresight-etm4x-core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 5d64075cd80069a67a275482f70a4793a6b0a072 Merge: 2bd5b559a1f3 dff655e82faf Author: David S. Miller Date: Mon Nov 13 09:06:58 2023 +0000 Merge branch 'hns3-fixes' Jijie Shao says: ==================== There are some bugfix for the HNS3 ethernet driver There are some bugfix for the HNS3 ethernet driver --- ChangeLog: v1 -> v2: - net: hns3: fix add VLAN fail issue, net: hns3: fix VF reset fail issue are modified suggested by Paolo v1: https://lore.kernel.org/all/20231028025917.314305-1-shaojijie@huawei.com/ ==================== Signed-off-by: David S. Miller commit dff655e82faffc287d4a72a59f66fa120bf904e4 Author: Jijie Shao Date: Fri Nov 10 17:37:13 2023 +0800 net: hns3: fix VF wrong speed and duplex issue If PF is down, firmware will returns 10 Mbit/s rate and half-duplex mode when PF queries the port information from firmware. After imp reset command is executed, PF status changes to down, and PF will query link status and updates port information from firmware in a periodic scheduled task. However, there is a low probability that port information is updated when PF is down, and then PF link status changes to up. In this case, PF synchronizes incorrect rate and duplex mode to VF. This patch fixes it by updating port information before PF synchronizes the rate and duplex to the VF when PF changes to up. Fixes: 18b6e31f8bf4 ("net: hns3: PF add support for pushing link status to VFs") Signed-off-by: Jijie Shao Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++++ 1 file changed, 4 insertions(+) commit 65e98bb56fa3ce2edb400930c05238c9b380500e Author: Jijie Shao Date: Fri Nov 10 17:37:12 2023 +0800 net: hns3: fix VF reset fail issue Currently the reset process in hns3 and firmware watchdog init process is asynchronous. We think firmware watchdog initialization is completed before VF clear the interrupt source. However, firmware initialization may not complete early. So VF will receive multiple reset interrupts and fail to reset. So we add delay before VF interrupt source and 5 ms delay is enough to avoid second reset interrupt. Fixes: 427900d27d86 ("net: hns3: fix the timing issue of VF clearing interrupt sources") Signed-off-by: Jijie Shao Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 14 +++++++++++++- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 1 + 2 files changed, 14 insertions(+), 1 deletion(-) commit dbd2f3b20c6ae425665b6975d766e3653d453e73 Author: Yonglong Liu Date: Fri Nov 10 17:37:11 2023 +0800 net: hns3: fix variable may not initialized problem in hns3_init_mac_addr() When a VF is calling hns3_init_mac_addr(), get_mac_addr() may return fail, then the value of mac_addr_temp is not initialized. Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") Signed-off-by: Yonglong Liu Signed-off-by: Jijie Shao Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 53aba458f23846112c0d44239580ff59bc5c36c3 Author: Yonglong Liu Date: Fri Nov 10 17:37:10 2023 +0800 net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs The hns3 driver define an array of string to show the coalesce info, but if the kernel adds a new mode or a new state, out-of-bounds access may occur when coalesce info is read via debugfs, this patch fix the problem. Fixes: c99fead7cb07 ("net: hns3: add debugfs support for interrupt coalesce") Signed-off-by: Yonglong Liu Signed-off-by: Jijie Shao Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 75b247b57d8b71bcb679e4cb37d0db104848806c Author: Jian Shen Date: Fri Nov 10 17:37:09 2023 +0800 net: hns3: fix incorrect capability bit display for copper port Currently, the FEC capability bit is default set for device version V2. It's incorrect for the copper port. Eventhough it doesn't make the nic work abnormal, but the capability information display in debugfs may confuse user. So clear it when driver get the port type inforamtion. Fixes: 433ccce83504 ("net: hns3: use FEC capability queried from firmware") Signed-off-by: Jian Shen Signed-off-by: Jijie Shao Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 1 + 1 file changed, 1 insertion(+) commit ac92c0a9a0603fb448e60f38e63302e4eebb8035 Author: Yonglong Liu Date: Fri Nov 10 17:37:08 2023 +0800 net: hns3: add barrier in vf mailbox reply process In hclgevf_mbx_handler() and hclgevf_get_mbx_resp() functions, there is a typical store-store and load-load scenario between received_resp and additional_info. This patch adds barrier to fix the problem. Fixes: 4671042f1ef0 ("net: hns3: add match_id to check mailbox response from PF to VF") Signed-off-by: Yonglong Liu Signed-off-by: Jijie Shao Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 472a2ff63efb30234cbf6b2cdaf8117f21b4f8bc Author: Jian Shen Date: Fri Nov 10 17:37:07 2023 +0800 net: hns3: fix add VLAN fail issue The hclge_sync_vlan_filter is called in periodic task, trying to remove VLAN from vlan_del_fail_bmap. It can be concurrence with VLAN adding operation from user. So once user failed to delete a VLAN id, and add it again soon, it may be removed by the periodic task, which may cause the software configuration being inconsistent with hardware. So add mutex handling to avoid this. user hns3 driver periodic task │ add vlan 10 ───── hns3_vlan_rx_add_vid │ │ (suppose success) │ │ │ del vlan 10 ───── hns3_vlan_rx_kill_vid │ │ (suppose fail,add to │ │ vlan_del_fail_bmap) │ │ │ add vlan 10 ───── hns3_vlan_rx_add_vid │ (suppose success) │ foreach vlan_del_fail_bmp del vlan 10 Fixes: fe4144d47eef ("net: hns3: sync VLAN filter entries when kill VLAN ID failed") Signed-off-by: Jian Shen Signed-off-by: Jijie Shao Signed-off-by: David S. Miller .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 28 +++++++++++++++------- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 11 +++++++-- 2 files changed, 29 insertions(+), 10 deletions(-) commit efb9cbf66440482ceaa90493d648226ab7ec2ebf Author: Junxian Huang Date: Sat Oct 28 17:32:42 2023 +0800 RDMA/hns: Fix unnecessary err return when using invalid congest control algorithm Add a default congest control algorithm so that driver won't return an error when the configured algorithm is invalid. Fixes: f91696f2f053 ("RDMA/hns: Support congestion control type selection according to the FW") Signed-off-by: Junxian Huang Link: https://lore.kernel.org/r/20231028093242.670325-1-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit 0550d4604e2ca4e653dc13f0c009fc42106b6bfc Author: Shigeru Yoshida Date: Wed Nov 8 23:31:13 2023 +0900 RDMA/core: Fix uninit-value access in ib_get_eth_speed() KMSAN reported the following uninit-value access issue: lo speed is unknown, defaulting to 1000 ===================================================== BUG: KMSAN: uninit-value in ib_get_width_and_speed drivers/infiniband/core/verbs.c:1889 [inline] BUG: KMSAN: uninit-value in ib_get_eth_speed+0x546/0xaf0 drivers/infiniband/core/verbs.c:1998 ib_get_width_and_speed drivers/infiniband/core/verbs.c:1889 [inline] ib_get_eth_speed+0x546/0xaf0 drivers/infiniband/core/verbs.c:1998 siw_query_port drivers/infiniband/sw/siw/siw_verbs.c:173 [inline] siw_get_port_immutable+0x6f/0x120 drivers/infiniband/sw/siw/siw_verbs.c:203 setup_port_data drivers/infiniband/core/device.c:848 [inline] setup_device drivers/infiniband/core/device.c:1244 [inline] ib_register_device+0x1589/0x1df0 drivers/infiniband/core/device.c:1383 siw_device_register drivers/infiniband/sw/siw/siw_main.c:72 [inline] siw_newlink+0x129e/0x13d0 drivers/infiniband/sw/siw/siw_main.c:490 nldev_newlink+0x8fd/0xa60 drivers/infiniband/core/nldev.c:1763 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0xe8a/0x1120 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0xf4b/0x1230 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1242/0x1420 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x997/0xd60 net/socket.c:2588 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2642 __sys_sendmsg net/socket.c:2671 [inline] __do_sys_sendmsg net/socket.c:2680 [inline] __se_sys_sendmsg net/socket.c:2678 [inline] __x64_sys_sendmsg+0x2fa/0x4a0 net/socket.c:2678 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Local variable lksettings created at: ib_get_eth_speed+0x4b/0xaf0 drivers/infiniband/core/verbs.c:1974 siw_query_port drivers/infiniband/sw/siw/siw_verbs.c:173 [inline] siw_get_port_immutable+0x6f/0x120 drivers/infiniband/sw/siw/siw_verbs.c:203 CPU: 0 PID: 11257 Comm: syz-executor.1 Not tainted 6.6.0-14500-g1c41041124bd #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014 ===================================================== If __ethtool_get_link_ksettings() fails, `netdev_speed` is set to the default value, SPEED_1000. In this case, if `lanes` field of struct ethtool_link_ksettings is not initialized, an uninitialized value is passed to ib_get_width_and_speed(). This causes the above issue. This patch resolves the issue by initializing `lanes` to 0. Fixes: cb06b6b3f6cb ("RDMA/core: Get IB width and speed from netdev") Signed-off-by: Shigeru Yoshida Link: https://lore.kernel.org/r/20231108143113.1360567-1-syoshida@redhat.com Signed-off-by: Leon Romanovsky drivers/infiniband/core/verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 50e865a56876bd7a74a79c1778025631150f104a Author: Randy Dunlap Date: Sun Nov 5 21:56:31 2023 -0800 xen/shbuf: eliminate 17 kernel-doc warnings Don't use kernel-doc markers ("/**") for comments that are not in kernel-doc format. This prevents multiple kernel-doc warnings: xen-front-pgdir-shbuf.c:25: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * This structure represents the structure of a shared page xen-front-pgdir-shbuf.c:37: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Shared buffer ops which are differently implemented xen-front-pgdir-shbuf.c:65: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Get granted reference to the very first page of the xen-front-pgdir-shbuf.c:85: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Map granted references of the shared buffer. xen-front-pgdir-shbuf.c:106: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Unmap granted references of the shared buffer. xen-front-pgdir-shbuf.c:127: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Free all the resources of the shared buffer. xen-front-pgdir-shbuf.c:154: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Get the number of pages the page directory consumes itself. xen-front-pgdir-shbuf.c:164: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Calculate the number of grant references needed to share the buffer xen-front-pgdir-shbuf.c:176: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Calculate the number of grant references needed to share the buffer xen-front-pgdir-shbuf.c:194: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Unmap the buffer previously mapped with grant references xen-front-pgdir-shbuf.c:242: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Map the buffer with grant references provided by the backend. xen-front-pgdir-shbuf.c:324: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Fill page directory with grant references to the pages of the xen-front-pgdir-shbuf.c:354: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Fill page directory with grant references to the pages of the xen-front-pgdir-shbuf.c:393: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Grant references to the frontend's buffer pages. xen-front-pgdir-shbuf.c:422: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Grant all the references needed to share the buffer. xen-front-pgdir-shbuf.c:470: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Allocate all required structures to mange shared buffer. xen-front-pgdir-shbuf.c:510: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Allocate a new instance of a shared buffer. Signed-off-by: Randy Dunlap Reported-by: kernel test robot Closes: lore.kernel.org/r/202311060203.yQrpPZhm-lkp@intel.com Acked-by: Juergen Gross Cc: Juergen Gross Cc: Stefano Stabellini Cc: Oleksandr Tyshchenko Cc: xen-devel@lists.xenproject.org Link: https://lore.kernel.org/r/20231106055631.21520-1-rdunlap@infradead.org Signed-off-by: Juergen Gross drivers/xen/xen-front-pgdir-shbuf.c | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) commit bfa993b355d33a438a746523e7129391c8664e8a Author: Roger Pau Monne Date: Wed Nov 8 16:25:15 2023 -0500 acpi/processor: sanitize _OSC/_PDC capabilities for Xen dom0 The Processor capability bits notify ACPI of the OS capabilities, and so ACPI can adjust the return of other Processor methods taking the OS capabilities into account. When Linux is running as a Xen dom0, the hypervisor is the entity in charge of processor power management, and hence Xen needs to make sure the capabilities reported by _OSC/_PDC match the capabilities of the driver in Xen. Introduce a small helper to sanitize the buffer when running as Xen dom0. When Xen supports HWP, this serves as the equivalent of commit a21211672c9a ("ACPI / processor: Request native thermal interrupt handling via _OSC") to avoid SMM crashes. Xen will set bit ACPI_PROC_CAP_COLLAB_PROC_PERF (bit 12) in the capability bits and the _OSC/_PDC call will apply it. [ jandryuk: Mention Xen HWP's need. Support _OSC & _PDC ] Signed-off-by: Roger Pau Monné Cc: stable@vger.kernel.org Signed-off-by: Jason Andryuk Reviewed-by: Michal Wilczynski Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20231108212517.72279-1-jandryuk@gmail.com Signed-off-by: Juergen Gross arch/x86/include/asm/acpi.h | 14 ++++++++++++++ arch/x86/include/asm/xen/hypervisor.h | 9 +++++++++ drivers/xen/pcpu.c | 22 ++++++++++++++++++++++ 3 files changed, 45 insertions(+) commit e64e7c74b99ec9e439abca75f522f4b98f220bd1 Author: Juergen Gross Date: Tue Oct 24 13:51:36 2023 +0200 xen/events: avoid using info_for_irq() in xen_send_IPI_one() xen_send_IPI_one() is being used by cpuhp_report_idle_dead() after it calls rcu_report_dead(), meaning that any RCU usage by xen_send_IPI_one() is a bad idea. Unfortunately xen_send_IPI_one() is using notify_remote_via_irq() today, which is using irq_get_chip_data() via info_for_irq(). And irq_get_chip_data() in turn is using a maple-tree lookup requiring RCU. Avoid this problem by caching the ipi event channels in another percpu variable, allowing the use notify_remote_via_evtchn() in xen_send_IPI_one(). Fixes: 721255b9826b ("genirq: Use a maple tree for interrupt descriptor management") Reported-by: David Woodhouse Signed-off-by: Juergen Gross Tested-by: David Woodhouse Acked-by: Stefano Stabellini Signed-off-by: Juergen Gross drivers/xen/events/events_base.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 7930d9e103700cde15833638855b750715c12091 Author: Dave Chinner Date: Fri Nov 10 15:33:14 2023 +1100 xfs: recovery should not clear di_flushiter unconditionally Because on v3 inodes, di_flushiter doesn't exist. It overlaps with zero padding in the inode, except when NREXT64=1 configurations are in use and the zero padding is no longer padding but holds the 64 bit extent counter. This manifests obviously on big endian platforms (e.g. s390) because the log dinode is in host order and the overlap is the LSBs of the extent count field. It is not noticed on little endian machines because the overlap is at the MSB end of the extent count field and we need to get more than 2^^48 extents in the inode before it manifests. i.e. the heat death of the universe will occur before we see the problem in little endian machines. This is a zero-day issue for NREXT64=1 configuraitons on big endian machines. Fix it by only clearing di_flushiter on v2 inodes during recovery. Fixes: 9b7d16e34bbe ("xfs: Introduce XFS_DIFLAG2_NREXT64 and associated helpers") cc: stable@kernel.org # 5.19+ Signed-off-by: Dave Chinner Reviewed-by: "Darrick J. Wong" Signed-off-by: Chandan Babu R fs/xfs/xfs_inode_item_recover.c | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-) commit 038ca189c0d2c1570b4d922f25b524007c85cf94 Author: Dave Chinner Date: Fri Nov 10 15:33:13 2023 +1100 xfs: inode recovery does not validate the recovered inode Discovered when trying to track down a weird recovery corruption issue that wasn't detected at recovery time. The specific corruption was a zero extent count field when big extent counts are in use, and it turns out the dinode verifier doesn't detect that specific corruption case, either. So fix it too. Signed-off-by: Dave Chinner Reviewed-by: "Darrick J. Wong" Signed-off-by: Chandan Babu R fs/xfs/libxfs/xfs_inode_buf.c | 3 +++ fs/xfs/xfs_inode_item_recover.c | 14 +++++++++++++- 2 files changed, 16 insertions(+), 1 deletion(-) commit a2e4388adfa44684c7c428a5a5980efe0d75e13e Author: Anthony Iliopoulos Date: Sun Nov 5 20:23:18 2023 +0100 xfs: fix again select in kconfig XFS_ONLINE_SCRUB_STATS Commit 57c0f4a8ea3a attempted to fix the select in the kconfig entry XFS_ONLINE_SCRUB_STATS by selecting XFS_DEBUG, but the original intention was to select DEBUG_FS, since the feature relies on debugfs to export the related scrub statistics. Fixes: 57c0f4a8ea3a ("xfs: fix select in config XFS_ONLINE_SCRUB_STATS") Reported-by: Holger Hoffstätte Signed-off-by: Anthony Iliopoulos Reviewed-by: Dave Chinner Reviewed-by: "Darrick J. Wong" Signed-off-by: Chandan Babu R fs/xfs/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f63a5b3769ad7659da4c0420751d78958ab97675 Author: Omar Sandoval Date: Wed Nov 1 09:41:45 2023 -0700 xfs: fix internal error from AGFL exhaustion We've been seeing XFS errors like the following: XFS: Internal error i != 1 at line 3526 of file fs/xfs/libxfs/xfs_btree.c. Caller xfs_btree_insert+0x1ec/0x280 ... Call Trace: xfs_corruption_error+0x94/0xa0 xfs_btree_insert+0x221/0x280 xfs_alloc_fixup_trees+0x104/0x3e0 xfs_alloc_ag_vextent_size+0x667/0x820 xfs_alloc_fix_freelist+0x5d9/0x750 xfs_free_extent_fix_freelist+0x65/0xa0 __xfs_free_extent+0x57/0x180 ... This is the XFS_IS_CORRUPT() check in xfs_btree_insert() when xfs_btree_insrec() fails. After converting this into a panic and dissecting the core dump, I found that xfs_btree_insrec() is failing because it's trying to split a leaf node in the cntbt when the AG free list is empty. In particular, it's failing to get a block from the AGFL _while trying to refill the AGFL_. If a single operation splits every level of the bnobt and the cntbt (and the rmapbt if it is enabled) at once, the free list will be empty. Then, when the next operation tries to refill the free list, it allocates space. If the allocation does not use a full extent, it will need to insert records for the remaining space in the bnobt and cntbt. And if those new records go in full leaves, the leaves (and potentially more nodes up to the old root) need to be split. Fix it by accounting for the additional splits that may be required to refill the free list in the calculation for the minimum free list size. P.S. As far as I can tell, this bug has existed for a long time -- maybe back to xfs-history commit afdf80ae7405 ("Add XFS_AG_MAXLEVELS macros ...") in April 1994! It requires a very unlucky sequence of events, and in fact we didn't hit it until a particular sparse mmap workload updated from 5.12 to 5.19. But this bug existed in 5.12, so it must've been exposed by some other change in allocation or writeback patterns. It's also much less likely to be hit with the rmapbt enabled, since that increases the minimum free list size and is unlikely to split at the same time as the bnobt and cntbt. Reviewed-by: "Darrick J. Wong" Reviewed-by: Dave Chinner Signed-off-by: Omar Sandoval Signed-off-by: Chandan Babu R fs/xfs/libxfs/xfs_alloc.c | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) commit 471de20303dda0b67981e06d59cc6c4a83fd2a3c Author: Leah Rumancik Date: Mon Oct 30 13:33:49 2023 -0700 xfs: up(ic_sema) if flushing data device fails We flush the data device cache before we issue external log IO. If the flush fails, we shut down the log immediately and return. However, the iclog->ic_sema is left in a decremented state so let's add an up(). Prior to this patch, xfs/438 would fail consistently when running with an external log device: sync -> xfs_log_force -> xlog_write_iclog -> down(&iclog->ic_sema) -> blkdev_issue_flush (fail causes us to intiate shutdown) -> xlog_force_shutdown -> return unmount -> xfs_log_umount -> xlog_wait_iclog_completion -> down(&iclog->ic_sema) --------> HANG There is a second early return / shutdown. Make sure the up() happens for it as well. Also make sure we cleanup the iclog state, xlog_state_done_syncing, before dropping the iclog lock. Fixes: b5d721eaae47 ("xfs: external logs need to flush data device") Fixes: 842a42d126b4 ("xfs: shutdown on failure to add page to log bio") Fixes: 7d839e325af2 ("xfs: check return codes when flushing block devices") Signed-off-by: Leah Rumancik Reviewed-by: "Darrick J. Wong" Signed-off-by: Chandan Babu R fs/xfs/xfs_log.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) commit 55f669f34184ecb25b8353f29c7f6f1ae5b313d1 Author: Christoph Hellwig Date: Mon Oct 16 17:28:52 2023 +0200 xfs: only remap the written blocks in xfs_reflink_end_cow_extent xfs_reflink_end_cow_extent looks up the COW extent and the data fork extent at offset_fsb, and then proceeds to remap the common subset between the two. It does however not limit the remapped extent to the passed in [*offset_fsbm end_fsb] range and thus potentially remaps more blocks than the one handled by the current I/O completion. This means that with sufficiently large data and COW extents we could be remapping COW fork mappings that have not been written to, leading to a stale data exposure on a powerfail event. We use to have a xfs_trim_range to make the remap fit the I/O completion range, but that got (apparently accidentally) removed in commit df2fd88f8ac7 ("xfs: rewrite xfs_reflink_end_cow to use intents"). Note that I've only found this by code inspection, and a test case would probably require very specific delay and error injection. Fixes: df2fd88f8ac7 ("xfs: rewrite xfs_reflink_end_cow to use intents") Signed-off-by: Christoph Hellwig Reviewed-by: "Darrick J. Wong" Signed-off-by: Chandan Babu R fs/xfs/xfs_reflink.c | 1 + 1 file changed, 1 insertion(+) commit 00080503612f61d1ad67be641ed9cb4f9f6ba40e Author: Matthew Wilcox (Oracle) Date: Tue Sep 19 17:12:45 2023 -0400 XFS: Update MAINTAINERS to catch all XFS documentation Assumes that all XFS documentation will be prefixed with xfs-, which seems like a good policy anyway. Reviewed-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Chandan Babu R MAINTAINERS | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit f8f9d952e42dd49ae534f61f2fa7ca0876cb9848 Author: Long Li Date: Mon Jul 31 20:46:18 2023 +0800 xfs: abort intent items when recovery intents fail When recovering intents, we capture newly created intent items as part of committing recovered intent items. If intent recovery fails at a later point, we forget to remove those newly created intent items from the AIL and hang: [root@localhost ~]# cat /proc/539/stack [<0>] xfs_ail_push_all_sync+0x174/0x230 [<0>] xfs_unmount_flush_inodes+0x8d/0xd0 [<0>] xfs_mountfs+0x15f7/0x1e70 [<0>] xfs_fs_fill_super+0x10ec/0x1b20 [<0>] get_tree_bdev+0x3c8/0x730 [<0>] vfs_get_tree+0x89/0x2c0 [<0>] path_mount+0xecf/0x1800 [<0>] do_mount+0xf3/0x110 [<0>] __x64_sys_mount+0x154/0x1f0 [<0>] do_syscall_64+0x39/0x80 [<0>] entry_SYSCALL_64_after_hwframe+0x63/0xcd When newly created intent items fail to commit via transaction, intent recovery hasn't created done items for these newly created intent items, so the capture structure is the sole owner of the captured intent items. We must release them explicitly or else they leak: unreferenced object 0xffff888016719108 (size 432): comm "mount", pid 529, jiffies 4294706839 (age 144.463s) hex dump (first 32 bytes): 08 91 71 16 80 88 ff ff 08 91 71 16 80 88 ff ff ..q.......q..... 18 91 71 16 80 88 ff ff 18 91 71 16 80 88 ff ff ..q.......q..... backtrace: [] xfs_efi_init+0x18f/0x1d0 [] xfs_extent_free_create_intent+0x50/0x150 [] xfs_defer_create_intents+0x16a/0x340 [] xfs_defer_ops_capture_and_commit+0x8e/0xad0 [] xfs_cui_item_recover+0x819/0x980 [] xlog_recover_process_intents+0x246/0xb70 [] xlog_recover_finish+0x8a/0x9a0 [] xfs_log_mount_finish+0x2bb/0x4a0 [] xfs_mountfs+0x14bf/0x1e70 [] xfs_fs_fill_super+0x10d0/0x1b20 [] get_tree_bdev+0x3d2/0x6d0 [] vfs_get_tree+0x89/0x2c0 [] path_mount+0xecf/0x1800 [] do_mount+0xf3/0x110 [] __x64_sys_mount+0x154/0x1f0 [] do_syscall_64+0x39/0x80 Fix the problem above by abort intent items that don't have a done item when recovery intents fail. Fixes: e6fff81e4870 ("xfs: proper replay of deferred ops queued during log recovery") Signed-off-by: Long Li Reviewed-by: Darrick J. Wong Signed-off-by: Chandan Babu R fs/xfs/libxfs/xfs_defer.c | 5 +++-- fs/xfs/libxfs/xfs_defer.h | 2 +- fs/xfs/xfs_log_recover.c | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) commit 2a5db859c6825b5d50377dda9c3cc729c20cad43 Author: Long Li Date: Mon Jul 31 20:46:17 2023 +0800 xfs: factor out xfs_defer_pending_abort Factor out xfs_defer_pending_abort() from xfs_defer_trans_abort(), which not use transaction parameter, so it can be used after the transaction life cycle. Signed-off-by: Long Li Reviewed-by: Darrick J. Wong Signed-off-by: Chandan Babu R fs/xfs/libxfs/xfs_defer.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) commit 7b211c7671212cad0b83603c674838c7e824d845 Author: Robert Marko Date: Fri Nov 10 10:30:11 2023 +0100 Revert "i2c: pxa: move to generic GPIO recovery" This reverts commit 0b01392c18b9993a584f36ace1d61118772ad0ca. Conversion of PXA to generic I2C recovery, makes the I2C bus completely lock up if recovery pinctrl is present in the DT and I2C recovery is enabled. So, until the generic I2C recovery can also work with PXA lets revert to have working I2C and I2C recovery again. Signed-off-by: Robert Marko Cc: stable@vger.kernel.org # 5.11+ Acked-by: Andi Shyti Acked-by: Russell King (Oracle) Acked-by: Linus Walleij Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-pxa.c | 76 +++++++++++++++++++++++++++++++++++++++----- 1 file changed, 68 insertions(+), 8 deletions(-) commit 42d62b7e47d58273c64fc1540e5d81ccfdb60f77 Author: Laurent Pinchart Date: Tue Oct 24 17:18:17 2023 +0300 media: vsp1: Remove unbalanced .s_stream(0) calls The VSP1 driver uses the subdev .s_stream() operation to stop WPF instances, without a corresponding call to start them. The V4L2 subdev core started warning about unbalanced .s_stream() calls in commit 009905ec5043 ("media: v4l2-subdev: Document and enforce .s_stream() requirements"), causing a regression with this driver. Fix the problem by replacing the .s_stream() operation with an explicit function call for WPF instances. This allows sharing an additional data structure between RPF and WPF instances. Fixes: 009905ec5043 ("media: v4l2-subdev: Document and enforce .s_stream() requirements") Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/linux-media/2221395-6a9b-9527-d697-e76aebc6af@linux-m68k.org/ Signed-off-by: Laurent Pinchart Tested-by: Geert Uytterhoeven drivers/media/platform/renesas/vsp1/vsp1_pipe.c | 2 +- drivers/media/platform/renesas/vsp1/vsp1_rpf.c | 10 +-------- drivers/media/platform/renesas/vsp1/vsp1_rwpf.c | 8 +++++-- drivers/media/platform/renesas/vsp1/vsp1_rwpf.h | 4 +++- drivers/media/platform/renesas/vsp1/vsp1_wpf.c | 29 +++---------------------- 5 files changed, 14 insertions(+), 39 deletions(-) commit b85ea95d086471afb4ad062012a4d73cd328fa86 Author: Linus Torvalds Date: Sun Nov 12 16:19:07 2023 -0800 Linux 6.7-rc1 Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7e8037b099c0bbe8f2109dc452dbcab8d400fc53 Author: Saurabh Sengar Date: Sat Nov 11 00:37:47 2023 -0800 x86/hyperv: Fix the detection of E820_TYPE_PRAM in a Gen2 VM A Gen2 VM doesn't support legacy PCI/PCIe, so both raw_pci_ops and raw_pci_ext_ops are NULL, and pci_subsys_init() -> pcibios_init() doesn't call pcibios_resource_survey() -> e820__reserve_resources_late(); as a result, any emulated persistent memory of E820_TYPE_PRAM (12) via the kernel parameter memmap=nn[KMG]!ss is not added into iomem_resource and hence can't be detected by register_e820_pmem(). Fix this by directly calling e820__reserve_resources_late() in hv_pci_init(), which is called from arch_initcall(pci_arch_init). It's ok to move a Gen2 VM's e820__reserve_resources_late() from subsys_initcall(pci_subsys_init) to arch_initcall(pci_arch_init) because the code in-between doesn't depend on the E820 resources. e820__reserve_resources_late() depends on e820__reserve_resources(), which has been called earlier from setup_arch(). For a Gen-2 VM, the new hv_pci_init() also adds any memory of E820_TYPE_PMEM (7) into iomem_resource, and acpi_nfit_register_region() -> acpi_nfit_insert_resource() -> region_intersects() returns REGION_INTERSECTS, so the memory of E820_TYPE_PMEM won't get added twice. Changed the local variable "int gen2vm" to "bool gen2vm". Signed-off-by: Saurabh Sengar Signed-off-by: Dexuan Cui Signed-off-by: Wei Liu Message-ID: <1699691867-9827-1-git-send-email-ssengar@linux.microsoft.com> arch/x86/hyperv/hv_init.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) commit e257da5715365b853439243f89cf5d8a9d382355 Author: Miri Korenblit Date: Sun Nov 12 16:36:20 2023 +0200 wifi: iwlwifi: fix system commands group ordering The commands should be sorted inside the group definition. Fix the ordering so we won't get following warning: WARN_ON(iwl_cmd_groups_verify_sorted(trans_cfg)) Link: https://lore.kernel.org/regressions/2fa930bb-54dd-4942-a88d-05a47c8e9731@gmail.com/ Link: https://lore.kernel.org/linux-wireless/CAHk-=wix6kqQ5vHZXjOPpZBfM7mMm9bBZxi2Jh7XnaKCqVf94w@mail.gmail.com/ Fixes: b6e3d1ba4fcf ("wifi: iwlwifi: mvm: implement new firmware API for statistics") Tested-by: Niklāvs Koļesņikovs Tested-by: Damian Tometzki Acked-by: Kalle Valo Signed-off-by: Miri Korenblit Signed-off-by: Emmanuel Grumbach Signed-off-by: Linus Torvalds drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b57b17e88bf58860dad312d08db7d6708ee6d06d Merge: 4eeee6636af8 a406b8b424fa Author: Linus Torvalds Date: Sun Nov 12 11:05:31 2023 -0800 Merge tag 'parisc-for-6.7-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture fixes from Helge Deller: - Include the upper 5 address bits when inserting TLB entries on a 64-bit kernel. On physical machines those are ignored, but in qemu it's nice to have them included and to be correct. - Stop the 64-bit kernel and show a warning if someone tries to boot on a machine with a 32-bit CPU - Fix a "no previous prototype" warning in parport-gsc * tag 'parisc-for-6.7-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Prevent booting 64-bit kernels on PA1.x machines parport: gsc: mark init function static parisc/pgtable: Do not drop upper 5 address bits of physical address commit 4eeee6636af819454d7c43702e77ec7857a63000 Merge: 5dd2020f335a 1d375d65466e Author: Linus Torvalds Date: Sun Nov 12 10:58:08 2023 -0800 Merge tag 'loongarch-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - support PREEMPT_DYNAMIC with static keys - relax memory ordering for atomic operations - support BPF CPU v4 instructions for LoongArch - some build and runtime warning fixes * tag 'loongarch-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: selftests/bpf: Enable cpu v4 tests for LoongArch LoongArch: BPF: Support signed mod instructions LoongArch: BPF: Support signed div instructions LoongArch: BPF: Support 32-bit offset jmp instructions LoongArch: BPF: Support unconditional bswap instructions LoongArch: BPF: Support sign-extension mov instructions LoongArch: BPF: Support sign-extension load instructions LoongArch: Add more instruction opcodes and emit_* helpers LoongArch/smp: Call rcutree_report_cpu_starting() earlier LoongArch: Relax memory ordering for atomic operations LoongArch: Mark __percpu functions as always inline LoongArch: Disable module from accessing external data directly LoongArch: Support PREEMPT_DYNAMIC with static keys commit 5dd2020f335a7a60c154375a168791a2b87f35b5 Merge: 1b907d050735 644b6025bcaf Author: Linus Torvalds Date: Sun Nov 12 10:50:38 2023 -0800 Merge tag 'powerpc-6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Finish a refactor of pgprot_framebuffer() which dependend on some changes that were merged via the drm tree - Fix some kernel-doc warnings to quieten the bots Thanks to Nathan Lynch and Thomas Zimmermann. * tag 'powerpc-6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/rtas: Fix ppc_rtas_rmo_buf_show() kernel-doc powerpc/pseries/rtas-work-area: Fix rtas_work_area_reserve_arena() kernel-doc powerpc/fb: Call internal __phys_mem_access_prot() in fbdev code powerpc: Remove file parameter from phys_mem_access_prot() powerpc/machdep: Remove trailing whitespaces commit 713f040cd22285fcc506f40a0d259566e6758c3c Author: Chandradeep Dey Date: Sat Nov 11 19:25:49 2023 +0100 ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC Apply the already existing quirk chain ALC294_FIXUP_ASUS_SPK to enable the internal speaker of ASUS K6500ZC. Signed-off-by: Chandradeep Dey Cc: Link: https://lore.kernel.org/r/NizcVHQ--3-9@chandradeepdey.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 1b907d0507354b74a4f2c286380cd6059af79248 Merge: 3ca112b71f35 fd2bd7c0539e Author: Linus Torvalds Date: Sat Nov 11 17:17:22 2023 -0800 Merge tag '6.7-rc-smb3-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - ctime caching fix (for setxattr) - encryption fix - DNS resolver mount fix - debugging improvements - multichannel fixes including cases where server stops or starts supporting multichannel after mount - reconnect fix - minor cleanups * tag '6.7-rc-smb3-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal module version number for cifs.ko cifs: handle when server stops supporting multichannel cifs: handle when server starts supporting multichannel Missing field not being returned in ioctl CIFS_IOC_GET_MNT_INFO smb3: allow dumping session and tcon id to improve stats analysis and debugging smb: client: fix mount when dns_resolver key is not available smb3: fix caching of ctime on setxattr smb3: minor cleanup of session handling code cifs: reconnect work should have reference on server struct cifs: do not pass cifs_sb when trying to add channels cifs: account for primary channel in the interface list cifs: distribute channels across interfaces based on speed cifs: handle cases where a channel is closed smb3: more minor cleanups for session handling routines smb3: minor RDMA cleanup cifs: Fix encryption of cleared, but unset rq_iter data buffers commit 2bd5b559a1f391f05927bbb0b31381fa71c61e26 Author: Jan Kiszka Date: Fri Nov 10 17:13:08 2023 +0100 net: ti: icssg-prueth: Fix error cleanup on failing pruss_request_mem_region We were just continuing in this case, surely not desired. Fixes: 128d5874c082 ("net: ti: icssg-prueth: Add ICSSG ethernet driver") Signed-off-by: Jan Kiszka Reviewed-by: Wojciech Drewek Reviewed-by: Roger Quadros Signed-off-by: David S. Miller drivers/net/ethernet/ti/icssg/icssg_prueth.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit e409d7346648c9acff84c3cc8d291767ee2d5326 Author: Jan Kiszka Date: Fri Nov 10 17:13:02 2023 +0100 net: ti: icssg-prueth: Add missing icss_iep_put to error path Analogously to prueth_remove, just also taking care for NULL'ing the iep pointers. Fixes: 186734c15886 ("net: ti: icssg-prueth: add packet timestamping and ptp support") Fixes: 443a2367ba3c ("net: ti: icssg-prueth: am65x SR2.0 add 10M full duplex support") Signed-off-by: Jan Kiszka Reviewed-by: Wojciech Drewek Reviewed-by: MD Danish Anwar Reviewed-by: Roger Quadros Signed-off-by: David S. Miller drivers/net/ethernet/ti/icssg/icssg_prueth.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit 5c0930ccaad5a74d74e8b18b648c5eb21ed2fe94 Author: Thomas Gleixner Date: Tue Nov 7 15:57:13 2023 +0100 hrtimers: Push pending hrtimers away from outgoing CPU earlier 2b8272ff4a70 ("cpu/hotplug: Prevent self deadlock on CPU hot-unplug") solved the straight forward CPU hotplug deadlock vs. the scheduler bandwidth timer. Yu discovered a more involved variant where a task which has a bandwidth timer started on the outgoing CPU holds a lock and then gets throttled. If the lock required by one of the CPU hotplug callbacks the hotplug operation deadlocks because the unthrottling timer event is not handled on the dying CPU and can only be recovered once the control CPU reaches the hotplug state which pulls the pending hrtimers from the dead CPU. Solve this by pushing the hrtimers away from the dying CPU in the dying callbacks. Nothing can queue a hrtimer on the dying CPU at that point because all other CPUs spin in stop_machine() with interrupts disabled and once the operation is finished the CPU is marked offline. Reported-by: Yu Liao Signed-off-by: Thomas Gleixner Tested-by: Liu Tie Link: https://lore.kernel.org/r/87a5rphara.ffs@tglx include/linux/cpuhotplug.h | 1 + include/linux/hrtimer.h | 4 ++-- kernel/cpu.c | 8 +++++++- kernel/time/hrtimer.c | 33 ++++++++++++--------------------- 4 files changed, 22 insertions(+), 24 deletions(-) commit 3ca112b71f35dd5d99fc4571a56b5fc6f0c15814 Merge: 18553507f60f f032c53bea6d Author: Linus Torvalds Date: Fri Nov 10 16:35:04 2023 -0800 Merge tag 'probes-fixes-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes fixes from Masami Hiramatsu: - Documentation update: Add a note about argument and return value fetching is the best effort because it depends on the type. - objpool: Fix to make internal global variables static in test_objpool.c. - kprobes: Unify kprobes_exceptions_nofify() prototypes. There are the same prototypes in asm/kprobes.h for some architectures, but some of them are missing the prototype and it causes a warning. So move the prototype into linux/kprobes.h. - tracing: Fix to check the tracepoint event and return event at parsing stage. The tracepoint event doesn't support %return but if $retval exists, it will be converted to %return silently. This finds that case and rejects it. - tracing: Fix the order of the descriptions about the parameters of __kprobe_event_gen_cmd_start() to be consistent with the argument list of the function. * tag 'probes-fixes-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/kprobes: Fix the order of argument descriptions tracing: fprobe-event: Fix to check tracepoint event and return kprobes: unify kprobes_exceptions_nofify() prototypes lib: test_objpool: make global variables static Documentation: tracing: Add a note about argument and retval access commit c3803203bc5ec910a3eb06172cf6fb368e0e4390 Author: Ani Sinha Date: Mon Oct 16 19:01:22 2023 +0530 hv/hv_kvp_daemon: Some small fixes for handling NM keyfiles Some small fixes: - lets make sure we are not adding ipv4 addresses in ipv6 section in keyfile and vice versa. - ADDR_FAMILY_IPV6 is a bit in addr_family. Test that bit instead of checking the whole value of addr_family. - Some trivial fixes in hv_set_ifconfig.sh. These fixes are proposed after doing some internal testing at Red Hat. CC: Shradha Gupta CC: Saurabh Sengar Fixes: 42999c904612 ("hv/hv_kvp_daemon:Support for keyfile based connection profile") Signed-off-by: Ani Sinha Reviewed-by: Shradha Gupta Signed-off-by: Wei Liu Message-ID: <20231016133122.2419537-1-anisinha@redhat.com> tools/hv/hv_kvp_daemon.c | 20 ++++++++++++-------- tools/hv/hv_set_ifconfig.sh | 4 ++-- 2 files changed, 14 insertions(+), 10 deletions(-) commit 18553507f60f4f51f071644621a58836eb59e28c Merge: c0d12d769299 a5035c818474 Author: Linus Torvalds Date: Fri Nov 10 15:07:01 2023 -0800 Merge tag 'fbdev-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes and cleanups from Helge Deller: - fix double free and resource leaks in imsttfb - lots of remove callback cleanups and section mismatch fixes in omapfb, amifb and atmel_lcdfb - error code fix and memparse simplification in omapfb * tag 'fbdev-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (31 commits) fbdev: fsl-diu-fb: mark wr_reg_wa() static fbdev: amifb: Convert to platform remove callback returning void fbdev: amifb: Mark driver struct with __refdata to prevent section mismatch warning fbdev: hyperv_fb: fix uninitialized local variable use fbdev: omapfb/tpd12s015: Convert to platform remove callback returning void fbdev: omapfb/tfp410: Convert to platform remove callback returning void fbdev: omapfb/sharp-ls037v7dw01: Convert to platform remove callback returning void fbdev: omapfb/opa362: Convert to platform remove callback returning void fbdev: omapfb/hdmi: Convert to platform remove callback returning void fbdev: omapfb/dvi: Convert to platform remove callback returning void fbdev: omapfb/dsi-cm: Convert to platform remove callback returning void fbdev: omapfb/dpi: Convert to platform remove callback returning void fbdev: omapfb/analog-tv: Convert to platform remove callback returning void fbdev: atmel_lcdfb: Convert to platform remove callback returning void fbdev: omapfb/tpd12s015: Don't put .remove() in .exit.text and drop suppress_bind_attrs fbdev: omapfb/tfp410: Don't put .remove() in .exit.text and drop suppress_bind_attrs fbdev: omapfb/sharp-ls037v7dw01: Don't put .remove() in .exit.text and drop suppress_bind_attrs fbdev: omapfb/opa362: Don't put .remove() in .exit.text and drop suppress_bind_attrs fbdev: omapfb/hdmi: Don't put .remove() in .exit.text and drop suppress_bind_attrs fbdev: omapfb/dvi: Don't put .remove() in .exit.text and drop suppress_bind_attrs ... commit f032c53bea6d2057c14553832d846be2f151cfb2 Author: Yujie Liu Date: Tue Oct 31 12:13:05 2023 +0800 tracing/kprobes: Fix the order of argument descriptions The order of descriptions should be consistent with the argument list of the function, so "kretprobe" should be the second one. int __kprobe_event_gen_cmd_start(struct dynevent_cmd *cmd, bool kretprobe, const char *name, const char *loc, ...) Link: https://lore.kernel.org/all/20231031041305.3363712-1-yujie.liu@intel.com/ Fixes: 2a588dd1d5d6 ("tracing: Add kprobe event command generation functions") Suggested-by: Mukesh Ojha Signed-off-by: Yujie Liu Reviewed-by: Mukesh Ojha Signed-off-by: Masami Hiramatsu (Google) kernel/trace/trace_kprobe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c0d12d769299e1e08338988c7745009e0db2a4a0 Merge: ac347a0655db 03df0fc007ca Author: Linus Torvalds Date: Fri Nov 10 14:59:30 2023 -0800 Merge tag 'drm-next-2023-11-10' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Daniel Vetter: "Dave's VPN to the big machine died, so it's on me to do fixes pr this and next week while everyone else is at plumbers. - big pile of amd fixes, but mostly for hw support newly added in 6.7 - i915 fixes, mostly minor things - qxl memory leak fix - vc4 uaf fix in mock helpers - syncobj fix for DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE" * tag 'drm-next-2023-11-10' of git://anongit.freedesktop.org/drm/drm: (78 commits) drm/amdgpu: fix error handling in amdgpu_vm_init drm/amdgpu: Fix possible null pointer dereference drm/amdgpu: move UVD and VCE sched entity init after sched init drm/amdgpu: move kfd_resume before the ip late init drm/amd: Explicitly check for GFXOFF to be enabled for s0ix drm/amdgpu: Change WREG32_RLC to WREG32_SOC15_RLC where inst != 0 (v2) drm/amdgpu: Use correct KIQ MEC engine for gfx9.4.3 (v5) drm/amdgpu: add smu v13.0.6 pcs xgmi ras error query support drm/amdgpu: fix software pci_unplug on some chips drm/amd/display: remove duplicated argument drm/amdgpu: correct mca debugfs dump reg list drm/amdgpu: correct acclerator check architecutre dump drm/amdgpu: add pcs xgmi v6.4.0 ras support drm/amdgpu: Change extended-scope MTYPE on GC 9.4.3 drm/amdgpu: disable smu v13.0.6 mca debug mode by default drm/amdgpu: Support multiple error query modes drm/amdgpu: refine smu v13.0.6 mca dump driver drm/amdgpu: Do not program PF-only regs in hdp_v4_0.c under SRIOV (v2) drm/amdgpu: Skip PCTL0_MMHUB_DEEPSLEEP_IB write in jpegv4.0.3 under SRIOV drm: amd: Resolve Sphinx unexpected indentation warning ... commit ac347a0655dbc7d885e217c89dddd16e2800bd58 Merge: e1d809b3c5d1 f86128050d2d Author: Linus Torvalds Date: Fri Nov 10 12:22:14 2023 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: "Mostly PMU fixes and a reworking of the pseudo-NMI disabling on broken MediaTek firmware: - Move the MediaTek GIC quirk handling from irqchip to core. Before the merging window commit 44bd78dd2b88 ("irqchip/gic-v3: Disable pseudo NMIs on MediaTek devices w/ firmware issues") temporarily addressed this issue. Fixed now at a deeper level in the arch code - Reject events meant for other PMUs in the CoreSight PMU driver, otherwise some of the core PMU events would disappear - Fix the Armv8 PMUv3 driver driver to not truncate 64-bit registers, causing some events to be invisible - Remove duplicate declaration of __arm64_sys##name following the patch to avoid prototype warning for syscalls - Typos in the elf_hwcap documentation" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/syscall: Remove duplicate declaration Revert "arm64: smp: avoid NMI IPIs with broken MediaTek FW" arm64: Move MediaTek GIC quirk handling from irqchip to core arm64/arm: arm_pmuv3: perf: Don't truncate 64-bit registers perf: arm_cspmu: Reject events meant for other PMUs Documentation/arm64: Fix typos in elf_hwcaps commit e1d809b3c5d1d9988350755454747a105dad331b Merge: ae4f52a729a1 bce36aa682da Author: Linus Torvalds Date: Fri Nov 10 11:57:51 2023 -0800 Merge tag 'sound-fix-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of fixes for rc1. The majority of changes are various ASoC driver-specific small fixes and usual HD-audio quirks, while there are a couple of core changes: a fix in ALSA core procfs code to avoid deadlocks at disconnection and an ASoC core fix for DAPM clock widgets" * tag 'sound-fix-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: OSS: dmasound/paula: Convert to platform remove callback returning void ALSA: hda: ASUS UM5302LA: Added quirks for cs35L41/10431A83 on i2c bus ALSA: info: Fix potential deadlock at disconnection ASoC: nau8540: Add self recovery to improve capture quility ALSA: hda/realtek: Add support dual speaker for Dell ALSA: hda: Add ASRock X670E Taichi to denylist ALSA: hda/realtek: Add quirk for ASUS UX7602ZM ASoC: SOF: sof-client: trivial: fix comment typo ASoC: dapm: fix clock get name ASoC: hdmi-codec: register hpd callback on component probe ASoC: mediatek: mt8186_mt6366_rt1019_rt5682s: trivial: fix error messages ASoC: da7219: Improve system suspend and resume handling ASoC: codecs: Modify macro value error ASoC: codecs: Modify the wrong judgment of re value ASoC: codecs: Modify the maximum value of calib ASoC: amd: acp: fix for i2s mode register field update ASoC: codecs: aw88399: Fix -Wuninitialized in aw_dev_set_vcalb() ASoC: rt712-sdca: fix speaker route missing issue ASoC: rockchip: Fix unused rockchip_i2s_tdm_match warning for !CONFIG_OF ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings commit 03df0fc007ca4713fa1e716329af556f981807e4 Merge: aec3e2e23b08 8473bfdcb5b1 Author: Daniel Vetter Date: Fri Nov 10 20:51:37 2023 +0100 Merge tag 'amd-drm-next-6.7-2023-11-10' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.7-2023-11-10: amdgpu: - SR-IOV fixes - DMCUB fixes - DCN3.5 fixes - DP2 fixes - SubVP fixes - SMU14 fixes - SDMA4.x fixes - Suspend/resume fixes - AGP regression fix - UAF fixes for some error cases - SMU 13.0.6 fixes - Documentation fixes - RAS fixes - Hotplug fixes - Scheduling entity ordering fix - GPUVM fixes Signed-off-by: Daniel Vetter From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20231110190703.4741-1-alexander.deucher@amd.com commit ae4f52a729a17a48865a008a6c7dd4c44077ec54 Merge: b456259e1544 bef4a48f4ef7 Author: Linus Torvalds Date: Fri Nov 10 11:44:38 2023 -0800 Merge tag 'spi-fix-v6.7-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of fixes that came in during the merge window: one Kconfig dependency fix and another fix for a long standing issue where a sync transfer races with system suspend" * tag 'spi-fix-v6.7-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: Fix null dereference on suspend spi: spi-zynq-qspi: add spi-mem to driver kconfig dependencies commit b456259e1544daa337fa00cda8bd3bea04c8d914 Merge: b077b7ee9268 015c9cbcf0ad Author: Linus Torvalds Date: Fri Nov 10 11:40:38 2023 -0800 Merge tag 'mmc-v6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC core: - Fix broken cache-flush support for Micron eMMCs - Revert 'mmc: core: Capture correct oemid-bits for eMMC cards' MMC host: - sdhci_am654: Fix TAP value parsing for legacy speed mode - sdhci-pci-gli: Fix support for ASPM mode for GL9755/GL9750 - vub300: Fix an error path in probe" * tag 'mmc-v6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-pci-gli: GL9750: Mask the replay timer timeout of AER mmc: sdhci-pci-gli: GL9755: Mask the replay timer timeout of AER Revert "mmc: core: Capture correct oemid-bits for eMMC cards" mmc: vub300: fix an error code mmc: Add quirk MMC_QUIRK_BROKEN_CACHE_FLUSH for Micron eMMC Q2J54A mmc: sdhci_am654: fix start loop index for TAP value parsing commit b077b7ee9268bb4a34e22a503a2e6315ae8f97a7 Merge: b712075e03cf d27abbfd4888 Author: Linus Torvalds Date: Fri Nov 10 11:34:16 2023 -0800 Merge tag 'pwm/for-6.7-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm fixes from Thierry Reding: "This contains two very small fixes that I failed to include in the main pull request" * tag 'pwm/for-6.7-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: pwm: Fix double shift bug pwm: samsung: Fix a bit test in pwm_samsung_resume() commit b712075e03cf95d9009c99230775dc41195bde8a Merge: 4b803784178d e53759298a7d Author: Linus Torvalds Date: Fri Nov 10 11:25:58 2023 -0800 Merge tag 'io_uring-6.7-2023-11-10' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "Mostly just a few fixes and cleanups caused by the read multishot support. Outside of that, a stable fix for how a connect retry is done" * tag 'io_uring-6.7-2023-11-10' of git://git.kernel.dk/linux: io_uring: do not clamp read length for multishot read io_uring: do not allow multishot read to set addr or len io_uring: indicate if io_kbuf_recycle did recycle anything io_uring/rw: add separate prep handler for fixed read/write io_uring/rw: add separate prep handler for readv/writev io_uring/net: ensure socket is marked connected on connect retry io_uring/rw: don't attempt to allocate async data if opcode doesn't need it commit 4b803784178d1721ba26cadd8aef13b2c7456730 Merge: d035e4eb38b3 37d9486874ec Author: Linus Torvalds Date: Fri Nov 10 11:20:33 2023 -0800 Merge tag 'block-6.7-2023-11-10' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - NVMe pull request via Keith: - nvme keyring config compile fixes (Hannes and Arnd) - fabrics keep alive fixes (Hannes) - tcp authentication fixes (Mark) - io_uring_cmd error handling fix (Anuj) - stale firmware attribute fix (Daniel) - tcp memory leak (Christophe) - crypto library usage simplification (Eric) - nbd use-after-free fix. May need a followup, but at least it's better than what it was before (Li) - Rate limit write on read-only device warnings (Yu) * tag 'block-6.7-2023-11-10' of git://git.kernel.dk/linux: nvme: keyring: fix conditional compilation nvme: common: make keyring and auth separate modules blk-core: use pr_warn_ratelimited() in bio_check_ro() nbd: fix uaf in nbd_open nvme: start keep-alive after admin queue setup nvme-loop: always quiesce and cancel commands before destroying admin q nvme-tcp: avoid open-coding nvme_tcp_teardown_admin_queue() nvme-auth: always set valid seq_num in dhchap reply nvme-auth: add flag for bi-directional auth nvme-auth: auth success1 msg always includes resp nvme: fix error-handling for io_uring nvme-passthrough nvme: update firmware version after commit nvme-tcp: Fix a memory leak nvme-auth: use crypto_shash_tfm_digest() commit d035e4eb38b3ea5ae9ead342f888fd3c394b0fe0 Merge: 391ce5b9c46e 99bce5182d8f Author: Linus Torvalds Date: Fri Nov 10 11:15:34 2023 -0800 Merge tag 'ata-6.7-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata fixes from Damien Le Moal: - Revert a change in ata_pci_shutdown_one() to suspend disks on shutdown as this is now done using the manage_shutdown scsi device flag (me) - Change the pata_falcon and pata_gayle drivers to stop using module_platform_driver_probe(). This makes these drivers more inline with all other drivers (allowing bind/unbind) and suppress a compilation warning (Uwe) - Convert the pata_falcon and pata_gayle drivers to the new .remove_new() void-return callback. These 2 drivers are the last ones needing this change (Uwe) * tag 'ata-6.7-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: pata_gayle: Convert to platform remove callback returning void ata: pata_falcon: Convert to platform remove callback returning void ata: pata_gayle: Stop using module_platform_driver_probe() ata: pata_falcon: Stop using module_platform_driver_probe() ata: libata-core: Fix ata_pci_shutdown_one() commit 391ce5b9c46ebf23cd049bb552a899dfc0cfb838 Merge: ead3b62a34d8 53c87e846e33 Author: Linus Torvalds Date: Fri Nov 10 11:09:07 2023 -0800 Merge tag 'dma-mapping-6.7-2023-11-10' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fixes from Christoph Hellwig: - don't leave pages decrypted for DMA in encrypted memory setups linger around on failure (Petr Tesarik) - fix an out of bounds access in the new dynamic swiotlb code (Petr Tesarik) - fix dma_addressing_limited for systems with weird physical memory layouts (Jia He) * tag 'dma-mapping-6.7-2023-11-10' of git://git.infradead.org/users/hch/dma-mapping: swiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC dma-mapping: fix dma_addressing_limited() if dma_range_map can't cover all system RAM dma-mapping: move dma_addressing_limited() out of line swiotlb: do not free decrypted pages if dynamic commit ead3b62a34d829d2df38187b93a18c22b289bd9c Merge: 826c484166f0 b36995b8609a Author: Linus Torvalds Date: Fri Nov 10 10:58:49 2023 -0800 Merge tag 'lsm-pr-20231109' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull lsm updates from Paul Moore: "We've got two small patches to correct the default return value of two LSM hooks: security_vm_enough_memory_mm() and security_inode_getsecctx()" * tag 'lsm-pr-20231109' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: lsm: fix default return value for inode_getsecctx lsm: fix default return value for vm_enough_memory commit 826c484166f0f74bd8fc09220f99dc937c9297cf Merge: e21165bfbc6c 5a5409d90bd0 Author: Linus Torvalds Date: Fri Nov 10 10:23:53 2023 -0800 Merge tag '6.7-rc-smb3-server-part2' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - slab out of bounds fix in ACL handling - fix malformed request oops - minor doc fix * tag '6.7-rc-smb3-server-part2' of git://git.samba.org/ksmbd: ksmbd: handle malformed smb1 message ksmbd: fix kernel-doc comment of ksmbd_vfs_kern_path_locked() ksmbd: fix slab out of bounds write in smb_inherit_dacl() commit e21165bfbc6c5d259466a7b2eccb66630e807bfb Merge: 56d428ae1c4e 56d2e2cfa213 Author: Linus Torvalds Date: Fri Nov 10 09:52:56 2023 -0800 Merge tag 'ceph-for-6.7-rc1' of https://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: - support for idmapped mounts in CephFS (Christian Brauner, Alexander Mikhalitsyn). The series was originally developed by Christian and later picked up and brought over the finish line by Alexander, who also contributed an enabler on the MDS side (separate owner_{u,g}id fields on the wire). The required exports for mnt_idmap_{get,put}() in VFS have been acked by Christian and received no objection from Christoph. - a churny change in CephFS logging to include cluster and client identifiers in log and debug messages (Xiubo Li). This would help in scenarios with dozens of CephFS mounts on the same node which are getting increasingly common, especially in the Kubernetes world. * tag 'ceph-for-6.7-rc1' of https://github.com/ceph/ceph-client: ceph: allow idmapped mounts ceph: allow idmapped atomic_open inode op ceph: allow idmapped set_acl inode op ceph: allow idmapped setattr inode op ceph: pass idmap to __ceph_setattr ceph: allow idmapped permission inode op ceph: allow idmapped getattr inode op ceph: pass an idmapping to mknod/symlink/mkdir ceph: add enable_unsafe_idmap module parameter ceph: handle idmapped mounts in create_request_message() ceph: stash idmapping in mdsc request fs: export mnt_idmap_get/mnt_idmap_put libceph, ceph: move mdsmap.h to fs/ceph ceph: print cluster fsid and client global_id in all debug logs ceph: rename _to_client() to _to_fs_client() ceph: pass the mdsc to several helpers libceph: add doutc and *_client debug macros support commit 56d428ae1c4e27fbe02cb554b2192cd66e4df05a Merge: 656d88c3b654 457926b25320 Author: Linus Torvalds Date: Fri Nov 10 09:23:17 2023 -0800 Merge tag 'riscv-for-linus-6.7-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull more RISC-V updates from Palmer Dabbelt: - Support for handling misaligned accesses in S-mode - Probing for misaligned access support is now properly cached and handled in parallel - PTDUMP now reflects the SW reserved bits, as well as the PBMT and NAPOT extensions - Performance improvements for TLB flushing - Support for many new relocations in the module loader - Various bug fixes and cleanups * tag 'riscv-for-linus-6.7-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (51 commits) riscv: Optimize bitops with Zbb extension riscv: Rearrange hwcap.h and cpufeature.h drivers: perf: Do not broadcast to other cpus when starting a counter drivers: perf: Check find_first_bit() return value of: property: Add fw_devlink support for msi-parent RISC-V: Don't fail in riscv_of_parent_hartid() for disabled HARTs riscv: Fix set_memory_XX() and set_direct_map_XX() by splitting huge linear mappings riscv: Don't use PGD entries for the linear mapping RISC-V: Probe misaligned access speed in parallel RISC-V: Remove __init on unaligned_emulation_finish() RISC-V: Show accurate per-hart isa in /proc/cpuinfo RISC-V: Don't rely on positional structure initialization riscv: Add tests for riscv module loading riscv: Add remaining module relocations riscv: Avoid unaligned access when relocating modules riscv: split cache ops out of dma-noncoherent.c riscv: Improve flush_tlb_kernel_range() riscv: Make __flush_tlb_range() loop over pte instead of flushing the whole tlb riscv: Improve flush_tlb_range() for hugetlb pages riscv: Improve tlb_flush() ... commit 656d88c3b654c0ccc0ff63aa75101c6c9f0a5300 Merge: 89cdf9d55601 4b7d3ab44565 Author: Linus Torvalds Date: Fri Nov 10 09:19:46 2023 -0800 Merge tag 'mips_6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: - removed AR7 platform support - cleanups and fixes * tag 'mips_6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: AR7: remove platform watchdog: ar7_wdt: remove driver to prepare for platform removal vlynq: remove bus driver mtd: parsers: ar7: remove support serial: 8250: remove AR7 support arch: mips: remove ReiserFS from defconfig MIPS: lantiq: Remove unnecessary include of MIPS: lantiq: Fix pcibios_plat_dev_init() "no previous prototype" warning MIPS: KVM: Fix a build warning about variable set but not used MIPS: Remove dead code in relocate_new_kernel mips: dts: ralink: mt7621: rename to GnuBee GB-PC1 and GnuBee GB-PC2 mips: dts: ralink: mt7621: define each reset as an item mips: dts: ingenic: Remove unneeded probe-type properties MIPS: loongson32: Remove dma.h and nand.h commit 8384c0baf223e1c3bc7b1c711d80a4c6106d210e Author: Eymen Yigit Date: Fri Nov 10 18:07:15 2023 +0300 ALSA: hda/realtek: Enable Mute LED on HP 255 G8 This HP Notebook uses ALC236 codec with COEF 0x07 idx 1 controlling the mute LED. Enable already existing quirk for this device. Signed-off-by: Eymen Yigit Cc: Luka Guzenko Cc: Link: https://lore.kernel.org/r/20231110150715.5141-1-eymenyg01@gmail.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 4b21a669ca21ed8f24ef4530b2918be5730114de Author: Kailang Yang Date: Fri Nov 10 15:16:06 2023 +0800 ALSA: hda/realtek - Add Dell ALC295 to pin fall back table Add ALC295 to pin fall back table. Remove 5 pin quirks for Dell ALC295. ALC295 was only support MIC2 for external MIC function. ALC295 assigned model "ALC269_FIXUP_DELL1_MIC_NO_PRESENCE" for pin fall back table. It was assigned wrong model. So, let's remove it. Fixes: fbc571290d9f ("ALSA: hda/realtek - Fixed Headphone Mic can't record on Dell platform") Signed-off-by: Kailang Yang Cc: Link: https://lore.kernel.org/r/7c1998e873834df98d59bd7e0d08c72e@realtek.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 19 +++---------------- 1 file changed, 3 insertions(+), 16 deletions(-) commit 8473bfdcb5b1a32fd05629c4535ccacd73bc5567 Author: Christian König Date: Tue Oct 31 15:35:27 2023 +0100 drm/amdgpu: fix error handling in amdgpu_vm_init When clearing the root PD fails we need to properly release it again. Signed-off-by: Christian König Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) commit 256503071c2de2b5b5c20e06654aa9a44f13aa62 Author: Felix Kuehling Date: Tue Oct 31 13:30:00 2023 -0400 drm/amdgpu: Fix possible null pointer dereference mem = bo->tbo.resource may be NULL in amdgpu_vm_bo_update. Fixes: 180253782038 ("drm/ttm: stop allocating dummy resources during BO creation") Signed-off-by: Felix Kuehling Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 037b98a2312e2587163de14afae8ae1b64b67dda Author: Alex Deucher Date: Wed Nov 8 09:40:44 2023 -0500 drm/amdgpu: move UVD and VCE sched entity init after sched init We need kernel scheduling entities to deal with handle clean up if apps are not cleaned up properly. With commit 56e449603f0ac5 ("drm/sched: Convert the GPU scheduler to variable number of run-queues") the scheduler entities have to be created after scheduler init, so change the ordering to fix this. v2: Leave logic in UVD and VCE code Fixes: 56e449603f0a ("drm/sched: Convert the GPU scheduler to variable number of run-queues") Reviewed-by: Christian König Reviewed-by: Luben Tuikov Signed-off-by: Alex Deucher Cc: ltuikov89@gmail.com drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 12 ++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 22 +++++++++++----------- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 24 ++++++++++++------------ drivers/gpu/drm/amd/amdgpu/amdgpu_vce.h | 2 +- drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 2 -- drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c | 2 -- drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c | 2 -- drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c | 2 -- drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c | 4 ---- drivers/gpu/drm/amd/amdgpu/vce_v2_0.c | 2 -- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 2 -- drivers/gpu/drm/amd/amdgpu/vce_v4_0.c | 5 ----- 13 files changed, 37 insertions(+), 46 deletions(-) commit 8ed79c409ecb216ee2b0ec334568a1104505c62a Author: Tim Huang Date: Thu Oct 19 15:50:43 2023 +0800 drm/amdgpu: move kfd_resume before the ip late init The kfd_resume needs to touch GC registers to enable the interrupts, it needs to be done before GFXOFF is enabled to ensure that the GFX is not off and GC registers can be touched. So move kfd_resume before the amdgpu_device_ip_late_init which enables the CGPG/GFXOFF. Signed-off-by: Tim Huang Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit e4c44b1a19625348fc004ce8c5f828d5d80d037e Author: Mario Limonciello Date: Thu Nov 9 11:23:46 2023 -0600 drm/amd: Explicitly check for GFXOFF to be enabled for s0ix If a user has disabled GFXOFF this may cause problems for the suspend sequence. Ensure that it is enabled in amdgpu_acpi_is_s0ix_active(). The system won't reach the deepest state but it also won't hang. Signed-off-by: Mario Limonciello Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 3 +++ 1 file changed, 3 insertions(+) commit aec3e2e23b08f188c22f36c4108467f80e980b15 Merge: 0b336ec076b9 0e8b9f258bae Author: Daniel Vetter Date: Fri Nov 10 16:54:41 2023 +0100 Merge tag 'drm-misc-fixes-2023-11-08' of git://anongit.freedesktop.org/drm/drm-misc into drm-next drm-misc-fixes for v6.7-rc1: qxl: - qxl memory leak fix. syncobj: - Fix waiting for DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE vc4: - Fix UAF in mock helpers Signed-off-by: Daniel Vetter From: Maarten Lankhorst [sima: Stitch together both changelogs from Maarten. Also because of branch history this contains a few more bugfixes which are already in v6.6, but I didn't feel like this justifies some backmerge since there wasn't any real conflict.] Link: https://patchwork.freedesktop.org/patch/msgid/bc8598ee-d427-4616-8ebd-64107ab9a2d8@linux.intel.com commit 0b336ec076b97642a8e740b0f01f6ad305b02742 Merge: 9ccde17d4655 9506fba463fc Author: Daniel Vetter Date: Fri Nov 10 16:43:44 2023 +0100 Merge tag 'drm-intel-next-fixes-2023-11-08' of git://anongit.freedesktop.org/drm/drm-intel into drm-next drm/i915 fixes for v6.7-rc1: - Fix null dereference when perf interface is not available - Fix a -Wstringop-overflow warning - Fix a -Wformat-truncation warning in intel_tc_port_init - Flush WC GGTT only on required platforms - Fix MTL HBR3 rate support on C10 phy and eDP - Fix MTL notify_guc for multi-GT - Bump GLK CDCLK frequency when driving multiple pipes - Fix potential spectre vulnerability Signed-off-by: Daniel Vetter From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/878r78xrxd.fsf@intel.com commit fd2bd7c0539e28f267a84da8d68f9378511b50a7 Author: Steve French Date: Thu Jul 20 08:30:32 2023 -0500 cifs: update internal module version number for cifs.ko From 2.45 to 2.46 Signed-off-by: Steve French fs/smb/client/cifsfs.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ee1d21794e55ab76505745d24101331552182002 Author: Shyam Prasad N Date: Fri Oct 13 11:40:09 2023 +0000 cifs: handle when server stops supporting multichannel When a server stops supporting multichannel, we will keep attempting reconnects to the secondary channels today. Avoid this by freeing extra channels when negotiate returns no multichannel support. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/cifsglob.h | 1 + fs/smb/client/cifsproto.h | 2 ++ fs/smb/client/connect.c | 10 +++++++ fs/smb/client/sess.c | 64 ++++++++++++++++++++++++++++++++++----- fs/smb/client/smb2pdu.c | 76 ++++++++++++++++++++++++++++++++++++++++++++++- fs/smb/client/transport.c | 2 +- 6 files changed, 145 insertions(+), 10 deletions(-) commit 705fc522fe9d58848c253ee0948567060f36e2a7 Author: Shyam Prasad N Date: Fri Oct 13 11:33:21 2023 +0000 cifs: handle when server starts supporting multichannel When the user mounts with multichannel option, but the server does not support it, there can be a time in future where it can be supported. With this change, such a case is handled. Signed-off-by: Shyam Prasad N fs/smb/client/cifsproto.h | 1 + fs/smb/client/connect.c | 3 +++ fs/smb/client/smb2pdu.c | 32 ++++++++++++++++++++++++++++++-- 3 files changed, 34 insertions(+), 2 deletions(-) commit 784e0e20b4c97c270b2892f677d3fad658e2c1d5 Author: Steve French Date: Fri Nov 10 01:24:16 2023 -0600 Missing field not being returned in ioctl CIFS_IOC_GET_MNT_INFO The tcon_flags field was always being set to zero in the information about the mount returned by the ioctl CIFS_IOC_GET_MNT_INFO instead of being set to the value of the Flags field in the tree connection structure as intended. Reviewed-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/ioctl.c | 1 + 1 file changed, 1 insertion(+) commit a406b8b424fa01f244c1aab02ba186258448c36b Author: Helge Deller Date: Fri Nov 10 16:13:15 2023 +0100 parisc: Prevent booting 64-bit kernels on PA1.x machines Bail out early with error message when trying to boot a 64-bit kernel on 32-bit machines. This fixes the previous commit to include the check for true 64-bit kernels as well. Signed-off-by: Helge Deller Fixes: 591d2108f3abc ("parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines") Cc: # v6.0+ arch/parisc/kernel/head.S | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit bef4a48f4ef798c4feddf045d49e53c8a97d5e37 Author: Mark Hasemeyer Date: Tue Nov 7 14:47:43 2023 -0700 spi: Fix null dereference on suspend A race condition exists where a synchronous (noqueue) transfer can be active during a system suspend. This can cause a null pointer dereference exception to occur when the system resumes. Example order of events leading to the exception: 1. spi_sync() calls __spi_transfer_message_noqueue() which sets ctlr->cur_msg 2. Spi transfer begins via spi_transfer_one_message() 3. System is suspended interrupting the transfer context 4. System is resumed 6. spi_controller_resume() calls spi_start_queue() which resets cur_msg to NULL 7. Spi transfer context resumes and spi_finalize_current_message() is called which dereferences cur_msg (which is now NULL) Wait for synchronous transfers to complete before suspending by acquiring the bus mutex and setting/checking a suspend flag. Signed-off-by: Mark Hasemeyer Link: https://lore.kernel.org/r/20231107144743.v1.1.I7987f05f61901f567f7661763646cb7d7919b528@changeid Signed-off-by: Mark Brown Cc: stable@kernel.org drivers/spi/spi.c | 56 ++++++++++++++++++++++++++++++++++--------------- include/linux/spi/spi.h | 1 + 2 files changed, 40 insertions(+), 17 deletions(-) commit 719639853d88071dfdfd8d9971eca9c283ff314c Author: Shigeru Yoshida Date: Thu Nov 9 00:44:20 2023 +0900 tty: Fix uninit-value access in ppp_sync_receive() KMSAN reported the following uninit-value access issue: ===================================================== BUG: KMSAN: uninit-value in ppp_sync_input drivers/net/ppp/ppp_synctty.c:690 [inline] BUG: KMSAN: uninit-value in ppp_sync_receive+0xdc9/0xe70 drivers/net/ppp/ppp_synctty.c:334 ppp_sync_input drivers/net/ppp/ppp_synctty.c:690 [inline] ppp_sync_receive+0xdc9/0xe70 drivers/net/ppp/ppp_synctty.c:334 tiocsti+0x328/0x450 drivers/tty/tty_io.c:2295 tty_ioctl+0x808/0x1920 drivers/tty/tty_io.c:2694 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0x211/0x400 fs/ioctl.c:857 __x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: __alloc_pages+0x75d/0xe80 mm/page_alloc.c:4591 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] __page_frag_cache_refill+0x9a/0x2c0 mm/page_alloc.c:4691 page_frag_alloc_align+0x91/0x5d0 mm/page_alloc.c:4722 page_frag_alloc include/linux/gfp.h:322 [inline] __netdev_alloc_skb+0x215/0x6d0 net/core/skbuff.c:728 netdev_alloc_skb include/linux/skbuff.h:3225 [inline] dev_alloc_skb include/linux/skbuff.h:3238 [inline] ppp_sync_input drivers/net/ppp/ppp_synctty.c:669 [inline] ppp_sync_receive+0x237/0xe70 drivers/net/ppp/ppp_synctty.c:334 tiocsti+0x328/0x450 drivers/tty/tty_io.c:2295 tty_ioctl+0x808/0x1920 drivers/tty/tty_io.c:2694 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0x211/0x400 fs/ioctl.c:857 __x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b CPU: 0 PID: 12950 Comm: syz-executor.1 Not tainted 6.6.0-14500-g1c41041124bd #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014 ===================================================== ppp_sync_input() checks the first 2 bytes of the data are PPP_ALLSTATIONS and PPP_UI. However, if the data length is 1 and the first byte is PPP_ALLSTATIONS, an access to an uninitialized value occurs when checking PPP_UI. This patch resolves this issue by checking the data length. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Shigeru Yoshida Reviewed-by: Simon Horman Signed-off-by: David S. Miller drivers/net/ppp/ppp_synctty.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ce51e6153f7781bcde0f8bb4c81d6fd85ee422e6 Author: Masami Hiramatsu (Google) Date: Wed Nov 8 21:12:39 2023 +0900 tracing: fprobe-event: Fix to check tracepoint event and return Fix to check the tracepoint event is not valid with $retval. The commit 08c9306fc2e3 ("tracing/fprobe-event: Assume fprobe is a return event by $retval") introduced automatic return probe conversion with $retval. But since tracepoint event does not support return probe, $retval is not acceptable. Without this fix, ftracetest, tprobe_syntax_errors.tc fails; [22] Tracepoint probe event parser error log check [FAIL] ---- # tail 22-tprobe_syntax_errors.tc-log.mRKroL + ftrace_errlog_check trace_fprobe t kfree ^$retval dynamic_events + printf %s t kfree + wc -c + pos=8 + printf %s t kfree ^$retval + tr -d ^ + command=t kfree $retval + echo Test command: t kfree $retval Test command: t kfree $retval + echo ---- So 't kfree $retval' should fail (tracepoint doesn't support return probe) but passed it. Link: https://lore.kernel.org/all/169944555933.45057.12831706585287704173.stgit@devnote2/ Fixes: 08c9306fc2e3 ("tracing/fprobe-event: Assume fprobe is a return event by $retval") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) kernel/trace/trace_fprobe.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 18f039428c7df183b09c69ebf10ffd4e521035d2 Author: Eric Dumazet Date: Thu Nov 9 15:22:41 2023 +0000 ipvlan: add ipvlan_route_v6_outbound() helper Inspired by syzbot reports using a stack of multiple ipvlan devices. Reduce stack size needed in ipvlan_process_v6_outbound() by moving the flowi6 struct used for the route lookup in an non inlined helper. ipvlan_route_v6_outbound() needs 120 bytes on the stack, immediately reclaimed. Also make sure ipvlan_process_v4_outbound() is not inlined. We might also have to lower MAX_NEST_DEV, because only syzbot uses setups with more than four stacked devices. BUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000) stack guard page: 0000 [#1] SMP KASAN CPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 RIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188 Code: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89 RSP: 0018:ffffc9000e804000 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568 RBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080c R13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000 FS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <#DF> [] __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31 [] instrument_atomic_read include/linux/instrumented.h:72 [inline] [] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] [] cpumask_test_cpu include/linux/cpumask.h:506 [inline] [] cpu_online include/linux/cpumask.h:1092 [inline] [] trace_lock_acquire include/trace/events/lock.h:24 [inline] [] lock_acquire+0xe2/0x590 kernel/locking/lockdep.c:5632 [] rcu_lock_acquire+0x2e/0x40 include/linux/rcupdate.h:306 [] rcu_read_lock include/linux/rcupdate.h:747 [inline] [] ip6_pol_route+0x15d/0x1440 net/ipv6/route.c:2221 [] ip6_pol_route_output+0x50/0x80 net/ipv6/route.c:2606 [] pol_lookup_func include/net/ip6_fib.h:584 [inline] [] fib6_rule_lookup+0x265/0x620 net/ipv6/fib6_rules.c:116 [] ip6_route_output_flags_noref+0x2d9/0x3a0 net/ipv6/route.c:2638 [] ip6_route_output_flags+0xca/0x340 net/ipv6/route.c:2651 [] ip6_route_output include/net/ip6_route.h:100 [inline] [] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:473 [inline] [] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] [] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] [] ipvlan_queue_xmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 [] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 [] netdev_start_xmit include/linux/netdevice.h:4966 [inline] [] xmit_one net/core/dev.c:3644 [inline] [] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 [] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [] dev_queue_xmit include/linux/netdevice.h:3067 [inline] [] neigh_hh_output include/net/neighbour.h:529 [inline] [] neigh_output include/net/neighbour.h:543 [inline] [] ip6_finish_output2+0x160d/0x1ae0 net/ipv6/ip6_output.c:139 [] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline] [] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211 [] NF_HOOK_COND include/linux/netfilter.h:298 [inline] [] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232 [] dst_output include/net/dst.h:444 [inline] [] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161 [] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline] [] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] [] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] [] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 [] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 [] netdev_start_xmit include/linux/netdevice.h:4966 [inline] [] xmit_one net/core/dev.c:3644 [inline] [] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 [] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [] dev_queue_xmit include/linux/netdevice.h:3067 [inline] [] neigh_hh_output include/net/neighbour.h:529 [inline] [] neigh_output include/net/neighbour.h:543 [inline] [] ip6_finish_output2+0x160d/0x1ae0 net/ipv6/ip6_output.c:139 [] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline] [] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211 [] NF_HOOK_COND include/linux/netfilter.h:298 [inline] [] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232 [] dst_output include/net/dst.h:444 [inline] [] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161 [] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline] [] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] [] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] [] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 [] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 [] netdev_start_xmit include/linux/netdevice.h:4966 [inline] [] xmit_one net/core/dev.c:3644 [inline] [] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 [] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [] dev_queue_xmit include/linux/netdevice.h:3067 [inline] [] neigh_hh_output include/net/neighbour.h:529 [inline] [] neigh_output include/net/neighbour.h:543 [inline] [] ip6_finish_output2+0x160d/0x1ae0 net/ipv6/ip6_output.c:139 [] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline] [] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211 [] NF_HOOK_COND include/linux/netfilter.h:298 [inline] [] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232 [] dst_output include/net/dst.h:444 [inline] [] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161 [] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline] [] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] [] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] [] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 [] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 [] netdev_start_xmit include/linux/netdevice.h:4966 [inline] [] xmit_one net/core/dev.c:3644 [inline] [] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 [] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [] dev_queue_xmit include/linux/netdevice.h:3067 [inline] [] neigh_hh_output include/net/neighbour.h:529 [inline] [] neigh_output include/net/neighbour.h:543 [inline] [] ip6_finish_output2+0x160d/0x1ae0 net/ipv6/ip6_output.c:139 [] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline] [] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211 [] NF_HOOK_COND include/linux/netfilter.h:298 [inline] [] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232 [] dst_output include/net/dst.h:444 [inline] [] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161 [] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline] [] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] [] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] [] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 [] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 [] netdev_start_xmit include/linux/netdevice.h:4966 [inline] [] xmit_one net/core/dev.c:3644 [inline] [] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 [] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [] dev_queue_xmit include/linux/netdevice.h:3067 [inline] [] neigh_resolve_output+0x64e/0x750 net/core/neighbour.c:1560 [] neigh_output include/net/neighbour.h:545 [inline] [] ip6_finish_output2+0x1643/0x1ae0 net/ipv6/ip6_output.c:139 [] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline] [] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211 [] NF_HOOK_COND include/linux/netfilter.h:298 [inline] [] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232 [] dst_output include/net/dst.h:444 [inline] [] NF_HOOK include/linux/netfilter.h:309 [inline] [] ip6_xmit+0x11a4/0x1b20 net/ipv6/ip6_output.c:352 [] sctp_v6_xmit+0x9ae/0x1230 net/sctp/ipv6.c:250 [] sctp_packet_transmit+0x25de/0x2bc0 net/sctp/output.c:653 [] sctp_packet_singleton+0x202/0x310 net/sctp/outqueue.c:783 [] sctp_outq_flush_ctrl net/sctp/outqueue.c:914 [inline] [] sctp_outq_flush+0x661/0x3d40 net/sctp/outqueue.c:1212 [] sctp_outq_uncork+0x79/0xb0 net/sctp/outqueue.c:764 [] sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline] [] sctp_do_sm+0x55c0/0x5c30 net/sctp/sm_sideeffect.c:1170 [] sctp_primitive_ASSOCIATE+0x97/0xc0 net/sctp/primitive.c:73 [] sctp_sendmsg_to_asoc+0xf62/0x17b0 net/sctp/socket.c:1839 [] sctp_sendmsg+0x212e/0x33b0 net/sctp/socket.c:2029 [] inet_sendmsg+0x149/0x310 net/ipv4/af_inet.c:849 [] sock_sendmsg_nosec net/socket.c:716 [inline] [] sock_sendmsg net/socket.c:736 [inline] [] ____sys_sendmsg+0x572/0x8c0 net/socket.c:2504 [] ___sys_sendmsg net/socket.c:2558 [inline] [] __sys_sendmsg+0x271/0x360 net/socket.c:2587 [] __do_sys_sendmsg net/socket.c:2596 [inline] [] __se_sys_sendmsg net/socket.c:2594 [inline] [] __x64_sys_sendmsg+0x7f/0x90 net/socket.c:2594 [] do_syscall_x64 arch/x86/entry/common.c:51 [inline] [] do_syscall_64+0x53/0x80 arch/x86/entry/common.c:84 [] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Mahesh Bandewar Cc: Willem de Bruijn Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller drivers/net/ipvlan/ipvlan_core.c | 41 ++++++++++++++++++++++++---------------- 1 file changed, 25 insertions(+), 16 deletions(-) commit abc28463c81853e4fdf8d009f71b2a3ce62a6f40 Author: Arnd Bergmann Date: Fri Nov 10 19:59:05 2023 +0900 kprobes: unify kprobes_exceptions_nofify() prototypes Most architectures that support kprobes declare this function in their own asm/kprobes.h header and provide an override, but some are missing the prototype, which causes a warning for the __weak stub implementation: kernel/kprobes.c:1865:12: error: no previous prototype for 'kprobe_exceptions_notify' [-Werror=missing-prototypes] 1865 | int __weak kprobe_exceptions_notify(struct notifier_block *self, Move the prototype into linux/kprobes.h so it is visible to all the definitions. Link: https://lore.kernel.org/all/20231108125843.3806765-4-arnd@kernel.org/ Acked-by: Masami Hiramatsu (Google) Signed-off-by: Arnd Bergmann Signed-off-by: Masami Hiramatsu (Google) arch/arc/include/asm/kprobes.h | 3 --- arch/arm/include/asm/kprobes.h | 2 -- arch/arm64/include/asm/kprobes.h | 2 -- arch/mips/include/asm/kprobes.h | 2 -- arch/powerpc/include/asm/kprobes.h | 2 -- arch/s390/include/asm/kprobes.h | 2 -- arch/sh/include/asm/kprobes.h | 2 -- arch/sparc/include/asm/kprobes.h | 2 -- arch/x86/include/asm/kprobes.h | 2 -- include/linux/kprobes.h | 4 ++++ 10 files changed, 4 insertions(+), 19 deletions(-) commit 3afe73372966d4d8b40922d7229c8ecb1c2ca287 Author: wuqiang.matt Date: Fri Nov 10 19:59:04 2023 +0900 lib: test_objpool: make global variables static Kernel test robot reported build warnings that structures g_ot_sync_ops, g_ot_async_ops and g_testcases should be static. These definitions are only used in test_objpool.c, so make them static Link: https://lore.kernel.org/all/20231108012248.313574-1-wuqiang.matt@bytedance.com/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311071229.WGrWUjM1-lkp@intel.com/ Signed-off-by: wuqiang.matt Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) lib/test_objpool.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit b2a866975f6cd5859c746f1da39c8f5736c8def2 Author: Masami Hiramatsu (Google) Date: Fri Nov 10 19:59:03 2023 +0900 Documentation: tracing: Add a note about argument and retval access Add a note about the argument and return value accecss will be best effort. Depending on the type, it will be passed via stack or a pair of the registers, but $argN and $retval only support the single register access. Link: https://lore.kernel.org/all/169556269377.146934.14829235476649685954.stgit@devnote2/ Suggested-by: Alexei Starovoitov Signed-off-by: Masami Hiramatsu (Google) Documentation/trace/fprobetrace.rst | 8 ++++++-- Documentation/trace/kprobetrace.rst | 8 ++++++-- 2 files changed, 12 insertions(+), 4 deletions(-) commit cbe9e68e1e0f965fd3b1caf975eb29083c65e6b0 Author: Ravi Gunasekaran Date: Fri Nov 10 14:57:49 2023 +0530 MAINTAINERS: net: Update reviewers for TI's Ethernet drivers Grygorii is no longer associated with TI and messages addressed to him bounce. Add Siddharth, Roger and myself as reviewers. Signed-off-by: Ravi Gunasekaran Signed-off-by: David S. Miller MAINTAINERS | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 871019b22d1bcc9fab2d1feba1b9a564acbb6e99 Author: Stanislav Fomichev Date: Wed Nov 8 13:13:25 2023 -0800 net: set SOCK_RCU_FREE before inserting socket into hashtable We've started to see the following kernel traces: WARNING: CPU: 83 PID: 0 at net/core/filter.c:6641 sk_lookup+0x1bd/0x1d0 Call Trace: __bpf_skc_lookup+0x10d/0x120 bpf_sk_lookup+0x48/0xd0 bpf_sk_lookup_tcp+0x19/0x20 bpf_prog_+0x37c/0x16a3 cls_bpf_classify+0x205/0x2e0 tcf_classify+0x92/0x160 __netif_receive_skb_core+0xe52/0xf10 __netif_receive_skb_list_core+0x96/0x2b0 napi_complete_done+0x7b5/0xb70 _poll+0x94/0xb0 net_rx_action+0x163/0x1d70 __do_softirq+0xdc/0x32e asm_call_irq_on_stack+0x12/0x20 do_softirq_own_stack+0x36/0x50 do_softirq+0x44/0x70 __inet_hash can race with lockless (rcu) readers on the other cpus: __inet_hash __sk_nulls_add_node_rcu <- (bpf triggers here) sock_set_flag(SOCK_RCU_FREE) Let's move the SOCK_RCU_FREE part up a bit, before we are inserting the socket into hashtables. Note, that the race is really harmless; the bpf callers are handling this situation (where listener socket doesn't have SOCK_RCU_FREE set) correctly, so the only annoyance is a WARN_ONCE. More details from Eric regarding SOCK_RCU_FREE timeline: Commit 3b24d854cb35 ("tcp/dccp: do not touch listener sk_refcnt under synflood") added SOCK_RCU_FREE. At that time, the precise location of sock_set_flag(sk, SOCK_RCU_FREE) did not matter, because the thread calling __inet_hash() owns a reference on sk. SOCK_RCU_FREE was only tested at dismantle time. Commit 6acc9b432e67 ("bpf: Add helper to retrieve socket in BPF") started checking SOCK_RCU_FREE _after_ the lookup to infer whether the refcount has been taken care of. Fixes: 6acc9b432e67 ("bpf: Add helper to retrieve socket in BPF") Reviewed-by: Eric Dumazet Signed-off-by: Stanislav Fomichev Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller net/ipv4/inet_hashtables.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8a4f030dbced6fc255cbe67b2d0a129947e18493 Author: Yuran Pereira Date: Wed Nov 8 02:18:36 2023 +0530 ptp: Fixes a null pointer dereference in ptp_ioctl Syzkaller found a null pointer dereference in ptp_ioctl originating from the lack of a null check for tsevq. ``` general protection fault, probably for non-canonical address 0xdffffc000000020b: 0000 [#1] PREEMPT SMP KASAN KASAN: probably user-memory-access in range [0x0000000000001058-0x000000000000105f] CPU: 0 PID: 5053 Comm: syz-executor353 Not tainted 6.6.0-syzkaller-10396-g4652b8e4f3ff #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 RIP: 0010:ptp_ioctl+0xcb7/0x1d10 drivers/ptp/ptp_chardev.c:476 ... Call Trace: posix_clock_ioctl+0xf8/0x160 kernel/time/posix-clock.c:86 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl fs/ioctl.c:857 [inline] __x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b ``` This patch fixes the issue by adding a check for tsevq and ensuring ptp_ioctl returns with an error if tsevq is null. Reported-by: syzbot+8a78ecea7ac1a2ea26e5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8a78ecea7ac1a2ea26e5 Fixes: c5a445b1e934 ("ptp: support event queue reader channel masks") Signed-off-by: Yuran Pereira Reviewed-by: Przemek Kitszel Signed-off-by: David S. Miller drivers/ptp/ptp_chardev.c | 2 ++ 1 file changed, 2 insertions(+) commit d27abbfd4888d79dd24baf50e774631046ac4732 Author: Dan Carpenter Date: Wed Oct 25 14:58:18 2023 +0300 pwm: Fix double shift bug These enums are passed to set/test_bit(). The set/test_bit() functions take a bit number instead of a shifted value. Passing a shifted value is a double shift bug like doing BIT(BIT(1)). The double shift bug doesn't cause a problem here because we are only checking 0 and 1 but if the value was 5 or above then it can lead to a buffer overflow. Signed-off-by: Dan Carpenter Reviewed-by: Uwe Kleine-König Reviewed-by: Sam Protsenko Signed-off-by: Thierry Reding include/linux/pwm.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a2da597ff6f5504fc99163de4f15b7f3a129894e Author: Dan Carpenter Date: Wed Oct 25 14:57:34 2023 +0300 pwm: samsung: Fix a bit test in pwm_samsung_resume() The PWMF_REQUESTED enum is supposed to be used with test_bit() and not used as in a bitwise AND. In this specific code the flag will never be set so the function is effectively a no-op. Fixes: e3fe982b2e4e ("pwm: samsung: Put per-channel data into driver data") Signed-off-by: Dan Carpenter Reviewed-by: Uwe Kleine-König Reviewed-by: Sam Protsenko Signed-off-by: Thierry Reding drivers/pwm/pwm-samsung.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a5035c81847430dfa3482807b07325f29e9e8c09 Author: Arnd Bergmann Date: Wed Nov 8 13:58:42 2023 +0100 fbdev: fsl-diu-fb: mark wr_reg_wa() static wr_reg_wa() is not an appropriate name for a global function, and doesn't need to be global anyway, so mark it static and avoid the warning: drivers/video/fbdev/fsl-diu-fb.c:493:6: error: no previous prototype for 'wr_reg_wa' [-Werror=missing-prototypes] Fixes: 0d9dab39fbbe ("powerpc/5121: fsl-diu-fb: fix issue with re-enabling DIU area descriptor") Signed-off-by: Arnd Bergmann Signed-off-by: Helge Deller drivers/video/fbdev/fsl-diu-fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit dce217780270300db7931d0fd73796aa64fea237 Author: Uwe Kleine-König Date: Thu Nov 9 23:01:54 2023 +0100 fbdev: amifb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Geert Uytterhoeven Signed-off-by: Helge Deller drivers/video/fbdev/amifb.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 67e1ab5bb58a787809772eba14e7e758c765e2fd Author: Uwe Kleine-König Date: Thu Nov 9 23:01:53 2023 +0100 fbdev: amifb: Mark driver struct with __refdata to prevent section mismatch warning As described in the added code comment, a reference to .exit.text is ok for drivers registered via module_platform_driver_probe(). Make this explicit to prevent a section mismatch warning. Signed-off-by: Uwe Kleine-König Reviewed-by: Geert Uytterhoeven Signed-off-by: Helge Deller drivers/video/fbdev/amifb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit de4eceab578ead12a71e5b5588a57e142bbe8ceb Author: Steve French Date: Thu Nov 9 15:28:12 2023 -0600 smb3: allow dumping session and tcon id to improve stats analysis and debugging When multiple mounts are to the same share from the same client it was not possible to determine which section of /proc/fs/cifs/Stats (and DebugData) correspond to that mount. In some recent examples this turned out to be a significant problem when trying to analyze performance data - since there are many cases where unless we know the tree id and session id we can't figure out which stats (e.g. number of SMB3.1.1 requests by type, the total time they take, which is slowest, how many fail etc.) apply to which mount. The only existing loosely related ioctl CIFS_IOC_GET_MNT_INFO does not return the information needed to uniquely identify which tcon is which mount although it does return various flags and device info. Add a cifs.ko ioctl CIFS_IOC_GET_TCON_INFO (0x800ccf0c) to return tid, session id, tree connect count. Cc: stable@vger.kernel.org Reviewed-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/cifs_ioctl.h | 6 ++++++ fs/smb/client/ioctl.c | 25 +++++++++++++++++++++++++ 2 files changed, 31 insertions(+) commit 8e8e46a6036f5e0eefdbf6e0ed43b3581d488aa7 Author: Arnd Bergmann Date: Wed Nov 8 13:58:26 2023 +0100 parport: gsc: mark init function static This is only used locally, so mark it static to avoid a warning: drivers/parport/parport_gsc.c:395:5: error: no previous prototype for 'parport_gsc_init' [-Werror=missing-prototypes] Acked-by: Helge Deller Acked-by: Sudip Mukherjee Signed-off-by: Arnd Bergmann Signed-off-by: Helge Deller drivers/parport/parport_gsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e2e57d637aa5da0a2f49d83ad44e9febf95df7b4 Author: Andrii Nakryiko Date: Thu Nov 9 22:14:11 2023 -0800 selftests/bpf: add more test cases for check_cfg() Add a few more simple cases to validate proper privileged vs unprivileged loop detection behavior. conditional_loop2 is the one reported by Hao Sun that triggered this set of fixes. Acked-by: Eduard Zingerman Suggested-by: Hao Sun Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20231110061412.2995786-2-andrii@kernel.org Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/progs/verifier_cfg.c | 62 ++++++++++++++++++++++++ 1 file changed, 62 insertions(+) commit 10e14e9652bf9e8104151bfd9200433083deae3d Author: Andrii Nakryiko Date: Thu Nov 9 22:14:10 2023 -0800 bpf: fix control-flow graph checking in privileged mode When BPF program is verified in privileged mode, BPF verifier allows bounded loops. This means that from CFG point of view there are definitely some back-edges. Original commit adjusted check_cfg() logic to not detect back-edges in control flow graph if they are resulting from conditional jumps, which the idea that subsequent full BPF verification process will determine whether such loops are bounded or not, and either accept or reject the BPF program. At least that's my reading of the intent. Unfortunately, the implementation of this idea doesn't work correctly in all possible situations. Conditional jump might not result in immediate back-edge, but just a few unconditional instructions later we can arrive at back-edge. In such situations check_cfg() would reject BPF program even in privileged mode, despite it might be bounded loop. Next patch adds one simple program demonstrating such scenario. To keep things simple, instead of trying to detect back edges in privileged mode, just assume every back edge is valid and let subsequent BPF verification prove or reject bounded loops. Note a few test changes. For unknown reason, we have a few tests that are specified to detect a back-edge in a privileged mode, but looking at their code it seems like the right outcome is passing check_cfg() and letting subsequent verification to make a decision about bounded or not bounded looping. Bounded recursion case is also interesting. The example should pass, as recursion is limited to just a few levels and so we never reach maximum number of nested frames and never exhaust maximum stack depth. But the way that max stack depth logic works today it falsely detects this as exceeding max nested frame count. This patch series doesn't attempt to fix this orthogonal problem, so we just adjust expected verifier failure. Suggested-by: Alexei Starovoitov Fixes: 2589726d12a1 ("bpf: introduce bounded loops") Reported-by: Hao Sun Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20231110061412.2995786-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 23 ++++++++-------------- .../testing/selftests/bpf/progs/verifier_loops1.c | 9 ++++++--- tools/testing/selftests/bpf/verifier/calls.c | 6 +++--- 3 files changed, 17 insertions(+), 21 deletions(-) commit cca202a5e59578247cd7f0496056884f5c9cc338 Author: Arnd Bergmann Date: Wed Nov 8 15:58:13 2023 +0100 fbdev: hyperv_fb: fix uninitialized local variable use When CONFIG_SYSFB is disabled, the hyperv_fb driver can now run into undefined behavior on a gen2 VM, as indicated by this smatch warning: drivers/video/fbdev/hyperv_fb.c:1077 hvfb_getmem() error: uninitialized symbol 'base'. drivers/video/fbdev/hyperv_fb.c:1077 hvfb_getmem() error: uninitialized symbol 'size'. Since there is no way to know the actual framebuffer in this configuration, just return an allocation failure here, which should avoid the build warning and the undefined behavior. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202311070802.YCpvehaz-lkp@intel.com/ Fixes: a07b50d80ab6 ("hyperv: avoid dependency on screen_info") Signed-off-by: Arnd Bergmann Signed-off-by: Helge Deller drivers/video/fbdev/hyperv_fb.c | 2 ++ 1 file changed, 2 insertions(+) commit 2e2389ca5d7efd2f029b138d78e38200d5ba125b Author: Uwe Kleine-König Date: Tue Nov 7 10:18:03 2023 +0100 fbdev: omapfb/tpd12s015: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/encoder-tpd12s015.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit a23f29d057d034c77bd6689a5c328a6933255bf4 Author: Uwe Kleine-König Date: Tue Nov 7 10:18:02 2023 +0100 fbdev: omapfb/tfp410: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/encoder-tfp410.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit b0d61e8c04965373b74d719a460153cb700dab80 Author: Uwe Kleine-König Date: Tue Nov 7 10:18:01 2023 +0100 fbdev: omapfb/sharp-ls037v7dw01: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/panel-sharp-ls037v7dw01.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit fe83fc52db06aa0632e53b3b27184e26971b555d Author: Uwe Kleine-König Date: Tue Nov 7 10:18:00 2023 +0100 fbdev: omapfb/opa362: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/encoder-opa362.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 34948a36a4bbf583bf39b5c9783aa9e872c7910d Author: Uwe Kleine-König Date: Tue Nov 7 10:17:59 2023 +0100 fbdev: omapfb/hdmi: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/connector-hdmi.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit ebfb1334cf430ef36059c5bed35e9cfbab23ff11 Author: Uwe Kleine-König Date: Tue Nov 7 10:17:58 2023 +0100 fbdev: omapfb/dvi: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit da21ff3954ed31e04f8280b3ef573484c38e01ad Author: Uwe Kleine-König Date: Tue Nov 7 10:17:57 2023 +0100 fbdev: omapfb/dsi-cm: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit d5d8b9df6b6d72841f827327b37de2b0b7af88f2 Author: Uwe Kleine-König Date: Tue Nov 7 10:17:56 2023 +0100 fbdev: omapfb/dpi: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/panel-dpi.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 26553eb8df2dbfbc075619abd53618efc8c5586a Author: Uwe Kleine-König Date: Tue Nov 7 10:17:55 2023 +0100 fbdev: omapfb/analog-tv: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/connector-analog-tv.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 42a0148ab7f85f4e102630e4cdbb5d336056aedf Author: Uwe Kleine-König Date: Tue Nov 7 10:17:54 2023 +0100 fbdev: atmel_lcdfb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/atmel_lcdfb.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit 3e9ec97706fd8bc06ed41ff85ff168537618879f Author: Uwe Kleine-König Date: Tue Nov 7 10:17:52 2023 +0100 fbdev: omapfb/tpd12s015: Don't put .remove() in .exit.text and drop suppress_bind_attrs On today's platforms the memory savings of putting the remove function in .exit isn't that relevant any more. It only matters for built-in drivers and typically saves a few 100k. The downside is that the driver cannot be unbound at runtime which is ancient and also slightly complicates testing. Also it requires to mark the driver struct with __refdata which is needed to suppress a (W=1) modpost warning: WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/encoder-tpd12s015: section mismatch in reference: tpd_driver+0x4 (section: .data) -> tpd_remove (section: .exit.text) To simplify matters, move the remove callback to .text and drop .suppress_bind_attrs = true. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/encoder-tpd12s015.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 20bcc282d7ccf78bd2dd24a518210baf8763ffaa Author: Uwe Kleine-König Date: Tue Nov 7 10:17:51 2023 +0100 fbdev: omapfb/tfp410: Don't put .remove() in .exit.text and drop suppress_bind_attrs On today's platforms the memory savings of putting the remove function in .exit isn't that relevant any more. It only matters for built-in drivers and typically saves a few 100k. The downside is that the driver cannot be unbound at runtime which is ancient and also slightly complicates testing. Also it requires to mark the driver struct with __refdata which is needed to suppress a (W=1) modpost warning: WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/encoder-tfp410: section mismatch in reference: tfp410_driver+0x4 (section: .data) -> tfp410_remove (section: .exit.text) To simplify matters, move the remove callback to .text and drop .suppress_bind_attrs = true. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/encoder-tfp410.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 6a06fc772fa53a436e50aef44f4163253dbb089f Author: Uwe Kleine-König Date: Tue Nov 7 10:17:50 2023 +0100 fbdev: omapfb/sharp-ls037v7dw01: Don't put .remove() in .exit.text and drop suppress_bind_attrs On today's platforms the memory savings of putting the remove function in .exit isn't that relevant any more. It only matters for built-in drivers and typically saves a few 100k. The downside is that the driver cannot be unbound at runtime which is ancient and also slightly complicates testing. Also it requires to mark the driver struct with __refdata which is needed to suppress a (W=1) modpost warning: WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/panel-sharp-ls037v7dw01: section mismatch in reference: sharp_ls_driver+0x4 (section: .data) -> sharp_ls_remove (section: .exit.text) To simplify matters, move the remove callback to .text and drop .suppress_bind_attrs = true. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/panel-sharp-ls037v7dw01.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 7462e46054c5ce07639aabec5b605d6a481368b1 Author: Uwe Kleine-König Date: Tue Nov 7 10:17:49 2023 +0100 fbdev: omapfb/opa362: Don't put .remove() in .exit.text and drop suppress_bind_attrs On today's platforms the memory savings of putting the remove function in .exit isn't that relevant any more. It only matters for built-in drivers and typically saves a few 100k. The downside is that the driver cannot be unbound at runtime which is ancient and also slightly complicates testing. Also it requires to mark the driver struct with __refdata which is needed to suppress a (W=1) modpost warning: WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/encoder-tfp410: section mismatch in reference: tfp410_driver+0x4 (section: .data) -> tfp410_remove (section: .exit.text) To simplify matters, move the remove callback to .text and drop .suppress_bind_attrs = true. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/encoder-opa362.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 1fc9ea058089f27a5f4c5f04927daed1bb7668d0 Author: Uwe Kleine-König Date: Tue Nov 7 10:17:48 2023 +0100 fbdev: omapfb/hdmi: Don't put .remove() in .exit.text and drop suppress_bind_attrs On today's platforms the memory savings of putting the remove function in .exit isn't that relevant any more. It only matters for built-in drivers and typically saves a few 100k. The downside is that the driver cannot be unbound at runtime which is ancient and also slightly complicates testing. Also it requires to mark the driver struct with __refdata which is needed to suppress a (W=1) modpost warning: WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/connector-hdmi: section mismatch in reference: hdmi_connector_driver+0x4 (section: .data) -> hdmic_remove (section: .exit.text) To simplify matters, move the remove callback to .text and drop .suppress_bind_attrs = true. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/connector-hdmi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit f004d91130595a01203272be12a8764788b68109 Author: Uwe Kleine-König Date: Tue Nov 7 10:17:47 2023 +0100 fbdev: omapfb/dvi: Don't put .remove() in .exit.text and drop suppress_bind_attrs On today's platforms the memory savings of putting the remove function in .exit isn't that relevant any more. It only matters for built-in drivers and typically saves a few 100k. The downside is that the driver cannot be unbound at runtime which is ancient and also slightly complicates testing. Also it requires to mark the driver struct with __refdata which is needed to suppress a (W=1) modpost warning: WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/connector-dvi: section mismatch in reference: dvi_connector_driver+0x4 (section: .data) -> dvic_remove (section: .exit.text) To simplify matters, move the remove callback to .text and drop .suppress_bind_attrs = true. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit b02e6f70f8d87d8cfc8306fcb38120bf58d5e6cb Author: Uwe Kleine-König Date: Tue Nov 7 10:17:46 2023 +0100 fbdev: omapfb/dsi-cm: Don't put .remove() in .exit.text and drop suppress_bind_attrs On today's platforms the memory savings of putting the remove function in .exit isn't that relevant any more. It only matters for built-in drivers and typically saves a few 100k. The downside is that the driver cannot be unbound at runtime which is ancient and also slightly complicates testing. Also it requires to mark the driver struct with __refdata which is needed to suppress a (W=1) modpost warning: WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm: section mismatch in reference: dsicm_driver+0x4 (section: .data) -> dsicm_remove (section: .exit.text) To simplify matters, move the remove callback to .text and drop .suppress_bind_attrs = true. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit bfaee69738bcae5c3dd0aaccae4f55dc381a9b36 Author: Uwe Kleine-König Date: Tue Nov 7 10:17:45 2023 +0100 fbdev: omapfb/dpi: Don't put .remove() in .exit.text and drop suppress_bind_attrs On today's platforms the memory savings of putting the remove function in .exit isn't that relevant any more. It only matters for built-in drivers and typically saves a few 100k. The downside is that the driver cannot be unbound at runtime which is ancient and also slightly complicates testing. Also it requires to mark the driver struct with __refdata which is needed to suppress a (W=1) modpost warning: WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/panel-dpi: section mismatch in reference: panel_dpi_driver+0x4 (section: .data) -> panel_dpi_remove (section: .exit.text) To simplify matters, move the remove callback to .text and drop .suppress_bind_attrs = true. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/panel-dpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 7fbbc0868ca473f9ec97754acb21ae0e4ddb3d89 Author: Uwe Kleine-König Date: Tue Nov 7 10:17:44 2023 +0100 fbdev: omapfb/analog-tv: Don't put .remove() in .exit.text and drop suppress_bind_attrs On today's platforms the memory savings of putting the remove function in .exit isn't that relevant any more. It only matters for built-in drivers and typically saves a few 100k. The downside is that the driver cannot be unbound at runtime which is ancient and also slightly complicates testing. Also it requires to mark the driver struct with __refdata which is needed to suppress a (W=1) modpost warning: WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/connector-analog-tv: section mismatch in reference: tvc_connector_driver+0x4 (section: .data) -> tvc_remove (section: .exit.text) To simplify matters, move the remove callback to .text and drop .suppress_bind_attrs = true. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/displays/connector-analog-tv.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 13c8fb98b7bd3872e75f89c86a2453b0e4a99401 Author: Uwe Kleine-König Date: Tue Nov 7 10:17:43 2023 +0100 fbdev: atmel_lcdfb: Stop using platform_driver_probe() On today's platforms the benefit of platform_driver_probe() isn't that relevant any more. It allows to drop some code after booting (or module loading) for .probe() and discard the .remove() function completely if the driver is built-in. This typically saves a few 100k. The downside of platform_driver_probe() is that the driver cannot be bound and unbound at runtime which is ancient and also slightly complicates testing. There are also thoughts to deprecate platform_driver_probe() because it adds some complexity in the driver core for little gain. Also many drivers don't use it correctly. This driver for example misses to mark the driver struct with __refdata which is needed to suppress a (W=1) modpost warning: WARNING: modpost: drivers/video/fbdev/atmel_lcdfb: section mismatch in reference: atmel_lcdfb_driver+0x4 (section: .data) -> atmel_lcdfb_remove (section: .exit.text) [folded in patch by Nathan Chancellor] Signed-off-by: Uwe Kleine-König Signed-off-by: Nathan Chancellor Signed-off-by: Helge Deller drivers/video/fbdev/atmel_lcdfb.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit 8c74b27f4b30cd896ccf387102410a65b4a35c25 Merge: fe69a1b1b6ed 62ccdb11d3c6 Author: Alexei Starovoitov Date: Thu Nov 9 20:11:20 2023 -0800 Merge branch 'bpf-control-flow-graph-and-precision-backtrack-fixes' Andrii Nakryiko says: ==================== BPF control flow graph and precision backtrack fixes A small fix to BPF verifier's CFG logic around handling and reporting ldimm64 instructions. Patch #1 was previously submitted separately ([0]), and so this patch set supersedes that patch. Second patch is fixing obscure corner case in mark_chain_precise() logic. See patch for details. Patch #3 adds a dedicated test, however fragile it might. [0] https://patchwork.kernel.org/project/netdevbpf/patch/20231101205626.119243-1-andrii@kernel.org/ ==================== Link: https://lore.kernel.org/r/20231110002638.4168352-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit 62ccdb11d3c63dc697dea1fd92b3496fe43dcc1e Author: Andrii Nakryiko Date: Thu Nov 9 16:26:38 2023 -0800 selftests/bpf: add edge case backtracking logic test Add a dedicated selftests to try to set up conditions to have a state with same first and last instruction index, but it actually is a loop 3->4->1->2->3. This confuses mark_chain_precision() if verifier doesn't take into account jump history. Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20231110002638.4168352-4-andrii@kernel.org Signed-off-by: Alexei Starovoitov .../selftests/bpf/progs/verifier_precision.c | 40 ++++++++++++++++++++++ 1 file changed, 40 insertions(+) commit 4bb7ea946a370707315ab774432963ce47291946 Author: Andrii Nakryiko Date: Thu Nov 9 16:26:37 2023 -0800 bpf: fix precision backtracking instruction iteration Fix an edge case in __mark_chain_precision() which prematurely stops backtracking instructions in a state if it happens that state's first and last instruction indexes are the same. This situations doesn't necessarily mean that there were no instructions simulated in a state, but rather that we starting from the instruction, jumped around a bit, and then ended up at the same instruction before checkpointing or marking precision. To distinguish between these two possible situations, we need to consult jump history. If it's empty or contain a single record "bridging" parent state and first instruction of processed state, then we indeed backtracked all instructions in this state. But if history is not empty, we are definitely not done yet. Move this logic inside get_prev_insn_idx() to contain it more nicely. Use -ENOENT return code to denote "we are out of instructions" situation. This bug was exposed by verifier_loop1.c's bounded_recursion subtest, once the next fix in this patch set is applied. Acked-by: Eduard Zingerman Fixes: b5dc0163d8fd ("bpf: precise scalar_value tracking") Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20231110002638.4168352-3-andrii@kernel.org Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) commit 3feb263bb516ee7e1da0acd22b15afbb9a7daa19 Author: Andrii Nakryiko Date: Thu Nov 9 16:26:36 2023 -0800 bpf: handle ldimm64 properly in check_cfg() ldimm64 instructions are 16-byte long, and so have to be handled appropriately in check_cfg(), just like the rest of BPF verifier does. This has implications in three places: - when determining next instruction for non-jump instructions; - when determining next instruction for callback address ldimm64 instructions (in visit_func_call_insn()); - when checking for unreachable instructions, where second half of ldimm64 is expected to be unreachable; We take this also as an opportunity to report jump into the middle of ldimm64. And adjust few test_verifier tests accordingly. Acked-by: Eduard Zingerman Reported-by: Hao Sun Fixes: 475fb78fbf48 ("bpf: verifier (add branch/goto checks)") Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20231110002638.4168352-2-andrii@kernel.org Signed-off-by: Alexei Starovoitov include/linux/bpf.h | 8 ++++++-- kernel/bpf/verifier.c | 27 ++++++++++++++++++------- tools/testing/selftests/bpf/verifier/ld_imm64.c | 8 ++++---- 3 files changed, 30 insertions(+), 13 deletions(-) commit fe69a1b1b6ed9ffc2c578c63f526026a8ab74f0c Author: Anders Roxell Date: Thu Nov 9 18:43:28 2023 +0100 selftests: bpf: xskxceiver: ksft_print_msg: fix format type error Crossbuilding selftests/bpf for architecture arm64, format specifies type error show up like. xskxceiver.c:912:34: error: format specifies type 'int' but the argument has type '__u64' (aka 'unsigned long long') [-Werror,-Wformat] ksft_print_msg("[%s] expected meta_count [%d], got meta_count [%d]\n", ~~ %llu __func__, pkt->pkt_nb, meta->count); ^~~~~~~~~~~ xskxceiver.c:929:55: error: format specifies type 'unsigned long long' but the argument has type 'u64' (aka 'unsigned long') [-Werror,-Wformat] ksft_print_msg("Frag invalid addr: %llx len: %u\n", addr, len); ~~~~ ^~~~ Fixing the issues by casting to (unsigned long long) and changing the specifiers to be %llu from %d and %u, since with u64s it might be %llx or %lx, depending on architecture. Signed-off-by: Anders Roxell Link: https://lore.kernel.org/r/20231109174328.1774571-1-anders.roxell@linaro.org Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/xskxceiver.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) commit 89cdf9d556016a54ff6ddd62324aa5ec790c05cc Merge: 3b2204134381 83b9dda8afa4 Author: Linus Torvalds Date: Thu Nov 9 17:09:35 2023 -0800 Merge tag 'net-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter and bpf. Current release - regressions: - sched: fix SKB_NOT_DROPPED_YET splat under debug config Current release - new code bugs: - tcp: - fix usec timestamps with TCP fastopen - fix possible out-of-bounds reads in tcp_hash_fail() - fix SYN option room calculation for TCP-AO - tcp_sigpool: fix some off by one bugs - bpf: fix compilation error without CGROUPS - ptp: - ptp_read() should not release queue - fix tsevqs corruption Previous releases - regressions: - llc: verify mac len before reading mac header Previous releases - always broken: - bpf: - fix check_stack_write_fixed_off() to correctly spill imm - fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END - check map->usercnt after timer->timer is assigned - dsa: lan9303: consequently nested-lock physical MDIO - dccp/tcp: call security_inet_conn_request() after setting IP addr - tg3: fix the TX ring stall due to incorrect full ring handling - phylink: initialize carrier state at creation - ice: fix direction of VF rules in switchdev mode Misc: - fill in a bunch of missing MODULE_DESCRIPTION()s, more to come" * tag 'net-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (84 commits) net: ti: icss-iep: fix setting counter value ptp: fix corrupted list in ptp_open ptp: ptp_read should not release queue net_sched: sch_fq: better validate TCA_FQ_WEIGHTS and TCA_FQ_PRIOMAP net: kcm: fill in MODULE_DESCRIPTION() net/sched: act_ct: Always fill offloading tuple iifidx netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses netfilter: xt_recent: fix (increase) ipv6 literal buffer length ipvs: add missing module descriptions netfilter: nf_tables: remove catchall element in GC sync path netfilter: add missing module descriptions drivers/net/ppp: use standard array-copy-function net: enetc: shorten enetc_setup_xdp_prog() error message to fit NETLINK_MAX_FMTMSG_LEN virtio/vsock: Fix uninit-value in virtio_transport_recv_pkt() r8169: respect userspace disabling IFF_MULTICAST selftests/bpf: get trusted cgrp from bpf_iter__cgroup directly bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg net: phylink: initialize carrier state at creation test/vsock: add dobule bind connect test test/vsock: refactor vsock_accept ... commit 3b220413438184b352b297e7cf593fa56999b5b3 Merge: a12deb44f973 9aedd10fe384 Author: Linus Torvalds Date: Thu Nov 9 17:04:58 2023 -0800 Merge tag 'v6.7-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This fixes a regression in ahash and hides the Kconfig sub-options for the jitter RNG" * tag 'v6.7-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: ahash - Set using_shash for cloned ahash wrapper over shash crypto: jitterentropy - Hide esoteric Kconfig options under FIPS and EXPERT commit a12deb44f9734dc25970c266249b272e44d3d1b5 Merge: ace92fd98475 cdd5b5a9761f Author: Linus Torvalds Date: Thu Nov 9 14:18:42 2023 -0800 Merge tag 'input-for-v6.7-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - a number of input drivers has been converted to use facilities provided by the device core to instantiate driver-specific attributes instead of using devm_device_add_group() and similar APIs - platform input devices have been converted to use remove() callback returning void - a fix for use-after-free when tearing down a Synaptics RMI device - a few flexible arrays in input structures have been annotated with __counted_by to help hardening efforts - handling of vddio supply in cyttsp5 driver - other miscellaneous fixups * tag 'input-for-v6.7-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (86 commits) Input: walkera0701 - use module_parport_driver macro to simplify the code Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() dt-bindings: input: fsl,scu-key: Document wakeup-source Input: cyttsp5 - add handling for vddio regulator dt-bindings: input: cyttsp5: document vddio-supply Input: tegra-kbc - use device_get_match_data() Input: Annotate struct ff_device with __counted_by Input: axp20x-pek - avoid needless newline removal Input: mt - annotate struct input_mt with __counted_by Input: leds - annotate struct input_leds with __counted_by Input: evdev - annotate struct evdev_client with __counted_by Input: synaptics-rmi4 - replace deprecated strncpy Input: wm97xx-core - convert to platform remove callback returning void Input: wm831x-ts - convert to platform remove callback returning void Input: ti_am335x_tsc - convert to platform remove callback returning void Input: sun4i-ts - convert to platform remove callback returning void Input: stmpe-ts - convert to platform remove callback returning void Input: pcap_ts - convert to platform remove callback returning void Input: mc13783_ts - convert to platform remove callback returning void Input: mainstone-wm97xx - convert to platform remove callback returning void ... commit ace92fd98475c15c860855b53aad3413e28399c8 Merge: 12418ece0d66 bdba49cbba41 Author: Linus Torvalds Date: Thu Nov 9 14:10:38 2023 -0800 Merge tag 'for-6.7-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull more i2c updates from Wolfram Sang: "This contains one patch which slipped through the cracks (iproc), a core sanitizing improvement as the new memdup_array_user() helper went upstream (i2c-dev), and two driver bugfixes (designware, cp2615)" * tag 'for-6.7-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: cp2615: Fix 'assignment to __be16' warning i2c: dev: copy userspace array safely i2c: designware: Disable TX_EMPTY irq while waiting for block length byte i2c: iproc: handle invalid slave state commit 197264284303b30b26e885d83680f594e69840e5 Author: Victor Lu Date: Tue Aug 8 14:28:56 2023 -0400 drm/amdgpu: Change WREG32_RLC to WREG32_SOC15_RLC where inst != 0 (v2) W/RREG32_RLC is hardedcoded to use instance 0. W/RREG32_SOC15_RLC should be used instead when inst != 0. v2: rebase Signed-off-by: Victor Lu Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gc_9_4_3.c | 38 +++++++++----------- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c | 40 ++++++++++------------ drivers/gpu/drm/amd/amdgpu/soc15_common.h | 2 +- 3 files changed, 37 insertions(+), 43 deletions(-) commit 85150626ea0423fd0adb5ac9b5ab4bbaff9aa30b Author: Victor Lu Date: Tue Oct 3 16:15:52 2023 -0400 drm/amdgpu: Use correct KIQ MEC engine for gfx9.4.3 (v5) amdgpu_kiq_wreg/rreg is hardcoded to use MEC engine 0. Add an xcc_id parameter to amdgpu_kiq_wreg/rreg, define W/RREG32_XCC and amdgpu_device_xcc_wreg/rreg to use the new xcc_id parameter. Using amdgpu_sriov_runtime to determine whether to access via kiq or RLC is sufficient for now. v5: add condition in amdgpu_device_xcc_w/rreg, remove trace func call v4: avoid using amdgpu_sriov_w/rreg v3: use W/RREG32_XCC to handle non-kiq case v2: define amdgpu_device_xcc_wreg/rreg instead of changing parameters of amdgpu_device_wreg/rreg Signed-off-by: Victor Lu Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu.h | 13 +++- .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gc_9_4_3.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 89 +++++++++++++++++++++- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 4 + drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 8 +- 9 files changed, 116 insertions(+), 18 deletions(-) commit 76d2da18afde2c78e9fc1fbcc9dc57c27ac77ac5 Author: Yang Wang Date: Tue Nov 7 18:03:45 2023 +0800 drm/amdgpu: add smu v13.0.6 pcs xgmi ras error query support add pcs xgmi ras error query support for smu v13.0.6. Signed-off-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_mca.h | 1 + .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+) commit 4638e0c29a3f2294d5de0d052a4b8c9f33ccb957 Author: Vitaly Prosyak Date: Wed Oct 11 19:31:48 2023 -0400 drm/amdgpu: fix software pci_unplug on some chips When software 'pci unplug' using IGT is executed we got a sysfs directory entry is NULL for differant ras blocks like hdp, umc, etc. Before call 'sysfs_remove_file_from_group' and 'sysfs_remove_group' check that 'sd' is not NULL. [ +0.000001] RIP: 0010:sysfs_remove_group+0x83/0x90 [ +0.000002] Code: 31 c0 31 d2 31 f6 31 ff e9 9a a8 b4 00 4c 89 e7 e8 f2 a2 ff ff eb c2 49 8b 55 00 48 8b 33 48 c7 c7 80 65 94 82 e8 cd 82 bb ff <0f> 0b eb cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 [ +0.000001] RSP: 0018:ffffc90002067c90 EFLAGS: 00010246 [ +0.000002] RAX: 0000000000000000 RBX: ffffffff824ea180 RCX: 0000000000000000 [ +0.000001] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ +0.000001] RBP: ffffc90002067ca8 R08: 0000000000000000 R09: 0000000000000000 [ +0.000001] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ +0.000001] R13: ffff88810a395f48 R14: ffff888101aab0d0 R15: 0000000000000000 [ +0.000001] FS: 00007f5ddaa43a00(0000) GS:ffff88841e800000(0000) knlGS:0000000000000000 [ +0.000002] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000001] CR2: 00007f8ffa61ba50 CR3: 0000000106432000 CR4: 0000000000350ef0 [ +0.000001] Call Trace: [ +0.000001] [ +0.000001] ? show_regs+0x72/0x90 [ +0.000002] ? sysfs_remove_group+0x83/0x90 [ +0.000002] ? __warn+0x8d/0x160 [ +0.000001] ? sysfs_remove_group+0x83/0x90 [ +0.000001] ? report_bug+0x1bb/0x1d0 [ +0.000003] ? handle_bug+0x46/0x90 [ +0.000001] ? exc_invalid_op+0x19/0x80 [ +0.000002] ? asm_exc_invalid_op+0x1b/0x20 [ +0.000003] ? sysfs_remove_group+0x83/0x90 [ +0.000001] dpm_sysfs_remove+0x61/0x70 [ +0.000002] device_del+0xa3/0x3d0 [ +0.000002] ? ktime_get_mono_fast_ns+0x46/0xb0 [ +0.000002] device_unregister+0x18/0x70 [ +0.000001] i2c_del_adapter+0x26d/0x330 [ +0.000002] arcturus_i2c_control_fini+0x25/0x50 [amdgpu] [ +0.000236] smu_sw_fini+0x38/0x260 [amdgpu] [ +0.000241] amdgpu_device_fini_sw+0x116/0x670 [amdgpu] [ +0.000186] ? mutex_lock+0x13/0x50 [ +0.000003] amdgpu_driver_release_kms+0x16/0x40 [amdgpu] [ +0.000192] drm_minor_release+0x4f/0x80 [drm] [ +0.000025] drm_release+0xfe/0x150 [drm] [ +0.000027] __fput+0x9f/0x290 [ +0.000002] ____fput+0xe/0x20 [ +0.000002] task_work_run+0x61/0xa0 [ +0.000002] exit_to_user_mode_prepare+0x150/0x170 [ +0.000002] syscall_exit_to_user_mode+0x2a/0x50 Cc: Hawking Zhang Cc: Luben Tuikov Cc: Alex Deucher Cc: Christian Koenig Signed-off-by: Vitaly Prosyak Reviewed-by: Luben Tuikov Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 36e0d7088555a6a32664635eebe372452027bc6f Author: José Pekkarinen Date: Sun Oct 29 11:39:26 2023 +0200 drm/amd/display: remove duplicated argument Spotted by coccicheck, there is a redundant check for v->SourcePixelFormat[k] != dm_444_16. This patch will remove it. The corresponding output follows. drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c:5130:86-122: duplicated argument to && or || Signed-off-by: José Pekkarinen Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8140b07b0a69a7e8d5d764237c68af7942c4bfdd Author: Yang Wang Date: Wed Nov 8 20:35:52 2023 +0800 drm/amdgpu: correct mca debugfs dump reg list avoid driver to touch invalid mca reg. Signed-off-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit d406aec8dc2a001d4a91f786b525b3b4ea7fa1ef Author: Hawking Zhang Date: Wed Nov 8 17:08:49 2023 +0800 drm/amdgpu: correct acclerator check architecutre dump So driver doesn't touch invalid aca entries. Signed-off-by: Hawking Zhang Reviewed-by: Yang Wang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c | 15 +++++++++++---- drivers/gpu/drm/amd/amdgpu/amdgpu_mca.h | 2 -- 2 files changed, 11 insertions(+), 6 deletions(-) commit 27d80f7d68185a62e101575d302539353622e523 Author: Yang Wang Date: Fri Nov 3 17:00:10 2023 +0800 drm/amdgpu: add pcs xgmi v6.4.0 ras support add pcs xgmi v6.4.0 ras support Signed-off-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c | 158 +++++++++++++++++++++++++++++- drivers/gpu/drm/amd/amdgpu/soc15_common.h | 6 ++ 2 files changed, 161 insertions(+), 3 deletions(-) commit 4abf0b0bdf5ffe7e79e6416cc2c1b7f018b71c79 Author: David Yat Sin Date: Wed Nov 8 02:32:13 2023 +0000 drm/amdgpu: Change extended-scope MTYPE on GC 9.4.3 Change local memory type to MTYPE_UC on revision id 0 Signed-off-by: David Yat Sin Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 7 +++++-- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 8 +++++--- 2 files changed, 10 insertions(+), 5 deletions(-) commit 61e0a98200f49d0b78e17aa2ccd71967cd92f2ab Author: Yang Wang Date: Tue Nov 7 09:34:33 2023 +0800 drm/amdgpu: disable smu v13.0.6 mca debug mode by default disable mca debug mode for smu v13.0.6 by default. Signed-off-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8cc0f5669eb6d4f156c721956da67560c9319317 Author: Hawking Zhang Date: Wed Nov 8 16:07:45 2023 +0800 drm/amdgpu: Support multiple error query modes Direct error query mode and firmware error query mode are supported for now. Signed-off-by: Hawking Zhang Reviewed-by: Yang Wang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 93 +++++++++++++++++++++++++-------- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h | 8 +++ 2 files changed, 78 insertions(+), 23 deletions(-) commit 07c1db70364671eea4e84befe43ac91941153a43 Author: Yang Wang Date: Thu Nov 2 14:17:04 2023 +0800 drm/amdgpu: refine smu v13.0.6 mca dump driver refine smu mca driver to support query ras error from pmfw path. - correct gfx smu bank hwid (from mp5 to smu bank) - retire unused callback function in amdgpu_mca_smu_funcs{} - add new mca_bank_set{} structure to collect mca bank - move enum mca_reg_idx into amdgpu_mca.h header - add mca status register field decode macro Signed-off-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c | 164 +++++++++++- drivers/gpu/drm/amd/amdgpu/amdgpu_mca.h | 61 ++++- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 276 ++++++++------------- 3 files changed, 319 insertions(+), 182 deletions(-) commit 0b1695710ab8be263a5c19f17240c6a44b4b0a3e Author: Victor Lu Date: Wed Oct 11 16:27:59 2023 -0400 drm/amdgpu: Do not program PF-only regs in hdp_v4_0.c under SRIOV (v2) The following regs can only be programmed by the PF: HDP_MISC_CNTL HDP_NONSURFACE_BASE HDP_NONSURFACE_BASE_HI v2: update commit message Signed-off-by: Victor Lu Reviewed-by: Samir Dhume Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/hdp_v4_0.c | 4 ++++ 1 file changed, 4 insertions(+) commit a78b4814697251419f3460bb124aaa5689e65055 Author: Victor Lu Date: Wed Oct 4 15:52:57 2023 -0400 drm/amdgpu: Skip PCTL0_MMHUB_DEEPSLEEP_IB write in jpegv4.0.3 under SRIOV PCTL0_MMHUB_DEEPSLEEP_IB is blocked for VF access Signed-off-by: Victor Lu Reviewed-by: Samir Dhume Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) commit bb619539629cee523df886705d6ef866e099640a Author: Hunter Chasens Date: Tue Nov 7 11:28:30 2023 -0500 drm: amd: Resolve Sphinx unexpected indentation warning Resolves Sphinx unexpected indentation warning when compiling documentation (e.g. `make htmldocs`). Replaces tabs with spaces and adds a literal block to keep vertical formatting of the example power state list. Reviewed-by: Lijo Lazar Reviewed-by: Bagas Sanjaya (v2) Acked-by: Randy Dunlap (v2) Signed-off-by: Hunter Chasens Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/amdgpu_pm.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit bf13da6ae1a0097cf2ff4fba1e3236aaa3fa3a7a Author: Yang Wang Date: Tue Oct 24 14:00:39 2023 +0800 drm/amdgpu: correct smu v13.0.6 umc ras error check correct smu v13.0.0 umc ras error check Signed-off-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/umc_v12_0.c | 4 ++-- drivers/gpu/drm/amd/amdgpu/umc_v12_0.h | 3 +++ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 16 +++++++++++----- 3 files changed, 16 insertions(+), 7 deletions(-) commit bc3c566071c8504f5d7c73a4171ead394f097639 Author: Victor Lu Date: Tue Aug 8 13:57:16 2023 -0400 drm/amdgpu: Add xcc param to SRIOV kiq write and WREG32_SOC15_IP_NO_KIQ (v4) WREG32/RREG32_SOC15_IP_NO_KIQ and amdgpu_virt_kiq_reg_write_reg_wait are not using the correct rlcg interface or mec engine, respectively. Add xcc instance parameter to them. v4: Use GET_INST and squash commit with: "drm/amdgpu: Add xcc_inst param to amdgpu_virt_kiq_reg_write_reg_wait" v3: xcc not needed for MMMHUB v2: rebase Signed-off-by: Victor Lu Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 5 +++-- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 3 ++- drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 26 +++++++++++++++----------- drivers/gpu/drm/amd/amdgpu/soc15_common.h | 6 +++--- 6 files changed, 25 insertions(+), 19 deletions(-) commit f64c3fce460469cd356ccb5c91d0bcbd1b9bc403 Author: Victor Lu Date: Tue Aug 8 15:11:19 2023 -0400 drm/amdgpu: Add flag to enable indirect RLCG access for gfx v9.4.3 The "rlcg_reg_access_supported" flag is missing. Add it back in. Signed-off-by: Victor Lu Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 1 + 1 file changed, 1 insertion(+) commit 5a2913aadabc4711e98fb48d56e5c5f5728bbc33 Author: Le Ma Date: Tue Nov 7 18:10:29 2023 +0800 drm/amd/pm: raise the deep sleep clock threshold for smu 13.0.6 The DS clock may exceed the limit as sclk dfll divider is 16 to target freq. Signed-off-by: Le Ma Reviewed-by: Lijo Lazar Reviewed-by: Yang Wang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4eaa007c739991b08b6343453035e5d1dfe2bd98 Author: Yang Wang Date: Tue Oct 31 10:48:50 2023 +0800 drm/amdgpu: correct amdgpu ip block rev info correct following amdgpu ip block version information: - gfx_v9_4_3 - sdma_v4_4_2 Signed-off-by: Yang Wang Reviewed-by: Kenneth Feng Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 2 +- drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 8abf799ea4d58e7d0522bd6e4bb070be3de3ed62 Author: Lijo Lazar Date: Fri Nov 3 11:24:44 2023 +0530 drm/amd/pm: Hide pp_dpm_pcie device attribute Hide PCIe DPM attribute on SOCs with GC v9.4.2 and GC v9.4.3. Signed-off-by: Lijo Lazar Reviewed-by: Yang Wang Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/amdgpu_pm.c | 4 ++++ 1 file changed, 4 insertions(+) commit 61d7052216214e828b71407172aa85031cf138a9 Author: Tao Zhou Date: Tue Oct 31 11:09:30 2023 +0800 drm/amdgpu: Don't warn for unsupported set_xgmi_plpd_mode set_xgmi_plpd_mode may be unsupported and this isn't error, no need to print warning for it. v2: add ret2 to save the status of psp_ras_trigger_error. Suggested-by: lijo.lazar@amd.com Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) commit 17daf01ab4e3e5a5929747aa05cc15eb2bad5438 Author: Christian König Date: Thu Nov 9 10:14:14 2023 +0100 drm/amdgpu: lower CS errors to debug severity Otherwise userspace can spam the logs by using incorrect input values. Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 12f76050d8d4d10dab96333656b821bd4620d103 Author: Christian König Date: Thu Nov 9 10:12:39 2023 +0100 drm/amdgpu: fix error handling in amdgpu_bo_list_get() We should not leak the pointer where we couldn't grab the reference on to the caller because it can be that the error handling still tries to put the reference then. Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 1 + 1 file changed, 1 insertion(+) commit bff3315ba8b1d81655743136bfc38514e820a739 Author: Alex Deucher Date: Tue Nov 7 14:07:44 2023 -0500 drm/amdgpu: fix AGP init order The default AGP settings were overwriting the IP selected ones since the default was getting set after the IP ones were selected. Fixes: de59b69932e6 ("drm/amdgpu/gmc: set a default disable value for AGP") Link: https://lists.freedesktop.org/archives/amd-gfx/2023-November/100966.html Tested-by: Mikhail Gavrilov Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: Mikhail Gavrilov drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 3 --- drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 1 + drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 1 + drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c | 1 + drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 1 + drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 1 + drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 2 ++ 7 files changed, 7 insertions(+), 3 deletions(-) commit 12418ece0d662ac6e7325eddefed841b25578fa3 Merge: f3bfe6433041 9d08e5909c81 Author: Linus Torvalds Date: Thu Nov 9 13:54:25 2023 -0800 Merge tag 'linux-watchdog-6.7-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - add support for Amlogic C3 and S4 SoCs - add IT8613 ID - add MSM8226 and MSM8974 compatibles - other small fixes and improvements * tag 'linux-watchdog-6.7-rc1' of git://www.linux-watchdog.org/linux-watchdog: (24 commits) dt-bindings: watchdog: Add support for Amlogic C3 and S4 SoCs watchdog: mlx-wdt: Parameter desctiption warning fix watchdog: aspeed: Add support for aspeed,reset-mask DT property dt-bindings: watchdog: aspeed-wdt: Add aspeed,reset-mask property watchdog: apple: Deactivate on suspend dt-bindings: watchdog: qcom-wdt: Add MSM8226 and MSM8974 compatibles dt-bindings: watchdog: fsl-imx7ulp-wdt: Add 'fsl,ext-reset-output' wdog: imx7ulp: Enable wdog int_en bit for watchdog any reset drivers: watchdog: marvell_gti: Program the max_hw_heartbeat_ms drivers: watchdog: marvell_gti: fix zero pretimeout handling watchdog: marvell_gti: Replace of_platform.h with explicit includes watchdog: imx_sc_wdt: continue if the wdog already enabled watchdog: st_lpc: Use device_get_match_data() watchdog: wdat_wdt: Add timeout value as a param in ping method watchdog: gpio_wdt: Make use of device properties sbsa_gwdt: Calculate timeout with 64-bit math watchdog: ixp4xx: Make sure restart always works watchdog: it87_wdt: add IT8613 ID watchdog: marvell_gti_wdt: Fix error code in probe() Watchdog: marvell_gti_wdt: Remove redundant dev_err_probe() for platform_get_irq() ... commit f3bfe643304143ce2727adc893cfa134ba27f968 Merge: 4bbdb725a36b 40592064a1a5 Author: Linus Torvalds Date: Thu Nov 9 13:47:52 2023 -0800 Merge tag 'pwm/for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm updates from Thierry Reding: "This contains a few fixes and a bunch of cleanups, a lot of which is in preparation for Uwe's character device support that may be ready in time for the next merge window" * tag 'pwm/for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: (37 commits) pwm: samsung: Document new member .channel in struct samsung_pwm_chip pwm: bcm2835: Add support for suspend/resume pwm: brcmstb: Checked clk_prepare_enable() return value pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume pwm: pxa: Explicitly include correct DT includes pwm: cros-ec: Simplify using devm_pwmchip_add() and dev_err_probe() pwm: samsung: Consistently use the same name for driver data pwm: vt8500: Simplify using devm functions pwm: sprd: Simplify using devm_pwmchip_add() and dev_err_probe() pwm: sprd: Provide a helper to cast a chip to driver data pwm: spear: Simplify using devm functions pwm: mtk-disp: Simplify using devm_pwmchip_add() pwm: imx-tpm: Simplify using devm functions pwm: brcmstb: Simplify using devm functions pwm: bcm2835: Simplify using devm functions pwm: bcm-iproc: Simplify using devm functions pwm: Adapt sysfs API documentation to reality pwm: dwc: add PWM bit unset in get_state call pwm: dwc: make timer clock configurable pwm: dwc: split pci out of core driver ... commit 4bbdb725a36b0d235f3b832bd0c1e885f0442d9f Merge: 6bc986ab839c e8cca466a84a Author: Linus Torvalds Date: Thu Nov 9 13:37:28 2023 -0800 Merge tag 'iommu-updates-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu updates from Joerg Roedel: "Core changes: - Make default-domains mandatory for all IOMMU drivers - Remove group refcounting - Add generic_single_device_group() helper and consolidate drivers - Cleanup map/unmap ops - Scaling improvements for the IOVA rcache depot - Convert dart & iommufd to the new domain_alloc_paging() ARM-SMMU: - Device-tree binding update: - Add qcom,sm7150-smmu-v2 for Adreno on SM7150 SoC - SMMUv2: - Support for Qualcomm SDM670 (MDSS) and SM7150 SoCs - SMMUv3: - Large refactoring of the context descriptor code to move the CD table into the master, paving the way for '->set_dev_pasid()' support on non-SVA domains - Minor cleanups to the SVA code Intel VT-d: - Enable debugfs to dump domain attached to a pasid - Remove an unnecessary inline function AMD IOMMU: - Initial patches for SVA support (not complete yet) S390 IOMMU: - DMA-API conversion and optimized IOTLB flushing And some smaller fixes and improvements" * tag 'iommu-updates-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (102 commits) iommu/dart: Remove the force_bypass variable iommu/dart: Call apple_dart_finalize_domain() as part of alloc_paging() iommu/dart: Convert to domain_alloc_paging() iommu/dart: Move the blocked domain support to a global static iommu/dart: Use static global identity domains iommufd: Convert to alloc_domain_paging() iommu/vt-d: Use ops->blocked_domain iommu/vt-d: Update the definition of the blocking domain iommu: Move IOMMU_DOMAIN_BLOCKED global statics to ops->blocked_domain Revert "iommu/vt-d: Remove unused function" iommu/amd: Remove DMA_FQ type from domain allocation path iommu: change iommu_map_sgtable to return signed values iommu/virtio: Add __counted_by for struct viommu_request and use struct_size() iommu/vt-d: debugfs: Support dumping a specified page table iommu/vt-d: debugfs: Create/remove debugfs file per {device, pasid} iommu/vt-d: debugfs: Dump entry pointing to huge page iommu/vt-d: Remove unused function iommu/arm-smmu-v3-sva: Remove bond refcount iommu/arm-smmu-v3-sva: Remove unused iommu_sva handle iommu/arm-smmu-v3: Rename cdcfg to cd_table ... commit 5e2fd17f434d2fed78efb123e2fc6711e4f598f1 Author: Paulo Alcantara Date: Thu Nov 9 12:01:48 2023 -0300 smb: client: fix mount when dns_resolver key is not available There was a wrong assumption that with CONFIG_CIFS_DFS_UPCALL=y there would always be a dns_resolver key set up so we could unconditionally upcall to resolve UNC hostname rather than using the value provided by mount(2). Only require it when performing automount of junctions within a DFS share so users that don't have dns_resolver key still can mount their regular shares with server hostname resolved by mount.cifs(8). Fixes: 348a04a8d113 ("smb: client: get rid of dfs code dep in namespace.c") Cc: stable@vger.kernel.org Tested-by: Eduard Bachmakov Reported-by: Eduard Bachmakov Closes: https://lore.kernel.org/all/CADCRUiNvZuiUZ0VGZZO9HRyPyw6x92kiA7o7Q4tsX5FkZqUkKg@mail.gmail.com/ Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/dfs.c | 18 +++++++++++++----- fs/smb/client/fs_context.h | 1 + fs/smb/client/namespace.c | 17 +++++++++++++++-- 3 files changed, 29 insertions(+), 7 deletions(-) commit 457926b253200bd9bdfae9a016a3b1d1dc661d55 Author: Xiao Wang Date: Tue Oct 31 14:45:53 2023 +0800 riscv: Optimize bitops with Zbb extension This patch leverages the alternative mechanism to dynamically optimize bitops (including __ffs, __fls, ffs, fls) with Zbb instructions. When Zbb ext is not supported by the runtime CPU, legacy implementation is used. If Zbb is supported, then the optimized variants will be selected via alternative patching. The legacy bitops support is taken from the generic C implementation as fallback. If the parameter is a build-time constant, we leverage compiler builtin to calculate the result directly, this approach is inspired by x86 bitops implementation. EFI stub runs before the kernel, so alternative mechanism should not be used there, this patch introduces a macro NO_ALTERNATIVE for this purpose. Signed-off-by: Xiao Wang Reviewed-by: Charlie Jenkins Link: https://lore.kernel.org/r/20231031064553.2319688-3-xiao.w.wang@intel.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/bitops.h | 254 +++++++++++++++++++++++++++++++++- drivers/firmware/efi/libstub/Makefile | 2 +- 2 files changed, 252 insertions(+), 4 deletions(-) commit e72c4333d2f2e7f2200f71a88c0480fd2a769a64 Author: Xiao Wang Date: Tue Oct 31 14:45:52 2023 +0800 riscv: Rearrange hwcap.h and cpufeature.h Now hwcap.h and cpufeature.h are mutually including each other, and most of the variable/API declarations in hwcap.h are implemented in cpufeature.c, so, it's better to move them into cpufeature.h and leave only macros for ISA extension logical IDs in hwcap.h. BTW, the riscv_isa_extension_mask macro is not used now, so this patch removes it. Suggested-by: Andrew Jones Signed-off-by: Xiao Wang Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20231031064553.2319688-2-xiao.w.wang@intel.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/cpufeature.h | 83 +++++++++++++++++++++++++++++++++ arch/riscv/include/asm/elf.h | 2 +- arch/riscv/include/asm/hwcap.h | 91 ------------------------------------- arch/riscv/include/asm/pgtable.h | 1 + arch/riscv/include/asm/switch_to.h | 2 +- arch/riscv/include/asm/vector.h | 2 +- arch/riscv/kvm/aia.c | 2 +- arch/riscv/kvm/main.c | 2 +- arch/riscv/kvm/tlb.c | 2 +- arch/riscv/kvm/vcpu_fp.c | 2 +- arch/riscv/kvm/vcpu_onereg.c | 2 +- arch/riscv/kvm/vcpu_vector.c | 2 +- drivers/clocksource/timer-riscv.c | 2 +- drivers/perf/riscv_pmu_sbi.c | 2 +- 14 files changed, 95 insertions(+), 102 deletions(-) commit 8f51593cdcab82fb23ef2e1a0010b2e6f99aae02 Author: Nícolas F. R. A. Prado Date: Tue Nov 7 17:55:28 2023 -0500 dt: dt-extract-compatibles: Don't follow symlinks when walking tree The iglob function, which we use to find C source files in the kernel tree, always follows symbolic links. This can cause unintentional recursions whenever a symbolic link points to a parent directory. A common scenario is building the kernel with the output set to a directory inside the kernel tree, which will contain such a symlink. Instead of using the iglob function, use os.walk to traverse the directory tree, which by default doesn't follow symbolic links. fnmatch is then used to match the glob on the filename, as well as ignore hidden files (which were ignored by default with iglob). This approach runs just as fast as using iglob. Fixes: b6acf8073517 ("dt: Add a check for undocumented compatible strings in kernel") Reported-by: Aishwarya TCV Closes: https://lore.kernel.org/all/e90cb52f-d55b-d3ba-3933-6cc7b43fcfbc@arm.com Signed-off-by: "Nícolas F. R. A. Prado" Link: https://lore.kernel.org/r/20231107225624.9811-1-nfraprado@collabora.com Signed-off-by: Rob Herring scripts/dtc/dt-extract-compatibles | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit f86128050d2d854035bfa461aadf36e6951b2bac Author: Kevin Brodsky Date: Thu Nov 9 14:11:53 2023 +0000 arm64/syscall: Remove duplicate declaration Commit 6ac19f96515e ("arm64: avoid prototype warnings for syscalls") added missing declarations to various syscall wrapper macros. It however proved a little too zealous in __SYSCALL_DEFINEx(), as a declaration for __arm64_sys##name was already present. A declaration is required before the call to ALLOW_ERROR_INJECTION(), so keep the original one and remove the new one. Fixes: 6ac19f96515e ("arm64: avoid prototype warnings for syscalls") Signed-off-by: Kevin Brodsky Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20231109141153.250046-1-kevin.brodsky@arm.com Signed-off-by: Catalin Marinas arch/arm64/include/asm/syscall_wrapper.h | 1 - 1 file changed, 1 deletion(-) commit bce36aa682da7ca996d4a02636ebfb6b5f2c3f83 Author: Uwe Kleine-König Date: Tue Nov 7 16:12:24 2023 +0100 OSS: dmasound/paula: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20231107151223.3971602-2-u.kleine-koenig@pengutronix.de Signed-off-by: Takashi Iwai sound/oss/dmasound/dmasound_paula.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 5923d6686a100c2b4cabd4c2ca9d5a12579c7614 Author: Steve French Date: Tue Nov 7 21:38:13 2023 -0600 smb3: fix caching of ctime on setxattr Fixes xfstest generic/728 which had been failing due to incorrect ctime after setxattr and removexattr Update ctime on successful set of xattr Cc: stable@vger.kernel.org Signed-off-by: Steve French fs/smb/client/xattr.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit f72d96507640835726d4f5ba26c1c11acbe1bc97 Author: Steve French Date: Mon Nov 6 15:37:03 2023 -0600 smb3: minor cleanup of session handling code Minor cleanup of style issues found by checkpatch Reviewed-by: Bharath SM Signed-off-by: Steve French fs/smb/client/sess.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) commit 19a4b9d6c372cab6a3b2c9a061a236136fe95274 Author: Shyam Prasad N Date: Fri Oct 13 11:43:09 2023 +0000 cifs: reconnect work should have reference on server struct The delayed work for reconnect takes server struct as a parameter. But it does so without holding a ref to it. Normally, this may not show a problem as the reconnect work is only cancelled on umount. However, since we now plan to support scaling down of channels, and the scale down can happen from reconnect work itself, we need to fix it. This change takes a reference on the server struct before it is passed to the delayed work. And drops the reference in the delayed work itself. Or if the delayed work is successfully cancelled, by the process that cancels it. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/connect.c | 27 +++++++++++++++++++++------ fs/smb/client/smb2pdu.c | 23 +++++++++++++---------- 2 files changed, 34 insertions(+), 16 deletions(-) commit 9599d59eb8fc0c0fd9480c4f22901533d08965ee Author: Shyam Prasad N Date: Mon Nov 6 16:22:11 2023 +0000 cifs: do not pass cifs_sb when trying to add channels The only reason why cifs_sb gets passed today to cifs_try_adding_channels is to pass the local_nls field for the new channels and binding session. However, the ses struct already has local_nls field that is setup during the first cifs_setup_session. So there is no need to pass cifs_sb. This change removes cifs_sb from the arg list for this and the functions that it calls and uses ses->local_nls instead. Cc: stable@vger.kernel.org Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/cifsproto.h | 2 +- fs/smb/client/connect.c | 2 +- fs/smb/client/sess.c | 12 ++++++------ 3 files changed, 8 insertions(+), 8 deletions(-) commit fa1d0508bdd4a68c5e40f85f635712af8c12f180 Author: Shyam Prasad N Date: Tue Mar 14 11:14:58 2023 +0000 cifs: account for primary channel in the interface list The refcounting of server interfaces should account for the primary channel too. Although this is not strictly necessary, doing so will account for the primary channel in DebugData. Cc: stable@vger.kernel.org Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/sess.c | 28 ++++++++++++++++++++++++++++ fs/smb/client/smb2ops.c | 6 ++++++ 2 files changed, 34 insertions(+) commit a6d8fb54a515f0546ffdb7870102b1238917e567 Author: Shyam Prasad N Date: Mon Dec 26 11:24:56 2022 +0000 cifs: distribute channels across interfaces based on speed Today, if the server interfaces RSS capable, we simply choose the fastest interface to setup a channel. This is not a scalable approach, and does not make a lot of attempt to distribute the connections. This change does a weighted distribution of channels across all the available server interfaces, where the weight is a function of the advertised interface speed. Also make sure that we don't mix rdma and non-rdma for channels. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/cifs_debug.c | 16 +++++++++ fs/smb/client/cifsglob.h | 2 ++ fs/smb/client/sess.c | 84 ++++++++++++++++++++++++++++++++++++++-------- 3 files changed, 88 insertions(+), 14 deletions(-) commit 0c51cc6f2cb0108e7d49805f6e089cd85caab279 Author: Shyam Prasad N Date: Fri Oct 13 09:25:30 2023 +0000 cifs: handle cases where a channel is closed So far, SMB multichannel could only scale up, but not scale down the number of channels. In this series of patch, we now allow the client to deal with the case of multichannel disabled on the server when the share is mounted. With that change, we now need the ability to scale down the channels. This change allows the client to deal with cases of missing channels more gracefully. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/cifs_debug.c | 5 +++++ fs/smb/client/cifsglob.h | 1 + fs/smb/client/cifsproto.h | 2 +- fs/smb/client/connect.c | 6 +++++- fs/smb/client/sess.c | 28 ++++++++++++++++++++++++---- fs/smb/client/smb2transport.c | 8 +++++++- 6 files changed, 43 insertions(+), 7 deletions(-) commit 1bc081b67a79b6e75fae686e98048cea1038ae31 Author: Steve French Date: Mon Nov 6 22:40:38 2023 -0600 smb3: more minor cleanups for session handling routines Some trivial cleanup pointed out by checkpatch Reviewed-by: Bharath SM Signed-off-by: Steve French fs/smb/client/sess.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) commit 43960dc2328e554c4c61b22c47e77e8b1c48d854 Author: Steve French Date: Mon Nov 6 13:31:45 2023 -0600 smb3: minor RDMA cleanup Some minor smbdirect debug cleanup spotted by checkpatch Cc: Long Li Reviewed-by: Bharath SM Signed-off-by: Steve French fs/smb/client/cifs_debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6ae90e906aed727759b88eb2b000fcdc8fcd94a3 Author: Vitalii Torshyn Date: Thu Nov 9 01:13:54 2023 +0200 ALSA: hda: ASUS UM5302LA: Added quirks for cs35L41/10431A83 on i2c bus Proposed patch fixes initialization of CSC3551 on the UM5302LA laptop. Patching DSDT table is not required since ASUS did added _DSD entry. Nothing new introduced but reused work started by Stefan B. Currently there is no official firmware available for 10431A83 on cirrus git unfortunately. For testing used 104317f3 (which is also seems on i2c bus): $ cd /lib/firmware/cirrus/ && \ for fw in $(find ./ -name '*104317f3*'); do newfw=$(echo $fw | sed 's/104317f3/10431a83/g'); echo echo "$fw -> $newfw"; ln -s $f $newfw; done With the patch applied to 6.6.0 and obviously symlinks to 104317F3 FW, speakers works and to my susrprise they sound quite good and loud without distortion. Probably confirmation from cirrus team is needed on firmware. Signed-off-by: Vitalii Torshyn Link: https://bugzilla.kernel.org/show_bug.cgi?id=218119 Link: https://lore.kernel.org/r/CAHiQ-bCMPpCJ8eOYAaVVoqGkFixS1qTgSS4xfbZvL4oZV9LYew@mail.gmail.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 6 ++++++ 1 file changed, 6 insertions(+) commit c7a60651953359f98dbf24b43e1bf561e1573ed4 Author: Takashi Iwai Date: Thu Nov 9 15:19:54 2023 +0100 ALSA: info: Fix potential deadlock at disconnection As reported recently, ALSA core info helper may cause a deadlock at the forced device disconnection during the procfs operation. The proc_remove() (that is called from the snd_card_disconnect() helper) has a synchronization of the pending procfs accesses via wait_for_completion(). Meanwhile, ALSA procfs helper takes the global mutex_lock(&info_mutex) at both the proc_open callback and snd_card_info_disconnect() helper. Since the proc_open can't finish due to the mutex lock, wait_for_completion() never returns, either, hence it deadlocks. TASK#1 TASK#2 proc_reg_open() takes use_pde() snd_info_text_entry_open() snd_card_disconnect() snd_info_card_disconnect() takes mutex_lock(&info_mutex) proc_remove() wait_for_completion(unused_pde) ... waiting task#1 closes mutex_lock(&info_mutex) => DEADLOCK This patch is a workaround for avoiding the deadlock scenario above. The basic strategy is to move proc_remove() call outside the mutex lock. proc_remove() can work gracefully without extra locking, and it can delete the tree recursively alone. So, we call proc_remove() at snd_info_card_disconnection() at first, then delete the rest resources recursively within the info_mutex lock. After the change, the function snd_info_disconnect() doesn't do disconnection by itself any longer, but it merely clears the procfs pointer. So rename the function to snd_info_clear_entries() for avoiding confusion. The similar change is applied to snd_info_free_entry(), too. Since the proc_remove() is called only conditionally with the non-NULL entry->p, it's skipped after the snd_info_clear_entries() call. Reported-by: Shinhyung Kang Closes: https://lore.kernel.org/r/664457955.21699345385931.JavaMail.epsvc@epcpadp4 Reviewed-by: Jaroslav Kysela Cc: Link: https://lore.kernel.org/r/20231109141954.4283-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/core/info.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) commit 68444b93ed6c622f77745ea25f8db05cd0afb1b6 Merge: c6e316ac0553 61e3d993c8bd Author: Palmer Dabbelt Date: Thu Nov 9 06:44:13 2023 -0800 Merge patch "drivers: perf: Do not broadcast to other cpus when starting a counter" This is really just a single patch, but since the offending fix hasn't yet made it to my for-next I'm merging it here. Signed-off-by: Palmer Dabbelt commit 61e3d993c8bd3e80f8f1363ed5e04f88ab531b72 Author: Alexandre Ghiti Date: Thu Oct 26 10:40:10 2023 +0200 drivers: perf: Do not broadcast to other cpus when starting a counter This command: $ perf record -e cycles:k -e instructions:k -c 10000 -m 64M dd if=/dev/zero of=/dev/null count=1000 gives rise to this kernel warning: [ 444.364395] WARNING: CPU: 0 PID: 104 at kernel/smp.c:775 smp_call_function_many_cond+0x42c/0x436 [ 444.364515] Modules linked in: [ 444.364657] CPU: 0 PID: 104 Comm: perf-exec Not tainted 6.6.0-rc6-00051-g391df82e8ec3-dirty #73 [ 444.364771] Hardware name: riscv-virtio,qemu (DT) [ 444.364868] epc : smp_call_function_many_cond+0x42c/0x436 [ 444.364917] ra : on_each_cpu_cond_mask+0x20/0x32 [ 444.364948] epc : ffffffff8009f9e0 ra : ffffffff8009fa5a sp : ff20000000003800 [ 444.364966] gp : ffffffff81500aa0 tp : ff60000002b83000 t0 : ff200000000038c0 [ 444.364982] t1 : ffffffff815021f0 t2 : 000000000000001f s0 : ff200000000038b0 [ 444.364998] s1 : ff60000002c54d98 a0 : ff60000002a73940 a1 : 0000000000000000 [ 444.365013] a2 : 0000000000000000 a3 : 0000000000000003 a4 : 0000000000000100 [ 444.365029] a5 : 0000000000010100 a6 : 0000000000f00000 a7 : 0000000000000000 [ 444.365044] s2 : 0000000000000000 s3 : ffffffffffffffff s4 : ff60000002c54d98 [ 444.365060] s5 : ffffffff81539610 s6 : ffffffff80c20c48 s7 : 0000000000000000 [ 444.365075] s8 : 0000000000000000 s9 : 0000000000000001 s10: 0000000000000001 [ 444.365090] s11: ffffffff80099394 t3 : 0000000000000003 t4 : 00000000eac0c6e6 [ 444.365104] t5 : 0000000400000000 t6 : ff60000002e010d0 [ 444.365120] status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000003 [ 444.365226] [] smp_call_function_many_cond+0x42c/0x436 [ 444.365295] [] on_each_cpu_cond_mask+0x20/0x32 [ 444.365311] [] pmu_sbi_ctr_start+0x7a/0xaa [ 444.365327] [] riscv_pmu_start+0x48/0x66 [ 444.365339] [] perf_adjust_freq_unthr_context+0x196/0x1ac [ 444.365356] [] perf_event_task_tick+0x78/0x8c [ 444.365368] [] scheduler_tick+0xe6/0x25e [ 444.365383] [] update_process_times+0x80/0x96 [ 444.365398] [] tick_sched_handle+0x26/0x52 [ 444.365410] [] tick_sched_timer+0x50/0x98 [ 444.365422] [] __hrtimer_run_queues+0x126/0x18a [ 444.365433] [] hrtimer_interrupt+0xce/0x1da [ 444.365444] [] riscv_timer_interrupt+0x30/0x3a [ 444.365457] [] handle_percpu_devid_irq+0x80/0x114 [ 444.365470] [] generic_handle_domain_irq+0x1c/0x2a [ 444.365483] [] riscv_intc_irq+0x2e/0x46 [ 444.365497] [] handle_riscv_irq+0x4a/0x74 [ 444.365521] [] do_irq+0x7c/0x7e [ 444.365796] ---[ end trace 0000000000000000 ]--- That's because the fix in commit 3fec323339a4 ("drivers: perf: Fix panic in riscv SBI mmap support") was wrong since there is no need to broadcast to other cpus when starting a counter, that's only needed in mmap when the counters could have already been started on other cpus, so simply remove this broadcast. Fixes: 3fec323339a4 ("drivers: perf: Fix panic in riscv SBI mmap support") Signed-off-by: Alexandre Ghiti Tested-by: Clément Léger Tested-by: Yu Chien Peter Lin Tested-by: Lad Prabhakar #On Link: https://lore.kernel.org/r/20231026084010.11888-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt drivers/perf/riscv_pmu_sbi.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit c6e316ac05532febb0c966fa9b55f5258ed037be Author: Alexandre Ghiti Date: Thu Nov 9 09:21:28 2023 +0100 drivers: perf: Check find_first_bit() return value We must check the return value of find_first_bit() before using the return value as an index array since it happens to overflow the array and then panic: [ 107.318430] Kernel BUG [#1] [ 107.319434] CPU: 3 PID: 1238 Comm: kill Tainted: G E 6.6.0-rc6ubuntu-defconfig #2 [ 107.319465] Hardware name: riscv-virtio,qemu (DT) [ 107.319551] epc : pmu_sbi_ovf_handler+0x3a4/0x3ae [ 107.319840] ra : pmu_sbi_ovf_handler+0x52/0x3ae [ 107.319868] epc : ffffffff80a0a77c ra : ffffffff80a0a42a sp : ffffaf83fecda350 [ 107.319884] gp : ffffffff823961a8 tp : ffffaf8083db1dc0 t0 : ffffaf83fecda480 [ 107.319899] t1 : ffffffff80cafe62 t2 : 000000000000ff00 s0 : ffffaf83fecda520 [ 107.319921] s1 : ffffaf83fecda380 a0 : 00000018fca29df0 a1 : ffffffffffffffff [ 107.319936] a2 : 0000000001073734 a3 : 0000000000000004 a4 : 0000000000000000 [ 107.319951] a5 : 0000000000000040 a6 : 000000001d1c8774 a7 : 0000000000504d55 [ 107.319965] s2 : ffffffff82451f10 s3 : ffffffff82724e70 s4 : 000000000000003f [ 107.319980] s5 : 0000000000000011 s6 : ffffaf8083db27c0 s7 : 0000000000000000 [ 107.319995] s8 : 0000000000000001 s9 : 00007fffb45d6558 s10: 00007fffb45d81a0 [ 107.320009] s11: ffffaf7ffff60000 t3 : 0000000000000004 t4 : 0000000000000000 [ 107.320023] t5 : ffffaf7f80000000 t6 : ffffaf8000000000 [ 107.320037] status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000003 [ 107.320081] [] pmu_sbi_ovf_handler+0x3a4/0x3ae [ 107.320112] [] handle_percpu_devid_irq+0x9e/0x1a0 [ 107.320131] [] generic_handle_domain_irq+0x28/0x36 [ 107.320148] [] riscv_intc_irq+0x36/0x4e [ 107.320166] [] handle_riscv_irq+0x54/0x86 [ 107.320189] [] do_irq+0x64/0x96 [ 107.320271] Code: 85a6 855e b097 ff7f 80e7 9220 b709 9002 4501 bbd9 (9002) 6097 [ 107.320585] ---[ end trace 0000000000000000 ]--- [ 107.320704] Kernel panic - not syncing: Fatal exception in interrupt [ 107.320775] SMP: stopping secondary CPUs [ 107.321219] Kernel Offset: 0x0 from 0xffffffff80000000 [ 107.333051] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- Fixes: 4905ec2fb7e6 ("RISC-V: Add sscofpmf extension support") Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20231109082128.40777-1-alexghiti@rivosinc.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt drivers/perf/riscv_pmu_sbi.c | 5 +++++ 1 file changed, 5 insertions(+) commit ec9aedb2aa1ab7ac420c00b31f5edc5be15ec167 Author: Zhang Rui Date: Mon Jul 3 00:28:02 2023 +0800 x86/acpi: Ignore invalid x2APIC entries Currently, the kernel enumerates the possible CPUs by parsing both ACPI MADT Local APIC entries and x2APIC entries. So CPUs with "valid" APIC IDs, even if they have duplicated APIC IDs in Local APIC and x2APIC, are always enumerated. Below is what ACPI MADT Local APIC and x2APIC describes on an Ivebridge-EP system, [02Ch 0044 1] Subtable Type : 00 [Processor Local APIC] [02Fh 0047 1] Local Apic ID : 00 ... [164h 0356 1] Subtable Type : 00 [Processor Local APIC] [167h 0359 1] Local Apic ID : 39 [16Ch 0364 1] Subtable Type : 00 [Processor Local APIC] [16Fh 0367 1] Local Apic ID : FF ... [3ECh 1004 1] Subtable Type : 09 [Processor Local x2APIC] [3F0h 1008 4] Processor x2Apic ID : 00000000 ... [B5Ch 2908 1] Subtable Type : 09 [Processor Local x2APIC] [B60h 2912 4] Processor x2Apic ID : 00000077 As a result, kernel shows "smpboot: Allowing 168 CPUs, 120 hotplug CPUs". And this wastes significant amount of memory for the per-cpu data. Plus this also breaks https://lore.kernel.org/all/87edm36qqb.ffs@tglx/, because __max_logical_packages is over-estimated by the APIC IDs in the x2APIC entries. According to https://uefi.org/specs/ACPI/6.5/05_ACPI_Software_Programming_Model.html#processor-local-x2apic-structure: "[Compatibility note] On some legacy OSes, Logical processors with APIC ID values less than 255 (whether in XAPIC or X2APIC mode) must use the Processor Local APIC structure to convey their APIC information to OSPM, and those processors must be declared in the DSDT using the Processor() keyword. Logical processors with APIC ID values 255 and greater must use the Processor Local x2APIC structure and be declared using the Device() keyword." Therefore prevent the registration of x2APIC entries with an APIC ID less than 255 if the local APIC table enumerates valid APIC IDs. [ tglx: Simplify the logic ] Signed-off-by: Zhang Rui Signed-off-by: Thomas Gleixner Tested-by: Peter Zijlstra Link: https://lore.kernel.org/r/20230702162802.344176-1-rui.zhang@intel.com arch/x86/kernel/acpi/boot.c | 34 +++++++++++++++------------------- 1 file changed, 15 insertions(+), 19 deletions(-) commit d3933152442b7f94419e9ea71835d71b620baf0e Author: Boris Burkov Date: Fri Nov 3 11:38:04 2023 -0700 btrfs: make OWNER_REF_KEY type value smallest among inline refs BTRFS_EXTENT_OWNER_REF_KEY is the type of simple quotas extent owner refs. This special inline ref goes in front of all other inline refs. In general, inline refs have a required sorted order s.t. type never decreases (among other requirements). This was recently reified into a tree-checker and fsck rule, which broke simple quotas. To be fair, though, in a sense, the new owner ref item had also violated that not yet fully enforced requirement. This fix brings the owner ref item into compliance with the requirement that inline ref type never decrease. btrfs/301 exercises this behavior and should pass again with this fix. Fixes: d9a620f77e33 ("btrfs: new inline ref storing owning subvol of data extents") Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba include/uapi/linux/btrfs_tree.h | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) commit 609d99379736aa6c5b0658654084198aa808035a Author: Filipe Manana Date: Mon Nov 6 20:17:37 2023 +0000 btrfs: fix qgroup record leaks when using simple quotas When using simple quotas we are not supposed to allocate qgroup records when adding delayed references. However we allocate them if either mode of quotas is enabled (the new simple one or the old one), but then we never free them because running the accounting, which frees the records, is only run when using the old quotas (at btrfs_qgroup_account_extents()), resulting in a memory leak of the records allocated when adding delayed references. Fix this by allocating the records only if the old quotas mode is enabled. Also fix btrfs_qgroup_trace_extent_nolock() to return 1 if the old quotas mode is not enabled - meaning the caller has to free the record. Fixes: 182940f4f4db ("btrfs: qgroup: add new quota mode for simple quotas") Reported-by: syzbot+d3ddc6dcc6386dea398b@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/00000000000004769106097f9a34@google.com/ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/delayed-ref.c | 4 ++-- fs/btrfs/qgroup.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) commit 6c8e69e4a702b072206f166111c003d704de15d9 Author: Filipe Manana Date: Fri Nov 3 12:26:25 2023 +0000 btrfs: fix race between accounting qgroup extents and removing a qgroup When doing qgroup accounting for an extent, we take the spinlock fs_info->qgroup_lock and then add qgroups to the local list (iterator) named "qgroups". These qgroups are found in the fs_info->qgroup_tree rbtree. After we're done, we unlock fs_info->qgroup_lock and then call qgroup_iterator_nested_clean(), which will iterate over all the qgroups added to the local list "qgroups" and then delete them from the list. Deleting a qgroup from the list can however result in a use-after-free if a qgroup remove operation happens after we unlock fs_info->qgroup_lock and before or while we are at qgroup_iterator_nested_clean(). Fix this by calling qgroup_iterator_nested_clean() while still holding the lock fs_info->qgroup_lock - we don't need it under the 'out' label since before taking the lock the "qgroups" list is always empty. This guarantees safety because btrfs_remove_qgroup() takes that lock before removing a qgroup from the rbtree fs_info->qgroup_tree. This was reported by syzbot with the following stack traces: BUG: KASAN: slab-use-after-free in __list_del_entry_valid_or_report+0x2f/0x130 lib/list_debug.c:49 Read of size 8 at addr ffff888027e420b0 by task kworker/u4:3/48 CPU: 1 PID: 48 Comm: kworker/u4:3 Not tainted 6.6.0-syzkaller-10396-g4652b8e4f3ff #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 Workqueue: btrfs-qgroup-rescan btrfs_work_helper Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0x163/0x540 mm/kasan/report.c:475 kasan_report+0x175/0x1b0 mm/kasan/report.c:588 __list_del_entry_valid_or_report+0x2f/0x130 lib/list_debug.c:49 __list_del_entry_valid include/linux/list.h:124 [inline] __list_del_entry include/linux/list.h:215 [inline] list_del_init include/linux/list.h:287 [inline] qgroup_iterator_nested_clean fs/btrfs/qgroup.c:2623 [inline] btrfs_qgroup_account_extent+0x18b/0x1150 fs/btrfs/qgroup.c:2883 qgroup_rescan_leaf fs/btrfs/qgroup.c:3543 [inline] btrfs_qgroup_rescan_worker+0x1078/0x1c60 fs/btrfs/qgroup.c:3604 btrfs_work_helper+0x37c/0xbd0 fs/btrfs/async-thread.c:315 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0x90f/0x1400 kernel/workqueue.c:2703 worker_thread+0xa5f/0xff0 kernel/workqueue.c:2784 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 Allocated by task 6355: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4f/0x70 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:383 kmalloc include/linux/slab.h:600 [inline] kzalloc include/linux/slab.h:721 [inline] btrfs_quota_enable+0xee9/0x2060 fs/btrfs/qgroup.c:1209 btrfs_ioctl_quota_ctl+0x143/0x190 fs/btrfs/ioctl.c:3705 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xf8/0x170 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Freed by task 6355: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4f/0x70 mm/kasan/common.c:52 kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522 ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1800 [inline] slab_free_freelist_hook mm/slub.c:1826 [inline] slab_free mm/slub.c:3809 [inline] __kmem_cache_free+0x263/0x3a0 mm/slub.c:3822 btrfs_remove_qgroup+0x764/0x8c0 fs/btrfs/qgroup.c:1787 btrfs_ioctl_qgroup_create+0x185/0x1e0 fs/btrfs/ioctl.c:3811 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xf8/0x170 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:45 __kasan_record_aux_stack+0xad/0xc0 mm/kasan/generic.c:492 __call_rcu_common kernel/rcu/tree.c:2667 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:2781 kthread_worker_fn+0x4ba/0xa90 kernel/kthread.c:823 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 Second to last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:45 __kasan_record_aux_stack+0xad/0xc0 mm/kasan/generic.c:492 __call_rcu_common kernel/rcu/tree.c:2667 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:2781 kthread_worker_fn+0x4ba/0xa90 kernel/kthread.c:823 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 The buggy address belongs to the object at ffff888027e42000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 176 bytes inside of freed 512-byte region [ffff888027e42000, ffff888027e42200) The buggy address belongs to the physical page: page:ffffea00009f9000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x27e40 head:ffffea00009f9000 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000840 ffff888012c41c80 ffffea0000a5ba00 dead000000000002 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4514, tgid 4514 (udevadm), ts 24598439480, free_ts 23755696267 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1e6/0x210 mm/page_alloc.c:1536 prep_new_page mm/page_alloc.c:1543 [inline] get_page_from_freelist+0x31db/0x3360 mm/page_alloc.c:3170 __alloc_pages+0x255/0x670 mm/page_alloc.c:4426 alloc_slab_page+0x6a/0x160 mm/slub.c:1870 allocate_slab mm/slub.c:2017 [inline] new_slab+0x84/0x2f0 mm/slub.c:2070 ___slab_alloc+0xc85/0x1310 mm/slub.c:3223 __slab_alloc mm/slub.c:3322 [inline] __slab_alloc_node mm/slub.c:3375 [inline] slab_alloc_node mm/slub.c:3468 [inline] __kmem_cache_alloc_node+0x19d/0x270 mm/slub.c:3517 kmalloc_trace+0x2a/0xe0 mm/slab_common.c:1098 kmalloc include/linux/slab.h:600 [inline] kzalloc include/linux/slab.h:721 [inline] kernfs_fop_open+0x3e7/0xcc0 fs/kernfs/file.c:670 do_dentry_open+0x8fd/0x1590 fs/open.c:948 do_open fs/namei.c:3622 [inline] path_openat+0x2845/0x3280 fs/namei.c:3779 do_filp_open+0x234/0x490 fs/namei.c:3809 do_sys_openat2+0x13e/0x1d0 fs/open.c:1440 do_sys_open fs/open.c:1455 [inline] __do_sys_openat fs/open.c:1471 [inline] __se_sys_openat fs/open.c:1466 [inline] __x64_sys_openat+0x247/0x290 fs/open.c:1466 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1136 [inline] free_unref_page_prepare+0x8c3/0x9f0 mm/page_alloc.c:2312 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2405 discard_slab mm/slub.c:2116 [inline] __unfreeze_partials+0x1dc/0x220 mm/slub.c:2655 put_cpu_partial+0x17b/0x250 mm/slub.c:2731 __slab_free+0x2b6/0x390 mm/slub.c:3679 qlink_free mm/kasan/quarantine.c:166 [inline] qlist_free_all+0x75/0xe0 mm/kasan/quarantine.c:185 kasan_quarantine_reduce+0x14b/0x160 mm/kasan/quarantine.c:292 __kasan_slab_alloc+0x23/0x70 mm/kasan/common.c:305 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook+0x67/0x3d0 mm/slab.h:762 slab_alloc_node mm/slub.c:3478 [inline] slab_alloc mm/slub.c:3486 [inline] __kmem_cache_alloc_lru mm/slub.c:3493 [inline] kmem_cache_alloc+0x104/0x2c0 mm/slub.c:3502 getname_flags+0xbc/0x4f0 fs/namei.c:140 do_sys_openat2+0xd2/0x1d0 fs/open.c:1434 do_sys_open fs/open.c:1455 [inline] __do_sys_openat fs/open.c:1471 [inline] __se_sys_openat fs/open.c:1466 [inline] __x64_sys_openat+0x247/0x290 fs/open.c:1466 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Memory state around the buggy address: ffff888027e41f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888027e42000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888027e42080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888027e42100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888027e42180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Reported-by: syzbot+e0b615318f8fcfc01ceb@syzkaller.appspotmail.com Fixes: dce28769a33a ("btrfs: qgroup: use qgroup_iterator_nested to in qgroup_update_refcnt()") CC: stable@vger.kernel.org # 6.6 Link: https://lore.kernel.org/linux-btrfs/00000000000091a5b2060936bf6d@google.com/ Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/qgroup.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 83b9dda8afa4e968d9cce253f390b01c0612a2a5 Author: Diogo Ivo Date: Tue Nov 7 12:00:36 2023 +0000 net: ti: icss-iep: fix setting counter value Currently icss_iep_set_counter() writes the upper 32-bits of the counter value to both the lower and upper counter registers, so fix this by writing the appropriate value to the lower register. Fixes: c1e0230eeaab ("net: ti: icss-iep: Add IEP driver") Signed-off-by: Diogo Ivo Link: https://lore.kernel.org/r/20231107120037.1513546-1-diogo.ivo@siemens.com Signed-off-by: Paolo Abeni drivers/net/ethernet/ti/icssg/icss_iep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3e3ab468ebdfd79fb2c80f381b70b3815801988e Merge: 53b5fdb61785 a60a609b7f54 Author: Takashi Iwai Date: Thu Nov 9 12:37:03 2023 +0100 Merge tag 'asoc-fix-v6.7-merge-window-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: One more fix for the merge window One additional driver fix that came in during the merge window. commit f9a619eb603b6c8062e910cd994acc4b3ce032ba Merge: 05942f780ac6 c5e4ce9db635 Author: Palmer Dabbelt Date: Wed Nov 8 18:57:17 2023 -0800 Merge patch series "Linux RISC-V AIA Preparatory Series" These two ended up in the AIA series, but they're really independent improvements. * b4-shazam-merge: of: property: Add fw_devlink support for msi-parent RISC-V: Don't fail in riscv_of_parent_hartid() for disabled HARTs Link: https://lore.kernel.org/r/20231027154254.355853-1-apatel@ventanamicro.com Signed-off-by: Palmer Dabbelt commit c5e4ce9db635fef5ebffdfba1e7d80710474b176 Author: Anup Patel Date: Fri Oct 27 21:12:54 2023 +0530 of: property: Add fw_devlink support for msi-parent This allows fw_devlink to create device links between consumers of a MSI and the supplier of the MSI. Signed-off-by: Anup Patel Acked-by: Rob Herring Reviewed-by: Saravana Kannan Link: https://lore.kernel.org/r/20231027154254.355853-3-apatel@ventanamicro.com Signed-off-by: Palmer Dabbelt drivers/of/property.c | 2 ++ 1 file changed, 2 insertions(+) commit c4676f8dc1e12e68d6511f9ed89707fdad4c962c Author: Anup Patel Date: Fri Oct 27 21:12:53 2023 +0530 RISC-V: Don't fail in riscv_of_parent_hartid() for disabled HARTs The riscv_of_processor_hartid() used by riscv_of_parent_hartid() fails for HARTs disabled in the DT. This results in the following warning thrown by the RISC-V INTC driver for the E-core on SiFive boards: [ 0.000000] riscv-intc: unable to find hart id for /cpus/cpu@0/interrupt-controller The riscv_of_parent_hartid() is only expected to read the hartid from the DT so we directly call of_get_cpu_hwid() instead of calling riscv_of_processor_hartid(). Fixes: ad635e723e17 ("riscv: cpu: Add 64bit hartid support on RV64") Signed-off-by: Anup Patel Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20231027154254.355853-2-apatel@ventanamicro.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/cpu.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit e439e4a62a8ea3c39d65c546de3af7d1c594077c Author: Neil Armstrong Date: Mon Oct 30 10:43:11 2023 +0100 scsi: ufs: qcom-ufs: dt-bindings: Document the SM8650 UFS Controller Document the UFS Controller on the SM8650 Platform. Reviewed-by: Alim Akhtar Reviewed-by: Manivannan Sadhasivam Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20231030-topic-sm8650-upstream-bindings-ufs-v3-1-a96364463fd5@linaro.org Reviewed-by: Krzysztof Kozlowski Signed-off-by: Martin K. Petersen Documentation/devicetree/bindings/ufs/qcom,ufs.yaml | 2 ++ 1 file changed, 2 insertions(+) commit 1bea2c3e6df8caf45d18384abfb707f47e9ff993 Author: Edward Adam Davis Date: Tue Nov 7 16:00:41 2023 +0800 ptp: fix corrupted list in ptp_open There is no lock protection when writing ptp->tsevqs in ptp_open() and ptp_release(), which can cause data corruption, use spin lock to avoid this issue. Moreover, ptp_release() should not be used to release the queue in ptp_read(), and it should be deleted altogether. Acked-by: Richard Cochran Reported-and-tested-by: syzbot+df3f3ef31f60781fa911@syzkaller.appspotmail.com Fixes: 8f5de6fb2453 ("ptp: support multiple timestamp event readers") Signed-off-by: Edward Adam Davis Link: https://lore.kernel.org/r/tencent_CD19564FFE8DA8A5918DFE92325D92DD8107@qq.com Signed-off-by: Jakub Kicinski drivers/ptp/ptp_chardev.c | 21 ++++++++++++--------- drivers/ptp/ptp_clock.c | 8 ++++++-- drivers/ptp/ptp_private.h | 1 + 3 files changed, 19 insertions(+), 11 deletions(-) commit b714ca2ccf6a90733f6ceb14abb6ce914f8832c3 Author: Edward Adam Davis Date: Tue Nov 7 16:00:40 2023 +0800 ptp: ptp_read should not release queue Firstly, queue is not the memory allocated in ptp_read; Secondly, other processes may block at ptp_read and wait for conditions to be met to perform read operations. Acked-by: Richard Cochran Reported-and-tested-by: syzbot+df3f3ef31f60781fa911@syzkaller.appspotmail.com Fixes: 8f5de6fb2453 ("ptp: support multiple timestamp event readers") Signed-off-by: Edward Adam Davis Link: https://lore.kernel.org/r/tencent_18747D76F1675A3C633772960237544AAA09@qq.com Signed-off-by: Jakub Kicinski drivers/ptp/ptp_chardev.c | 2 -- 1 file changed, 2 deletions(-) commit 3b83486399a6a9feb9c681b74c21a227d48d7020 Author: Mike Christie Date: Mon Nov 6 17:13:04 2023 -0600 scsi: sd: Fix sshdr use in sd_suspend_common() If scsi_execute_cmd() returns < 0, it doesn't initialize the sshdr, so we shouldn't access the sshdr. If it returns 0, then the cmd executed successfully, so there is no need to check the sshdr. sd_sync_cache() will only access the sshdr if it's been setup because it calls scsi_status_is_check_condition() before accessing it. However, the sd_sync_cache() caller, sd_suspend_common(), does not check. sd_suspend_common() is only checking for ILLEGAL_REQUEST which it's using to determine if the command is supported. If it's not it just ignores the error. So to fix its sshdr use this patch just moves that check to sd_sync_cache() where it converts ILLEGAL_REQUEST to success/0. sd_suspend_common() was ignoring that error and sd_shutdown() doesn't check for errors so there will be no behavior changes. Signed-off-by: Mike Christie Link: https://lore.kernel.org/r/20231106231304.5694-2-michael.christie@oracle.com Reviewed-by: Christoph Hellwig Reviewed-by: Martin Wilck Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen drivers/scsi/sd.c | 53 +++++++++++++++++++++++------------------------------ 1 file changed, 23 insertions(+), 30 deletions(-) commit 9b818a340c0024f8b8f36a5f8e8b4eea3afa9a77 Merge: f1a3b283f852 68c51db3a16d Author: Jakub Kicinski Date: Wed Nov 8 18:43:52 2023 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-11-06 (ice) This series contains updates to ice driver only. Dave removes SR-IOV LAG attribute for only the interface being disabled to allow for proper unwinding of all interfaces. Michal Schmidt changes some LAG allocations from GFP_KERNEL to GFP_ATOMIC due to non-allowed sleeping. Aniruddha and Marcin fix redirection and drop rules for switchdev by properly setting and marking egress/ingress type. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: Fix VF-VF direction matching in drop rule in switchdev ice: Fix VF-VF filter rules in switchdev mode ice: lag: in RCU, use atomic allocation ice: Fix SRIOV LAG disable on non-compliant aggregate ==================== Link: https://lore.kernel.org/r/20231107004844.655549-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 037fbd3fcfbd99145f9310d93f6637012807cfd0 Author: Dan Carpenter Date: Mon Nov 6 17:05:04 2023 +0300 scsi: scsi_debug: Delete some bogus error checking Smatch complains that "dentry" is never initialized. These days everyone initializes all their stack variables to zero so this means that it will trigger a warning every time this function is run. Really, debugfs functions are not supposed to be checked for errors in normal code. For example, if we updated this code to check the correct variable then it would print a warning if CONFIG_DEBUGFS was disabled. We don't want that. Just delete the check. Fixes: f084fe52c640 ("scsi: scsi_debug: Add debugfs interface to fail target reset") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/c602c9ad-5e35-4e18-a47f-87ed956a9ec2@moroto.mountain Reviewed-by: Wenchao Hao Signed-off-by: Martin K. Petersen drivers/scsi/scsi_debug.c | 7 ------- 1 file changed, 7 deletions(-) commit 860c3d03bbc3f17aef8600662c488f27fd093142 Author: Dan Carpenter Date: Mon Nov 6 17:04:33 2023 +0300 scsi: scsi_debug: Fix some bugs in sdebug_error_write() There are two bug in this code: 1) If count is zero, then it will lead to a NULL dereference. The kmalloc() will successfully allocate zero bytes and the test for "if (buf[0] == '-')" will read beyond the end of the zero size buffer and Oops. 2) The code does not ensure that the user's string is properly NUL terminated which could lead to a read overflow. Fixes: a9996d722b11 ("scsi: scsi_debug: Add interface to manage error injection for a single device") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/7733643d-e102-4581-8d29-769472011c97@moroto.mountain Reviewed-by: Wenchao Hao Signed-off-by: Martin K. Petersen drivers/scsi/scsi_debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 27900d7119c464b43cd9eac69c85884d17bae240 Author: Peter Wang Date: Mon Nov 6 15:51:17 2023 +0800 scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR If command timeout happens and cq complete IRQ is raised at the same time, ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the ISR. Error log: ufshcd_abort: Device abort task at tag 18 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44 lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114 Fixes: f1304d442077 ("scsi: ufs: mcq: Added ufshcd_mcq_abort()") Cc: stable@vger.kernel.org Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20231106075117.8995-1-peter.wang@mediatek.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen drivers/ufs/core/ufs-mcq.c | 3 +++ 1 file changed, 3 insertions(+) commit defde5a50d91c74e1ce71a7f0bce7fb1ae311d84 Author: Naomi Chu Date: Thu Nov 2 13:24:24 2023 +0800 scsi: ufs: core: Expand MCQ queue slot to DeviceQueueDepth + 1 The UFSHCI 4.0 specification mandates that there should always be at least one empty slot in each queue for distinguishing between full and empty states. Enlarge 'hwq->max_entries' to 'DeviceQueueDepth + 1' to allow UFSHCI 4.0 controllers to fully utilize MCQ queue slots. Fixes: 4682abfae2eb ("scsi: ufs: core: mcq: Allocate memory for MCQ mode") Signed-off-by: Naomi Chu Link: https://lore.kernel.org/r/20231102052426.12006-2-naomi.chu@mediatek.com Reviewed-by: Stanley Chu Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Reviewed-by: Chun-Hung Signed-off-by: Martin K. Petersen drivers/ufs/core/ufs-mcq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 19597cad64d608aa8ac2f8aef50a50187a565223 Author: Quinn Tran Date: Mon Oct 30 12:19:12 2023 +0530 scsi: qla2xxx: Fix system crash due to bad pointer access User experiences system crash when running AER error injection. The perturbation causes the abort-all-I/O path to trigger. The driver assumes all I/O on this path is FCP only. If there is both NVMe & FCP traffic, a system crash happens. Add additional check to see if I/O is FCP or not before access. PID: 999019 TASK: ff35d769f24722c0 CPU: 53 COMMAND: "kworker/53:1" 0 [ff3f78b964847b58] machine_kexec at ffffffffae86973d 1 [ff3f78b964847ba8] __crash_kexec at ffffffffae9be29d 2 [ff3f78b964847c70] crash_kexec at ffffffffae9bf528 3 [ff3f78b964847c78] oops_end at ffffffffae8282ab 4 [ff3f78b964847c98] exc_page_fault at ffffffffaf2da502 5 [ff3f78b964847cc0] asm_exc_page_fault at ffffffffaf400b62 [exception RIP: qla2x00_abort_srb+444] RIP: ffffffffc07b5f8c RSP: ff3f78b964847d78 RFLAGS: 00010046 RAX: 0000000000000282 RBX: ff35d74a0195a200 RCX: ff35d76886fd03a0 RDX: 0000000000000001 RSI: ffffffffc07c5ec8 RDI: ff35d74a0195a200 RBP: ff35d76913d22080 R8: ff35d7694d103200 R9: ff35d7694d103200 R10: 0000000100000000 R11: ffffffffb05d6630 R12: 0000000000010000 R13: ff3f78b964847df8 R14: ff35d768d8754000 R15: ff35d768877248e0 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 6 [ff3f78b964847d70] qla2x00_abort_srb at ffffffffc07b5f84 [qla2xxx] 7 [ff3f78b964847de0] __qla2x00_abort_all_cmds at ffffffffc07b6238 [qla2xxx] 8 [ff3f78b964847e38] qla2x00_abort_all_cmds at ffffffffc07ba635 [qla2xxx] 9 [ff3f78b964847e58] qla2x00_terminate_rport_io at ffffffffc08145eb [qla2xxx] 10 [ff3f78b964847e70] fc_terminate_rport_io at ffffffffc045987e [scsi_transport_fc] 11 [ff3f78b964847e88] process_one_work at ffffffffae914f15 12 [ff3f78b964847ed0] worker_thread at ffffffffae9154c0 13 [ff3f78b964847f10] kthread at ffffffffae91c456 14 [ff3f78b964847f50] ret_from_fork at ffffffffae8036ef Cc: stable@vger.kernel.org Fixes: f45bca8c5052 ("scsi: qla2xxx: Fix double scsi_done for abort path") Signed-off-by: Quinn Tran Signed-off-by: Nilesh Javali Link: https://lore.kernel.org/r/20231030064912.37912-1-njavali@marvell.com Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_os.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit f1a3b283f852c613fae004f87bbbacc8cef5a061 Author: Eric Dumazet Date: Tue Nov 7 16:04:40 2023 +0000 net_sched: sch_fq: better validate TCA_FQ_WEIGHTS and TCA_FQ_PRIOMAP syzbot was able to trigger the following report while providing too small TCA_FQ_WEIGHTS attribute [1] Fix is to use NLA_POLICY_EXACT_LEN() to ensure user space provided correct sizes. Apply the same fix to TCA_FQ_PRIOMAP. [1] BUG: KMSAN: uninit-value in fq_load_weights net/sched/sch_fq.c:960 [inline] BUG: KMSAN: uninit-value in fq_change+0x1348/0x2fe0 net/sched/sch_fq.c:1071 fq_load_weights net/sched/sch_fq.c:960 [inline] fq_change+0x1348/0x2fe0 net/sched/sch_fq.c:1071 fq_init+0x68e/0x780 net/sched/sch_fq.c:1159 qdisc_create+0x12f3/0x1be0 net/sched/sch_api.c:1326 tc_modify_qdisc+0x11ef/0x2c20 rtnetlink_rcv_msg+0x16a6/0x1840 net/core/rtnetlink.c:6558 netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2545 rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6576 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2588 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2642 __sys_sendmsg net/socket.c:2671 [inline] __do_sys_sendmsg net/socket.c:2680 [inline] __se_sys_sendmsg net/socket.c:2678 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2678 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 __alloc_skb+0x318/0x740 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1286 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1214 [inline] netlink_sendmsg+0xb34/0x13d0 net/netlink/af_netlink.c:1885 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2588 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2642 __sys_sendmsg net/socket.c:2671 [inline] __do_sys_sendmsg net/socket.c:2680 [inline] __se_sys_sendmsg net/socket.c:2678 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2678 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b CPU: 1 PID: 5001 Comm: syz-executor300 Not tainted 6.6.0-syzkaller-12401-g8f6f76a6a29f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 Fixes: 29f834aa326e ("net_sched: sch_fq: add 3 bands and WRR scheduling") Fixes: 49e7265fd098 ("net_sched: sch_fq: add TCA_FQ_WEIGHTS attribute") Reported-by: syzbot Signed-off-by: Eric Dumazet Acked-by: Jamal Hadi Salim Link: https://lore.kernel.org/r/20231107160440.1992526-1-edumazet@google.com Signed-off-by: Jakub Kicinski net/sched/sch_fq.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) commit 09699f193555c0630b7d0fe52c90ba2c7eac639e Merge: 31356547e331 aa54d846f361 Author: Jakub Kicinski Date: Wed Nov 8 18:20:13 2023 -0800 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-11-06 (i40e) This series contains updates to i40e driver only. Ivan Vecera resolves a couple issues with devlink; removing a call to devlink_port_type_clear() and ensuring devlink port is unregistered after the net device. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: i40e: Fix devlink port unregistering i40e: Do not call devlink_port_type_clear() ==================== Link: https://lore.kernel.org/r/20231107003600.653796-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 31356547e3316829f15a98ecf9a2096cf3e228d2 Author: Jakub Kicinski Date: Tue Nov 7 18:03:05 2023 -0800 net: kcm: fill in MODULE_DESCRIPTION() W=1 builds now warn if module is built without a MODULE_DESCRIPTION(). Link: https://lore.kernel.org/r/20231108020305.537293-1-kuba@kernel.org Signed-off-by: Jakub Kicinski net/kcm/kcmsock.c | 1 + 1 file changed, 1 insertion(+) commit 0613736e8ab91e7f338d4021a8b57b124dc49bd4 Merge: 942b8b38de3f 80abbe8a8263 Author: Jakub Kicinski Date: Wed Nov 8 18:14:59 2023 -0800 Merge tag 'nf-23-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Add missing netfilter modules description to fix W=1, from Florian Westphal. 2) Fix catch-all element GC with timeout when use with the pipapo set backend, this remained broken since I tried to fix it this summer, then another attempt to fix it recently. 3) Add missing IPVS modules descriptions to fix W=1, also from Florian. 4) xt_recent allocated a too small buffer to store an IPv4-mapped IPv6 address which can be parsed by in6_pton(), from Maciej Zenczykowski. Broken for many releases. 5) Skip IPv4-mapped IPv6, IPv4-compat IPv6, site/link local scoped IPv6 addressses to set up IPv6 NAT redirect, also from Florian. This is broken since 2012. * tag 'nf-23-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses netfilter: xt_recent: fix (increase) ipv6 literal buffer length ipvs: add missing module descriptions netfilter: nf_tables: remove catchall element in GC sync path netfilter: add missing module descriptions ==================== Link: https://lore.kernel.org/r/20231108155802.84617-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 942b8b38de3fd38de1476b2abca562e729caa03d Merge: 9bc64bd0cd76 8e1b802503bb Author: Jakub Kicinski Date: Wed Nov 8 17:56:13 2023 -0800 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2023-11-08 We've added 16 non-merge commits during the last 6 day(s) which contain a total of 30 files changed, 341 insertions(+), 130 deletions(-). The main changes are: 1) Fix a BPF verifier issue in precision tracking for BPF_ALU | BPF_TO_BE | BPF_END where the source register was incorrectly marked as precise, from Shung-Hsi Yu. 2) Fix a concurrency issue in bpf_timer where the former could still have been alive after an application releases or unpins the map, from Hou Tao. 3) Fix a BPF verifier issue where immediates are incorrectly cast to u32 before being spilled and therefore losing sign information, from Hao Sun. 4) Fix a misplaced BPF_TRACE_ITER in check_css_task_iter_allowlist which incorrectly compared bpf_prog_type with bpf_attach_type, from Chuyi Zhou. 5) Add __bpf_hook_{start,end} as well as __bpf_kfunc_{start,end}_defs macros, migrate all BPF-related __diag callsites over to it, and add a new __diag_ignore_all for -Wmissing-declarations to the macros to address recent build warnings, from Dave Marchevsky. 6) Fix broken BPF selftest build of xdp_hw_metadata test on architectures where char is not signed, from Björn Töpel. 7) Fix test_maps selftest to properly use LIBBPF_OPTS() macro to initialize the bpf_map_create_opts, from Andrii Nakryiko. 8) Fix bpffs selftest to avoid unmounting /sys/kernel/debug as it may have been mounted and used by other applications already, from Manu Bretelle. 9) Fix a build issue without CONFIG_CGROUPS wrt css_task open-coded iterators, from Matthieu Baerts. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: get trusted cgrp from bpf_iter__cgroup directly bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg selftests/bpf: Fix broken build where char is unsigned selftests/bpf: precision tracking test for BPF_NEG and BPF_END bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END selftests/bpf: Add test for using css_task iter in sleepable progs selftests/bpf: Add tests for css_task iter combining with cgroup iter bpf: Relax allowlist for css_task iter selftests/bpf: fix test_maps' use of bpf_map_create_opts bpf: Check map->usercnt after timer->timer is assigned bpf: Add __bpf_hook_{start,end} macros bpf: Add __bpf_kfunc_{start,end}_defs macros selftests/bpf: fix test_bpffs selftests/bpf: Add test for immediate spilled to stack bpf: Fix check_stack_write_fixed_off() to correctly spill imm bpf: fix compilation error without CGROUPS ==================== Link: https://lore.kernel.org/r/20231108132448.1970-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 9bc64bd0cd765f696fcd40fc98909b1f7c73b2ba Author: Vlad Buslov Date: Fri Nov 3 16:14:10 2023 +0100 net/sched: act_ct: Always fill offloading tuple iifidx Referenced commit doesn't always set iifidx when offloading the flow to hardware. Fix the following cases: - nf_conn_act_ct_ext_fill() is called before extension is created with nf_conn_act_ct_ext_add() in tcf_ct_act(). This can cause rule offload with unspecified iifidx when connection is offloaded after only single original-direction packet has been processed by tc data path. Always fill the new nf_conn_act_ct_ext instance after creating it in nf_conn_act_ct_ext_add(). - Offloading of unidirectional UDP NEW connections is now supported, but ct flow iifidx field is not updated when connection is promoted to bidirectional which can result reply-direction iifidx to be zero when refreshing the connection. Fill in the extension and update flow iifidx before calling flow_offload_refresh(). Fixes: 9795ded7f924 ("net/sched: act_ct: Fill offloading tuple iifidx") Reviewed-by: Paul Blakey Signed-off-by: Vlad Buslov Reviewed-by: Simon Horman Fixes: 6a9bad0069cf ("net/sched: act_ct: offload UDP NEW connections") Link: https://lore.kernel.org/r/20231103151410.764271-1-vladbu@nvidia.com Signed-off-by: Jakub Kicinski include/net/netfilter/nf_conntrack_act_ct.h | 30 ++++++++++++++++------------- net/openvswitch/conntrack.c | 2 +- net/sched/act_ct.c | 15 ++++++++++++++- 3 files changed, 32 insertions(+), 15 deletions(-) commit 1ee60356c2dca938362528404af95b8ef3e49b6a Author: Kees Cook Date: Sat Nov 4 13:43:37 2023 -0700 gcc-plugins: randstruct: Only warn about true flexible arrays The randstruct GCC plugin tried to discover "fake" flexible arrays to issue warnings about them in randomized structs. In the future LSM overhead reduction series, it would be legal to have a randomized struct with a 1-element array, and this should _not_ be treated as a flexible array, especially since commit df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3"). Disable the 0-sized and 1-element array discovery logic in the plugin, but keep the "true" flexible array check. Cc: KP Singh Cc: linux-hardening@vger.kernel.org Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311021532.iBwuZUZ0-lkp@intel.com/ Fixes: df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3") Reviewed-by: Bill Wendling Acked-by: "Gustavo A. R. Silva" Link: https://lore.kernel.org/r/20231104204334.work.160-kees@kernel.org Signed-off-by: Kees Cook scripts/gcc-plugins/randomize_layout_plugin.c | 10 ---------- 1 file changed, 10 deletions(-) commit 6bc986ab839c844e78a2333a02e55f02c9e57935 Merge: 67c0afb6424f f003a717ae90 Author: Linus Torvalds Date: Wed Nov 8 13:39:16 2023 -0800 Merge tag 'nfs-for-6.7-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client updates from Trond Myklebust: "Bugfixes: - SUNRPC: - re-probe the target RPC port after an ECONNRESET error - handle allocation errors from rpcb_call_async() - fix a use-after-free condition in rpc_pipefs - fix up various checks for timeouts - NFSv4.1: - Handle NFS4ERR_DELAY errors during session trunking - fix SP4_MACH_CRED protection for pnfs IO - NFSv4: - Ensure that we test all delegations when the server notifies us that it may have revoked some of them Features: - Allow knfsd processes to break out of NFS4ERR_DELAY loops when re-exporting NFSv4.x by setting appropriate values for the 'delay_retrans' module parameter - nfs: Convert nfs_symlink() to use a folio" * tag 'nfs-for-6.7-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: nfs: Convert nfs_symlink() to use a folio SUNRPC: Fix RPC client cleaned up the freed pipefs dentries NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO SUNRPC: Add an IS_ERR() check back to where it was NFSv4.1: fix handling NFS4ERR_DELAY when testing for session trunking nfs41: drop dependency between flexfiles layout driver and NFSv3 modules NFSv4: fairly test all delegations on a SEQ4_ revocation SUNRPC: SOFTCONN tasks should time out when on the sending list SUNRPC: Force close the socket when a hard error is reported SUNRPC: Don't skip timeout checks in call_connect_status() SUNRPC: ECONNRESET might require a rebind NFSv4/pnfs: Allow layoutget to return EAGAIN for softerr mounts NFSv4: Add a parameter to limit the number of retries after NFS4ERR_DELAY commit 67c0afb6424fee94238d9a32b97c407d0c97155e Merge: 34f763262743 1373ca10ec04 Author: Linus Torvalds Date: Wed Nov 8 13:33:47 2023 -0800 Merge tag 'exfat-for-6.7-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat updates from Namjae Jeon: - Fix an issue that exfat timestamps are not updated caused by new timestamp accessor function patch * tag 'exfat-for-6.7-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: fix ctime is not updated exfat: fix setting uninitialized time to ctime/atime commit 34f763262743aac0847b15711b0460ac6d6943d5 Merge: 6d795e2a7df5 14a537983b22 Author: Linus Torvalds Date: Wed Nov 8 13:22:16 2023 -0800 Merge tag 'xfs-6.7-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Chandan Babu: - Realtime device subsystem: - Cleanup usage of xfs_rtblock_t and xfs_fsblock_t data types - Replace open coded conversions between rt blocks and rt extents with calls to static inline helpers - Replace open coded realtime geometry compuation and macros with helper functions - CPU usage optimizations for realtime allocator - Misc bug fixes associated with Realtime device - Allow read operations to execute while an FICLONE ioctl is being serviced - Misc bug fixes: - Alert user when xfs_droplink() encounters an inode with a link count of zero - Handle the case where the allocator could return zero extents when servicing an fallocate request * tag 'xfs-6.7-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (40 commits) xfs: allow read IO and FICLONE to run concurrently xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space xfs: introduce protection for drop nlink xfs: don't look for end of extent further than necessary in xfs_rtallocate_extent_near() xfs: don't try redundant allocations in xfs_rtallocate_extent_near() xfs: limit maxlen based on available space in xfs_rtallocate_extent_near() xfs: return maximum free size from xfs_rtany_summary() xfs: invert the realtime summary cache xfs: simplify rt bitmap/summary block accessor functions xfs: simplify xfs_rtbuf_get calling conventions xfs: cache last bitmap block in realtime allocator xfs: use accessor functions for summary info words xfs: consolidate realtime allocation arguments xfs: create helpers for rtsummary block/wordcount computations xfs: use accessor functions for bitmap words xfs: create helpers for rtbitmap block/wordcount computations xfs: create a helper to handle logging parts of rt bitmap/summary blocks xfs: convert rt summary macros to helpers xfs: convert open-coded xfs_rtword_t pointer accesses to helper xfs: remove XFS_BLOCKWSIZE and XFS_BLOCKWMASK macros ... commit 6d795e2a7df53afccb613cdd1fdc3035a95c8a1d Author: Konstantin Ryabitsev Date: Tue Nov 7 15:00:32 2023 -0500 MAINTAINERS: update lists.linuxfoundation.org migrated lists The mailman-2 system behind lists.linux[-]foundation.org is being retired, so the lists are being migrated to lists.linux.dev. Since both domains belong to LF and setting up proper forwards is possible, the old addresses will continue to work for a while, but all new patches should be sent to the new canonical addresses for each list. Signed-off-by: Konstantin Ryabitsev Signed-off-by: Linus Torvalds MAINTAINERS | 50 +++++++++++++++++++++++++------------------------- 1 file changed, 25 insertions(+), 25 deletions(-) commit 1995a536702921f000acda2bed645f1fe0e7ee5b Merge: 90450a06162e 02e790ee3077 Author: Linus Torvalds Date: Wed Nov 8 12:39:54 2023 -0800 Merge tag 's390-6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull more s390 updates from Vasily Gorbik: - Get rid of s390 specific use of two PTEs per 4KB page with complex half-used pages tracking. Using full 4KB pages for 2KB PTEs increases the memory footprint of page tables but drastically simplify mm code, removing a common blocker for common code changes and adaptations - Simplify and rework "cmma no-dat" handling. This is a follow up for recent fixes which prevent potential incorrect guest TLB flushes - Add perf user stack unwinding as well as USER_STACKTRACE support for user space built with -mbackchain compile option - Add few missing conversion from tlb_remove_table to tlb_remove_ptdesc - Fix crypto cards vanishing in a secure execution environment due to asynchronous errors - Avoid reporting crypto cards or queues in check-stop state as online - Fix null-ptr deference in AP bus code triggered by early config change via SCLP - Couple of stability improvements in AP queue interrupt handling * tag 's390-6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/mm: make pte_free_tlb() similar to pXd_free_tlb() s390/mm: use compound page order to distinguish page tables s390/mm: use full 4KB page for 2KB PTE s390/cmma: rework no-dat handling s390/cmma: move arch_set_page_dat() to header file s390/cmma: move set_page_stable() and friends to header file s390/cmma: move parsing of cmma kernel parameter to early boot code s390/cmma: cleanup inline assemblies s390/ap: fix vanishing crypto cards in SE environment s390/zcrypt: don't report online if card or queue is in check-stop state s390: add USER_STACKTRACE support s390/perf: implement perf_callchain_user() s390/ap: fix AP bus crash on early config change callback invocation s390/ap: re-enable interrupt for AP queues s390/ap: rework to use irq info from ap queue status s390/mm: add missing conversion to use ptdescs commit b36995b8609a5a8fe5cf259a1ee768fcaed919f8 Author: Ondrej Mosnacek Date: Tue Oct 31 13:32:07 2023 +0100 lsm: fix default return value for inode_getsecctx -EOPNOTSUPP is the return value that implements a "no-op" hook, not 0. Without this fix having only the BPF LSM enabled (with no programs attached) can cause uninitialized variable reads in nfsd4_encode_fattr(), because the BPF hook returns 0 without touching the 'ctxlen' variable and the corresponding 'contextlen' variable in nfsd4_encode_fattr() remains uninitialized, yet being treated as valid based on the 0 return value. Cc: stable@vger.kernel.org Fixes: 98e828a0650f ("security: Refactor declaration of LSM hooks") Reported-by: Benjamin Coddington Signed-off-by: Ondrej Mosnacek Signed-off-by: Paul Moore include/linux/lsm_hook_defs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 866d648059d5faf53f1cd960b43fe8365ad93ea7 Author: Ondrej Mosnacek Date: Tue Oct 31 13:32:06 2023 +0100 lsm: fix default return value for vm_enough_memory 1 is the return value that implements a "no-op" hook, not 0. Cc: stable@vger.kernel.org Fixes: 98e828a0650f ("security: Refactor declaration of LSM hooks") Signed-off-by: Ondrej Mosnacek Signed-off-by: Paul Moore include/linux/lsm_hook_defs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 65120498aaf8d7320647a8b6d6de7db42e74ea52 Author: Arnd Bergmann Date: Wed Nov 8 13:58:27 2023 +0100 stackleak: add declarations for global functions With -Wmissing-prototypes enabled, the stackleak code produces a couple of warnings that have no declarations because they are only called from assembler: stackleak.c:127:25: error: no previous prototype for 'stackleak_erase' [-Werror=missing-prototypes] stackleak.c:139:25: error: no previous prototype for 'stackleak_erase_on_task_stack' [-Werror=missing-prototypes] stackleak.c:151:25: error: no previous prototype for 'stackleak_erase_off_task_stack' [-Werror=missing-prototypes] stackleak.c:159:49: error: no previous prototype for 'stackleak_track_stack' [-Werror=missing-prototypes] Add declarations to the stackleak header to shut up the warnings. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20231108125843.3806765-7-arnd@kernel.org Signed-off-by: Kees Cook include/linux/stackleak.h | 6 ++++++ 1 file changed, 6 insertions(+) commit 7a934b5cc3f452df6f9a4903450fc103dee98ee8 Author: Ming Yen Hsieh Date: Mon Oct 30 15:17:34 2023 +0800 wifi: mt76: mt7921: fix 6GHz disabled by the missing default CLC config No matter CLC is enabled or disabled, the driver should initialize the default value 0xff for channel configuration of CLC. Otherwise, the zero value would disable channels. Reported-and-tested-by: Ben Greear Closes: https://lore.kernel.org/all/2fb78387-d226-3193-8ca7-90040561b9ad@candelatech.com/ Fixes: 09382d8f8641 ("wifi: mt76: mt7921: update the channel usage when the regd domain changed") Signed-off-by: Ming Yen Hsieh Signed-off-by: Deren Wu Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/5a976ddf1f636b5cb809373501d3cfdc6d8de3e4.1698648737.git.deren.wu@mediatek.com drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 1 + 1 file changed, 1 insertion(+) commit 90450a06162e6c71ab813ea22a83196fe7cff4bc Merge: 447cec034b78 a80712b9cc7e Author: Linus Torvalds Date: Wed Nov 8 09:47:52 2023 -0800 Merge tag 'rcu-fixes-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/linux-dynticks Pull RCU fixes from Frederic Weisbecker: - Fix a lock inversion between scheduler and RCU introduced in v6.2-rc4. The scenario could trigger on any user of RCU_NOCB (mostly Android but also nohz_full) - Fix PF_IDLE semantic changes introduced in v6.6-rc3 breaking some RCU-Tasks and RCU-Tasks-Trace expectations as to what exactly is an idle task. This resulted in potential spurious stalls and warnings. * tag 'rcu-fixes-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/linux-dynticks: rcu/tasks-trace: Handle new PF_IDLE semantics rcu/tasks: Handle new PF_IDLE semantics rcu: Introduce rcu_cpu_online() rcu: Break rcu_node_0 --> &rq->__lock order commit 447cec034b7896f4b19dbfe3ce6c366ce7c7602a Merge: c1ef4df14ed1 e96c6b8f212a Author: Linus Torvalds Date: Wed Nov 8 09:40:13 2023 -0800 Merge tag 'memblock-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock update from Mike Rapoport: "Report failures when memblock_can_resize is not set. Numerous memblock reservations at early boot may exhaust static memblock.reserved array and it is unnoticed because most of the callers don't check memblock_reserve() return value. In this case the system will crash later, but the reason is hard to identify. Replace return of an error with panic() when memblock.reserved is exhausted before it can be resized" * tag 'memblock-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: memblock: report failures when memblock_can_resize is not set commit c1ef4df14ed1feb9b0f08508390a196a1bc530ce Merge: d46392bbf5c6 23816724fdbd Author: Linus Torvalds Date: Wed Nov 8 09:28:38 2023 -0800 Merge tag 'kgdb-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux Pull kgdb updates from Daniel Thompson: "Just two patches for you this time! - During a panic, flush the console before entering kgdb. This makes things a little easier to comprehend, especially if an NMI backtrace was triggered on all CPUs just before we enter the panic routines - Correcting a couple of misleading (a.k.a. plain wrong) comments" * tag 'kgdb-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux: kdb: Corrects comment for kdballocenv kgdb: Flush console before entering kgdb on panic commit d46392bbf5c6ce594669f00b8177f0b34e983f90 Merge: 305230142ae0 e1c05b3bf80f Author: Linus Torvalds Date: Wed Nov 8 09:21:18 2023 -0800 Merge tag 'riscv-for-linus-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Palmer Dabbelt: - Support for cbo.zero in userspace - Support for CBOs on ACPI-based systems - A handful of improvements for the T-Head cache flushing ops - Support for software shadow call stacks - Various cleanups and fixes * tag 'riscv-for-linus-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (31 commits) RISC-V: hwprobe: Fix vDSO SIGSEGV riscv: configs: defconfig: Enable configs required for RZ/Five SoC riscv: errata: prefix T-Head mnemonics with th. riscv: put interrupt entries into .irqentry.text riscv: mm: Update the comment of CONFIG_PAGE_OFFSET riscv: Using TOOLCHAIN_HAS_ZIHINTPAUSE marco replace zihintpause riscv/mm: Fix the comment for swap pte format RISC-V: clarify the QEMU workaround in ISA parser riscv: correct pt_level name via pgtable_l5/4_enabled RISC-V: Provide pgtable_l5_enabled on rv32 clocksource: timer-riscv: Increase rating of clock_event_device for Sstc clocksource: timer-riscv: Don't enable/disable timer interrupt lkdtm: Fix CFI_BACKWARD on RISC-V riscv: Use separate IRQ shadow call stacks riscv: Implement Shadow Call Stack riscv: Move global pointer loading to a macro riscv: Deduplicate IRQ stack switching riscv: VMAP_STACK overflow detection thread-safe RISC-V: cacheflush: Initialize CBO variables on ACPI systems RISC-V: ACPI: RHCT: Add function to get CBO block sizes ... commit 31255e072b2e91f97645d792d25b2db744186dd1 Author: Rick Edgecombe Date: Tue Nov 7 10:22:51 2023 -0800 x86/shstk: Delay signal entry SSP write until after user accesses When a signal is being delivered, the kernel needs to make accesses to userspace. These accesses could encounter an access error, in which case the signal delivery itself will trigger a segfault. Usually this would result in the kernel killing the process. But in the case of a SEGV signal handler being configured, the failure of the first signal delivery will result in *another* signal getting delivered. The second signal may succeed if another thread has resolved the issue that triggered the segfault (i.e. a well timed mprotect()/mmap()), or the second signal is being delivered to another stack (i.e. an alt stack). On x86, in the non-shadow stack case, all the accesses to userspace are done before changes to the registers (in pt_regs). The operation is aborted when an access error occurs, so although there may be writes done for the first signal, control flow changes for the signal (regs->ip, regs->sp, etc) are not committed until all the accesses have already completed successfully. This means that the second signal will be delivered as if it happened at the time of the first signal. It will effectively replace the first aborted signal, overwriting the half-written frame of the aborted signal. So on sigreturn from the second signal, control flow will resume happily from the point of control flow where the original signal was delivered. The problem is, when shadow stack is active, the shadow stack SSP register/MSR is updated *before* some of the userspace accesses. This means if the earlier accesses succeed and the later ones fail, the second signal will not be delivered at the same spot on the shadow stack as the first one. So on sigreturn from the second signal, the SSP will be pointing to the wrong location on the shadow stack (off by a frame). Pengfei privately reported that while using a shadow stack enabled glibc, the “signal06” test in the LTP test-suite hung. It turns out it is testing the above described double signal scenario. When this test was compiled with shadow stack, the first signal pushed a shadow stack sigframe, then the second pushed another. When the second signal was handled, the SSP was at the first shadow stack signal frame instead of the original location. The test then got stuck as the #CP from the twice incremented SSP was incorrect and generated segfaults in a loop. Fix this by adjusting the SSP register only after any userspace accesses, such that there can be no failures after the SSP is adjusted. Do this by moving the shadow stack sigframe push logic to happen after all other userspace accesses. Note, sigreturn (as opposed to the signal delivery dealt with in this patch) has ordering behavior that could lead to similar failures. The ordering issues there extend beyond shadow stack to include the alt stack restoration. Fixing that would require cross-arch changes, and the ordering today does not cause any known test or apps breakages. So leave it as is, for now. [ dhansen: minor changelog/subject tweak ] Fixes: 05e36022c054 ("x86/shstk: Handle signals for shadow stack") Reported-by: Pengfei Xu Signed-off-by: Rick Edgecombe Signed-off-by: Dave Hansen Tested-by: Pengfei Xu Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/20231107182251.91276-1-rick.p.edgecombe%40intel.com Link: https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/syscalls/signal/signal06.c arch/x86/kernel/signal_64.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 53b5fdb617859a68ab0f4961e524982297bcd7c7 Merge: f0d9da19d7de 45f2f28bd498 Author: Takashi Iwai Date: Wed Nov 8 17:44:06 2023 +0100 Merge tag 'asoc-fix-v6.7-merge-window' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.7 A collection of fixes that have come in during the merge window, the majority of this is driver specific with one core fix for handling of DAPM clock widgets when a name prefix is specified for the card - the name should not be applied to the clock name we request from the clock API. commit 37d9486874ec925fa298bcd7ba628a9b206e812f Merge: 1b0a151c10a6 706add13676d Author: Jens Axboe Date: Wed Nov 8 09:19:16 2023 -0700 Merge tag 'nvme-6.7-2023-11-8' of git://git.infradead.org/nvme into block-6.7 Pull NVMe fixes from Keith: "nvme fixes for 6.7 - nvme keyring config compile fixes (Hannes and Arnd) - fabrics keep alive fixes (Hannes) - tcp authentication fixes (Mark) - io_uring_cmd error handling fix (Anuj) - stale firmware attribute fix (Daniel) - tcp memory leak (Christophe) - cytpo library usage simplification (Eric)" * tag 'nvme-6.7-2023-11-8' of git://git.infradead.org/nvme: nvme: keyring: fix conditional compilation nvme: common: make keyring and auth separate modules nvme: start keep-alive after admin queue setup nvme-loop: always quiesce and cancel commands before destroying admin q nvme-tcp: avoid open-coding nvme_tcp_teardown_admin_queue() nvme-auth: always set valid seq_num in dhchap reply nvme-auth: add flag for bi-directional auth nvme-auth: auth success1 msg always includes resp nvme: fix error-handling for io_uring nvme-passthrough nvme: update firmware version after commit nvme-tcp: Fix a memory leak nvme-auth: use crypto_shash_tfm_digest() commit 706add13676da7ad213b65e92b94af5efc8c4131 Author: Hannes Reinecke Date: Thu Oct 26 15:08:04 2023 +0200 nvme: keyring: fix conditional compilation The keyring and auth functions can be called from both the host and the target side and are controlled by Kconfig options for each of the combinations, but the declarations are controlled by #ifdef checks on the shared Kconfig symbols. This leads to link failures in combinations where one of the frontends is built-in and the other one is a module, and the keyring code ends up in a module that is not reachable from the builtin code: ld: drivers/nvme/host/core.o: in function `nvme_core_exit': core.c:(.exit.text+0x4): undefined reference to `nvme_keyring_exit' ld: drivers/nvme/host/core.o: in function `nvme_core_init': core.c:(.init.text+0x94): undefined reference to `nvme_keyring_init ld: drivers/nvme/host/tcp.o: in function `nvme_tcp_setup_ctrl': tcp.c:(.text+0x4c18): undefined reference to `nvme_tls_psk_default' Address this by moving nvme_keyring_init()/nvme_keyring_exit() into module init/exit functions for the keyring module. Fixes: be8e82caa6859 ("nvme-tcp: enable TLS handshake upcall") Signed-off-by: Hannes Reinecke Cc: Arnd Bergmann Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/common/keyring.c | 9 +++++---- drivers/nvme/host/core.c | 9 +-------- include/linux/nvme-keyring.h | 8 -------- 3 files changed, 6 insertions(+), 20 deletions(-) commit 37de5a80e932f828c34abeaae63170d73930dca3 Author: David Howells Date: Mon Nov 6 14:40:11 2023 +0000 cifs: Fix encryption of cleared, but unset rq_iter data buffers Each smb_rqst struct contains two things: an array of kvecs (rq_iov) that contains the protocol data for an RPC op and an iterator (rq_iter) that contains the data payload of an RPC op. When an smb_rqst is allocated rq_iter is it always cleared, but we don't set it up unless we're going to use it. The functions that determines the size of the ciphertext buffer that will be needed to encrypt a request, cifs_get_num_sgs(), assumes that rq_iter is always initialised - and employs user_backed_iter() to check that the iterator isn't user-backed. This used to incidentally work, because ->user_backed was set to false because the iterator has never been initialised, but with commit f1b4cb650b9a0eeba206d8f069fcdc532bfbcd74[1] which changes user_backed_iter() to determine this based on the iterator type insted, a warning is now emitted: WARNING: CPU: 7 PID: 4584 at fs/smb/client/cifsglob.h:2165 smb2_get_aead_req+0x3fc/0x420 [cifs] ... RIP: 0010:smb2_get_aead_req+0x3fc/0x420 [cifs] ... crypt_message+0x33e/0x550 [cifs] smb3_init_transform_rq+0x27d/0x3f0 [cifs] smb_send_rqst+0xc7/0x160 [cifs] compound_send_recv+0x3ca/0x9f0 [cifs] cifs_send_recv+0x25/0x30 [cifs] SMB2_tcon+0x38a/0x820 [cifs] cifs_get_smb_ses+0x69c/0xee0 [cifs] cifs_mount_get_session+0x76/0x1d0 [cifs] dfs_mount_share+0x74/0x9d0 [cifs] cifs_mount+0x6e/0x2e0 [cifs] cifs_smb3_do_mount+0x143/0x300 [cifs] smb3_get_tree+0x15e/0x290 [cifs] vfs_get_tree+0x2d/0xe0 do_new_mount+0x124/0x340 __se_sys_mount+0x143/0x1a0 The problem is that rq_iter was never set, so the type is 0 (ie. ITER_UBUF) which causes user_backed_iter() to return true. The code doesn't malfunction because it checks the size of the iterator - which is 0. Fix cifs_get_num_sgs() to ignore rq_iter if its count is 0, thereby bypassing the warnings. It might be better to explicitly initialise rq_iter to a zero-length ITER_BVEC, say, as it can always be reinitialised later. Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") Reported-by: Damian Tometzki Closes: https://lore.kernel.org/r/ZUfQo47uo0p2ZsYg@fedora.fritz.box/ Tested-by: Damian Tometzki Cc: stable@vger.kernel.org cc: Eric Biggers cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f1b4cb650b9a0eeba206d8f069fcdc532bfbcd74 [1] Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: David Howells Signed-off-by: Steve French fs/smb/client/cifsglob.h | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit 80abbe8a8263106fe45a4f293b92b5c74cc9cc8a Author: Florian Westphal Date: Wed Nov 8 13:18:53 2023 +0100 netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses The ipv6 redirect target was derived from the ipv4 one, i.e. its identical to a 'dnat' with the first (primary) address assigned to the network interface. The code has been moved around to make it usable from nf_tables too, but its still the same as it was back when this was added in 2012. IPv6, however, has different types of addresses, if the 'wrong' address comes first the redirection does not work. In Daniels case, the addresses are: inet6 ::ffff:192 ... inet6 2a01: ... ... so the function attempts to redirect to the mapped address. Add more checks before the address is deemed correct: 1. If the packets' daddr is scoped, search for a scoped address too 2. skip tentative addresses 3. skip mapped addresses Use the first address that appears to match our needs. Reported-by: Daniel Huhardeaux Closes: https://lore.kernel.org/netfilter/71be06b8-6aa0-4cf9-9e0b-e2839b01b22f@tootai.net/ Fixes: 115e23ac78f8 ("netfilter: ip6tables: add REDIRECT target") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_nat_redirect.c | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) commit 4bb49009e07175266e8c5ffbd5d4c4b241c97f19 Author: Douglas Anderson Date: Tue Nov 7 07:26:57 2023 -0800 Revert "arm64: smp: avoid NMI IPIs with broken MediaTek FW" This reverts commit a07a594152173a3dd3bdd12fc7d73dbba54cdbca. This is no longer needed after the patch ("arm64: Move MediaTek GIC quirk handling from irqchip to core). Signed-off-by: Douglas Anderson Acked-by: Mark Rutland Acked-by: Marc Zyngier Tested-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20231107072651.v2.2.I2c5fa192e767eb3ee233bc28eb60e2f8656c29a6@changeid Signed-off-by: Catalin Marinas arch/arm64/kernel/smp.c | 5 +---- drivers/irqchip/irq-gic-v3.c | 2 +- 2 files changed, 2 insertions(+), 5 deletions(-) commit 1d816ba168ea1999afe8cd2ccbe66b0e762bf455 Author: Douglas Anderson Date: Tue Nov 7 07:26:56 2023 -0800 arm64: Move MediaTek GIC quirk handling from irqchip to core In commit 44bd78dd2b88 ("irqchip/gic-v3: Disable pseudo NMIs on MediaTek devices w/ firmware issues") we added a method for detecting MediaTek devices with broken firmware and disabled pseudo-NMI. While that worked, it didn't address the problem at a deep enough level. The fundamental issue with this broken firmware is that it's not saving and restoring several important GICR registers. The current list is believed to be: * GICR_NUM_IPRIORITYR * GICR_CTLR * GICR_ISPENDR0 * GICR_ISACTIVER0 * GICR_NSACR Pseudo-NMI didn't work because it was the only thing (currently) in the kernel that relied on the broken registers, so forcing pseudo-NMI off was an effective fix. However, it could be observed that calling system_uses_irq_prio_masking() on these systems still returned "true". That caused confusion and led to the need for commit a07a59415217 ("arm64: smp: avoid NMI IPIs with broken MediaTek FW"). It's worried that the incorrect value returned by system_uses_irq_prio_masking() on these systems will continue to confuse future developers. Let's fix the issue a little more completely by disabling IRQ priorities at a deeper level in the kernel. Once we do this we can revert some of the other bits of code dealing with this quirk. This includes a partial revert of commit 44bd78dd2b88 ("irqchip/gic-v3: Disable pseudo NMIs on MediaTek devices w/ firmware issues"). This isn't a full revert because it leaves some of the changes to the "quirks" structure around in case future code needs it. Suggested-by: Mark Rutland Signed-off-by: Douglas Anderson Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Acked-by: Mark Rutland Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20231107072651.v2.1.Ide945748593cffd8ff0feb9ae22b795935b944d6@changeid Signed-off-by: Catalin Marinas arch/arm64/kernel/cpufeature.c | 46 ++++++++++++++++++++++++++++++++++-------- drivers/irqchip/irq-gic-v3.c | 22 +------------------- 2 files changed, 39 insertions(+), 29 deletions(-) commit 53c87e846e335e3c18044c397cc35178163d7827 Author: Petr Tesarik Date: Wed Nov 8 12:12:49 2023 +0100 swiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC Limit the free list length to the size of the IO TLB. Transient pool can be smaller than IO_TLB_SEGSIZE, but the free list is initialized with the assumption that the total number of slots is a multiple of IO_TLB_SEGSIZE. As a result, swiotlb_area_find_slots() may allocate slots past the end of a transient IO TLB buffer. Reported-by: Niklas Schnelle Closes: https://lore.kernel.org/linux-iommu/104a8c8fedffd1ff8a2890983e2ec1c26bff6810.camel@linux.ibm.com/ Fixes: 79636caad361 ("swiotlb: if swiotlb is full, fall back to a transient memory pool") Cc: stable@vger.kernel.org Signed-off-by: Petr Tesarik Reviewed-by: Halil Pasic Signed-off-by: Christoph Hellwig kernel/dma/swiotlb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 05942f780ac6a70e5859fc41d5700e2ca43c4867 Merge: 55e0bf49a0d0 311cd2f6e253 Author: Palmer Dabbelt Date: Wed Nov 8 07:08:35 2023 -0800 Merge patch series "riscv: Fix set_memory_XX() and set_direct_map_XX()" Alexandre Ghiti says: Those 2 patches fix the set_memory_XX() and set_direct_map_XX() APIs, which in turn fix STRICT_KERNEL_RWX and memfd_secret(). Those were broken since the permission changes were not applied to the linear mapping because the linear mapping is mapped using hugepages and walk_page_range_novma() does not split such mappings. To fix that, patch 1 disables PGD mappings in the linear mapping as it is hard to propagate changes at this level in *all* the page tables, this has the downside of disabling PMD mapping for sv32 and PUD (1GB) mapping for sv39 in the linear mapping (for specific kernels, we could add a Kconfig to enable ARCH_HAS_SET_DIRECT_MAP and STRICT_KERNEL_RWX if needed, I'm pretty sure we'll discuss that). patch 2 implements the split of the huge linear mappings so that walk_page_range_novma() can properly apply the permissions. The whole split is protected with mmap_sem in write mode, but I'm wondering if that's enough, any opinion on that is appreciated. * b4-shazam-merge: riscv: Fix set_memory_XX() and set_direct_map_XX() by splitting huge linear mappings riscv: Don't use PGD entries for the linear mapping Link: https://lore.kernel.org/r/20231108075930.7157-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 311cd2f6e25380cff0abc2884dc6a3d33bc9b5c3 Author: Alexandre Ghiti Date: Wed Nov 8 08:59:30 2023 +0100 riscv: Fix set_memory_XX() and set_direct_map_XX() by splitting huge linear mappings When STRICT_KERNEL_RWX is set, any change of permissions on any kernel mapping (vmalloc/modules/kernel text...etc) should be applied on its linear mapping alias. The problem is that the riscv kernel uses huge mappings for the linear mapping and walk_page_range_novma() does not split those huge mappings. So this patchset implements such split in order to apply fine-grained permissions on the linear mapping. Below is the difference before and after (the first PUD mapping is split into PTE/PMD mappings): Before: ---[ Linear mapping ]--- 0xffffaf8000080000-0xffffaf8000200000 0x0000000080080000 1536K PTE D A G . . W R V 0xffffaf8000200000-0xffffaf8077c00000 0x0000000080200000 1914M PMD D A G . . W R V 0xffffaf8077c00000-0xffffaf8078800000 0x00000000f7c00000 12M PMD D A G . . . R V 0xffffaf8078800000-0xffffaf8078c00000 0x00000000f8800000 4M PMD D A G . . W R V 0xffffaf8078c00000-0xffffaf8079200000 0x00000000f8c00000 6M PMD D A G . . . R V 0xffffaf8079200000-0xffffaf807e600000 0x00000000f9200000 84M PMD D A G . . W R V 0xffffaf807e600000-0xffffaf807e716000 0x00000000fe600000 1112K PTE D A G . . W R V 0xffffaf807e717000-0xffffaf807e71a000 0x00000000fe717000 12K PTE D A G . . W R V 0xffffaf807e71d000-0xffffaf807e71e000 0x00000000fe71d000 4K PTE D A G . . W R V 0xffffaf807e722000-0xffffaf807e800000 0x00000000fe722000 888K PTE D A G . . W R V 0xffffaf807e800000-0xffffaf807fe00000 0x00000000fe800000 22M PMD D A G . . W R V 0xffffaf807fe00000-0xffffaf807ff54000 0x00000000ffe00000 1360K PTE D A G . . W R V 0xffffaf807ff55000-0xffffaf8080000000 0x00000000fff55000 684K PTE D A G . . W R V 0xffffaf8080000000-0xffffaf8400000000 0x0000000100000000 14G PUD D A G . . W R V After: ---[ Linear mapping ]--- 0xffffaf8000080000-0xffffaf8000200000 0x0000000080080000 1536K PTE D A G . . W R V 0xffffaf8000200000-0xffffaf8077c00000 0x0000000080200000 1914M PMD D A G . . W R V 0xffffaf8077c00000-0xffffaf8078800000 0x00000000f7c00000 12M PMD D A G . . . R V 0xffffaf8078800000-0xffffaf8078a00000 0x00000000f8800000 2M PMD D A G . . W R V 0xffffaf8078a00000-0xffffaf8078c00000 0x00000000f8a00000 2M PTE D A G . . W R V 0xffffaf8078c00000-0xffffaf8079200000 0x00000000f8c00000 6M PMD D A G . . . R V 0xffffaf8079200000-0xffffaf807e600000 0x00000000f9200000 84M PMD D A G . . W R V 0xffffaf807e600000-0xffffaf807e716000 0x00000000fe600000 1112K PTE D A G . . W R V 0xffffaf807e717000-0xffffaf807e71a000 0x00000000fe717000 12K PTE D A G . . W R V 0xffffaf807e71d000-0xffffaf807e71e000 0x00000000fe71d000 4K PTE D A G . . W R V 0xffffaf807e722000-0xffffaf807e800000 0x00000000fe722000 888K PTE D A G . . W R V 0xffffaf807e800000-0xffffaf807fe00000 0x00000000fe800000 22M PMD D A G . . W R V 0xffffaf807fe00000-0xffffaf807ff54000 0x00000000ffe00000 1360K PTE D A G . . W R V 0xffffaf807ff55000-0xffffaf8080000000 0x00000000fff55000 684K PTE D A G . . W R V 0xffffaf8080000000-0xffffaf8080800000 0x0000000100000000 8M PMD D A G . . W R V 0xffffaf8080800000-0xffffaf8080af6000 0x0000000100800000 3032K PTE D A G . . W R V 0xffffaf8080af6000-0xffffaf8080af8000 0x0000000100af6000 8K PTE D A G . X . R V 0xffffaf8080af8000-0xffffaf8080c00000 0x0000000100af8000 1056K PTE D A G . . W R V 0xffffaf8080c00000-0xffffaf8081a00000 0x0000000100c00000 14M PMD D A G . . W R V 0xffffaf8081a00000-0xffffaf8081a40000 0x0000000101a00000 256K PTE D A G . . W R V 0xffffaf8081a40000-0xffffaf8081a44000 0x0000000101a40000 16K PTE D A G . X . R V 0xffffaf8081a44000-0xffffaf8081a52000 0x0000000101a44000 56K PTE D A G . . W R V 0xffffaf8081a52000-0xffffaf8081a54000 0x0000000101a52000 8K PTE D A G . X . R V ... 0xffffaf809e800000-0xffffaf80c0000000 0x000000011e800000 536M PMD D A G . . W R V 0xffffaf80c0000000-0xffffaf8400000000 0x0000000140000000 13G PUD D A G . . W R V Note that this also fixes memfd_secret() syscall which uses set_direct_map_invalid_noflush() and set_direct_map_default_noflush() to remove the pages from the linear mapping. Below is the kernel page table while a memfd_secret() syscall is running, you can see all the !valid page table entries in the linear mapping: ... 0xffffaf8082240000-0xffffaf8082241000 0x0000000102240000 4K PTE D A G . . W R . 0xffffaf8082241000-0xffffaf8082250000 0x0000000102241000 60K PTE D A G . . W R V 0xffffaf8082250000-0xffffaf8082252000 0x0000000102250000 8K PTE D A G . . W R . 0xffffaf8082252000-0xffffaf8082256000 0x0000000102252000 16K PTE D A G . . W R V 0xffffaf8082256000-0xffffaf8082257000 0x0000000102256000 4K PTE D A G . . W R . 0xffffaf8082257000-0xffffaf8082258000 0x0000000102257000 4K PTE D A G . . W R V 0xffffaf8082258000-0xffffaf8082259000 0x0000000102258000 4K PTE D A G . . W R . 0xffffaf8082259000-0xffffaf808225a000 0x0000000102259000 4K PTE D A G . . W R V 0xffffaf808225a000-0xffffaf808225c000 0x000000010225a000 8K PTE D A G . . W R . 0xffffaf808225c000-0xffffaf8082266000 0x000000010225c000 40K PTE D A G . . W R V 0xffffaf8082266000-0xffffaf8082268000 0x0000000102266000 8K PTE D A G . . W R . 0xffffaf8082268000-0xffffaf8082284000 0x0000000102268000 112K PTE D A G . . W R V 0xffffaf8082284000-0xffffaf8082288000 0x0000000102284000 16K PTE D A G . . W R . 0xffffaf8082288000-0xffffaf808229c000 0x0000000102288000 80K PTE D A G . . W R V 0xffffaf808229c000-0xffffaf80822a0000 0x000000010229c000 16K PTE D A G . . W R . 0xffffaf80822a0000-0xffffaf80822a5000 0x00000001022a0000 20K PTE D A G . . W R V 0xffffaf80822a5000-0xffffaf80822a6000 0x00000001022a5000 4K PTE D A G . . . R V 0xffffaf80822a6000-0xffffaf80822ab000 0x00000001022a6000 20K PTE D A G . . W R V ... And when the memfd_secret() fd is released, the linear mapping is correctly reset: ... 0xffffaf8082240000-0xffffaf80822a5000 0x0000000102240000 404K PTE D A G . . W R V 0xffffaf80822a5000-0xffffaf80822a6000 0x00000001022a5000 4K PTE D A G . . . R V 0xffffaf80822a6000-0xffffaf80822af000 0x00000001022a6000 36K PTE D A G . . W R V ... Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20231108075930.7157-3-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/mm/pageattr.c | 270 ++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 230 insertions(+), 40 deletions(-) commit 629db01c64ff6cea08fc61b52426362689ef8618 Author: Alexandre Ghiti Date: Wed Nov 8 08:59:29 2023 +0100 riscv: Don't use PGD entries for the linear mapping Propagating changes at this level is cumbersome as we need to go through all the page tables when that happens (either when changing the permissions or when splitting the mapping). Note that this prevents the use of 4MB mapping for sv32 and 1GB mapping for sv39 in the linear mapping. Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20231108075930.7157-2-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/mm/init.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit a60a609b7f548050d1e84c7aa1c0a57d5d7e22d5 Author: David Lin Date: Wed Nov 8 14:16:59 2023 +0800 ASoC: nau8540: Add self recovery to improve capture quility Reading the peak data to detect abnormal data in the ADC channel. If abnormal data occurs, the driver takes recovery actions to refresh the ADC channel. Signed-off-by: David Lin Link: https://lore.kernel.org/r/20231108061658.1265065-1-CTLIN0@nuvoton.com Signed-off-by: Mark Brown sound/soc/codecs/nau8540.c | 49 ++++++++++++++++++++++++++++++++++++++++++++++ sound/soc/codecs/nau8540.h | 15 ++++++++++++++ 2 files changed, 64 insertions(+) commit 7b308feb4fd2d1c06919445c65c8fbf8e9fd1781 Author: Maciej Żenczykowski Date: Sun Nov 5 11:56:00 2023 -0800 netfilter: xt_recent: fix (increase) ipv6 literal buffer length in6_pton() supports 'low-32-bit dot-decimal representation' (this is useful with DNS64/NAT64 networks for example): # echo +aaaa:bbbb:cccc:dddd:eeee:ffff:1.2.3.4 > /proc/self/net/xt_recent/DEFAULT # cat /proc/self/net/xt_recent/DEFAULT src=aaaa:bbbb:cccc:dddd:eeee:ffff:0102:0304 ttl: 0 last_seen: 9733848829 oldest_pkt: 1 9733848829 but the provided buffer is too short: # echo +aaaa:bbbb:cccc:dddd:eeee:ffff:255.255.255.255 > /proc/self/net/xt_recent/DEFAULT -bash: echo: write error: Invalid argument Fixes: 079aa88fe717 ("netfilter: xt_recent: IPv6 support") Signed-off-by: Maciej Żenczykowski Reviewed-by: Simon Horman Signed-off-by: Pablo Neira Ayuso net/netfilter/xt_recent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 17cd01e4d1e37e2c8051bbc0ca1ecca4cb001198 Author: Florian Westphal Date: Tue Nov 7 10:48:04 2023 +0100 ipvs: add missing module descriptions W=1 builds warn on missing MODULE_DESCRIPTION, add them. Signed-off-by: Florian Westphal Acked-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso net/netfilter/ipvs/ip_vs_core.c | 1 + net/netfilter/ipvs/ip_vs_dh.c | 1 + net/netfilter/ipvs/ip_vs_fo.c | 1 + net/netfilter/ipvs/ip_vs_ftp.c | 1 + net/netfilter/ipvs/ip_vs_lblc.c | 1 + net/netfilter/ipvs/ip_vs_lblcr.c | 1 + net/netfilter/ipvs/ip_vs_lc.c | 1 + net/netfilter/ipvs/ip_vs_nq.c | 1 + net/netfilter/ipvs/ip_vs_ovf.c | 1 + net/netfilter/ipvs/ip_vs_pe_sip.c | 1 + net/netfilter/ipvs/ip_vs_rr.c | 1 + net/netfilter/ipvs/ip_vs_sed.c | 1 + net/netfilter/ipvs/ip_vs_sh.c | 1 + net/netfilter/ipvs/ip_vs_twos.c | 1 + net/netfilter/ipvs/ip_vs_wlc.c | 1 + net/netfilter/ipvs/ip_vs_wrr.c | 1 + 16 files changed, 16 insertions(+) commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630 Author: Pablo Neira Ayuso Date: Mon Nov 6 10:53:09 2023 +0100 netfilter: nf_tables: remove catchall element in GC sync path The expired catchall element is not deactivated and removed from GC sync path. This path holds mutex so just call nft_setelem_data_deactivate() and nft_setelem_catchall_remove() before queueing the GC work. Fixes: 4a9e12ea7e70 ("netfilter: nft_set_pipapo: call nft_trans_gc_queue_sync() in catchall GC") Reported-by: lonial con Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_tables_api.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) commit 94090b23f3f71c150359a2e0716855a4037ad45a Author: Florian Westphal Date: Sat Nov 4 11:14:05 2023 +0100 netfilter: add missing module descriptions W=1 builds warn on missing MODULE_DESCRIPTION, add them. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/bridge/netfilter/ebtable_broute.c | 1 + net/bridge/netfilter/ebtable_filter.c | 1 + net/bridge/netfilter/ebtable_nat.c | 1 + net/bridge/netfilter/ebtables.c | 1 + net/bridge/netfilter/nf_conntrack_bridge.c | 1 + net/ipv4/netfilter/iptable_nat.c | 1 + net/ipv4/netfilter/iptable_raw.c | 1 + net/ipv4/netfilter/nf_defrag_ipv4.c | 1 + net/ipv4/netfilter/nf_reject_ipv4.c | 1 + net/ipv6/netfilter/ip6table_nat.c | 1 + net/ipv6/netfilter/ip6table_raw.c | 1 + net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 1 + net/ipv6/netfilter/nf_reject_ipv6.c | 1 + net/netfilter/nf_conntrack_broadcast.c | 1 + net/netfilter/nf_conntrack_netlink.c | 1 + net/netfilter/nf_conntrack_proto.c | 1 + net/netfilter/nf_nat_core.c | 1 + net/netfilter/nf_tables_api.c | 1 + net/netfilter/nfnetlink_osf.c | 1 + net/netfilter/nft_chain_nat.c | 1 + net/netfilter/nft_fib.c | 1 + net/netfilter/nft_fwd_netdev.c | 1 + 22 files changed, 22 insertions(+) commit caf3100810f4150677f4e1057aa0a29f8a2c3743 Author: Philipp Stanner Date: Mon Nov 6 10:16:00 2023 +0100 drivers/net/ppp: use standard array-copy-function In ppp_generic.c, memdup_user() is utilized to copy a userspace array. This is done without an overflow-check, which is, however, not critical because the multiplicands are an unsigned short and struct sock_filter, which is currently of size 8. Regardless, string.h now provides memdup_array_user(), a wrapper for copying userspace arrays in a standardized manner, which has the advantage of making it more obvious to the reader that an array is being copied. The wrapper additionally performs an obligatory overflow check, saving the reader the effort of analyzing the potential for overflow, and making the code a bit more robust in case of future changes to the multiplicands len * size. Replace memdup_user() with memdup_array_user(). Suggested-by: Dave Airlie Signed-off-by: Philipp Stanner Signed-off-by: David S. Miller drivers/net/ppp/ppp_generic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit bdba49cbba41f0bea54fc93529bbef4d6ceaa3cd Author: Bence Csókás Date: Mon Oct 30 17:19:10 2023 +0000 i2c: cp2615: Fix 'assignment to __be16' warning While the preamble field _is_ technically big-endian, its value is always 0x2A2A, which is the same in either endianness. However, to avoid generating a warning, we should still call `htons()` explicitly. Signed-off-by: Bence Csókás Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-cp2615.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cc9c54232f04aef3a5d7f64a0ece7df00f1aaa3d Author: Philipp Stanner Date: Thu Nov 2 20:26:13 2023 +0100 i2c: dev: copy userspace array safely i2c-dev.c utilizes memdup_user() to copy a userspace array. This is done without an overflow check. Use the new wrapper memdup_array_user() to copy the array more safely. Suggested-by: Dave Airlie Signed-off-by: Philipp Stanner Signed-off-by: Wolfram Sang drivers/i2c/i2c-dev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e8183fa10c25c7b3c20670bf2b430ddcc1ee03c0 Author: Tam Nguyen Date: Thu Nov 2 10:30:08 2023 +0700 i2c: designware: Disable TX_EMPTY irq while waiting for block length byte During SMBus block data read process, we have seen high interrupt rate because of TX_EMPTY irq status while waiting for block length byte (the first data byte after the address phase). The interrupt handler does not do anything because the internal state is kept as STATUS_WRITE_IN_PROGRESS. Hence, we should disable TX_EMPTY IRQ until I2C DesignWare receives first data byte from I2C device, then re-enable it to resume SMBus transaction. It takes 0.789 ms for host to receive data length from slave. Without the patch, i2c_dw_isr() is called 99 times by TX_EMPTY interrupt. And it is none after applying the patch. Cc: stable@vger.kernel.org Co-developed-by: Chuong Tran Signed-off-by: Chuong Tran Signed-off-by: Tam Nguyen Acked-by: Jarkko Nikula Reviewed-by: Serge Semin Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-designware-master.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) commit ba15a14399c262f91ce30c19fcbdc952262dd1be Author: Roman Bacik Date: Thu Aug 24 14:23:51 2023 -0700 i2c: iproc: handle invalid slave state Add the code to handle an invalid state when both bits S_RX_EVENT (indicating a transaction) and S_START_BUSY (indicating the end of transaction - transition of START_BUSY from 1 to 0) are set in the interrupt status register during a slave read. Signed-off-by: Roman Bacik Fixes: 1ca1b4516088 ("i2c: iproc: handle Master aborted error") Acked-by: Ray Jui Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-bcm-iproc.c | 133 +++++++++++++++++++++---------------- 1 file changed, 75 insertions(+), 58 deletions(-) commit f0d9da19d7de9e845e7a93a901c4b9658df6b492 Author: Kailang Yang Date: Wed Nov 8 15:45:00 2023 +0800 ALSA: hda/realtek: Add support dual speaker for Dell Dell new platform support dual speaker. But BIOS verb table only show one speaker. It will fill verb table for second speaker. Then bind with CS AMP model. Fixes: de90f5165b1c ("ALSA: hda/realtek: Add support for DELL Oasis 13/14/16 laptops") Signed-off-by: Kailang Yang Link: https://lore.kernel.org/r/4dd390a77bf742b8a518ac2deee00b0f@realtek.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 40 +++++++++++++++++++++++++++++++++------- 1 file changed, 33 insertions(+), 7 deletions(-) commit 1d375d65466e5c8d7a9406826d80d475a22e8c6d Author: Hengqi Chen Date: Wed Nov 8 14:12:21 2023 +0800 selftests/bpf: Enable cpu v4 tests for LoongArch Enable the cpu v4 tests for LoongArch. Currently, we don't have BPF trampoline in LoongArch JIT, so the fentry test `test_ptr_struct_arg` still failed, will followup. Test result attached below: # ./test_progs -t verifier_sdiv,verifier_movsx,verifier_ldsx,verifier_gotol,verifier_bswap #316/1 verifier_bswap/BSWAP, 16:OK #316/2 verifier_bswap/BSWAP, 16 @unpriv:OK #316/3 verifier_bswap/BSWAP, 32:OK #316/4 verifier_bswap/BSWAP, 32 @unpriv:OK #316/5 verifier_bswap/BSWAP, 64:OK #316/6 verifier_bswap/BSWAP, 64 @unpriv:OK #316 verifier_bswap:OK #330/1 verifier_gotol/gotol, small_imm:OK #330/2 verifier_gotol/gotol, small_imm @unpriv:OK #330 verifier_gotol:OK #338/1 verifier_ldsx/LDSX, S8:OK #338/2 verifier_ldsx/LDSX, S8 @unpriv:OK #338/3 verifier_ldsx/LDSX, S16:OK #338/4 verifier_ldsx/LDSX, S16 @unpriv:OK #338/5 verifier_ldsx/LDSX, S32:OK #338/6 verifier_ldsx/LDSX, S32 @unpriv:OK #338/7 verifier_ldsx/LDSX, S8 range checking, privileged:OK #338/8 verifier_ldsx/LDSX, S16 range checking:OK #338/9 verifier_ldsx/LDSX, S16 range checking @unpriv:OK #338/10 verifier_ldsx/LDSX, S32 range checking:OK #338/11 verifier_ldsx/LDSX, S32 range checking @unpriv:OK #338 verifier_ldsx:OK #349/1 verifier_movsx/MOV32SX, S8:OK #349/2 verifier_movsx/MOV32SX, S8 @unpriv:OK #349/3 verifier_movsx/MOV32SX, S16:OK #349/4 verifier_movsx/MOV32SX, S16 @unpriv:OK #349/5 verifier_movsx/MOV64SX, S8:OK #349/6 verifier_movsx/MOV64SX, S8 @unpriv:OK #349/7 verifier_movsx/MOV64SX, S16:OK #349/8 verifier_movsx/MOV64SX, S16 @unpriv:OK #349/9 verifier_movsx/MOV64SX, S32:OK #349/10 verifier_movsx/MOV64SX, S32 @unpriv:OK #349/11 verifier_movsx/MOV32SX, S8, range_check:OK #349/12 verifier_movsx/MOV32SX, S8, range_check @unpriv:OK #349/13 verifier_movsx/MOV32SX, S16, range_check:OK #349/14 verifier_movsx/MOV32SX, S16, range_check @unpriv:OK #349/15 verifier_movsx/MOV32SX, S16, range_check 2:OK #349/16 verifier_movsx/MOV32SX, S16, range_check 2 @unpriv:OK #349/17 verifier_movsx/MOV64SX, S8, range_check:OK #349/18 verifier_movsx/MOV64SX, S8, range_check @unpriv:OK #349/19 verifier_movsx/MOV64SX, S16, range_check:OK #349/20 verifier_movsx/MOV64SX, S16, range_check @unpriv:OK #349/21 verifier_movsx/MOV64SX, S32, range_check:OK #349/22 verifier_movsx/MOV64SX, S32, range_check @unpriv:OK #349/23 verifier_movsx/MOV64SX, S16, R10 Sign Extension:OK #349/24 verifier_movsx/MOV64SX, S16, R10 Sign Extension @unpriv:OK #349 verifier_movsx:OK #361/1 verifier_sdiv/SDIV32, non-zero imm divisor, check 1:OK #361/2 verifier_sdiv/SDIV32, non-zero imm divisor, check 1 @unpriv:OK #361/3 verifier_sdiv/SDIV32, non-zero imm divisor, check 2:OK #361/4 verifier_sdiv/SDIV32, non-zero imm divisor, check 2 @unpriv:OK #361/5 verifier_sdiv/SDIV32, non-zero imm divisor, check 3:OK #361/6 verifier_sdiv/SDIV32, non-zero imm divisor, check 3 @unpriv:OK #361/7 verifier_sdiv/SDIV32, non-zero imm divisor, check 4:OK #361/8 verifier_sdiv/SDIV32, non-zero imm divisor, check 4 @unpriv:OK #361/9 verifier_sdiv/SDIV32, non-zero imm divisor, check 5:OK #361/10 verifier_sdiv/SDIV32, non-zero imm divisor, check 5 @unpriv:OK #361/11 verifier_sdiv/SDIV32, non-zero imm divisor, check 6:OK #361/12 verifier_sdiv/SDIV32, non-zero imm divisor, check 6 @unpriv:OK #361/13 verifier_sdiv/SDIV32, non-zero imm divisor, check 7:OK #361/14 verifier_sdiv/SDIV32, non-zero imm divisor, check 7 @unpriv:OK #361/15 verifier_sdiv/SDIV32, non-zero imm divisor, check 8:OK #361/16 verifier_sdiv/SDIV32, non-zero imm divisor, check 8 @unpriv:OK #361/17 verifier_sdiv/SDIV32, non-zero reg divisor, check 1:OK #361/18 verifier_sdiv/SDIV32, non-zero reg divisor, check 1 @unpriv:OK #361/19 verifier_sdiv/SDIV32, non-zero reg divisor, check 2:OK #361/20 verifier_sdiv/SDIV32, non-zero reg divisor, check 2 @unpriv:OK #361/21 verifier_sdiv/SDIV32, non-zero reg divisor, check 3:OK #361/22 verifier_sdiv/SDIV32, non-zero reg divisor, check 3 @unpriv:OK #361/23 verifier_sdiv/SDIV32, non-zero reg divisor, check 4:OK #361/24 verifier_sdiv/SDIV32, non-zero reg divisor, check 4 @unpriv:OK #361/25 verifier_sdiv/SDIV32, non-zero reg divisor, check 5:OK #361/26 verifier_sdiv/SDIV32, non-zero reg divisor, check 5 @unpriv:OK #361/27 verifier_sdiv/SDIV32, non-zero reg divisor, check 6:OK #361/28 verifier_sdiv/SDIV32, non-zero reg divisor, check 6 @unpriv:OK #361/29 verifier_sdiv/SDIV32, non-zero reg divisor, check 7:OK #361/30 verifier_sdiv/SDIV32, non-zero reg divisor, check 7 @unpriv:OK #361/31 verifier_sdiv/SDIV32, non-zero reg divisor, check 8:OK #361/32 verifier_sdiv/SDIV32, non-zero reg divisor, check 8 @unpriv:OK #361/33 verifier_sdiv/SDIV64, non-zero imm divisor, check 1:OK #361/34 verifier_sdiv/SDIV64, non-zero imm divisor, check 1 @unpriv:OK #361/35 verifier_sdiv/SDIV64, non-zero imm divisor, check 2:OK #361/36 verifier_sdiv/SDIV64, non-zero imm divisor, check 2 @unpriv:OK #361/37 verifier_sdiv/SDIV64, non-zero imm divisor, check 3:OK #361/38 verifier_sdiv/SDIV64, non-zero imm divisor, check 3 @unpriv:OK #361/39 verifier_sdiv/SDIV64, non-zero imm divisor, check 4:OK #361/40 verifier_sdiv/SDIV64, non-zero imm divisor, check 4 @unpriv:OK #361/41 verifier_sdiv/SDIV64, non-zero imm divisor, check 5:OK #361/42 verifier_sdiv/SDIV64, non-zero imm divisor, check 5 @unpriv:OK #361/43 verifier_sdiv/SDIV64, non-zero imm divisor, check 6:OK #361/44 verifier_sdiv/SDIV64, non-zero imm divisor, check 6 @unpriv:OK #361/45 verifier_sdiv/SDIV64, non-zero reg divisor, check 1:OK #361/46 verifier_sdiv/SDIV64, non-zero reg divisor, check 1 @unpriv:OK #361/47 verifier_sdiv/SDIV64, non-zero reg divisor, check 2:OK #361/48 verifier_sdiv/SDIV64, non-zero reg divisor, check 2 @unpriv:OK #361/49 verifier_sdiv/SDIV64, non-zero reg divisor, check 3:OK #361/50 verifier_sdiv/SDIV64, non-zero reg divisor, check 3 @unpriv:OK #361/51 verifier_sdiv/SDIV64, non-zero reg divisor, check 4:OK #361/52 verifier_sdiv/SDIV64, non-zero reg divisor, check 4 @unpriv:OK #361/53 verifier_sdiv/SDIV64, non-zero reg divisor, check 5:OK #361/54 verifier_sdiv/SDIV64, non-zero reg divisor, check 5 @unpriv:OK #361/55 verifier_sdiv/SDIV64, non-zero reg divisor, check 6:OK #361/56 verifier_sdiv/SDIV64, non-zero reg divisor, check 6 @unpriv:OK #361/57 verifier_sdiv/SMOD32, non-zero imm divisor, check 1:OK #361/58 verifier_sdiv/SMOD32, non-zero imm divisor, check 1 @unpriv:OK #361/59 verifier_sdiv/SMOD32, non-zero imm divisor, check 2:OK #361/60 verifier_sdiv/SMOD32, non-zero imm divisor, check 2 @unpriv:OK #361/61 verifier_sdiv/SMOD32, non-zero imm divisor, check 3:OK #361/62 verifier_sdiv/SMOD32, non-zero imm divisor, check 3 @unpriv:OK #361/63 verifier_sdiv/SMOD32, non-zero imm divisor, check 4:OK #361/64 verifier_sdiv/SMOD32, non-zero imm divisor, check 4 @unpriv:OK #361/65 verifier_sdiv/SMOD32, non-zero imm divisor, check 5:OK #361/66 verifier_sdiv/SMOD32, non-zero imm divisor, check 5 @unpriv:OK #361/67 verifier_sdiv/SMOD32, non-zero imm divisor, check 6:OK #361/68 verifier_sdiv/SMOD32, non-zero imm divisor, check 6 @unpriv:OK #361/69 verifier_sdiv/SMOD32, non-zero reg divisor, check 1:OK #361/70 verifier_sdiv/SMOD32, non-zero reg divisor, check 1 @unpriv:OK #361/71 verifier_sdiv/SMOD32, non-zero reg divisor, check 2:OK #361/72 verifier_sdiv/SMOD32, non-zero reg divisor, check 2 @unpriv:OK #361/73 verifier_sdiv/SMOD32, non-zero reg divisor, check 3:OK #361/74 verifier_sdiv/SMOD32, non-zero reg divisor, check 3 @unpriv:OK #361/75 verifier_sdiv/SMOD32, non-zero reg divisor, check 4:OK #361/76 verifier_sdiv/SMOD32, non-zero reg divisor, check 4 @unpriv:OK #361/77 verifier_sdiv/SMOD32, non-zero reg divisor, check 5:OK #361/78 verifier_sdiv/SMOD32, non-zero reg divisor, check 5 @unpriv:OK #361/79 verifier_sdiv/SMOD32, non-zero reg divisor, check 6:OK #361/80 verifier_sdiv/SMOD32, non-zero reg divisor, check 6 @unpriv:OK #361/81 verifier_sdiv/SMOD64, non-zero imm divisor, check 1:OK #361/82 verifier_sdiv/SMOD64, non-zero imm divisor, check 1 @unpriv:OK #361/83 verifier_sdiv/SMOD64, non-zero imm divisor, check 2:OK #361/84 verifier_sdiv/SMOD64, non-zero imm divisor, check 2 @unpriv:OK #361/85 verifier_sdiv/SMOD64, non-zero imm divisor, check 3:OK #361/86 verifier_sdiv/SMOD64, non-zero imm divisor, check 3 @unpriv:OK #361/87 verifier_sdiv/SMOD64, non-zero imm divisor, check 4:OK #361/88 verifier_sdiv/SMOD64, non-zero imm divisor, check 4 @unpriv:OK #361/89 verifier_sdiv/SMOD64, non-zero imm divisor, check 5:OK #361/90 verifier_sdiv/SMOD64, non-zero imm divisor, check 5 @unpriv:OK #361/91 verifier_sdiv/SMOD64, non-zero imm divisor, check 6:OK #361/92 verifier_sdiv/SMOD64, non-zero imm divisor, check 6 @unpriv:OK #361/93 verifier_sdiv/SMOD64, non-zero imm divisor, check 7:OK #361/94 verifier_sdiv/SMOD64, non-zero imm divisor, check 7 @unpriv:OK #361/95 verifier_sdiv/SMOD64, non-zero imm divisor, check 8:OK #361/96 verifier_sdiv/SMOD64, non-zero imm divisor, check 8 @unpriv:OK #361/97 verifier_sdiv/SMOD64, non-zero reg divisor, check 1:OK #361/98 verifier_sdiv/SMOD64, non-zero reg divisor, check 1 @unpriv:OK #361/99 verifier_sdiv/SMOD64, non-zero reg divisor, check 2:OK #361/100 verifier_sdiv/SMOD64, non-zero reg divisor, check 2 @unpriv:OK #361/101 verifier_sdiv/SMOD64, non-zero reg divisor, check 3:OK #361/102 verifier_sdiv/SMOD64, non-zero reg divisor, check 3 @unpriv:OK #361/103 verifier_sdiv/SMOD64, non-zero reg divisor, check 4:OK #361/104 verifier_sdiv/SMOD64, non-zero reg divisor, check 4 @unpriv:OK #361/105 verifier_sdiv/SMOD64, non-zero reg divisor, check 5:OK #361/106 verifier_sdiv/SMOD64, non-zero reg divisor, check 5 @unpriv:OK #361/107 verifier_sdiv/SMOD64, non-zero reg divisor, check 6:OK #361/108 verifier_sdiv/SMOD64, non-zero reg divisor, check 6 @unpriv:OK #361/109 verifier_sdiv/SMOD64, non-zero reg divisor, check 7:OK #361/110 verifier_sdiv/SMOD64, non-zero reg divisor, check 7 @unpriv:OK #361/111 verifier_sdiv/SMOD64, non-zero reg divisor, check 8:OK #361/112 verifier_sdiv/SMOD64, non-zero reg divisor, check 8 @unpriv:OK #361/113 verifier_sdiv/SDIV32, zero divisor:OK #361/114 verifier_sdiv/SDIV32, zero divisor @unpriv:OK #361/115 verifier_sdiv/SDIV64, zero divisor:OK #361/116 verifier_sdiv/SDIV64, zero divisor @unpriv:OK #361/117 verifier_sdiv/SMOD32, zero divisor:OK #361/118 verifier_sdiv/SMOD32, zero divisor @unpriv:OK #361/119 verifier_sdiv/SMOD64, zero divisor:OK #361/120 verifier_sdiv/SMOD64, zero divisor @unpriv:OK #361 verifier_sdiv:OK Summary: 5/163 PASSED, 0 SKIPPED, 0 FAILED # ./test_progs -t ldsx_insn test_map_val_and_probed_memory:PASS:test_ldsx_insn__open 0 nsec test_map_val_and_probed_memory:PASS:test_ldsx_insn__load 0 nsec libbpf: prog 'test_ptr_struct_arg': failed to attach: ERROR: strerror_r(-524)=22 libbpf: prog 'test_ptr_struct_arg': failed to auto-attach: -524 test_map_val_and_probed_memory:FAIL:test_ldsx_insn__attach unexpected error: -524 (errno 524) #116/1 ldsx_insn/map_val and probed_memory:FAIL #116/2 ldsx_insn/ctx_member_sign_ext:OK #116/3 ldsx_insn/ctx_member_narrow_sign_ext:OK #116 ldsx_insn:FAIL All error logs: test_map_val_and_probed_memory:PASS:test_ldsx_insn__open 0 nsec test_map_val_and_probed_memory:PASS:test_ldsx_insn__load 0 nsec libbpf: prog 'test_ptr_struct_arg': failed to attach: ERROR: strerror_r(-524)=22 libbpf: prog 'test_ptr_struct_arg': failed to auto-attach: -524 test_map_val_and_probed_memory:FAIL:test_ldsx_insn__attach unexpected error: -524 (errno 524) #116/1 ldsx_insn/map_val and probed_memory:FAIL #116 ldsx_insn:FAIL Summary: 0/2 PASSED, 0 SKIPPED, 1 FAILED Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen tools/testing/selftests/bpf/progs/test_ldsx_insn.c | 3 ++- tools/testing/selftests/bpf/progs/verifier_bswap.c | 3 ++- tools/testing/selftests/bpf/progs/verifier_gotol.c | 3 ++- tools/testing/selftests/bpf/progs/verifier_ldsx.c | 3 ++- tools/testing/selftests/bpf/progs/verifier_movsx.c | 3 ++- tools/testing/selftests/bpf/progs/verifier_sdiv.c | 3 ++- 6 files changed, 12 insertions(+), 6 deletions(-) commit 7b6b13d32965ad7f1eb889d1a7058868a88eb29f Author: Hengqi Chen Date: Wed Nov 8 14:12:21 2023 +0800 LoongArch: BPF: Support signed mod instructions Add support for signed mod instructions. Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen arch/loongarch/net/bpf_jit.c | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-) commit 2425c9e002d2a1fdca34261b2fa6713eafef2163 Author: Hengqi Chen Date: Wed Nov 8 14:12:21 2023 +0800 LoongArch: BPF: Support signed div instructions Add support for signed div instructions. Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen arch/loongarch/net/bpf_jit.c | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-) commit 9ddd2b8d1a8b566195c196fe4249d04cd75cc73c Author: Hengqi Chen Date: Wed Nov 8 14:12:16 2023 +0800 LoongArch: BPF: Support 32-bit offset jmp instructions Add support for 32-bit offset jmp instruction. Currently, we use b instruction which supports range within ±128MB for such jumps. This should be large enough for BPF progs. Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen arch/loongarch/net/bpf_jit.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 4ebf9216e7dff0b38e350007da3b03afb15c816b Author: Hengqi Chen Date: Wed Nov 8 14:12:16 2023 +0800 LoongArch: BPF: Support unconditional bswap instructions Add support for unconditional bswap instruction. Since LoongArch is always little-endian, just treat unconditional bswap the same as big- endian conversion. Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen arch/loongarch/net/bpf_jit.c | 1 + 1 file changed, 1 insertion(+) commit f48012f161508c743e1b39c3521a2b285d19c6aa Author: Hengqi Chen Date: Wed Nov 8 14:12:16 2023 +0800 LoongArch: BPF: Support sign-extension mov instructions Add support for sign-extension mov instructions. Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen arch/loongarch/net/bpf_jit.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) commit 7111afe8fb5f15e11b8eff90d7aed1c58e3b1167 Author: Hengqi Chen Date: Wed Nov 8 14:12:16 2023 +0800 LoongArch: BPF: Support sign-extension load instructions Add support for sign-extension load instructions. Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen arch/loongarch/net/bpf_jit.c | 49 +++++++++++++++++++++++++++++++++++--------- 1 file changed, 39 insertions(+), 10 deletions(-) commit add28024405ed600afaa02749989d4fd119f9057 Author: Hengqi Chen Date: Wed Nov 8 14:12:15 2023 +0800 LoongArch: Add more instruction opcodes and emit_* helpers This patch adds more instruction opcodes and their corresponding emit_* helpers which will be used in later patches. Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen arch/loongarch/include/asm/inst.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit a2ccf46333d7b2cf9658f0d82ac74097c1542fae Author: Huacai Chen Date: Wed Nov 8 14:12:15 2023 +0800 LoongArch/smp: Call rcutree_report_cpu_starting() earlier rcutree_report_cpu_starting() must be called before cpu_probe() to avoid the following lockdep splat that triggered by calling __alloc_pages() when CONFIG_PROVE_RCU_LIST=y: ============================= WARNING: suspicious RCU usage 6.6.0+ #980 Not tainted ----------------------------- kernel/locking/lockdep.c:3761 RCU-list traversed in non-reader section!! other info that might help us debug this: RCU used illegally from offline CPU! rcu_scheduler_active = 1, debug_locks = 1 1 lock held by swapper/1/0: #0: 900000000c82ef98 (&pcp->lock){+.+.}-{2:2}, at: get_page_from_freelist+0x894/0x1790 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.6.0+ #980 Stack : 0000000000000001 9000000004f79508 9000000004893670 9000000100310000 90000001003137d0 0000000000000000 90000001003137d8 9000000004f79508 0000000000000000 0000000000000001 0000000000000000 90000000048a3384 203a656d616e2065 ca43677b3687e616 90000001002c3480 0000000000000008 000000000000009d 0000000000000000 0000000000000001 80000000ffffe0b8 000000000000000d 0000000000000033 0000000007ec0000 13bbf50562dad831 9000000005140748 0000000000000000 9000000004f79508 0000000000000004 0000000000000000 9000000005140748 90000001002bad40 0000000000000000 90000001002ba400 0000000000000000 9000000003573ec8 0000000000000000 00000000000000b0 0000000000000004 0000000000000000 0000000000070000 ... Call Trace: [<9000000003573ec8>] show_stack+0x38/0x150 [<9000000004893670>] dump_stack_lvl+0x74/0xa8 [<900000000360d2bc>] lockdep_rcu_suspicious+0x14c/0x190 [<900000000361235c>] __lock_acquire+0xd0c/0x2740 [<90000000036146f4>] lock_acquire+0x104/0x2c0 [<90000000048a955c>] _raw_spin_lock_irqsave+0x5c/0x90 [<900000000381cd5c>] rmqueue_bulk+0x6c/0x950 [<900000000381fc0c>] get_page_from_freelist+0xd4c/0x1790 [<9000000003821c6c>] __alloc_pages+0x1bc/0x3e0 [<9000000003583b40>] tlb_init+0x150/0x2a0 [<90000000035742a0>] per_cpu_trap_init+0xf0/0x110 [<90000000035712fc>] cpu_probe+0x3dc/0x7a0 [<900000000357ed20>] start_secondary+0x40/0xb0 [<9000000004897138>] smpboot_entry+0x54/0x58 raw_smp_processor_id() is required in order to avoid calling into lockdep before RCU has declared the CPU to be watched for readers. See also commit 29368e093921 ("x86/smpboot: Move rcu_cpu_starting() earlier"), commit de5d9dae150c ("s390/smp: move rcu_cpu_starting() earlier") and commit 99f070b62322 ("powerpc/smp: Call rcu_cpu_starting() earlier"). Signed-off-by: Huacai Chen arch/loongarch/kernel/smp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit affef66b65889a0ea0060e13e5f7fe569897d787 Author: WANG Rui Date: Wed Nov 8 14:12:15 2023 +0800 LoongArch: Relax memory ordering for atomic operations This patch relaxes the implementation while satisfying the memory ordering requirements for atomic operations, which will help improve performance on LA664+. Unixbench with full threads (8) before after Dhrystone 2 using register variables 203910714.2 203909539.8 0.00% Double-Precision Whetstone 37930.9 37931 0.00% Execl Throughput 29431.5 29545.8 0.39% File Copy 1024 bufsize 2000 maxblocks 6645759.5 6676320 0.46% File Copy 256 bufsize 500 maxblocks 2138772.4 2144182.4 0.25% File Copy 4096 bufsize 8000 maxblocks 11640698.4 11602703 -0.33% Pipe Throughput 8849077.7 8917009.4 0.77% Pipe-based Context Switching 1255108.5 1287277.3 2.56% Process Creation 50825.9 50442.1 -0.76% Shell Scripts (1 concurrent) 25795.8 25942.3 0.57% Shell Scripts (8 concurrent) 3812.6 3835.2 0.59% System Call Overhead 9248212.6 9353348.6 1.14% ======= System Benchmarks Index Score 8076.6 8114.4 0.47% Signed-off-by: WANG Rui Signed-off-by: Huacai Chen arch/loongarch/include/asm/atomic.h | 88 ++++++++++++++++++++++++++++--------- 1 file changed, 68 insertions(+), 20 deletions(-) commit 71945968d8b128c955204baa33ec03bdd91bdc26 Author: Nathan Chancellor Date: Wed Nov 8 14:12:15 2023 +0800 LoongArch: Mark __percpu functions as always inline A recent change to the optimization pipeline in LLVM reveals some fragility around the inlining of LoongArch's __percpu functions, which manifests as a BUILD_BUG() failure: In file included from kernel/sched/build_policy.c:17: In file included from include/linux/sched/cputime.h:5: In file included from include/linux/sched/signal.h:5: In file included from include/linux/rculist.h:11: In file included from include/linux/rcupdate.h:26: In file included from include/linux/irqflags.h:18: arch/loongarch/include/asm/percpu.h:97:3: error: call to '__compiletime_assert_51' declared with 'error' attribute: BUILD_BUG failed 97 | BUILD_BUG(); | ^ include/linux/build_bug.h:59:21: note: expanded from macro 'BUILD_BUG' 59 | #define BUILD_BUG() BUILD_BUG_ON_MSG(1, "BUILD_BUG failed") | ^ include/linux/build_bug.h:39:37: note: expanded from macro 'BUILD_BUG_ON_MSG' 39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg) | ^ include/linux/compiler_types.h:425:2: note: expanded from macro 'compiletime_assert' 425 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | ^ include/linux/compiler_types.h:413:2: note: expanded from macro '_compiletime_assert' 413 | __compiletime_assert(condition, msg, prefix, suffix) | ^ include/linux/compiler_types.h:406:4: note: expanded from macro '__compiletime_assert' 406 | prefix ## suffix(); \ | ^ :86:1: note: expanded from here 86 | __compiletime_assert_51 | ^ 1 error generated. If these functions are not inlined (which the compiler is free to do even with functions marked with the standard 'inline' keyword), the BUILD_BUG() in the default case cannot be eliminated since the compiler cannot prove it is never used, resulting in a build failure due to the error attribute. Mark these functions as __always_inline to guarantee inlining so that the BUILD_BUG() only triggers when the default case genuinely cannot be eliminated due to an unexpected size. Cc: Closes: https://github.com/ClangBuiltLinux/linux/issues/1955 Fixes: 46859ac8af52 ("LoongArch: Add multi-processor (SMP) support") Link: https://github.com/llvm/llvm-project/commit/1a2e77cf9e11dbf56b5720c607313a566eebb16e Suggested-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Signed-off-by: Huacai Chen arch/loongarch/include/asm/percpu.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 21eb2bfe2748b238f06983e4308cb30611371605 Author: WANG Rui Date: Wed Nov 8 14:12:07 2023 +0800 LoongArch: Disable module from accessing external data directly The distance between vmlinux and the module is too far so that PC-REL cannot be accessed directly, only GOT. When compiling module with GCC, the option `-mdirect-extern-access` is disabled by default. The Clang option `-fdirect-access-external-data` is enabled by default, so it needs to be explicitly disabled. Signed-off-by: WANG Rui Signed-off-by: Huacai Chen arch/loongarch/Makefile | 2 ++ 1 file changed, 2 insertions(+) commit 80c7889de7a8246e44a9632a2b7d15b41ab3fe41 Author: Huacai Chen Date: Wed Nov 8 14:12:01 2023 +0800 LoongArch: Support PREEMPT_DYNAMIC with static keys Since commit 4e90d0522a688371402c ("riscv: support PREEMPT_DYNAMIC with static keys"), the infrastructure is complete and we can simply select HAVE_PREEMPT_DYNAMIC_KEY to enable PREEMPT_DYNAMIC on LoongArch because we already support static keys. Signed-off-by: Huacai Chen arch/loongarch/Kconfig | 1 + 1 file changed, 1 insertion(+) commit b8337e6a780dad9505f9d44da07c0a5c52fa0a04 Author: Len Brown Date: Tue Nov 7 23:28:30 2023 -0500 tools/power turbostat: version 2023.11.07 Turbostat features are now table-driven (Rui Zhang) Add support for some new platforms (Sumeet Pawnikar, Rui Zhang) Gracefully run in configs when CPUs are limited (Rui Zhang, Srinivas Pandruvada) misc minor fixes. Signed-off-by: Len Brown tools/power/x86/turbostat/turbostat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f2c1dba31133233697fc96e808c6005fc304a8e9 Author: Len Brown Date: Wed Jun 28 09:40:53 2023 -0400 tools/power/turbostat: bugfix "--show IPC" turbostat --show IPC displays "inf" for the IPC column turbostat was missing the explicit dependency of IPC on APERF, and thus neglected to collect APERF when only IPC was requested. typcial use: turbostat --quiet --show CPU,IPC Signed-off-by: Len Brown tools/power/x86/turbostat/turbostat.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit f968c56417f00be4cb62eadeed042a1e3c80dc53 Author: Vladimir Oltean Date: Mon Nov 6 18:03:11 2023 +0200 net: enetc: shorten enetc_setup_xdp_prog() error message to fit NETLINK_MAX_FMTMSG_LEN NETLINK_MAX_FMTMSG_LEN is currently hardcoded to 80, and we provide an error printf-formatted string having 96 characters including the terminating \0. Assuming each %d (representing a queue) gets replaced by a number having at most 2 digits (a reasonable assumption), the final string is also 96 characters wide, which is too much. Reduce the verbiage a bit by removing some (partially) redundant words, which makes the new printf-formatted string be 73 characters wide with the trailing newline. Fixes: 800db2d125c2 ("net: enetc: ensure we always have a minimum number of TXQs for stack") Reported-by: kernel test robot Closes: https://lore.kernel.org/lkml/202311061336.4dsWMT1h-lkp@intel.com/ Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20231106160311.616118-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/freescale/enetc/enetc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 34c4effacfc329aeca5635a69fd9e0f6c90b4101 Author: Shigeru Yoshida Date: Sun Nov 5 00:05:31 2023 +0900 virtio/vsock: Fix uninit-value in virtio_transport_recv_pkt() KMSAN reported the following uninit-value access issue: ===================================================== BUG: KMSAN: uninit-value in virtio_transport_recv_pkt+0x1dfb/0x26a0 net/vmw_vsock/virtio_transport_common.c:1421 virtio_transport_recv_pkt+0x1dfb/0x26a0 net/vmw_vsock/virtio_transport_common.c:1421 vsock_loopback_work+0x3bb/0x5a0 net/vmw_vsock/vsock_loopback.c:120 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0xff6/0x1e60 kernel/workqueue.c:2703 worker_thread+0xeca/0x14d0 kernel/workqueue.c:2784 kthread+0x3cc/0x520 kernel/kthread.c:388 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 Uninit was stored to memory at: virtio_transport_space_update net/vmw_vsock/virtio_transport_common.c:1274 [inline] virtio_transport_recv_pkt+0x1ee8/0x26a0 net/vmw_vsock/virtio_transport_common.c:1415 vsock_loopback_work+0x3bb/0x5a0 net/vmw_vsock/vsock_loopback.c:120 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0xff6/0x1e60 kernel/workqueue.c:2703 worker_thread+0xeca/0x14d0 kernel/workqueue.c:2784 kthread+0x3cc/0x520 kernel/kthread.c:388 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 Uninit was created at: slab_post_alloc_hook+0x105/0xad0 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x5a2/0xaf0 mm/slub.c:3523 kmalloc_reserve+0x13c/0x4a0 net/core/skbuff.c:559 __alloc_skb+0x2fd/0x770 net/core/skbuff.c:650 alloc_skb include/linux/skbuff.h:1286 [inline] virtio_vsock_alloc_skb include/linux/virtio_vsock.h:66 [inline] virtio_transport_alloc_skb+0x90/0x11e0 net/vmw_vsock/virtio_transport_common.c:58 virtio_transport_reset_no_sock net/vmw_vsock/virtio_transport_common.c:957 [inline] virtio_transport_recv_pkt+0x1279/0x26a0 net/vmw_vsock/virtio_transport_common.c:1387 vsock_loopback_work+0x3bb/0x5a0 net/vmw_vsock/vsock_loopback.c:120 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0xff6/0x1e60 kernel/workqueue.c:2703 worker_thread+0xeca/0x14d0 kernel/workqueue.c:2784 kthread+0x3cc/0x520 kernel/kthread.c:388 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 CPU: 1 PID: 10664 Comm: kworker/1:5 Not tainted 6.6.0-rc3-00146-g9f3ebbef746f #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014 Workqueue: vsock-loopback vsock_loopback_work ===================================================== The following simple reproducer can cause the issue described above: int main(void) { int sock; struct sockaddr_vm addr = { .svm_family = AF_VSOCK, .svm_cid = VMADDR_CID_ANY, .svm_port = 1234, }; sock = socket(AF_VSOCK, SOCK_STREAM, 0); connect(sock, (struct sockaddr *)&addr, sizeof(addr)); return 0; } This issue occurs because the `buf_alloc` and `fwd_cnt` fields of the `struct virtio_vsock_hdr` are not initialized when a new skb is allocated in `virtio_transport_init_hdr()`. This patch resolves the issue by initializing these fields during allocation. Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff") Reported-and-tested-by: syzbot+0c8ce1da0ac31abbadcd@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0c8ce1da0ac31abbadcd Signed-off-by: Shigeru Yoshida Reviewed-by: Stefano Garzarella Link: https://lore.kernel.org/r/20231104150531.257952-1-syoshida@redhat.com Signed-off-by: Jakub Kicinski net/vmw_vsock/virtio_transport_common.c | 2 ++ 1 file changed, 2 insertions(+) commit 8999ce4cfc87e61b4143ec2e7b93d8e92e11fa7f Author: Heiner Kallweit Date: Sun Nov 5 23:43:36 2023 +0100 r8169: respect userspace disabling IFF_MULTICAST So far we ignore the setting of IFF_MULTICAST. Fix this and clear bit AcceptMulticast if IFF_MULTICAST isn't set. Note: Based on the implementations I've seen it doesn't seem to be 100% clear what a driver is supposed to do if IFF_ALLMULTI is set but IFF_MULTICAST is not. This patch is based on the understanding that IFF_MULTICAST has precedence. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/4a57ba02-d52d-4369-9f14-3565e6c1f7dc@gmail.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/realtek/r8169_main.c | 2 ++ 1 file changed, 2 insertions(+) commit 305230142ae0637213bf6e04f6d9f10bbcb74af8 Merge: 25b6377007eb 36cbb924d60b Author: Linus Torvalds Date: Tue Nov 7 17:16:23 2023 -0800 Merge tag 'pm-6.7-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These add new hardware support to a cpufreq driver and fix cpupower utility documentation: - Add support for several Qualcomm SoC versions to the Qualcomm cpufreq driver (Robert Marko, Varadarajan Narayanan) - Fix a reference to a removed document in the cpupower utility documentation (Vegard Nossum)" * tag 'pm-6.7-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: qcom-nvmem: Introduce cpufreq for ipq95xx cpufreq: qcom-nvmem: Enable cpufreq for ipq53xx cpufreq: qcom-nvmem: add support for IPQ8074 cpupower: fix reference to nonexistent document commit 25b6377007ebe1c3ede773fd6979f613386db000 Merge: eaec7c9892bd 9ccde17d4655 Author: Linus Torvalds Date: Tue Nov 7 17:10:02 2023 -0800 Merge tag 'drm-next-2023-11-07' of git://anongit.freedesktop.org/drm/drm Pull more drm updates from Dave Airlie: "Geert pointed out I missed the renesas reworks in my main pull, so this pull contains the renesas next work for atomic conversion and DT support. It also contains a bunch of amdgpu and some small ssd13xx fixes. renesas: - atomic conversion - DT support ssd13xx: - dt binding fix for ssd132x - Initialize ssd130x crtc_state to NULL. amdgpu: - Fix RAS support check - RAS fixes - MES fixes - SMU13 fixes - Contiguous memory allocation fix - BACO fixes - GPU reset fixes - Min power limit fixes - GFX11 fixes - USB4/TB hotplug fixes - ARM regression fix - GFX9.4.3 fixes - KASAN/KCSAN stack size check fixes - SR-IOV fixes - SMU14 fixes - PSP13 fixes - Display blend fixes - Flexible array size fixes amdkfd: - GPUVM fix radeon: - Flexible array size fixes" * tag 'drm-next-2023-11-07' of git://anongit.freedesktop.org/drm/drm: (83 commits) drm/amd/display: Enable fast update on blendTF change drm/amd/display: Fix blend LUT programming drm/amd/display: Program plane color setting correctly drm/amdgpu: Query and report boot status drm/amdgpu: Add psp v13 function to query boot status drm/amd/swsmu: remove fw version check in sw_init. drm/amd/swsmu: update smu v14_0_0 driver if and metrics table drm/amdgpu: Add C2PMSG_109/126 reg field shift/masks drm/amdgpu: Optimize the asic type fix code drm/amdgpu: fix GRBM read timeout when do mes_self_test drm/amdgpu: check recovery status of xgmi hive in ras_reset_error_count drm/amd/pm: only check sriov vf flag once when creating hwmon sysfs drm/amdgpu: Attach eviction fence on alloc drm/amdkfd: Improve amdgpu_vm_handle_moved drm/amd/display: Increase frame warning limit with KASAN or KCSAN in dml2 drm/amd/display: Avoid NULL dereference of timing generator drm/amdkfd: Update cache info for GFX 9.4.3 drm/amdkfd: Populate cache info for GFX 9.4.3 drm/amdgpu: don't put MQDs in VRAM on ARM | ARM64 drm/amdgpu/smu13: drop compute workload workaround ... commit eaec7c9892bd565ffc7dcd32515b157011ca2323 Merge: b8dd631fcabe 984a4afdc87a Author: Linus Torvalds Date: Tue Nov 7 16:56:10 2023 -0800 Merge tag 'regmap-fix-v6.7-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fix from Mark Brown: "One fix here, for an interaction between noinc registers and caches. If a device uses noinc registers (which is rare) then we could corrupt registers after the noinc register in the cache" * tag 'regmap-fix-v6.7-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: prevent noinc writes from clobbering cache commit 5a5409d90bd05f87fe5623a749ccfbf3f7c7d400 Author: Namjae Jeon Date: Tue Nov 7 21:04:31 2023 +0900 ksmbd: handle malformed smb1 message If set_smb1_rsp_status() is not implemented, It will cause NULL pointer dereferece error when client send malformed smb1 message. This patch add set_smb1_rsp_status() to ignore malformed smb1 message. Cc: stable@vger.kernel.org Reported-by: Robert Morris Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb_common.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit f6049712e520287ad695e9d4f1572ab76807fa0c Author: Namjae Jeon Date: Sun Nov 5 12:47:53 2023 +0900 ksmbd: fix kernel-doc comment of ksmbd_vfs_kern_path_locked() Fix argument list that the kdoc format and script verified in ksmbd_vfs_kern_path_locked(). fs/smb/server/vfs.c:1207: warning: Function parameter or member 'parent_path' not described in 'ksmbd_vfs_kern_path_locked' Reported-by: kernel test robot Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/vfs.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit eebff19acaa35820cb09ce2ccb3d21bee2156ffb Author: Namjae Jeon Date: Sun Nov 5 12:46:24 2023 +0900 ksmbd: fix slab out of bounds write in smb_inherit_dacl() slab out-of-bounds write is caused by that offsets is bigger than pntsd allocation size. This patch add the check to validate 3 offsets using allocation size. Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-22271 Cc: stable@vger.kernel.org Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smbacl.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) commit b8dd631fcabe2656c8d3751ad4836131d51fb63b Merge: c87271ee86e8 3d8a18697ad8 Author: Linus Torvalds Date: Tue Nov 7 16:53:28 2023 -0800 Merge tag 'rproc-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: "Support for controlling the second core in Mediatek's SCP dual-core setup is introduced. Support for audio, compute and modem DSPs on Qualcomm SM6375, and the audio DSP in SC7180 are introduced. The peripheral NoC clock is dropped from MSM8996 modem DSP, as this is handled through the interconnect provider. In the zynqmp driver the setup for TCM memory, and device address translation thereof, when operating in lockstep mode is corrected. A few bug fixes and cleanups are introduces across the ST and STM32 remoteproc drivers" * tag 'rproc-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (28 commits) remoteproc: st: Fix sometimes uninitialized ret in st_rproc_probe() remoteproc: st: Use device_get_match_data() remoteproc: zynqmp: Change tcm address translation method remoteproc: mediatek: Refactor single core check and fix retrocompatibility remoteproc: qcom: q6v5-mss: Remove PNoC clock from 8996 MSS dt-bindings: remoteproc: qcom,msm8996-mss-pil: Remove PNoC clock dt-bindings: remoteproc: qcom,adsp: Remove AGGRE2 clock remoteproc: qcom: pas: Add SM6375 MPSS remoteproc: qcom: pas: Add SM6375 ADSP & CDSP dt-bindings: remoteproc: qcom,sm6375-pas: Document remoteprocs dt-bindings: remoteproc: pru: Add Interrupt property remoteproc: qcom: pas: Add sc7180 adsp dt-bindings: remoteproc: qcom: sc7180-pas: Add ADSP compatible arm64: dts: mediatek: Update the node name of SCP rpmsg subnode remoteproc: zynqmp: fix TCM carveouts in lockstep mode remoteproc: mediatek: Refine ipi handler error message remoteproc: mediatek: Report watchdog crash to all cores remoteproc: mediatek: Handle MT8195 SCP core 1 watchdog timeout remoteproc: mediatek: Setup MT8195 SCP core 1 SRAM offset remoteproc: mediatek: Remove dependency of MT8195 SCP L2TCM power control on dual-core SCP ... commit c87271ee86e836d3beae7b8b0222e81e225fa6c5 Merge: d3fbdb8ad334 2a6e483ad047 Author: Linus Torvalds Date: Tue Nov 7 16:50:51 2023 -0800 Merge tag 'rpmsg-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg updates from Bjorn Andersson: "This replaces a number of strncpy() instances with strscpy() or strscpy_pad() through the rpmsg core and virtio implementation" * tag 'rpmsg-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: virtio: Replace deprecated strncpy with strscpy/_pad rpmsg: Replace deprecated strncpy with strscpy_pad rpmsg: core: Replace deprecated strncpy with strscpy commit d3fbdb8ad33491f7c241a1167d7e3009f6e3f085 Merge: dc1434801d2e 4f733de8b78a Author: Linus Torvalds Date: Tue Nov 7 16:40:42 2023 -0800 Merge tag 'pcmcia-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux Pull PCMCIA updates from Dominik Brodowski: "Cleanups and fixes. Yang Yingliang has fixed a number of resource leaks and Dongliang Mu contributed a spelling fix for the PCMCIA core. Also included is a tiny clenaup to the tcic PCMCIA socket driver provided by lizhe" * tag 'pcmcia-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux: pcmcia: tcic: remove unneeded "&" in call to setup_timer() pcmcia: typo fix pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() pcmcia: ds: fix refcount leak in pcmcia_device_add() pcmcia: cs: fix possible hung task and memory leak pccardd() commit dc1434801d2ee8b57286f587877e67d2f9b699d6 Merge: 13d88ac54ddd 5be55473a064 Author: Linus Torvalds Date: Tue Nov 7 16:36:25 2023 -0800 Merge tag 'gpio-pinctrl-updates-for-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio/pinctrl updates from Bartosz Golaszewski: "The bulk of it is a rework of the glue layer between pinctrl and GPIO. We changed the signature of GPIO helpers for pinctrl to taking the gpio_chip/offset pair as arguments instead of using the deprecated global GPIO numberspace. The last little bit is removing the gpiochip_find() function as it now has no more users in-tree. Summary: - rework the GPIO-to-pinctrl glue code to stop using the deprecated global GPIO numberspace - remove now unused wrappers around pinctrl GPIO helpers from drivers - remove gpiochip_find() as it has no more users" * tag 'gpio-pinctrl-updates-for-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (70 commits) pinctrl: tegra: drop the wrapper around pinctrl_gpio_request() pinctrl: em: drop the wrapper around pinctrl_gpio_request() pinctrl: nuvoton: npcm8xx: drop wrappers around pinctrl_gpio_request/free() pinctrl: nuvoton: npcm7xx: drop wrappers around pinctrl_gpio_request/free() pinctrl: stm32: drop wrappers around pinctrl_gpio_free/input() pinctrl: starfive: jh7110: drop wrappers around pinctrl_gpio_request/free() pinctrl: starfive: jh7100: drop wrappers around pinctrl_gpio_request/free() pinctrl: ocelot: drop the wrapper around pinctrl_gpio_direction_input() pinctrl: cirrus: drop the wrapper around pinctrl_gpio_direction_input() pinctrl: mediatek: common: drop the wrappers around pinctrl_gpio_direction_input() pinctrl: mediatek: moore: drop the wrappers around pinctrl_gpio_direction_input() pinctrl: rk805: drop the wrapper around pinctrl_gpio_direction_input() pinctrl: axp209: drop the wrapper around pinctrl_gpio_direction_input() pinctrl: vt8500: drop the wrapper around pinctrl_gpio_direction_input() pinctrl: as3722: drop the wrapper around pinctrl_gpio_direction_input() pinctrl: ingenic: drop the wrapper around pinctrl_gpio_direction_input() pinctrl: st: drop the wrapper around pinctrl_gpio_direction_input() pinctrl: change the signature of pinctrl_ready_for_gpio_range() pinctrl: change the signature of gpio_to_pin() pinctrl: change the signature of pinctrl_match_gpio_range() ... commit 99bce5182d8fe90e5c57e9d99f831baaa94f90cb Author: Uwe Kleine-König Date: Sun Nov 5 16:00:39 2023 +0100 ata: pata_gayle: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Sergey Shtylyov Reviewed-by: Niklas Cassel Signed-off-by: Damien Le Moal drivers/ata/pata_gayle.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 47d4708dfa54ad0e84e47bc681c133c2146b0f56 Author: Uwe Kleine-König Date: Sun Nov 5 16:00:38 2023 +0100 ata: pata_falcon: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Sergey Shtylyov Reviewed-by: Niklas Cassel Signed-off-by: Damien Le Moal drivers/ata/pata_falcon.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 0b2771dd52570698c1b92e428f8bf2a224e7a2c3 Author: Uwe Kleine-König Date: Sun Nov 5 16:00:37 2023 +0100 ata: pata_gayle: Stop using module_platform_driver_probe() On today's platforms the benefit of platform_driver_probe() isn't that relevant any more. It allows to drop some code after booting (or module loading) for .probe() and discard the .remove() function completely if the driver is built-in. This typically saves a few 100k. The downside of platform_driver_probe() is that the driver cannot be bound and unbound at runtime which is ancient and so slightly complicates testing. There are also thoughts to deprecate platform_driver_probe() because it adds some complexity in the driver core for little gain. Also many drivers don't use it correctly. This driver for example misses to mark the driver struct with __ref which is needed to suppress a (W=1) modpost warning. Signed-off-by: Uwe Kleine-König Reviewed-by: Sergey Shtylyov Reviewed-by: Niklas Cassel Signed-off-by: Damien Le Moal drivers/ata/pata_gayle.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 36f10a914a7b7169b5e399d1671ba2169c0801f3 Author: Uwe Kleine-König Date: Sun Nov 5 16:00:36 2023 +0100 ata: pata_falcon: Stop using module_platform_driver_probe() On today's platforms the benefit of platform_driver_probe() isn't that relevant any more. It allows to drop some code after booting (or module loading) for .probe() and discard the .remove() function completely if the driver is built-in. This typically saves a few 100k. The downside of platform_driver_probe() is that the driver cannot be bound and unbound at runtime which is ancient and so slightly complicates testing. There are also thoughts to deprecate platform_driver_probe() because it adds some complexity in the driver core for little gain. Also many drivers don't use it correctly. This driver for example misses to mark the driver struct with __ref which is needed to suppress a (W=1) modpost warning. Signed-off-by: Uwe Kleine-König Reviewed-by: Sergey Shtylyov Reviewed-by: Niklas Cassel Signed-off-by: Damien Le Moal drivers/ata/pata_falcon.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit fd3a6837d8e18cb7be80dcca1283276290336a7a Author: Damien Le Moal Date: Mon Nov 6 13:00:49 2023 +0900 ata: libata-core: Fix ata_pci_shutdown_one() This reverts commit 5b6fba546da246b3d0dd8465c07783e22629cc53. Commit 5b6fba546da2 ("ata: libata-core: Detach a port devices on shutdown") modified the function ata_pci_shutdown_one() to stop (suspend) devices attached to the ports of a PCI AHCI adapter to ensure that drives are spun down before shutting down a system. However, this is done only for PCI adapters and not for other types of adapters. This limitation was addressed with commit 24eca2dce0f8 ("scsi: sd: Introduce manage_shutdown device flag"). With this, all ATA disks are spun down on system shutdown, which make the changes introduced with 5b6fba546da2 useless. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel drivers/ata/libata-core.c | 16 +--------------- 1 file changed, 1 insertion(+), 15 deletions(-) commit 8e1b802503bb630eafc3e97b2daf755368ec96e1 Merge: d84b139f53e8 3c5864ba9cf9 Author: Martin KaFai Lau Date: Tue Nov 7 13:26:03 2023 -0800 Merge branch 'Let BPF verifier consider {task,cgroup} is trusted in bpf_iter_reg' Chuyi Zhou says: ==================== The patchset aims to let the BPF verivier consider bpf_iter__cgroup->cgroup and bpf_iter__task->task is trusted suggested by Alexei[1]. Please see individual patches for more details. And comments are always welcome. Link[1]:https://lore.kernel.org/bpf/20231022154527.229117-1-zhouchuyi@bytedance.com/T/#mb57725edc8ccdd50a1b165765c7619b4d65ed1b0 v2->v1: * Patch #1: Add Yonghong's ack and add description of similar case in log. * Patch #2: Add Yonghong's ack ==================== Signed-off-by: Martin KaFai Lau commit 3c5864ba9cf912ff9809f315d28f296f21563cce Author: Chuyi Zhou Date: Tue Nov 7 21:22:04 2023 +0800 selftests/bpf: get trusted cgrp from bpf_iter__cgroup directly Commit f49843afde (selftests/bpf: Add tests for css_task iter combining with cgroup iter) added a test which demonstrates how css_task iter can be combined with cgroup iter. That test used bpf_cgroup_from_id() to convert bpf_iter__cgroup->cgroup to a trusted ptr which is pointless now, since with the previous fix, we can get a trusted cgroup directly from bpf_iter__cgroup. Signed-off-by: Chuyi Zhou Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20231107132204.912120-3-zhouchuyi@bytedance.com Signed-off-by: Martin KaFai Lau tools/testing/selftests/bpf/progs/iters_css_task.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) commit 0de4f50de25af79c2a46db55d70cdbd8f985c6d1 Author: Chuyi Zhou Date: Tue Nov 7 21:22:03 2023 +0800 bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg BTF_TYPE_SAFE_TRUSTED(struct bpf_iter__task) in verifier.c wanted to teach BPF verifier that bpf_iter__task -> task is a trusted ptr. But it doesn't work well. The reason is, bpf_iter__task -> task would go through btf_ctx_access() which enforces the reg_type of 'task' is ctx_arg_info->reg_type, and in task_iter.c, we actually explicitly declare that the ctx_arg_info->reg_type is PTR_TO_BTF_ID_OR_NULL. Actually we have a previous case like this[1] where PTR_TRUSTED is added to the arg flag for map_iter. This patch sets ctx_arg_info->reg_type is PTR_TO_BTF_ID_OR_NULL | PTR_TRUSTED in task_reg_info. Similarly, bpf_cgroup_reg_info -> cgroup is also PTR_TRUSTED since we are under the protection of cgroup_mutex and we would check cgroup_is_dead() in __cgroup_iter_seq_show(). This patch is to improve the user experience of the newly introduced bpf_iter_css_task kfunc before hitting the mainline. The Fixes tag is pointing to the commit introduced the bpf_iter_css_task kfunc. Link[1]:https://lore.kernel.org/all/20230706133932.45883-3-aspsk@isovalent.com/ Fixes: 9c66dc94b62a ("bpf: Introduce css_task open-coded iterator kfuncs") Signed-off-by: Chuyi Zhou Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20231107132204.912120-2-zhouchuyi@bytedance.com Signed-off-by: Martin KaFai Lau kernel/bpf/cgroup_iter.c | 2 +- kernel/bpf/task_iter.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 55e0bf49a0d0387d682d696e41cada071f516075 Author: Evan Green Date: Mon Nov 6 14:58:55 2023 -0800 RISC-V: Probe misaligned access speed in parallel Probing for misaligned access speed takes about 0.06 seconds. On a system with 64 cores, doing this in smp_callin() means it's done serially, extending boot time by 3.8 seconds. That's a lot of boot time. Instead of measuring each CPU serially, let's do the measurements on all CPUs in parallel. If we disable preemption on all CPUs, the jiffies stop ticking, so we can do this in stages of 1) everybody except core 0, then 2) core 0. The allocations are all done outside of on_each_cpu() to avoid calling alloc_pages() with interrupts disabled. For hotplugged CPUs that come in after the boot time measurement, register CPU hotplug callbacks, and do the measurement there. Interrupts are enabled in those callbacks, so they're fine to do alloc_pages() in. Reported-by: Jisheng Zhang Closes: https://lore.kernel.org/all/mhng-9359993d-6872-4134-83ce-c97debe1cf9a@palmer-ri-x1c9/T/#mae9b8f40016f9df428829d33360144dc5026bcbf Fixes: 584ea6564bca ("RISC-V: Probe for unaligned access speed") Signed-off-by: Evan Green Link: https://lore.kernel.org/r/20231106225855.3121724-1-evan@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/cpufeature.h | 1 - arch/riscv/kernel/cpufeature.c | 96 +++++++++++++++++++++++++++++-------- arch/riscv/kernel/smpboot.c | 1 - 3 files changed, 77 insertions(+), 21 deletions(-) commit 6eb7a6445b76a2fced91ebcf93d7a9073258c8cf Author: Evan Green Date: Mon Nov 6 15:11:05 2023 -0800 RISC-V: Remove __init on unaligned_emulation_finish() This function shouldn't be __init, since it's called during hotplug. The warning says it well enough: WARNING: modpost: vmlinux: section mismatch in reference: check_unaligned_access_all_cpus+0x13a (section: .text) -> unaligned_emulation_finish (section: .init.text) Signed-off-by: Evan Green Fixes: 71c54b3d169d ("riscv: report misaligned accesses emulation to hwprobe") Link: https://lore.kernel.org/r/20231106231105.3141413-1-evan@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/traps_misaligned.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d3d2cf1acab1857ae1982d431be9d96dc0e0775c Author: Evan Green Date: Mon Nov 6 15:24:39 2023 -0800 RISC-V: Show accurate per-hart isa in /proc/cpuinfo In /proc/cpuinfo, most of the information we show for each processor is specific to that hart: marchid, mvendorid, mimpid, processor, hart, compatible, and the mmu size. But the ISA string gets filtered through a lowest common denominator mask, so that if one CPU is missing an ISA extension, no CPUs will show it. Now that we track the ISA extensions for each hart, let's report ISA extension info accurately per-hart in /proc/cpuinfo. We cannot change the "isa:" line, as usermode may be relying on that line to show only the common set of extensions supported across all harts. Add a new "hart isa" line instead, which reports the true set of extensions for that hart. Signed-off-by: Evan Green Reviewed-by: Andrew Jones Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20231106232439.3176268-1-evan@rivosinc.com Signed-off-by: Palmer Dabbelt Documentation/riscv/uabi.rst | 20 ++++++++++++++++++++ arch/riscv/kernel/cpu.c | 22 ++++++++++++++++++---- 2 files changed, 38 insertions(+), 4 deletions(-) commit 28ea54bade76e2d47cb8cdb96e427cfb90d3eea7 Author: Palmer Dabbelt Date: Tue Nov 7 07:55:29 2023 -0800 RISC-V: Don't rely on positional structure initialization Without this I get a bunch of warnings along the lines of arch/riscv/kernel/module.c:535:26: error: positional initialization of field in 'struct' declared with 'designated_init' attribute [-Werror=designated-init] 535 | [R_RISCV_32] = { apply_r_riscv_32_rela }, This just mades the member initializers explicit instead of positional. I also aligned some of the table, but mostly just to make the batch editing go faster. Fixes: b51fc88cb35e ("Merge patch series "riscv: Add remaining module relocations and tests"") Reviewed-by: Charlie Jenkins Link: https://lore.kernel.org/r/20231107155529.8368-1-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/module.c | 125 +++++++++++++++++++++++---------------------- 1 file changed, 65 insertions(+), 60 deletions(-) commit b51fc88cb35e49a6e835b496fb21417f414f7c02 Merge: 946bb33d3302 af71bc194916 Author: Palmer Dabbelt Date: Tue Nov 7 14:59:35 2023 -0800 Merge patch series "riscv: Add remaining module relocations and tests" Charlie Jenkins says: A handful of module relocations were missing, this patch includes the remaining ones. I also wrote some test cases to ensure that module loading works properly. Some relocations cannot be supported in the kernel, these include the ones that rely on thread local storage and dynamic linking. This patch also overhauls the implementation of ADD/SUB/SET/ULEB128 relocations to handle overflow. "Overflow" is different for ULEB128 since it is a variable-length encoding that the compiler can be expected to generate enough space for. Instead of overflowing, ULEB128 will expand into the next 8-bit segment of the location. A psABI proposal [1] was merged that mandates that SET_ULEB128 and SUB_ULEB128 are paired, however the discussion following the merging of the pull request revealed that while the pull request was valid, it would be better for linkers to properly handle this overflow. This patch proactively implements this methodology for future compatibility. This can be tested by enabling KUNIT, RUNTIME_KERNEL_TESTING_MENU, and RISCV_MODULE_LINKING_KUNIT. [1] https://github.com/riscv-non-isa/riscv-elf-psabi-doc/pull/403 * b4-shazam-merge: riscv: Add tests for riscv module loading riscv: Add remaining module relocations riscv: Avoid unaligned access when relocating modules Link: https://lore.kernel.org/r/20231101-module_relocations-v9-0-8dfa3483c400@rivosinc.com Signed-off-by: Palmer Dabbelt commit af71bc194916b10f9b394f9b14419d99700a5e67 Author: Charlie Jenkins Date: Wed Nov 1 11:33:01 2023 -0700 riscv: Add tests for riscv module loading Add test cases for the two main groups of relocations added: SUB and SET, along with uleb128. Signed-off-by: Charlie Jenkins Link: https://lore.kernel.org/r/20231101-module_relocations-v9-3-8dfa3483c400@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig.debug | 1 + arch/riscv/kernel/Makefile | 1 + arch/riscv/kernel/tests/Kconfig.debug | 35 +++++++++ arch/riscv/kernel/tests/Makefile | 1 + arch/riscv/kernel/tests/module_test/Makefile | 15 ++++ .../tests/module_test/test_module_linking_main.c | 88 ++++++++++++++++++++++ arch/riscv/kernel/tests/module_test/test_set16.S | 23 ++++++ arch/riscv/kernel/tests/module_test/test_set32.S | 20 +++++ arch/riscv/kernel/tests/module_test/test_set6.S | 23 ++++++ arch/riscv/kernel/tests/module_test/test_set8.S | 23 ++++++ arch/riscv/kernel/tests/module_test/test_sub16.S | 20 +++++ arch/riscv/kernel/tests/module_test/test_sub32.S | 20 +++++ arch/riscv/kernel/tests/module_test/test_sub6.S | 20 +++++ arch/riscv/kernel/tests/module_test/test_sub64.S | 25 ++++++ arch/riscv/kernel/tests/module_test/test_sub8.S | 20 +++++ arch/riscv/kernel/tests/module_test/test_uleb128.S | 31 ++++++++ 16 files changed, 366 insertions(+) commit 8fd6c5142395a106b63c8668e9f4a7106b6a0772 Author: Charlie Jenkins Date: Wed Nov 1 11:33:00 2023 -0700 riscv: Add remaining module relocations Add all final module relocations and add error logs explaining the ones that are not supported. Implement overflow checks for ADD/SUB/SET/ULEB128 relocations. Signed-off-by: Charlie Jenkins Link: https://lore.kernel.org/r/20231101-module_relocations-v9-2-8dfa3483c400@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/include/uapi/asm/elf.h | 5 +- arch/riscv/kernel/module.c | 448 +++++++++++++++++++++++++++++++++++--- 2 files changed, 423 insertions(+), 30 deletions(-) commit 8cbe0accc4a6ba7ed34812a1c7e1ba67e7f7b2a4 Author: Emil Renner Berthing Date: Wed Nov 1 11:32:59 2023 -0700 riscv: Avoid unaligned access when relocating modules With the C-extension regular 32bit instructions are not necessarily aligned on 4-byte boundaries. RISC-V instructions are in fact an ordered list of 16bit little-endian "parcels", so access the instruction as such. This should also make the code work in case someone builds a big-endian RISC-V machine. Signed-off-by: Emil Renner Berthing Signed-off-by: Charlie Jenkins Link: https://lore.kernel.org/r/20231101-module_relocations-v9-1-8dfa3483c400@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/module.c | 157 +++++++++++++++++++++++---------------------- 1 file changed, 81 insertions(+), 76 deletions(-) commit 02d5fdbf4f2b8c406f7a4c98fa52aa181a11d733 Author: Klaus Kudielka Date: Tue Nov 7 18:44:02 2023 +0100 net: phylink: initialize carrier state at creation Background: Turris Omnia (Armada 385); eth2 (mvneta) connected to SFP bus; SFP module is present, but no fiber connected, so definitely no carrier. After booting, eth2 is down, but netdev LED trigger surprisingly reports link active. Then, after "ip link set eth2 up", the link indicator goes away - as I would have expected it from the beginning. It turns out, that the default carrier state after netdev creation is "carrier ok". Some ethernet drivers explicitly call netif_carrier_off during probing, others (like mvneta) don't - which explains the current behaviour: only when the device is brought up, phylink_start calls netif_carrier_off. Fix this for all drivers using phylink, by calling netif_carrier_off in phylink_create. Fixes: 089381b27abe ("leds: initial support for Turris Omnia LEDs") Cc: stable@vger.kernel.org Suggested-by: Andrew Lunn Signed-off-by: Klaus Kudielka Reviewed-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/phy/phylink.c | 1 + 1 file changed, 1 insertion(+) commit 97b94329126823d58550f4699d91e2536d4b6e91 Merge: 7425627b2b2c d80f63f69025 Author: David S. Miller Date: Tue Nov 7 22:27:07 2023 +0000 Merge branch 'vsock-fixes' Filippo Storniolo says: ==================== vsock: fix server prevents clients from reconnecting This patch series introduce fix and tests for the following vsock bug: If the same remote peer, using the same port, tries to connect to a server on a listening port more than once, the server will reject the connection, causing a "connection reset by peer" error on the remote peer. This is due to the presence of a dangling socket from a previous connection in both the connected and bound socket lists. The inconsistency of the above lists only occurs when the remote peer disconnects and the server remains active. This bug does not occur when the server socket is closed. More details on the first patch changelog. The remaining patches are refactoring and test. ==================== Signed-off-by: David S. Miller commit d80f63f690257b04b4fe3731b90dbf34a9ebb93f Author: Filippo Storniolo Date: Fri Nov 3 18:55:51 2023 +0100 test/vsock: add dobule bind connect test This add bind connect test which creates a listening server socket and tries to connect a client with a bound local port to it twice. Co-developed-by: Luigi Leonardi Signed-off-by: Luigi Leonardi Signed-off-by: Filippo Storniolo Reviewed-by: Stefano Garzarella Signed-off-by: David S. Miller tools/testing/vsock/util.c | 47 +++++++++++++++++++++++++++++++++++++ tools/testing/vsock/util.h | 3 +++ tools/testing/vsock/vsock_test.c | 50 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 100 insertions(+) commit 84d5fb9741316ca53f0f7c23b82f30e0bb33c38e Author: Filippo Storniolo Date: Fri Nov 3 18:55:50 2023 +0100 test/vsock: refactor vsock_accept This is a preliminary patch to introduce SOCK_STREAM bind connect test. vsock_accept() is split into vsock_listen() and vsock_accept(). Co-developed-by: Luigi Leonardi Signed-off-by: Luigi Leonardi Signed-off-by: Filippo Storniolo Reviewed-by: Stefano Garzarella Signed-off-by: David S. Miller tools/testing/vsock/util.c | 32 ++++++++++++++++++++------------ 1 file changed, 20 insertions(+), 12 deletions(-) commit bfada5a7672fea5465d81bba3d05fca6024a244e Author: Filippo Storniolo Date: Fri Nov 3 18:55:49 2023 +0100 test/vsock fix: add missing check on socket creation Add check on socket() return value in vsock_listen() and vsock_connect() Co-developed-by: Luigi Leonardi Signed-off-by: Luigi Leonardi Signed-off-by: Filippo Storniolo Reviewed-by: Stefano Garzarella Signed-off-by: David S. Miller tools/testing/vsock/util.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 3a5cc90a4d1756072619fe511d07621bdef7f120 Author: Filippo Storniolo Date: Fri Nov 3 18:55:48 2023 +0100 vsock/virtio: remove socket from connected/bound list on shutdown If the same remote peer, using the same port, tries to connect to a server on a listening port more than once, the server will reject the connection, causing a "connection reset by peer" error on the remote peer. This is due to the presence of a dangling socket from a previous connection in both the connected and bound socket lists. The inconsistency of the above lists only occurs when the remote peer disconnects and the server remains active. This bug does not occur when the server socket is closed: virtio_transport_release() will eventually schedule a call to virtio_transport_do_close() and the latter will remove the socket from the bound and connected socket lists and clear the sk_buff. However, virtio_transport_do_close() will only perform the above actions if it has been scheduled, and this will not happen if the server is processing the shutdown message from a remote peer. To fix this, introduce a call to vsock_remove_sock() when the server is handling a client disconnect. This is to remove the socket from the bound and connected socket lists without clearing the sk_buff. Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko") Reported-by: Daan De Meyer Tested-by: Daan De Meyer Co-developed-by: Luigi Leonardi Signed-off-by: Luigi Leonardi Signed-off-by: Filippo Storniolo Reviewed-by: Stefano Garzarella Signed-off-by: David S. Miller net/vmw_vsock/virtio_transport_common.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) commit 7425627b2b2cd671d5bf6541ce50f7cba8a76ad6 Author: Nathan Chancellor Date: Mon Nov 6 14:14:16 2023 -0700 tcp: Fix -Wc23-extensions in tcp_options_write() Clang warns (or errors with CONFIG_WERROR=y) when CONFIG_TCP_AO is set: net/ipv4/tcp_output.c:663:2: error: label at end of compound statement is a C23 extension [-Werror,-Wc23-extensions] 663 | } | ^ 1 error generated. On earlier releases (such as clang-11, the current minimum supported version for building the kernel) that do not support C23, this was a hard error unconditionally: net/ipv4/tcp_output.c:663:2: error: expected statement } ^ 1 error generated. While adding a semicolon after the label would resolve this, it is more in line with the kernel as a whole to refactor this block into a standalone function, which means the goto a label construct can just be replaced with a return statement. Do so to resolve the warning. Closes: https://github.com/ClangBuiltLinux/linux/issues/1953 Fixes: 1e03d32bea8e ("net/tcp: Add TCP-AO sign to outgoing packets") Signed-off-by: Nathan Chancellor Reviewed-by: Dmitry Safonov Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/tcp_output.c | 70 ++++++++++++++++++++++++++++----------------------- 1 file changed, 39 insertions(+), 31 deletions(-) commit c542b39b607dc0619e3b1b36e289600a555c4774 Author: Alex Pakhunov Date: Sun Nov 5 10:58:28 2023 -0800 tg3: Fix the TX ring stall The TX ring maintained by the tg3 driver can end up in the state, when it has packets queued for sending but the NIC hardware is not informed, so no progress is made. This leads to a multi-second interruption in network traffic followed by dev_watchdog() firing and resetting the queue. The specific sequence of steps is: 1. tg3_start_xmit() is called at least once and queues packet(s) without updating tnapi->prodmbox (netdev_xmit_more() returns true) 2. tg3_start_xmit() is called with an SKB which causes tg3_tso_bug() to be called. 3. tg3_tso_bug() determines that the SKB is too large, ... if (unlikely(tg3_tx_avail(tnapi) <= frag_cnt_est)) { ... stops the queue, and returns NETDEV_TX_BUSY: netif_tx_stop_queue(txq); ... if (tg3_tx_avail(tnapi) <= frag_cnt_est) return NETDEV_TX_BUSY; 4. Since all tg3_tso_bug() call sites directly return, the code updating tnapi->prodmbox is skipped. 5. The queue is stuck now. tg3_start_xmit() is not called while the queue is stopped. The NIC is not processing new packets because tnapi->prodmbox wasn't updated. tg3_tx() is not called by tg3_poll_work() because the all TX descriptions that could be freed has been freed: /* run TX completion thread */ if (tnapi->hw_status->idx[0].tx_consumer != tnapi->tx_cons) { tg3_tx(tnapi); 6. Eventually, dev_watchdog() fires triggering a reset of the queue. This fix makes sure that the tnapi->prodmbox update happens regardless of the reason tg3_start_xmit() returned. Signed-off-by: Alex Pakhunov Signed-off-by: Vincent Wong Reviewed-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/tg3.c | 53 +++++++++++++++++++++++++++++-------- 1 file changed, 42 insertions(+), 11 deletions(-) commit dbc9e341e3655f03a1eeeda8f0fa7931f54fac58 Author: Kuan-Wei Chiu Date: Tue Nov 7 06:20:59 2023 +0800 s390/qeth: Fix typo 'weed' in comment Replace 'weed' with 'we' in the comment. Signed-off-by: Kuan-Wei Chiu Reviewed-by: Alexandra Winter Signed-off-by: David S. Miller drivers/s390/net/qeth_core_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 13d88ac54ddd1011b6e94443958e798aa06eb835 Merge: 062cca8915ca 4ad714df58e6 Author: Linus Torvalds Date: Tue Nov 7 12:11:26 2023 -0800 Merge tag 'vfs-6.7.fsid' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fanotify fsid updates from Christian Brauner: "This work is part of the plan to enable fanotify to serve as a drop-in replacement for inotify. While inotify is availabe on all filesystems, fanotify currently isn't. In order to support fanotify on all filesystems two things are needed: (1) all filesystems need to support AT_HANDLE_FID (2) all filesystems need to report a non-zero f_fsid This contains (1) and allows filesystems to encode non-decodable file handlers for fanotify without implementing any exportfs operations by encoding a file id of type FILEID_INO64_GEN from i_ino and i_generation. Filesystems that want to opt out of encoding non-decodable file ids for fanotify that don't support NFS export can do so by providing an empty export_operations struct. This also partially addresses (2) by generating f_fsid for simple filesystems as well as freevxfs. Remaining filesystems will be dealt with by separate patches. Finally, this contains the patch from the current exportfs maintainers which moves exportfs under vfs with Chuck, Jeff, and Amir as maintainers and vfs.git as tree" * tag 'vfs-6.7.fsid' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: MAINTAINERS: create an entry for exportfs fs: fix build error with CONFIG_EXPORTFS=m or not defined freevxfs: derive f_fsid from bdev->bd_dev fs: report f_fsid from s_dev for "simple" filesystems exportfs: support encoding non-decodeable file handles by default exportfs: define FILEID_INO64_GEN* file handle types exportfs: make ->encode_fh() a mandatory method for NFS export exportfs: add helpers to check if filesystem can encode/decode file handles commit 062cca8915cad56aabb11206a4a5082856167fc0 Merge: 1a0507d8780e 64bc7eee421f Author: Linus Torvalds Date: Tue Nov 7 12:03:54 2023 -0800 Merge tag 'vfs-6.7.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull iomap maintainership rotation from Christian Brauner: "As discussed on list last week this makes fs/iomap part of vfs.git with Darrick as main reviewer" * tag 'vfs-6.7.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: iomap: rename iomap entry iomap: rotate maintainers commit 1a0507d8780e2902c4c17c5a4c45d298bd7048af Merge: 7f851936a0ca 0cdc6f44e9fd Author: Linus Torvalds Date: Tue Nov 7 11:54:17 2023 -0800 Merge tag 'gfs2-v6.6-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: - Don't update inode timestamps for direct writes (performance regression fix) - Skip no-op quota records instead of panicing - Fix a RCU race in gfs2_permission() - Various other smaller fixes and cleanups all over the place * tag 'gfs2-v6.6-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: (24 commits) gfs2: don't withdraw if init_threads() got interrupted gfs2: remove dead code in add_to_queue gfs2: Fix slab-use-after-free in gfs2_qd_dealloc gfs2: Silence "suspicious RCU usage in gfs2_permission" warning gfs2: fs: derive f_fsid from s_uuid gfs2: No longer use 'extern' in function declarations gfs2: Rename gfs2_lookup_{ simple => meta } gfs2: Convert gfs2_internal_read to folios gfs2: Convert stuffed_readpage to folios gfs2: Minor gfs2_write_jdata_batch PAGE_SIZE cleanup gfs2: Get rid of gfs2_alloc_blocks generation parameter gfs2: Add metapath_dibh helper gfs2: Clean up quota.c:print_message gfs2: Clean up gfs2_alloc_parms initializers gfs2: Two quota=account mode fixes gfs2: Stop using GFS2_BASIC_BLOCK and GFS2_BASIC_BLOCK_SHIFT gfs2: setattr_chown: Add missing initialization gfs2: fix an oops in gfs2_permission gfs2: ignore negated quota changes gfs2: Don't update inode timestamps for direct writes ... commit 7f851936a0ca4b231224ee296cba28f9b1bc555e Merge: c9d01179e185 24e16e385f22 Author: Linus Torvalds Date: Tue Nov 7 11:46:31 2023 -0800 Merge tag 'ovl-update-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs Pull overlayfs updates from Amir Goldstein: - Overlayfs aio cleanups and fixes Cleanups and minor fixes in preparation for factoring out of read/write passthrough code. - Overlayfs lock ordering changes Hold mnt_writers only throughout copy up instead of a long lived elevated refcount. - Add support for nesting overlayfs private xattrs There are cases where you want to use an overlayfs mount as a lowerdir for another overlayfs mount. For example, if the system rootfs is on overlayfs due to composefs, or to make it volatile (via tmpfs), then you cannot currently store a lowerdir on the rootfs, because the inner overlayfs will eat all the whiteouts and overlay xattrs. This means you can't e.g. store on the rootfs a prepared container image for use with overlayfs. This adds support for nesting of overlayfs mounts by escaping the problematic features and unescaping them when exposing to the overlayfs user. - Add new mount options for appending lowerdirs * tag 'ovl-update-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs: ovl: add support for appending lowerdirs one by one ovl: refactor layer parsing helpers ovl: store and show the user provided lowerdir mount option ovl: remove unused code in lowerdir param parsing ovl: Add documentation on nesting of overlayfs mounts ovl: Add an alternative type of whiteout ovl: Support escaped overlay.* xattrs ovl: Add OVL_XATTR_TRUSTED/USER_PREFIX_LEN macros ovl: Move xattr support to new xattrs.c file ovl: do not encode lower fh with upper sb_writers held ovl: do not open/llseek lower file with upper sb_writers held ovl: reorder ovl_want_write() after ovl_inode_lock() ovl: split ovl_want_write() into two helpers ovl: add helper ovl_file_modified() ovl: protect copying of realinode attributes to ovl inode ovl: punt write aio completion to workqueue ovl: propagate IOCB_APPEND flag on writes to realfile ovl: use simpler function to convert iocb to rw flags commit 36cbb924d60bf2f1f684b3739edc61cba8350160 Merge: d53f7f7a74cf a563c99f222f Author: Rafael J. Wysocki Date: Tue Nov 7 20:46:13 2023 +0100 Merge branch 'pm-tools' Merge cpupower utility update for 6.7-rc1: - Fix a reference to a removed document in the cpupower utility documentation (Vegard Nossum). * pm-tools: cpupower: fix reference to nonexistent document commit d53f7f7a74cfb8e672644fdde518f286e512f791 Merge: 3062a9879afb d1f6be54eafe Author: Rafael J. Wysocki Date: Tue Nov 7 20:45:12 2023 +0100 Merge branch 'pm-cpufreq' Merge branch 'pm-cpufreq' Merge additional Qualcomm cpufreq driver updates for 6.7-rc1: - Add support for several Qualcomm SoC versions (Robert Marko, Varadarajan Narayanan). * pm-cpufreq: cpufreq: qcom-nvmem: Introduce cpufreq for ipq95xx cpufreq: qcom-nvmem: Enable cpufreq for ipq53xx cpufreq: qcom-nvmem: add support for IPQ8074 commit c9d01179e185f72b20af7e37aa4308f4c7ca7eeb Merge: be3ca57cfb77 c7046ed0cf9b Author: Linus Torvalds Date: Tue Nov 7 11:38:38 2023 -0800 Merge tag 'bcachefs-2023-11-5' of https://evilpiepirate.org/git/bcachefs Pull more bcachefs updates from Kent Overstreet: "Here's the second big bcachefs pull request. This brings your tree up to date with my master branch, which is what existing bcachefs users are currently running. New features: - rebalance_work btree (and metadata version 1.3): the rebalance thread no longer has to scan to find extents that need processing - big scalability improvement. - sb_errors superblock section: this adds counters for each fsck error type, since filesystem creation, along with the date of the most recent error. It'll get us better bug reports (since users do not typically report errors that fsck was able to fix), and I might add telemetry for this in the future. Fixes include: - multiple snapshot deletion fixes - members_v2 fixups - deleted_inodes btree fixes - copygc thread no longer spins when a device is full but has no fragmented buckets (i.e. rebalance needs to move data around instead) - a fix for a memory reclaim issue with the btree key cache: we're now careful not to hold the srcu read lock that blocks key cache reclaim for too long - an early allocator locking fix, from Brian - endianness fixes, from Brian - CONFIG_BCACHEFS_DEBUG_TRANSACTIONS no longer defaults to y, a big performance improvement on multithreaded workloads" * tag 'bcachefs-2023-11-5' of https://evilpiepirate.org/git/bcachefs: (70 commits) bcachefs: Improve stripe checksum error message bcachefs: Simplify, fix bch2_backpointer_get_key() bcachefs: kill thing_it_points_to arg to backpointer_not_found() bcachefs: bch2_ec_read_extent() now takes btree_trans bcachefs: bch2_stripe_to_text() now prints ptr gens bcachefs: Don't iterate over journal entries just for btree roots bcachefs: Break up bch2_journal_write() bcachefs: Replace ERANGE with private error codes bcachefs: bkey_copy() is no longer a macro bcachefs: x-macro-ify inode flags enum bcachefs: Convert bch2_fs_open() to darray bcachefs: Move __bch2_members_v2_get_mut to sb-members.h bcachefs: bch2_prt_datetime() bcachefs: CONFIG_BCACHEFS_DEBUG_TRANSACTIONS no longer defaults to y bcachefs: Add a comment for BTREE_INSERT_NOJOURNAL usage bcachefs: rebalance_work btree is not a snapshots btree bcachefs: Add missing printk newlines bcachefs: Fix recovery when forced to use JSET_NO_FLUSH journal entry bcachefs: .get_parent() should return an error pointer bcachefs: Fix bch2_delete_dead_inodes() ... commit 166b0110d1ee53290bd11618df6e3991c117495a Author: Helge Deller Date: Tue Nov 7 14:33:32 2023 +0100 parisc/pgtable: Do not drop upper 5 address bits of physical address When calculating the pfn for the iitlbt/idtlbt instruction, do not drop the upper 5 address bits. This doesn't seem to have an effect on physical hardware which uses less physical address bits, but in qemu the missing bits are visible. Signed-off-by: Helge Deller Cc: arch/parisc/kernel/entry.S | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 6affe08aea5f3b630565676e227b41d55a6f009c Author: Arnd Bergmann Date: Thu Oct 26 15:08:03 2023 +0200 nvme: common: make keyring and auth separate modules When only the keyring module is included but auth is not, modpost complains about the lack of a module license tag: ERROR: modpost: missing MODULE_LICENSE() in drivers/nvme/common/nvme-common.o Address this by making both modules buildable standalone, removing the now unnecessary CONFIG_NVME_COMMON symbol in the process. Also, now that NVME_KEYRING config symbol can be either a module or built-in, the stubs need to check for '#if IS_ENABLED' rather than a simple '#ifdef'. Fixes: 9d77eb5277849 ("nvme-keyring: register '.nvme' keyring") Signed-off-by: Arnd Bergmann Signed-off-by: Hannes Reinecke Signed-off-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/Makefile | 2 +- drivers/nvme/common/Kconfig | 7 ++----- drivers/nvme/common/Makefile | 7 ++++--- drivers/nvme/common/keyring.c | 2 ++ drivers/nvme/host/Kconfig | 2 -- drivers/nvme/target/Kconfig | 2 -- include/linux/nvme-keyring.h | 2 +- 7 files changed, 10 insertions(+), 14 deletions(-) commit 946bb33d330251966223f770f64885c79448b1a1 Author: Christoph Hellwig Date: Sat Oct 28 17:51:01 2023 +0200 riscv: split cache ops out of dma-noncoherent.c The cache ops are also used by the pmem code which is unconditionally built into the kernel. Move them into a separate file that is built based on the correct config option. Fixes: fd962781270e ("riscv: RISCV_NONSTANDARD_CACHE_OPS shouldn't depend on RISCV_DMA_NONCOHERENT") Reported-by: kernel test robot Signed-off-by: Christoph Hellwig Reviewed-by: Conor Dooley Tested-by: Conor Dooley Reviewed-by: Lad Prabhakar Tested-by: Lad Prabhakar # Link: https://lore.kernel.org/r/20231028155101.1039049-1-hch@lst.de Signed-off-by: Palmer Dabbelt arch/riscv/mm/Makefile | 1 + arch/riscv/mm/cache-ops.c | 17 +++++++++++++++++ arch/riscv/mm/dma-noncoherent.c | 15 --------------- 3 files changed, 18 insertions(+), 15 deletions(-) commit 20238a2cc9a6a926f9f47ae4ae9edd1bc98f278c Author: Tao Zhou Date: Thu Oct 19 16:01:07 2023 +0800 drm/amdgpu: add RAS reset/query operations for XGMI v6_4 Reset/query RAS error status and count. v2: use XGMI IP version instead of WAFL version. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c | 46 +++++++++++++++++++++++++++++--- 1 file changed, 43 insertions(+), 3 deletions(-) commit 61fe5536d06cf485d387c894d2083de883c81ad7 Author: Tao Zhou Date: Tue Oct 31 10:39:51 2023 +0800 drm/amdgpu: handle extra UE register entries for gfx v9_4_3 The UE registe list is larger than CE list. Reported-by: yipeng.chai@amd.com Signed-off-by: Tao Zhou Reviewed-by: Stanley.Yang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 38 +++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) commit d78fa1c309327cee1cfb7c608ec59f5a60ab94bd Author: Tim Huang Date: Thu Oct 19 10:24:11 2023 +0800 drm/amd/pm: not stop rlc for IMU enabled APUs when suspend For IMU enabled APUs, after sending the PrepareMp1ForUnload message to SMU in system_features_control, the RLC registers can't be touched. The driver to stop the rlc in suspending is no longer required. Signed-off-by: Tim Huang Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 1 + 1 file changed, 1 insertion(+) commit c68b4550b6b432cbb05ad30f67178d2d3845d919 Author: Bragatheswaran Manickavel Date: Tue Oct 24 23:41:34 2023 +0530 drm/amd/display: avoid variable reinitialization The member variable enable_hpo_pg_support is already initialized and hence the reinitialization instruction can be removed. Issue identified using the doubleinit.cocci Coccinelle semantic patch script. Signed-off-by: Bragatheswaran Manickavel Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn35/dcn35_resource.c | 1 - 1 file changed, 1 deletion(-) commit 8cfd6a05750cd7aa84e7f1e5933fa7781006bfc3 Author: Lijo Lazar Date: Tue Oct 31 12:32:03 2023 +0530 drm/amd/pm: Hide irrelevant pm device attributes Change return code to EOPNOTSUPP for unsupported functions. Use the error code information to hide sysfs nodes not valid for the SOC. Signed-off-by: Lijo Lazar Reviewed-by: Yang Wang Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 12 ++++++------ drivers/gpu/drm/amd/pm/amdgpu_pm.c | 12 ++++++++++++ drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 4 ++-- 3 files changed, 20 insertions(+), 8 deletions(-) commit 0553eb9f33aa1a89a788682c78bd9747d41e65cb Author: Lijo Lazar Date: Mon Nov 6 09:06:58 2023 +0530 drm/amdgpu: Fix sdma 4.4.2 doorbell rptr/wptr init Doorbell rptr/wptr can be set through multiple ways including direct register initialization. Disable doorbell during hw_fini once the ring is disabled so that during next module reload direct initialization takes effect. Also, move the direct initialization after minor update is set to 1 since rptr/wptr are reinitialized back to 0 which could be lower than the previous doorbell value (ex: cases like module reload). Signed-off-by: Lijo Lazar Reviewed-by: Le Ma Reviewed-by: Asad Kamal Tested-by: Asad Kamal Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) commit 9c561ca2d3ca99606034880f62791e866af35ef9 Author: Jiadong Zhu Date: Thu Oct 26 17:08:49 2023 +0800 drm/amdgpu/soc21: add mode2 asic reset for SMU IP v14.0.0 Set the default reset method to mode2 for SMU IP v14.0.0 Signed-off-by: Jiadong Zhu Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/soc21.c | 1 + 1 file changed, 1 insertion(+) commit d736c2e0744807e4cb12e84b179896c995a096f9 Author: George Shen Date: Tue Oct 24 21:47:57 2023 -0400 drm/amd/display: Set stream's DP test pattern upon test request [Why] A recent refactor of DC's DP test pattern automation code requires the DC stream's test pattern and test pattern color space fields to be correctly populated before calling dc_link_dp_set_test_pattern. [How] Populate stream's test pattern type and color space fields before calling into DC to program DP test pattern. Reviewed-by: Aurabindo Pillai Acked-by: Hersen Wu Signed-off-by: George Shen Signed-off-by: Hersen Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 3 +++ 1 file changed, 3 insertions(+) commit 35c1d9664cbfa3a592c208cff86353c7c7689eef Author: Sung Joon Kim Date: Wed Oct 11 17:12:05 2023 -0400 drm/amd/display: Fix handling duplicate planes on one stream [why] DML2 does not handle the case when we have a single stream sourcing 2 or more planes that are duplicates of one another. To properly handle this scenario, pipe index to plane index mapping is used to decide which plane is being processed and programmed. [how] Create static array of pipe index to plane index map. Populate the array properly and use in appropriate places. Reviewed-by: Xi (Alex) Liu Acked-by: Hersen Wu Signed-off-by: Sung Joon Kim Signed-off-by: Hersen Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher .../amd/display/dc/dml2/dml2_dc_resource_mgmt.c | 45 +++++++++++------- .../drm/amd/display/dc/dml2/dml2_internal_types.h | 3 ++ .../amd/display/dc/dml2/dml2_translation_helper.c | 54 ++++++++++++++++++---- .../amd/display/dc/dml2/dml2_translation_helper.h | 2 +- drivers/gpu/drm/amd/display/dc/dml2/dml2_utils.c | 18 +++++--- drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c | 2 +- 6 files changed, 90 insertions(+), 34 deletions(-) commit ed6e2782e9747508888f671e1101250bb19045be Author: Alvin Lee Date: Mon Oct 23 14:33:16 2023 -0400 drm/amd/display: For cursor P-State allow for SubVP [Description] - Similar to FPO, SubVP should also force cursor P-State allow instead of relying on natural assertion - Implement code path to force and unforce cursor P-State allow for SubVP Reviewed-by: Samson Tam Acked-by: Hersen Wu Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 17 ++--------------- 1 file changed, 2 insertions(+), 15 deletions(-) commit e4c33fff2eae41d16d9760e56efc23dcc30c6b91 Author: Daniel Miess Date: Thu Oct 26 14:34:14 2023 -0400 drm/amd/display: Enable physymclk RCO [Why] Enable the last of the RCO options for dcn35 [How] Breakout RCO from dccg35_set_physymclk so that physymclk RCO can be set in dccg_init without disabling physymclk Reviewed-by: Nicholas Kazlauskas Reviewed-by: Jun Lei Acked-by: Hersen Wu Signed-off-by: Daniel Miess Signed-off-by: Hersen Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dccg.c | 72 ++++++++++++---------- .../gpu/drm/amd/display/dc/dcn35/dcn35_resource.c | 20 +++++- .../gpu/drm/amd/display/dc/hwss/dce/dce_hwseq.h | 18 +++++- .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 24 +++++++- drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h | 5 ++ 5 files changed, 102 insertions(+), 37 deletions(-) commit 90f2f83352f7e85edb38cdb171627ded3d9c7040 Author: Chaitanya Dhere Date: Tue Oct 24 13:10:12 2023 -0400 drm/amd/display: Remove references to unused dml arch version Clean-up the code to remove references of all unused dml architecture versions since only dml2 is actively used. Reviewed-by: Jun Lei Acked-by: Hersen Wu Signed-off-by: Chaitanya Dhere Signed-off-by: Hersen Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher .../gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c | 16 ++-------------- .../gpu/drm/amd/display/dc/dml2/dml2_internal_types.h | 1 - 2 files changed, 2 insertions(+), 15 deletions(-) commit 5c10147464fafbd3850d1f276a75a8825ecbbc0d Author: Aric Cyr Date: Sun Oct 29 21:22:37 2023 -0400 drm/amd/display: Promote DAL to 3.2.259 Summary: - Enable DCN35 physymclk root clock gating - Fix DP automation test pattern bug - Disable OTG for mode timing switch on DCN35 - Refactor DML2 - Revert Fix handling duplicate planes on one stream - Revert Enable DCN clock gating - Implement cursor P-State allow for SubVP - Optimize pipe otg allocation - Save and restore mall state while switching from ODM to Subvp Acked-by: Hersen Wu Signed-off-by: Aric Cyr Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fecbaa0a79adaa632e406ee5cffe5751e2d44fcb Author: Wenjing Liu Date: Fri Oct 20 16:18:40 2023 -0400 drm/amd/display: save and restore mall state when applying minimal transition [why] There is a case when we are switching from ODM combine to Subvp where minimal transition based off subvp state is required. In thise case, we need to save and restore mall state when applying minimal transition. Reviewed-by: Dillon Varone Acked-by: Hersen Wu Signed-off-by: Wenjing Liu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) commit 62893e9794c5ba237af93fa1f67cd04ca823405e Author: Joshua Aberback Date: Wed Oct 25 01:18:04 2023 -0400 drm/amd/display: Remove unused duplicate register definition [Why] DCN32 uses ABM register definitions in dcn32_resource.h, remove duplicate from dce_abm.h to avoid confusion. Reviewed-by: Dillon Varone Acked-by: Hersen Wu Signed-off-by: Joshua Aberback Signed-off-by: Hersen Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dce/dce_abm.h | 15 --------------- 1 file changed, 15 deletions(-) commit 60ccd588d5820fc270bdd75185b5dc0220019e35 Author: Rodrigo Siqueira Date: Fri Oct 20 15:31:24 2023 -0600 drm/amd/display: Create optc.h file For all the components that participate in DCN architecture, there is a header in the dc/inch/hw. For some reason, OPTC broke this pattern and added all the primary functions/structs associated with that in the dcn10_optc.h file. For consistency's sake, this commit introduces a new optc.h file and extracts the code from dcn10_optc to this new file. Reviewed-by: Hamza Mahfooz Acked-by: Hersen Wu Signed-off-by: Rodrigo Siqueira Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher .../drm/amd/display/amdgpu_dm/amdgpu_dm_trace.h | 2 +- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h | 186 +---------------- drivers/gpu/drm/amd/display/dc/inc/hw/optc.h | 219 +++++++++++++++++++++ 3 files changed, 221 insertions(+), 186 deletions(-) commit 3e18d4bd9ac627d8262661272ea1e60631c2608e Author: Ovidiu Bunea Date: Wed Oct 25 13:05:47 2023 -0400 drm/amd/display: Disable OTG for mode timing switch on DCN35 [why] Doing a mode timing change causes a hang when OTG is not disabled. [how] Add link_enc null check in disable_otg_wa to cover this case. Reviewed-by: Nicholas Kazlauskas Acked-by: Hersen Wu Signed-off-by: Ovidiu Bunea Signed-off-by: Hersen Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d0ef62bd109c2af3ba8dc16a6d5ad4a0f30e03dc Author: Dennis Chan Date: Thu Oct 12 23:08:25 2023 +0800 drm/amd/display: Revise Replay Desync Error IRQ handle [Why] Current Desync IRQ handler will have some potential do not hit the desync error case. We change to check both desync error HPD and DPCD. Signed-off-by: Dennis Chan Acked-by: Hersen Wu Reviewed-by: Robin Chen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dc_types.h | 1 + drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_irq_handler.c | 3 +++ 2 files changed, 4 insertions(+) commit 77b2c07d7d3cc1ee11cb64d209d59e57b0ae649b Author: Anthony Koo Date: Sat Oct 21 03:51:08 2023 -0400 drm/amd/display: [FW Promotion] Release 0.0.190.0 - Increase number of bits for IPS boot option Reviewed-by: Aric Cyr Acked-by: Hersen Wu Signed-off-by: Anthony Koo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 51131758c79f3f727318ee468bbb9c22666604e3 Author: Aric Cyr Date: Sun Oct 22 17:26:35 2023 -0400 drm/amd/display: 3.2.258 This version brings along following fixes: Update test link rate DPCD bit field to match spec Enable RCO options for dcn35 Add missing dml2 init value for dcn35 Enable DCN clock gating DCN35 Disable cm power optimization Allow 16 max_slices for DP2 DSC Fix OTG disable workaround logic Enable more IPS options Fix FRL assertion on boot Fix missing blendTF programming Update DP HPO MSA with colorimetry from test request Fix handling duplicate planes on one stream Acked-by: Hersen Wu Signed-off-by: Aric Cyr Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f9e7d4fadc4fbd8083e8dec04fabf870f3f6ae39 Author: Roman Li Date: Thu Oct 19 15:32:55 2023 -0400 drm/amd/display: Add missing dml2 init value for dcn35 [Why] For lighting up, some dml2 params needs to be initialized. One of them escaped initial patch under: "drm/amd/display: Add DCN35 DML2 support" [How] Add missing initialization. Fixes: 115009d11ccf ("drm/amd/display: Add DCN35 DML2 support") Reviewed-by: Harry Wentland Acked-by: Hersen Wu Signed-off-by: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c | 1 + 1 file changed, 1 insertion(+) commit fd7cedccdde3ff9c7d31092787f280631da7b207 Author: Taimur Hassan Date: Tue Oct 10 13:31:19 2023 -0400 drm/amd/display: Fix OTG disable workaround logic [Why] DENTIST was hanging when performing DISPCLK update with OTG enabled, as OTG disable workaround was not executing. [How] Workaround was checking against current_state before running, but when called from optimize_bandwidth (safe_to_lower), we should be checking against context instead. Reviewed-by: Nicholas Kazlauskas Acked-by: Hersen Wu Signed-off-by: Taimur Hassan Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit ce3b32ec4aef7171277c7c8efc07861eac27998c Author: ChunTao Tso Date: Tue Oct 3 17:05:05 2023 +0800 drm/amd/display: amend HPD handler for Replay [Why] For Replay, if we receive HPD, it doesn’t need to reboot the display. We don’t need to return anything exactly. [How] Return nothing just because we don’t need to reboot the display. Signed-off-by: ChunTao Tso Acked-by: Hersen Wu Reviewed-by: Jerry Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher .../drm/amd/display/dc/link/protocols/link_dp_irq_handler.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit 39ad51cb61556892ce8af02b995136cd2711527b Author: Dennis Chan Date: Wed May 3 14:20:17 2023 +0800 drm/amd/display: Introduce flag for disabling Replay desync recovery [why] It's useful to disable the recovery mechanism when debugging replay desync errors. Signed-off-by: Dennis Chan Acked-by: Hersen Wu Reviewed-by: Robin Chen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dc_types.h | 3 ++- drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_irq_handler.c | 3 +++ 2 files changed, 5 insertions(+), 1 deletion(-) commit 85de32cd7b383f5d84195aed0c53e920e6786005 Author: Yihan Zhu Date: Thu Oct 19 14:23:17 2023 -0400 drm/amd/display: DCN35 Disable cm power optimization [WHY & HOW] Enabling SCE after boot up will cause color distortion. Reviewed-by: Ovidiu Bunea Acked-by: Hersen Wu Signed-off-by: Yihan Zhu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn35/dcn35_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 81df7271688cf04a502e3bbd19d0395a986a89e1 Author: George Shen Date: Wed Oct 11 16:32:39 2023 -0400 drm/amd/display: Update DP HPO MSA with colorimetry from test request [Why] Some DP link layer tests request a different colorimetry than the default one that is used. Currently, our test automation logic does not update the MSA with the test request value for DP HPO case. [How] Update HPO MSA colorimetry with test automation request value. Reviewed-by: Wenjing Liu Acked-by: Hersen Wu Signed-off-by: George Shen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit f031ba12082cadd1d827b36ba1d2c76a2395134d Author: George Shen Date: Thu Oct 19 22:03:41 2023 -0400 drm/amd/display: Update test link rate DPCD bit field to match spec [Why] An SCR was made to the DP2.0 spec that updated the bit field definition for UHBR13.5 in the test link rate DPCD register. [How] Add new translation to match the SCR update. Keep old translation for backwards compatibility. Reviewed-by: Wenjing Liu Acked-by: Hersen Wu Signed-off-by: George Shen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 3 ++- drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c | 8 +++++++- 2 files changed, 9 insertions(+), 2 deletions(-) commit 8df0d7d33a58d9394bd1240205e393d5f2bab6c7 Author: Fangzhi Zuo Date: Wed Oct 18 09:38:33 2023 -0400 drm/amd/display: Allow 16 max_slices for DP2 DSC Enable 12 and 16 max_slices for DP2 DSC Reviewed-by: Alvin Lee Acked-by: Hersen Wu Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dsc.c | 10 +++++++++- drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c | 11 +++++++++++ drivers/gpu/drm/amd/display/dc/inc/hw/dsc.h | 2 ++ 3 files changed, 22 insertions(+), 1 deletion(-) commit 92e11f0159f6635bb8b0a7bb427ddb525bccbcb5 Author: Sung Joon Kim Date: Mon Oct 16 11:35:56 2023 -0400 drm/amd/display: Enable more IPS options [why] To help isolate static screen and video playback tests, we want to enable an IPS option to allow IPS only on D3 cycle. [how] Add DISABLE_DYNAMIC and DISABLE_ALL IPS disable flags for user control. Reviewed-by: Jun Lei Acked-by: Hersen Wu Signed-off-by: Sung Joon Kim Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 7 ++++--- drivers/gpu/drm/amd/display/dc/core/dc.c | 4 ++-- drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 9 ++++++--- 3 files changed, 12 insertions(+), 8 deletions(-) commit eacfdc362d3c1eaab517f7c25b089f2536c010f1 Author: Daniel Miess Date: Fri Oct 20 12:31:09 2023 -0400 drm/amd/display: Enable RCO options for dcn35 [Why & How] Enable root clock optimization options for dcn35 for power savings Reviewed-by: Nicholas Kazlauskas Acked-by: Hersen Wu Signed-off-by: Daniel Miess Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dccg.c | 1 + drivers/gpu/drm/amd/display/dc/dcn35/dcn35_resource.c | 16 ++++++++-------- 2 files changed, 9 insertions(+), 8 deletions(-) commit f896cd2686817db915c265ff693a8dad7b6580dc Author: Sung Joon Kim Date: Mon Oct 16 15:23:16 2023 -0400 drm/amd/display: Fix FRL assertion on boot [why] Make sure to ungate the clocks on boot so programming sequence is done successfully. [how] Move the ungate logic after bios init. Reviewed-by: Xi (Alex) Liu Acked-by: Hersen Wu Signed-off-by: Sung Joon Kim Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 566f648c4e028ffd62f533d2e8d7e7f89d0e420c Author: Ilya Bakoulin Date: Fri Oct 13 19:34:58 2023 -0400 drm/amd/display: Fix missing blendTF programming [Why] When MPO surface pixel format is not ARGB8888, fast update can miss programming blendTF. [How] Set the gamma_change update flag on blend_tf change. Reviewed-by: Aric Cyr Acked-by: Hersen Wu Signed-off-by: Ilya Bakoulin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc.c | 3 +++ 1 file changed, 3 insertions(+) commit 5d71a8e336e1553aa685963ba362d951541ce082 Author: Aric Cyr Date: Sun Oct 15 14:28:01 2023 -0400 drm/amd/display: 3.2.257 This version brings along following fixes: On boot disable domain22 force power on decouple dmcub execution to reduce lock granularity Enable fast update on blendTF change Fix blend LUT programming Program plane color setting correctly amend HPD handler for Replay Avoid NULL dereference of timing generator Acked-by: Hersen Wu Signed-off-by: Aric Cyr Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 028bac5834495f4f4036bf8b3206fcdafe99a393 Author: JinZe.Xu Date: Fri Oct 13 09:50:00 2023 +0800 drm/amd/display: decouple dmcub execution to reduce lock granularity [Why] On some systems dmub commands run at high IRQ, so long running commands will block other interrupts. [How] Decouple wait_for_idle from dmcub queue/execute/wait. Reviewed-by: Josip Pavic Acked-by: Hersen Wu Signed-off-by: JinZe.Xu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 74 ++++++++++++++++++++++++++++ drivers/gpu/drm/amd/display/dc/dc_dmub_srv.h | 8 +++ 2 files changed, 82 insertions(+) commit 13c84bbe0524e6a5c8a3d873152c1eaa295e3592 Author: Anthony Koo Date: Sat Oct 14 11:12:13 2023 -0400 drm/amd/display: [FW Promotion] Release 0.0.189.0 - Minor formatting changes - Update defines to match the bit width of the field it is used for - Add new boot up bits to control HW sub block regions power down Reviewed-by: Aric Cyr Acked-by: Hersen Wu Signed-off-by: Anthony Koo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) commit 89830c62e677187a75b25202effbbf6611fc6552 Author: Daniel Miess Date: Fri Oct 13 10:38:09 2023 -0400 drm/amd/display: On boot disable domain22 force power on [Why] HDCP2 enablement fails when domain22 is set to force power on [How] Disable force power on for domain22 on startup Reviewed-by: Nicholas Kazlauskas Acked-by: Hersen Wu Signed-off-by: Daniel Miess Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn35/dcn35_pg_cntl.c | 10 +++++++++- drivers/gpu/drm/amd/display/dc/dcn35/dcn35_pg_cntl.h | 1 + drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 3 +++ drivers/gpu/drm/amd/display/dc/inc/hw/pg_cntl.h | 2 ++ 4 files changed, 15 insertions(+), 1 deletion(-) commit 9256e8d47a2fa0bcb5d32e7fee8c674c476a480f Author: Surbhi Kakarya Date: Mon Sep 25 12:12:10 2023 -0400 drm/amd: Disable XNACK on SRIOV environment The purpose of this patch is to disable XNACK or set XNACK OFF mode on SRIOV platform which doesn't support it. This will prevent user-space application to fail or result into unexpected behaviour whenever the application need to run test-case in XNACK ON mode. Signed-off-by: Surbhi Kakarya Reviewed-by: Shaoyun Liu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 5 ++++- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 10 ++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 1 + drivers/gpu/drm/amd/amdkfd/kfd_process.c | 7 ++++++- 4 files changed, 21 insertions(+), 2 deletions(-) commit 1b0a151c10a6d823f033023b9fdd9af72a89591b Author: Yu Kuai Date: Tue Nov 7 19:12:47 2023 +0800 blk-core: use pr_warn_ratelimited() in bio_check_ro() If one of the underlying disks of raid or dm is set to read-only, then each io will generate new log, which will cause message storm. This environment is indeed problematic, however we can't make sure our naive custormer won't do this, hence use pr_warn_ratelimited() to prevent message storm in this case. Signed-off-by: Yu Kuai Fixes: 57e95e4670d1 ("block: fix and cleanup bio_check_ro") Signed-off-by: Ye Bin Link: https://lore.kernel.org/r/20231107111247.2157820-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe block/blk-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 327462725b0f759f093788dfbcb2f1fd132f956b Author: Li Lingfeng Date: Tue Nov 7 18:34:35 2023 +0800 nbd: fix uaf in nbd_open Commit 4af5f2e03013 ("nbd: use blk_mq_alloc_disk and blk_cleanup_disk") cleans up disk by blk_cleanup_disk() and it won't set disk->private_data as NULL as before. UAF may be triggered in nbd_open() if someone tries to open nbd device right after nbd_put() since nbd has been free in nbd_dev_remove(). Fix this by implementing ->free_disk and free private data in it. Fixes: 4af5f2e03013 ("nbd: use blk_mq_alloc_disk and blk_cleanup_disk") Signed-off-by: Li Lingfeng Reviewed-by: Josef Bacik Link: https://lore.kernel.org/r/20231107103435.2074904-1-lilingfeng@huaweicloud.com Signed-off-by: Jens Axboe drivers/block/nbd.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit df42ee7e22f03de034939d582c4dff19e6030e4f Author: Alexander Koskovich Date: Sun Nov 5 15:29:29 2023 +0000 ALSA: hda: Add ASRock X670E Taichi to denylist Recent AMD platforms expose an HD-audio bus but without any actual codecs, which is internally tied with a USB-audio device, supposedly. It results in "no codecs" error of HD-audio bus driver, and it's nothing but a waste of resources. snd_hda_intel 0000:59:00.6: no codecs found! Signed-off-by: Alexander Koskovich Link: https://lore.kernel.org/r/20231105152834.5620-1-akoskovich@pm.me Signed-off-by: Takashi Iwai sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) commit 26fd31ef9c02a5e91cdb8eea127b056bd7cf0b3b Author: Alex Spataru Date: Sat Nov 4 16:01:52 2023 -0500 ALSA: hda/realtek: Add quirk for ASUS UX7602ZM Enables the SPI-connected CSC35L41 audio amplifier for this laptop model. As of BIOS version 303 it's still necessary to modify the ACPI table to add the related _DSD properties: https://github.com/alex-spataru/asus_zenbook_ux7602zm_sound/ Signed-off-by: Alex Spataru Link: https://lore.kernel.org/r/DS7PR07MB7621BB5BB14F5473D181624CE3A4A@DS7PR07MB7621.namprd07.prod.outlook.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 4ad714df58e646d4b2a454a7dface8ff903911c4 Author: Amir Goldstein Date: Thu Oct 26 23:55:53 2023 +0300 MAINTAINERS: create an entry for exportfs Split the exportfs entry from the nfsd entry and add myself as reviewer. Suggested-by: Chuck Lever Acked-by: Chuck Lever Acked-by: Jeff Layton Signed-off-by: Amir Goldstein Link: https://lore.kernel.org/r/20231026205553.143556-1-amir73il@gmail.com Signed-off-by: Christian Brauner MAINTAINERS | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) commit aba6ab57a910ad4b940c2024d15f2cdbf5b7f76b Author: Dan Carpenter Date: Fri Oct 27 15:05:44 2023 +0300 fbdev: imsttfb: fix a resource leak in probe I've re-written the error handling but the bug is that if init_imstt() fails we need to call iounmap(par->cmap_regs). Fixes: c75f5a550610 ("fbdev: imsttfb: Fix use after free bug in imsttfb_probe") Signed-off-by: Dan Carpenter Signed-off-by: Helge Deller drivers/video/fbdev/imsttfb.c | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) commit e08c30efda21ef4c0ec084a3a9581c220b442ba9 Author: Dan Carpenter Date: Fri Oct 27 15:04:56 2023 +0300 fbdev: imsttfb: fix double free in probe() The init_imstt() function calls framebuffer_release() on error and then the probe() function calls it again. It should only be done in probe. Fixes: 518ecb6a209f ("fbdev: imsttfb: Fix error path of imsttfb_probe()") Signed-off-by: Dan Carpenter Signed-off-by: Helge Deller drivers/video/fbdev/imsttfb.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 3e91a38de1dce97b385d732a5f444264ea8fbd92 Author: Philipp Stanner Date: Thu Nov 2 20:24:03 2023 +0100 fbdev: viafb: use new array-copying-wrapper viafbdev.c utilizes memdup_user() to copy an array from userspace. There is a new wrapper, specifically designed for copying arrays. Use this one instead. Suggested-by: Dave Airlie Signed-off-by: Philipp Stanner Signed-off-by: Helge Deller drivers/video/fbdev/via/viafbdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fc6699d62f5f4facc3e934efd25892fc36050b70 Author: Uwe Kleine-König Date: Fri Nov 3 18:35:58 2023 +0100 fbdev: omapfb: Drop unused remove function OMAP2_VRFB is a bool, so the vrfb driver can never be compiled as a module. With that __exit_p(vrfb_remove) always evaluates to NULL and vrfb_remove() is unused. If the driver was compilable as a module, it would fail to build because the type of vrfb_remove() isn't compatible with struct platform_driver::remove(). (The former returns void, the latter int.) Fixes: aa1e49a3752f ("OMAPDSS: VRFB: add omap_vrfb_supported()") Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller drivers/video/fbdev/omap2/omapfb/vrfb.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit 02d487fa30042fb68392e36f04e51fda266637e7 Author: Christophe JAILLET Date: Sat Oct 21 08:53:37 2023 +0200 fbdev: offb: Simplify offb_init_fb() Turn a strcpy()+strncat()+'\0' into an equivalent snprintf(). Signed-off-by: Christophe JAILLET Signed-off-by: Helge Deller drivers/video/fbdev/offb.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit 7be6adf11370d58f9a7afa50fbf06801db04af5c Author: Andy Shevchenko Date: Wed Oct 18 06:47:25 2023 +0300 fbdev: omapfb: Replace custom memparse() implementation Our library has memparse() for parsing numbers with respective suffixes suitable for memory sizes. Use it instead of custom implementation. Signed-off-by: Andy Shevchenko Signed-off-by: Helge Deller drivers/video/fbdev/omap/omapfb_main.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) commit e89a60ba93c266ee3606adcdd460412c1e7c0924 Author: Andy Shevchenko Date: Wed Oct 18 06:37:50 2023 +0300 fbdev: omapfb: Do not shadow error code from platform_get_irq() There is no point in shadowing the error codes from platform_get_irq(). Refactor omapfb_do_probe() accordingly. Signed-off-by: Andy Shevchenko Signed-off-by: Helge Deller drivers/video/fbdev/omap/omapfb_main.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit 015c9cbcf0ad709079117d27c2094a46e0eadcdb Author: Victor Shih Date: Tue Nov 7 17:57:40 2023 +0800 mmc: sdhci-pci-gli: GL9750: Mask the replay timer timeout of AER Due to a flaw in the hardware design, the GL9750 replay timer frequently times out when ASPM is enabled. As a result, the warning messages will often appear in the system log when the system accesses the GL9750 PCI config. Therefore, the replay timer timeout must be masked. Fixes: d7133797e9e1 ("mmc: sdhci-pci-gli: A workaround to allow GL9750 to enter ASPM L1.2") Signed-off-by: Victor Shih Acked-by: Adrian Hunter Acked-by: Kai-Heng Feng Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20231107095741.8832-2-victorshihgli@gmail.com Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-pci-gli.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 85dd3af64965c1c0eb7373b340a1b1f7773586b0 Author: Victor Shih Date: Tue Nov 7 17:57:41 2023 +0800 mmc: sdhci-pci-gli: GL9755: Mask the replay timer timeout of AER Due to a flaw in the hardware design, the GL9755 replay timer frequently times out when ASPM is enabled. As a result, the warning messages will often appear in the system log when the system accesses the GL9755 PCI config. Therefore, the replay timer timeout must be masked. Fixes: 36ed2fd32b2c ("mmc: sdhci-pci-gli: A workaround to allow GL9755 to enter ASPM L1.2") Signed-off-by: Victor Shih Acked-by: Adrian Hunter Acked-by: Kai-Heng Feng Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20231107095741.8832-3-victorshihgli@gmail.com Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-pci-gli.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 45f2f28bd498fb697d07a38775d55f0f50fee5ca Author: Eugen Hristev Date: Tue Oct 31 13:22:18 2023 +0200 ASoC: SOF: sof-client: trivial: fix comment typo Fix typo s/depndent/dependent Fixes: 6e9548cdb30e ("ASoC: SOF: Convert the generic IPC flood test into SOF client") Signed-off-by: Eugen Hristev Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20231031112218.79136-1-eugen.hristev@collabora.com Signed-off-by: Mark Brown sound/soc/sof/sof-client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 403edfa436286b21f5ffe6856ae5b36396e8966c Author: Ilkka Koskinen Date: Thu Nov 2 11:30:12 2023 -0700 arm64/arm: arm_pmuv3: perf: Don't truncate 64-bit registers The driver used to truncate several 64-bit registers such as PMCEID[n] registers used to describe whether architectural and microarchitectural events in range 0x4000-0x401f exist. Due to discarding the bits, the driver made the events invisible, even if they existed. Moreover, PMCCFILTR and PMCR registers have additional bits in the upper 32 bits. This patch makes them available although they aren't currently used. Finally, functions handling PMXEVCNTR and PMXEVTYPER registers are removed as they not being used at all. Fixes: df29ddf4f04b ("arm64: perf: Abstract system register accesses away") Reported-by: Carl Worth Signed-off-by: Ilkka Koskinen Acked-by: Will Deacon Closes: https://lore.kernel.org/.. Reviewed-by: Anshuman Khandual Link: https://lore.kernel.org/r/20231102183012.1251410-1-ilkka@os.amperecomputing.com Signed-off-by: Catalin Marinas arch/arm/include/asm/arm_pmuv3.h | 48 ++++++++++++++++++-------------------- arch/arm64/include/asm/arm_pmuv3.h | 25 ++++---------------- drivers/perf/arm_pmuv3.c | 6 ++--- 3 files changed, 31 insertions(+), 48 deletions(-) commit 15c7ef7341a2e54cfa12ac502c65d6fd2cce2b62 Author: Ilkka Koskinen Date: Thu Nov 2 17:16:54 2023 -0700 perf: arm_cspmu: Reject events meant for other PMUs Coresight PMU driver didn't reject events meant for other PMUs. This caused some of the Core PMU events disappearing from the output of "perf list". In addition, trying to run e.g. $ perf stat -e r2 sleep 1 made Coresight PMU driver to handle the event instead of letting Core PMU driver to deal with it. Cc: stable@vger.kernel.org Fixes: e37dfd65731d ("perf: arm_cspmu: Add support for ARM CoreSight PMU driver") Signed-off-by: Ilkka Koskinen Acked-by: Will Deacon Reviewed-by: Besar Wicaksono Acked-by: Mark Rutland Reviewed-by: Anshuman Khandual Link: https://lore.kernel.org/r/20231103001654.35565-1-ilkka@os.amperecomputing.com Signed-off-by: Catalin Marinas drivers/perf/arm_cspmu/arm_cspmu.c | 3 +++ 1 file changed, 3 insertions(+) commit 6eeeb4c7e4b5e03405b335fa7ce340922b7ce089 Author: Marielle Novastrider Date: Tue Oct 31 20:08:38 2023 +0000 Documentation/arm64: Fix typos in elf_hwcaps Small typos in register and field names. Signed-off-by: Marielle Novastrider Acked-by: Will Deacon Link: https://lore.kernel.org/r/20231031200838.55569-1-marielle@novastrider.com Signed-off-by: Catalin Marinas Documentation/arch/arm64/elf_hwcaps.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 64bc7eee421fafc5d491d65bff74f46430fe61af Author: Christian Brauner Date: Tue Nov 7 10:50:38 2023 +0100 iomap: rename iomap entry Since this is now part of the vfs trees rename it accordingly and remove the old tree referencing xfs. Signed-off-by: Christian Brauner MAINTAINERS | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) commit 9aedd10fe38418319bd8ed55dc68a40ec04aaa05 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Tue Nov 7 02:37:17 2023 +0000 crypto: ahash - Set using_shash for cloned ahash wrapper over shash The cloned child of ahash that uses shash under the hood should use shash helpers (like crypto_shash_setkey()). The following panic may be observed on TCP-AO selftests: > ================================================================== > BUG: KASAN: wild-memory-access in crypto_mod_get+0x1b/0x60 > Write of size 4 at addr 5d5be0ff5c415e14 by task connect_ipv4/1397 > > CPU: 0 PID: 1397 Comm: connect_ipv4 Tainted: G W 6.6.0+ #47 > Call Trace: > > dump_stack_lvl+0x46/0x70 > kasan_report+0xc3/0xf0 > kasan_check_range+0xec/0x190 > crypto_mod_get+0x1b/0x60 > crypto_spawn_alg+0x53/0x140 > crypto_spawn_tfm2+0x13/0x60 > hmac_init_tfm+0x25/0x60 > crypto_ahash_setkey+0x8b/0x100 > tcp_ao_add_cmd+0xe7a/0x1120 > do_tcp_setsockopt+0x5ed/0x12a0 > do_sock_setsockopt+0x82/0x100 > __sys_setsockopt+0xe9/0x160 > __x64_sys_setsockopt+0x60/0x70 > do_syscall_64+0x3c/0xe0 > entry_SYSCALL_64_after_hwframe+0x46/0x4e > ================================================================== > general protection fault, probably for non-canonical address 0x5d5be0ff5c415e14: 0000 [#1] PREEMPT SMP KASAN > CPU: 0 PID: 1397 Comm: connect_ipv4 Tainted: G B W 6.6.0+ #47 > Call Trace: > > ? die_addr+0x3c/0xa0 > ? exc_general_protection+0x144/0x210 > ? asm_exc_general_protection+0x22/0x30 > ? add_taint+0x26/0x90 > ? crypto_mod_get+0x20/0x60 > ? crypto_mod_get+0x1b/0x60 > ? ahash_def_finup_done1+0x58/0x80 > crypto_spawn_alg+0x53/0x140 > crypto_spawn_tfm2+0x13/0x60 > hmac_init_tfm+0x25/0x60 > crypto_ahash_setkey+0x8b/0x100 > tcp_ao_add_cmd+0xe7a/0x1120 > do_tcp_setsockopt+0x5ed/0x12a0 > do_sock_setsockopt+0x82/0x100 > __sys_setsockopt+0xe9/0x160 > __x64_sys_setsockopt+0x60/0x70 > do_syscall_64+0x3c/0xe0 > entry_SYSCALL_64_after_hwframe+0x46/0x4e > > RIP: 0010:crypto_mod_get+0x20/0x60 Make sure that the child/clone has using_shash set when parent is an shash user. Fixes: 2f1f34c1bf7b ("crypto: ahash - optimize performance when wrapping shash") Cc: David Ahern Cc: "David S. Miller" Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Eric Biggers Cc: Eric Dumazet Cc: Francesco Ruggeri To: Herbert Xu Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Salam Noureddine Cc: netdev@vger.kernel.org Cc: linux-crypto@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Dmitry Safonov Reviewed-by: Eric Biggers Signed-off-by: Herbert Xu crypto/ahash.c | 1 + 1 file changed, 1 insertion(+) commit e7ed6473c2c8c4e45dd861bfa06e96189b11d8db Author: Herbert Xu Date: Mon Nov 6 18:00:08 2023 +0800 crypto: jitterentropy - Hide esoteric Kconfig options under FIPS and EXPERT As JITTERENTROPY is selected by default if you enable the CRYPTO API, any Kconfig options added there will show up for every single user. Hide the esoteric options under EXPERT as well as FIPS so that only distro makers will see them. Reported-by: Linus Torvalds Signed-off-by: Herbert Xu Reviewed-by: Stephan Mueller Signed-off-by: Herbert Xu crypto/Kconfig | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) commit f367db71d5755d6476dd6f3d84b53c098c111255 Merge: e0c0a7c35f67 62b78fd5fe39 Author: Palmer Dabbelt Date: Mon Nov 6 22:49:30 2023 -0800 Merge patch series "riscv: tlb flush improvements" Alexandre Ghiti says: This series optimizes the tlb flushes on riscv which used to simply flush the whole tlb whatever the size of the range to flush or the size of the stride. Patch 3 introduces a threshold that is microarchitecture specific and will very likely be modified by vendors, not sure though which mechanism we'll use to do that (dt? alternatives? vendor initialization code?). * b4-shazam-merge: riscv: Improve flush_tlb_kernel_range() riscv: Make __flush_tlb_range() loop over pte instead of flushing the whole tlb riscv: Improve flush_tlb_range() for hugetlb pages riscv: Improve tlb_flush() Link: https://lore.kernel.org/r/20231030133027.19542-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 62b78fd5fe39b5b82e4b4b8d0ba87ad40d1a99bb Author: Alexandre Ghiti Date: Mon Oct 30 14:30:28 2023 +0100 riscv: Improve flush_tlb_kernel_range() This function used to simply flush the whole tlb of all harts, be more subtile and try to only flush the range. The problem is that we can only use PAGE_SIZE as stride since we don't know the size of the underlying mapping and then this function will be improved only if the size of the region to flush is < threshold * PAGE_SIZE. Signed-off-by: Alexandre Ghiti Reviewed-by: Andrew Jones Tested-by: Lad Prabhakar # On RZ/Five SMARC Reviewed-by: Samuel Holland Tested-by: Samuel Holland Link: https://lore.kernel.org/r/20231030133027.19542-5-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/tlbflush.h | 11 ++++++----- arch/riscv/mm/tlbflush.c | 34 ++++++++++++++++++++++++---------- 2 files changed, 30 insertions(+), 15 deletions(-) commit ba6f35964c518b4520bc3f2fe25d8457cb4a7be5 Author: Alexandre Ghiti Date: Mon Oct 30 14:30:27 2023 +0100 riscv: Make __flush_tlb_range() loop over pte instead of flushing the whole tlb Currently, when the range to flush covers more than one page (a 4K page or a hugepage), __flush_tlb_range() flushes the whole tlb. Flushing the whole tlb comes with a greater cost than flushing a single entry so we should flush single entries up to a certain threshold so that: threshold * cost of flushing a single entry < cost of flushing the whole tlb. Co-developed-by: Mayuresh Chitale Signed-off-by: Mayuresh Chitale Signed-off-by: Alexandre Ghiti Reviewed-by: Andrew Jones Tested-by: Lad Prabhakar # On RZ/Five SMARC Reviewed-by: Samuel Holland Tested-by: Samuel Holland Link: https://lore.kernel.org/r/20231030133027.19542-4-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/sbi.h | 3 - arch/riscv/include/asm/tlbflush.h | 3 + arch/riscv/kernel/sbi.c | 32 ++++------- arch/riscv/mm/tlbflush.c | 115 +++++++++++++++++++------------------- 4 files changed, 72 insertions(+), 81 deletions(-) commit 9e113064b4c291ad06a7a3864691288bd2cf014f Author: Alexandre Ghiti Date: Mon Oct 30 14:30:26 2023 +0100 riscv: Improve flush_tlb_range() for hugetlb pages flush_tlb_range() uses a fixed stride of PAGE_SIZE and in its current form, when a hugetlb mapping needs to be flushed, flush_tlb_range() flushes the whole tlb: so set a stride of the size of the hugetlb mapping in order to only flush the hugetlb mapping. However, if the hugepage is a NAPOT region, all PTEs that constitute this mapping must be invalidated, so the stride size must actually be the size of the PTE. Note that THPs are directly handled by flush_pmd_tlb_range(). Signed-off-by: Alexandre Ghiti Reviewed-by: Samuel Holland Tested-by: Lad Prabhakar # On RZ/Five SMARC Link: https://lore.kernel.org/r/20231030133027.19542-3-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/mm/tlbflush.c | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) commit 114d5c85a39a0e35024ff5156a160eef1907f3e6 Author: Alexandre Ghiti Date: Mon Oct 30 14:30:25 2023 +0100 riscv: Improve tlb_flush() For now, tlb_flush() simply calls flush_tlb_mm() which results in a flush of the whole TLB. So let's use mmu_gather fields to provide a more fine-grained flush of the TLB. Signed-off-by: Alexandre Ghiti Reviewed-by: Andrew Jones Reviewed-by: Samuel Holland Tested-by: Lad Prabhakar # On RZ/Five SMARC Link: https://lore.kernel.org/r/20231030133027.19542-2-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/tlb.h | 8 +++++++- arch/riscv/include/asm/tlbflush.h | 3 +++ arch/riscv/mm/tlbflush.c | 7 +++++++ 3 files changed, 17 insertions(+), 1 deletion(-) commit 644b6025bcaff59737270d812c70302f5a8d4a8f Author: Nathan Lynch Date: Mon Nov 6 07:42:54 2023 -0600 powerpc/rtas: Fix ppc_rtas_rmo_buf_show() kernel-doc >From a W=1 build: >> arch/powerpc/kernel/rtas-proc.c:771: warning: Function parameter or member 'm' not described in >> 'ppc_rtas_rmo_buf_show' >> arch/powerpc/kernel/rtas-proc.c:771: warning: Function parameter or member 'v' not described in >> 'ppc_rtas_rmo_buf_show' Add the missing parameter descriptions. Signed-off-by: Nathan Lynch Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202309211645.1Lvwmbv4-lkp@intel.com/ Signed-off-by: Michael Ellerman Link: https://msgid.link/20231106-rtas-trivial-v1-2-61847655c51f@linux.ibm.com arch/powerpc/kernel/rtas-proc.c | 2 ++ 1 file changed, 2 insertions(+) commit 65083333d3d16b282674aeef5cce5c72226c05e0 Author: Nathan Lynch Date: Mon Nov 6 07:42:53 2023 -0600 powerpc/pseries/rtas-work-area: Fix rtas_work_area_reserve_arena() kernel-doc >From a W=1 build: >> arch/powerpc/platforms/pseries/rtas-work-area.c:189: warning: Function parameter or member 'limit' not >> described in 'rtas_work_area_reserve_arena' Add the missing description of the limit parameter. Signed-off-by: Nathan Lynch Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202309131221.Bm1pg96n-lkp@intel.com/ Signed-off-by: Michael Ellerman Link: https://msgid.link/20231106-rtas-trivial-v1-1-61847655c51f@linux.ibm.com arch/powerpc/platforms/pseries/rtas-work-area.c | 1 + 1 file changed, 1 insertion(+) commit 115c0f4d58574524ed7fbbcce1b0a86aa5249db1 Author: Eric Dumazet Date: Fri Nov 3 20:04:51 2023 +0000 idpf: fix potential use-after-free in idpf_tso() skb_cow_head() can change skb->head (and thus skb_shinfo(skb)) We must not cache skb_shinfo(skb) before skb_cow_head(). Fixes: 6818c4d5b3c2 ("idpf: add splitq start_xmit") Signed-off-by: Eric Dumazet Cc: Joshua Hay Cc: Alan Brady Cc: Madhu Chittim Cc: Phani Burra Cc: Sridhar Samudrala Cc: Willem de Bruijn Cc: Pavan Kumar Linga Cc: Tony Nguyen Cc: Bailey Forrest Reviewed-by: Jacob Keller Link: https://lore.kernel.org/r/20231103200451.514047-1-edumazet@google.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/idpf/idpf_txrx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 9fc3bc7643341dc5be7d269f3d3dbe441d8d7ac3 Author: George Shuklin Date: Fri Nov 3 13:50:29 2023 +0200 tg3: power down device only on SYSTEM_POWER_OFF Dell R650xs servers hangs on reboot if tg3 driver calls tg3_power_down. This happens only if network adapters (BCM5720 for R650xs) were initialized using SNP (e.g. by booting ipxe.efi). The actual problem is on Dell side, but this fix allows servers to come back alive after reboot. Signed-off-by: George Shuklin Fixes: 2ca1c94ce0b6 ("tg3: Disable tg3 device on system reboot to avoid triggering AER") Reviewed-by: Pavan Chebbi Reviewed-by: Michael Chan Link: https://lore.kernel.org/r/20231103115029.83273-1-george.shuklin@gmail.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/tg3.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 68c51db3a16d258e730dd1c04a1de2f7ab038ddf Author: Marcin Szycik Date: Wed Oct 25 16:47:24 2023 +0200 ice: Fix VF-VF direction matching in drop rule in switchdev When adding a drop rule on a VF, rule direction is not being set, which results in it always being set to ingress (ICE_ESWITCH_FLTR_INGRESS equals 0). Because of this, drop rules added on port representors don't match any packets. To fix it, set rule direction in drop action to egress when netdev is a port representor, otherwise set it to ingress. Fixes: 0960a27bd479 ("ice: Add direction metadata") Reviewed-by: Michal Swiatkowski Signed-off-by: Marcin Szycik Tested-by: Sujai Buvaneswaran Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_tc_lib.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) commit 8b3c8c55ccbc02920b0ae6601c66df24f0d833bd Author: Aniruddha Paul Date: Fri Oct 13 19:13:42 2023 +0530 ice: Fix VF-VF filter rules in switchdev mode Any packet leaving VSI i.e VF's VSI is considered as egress traffic by HW, thus failing to match the added rule. Mark the direction for redirect rules as below: 1. VF-VF - Egress 2. Uplink-VF - Ingress 3. VF-Uplink - Egress 4. Link_Partner-Uplink - Ingress 5. Link_Partner-VF - Ingress Fixes: 0960a27bd479 ("ice: Add direction metadata") Reviewed-by: Przemek Kitszel Reviewed-by: Wojciech Drewek Signed-off-by: Aniruddha Paul Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_tc_lib.c | 90 ++++++++++++++++++++--------- 1 file changed, 62 insertions(+), 28 deletions(-) commit e1db8c2a01d7e12bd566106fbeefa3c5cccd2003 Author: Michal Schmidt Date: Mon Oct 23 12:59:53 2023 +0200 ice: lag: in RCU, use atomic allocation Sleeping is not allowed in RCU read-side critical sections. Use atomic allocations under rcu_read_lock. Fixes: 1e0f9881ef79 ("ice: Flesh out implementation of support for SRIOV on bonded interface") Fixes: 41ccedf5ca8f ("ice: implement lag netdev event handler") Fixes: 3579aa86fb40 ("ice: update reset path for SRIOV LAG support") Signed-off-by: Michal Schmidt Reviewed-by: Wojciech Drewek Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_lag.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 3e39da4fa16c9c09207d98b8a86a6f6436b531c9 Author: Dave Ertman Date: Tue Oct 10 10:32:15 2023 -0700 ice: Fix SRIOV LAG disable on non-compliant aggregate If an attribute of an aggregate interface disqualifies it from supporting SRIOV, the driver will unwind the SRIOV support. Currently the driver is clearing the feature bit for all interfaces in the aggregate, but this is not allowing the other interfaces to unwind successfully on driver unload. Only clear the feature bit for the interface that is currently unwinding. Fixes: bf65da2eb279 ("ice: enforce interface eligibility and add messaging for SRIOV LAG") Signed-off-by: Dave Ertman Reviewed-by: Wojciech Drewek Reviewed-by: Simon Horman Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_lag.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) commit e0c0a7c35f67191152635e5913f76aa7094d967c Author: Andreas Schwab Date: Tue Oct 31 12:40:47 2023 +0100 riscv: select ARCH_PROC_KCORE_TEXT This adds a separate segment for kernel text in /proc/kcore, which has a different address than the direct linear map. Signed-off-by: Andreas Schwab Link: https://lore.kernel.org/r/mvmh6m758ao.fsf@suse.de Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 3 +++ 1 file changed, 3 insertions(+) commit aa54d846f3613fa9651786308c6f438e8705aff1 Author: Ivan Vecera Date: Tue Oct 24 14:51:09 2023 +0200 i40e: Fix devlink port unregistering Ensure that devlink port is unregistered after unregistering of net device. Reproducer: [root@host ~]# rmmod i40e [ 4742.939386] i40e 0000:02:00.1: i40e_ptp_stop: removed PHC on enp2s0f1np1 [ 4743.059269] ------------[ cut here ]------------ [ 4743.063900] WARNING: CPU: 21 PID: 10766 at net/devlink/port.c:1078 devl_port_unregister+0x69/0x80 ... Fixes: 9e479d64dc58 ("i40e: Add initial devlink support") Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/i40e/i40e_main.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit e96fe283c6f45dd888536ccb7b0464569533f791 Author: Ivan Vecera Date: Tue Oct 24 14:51:08 2023 +0200 i40e: Do not call devlink_port_type_clear() Do not call devlink_port_type_clear() prior devlink port unregister and let devlink core to take care about it. Reproducer: [root@host ~]# rmmod i40e [ 4539.964699] i40e 0000:02:00.0: devlink port type for port 0 cleared without a software interface reference, device type not supported by the kernel? [ 4540.319811] i40e 0000:02:00.1: devlink port type for port 1 cleared without a software interface reference, device type not supported by the kernel? Fixes: 9e479d64dc58 ("i40e: Add initial devlink support") Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/i40e/i40e_devlink.c | 1 - 1 file changed, 1 deletion(-) commit cdd5b5a9761fd66d17586e4f4ba6588c70e640ea Merge: 5c15c60e7be6 28d3fe323547 Author: Dmitry Torokhov Date: Mon Nov 6 15:42:08 2023 -0800 Merge branch 'next' into for-linus Prepare input updates for 6.7 merge window. commit be3ca57cfb777ad820c6659d52e60bbdd36bf5ff Merge: d2f51b3516da 3e238417254b Author: Linus Torvalds Date: Mon Nov 6 15:06:06 2023 -0800 Merge tag 'media/v6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - the old V4L2 core videobuf kAPI was finally removed. All media drivers should now be using VB2 kAPI - new automotive driver: mgb4 - new platform video driver: npcm-video - new sensor driver: mt9m114 - new TI driver used in conjunction with Cadence CSI2RX IP to bridge TI-specific parts - ir-rx51 was removed and the N900 DT binding was moved to the pwm-ir-tx generic driver - drop atomisp-specific ov5693, using the upstream driver instead - the camss driver has gained RDI3 support for VFE 17x - the atomisp driver now detects ISP2400 or ISP2401 at run time. No need to set it up at build time anymore - lots of driver fixes, cleanups and improvements * tag 'media/v6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (377 commits) media: nuvoton: VIDEO_NPCM_VCD_ECE should depend on ARCH_NPCM media: venus: Fix firmware path for resources media: venus: hfi_cmds: Replace one-element array with flex-array member and use __counted_by media: venus: hfi_parser: Add check to keep the number of codecs within range media: venus: hfi: add checks to handle capabilities from firmware media: venus: hfi: fix the check to handle session buffer requirement media: venus: hfi: add checks to perform sanity on queue pointers media: platform: cadence: select MIPI_DPHY dependency media: MAINTAINERS: Fix path for J721E CSI2RX bindings media: cec: meson: always include meson sub-directory in Makefile media: videobuf2: Fix IS_ERR checking in vb2_dc_put_userptr() media: platform: mtk-mdp3: fix uninitialized variable in mdp_path_config() media: mediatek: vcodec: using encoder device to alloc/free encoder memory media: imx-jpeg: notify source chagne event when the first picture parsed media: cx231xx: Use EP5_BUF_SIZE macro media: siano: Drop unnecessary error check for debugfs_create_dir/file() media: mediatek: vcodec: Handle invalid encoder vsi media: aspeed: Drop unnecessary error check for debugfs_create_file() Documentation: media: buffer.rst: fix V4L2_BUF_FLAG_PREPARED Documentation: media: gen-errors.rst: fix confusing ENOTTY description ... commit e53759298a7d7e98c3e5c2440d395d19cea7d6bf Author: Dylan Yudaken Date: Mon Nov 6 20:39:09 2023 +0000 io_uring: do not clamp read length for multishot read When doing a multishot read, the code path reuses the old read paths. However this breaks an assumption built into those paths, namely that struct io_rw::len is available for reuse by __io_import_iovec. For multishot this results in len being set for the first receive call, and then subsequent calls are clamped to that buffer length incorrectly. Instead keep len as zero after recycling buffers, to reuse the full buffer size of the next selected buffer. Fixes: fc68fcda0491 ("io_uring/rw: add support for IORING_OP_READ_MULTISHOT") Signed-off-by: Dylan Yudaken Link: https://lore.kernel.org/r/20231106203909.197089-4-dyudaken@gmail.com Signed-off-by: Jens Axboe io_uring/rw.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 49fbe99486786661994a55ced855c31d966bbdf0 Author: Dylan Yudaken Date: Mon Nov 6 20:39:08 2023 +0000 io_uring: do not allow multishot read to set addr or len For addr: this field is not used, since buffer select is forced. But by forcing it to be zero it leaves open future uses of the field. len is actually usable, you could imagine that you want to receive multishot up to a certain length. However right now this is not how it is implemented, and it seems safer to force this to be zero. Fixes: fc68fcda0491 ("io_uring/rw: add support for IORING_OP_READ_MULTISHOT") Signed-off-by: Dylan Yudaken Link: https://lore.kernel.org/r/20231106203909.197089-3-dyudaken@gmail.com Signed-off-by: Jens Axboe io_uring/rw.c | 4 ++++ 1 file changed, 4 insertions(+) commit 89d528ba2f8281de61163c6b62e598b64d832175 Author: Dylan Yudaken Date: Mon Nov 6 20:39:07 2023 +0000 io_uring: indicate if io_kbuf_recycle did recycle anything It can be useful to know if io_kbuf_recycle did actually recycle the buffer on the request, or if it left the request alone. Signed-off-by: Dylan Yudaken Link: https://lore.kernel.org/r/20231106203909.197089-2-dyudaken@gmail.com Signed-off-by: Jens Axboe io_uring/kbuf.c | 6 +++--- io_uring/kbuf.h | 13 ++++++++----- 2 files changed, 11 insertions(+), 8 deletions(-) commit 4cc0d8a3f109fbdd8100ed88fc9417203a5d5b4e Author: Clément Léger Date: Tue Oct 24 15:26:53 2023 +0200 riscv: kernel: Use correct SYM_DATA_*() macro for data Some data were incorrectly annotated with SYM_FUNC_*() instead of SYM_DATA_*() ones. Use the correct ones. Signed-off-by: Clément Léger Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20231024132655.730417-4-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/entry.S | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit 76329c693924d8f37afbf361f0d8daab594e1644 Author: Clément Léger Date: Tue Oct 24 15:26:52 2023 +0200 riscv: Use SYM_*() assembly macros instead of deprecated ones ENTRY()/END()/WEAK() macros are deprecated and we should make use of the new SYM_*() macros [1] for better annotation of symbols. Replace the deprecated ones with the new ones and fix wrong usage of END()/ENDPROC() to correctly describe the symbols. [1] https://docs.kernel.org/core-api/asm-annotations.html Signed-off-by: Clément Léger Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20231024132655.730417-3-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/copy-unaligned.S | 8 ++++---- arch/riscv/kernel/fpu.S | 8 ++++---- arch/riscv/kernel/head.S | 12 ++++++------ arch/riscv/kernel/hibernate-asm.S | 12 ++++++------ arch/riscv/kernel/mcount-dyn.S | 20 ++++++++------------ arch/riscv/kernel/mcount.S | 8 ++++---- arch/riscv/kernel/probes/rethook_trampoline.S | 4 ++-- arch/riscv/kernel/suspend_entry.S | 4 ++-- arch/riscv/kernel/vdso/flush_icache.S | 4 ++-- arch/riscv/kernel/vdso/getcpu.S | 4 ++-- arch/riscv/kernel/vdso/rt_sigreturn.S | 4 ++-- arch/riscv/kernel/vdso/sys_hwprobe.S | 4 ++-- arch/riscv/lib/memcpy.S | 6 +++--- arch/riscv/lib/memmove.S | 3 +-- arch/riscv/lib/memset.S | 6 +++--- arch/riscv/lib/uaccess.S | 11 +++++------ arch/riscv/purgatory/entry.S | 16 ++++------------ 17 files changed, 60 insertions(+), 74 deletions(-) commit b18f7296fbfdb2ad0871f00f3042fc74663d52ac Author: Clément Léger Date: Tue Oct 24 15:26:51 2023 +0200 riscv: use ".L" local labels in assembly when applicable For the sake of coherency, use local labels in assembly when applicable. This also avoid kprobes being confused when applying a kprobe since the size of function is computed by checking where the next visible symbol is located. This might end up in computing some function size to be way shorter than expected and thus failing to apply kprobes to the specified offset. Signed-off-by: Clément Léger Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20231024132655.730417-2-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/entry.S | 6 +++--- arch/riscv/kernel/head.S | 18 ++++++++-------- arch/riscv/kernel/mcount.S | 10 ++++----- arch/riscv/lib/memmove.S | 54 +++++++++++++++++++++++----------------------- 4 files changed, 44 insertions(+), 44 deletions(-) commit 57a4542cb7c9baa1509c3366b57a08d75b212ead Author: Geert Uytterhoeven Date: Tue Oct 24 16:53:18 2023 +0200 riscv: boot: Fix creation of loader.bin When flashing loader.bin for K210 using kflash:     [ERROR] This is an ELF file and cannot be programmed to flash directly: arch/riscv/boot/loader.bin Before, loader.bin relied on "OBJCOPYFLAGS := -O binary" in the main RISC-V Makefile to create a boot image with the right format. With this removed, the image is now created in the wrong (ELF) format. Fix this by adding an explicit rule. Fixes: 505b02957e74f0c5 ("riscv: Remove duplicate objcopy flag") Signed-off-by: Geert Uytterhoeven Reviewed-by: Damien Le Moal Link: https://lore.kernel.org/r/1086025809583809538dfecaa899892218f44e7e.1698159066.git.geert+renesas@glider.be Signed-off-by: Palmer Dabbelt arch/riscv/boot/Makefile | 1 + 1 file changed, 1 insertion(+) commit 4733b65d82bdb19bca5ba47ff6c9b24bce1b3f9f Author: Hannes Reinecke Date: Tue Oct 24 08:13:37 2023 +0200 nvme: start keep-alive after admin queue setup Setting up I/O queues might take quite some time on larger and/or busy setups, so KATO might expire before all I/O queues could be set up. Fix this by start keep alive from the ->init_ctrl_finish() callback, and stopping it when calling nvme_cancel_admin_tagset(). Signed-off-by: Hannes Reinecke Tested-by: Mark O'Donovan [fixed nvme-fc compile error] Signed-off-by: Keith Busch drivers/nvme/host/core.c | 6 +++--- drivers/nvme/host/fc.c | 6 ++++++ 2 files changed, 9 insertions(+), 3 deletions(-) commit 23816724fdbd47c28bc998866fd7bc5ad9f0e535 Author: Yuran Pereira Date: Sun Nov 5 13:18:08 2023 +0530 kdb: Corrects comment for kdballocenv This patch corrects the comment for the kdballocenv function. The previous comment incorrectly described the function's parameters and return values. Signed-off-by: Yuran Pereira Link: https://lore.kernel.org/r/DB3PR10MB6835B383B596133EDECEA98AE8ABA@DB3PR10MB6835.EURPRD10.PROD.OUTLOOK.COM [daniel.thompson@linaro.org: fixed whitespace alignment in new lines] Signed-off-by: Daniel Thompson kernel/debug/kdb/kdb_main.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 55adcdbbdd349de935de677ccb59ff8be8c67f6a Author: Hannes Reinecke Date: Tue Oct 24 08:13:36 2023 +0200 nvme-loop: always quiesce and cancel commands before destroying admin q Once ->init_ctrl_finish() is called there may be commands outstanding, so we should quiesce the admin queue and cancel all commands prior to call nvme_loop_destroy_admin_queue(). Signed-off-by: Hannes Reinecke Tested-by: Mark O'Donovan Signed-off-by: Keith Busch drivers/nvme/target/loop.c | 4 ++++ 1 file changed, 4 insertions(+) commit fd1418de10b9ca03d78404cf00a95138689ea369 Author: Hannes Reinecke Date: Tue Oct 24 08:13:35 2023 +0200 nvme-tcp: avoid open-coding nvme_tcp_teardown_admin_queue() nvme_tcp_setup_ctrl() has an open-coded version of nvme_tcp_teardown_admin_queue(). Signed-off-by: Hannes Reinecke Tested-by: Mark O'Donovan Signed-off-by: Keith Busch drivers/nvme/host/tcp.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 6f66d046eade7a5b979e349ac52026ddfe2776b3 Author: Mark O'Donovan Date: Wed Oct 25 10:51:25 2023 +0000 nvme-auth: always set valid seq_num in dhchap reply Currently a seqnum of zero is sent during uni-directional authentication. The zero value is reserved for the secure channel feature which is not yet implemented. Relevant extract from the spec: The value 0h is used to indicate that bidirectional authentication is not performed, but a challenge value C2 is carried in order to generate a pre-shared key (PSK) for subsequent establishment of a secure channel Signed-off-by: Mark O'Donovan Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke drivers/nvme/host/auth.c | 3 +-- drivers/nvme/target/fabrics-cmd-auth.c | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) commit fc1e03eacac8e5ff8664ce2ebadabba8604f09f4 Author: Mark O'Donovan Date: Wed Oct 25 10:51:24 2023 +0000 nvme-auth: add flag for bi-directional auth Introduces an explicit variable for bi-directional auth. The currently used variable chap->s2 is incorrectly zeroed for uni-directional auth. That will be fixed in the next patch so this needs to change to avoid sending unexpected success2 messages Signed-off-by: Mark O'Donovan Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke drivers/nvme/host/auth.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 75276847f4e262a52ccaf1a1c6b929280ddf77f6 Author: Mark O'Donovan Date: Wed Oct 25 10:51:23 2023 +0000 nvme-auth: auth success1 msg always includes resp In cases where RVALID is false, the response is still transmitted, but is cleared to zero. Relevant extract from the spec: Response R2, if valid (i.e., if the RVALID field is set to 01h), cleared to 0h otherwise Signed-off-by: Mark O'Donovan Reviewed-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig drivers/nvme/host/auth.c | 5 +---- include/linux/nvme.h | 2 +- 2 files changed, 2 insertions(+), 5 deletions(-) commit 1147dd0503564fa0e03489a039f9e0c748a03db4 Author: Anuj Gupta Date: Thu Oct 19 00:54:30 2023 +0530 nvme: fix error-handling for io_uring nvme-passthrough Driver may return an error before submitting the command to the device. Ensure that such error is propagated up. Fixes: 456cba386e94 ("nvme: wire-up uring-cmd support for io-passthru on char-device.") Signed-off-by: Anuj Gupta Signed-off-by: Kanchan Joshi Reviewed-by: Niklas Cassel Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/host/ioctl.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 983a338b96c8a25b81e773b643f80634358e81bc Author: Daniel Wagner Date: Mon Oct 30 17:00:44 2023 +0100 nvme: update firmware version after commit The firmware version sysfs entry needs to be updated after a successfully firmware activation. nvme-cli stopped issuing an Identify Controller command to list the current firmware information and relies on sysfs showing the current firmware version. Reported-by: Kenji Tomonaga Signed-off-by: Daniel Wagner Tested-by: Kenji Tomonaga Reviewed-by: Christoph Hellwig Reviewed-by: Niklas Cassel [fixed off-by one afi index] Signed-off-by: Keith Busch drivers/nvme/host/core.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) commit 0e32fdd7968eb9a39aa4d4111aef0fda8684af9e Author: Christophe JAILLET Date: Mon Oct 30 15:49:28 2023 +0100 nvme-tcp: Fix a memory leak All error handling path end to the error handling path, except this one. Go to the error handling branch as well here, otherwise 'icreq' and 'icresp' will leak. Fixes: 2837966ab2a8 ("nvme-tcp: control message handling for recvmsg()") Signed-off-by: Christophe JAILLET Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/host/tcp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 744eac783f9e105358eed05b42dcc5c5789744b3 Author: Eric Biggers Date: Sat Oct 28 22:00:40 2023 -0700 nvme-auth: use crypto_shash_tfm_digest() Simplify nvme_auth_augmented_challenge() by using crypto_shash_tfm_digest() instead of an alloc+init+update+final sequence. This should also improve performance. Signed-off-by: Eric Biggers Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/common/auth.c | 23 ++--------------------- 1 file changed, 2 insertions(+), 21 deletions(-) commit 9ba91d1356db3ad4df7c79d5284bc1427d51c03b Merge: dbfbda3bd6bf 5e22bfd520ea Author: Palmer Dabbelt Date: Mon Nov 6 07:20:54 2023 -0800 Merge patch series "riscv: tlb flush improvements" Alexandre Ghiti says: This series optimizes the tlb flushes on riscv which used to simply flush the whole tlb whatever the size of the range to flush or the size of the stride. Patch 3 introduces a threshold that is microarchitecture specific and will very likely be modified by vendors, not sure though which mechanism we'll use to do that (dt? alternatives? vendor initialization code?). * b4-shazam-merge: riscv: Improve flush_tlb_kernel_range() riscv: Make __flush_tlb_range() loop over pte instead of flushing the whole tlb riscv: Improve flush_tlb_range() for hugetlb pages riscv: Improve tlb_flush() Link: https://lore.kernel.org/r/20231030133027.19542-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit 5e22bfd520ea8740e9a20314d2a890baf304c9d2 Author: Alexandre Ghiti Date: Mon Oct 30 14:30:28 2023 +0100 riscv: Improve flush_tlb_kernel_range() This function used to simply flush the whole tlb of all harts, be more subtile and try to only flush the range. The problem is that we can only use PAGE_SIZE as stride since we don't know the size of the underlying mapping and then this function will be improved only if the size of the region to flush is < threshold * PAGE_SIZE. Signed-off-by: Alexandre Ghiti Reviewed-by: Andrew Jones Tested-by: Lad Prabhakar # On RZ/Five SMARC Reviewed-by: Samuel Holland Tested-by: Samuel Holland Link: https://lore.kernel.org/r/20231030133027.19542-5-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/tlbflush.h | 11 ++++++----- arch/riscv/mm/tlbflush.c | 34 ++++++++++++++++++++++++---------- 2 files changed, 30 insertions(+), 15 deletions(-) commit 9d4e8d5fa7dbbb606b355f40d918a1feef821bc5 Author: Alexandre Ghiti Date: Mon Oct 30 14:30:27 2023 +0100 riscv: Make __flush_tlb_range() loop over pte instead of flushing the whole tlb Currently, when the range to flush covers more than one page (a 4K page or a hugepage), __flush_tlb_range() flushes the whole tlb. Flushing the whole tlb comes with a greater cost than flushing a single entry so we should flush single entries up to a certain threshold so that: threshold * cost of flushing a single entry < cost of flushing the whole tlb. Co-developed-by: Mayuresh Chitale Signed-off-by: Mayuresh Chitale Signed-off-by: Alexandre Ghiti Reviewed-by: Andrew Jones Tested-by: Lad Prabhakar # On RZ/Five SMARC Reviewed-by: Samuel Holland Tested-by: Samuel Holland Link: https://lore.kernel.org/r/20231030133027.19542-4-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/sbi.h | 3 - arch/riscv/include/asm/tlbflush.h | 3 + arch/riscv/kernel/sbi.c | 32 ++++------- arch/riscv/mm/tlbflush.c | 115 +++++++++++++++++++------------------- 4 files changed, 72 insertions(+), 81 deletions(-) commit c962a6e7463980a513e990a7a8a9967e529ad467 Author: Alexandre Ghiti Date: Mon Oct 30 14:30:26 2023 +0100 riscv: Improve flush_tlb_range() for hugetlb pages flush_tlb_range() uses a fixed stride of PAGE_SIZE and in its current form, when a hugetlb mapping needs to be flushed, flush_tlb_range() flushes the whole tlb: so set a stride of the size of the hugetlb mapping in order to only flush the hugetlb mapping. However, if the hugepage is a NAPOT region, all PTEs that constitute this mapping must be invalidated, so the stride size must actually be the size of the PTE. Note that THPs are directly handled by flush_pmd_tlb_range(). Signed-off-by: Alexandre Ghiti Reviewed-by: Samuel Holland Tested-by: Lad Prabhakar # On RZ/Five SMARC Link: https://lore.kernel.org/r/20231030133027.19542-3-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/mm/tlbflush.c | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) commit c5e9b2c2ae82231d85d9650854e7b3e97dde33da Author: Alexandre Ghiti Date: Mon Oct 30 14:30:25 2023 +0100 riscv: Improve tlb_flush() For now, tlb_flush() simply calls flush_tlb_mm() which results in a flush of the whole TLB. So let's use mmu_gather fields to provide a more fine-grained flush of the TLB. Signed-off-by: Alexandre Ghiti Reviewed-by: Andrew Jones Reviewed-by: Samuel Holland Tested-by: Lad Prabhakar # On RZ/Five SMARC Link: https://lore.kernel.org/r/20231030133027.19542-2-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/tlb.h | 8 +++++++- arch/riscv/include/asm/tlbflush.h | 3 +++ arch/riscv/mm/tlbflush.c | 7 +++++++ 3 files changed, 17 insertions(+), 1 deletion(-) commit f688944cfb810986c626cb13d95bc666e5c8a36c Author: Jens Axboe Date: Mon Nov 6 07:43:16 2023 -0700 io_uring/rw: add separate prep handler for fixed read/write Rather than sprinkle opcode checks in the generic read/write prep handler, have a separate prep handler for the vectored readv/writev operation. Signed-off-by: Jens Axboe io_uring/opdef.c | 4 ++-- io_uring/rw.c | 30 ++++++++++++++++++------------ io_uring/rw.h | 1 + 3 files changed, 21 insertions(+), 14 deletions(-) commit 0e984ec88da9747549227900e5215c5e6a1b65ae Author: Jens Axboe Date: Mon Nov 6 07:41:17 2023 -0700 io_uring/rw: add separate prep handler for readv/writev Rather than sprinkle opcode checks in the generic read/write prep handler, have a separate prep handler for the vectored readv/writev operation. Signed-off-by: Jens Axboe io_uring/opdef.c | 4 ++-- io_uring/rw.c | 22 +++++++++++++++------- io_uring/rw.h | 1 + 3 files changed, 18 insertions(+), 9 deletions(-) commit 1a229d8690a0f8951fc4aa8b76a7efab0d8de342 Author: Johan Hovold Date: Mon Nov 6 12:06:54 2023 +0100 Revert "usb: phy: add usb phy notify port status API" This reverts commit a08799cf17c22375752abfad3b4a2b34b3acb287. The recently added Realtek PHY drivers depend on the new port status notification mechanism which was built on the deprecated USB PHY implementation and devicetree binding. Specifically, using these PHYs would require describing the very same PHY using both the generic "phy" property and the deprecated "usb-phy" property which is clearly wrong. We should not be building new functionality on top of the legacy USB PHY implementation even if it is currently stuck in some kind of transitional limbo. Revert the new notification interface which is broken by design. Fixes: a08799cf17c2 ("usb: phy: add usb phy notify port status API") Cc: stable@vger.kernel.org # 6.6 Cc: Stanley Chang Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20231106110654.31090-4-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/usb/core/hub.c | 23 ----------------------- include/linux/usb/phy.h | 13 ------------- 2 files changed, 36 deletions(-) commit 7a784bcdd7e54f0599da3b2360e472238412623e Author: Johan Hovold Date: Mon Nov 6 12:06:53 2023 +0100 Revert "phy: realtek: usb: Add driver for the Realtek SoC USB 2.0 PHY" This reverts commit 134e6d25f6bd06071e5aac0a7eefcea6f7713955. The recently added Realtek PHY drivers depend on the new port status notification mechanism which was built on the deprecated USB PHY implementation and devicetree binding. Specifically, using these PHYs would require describing the very same PHY using both the generic "phy" property and the deprecated "usb-phy" property which is clearly wrong. We should not be building new functionality on top of the legacy USB PHY implementation even if it is currently stuck in some kind of transitional limbo. Revert the new Realtek PHY drivers for now so that the port status notification interface can be reverted and replaced. Fixes: 134e6d25f6bd ("phy: realtek: usb: Add driver for the Realtek SoC USB 2.0 PHY") Cc: stable@vger.kernel.org # 6.6 Cc: Stanley Chang Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20231106110654.31090-3-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/phy/Kconfig | 1 - drivers/phy/Makefile | 1 - drivers/phy/realtek/Kconfig | 20 - drivers/phy/realtek/Makefile | 2 - drivers/phy/realtek/phy-rtk-usb2.c | 1325 ------------------------------------ 5 files changed, 1349 deletions(-) commit 258ea41c926b7b3a16d0d7aa210a1401c4a1601b Author: Johan Hovold Date: Mon Nov 6 12:06:52 2023 +0100 Revert "phy: realtek: usb: Add driver for the Realtek SoC USB 3.0 PHY" This reverts commit adda6e82a7de7d6d478f6c8ef127f0ac51c510a1. The recently added Realtek PHY drivers depend on the new port status notification mechanism which was built on the deprecated USB PHY implementation and devicetree binding. Specifically, using these PHYs would require describing the very same PHY using both the generic "phy" property and the deprecated "usb-phy" property which is clearly wrong. We should not be building new functionality on top of the legacy USB PHY implementation even if it is currently stuck in some kind of transitional limbo. Revert the new Realtek PHY drivers for now so that the port status notification interface can be reverted and replaced. Fixes: adda6e82a7de ("phy: realtek: usb: Add driver for the Realtek SoC USB 3.0 PHY") Cc: stable@vger.kernel.org # 6.6 Cc: Stanley Chang Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20231106110654.31090-2-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/phy/realtek/Kconfig | 12 - drivers/phy/realtek/Makefile | 1 - drivers/phy/realtek/phy-rtk-usb3.c | 761 ------------------------------------- 3 files changed, 774 deletions(-) commit 9506fba463fcbdf8c8b7af3ec9ee34360df843fe Author: Nirmoy Das Date: Thu Oct 26 14:56:36 2023 +0200 drm/i915/tc: Fix -Wformat-truncation in intel_tc_port_init Fix below compiler warning: intel_tc.c:1879:11: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 3 [-Werror=format-truncation=] "%c/TC#%d", port_name(port), tc_port + 1); ^~ intel_tc.c:1878:2: note: ‘snprintf’ output between 7 and 17 bytes into a destination of size 8 snprintf(tc->port_name, sizeof(tc->port_name), ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "%c/TC#%d", port_name(port), tc_port + 1); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ v2: use kasprintf(Imre) v3: use const for port_name, and fix tc mem leak(Imre) Fixes: 3eafcddf766b ("drm/i915/tc: Move TC port fields to a new intel_tc_port struct") Cc: Mika Kahola Cc: Imre Deak Cc: Jani Nikula Signed-off-by: Nirmoy Das Reviewed-by: Andrzej Hajda Reviewed-by: Imre Deak Reviewed-by: Mika Kahola Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20231026125636.5080-1-nirmoy.das@intel.com (cherry picked from commit 70a3cbbe620ee66afb0c066624196077767e61b2) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/intel_tc.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 1a8e9bad6ef563c28ab0f8619628d5511be55431 Author: Kunwu Chan Date: Fri Nov 3 11:09:22 2023 +0000 drm/i915: Fix potential spectre vulnerability Fix smatch warning: drivers/gpu/drm/i915/gem/i915_gem_context.c:847 set_proto_ctx_sseu() warn: potential spectre issue 'pc->user_engines' [r] (local cap) Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") Cc: # v5.15+ Signed-off-by: Kunwu Chan Reviewed-by: Tvrtko Ursulin Signed-off-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20231103110922.430122-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit 27b086382c22efb7e0a16442f7bdc2e120108ef3) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/gem/i915_gem_context.c | 1 + 1 file changed, 1 insertion(+) commit 0cb89cd42fd22bbdec0b046c48f35775f5b88bdb Author: Ville Syrjälä Date: Tue Oct 31 18:08:00 2023 +0200 drm/i915: Bump GLK CDCLK frequency when driving multiple pipes On GLK CDCLK frequency needs to be at least 2*96 MHz when accessing the audio hardware. Currently we bump the CDCLK frequency up temporarily (if not high enough already) whenever audio hardware is being accessed, and drop it back down afterwards. With a single active pipe this works just fine as we can switch between all the valid CDCLK frequencies by changing the cd2x divider, which doesn't require a full modeset. However with multiple active pipes the cd2x divider trick no longer works, and thus we end up blinking all displays off and back on. To avoid this let's just bump the CDCLK frequency to >=2*96MHz whenever multiple pipes are active. The downside is slightly higher power consumption, but that seems like an acceptable tradeoff. With a single active pipe we can stick to the current more optiomal (from power comsumption POV) behaviour. Cc: stable@vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/9599 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20231031160800.18371-1-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit 451eaa1a614c911f5a51078dcb68022874e4cb12) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/intel_cdclk.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 0ad755fb88bdb7452f976d97847a47dbf7496763 Author: Nirmoy Das Date: Wed Oct 25 12:28:26 2023 +0200 drm/i915/mtl: Apply notify_guc to all GTs Handle platforms with multiple GTs by iterate over all GTs. Add a Fixes commit so this gets propagated for MTL support. Fixes: 213c43676beb ("drm/i915/mtl: Remove the 'force_probe' requirement for Meteor Lake") Suggested-by: John Harrison Cc: Jani Nikula Cc: Rodrigo Vivi Cc: Tvrtko Ursulin Cc: Andi Shyti Cc: Andrzej Hajda Signed-off-by: Nirmoy Das Reviewed-by: Andi Shyti Reviewed-by: Andrzej Hajda Link: https://patchwork.freedesktop.org/patch/msgid/20231025102826.16955-1-nirmoy.das@intel.com (cherry picked from commit 949113d34fb82a5dc6f5dd3ad9168001b441792b) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_debugfs_params.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 18216762bcf618c52b85719d3563243f80e4a2d4 Author: Bagas Sanjaya Date: Mon Nov 6 17:12:04 2023 +0700 x86/Documentation: Indent 'note::' directive for protocol version number note The protocol version number note is between the protocol version table and the memory layout section. As such, Sphinx renders the note directive not only on the actual note, but until the end of doc. Indent the directive so that only the actual protocol version number note is rendered as such. Fixes: 2c33c27fd603 ("x86/boot: Introduce kernel_info") Signed-off-by: Bagas Sanjaya Signed-off-by: Ingo Molnar Cc: Jonathan Corbet Link: https://lore.kernel.org/r/20231106101206.76487-2-bagasdotme@gmail.com Signed-off-by: Ingo Molnar Documentation/arch/x86/boot.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c2ded280a4b1b7bd93e53670528504be08d24967 Author: Amit Kumar Mahapatra Date: Sat Nov 4 00:13:51 2023 +0530 spi: spi-zynq-qspi: add spi-mem to driver kconfig dependencies Zynq QSPI driver has been converted to use spi-mem framework so add spi-mem to driver kconfig dependencies. Fixes: 67dca5e580f1 ("spi: spi-mem: Add support for Zynq QSPI controller") Signed-off-by: Amit Kumar Mahapatra Signed-off-by: Radhey Shyam Pandey Link: https://lore.kernel.org/r/1699037031-702858-1-git-send-email-radhey.shyam.pandey@amd.com Signed-off-by: Mark Brown drivers/spi/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 4bdcbc31ad2112385ad525b28972c45015e6ad70 Author: Jerome Brunet Date: Mon Nov 6 11:37:09 2023 +0100 ASoC: dapm: fix clock get name The name currently used to get the clock includes the dapm prefix. It should use the name as provided to the widget, without the prefix. Fixes: 3caac759681e ("ASoC: soc-dapm.c: fixup snd_soc_dapm_new_control_unlocked() error handling") Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20231106103712.703962-1-jbrunet@baylibre.com Signed-off-by: Mark Brown sound/soc/soc-dapm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 15be353d55f9e12e34f9a819f51eb41fdef5eda8 Author: Jerome Brunet Date: Mon Nov 6 11:40:11 2023 +0100 ASoC: hdmi-codec: register hpd callback on component probe The HDMI hotplug callback to the hdmi-codec is currently registered when jack is set. The hotplug not only serves to report the ASoC jack state but also to get the ELD. It should be registered when the component probes instead, so it does not depend on the card driver registering a jack for the HDMI to properly report the ELD. Fixes: 25ce4f2b3593 ("ASoC: hdmi-codec: Get ELD in before reporting plugged event") Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20231106104013.704356-1-jbrunet@baylibre.com Signed-off-by: Mark Brown sound/soc/codecs/hdmi-codec.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) commit c1ed833e0b3b7b9edc82b97b73b2a8a10ceab241 Merge: d93f9528573e aa96fbd6d78d Author: David S. Miller Date: Mon Nov 6 10:01:08 2023 +0000 Merge branch 'smc-fixes' D. Wythe says ==================== bugfixs for smc This patches includes bugfix following: 1. hung state 2. sock leak 3. potential panic We have been testing these patches for some time, but if you have any questions, please let us know. -- v1: Fix spelling errors and incorrect function names in descriptions v2->v1: Add fix tags for bugfix patch ==================== Reviewed-by: Wenjia Zhang Signed-off-by: David S. Miller commit aa96fbd6d78d9770323b21e2c92bd38821be8852 Author: D. Wythe Date: Fri Nov 3 14:07:40 2023 +0800 net/smc: put sk reference if close work was canceled Note that we always hold a reference to sock when attempting to submit close_work. Therefore, if we have successfully canceled close_work from pending, we MUST release that reference to avoid potential leaks. Fixes: 42bfba9eaa33 ("net/smc: immediate termination for SMCD link groups") Signed-off-by: D. Wythe Reviewed-by: Dust Li Signed-off-by: David S. Miller net/smc/smc_close.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c5bf605ba4f9d6fbbb120595ab95002f4716edcb Author: D. Wythe Date: Fri Nov 3 14:07:39 2023 +0800 net/smc: allow cdc msg send rather than drop it with NULL sndbuf_desc This patch re-fix the issues mentioned by commit 22a825c541d7 ("net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()"). Blocking sending message do solve the issues though, but it also prevents the peer to receive the final message. Besides, in logic, whether the sndbuf_desc is NULL or not have no impact on the processing of cdc message sending. Hence that, this patch allows the cdc message sending but to check the sndbuf_desc with care in smc_cdc_tx_handler(). Fixes: 22a825c541d7 ("net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()") Signed-off-by: D. Wythe Reviewed-by: Dust Li Signed-off-by: David S. Miller net/smc/smc_cdc.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit 5211c9729484c923f8d2e06bd29f9322cc42bb8f Author: D. Wythe Date: Fri Nov 3 14:07:38 2023 +0800 net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT Considering scenario: smc_cdc_rx_handler __smc_release sock_set_flag smc_close_active() sock_set_flag __set_bit(DEAD) __set_bit(DONE) Dues to __set_bit is not atomic, the DEAD or DONE might be lost. if the DEAD flag lost, the state SMC_CLOSED will be never be reached in smc_close_passive_work: if (sock_flag(sk, SOCK_DEAD) && smc_close_sent_any_close(conn)) { sk->sk_state = SMC_CLOSED; } else { /* just shutdown, but not yet closed locally */ sk->sk_state = SMC_APPFINCLOSEWAIT; } Replace sock_set_flags or __set_bit to set_bit will fix this problem. Since set_bit is atomic. Fixes: b38d732477e4 ("smc: socket closing and linkgroup cleanup") Signed-off-by: D. Wythe Reviewed-by: Dust Li Signed-off-by: David S. Miller net/smc/af_smc.c | 4 ++-- net/smc/smc.h | 5 +++++ net/smc/smc_cdc.c | 2 +- net/smc/smc_close.c | 2 +- 4 files changed, 9 insertions(+), 4 deletions(-) commit d93f9528573e1d419b69ca5ff4130201d05f6b90 Author: Jakub Kicinski Date: Thu Nov 2 11:52:27 2023 -0700 nfsd: regenerate user space parsers after ynl-gen changes Commit 8cea95b0bd79 ("tools: ynl-gen: handle do ops with no input attrs") added support for some of the previously-skipped ops in nfsd. Regenerate the user space parsers to fill them in. Signed-off-by: Jakub Kicinski Acked-by: Chuck Lever Signed-off-by: David S. Miller include/uapi/linux/nfsd_netlink.h | 6 +- tools/net/ynl/generated/nfsd-user.c | 120 ++++++++++++++++++++++++++++++++++-- tools/net/ynl/generated/nfsd-user.h | 44 +++++++++++-- 3 files changed, 156 insertions(+), 14 deletions(-) commit 0a8e987dcc13244b5a5bc90cb1b184f813104d87 Author: Kuniyuki Iwashima Date: Thu Nov 2 14:05:48 2023 -0700 tcp: Fix SYN option room calculation for TCP-AO. When building SYN packet in tcp_syn_options(), MSS, TS, WS, and SACKPERM are used without checking the remaining bytes in the options area. To keep that logic as is, we limit the TCP-AO MAC length in tcp_ao_parse_crypto(). Currently, the limit is calculated as below. MAX_TCP_OPTION_SPACE - TCPOLEN_TSTAMP_ALIGNED - TCPOLEN_WSCALE_ALIGNED - TCPOLEN_SACKPERM_ALIGNED This looks confusing as (1) we pack SACKPERM into the leading 2-bytes of the aligned 12-bytes of TS and (2) TCPOLEN_MSS_ALIGNED is not used. Fortunately, the calculated limit is not wrong as TCPOLEN_SACKPERM_ALIGNED and TCPOLEN_MSS_ALIGNED are the same value. However, we should use the proper constant in the formula. MAX_TCP_OPTION_SPACE - TCPOLEN_MSS_ALIGNED - TCPOLEN_TSTAMP_ALIGNED - TCPOLEN_WSCALE_ALIGNED Fixes: 4954f17ddefc ("net/tcp: Introduce TCP_AO setsockopt()s") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Dmitry Safonov Signed-off-by: David S. Miller net/ipv4/tcp_ao.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 3423ca23e08bf285a324237abe88e7e7d9becfe6 Author: Geetha sowjanya Date: Tue Oct 31 16:53:45 2023 +0530 octeontx2-pf: Free pending and dropped SQEs On interface down, the pending SQEs in the NIX get dropped or drained out during SMQ flush. But skb's pointed by these SQEs never get free or updated to the stack as respective CQE never get added. This patch fixes the issue by freeing all valid skb's in SQ SG list. Fixes: b1bc8457e9d0 ("octeontx2-pf: Cleanup all receive buffers in SG descriptor") Signed-off-by: Geetha sowjanya Signed-off-by: David S. Miller .../ethernet/marvell/octeontx2/nic/otx2_common.c | 15 +++----- .../ethernet/marvell/octeontx2/nic/otx2_common.h | 1 + .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 1 + .../net/ethernet/marvell/octeontx2/nic/otx2_txrx.c | 42 ++++++++++++++++++++++ 4 files changed, 49 insertions(+), 10 deletions(-) commit 40cb2fdfed342e7e578d551a073687789f698d89 Author: Jamal Hadi Salim Date: Sat Oct 28 13:16:10 2023 -0400 net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config Getting the following splat [1] with CONFIG_DEBUG_NET=y and this reproducer [2]. Problem seems to be that classifiers clear 'struct tcf_result::drop_reason', thereby triggering the warning in __kfree_skb_reason() due to reason being 'SKB_NOT_DROPPED_YET' (0). Fixed by disambiguating a legit error from a verdict with a bogus drop_reason [1] WARNING: CPU: 0 PID: 181 at net/core/skbuff.c:1082 kfree_skb_reason+0x38/0x130 Modules linked in: CPU: 0 PID: 181 Comm: mausezahn Not tainted 6.6.0-rc6-custom-ge43e6d9582e0 #682 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc37 04/01/2014 RIP: 0010:kfree_skb_reason+0x38/0x130 [...] Call Trace: __netif_receive_skb_core.constprop.0+0x837/0xdb0 __netif_receive_skb_one_core+0x3c/0x70 process_backlog+0x95/0x130 __napi_poll+0x25/0x1b0 net_rx_action+0x29b/0x310 __do_softirq+0xc0/0x29b do_softirq+0x43/0x60 [2] ip link add name veth0 type veth peer name veth1 ip link set dev veth0 up ip link set dev veth1 up tc qdisc add dev veth1 clsact tc filter add dev veth1 ingress pref 1 proto all flower dst_mac 00:11:22:33:44:55 action drop mausezahn veth0 -a own -b 00:11:22:33:44:55 -q -c 1 Ido reported: [...] getting the following splat [1] with CONFIG_DEBUG_NET=y and this reproducer [2]. Problem seems to be that classifiers clear 'struct tcf_result::drop_reason', thereby triggering the warning in __kfree_skb_reason() due to reason being 'SKB_NOT_DROPPED_YET' (0). [...] [1] WARNING: CPU: 0 PID: 181 at net/core/skbuff.c:1082 kfree_skb_reason+0x38/0x130 Modules linked in: CPU: 0 PID: 181 Comm: mausezahn Not tainted 6.6.0-rc6-custom-ge43e6d9582e0 #682 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc37 04/01/2014 RIP: 0010:kfree_skb_reason+0x38/0x130 [...] Call Trace: __netif_receive_skb_core.constprop.0+0x837/0xdb0 __netif_receive_skb_one_core+0x3c/0x70 process_backlog+0x95/0x130 __napi_poll+0x25/0x1b0 net_rx_action+0x29b/0x310 __do_softirq+0xc0/0x29b do_softirq+0x43/0x60 [2] #!/bin/bash ip link add name veth0 type veth peer name veth1 ip link set dev veth0 up ip link set dev veth1 up tc qdisc add dev veth1 clsact tc filter add dev veth1 ingress pref 1 proto all flower dst_mac 00:11:22:33:44:55 action drop mausezahn veth0 -a own -b 00:11:22:33:44:55 -q -c 1 What happens is that inside most classifiers the tcf_result is copied over from a filter template e.g. *res = f->res which then implicitly overrides the prior SKB_DROP_REASON_TC_{INGRESS,EGRESS} default drop code which was set via sch_handle_{ingress,egress}() for kfree_skb_reason(). Commit text above copied verbatim from Daniel. The general idea of the patch is not very different from what Ido originally posted but instead done at the cls_api codepath. Fixes: 54a59aed395c ("net, sched: Make tc-related drop reason more flexible") Reported-by: Ido Schimmel Signed-off-by: Jamal Hadi Salim Link: https://lore.kernel.org/netdev/ZTjY959R+AFXf3Xy@shredder Reviewed-by: Simon Horman Signed-off-by: David S. Miller net/sched/act_api.c | 2 +- net/sched/cls_api.c | 9 ++++++++- 2 files changed, 9 insertions(+), 2 deletions(-) commit 0e8b9f258baed25f1c5672613699247c76b007b5 Author: Zongmin Zhou Date: Tue Aug 1 10:53:09 2023 +0800 drm/qxl: prevent memory leak The allocated memory for qdev->dumb_heads should be released in qxl_destroy_monitors_object before qxl suspend. otherwise,qxl_create_monitors_object will be called to reallocate memory for qdev->dumb_heads after qxl resume, it will cause memory leak. Signed-off-by: Zongmin Zhou Link: https://lore.kernel.org/r/20230801025309.4049813-1-zhouzongmin@kylinos.cn Reviewed-by: Dave Airlie Signed-off-by: Maxime Ripard drivers/gpu/drm/qxl/qxl_display.c | 3 +++ 1 file changed, 3 insertions(+) commit a409d9600959f3c4b2a48946304c8e01b8d04072 Author: Jia He Date: Sat Oct 28 10:20:59 2023 +0000 dma-mapping: fix dma_addressing_limited() if dma_range_map can't cover all system RAM There is an unusual case that the range map covers right up to the top of system RAM, but leaves a hole somewhere lower down. Then it prevents the nvme device dma mapping in the checking path of phys_to_dma() and causes the hangs at boot. E.g. On an Armv8 Ampere server, the dsdt ACPI table is: Method (_DMA, 0, Serialized) // _DMA: Direct Memory Access { Name (RBUF, ResourceTemplate () { QWordMemory (ResourceConsumer, PosDecode, MinFixed, MaxFixed, Cacheable, ReadWrite, 0x0000000000000000, // Granularity 0x0000000000000000, // Range Minimum 0x00000000FFFFFFFF, // Range Maximum 0x0000000000000000, // Translation Offset 0x0000000100000000, // Length ,, , AddressRangeMemory, TypeStatic) QWordMemory (ResourceConsumer, PosDecode, MinFixed, MaxFixed, Cacheable, ReadWrite, 0x0000000000000000, // Granularity 0x0000006010200000, // Range Minimum 0x000000602FFFFFFF, // Range Maximum 0x0000000000000000, // Translation Offset 0x000000001FE00000, // Length ,, , AddressRangeMemory, TypeStatic) QWordMemory (ResourceConsumer, PosDecode, MinFixed, MaxFixed, Cacheable, ReadWrite, 0x0000000000000000, // Granularity 0x00000060F0000000, // Range Minimum 0x00000060FFFFFFFF, // Range Maximum 0x0000000000000000, // Translation Offset 0x0000000010000000, // Length ,, , AddressRangeMemory, TypeStatic) QWordMemory (ResourceConsumer, PosDecode, MinFixed, MaxFixed, Cacheable, ReadWrite, 0x0000000000000000, // Granularity 0x0000007000000000, // Range Minimum 0x000003FFFFFFFFFF, // Range Maximum 0x0000000000000000, // Translation Offset 0x0000039000000000, // Length ,, , AddressRangeMemory, TypeStatic) }) But the System RAM ranges are: cat /proc/iomem |grep -i ram 90000000-91ffffff : System RAM 92900000-fffbffff : System RAM 880000000-fffffffff : System RAM 8800000000-bff5990fff : System RAM bff59d0000-bff5a4ffff : System RAM bff8000000-bfffffffff : System RAM So some RAM ranges are out of dma_range_map. Fix it by checking whether each of the system RAM resources can be properly encompassed within the dma_range_map. Signed-off-by: Jia He Signed-off-by: Christoph Hellwig kernel/dma/direct.c | 40 ++++++++++++++++++++++++++++++++++++++++ kernel/dma/direct.h | 1 + kernel/dma/mapping.c | 11 +++++++++-- 3 files changed, 50 insertions(+), 2 deletions(-) commit 8ae0e970319ac0b516d285650a744bab4ed3dd37 Author: Jia He Date: Sat Oct 28 10:20:58 2023 +0000 dma-mapping: move dma_addressing_limited() out of line This patch moves dma_addressing_limited() out of line, serving as a preliminary step to prevent the introduction of a new publicly accessible low-level helper when validating whether all system RAM is mapped within the DMA mapping range. Suggested-by: Christoph Hellwig Signed-off-by: Jia He Signed-off-by: Christoph Hellwig include/linux/dma-mapping.h | 19 +++++-------------- kernel/dma/mapping.c | 15 +++++++++++++++ 2 files changed, 20 insertions(+), 14 deletions(-) commit deebe5f607d7f72f83c41163191ad0c1c4356385 Author: Thomas Zimmermann Date: Fri Sep 22 10:04:59 2023 +0200 powerpc/fb: Call internal __phys_mem_access_prot() in fbdev code Call __phys_mem_access_prot() from the fbdev mmap helper pgprot_framebuffer(). Allows to avoid the file argument of NULL. Signed-off-by: Thomas Zimmermann Reviewed-by: Arnd Bergmann Signed-off-by: Michael Ellerman Link: https://msgid.link/20230922080636.26762-6-tzimmermann@suse.de arch/powerpc/include/asm/fb.h | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit 1f92a844c35e483c00bab8a7b7d39c555ee799d8 Author: Thomas Zimmermann Date: Fri Sep 22 10:04:58 2023 +0200 powerpc: Remove file parameter from phys_mem_access_prot() Remove 'file' parameter from struct machdep_calls.phys_mem_access_prot and its implementation in pci_phys_mem_access_prot(). The file is not used on PowerPC. By removing it, a later patch can simplify fbdev's mmap code, which uses phys_mem_access_prot() on PowerPC. Signed-off-by: Thomas Zimmermann Reviewed-by: Arnd Bergmann [mpe: Rebase on unrelated changes to phys_mem_access_prot()] Signed-off-by: Michael Ellerman Link: https://msgid.link/20230922080636.26762-5-tzimmermann@suse.de arch/powerpc/include/asm/machdep.h | 3 +-- arch/powerpc/include/asm/pci.h | 4 +--- arch/powerpc/include/asm/pgtable.h | 10 ++++++++-- arch/powerpc/kernel/pci-common.c | 3 +-- arch/powerpc/mm/mem.c | 8 ++++---- 5 files changed, 15 insertions(+), 13 deletions(-) commit 322948c3198cf80e7c10d953ddad24ebd85757cd Author: Thomas Zimmermann Date: Fri Sep 22 10:04:57 2023 +0200 powerpc/machdep: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Reviewed-by: Arnd Bergmann Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Michael Ellerman Link: https://msgid.link/20230922080636.26762-4-tzimmermann@suse.de arch/powerpc/include/asm/machdep.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit d2f51b3516dade79269ff45eae2a7668ae711b25 Merge: 7b2c9e41e73f cfb67623ce28 Author: Linus Torvalds Date: Sun Nov 5 18:49:40 2023 -0800 Merge tag 'rtc-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "There is a new driver for the RTC of the Mstar SSD202D SoC. The rtc7301 driver gains support for byte addresses to support the USRobotics USR8200. Then we have many non user visible changes and typo fixes. Summary: Subsytem: - convert platform drivers to remove_new - prevent modpost warnings for unremovable platform drivers New driver: - Mstar SSD202D Drivers: - brcmstb-waketimer: support level alarm_irq - ep93xx: add DT support - rtc7301: support byte-addressed IO" * tag 'rtc-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (28 commits) dt-bindings: rtc: Add Mstar SSD202D RTC rtc: Add support for the SSD202D RTC rtc: at91rm9200: annotate at91_rtc_remove with __exit again dt-bindings: rtc: microcrystal,rv3032: Document wakeup-source property dt-bindings: rtc: pcf8523: Convert to YAML dt-bindings: rtc: mcp795: move to trivial-rtc rtc: ep93xx: add DT support for Cirrus EP93xx dt-bindings: rtc: Add Cirrus EP93xx dt-bindings: rtc: pcf2123: convert to YAML rtc: efi: fixed typo in efi_procfs() rtc: omap: Use device_get_match_data() rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call rtc: rtc7301: Support byte-addressed IO rtc: rtc7301: Rewrite bindings in schema rtc: sh: Convert to platform remove callback returning void rtc: pxa: Convert to platform remove callback returning void rtc: mv: Convert to platform remove callback returning void rtc: imxdi: Convert to platform remove callback returning void rtc: at91rm9200: Convert to platform remove callback returning void rtc: pcap: Drop no-op remove function ... commit 7b2c9e41e73fbe50f519072009b1e624ea230163 Merge: 77fa2fbe87fc 96cb7a4e296d Author: Linus Torvalds Date: Sun Nov 5 18:45:32 2023 -0800 Merge tag 'mailbox-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox Pull mailbox updates from Jassi Brar: - imx: add support for TX Doorbell v2 - mtk: implement runtime PM - zynqmp: add destination mailbox compatible - qcom: - add another clock provider for IPQ - add SM8650 compatible - misc: use preferred device_get_match_data() * tag 'mailbox-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: dt-bindings: mailbox: qcom-ipcc: document the SM8650 Inter-Processor Communication Controller mailbox: mtk-cmdq-mailbox: Implement Runtime PM with autosuspend mailbox: Use device_get_match_data() dt-bindings: zynqmp: add destination mailbox compatible dt-bindings: mailbox: qcom: add one more clock provider for IPQ mailbox mailbox: imx: support channel type tx doorbell v2 dt-bindings: mailbox: fsl,mu: add new tx doorbell channel commit 9ccde17d46554dbb2757c427f2cdf67688701f96 Merge: f056cb9681f6 6d5e0032a92d Author: Dave Airlie Date: Mon Nov 6 11:25:10 2023 +1000 Merge tag 'amd-drm-next-6.7-2023-11-03' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.7-2023-11-03: amdgpu: - Fix RAS support check - RAS fixes - MES fixes - SMU13 fixes - Contiguous memory allocation fix - BACO fixes - GPU reset fixes - Min power limit fixes - GFX11 fixes - USB4/TB hotplug fixes - ARM regression fix - GFX9.4.3 fixes - KASAN/KCSAN stack size check fixes - SR-IOV fixes - SMU14 fixes - PSP13 fixes - Display blend fixes - Flexible array size fixes amdkfd: - GPUVM fix radeon: - Flexible array size fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20231103173203.4912-1-alexander.deucher@amd.com commit f056cb9681f631c99c7c6780c82651c86f15cf5c Merge: 2ba446f82142 94565e95e247 Author: Dave Airlie Date: Mon Nov 6 11:24:29 2023 +1000 Merge tag 'drm-misc-next-fixes-2023-11-02' of git://anongit.freedesktop.org/drm/drm-misc into drm-next drm-misc-next-fixes for v6.7-rc1: - dt binding fix for ssd132x - Initialize ssd130x crtc_state to NULL. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/58f40043-bb8a-4716-bf07-89f6a9f56c4c@linux.intel.com commit 0cdc6f44e9fdc2d20d720145bf99a39f611f6d61 Author: Andreas Gruenbacher Date: Thu Nov 2 20:52:30 2023 +0100 gfs2: don't withdraw if init_threads() got interrupted In gfs2_fill_super(), when mounting a gfs2 filesystem is interrupted, kthread_create() can return -EINTR. When that happens, we roll back what has already been done and abort the mount. Since commit 62dd0f98a0e5 ("gfs2: Flag a withdraw if init_threads() fails), we are calling gfs2_withdraw_delayed() in gfs2_fill_super(); first via gfs2_make_fs_rw(), then directly. But gfs2_withdraw_delayed() only marks the filesystem as withdrawing and relies on a caller further up the stack to do the actual withdraw, which doesn't exist in the gfs2_fill_super() case. Because the filesystem is marked as withdrawing / withdrawn, function gfs2_lm_unmount() doesn't release the dlm lockspace, so when we try to mount that filesystem again, we get: gfs2: fsid=gohan:gohan0: Trying to join cluster "lock_dlm", "gohan:gohan0" gfs2: fsid=gohan:gohan0: dlm_new_lockspace error -17 Since commit b77b4a4815a9 ("gfs2: Rework freeze / thaw logic"), the deadlock this gfs2_withdraw_delayed() call was supposed to work around cannot occur anymore because freeze_go_callback() won't take the sb->s_umount semaphore unconditionally anymore, so we can get rid of the gfs2_withdraw_delayed() in gfs2_fill_super() entirely. Reported-by: Alexander Aring Signed-off-by: Andreas Gruenbacher Cc: stable@vger.kernel.org # v6.5+ fs/gfs2/ops_fstype.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit bb25b97562e52b2b5808b348db32568b1f5394b5 Author: Su Hui Date: Thu Nov 2 09:51:42 2023 +0800 gfs2: remove dead code in add_to_queue clang static analyzer complains that value stored to 'gh' is never read. The code of this line is useless after commit 0b93bac2271e ("gfs2: Remove LM_FLAG_PRIORITY flag"). Remove this code to save space. Signed-off-by: Su Hui Signed-off-by: Andreas Gruenbacher fs/gfs2/glock.c | 1 - 1 file changed, 1 deletion(-) commit bdcb8aa434c6d36b5c215d02a9ef07551be25a37 Author: Juntong Deng Date: Mon Oct 30 05:10:06 2023 +0800 gfs2: Fix slab-use-after-free in gfs2_qd_dealloc In gfs2_put_super(), whether withdrawn or not, the quota should be cleaned up by gfs2_quota_cleanup(). Otherwise, struct gfs2_sbd will be freed before gfs2_qd_dealloc (rcu callback) has run for all gfs2_quota_data objects, resulting in use-after-free. Also, gfs2_destroy_threads() and gfs2_quota_cleanup() is already called by gfs2_make_fs_ro(), so in gfs2_put_super(), after calling gfs2_make_fs_ro(), there is no need to call them again. Reported-by: syzbot+29c47e9e51895928698c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=29c47e9e51895928698c Signed-off-by: Juntong Deng Signed-off-by: Andreas Gruenbacher fs/gfs2/super.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 074d7306a4fe22fcac0b53f699f92757ab1cee99 Author: Andreas Gruenbacher Date: Mon Oct 30 22:06:05 2023 +0100 gfs2: Silence "suspicious RCU usage in gfs2_permission" warning Commit 0abd1557e21c added rcu_dereference() for dereferencing ip->i_gl in gfs2_permission. This now causes lockdep to complain when gfs2_permission is called in non-RCU context: WARNING: suspicious RCU usage in gfs2_permission Switch to rcu_dereference_check() and check for the MAY_NOT_BLOCK flag to shut up lockdep when we know that dereferencing ip->i_gl is safe. Fixes: 0abd1557e21c ("gfs2: fix an oops in gfs2_permission") Reported-by: syzbot+3e5130844b0c0e2b4948@syzkaller.appspotmail.com Signed-off-by: Andreas Gruenbacher fs/gfs2/inode.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit d6fc6c93636ffefd3d209d90a749e4e4ea51d6c1 Author: Amir Goldstein Date: Tue Oct 24 10:55:35 2023 +0300 gfs2: fs: derive f_fsid from s_uuid gfs2 already has optional persistent uuid. Use that uuid to report f_fsid in statfs(2), same as ext2/ext4/zonefs. This allows gfs2 to be monitored by fanotify filesystem watch. for example, with inotify-tools 4.23.8.0, the following command can be used to watch changes over entire filesystem: fsnotifywatch --filesystem /mnt/gfs2 Signed-off-by: Amir Goldstein Reviewed-by: Jan Kara Signed-off-by: Andreas Gruenbacher fs/gfs2/super.c | 1 + 1 file changed, 1 insertion(+) commit 0b2355fe91ac3756a9e29c8b833ba33f9affb520 Author: Andreas Gruenbacher Date: Mon Oct 9 18:49:31 2023 +0200 gfs2: No longer use 'extern' in function declarations For non-static function declarations, external linkage is implied and the 'extern' keyword isn't needed. Some static checkers complain about the overuse of 'extern', so clean up all the function declarations. In addition, remove 'extern' from the definition of free_local_statfs_inodes(); it isn't needed there, either. Signed-off-by: Andreas Gruenbacher fs/gfs2/acl.h | 8 ++--- fs/gfs2/aops.h | 6 ++-- fs/gfs2/bmap.h | 38 ++++++++++---------- fs/gfs2/dir.h | 38 ++++++++++---------- fs/gfs2/glock.h | 100 ++++++++++++++++++++++++++--------------------------- fs/gfs2/glops.h | 4 +-- fs/gfs2/incore.h | 2 +- fs/gfs2/inode.h | 52 ++++++++++++++-------------- fs/gfs2/log.h | 46 ++++++++++++------------ fs/gfs2/lops.h | 22 ++++++------ fs/gfs2/meta_io.h | 20 +++++------ fs/gfs2/quota.h | 35 ++++++++++--------- fs/gfs2/recovery.h | 18 +++++----- fs/gfs2/rgrp.h | 85 +++++++++++++++++++++++---------------------- fs/gfs2/super.c | 6 ++-- fs/gfs2/super.h | 50 +++++++++++++-------------- fs/gfs2/trans.h | 24 ++++++------- fs/gfs2/util.h | 8 ++--- fs/gfs2/xattr.h | 12 +++---- 19 files changed, 289 insertions(+), 285 deletions(-) commit 062fb903895a035ed382a0d3f9b9d459b2718217 Author: Andreas Gruenbacher Date: Wed Jul 26 22:23:43 2023 +0200 gfs2: Rename gfs2_lookup_{ simple => meta } Function gfs2_lookup_simple() is used for looking up inodes in the metadata directory tree, so rename it to gfs2_lookup_meta() to closer match its purpose. Clean the function up a little on the way. Signed-off-by: Andreas Gruenbacher fs/gfs2/inode.c | 13 +++++++------ fs/gfs2/inode.h | 2 +- fs/gfs2/ops_fstype.c | 16 ++++++++-------- 3 files changed, 16 insertions(+), 15 deletions(-) commit be7f6a6b0bca708999eef4f8e9f2b128c73b9e17 Author: Andreas Gruenbacher Date: Mon Jul 24 20:53:14 2023 +0200 gfs2: Convert gfs2_internal_read to folios Change gfs2_internal_read() to use folios. Convert sizes to size_t. Signed-off-by: Andreas Gruenbacher fs/gfs2/aops.c | 34 ++++++++++++++++------------------ fs/gfs2/inode.h | 4 ++-- 2 files changed, 18 insertions(+), 20 deletions(-) commit 7fa4964b35e4046cae1c7d8b42f631ffd898701d Author: Andreas Gruenbacher Date: Fri Jul 21 23:58:04 2023 +0200 gfs2: Convert stuffed_readpage to folios Change stuffed_readpage() to take a folio instead of a page. Signed-off-by: Andreas Gruenbacher fs/gfs2/aops.c | 30 ++++++++++++++---------------- 1 file changed, 14 insertions(+), 16 deletions(-) commit d6d64dac1d3967f3e951ae1cf2753181b78f2f89 Author: Andreas Gruenbacher Date: Tue Jul 18 15:49:08 2023 +0200 gfs2: Minor gfs2_write_jdata_batch PAGE_SIZE cleanup In gfs2_write_jdata_batch(), to compute the number of blocks, compute the total size of the folio batch instead of the number of pages it contains. Not a functional change. Note that we don't currently allow mounting filesystems with a block size bigger than the page size. We could change that after converting the page cache to folios. The page cache would then only contain block-size or bigger folios, so rounding wouldn't become an issue here. Signed-off-by: Andreas Gruenbacher fs/gfs2/aops.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 4c7b3f7fb7c8c66d669d107e717f9de41ef81e92 Author: Andreas Gruenbacher Date: Sat Oct 21 00:40:07 2023 +0200 gfs2: Get rid of gfs2_alloc_blocks generation parameter Get rid of the generation parameter of gfs2_alloc_blocks(): we only ever set the generation of the current inode while creating it, so do so directly. Signed-off-by: Andreas Gruenbacher fs/gfs2/bmap.c | 4 ++-- fs/gfs2/dir.c | 2 +- fs/gfs2/inode.c | 2 +- fs/gfs2/rgrp.c | 12 +++++++----- fs/gfs2/rgrp.h | 2 +- fs/gfs2/xattr.c | 6 +++--- 6 files changed, 15 insertions(+), 13 deletions(-) commit d3badb15613c14dd35d3495b1dde5c90fcd616dd Author: Fang Xiang Date: Mon Oct 30 16:32:56 2023 +0800 irqchip/gic-v3-its: Flush ITS tables correctly in non-coherent GIC designs In non-coherent GIC designs, the ITS tables must be flushed before writing to the GITS_BASER registers, otherwise the ITS could read dirty tables, which results in unpredictable behavior. Flush the tables right at the begin of its_setup_baser() to prevent that. [ tglx: Massage changelog ] Fixes: a8707f553884 ("irqchip/gic-v3: Add Rockchip 3588001 erratum workaround") Suggested-by: Marc Zyngier Signed-off-by: Fang Xiang Signed-off-by: Thomas Gleixner Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20231030083256.4345-1-fangxiang3@xiaomi.com drivers/irqchip/irq-gic-v3-its.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) commit dbfbda3bd6bfb5189e05b9eab8dfaad2d1d23f62 Author: Jisheng Zhang Date: Tue Sep 12 15:25:10 2023 +0800 riscv: mm: update T-Head memory type definitions Update T-Head memory type definitions according to C910 doc [1] For NC and IO, SH property isn't configurable, hardcoded as SH, so set SH for NOCACHE and IO. And also set bit[61](Bufferable) for NOCACHE according to the table 6.1 in the doc [1]. Link: https://github.com/T-head-Semi/openc910 [1] Signed-off-by: Jisheng Zhang Reviewed-by: Guo Ren Tested-by: Drew Fustini Link: https://lore.kernel.org/r/20230912072510.2510-1-jszhang@kernel.org Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/pgtable-64.h | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) commit 7f00a975005f5656ee2bf656bab1c1657c587e2b Merge: b8a03a634129 8f8c1ff879fa Author: Palmer Dabbelt Date: Sun Nov 5 14:15:17 2023 -0800 Merge patch series "riscv: vdso.lds.S: some improvement" Jisheng Zhang says: This series renews one of my last year RFC patch[1], tries to improve the vdso layout a bit. patch1 removes useless symbols patch2 merges .data section of vdso into .rodata because they are readonly patch3 is the real renew patch, it removes hardcoded 0x800 .text start addr. But I rewrite the commit msg per Andrew's suggestions and move move .note, .eh_frame_hdr, and .eh_frame between .rodata and .text to keep the actual code well away from the non-instruction data. * b4-shazam-merge: riscv: vdso.lds.S: remove hardcoded 0x800 .text start addr riscv: vdso.lds.S: merge .data section into .rodata section riscv: vdso.lds.S: drop __alt_start and __alt_end symbols Link: https://lore.kernel.org/linux-riscv/20221123161805.1579-1-jszhang@kernel.org/ [1] Link: https://lore.kernel.org/r/20230912072015.2424-1-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit 8f8c1ff879fab60f80f3a7aec3000f47e5b03ba9 Author: Jisheng Zhang Date: Tue Sep 12 15:20:15 2023 +0800 riscv: vdso.lds.S: remove hardcoded 0x800 .text start addr I believe the hardcoded 0x800 and related comments come from the long history VDSO_TEXT_OFFSET in x86 vdso code, but commit 5b9304933730 ("x86 vDSO: generate vdso-syms.lds") and commit f6b46ebf904f ("x86 vDSO: new layout") removes the comment and hard coding for x86. Similar as x86 and other arch, riscv doesn't need the rigid layout using VDSO_TEXT_OFFSET since it "no longer matters to the kernel". so we could remove the hard coding now, and removing it brings a small vdso.so and aligns with other architectures. Also, having enough separation between data and text is important for I-cache, so similar as x86, move .note, .eh_frame_hdr, and .eh_frame between .rodata and .text. Signed-off-by: Jisheng Zhang Reviewed-by: Andrew Jones Tested-by: Emil Renner Berthing Link: https://lore.kernel.org/r/20230912072015.2424-4-jszhang@kernel.org Signed-off-by: Palmer Dabbelt arch/riscv/kernel/vdso/vdso.lds.S | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) commit 49cfbdc21faf5fffbdaa8fd31e1451a4432cfdaa Author: Jisheng Zhang Date: Tue Sep 12 15:20:14 2023 +0800 riscv: vdso.lds.S: merge .data section into .rodata section The .data section doesn't need to be separate from .rodata section, they are both readonly. Signed-off-by: Jisheng Zhang Tested-by: Emil Renner Berthing Link: https://lore.kernel.org/r/20230912072015.2424-3-jszhang@kernel.org Signed-off-by: Palmer Dabbelt arch/riscv/kernel/vdso/vdso.lds.S | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit ddcc7d9bf531b2e950bc4a745a41c825a4759ae6 Author: Jisheng Zhang Date: Tue Sep 12 15:20:13 2023 +0800 riscv: vdso.lds.S: drop __alt_start and __alt_end symbols These two symbols are not used, remove them. Signed-off-by: Jisheng Zhang Tested-by: Emil Renner Berthing Link: https://lore.kernel.org/r/20230912072015.2424-2-jszhang@kernel.org Signed-off-by: Palmer Dabbelt arch/riscv/kernel/vdso/vdso.lds.S | 2 -- 1 file changed, 2 deletions(-) commit b8a03a634129b61a7ec69ece4460297ffbd790dc Author: Yunhui Cui Date: Tue Sep 12 10:13:49 2023 +0800 riscv: add userland instruction dump to RISC-V splats Add userland instruction dump and rename dump_kernel_instr() to dump_instr(). An example: [ 0.822439] Freeing unused kernel image (initmem) memory: 6916K [ 0.823817] Run /init as init process [ 0.839411] init[1]: unhandled signal 4 code 0x1 at 0x000000000005be18 in bb[10000+5fb000] [ 0.840751] CPU: 0 PID: 1 Comm: init Not tainted 5.14.0-rc4-00049-gbd644290aa72-dirty #187 [ 0.841373] Hardware name: , BIOS [ 0.841743] epc : 000000000005be18 ra : 0000000000079e74 sp : 0000003fffcafda0 [ 0.842271] gp : ffffffff816e9dc8 tp : 0000000000000000 t0 : 0000000000000000 [ 0.842947] t1 : 0000003fffc9fdf0 t2 : 0000000000000000 s0 : 0000000000000000 [ 0.843434] s1 : 0000000000000000 a0 : 0000003fffca0190 a1 : 0000003fffcafe18 [ 0.843891] a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000 [ 0.844357] a5 : 0000000000000000 a6 : 0000000000000000 a7 : 0000000000000000 [ 0.844803] s2 : 0000000000000000 s3 : 0000000000000000 s4 : 0000000000000000 [ 0.845253] s5 : 0000000000000000 s6 : 0000000000000000 s7 : 0000000000000000 [ 0.845722] s8 : 0000000000000000 s9 : 0000000000000000 s10: 0000000000000000 [ 0.846180] s11: 0000000000d144e0 t3 : 0000000000000000 t4 : 0000000000000000 [ 0.846616] t5 : 0000000000000000 t6 : 0000000000000000 [ 0.847204] status: 0000000200000020 badaddr: 00000000f0028053 cause: 0000000000000002 [ 0.848219] Code: f06f ff5f 3823 fa11 0113 fb01 2e23 0201 0293 0000 (8053) f002 [ 0.851016] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000004 Signed-off-by: Yunhui Cui Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20230912021349.28302-1-cuiyunhui@bytedance.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/traps.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) commit 8cb22bec142624d21bc85ff96b7bad10b6220e6a Author: Nam Cao Date: Tue Aug 29 20:25:00 2023 +0200 riscv: kprobes: allow writing to x0 Instructions can write to x0, so we should simulate these instructions normally. Currently, the kernel hangs if an instruction who writes to x0 is simulated. Fixes: c22b0bcb1dd0 ("riscv: Add kprobes supported") Cc: stable@vger.kernel.org Signed-off-by: Nam Cao Reviewed-by: Charlie Jenkins Acked-by: Guo Ren Link: https://lore.kernel.org/r/20230829182500.61875-1-namcaov@gmail.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/probes/simulate-insn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b701f9e726f0a30a94ea6af596b74c1f07b95b6b Author: Nam Cao Date: Tue Aug 29 10:36:15 2023 +0200 riscv: provide riscv-specific is_trap_insn() uprobes expects is_trap_insn() to return true for any trap instructions, not just the one used for installing uprobe. The current default implementation only returns true for 16-bit c.ebreak if C extension is enabled. This can confuse uprobes if a 32-bit ebreak generates a trap exception from userspace: uprobes asks is_trap_insn() who says there is no trap, so uprobes assume a probe was there before but has been removed, and return to the trap instruction. This causes an infinite loop of entering and exiting trap handler. Instead of using the default implementation, implement this function speficially for riscv with checks for both ebreak and c.ebreak. Fixes: 74784081aac8 ("riscv: Add uprobes supported") Signed-off-by: Nam Cao Tested-by: Björn Töpel Reviewed-by: Guo Ren Link: https://lore.kernel.org/r/20230829083614.117748-1-namcaov@gmail.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/probes/uprobes.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 02e790ee3077c0571794d0ab8f71413edbe129cc Author: Alexander Gordeev Date: Fri Nov 3 16:43:52 2023 +0100 s390/mm: make pte_free_tlb() similar to pXd_free_tlb() Make pte_free_tlb() look similar to pXd_free_tlb() family functions. Reviewed-by: Heiko Carstens Reviewed-by: Gerald Schaefer Signed-off-by: Alexander Gordeev Signed-off-by: Vasily Gorbik arch/s390/include/asm/pgalloc.h | 1 - arch/s390/include/asm/tlb.h | 4 +++- arch/s390/mm/pgalloc.c | 11 ----------- 3 files changed, 3 insertions(+), 13 deletions(-) commit 0031f1c7cf2632a068a80261071b9b1f2d32d836 Author: Alexander Gordeev Date: Fri Nov 3 16:40:13 2023 +0100 s390/mm: use compound page order to distinguish page tables CRSTs always have size of four pages, while 2KB-size page tables always occupy a single page. Use that information to distinguish page tables from CRSTs. Reviewed-by: Heiko Carstens Reviewed-by: Gerald Schaefer Signed-off-by: Alexander Gordeev Signed-off-by: Vasily Gorbik arch/s390/mm/pgalloc.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) commit d08d4e7cd6bffe333f09853005aa549a8d57614b Author: Alexander Gordeev Date: Thu Oct 12 20:28:51 2023 +0200 s390/mm: use full 4KB page for 2KB PTE Cease using 4KB pages to host two 2KB PTEs. That greatly simplifies the memory management code at the expense of page tables memory footprint. Instead of two PTEs per 4KB page use only upper half of the parent page for a single PTE. With that the list of half-used pages pgtable_list becomes unneeded. Further, the upper byte of the parent page _refcount counter does not need to be used for fragments tracking and could be left alone. Commit 8211dad62798 ("s390: add pte_free_defer() for pgtables sharing page") introduced the use of PageActive flag to coordinate a deferred free with 2KB page table fragments tracking. Since there is no tracking anymore, there is no need for using PageActive flag. Reviewed-by: Heiko Carstens Reviewed-by: Gerald Schaefer Signed-off-by: Alexander Gordeev Signed-off-by: Vasily Gorbik arch/s390/include/asm/mmu.h | 2 - arch/s390/include/asm/mmu_context.h | 1 - arch/s390/include/asm/tlb.h | 5 - arch/s390/mm/pgalloc.c | 285 ++++-------------------------------- 4 files changed, 31 insertions(+), 262 deletions(-) commit a51324c430db3fcf3e7d77c265491322c251a396 Author: Heiko Carstens Date: Fri Oct 27 14:12:39 2023 +0200 s390/cmma: rework no-dat handling Rework the way physical pages are set no-dat / dat: The old way is: - Rely on that all pages are initially marked "dat" - Allocate page tables for the kernel mapping - Enable dat - Walk the whole kernel mapping and set PG_arch_1 bit in all struct pages that belong to pages of kernel page tables - Walk all struct pages and test and clear the PG_arch_1 bit. If the bit is not set, set the page state to no-dat - For all subsequent page table allocations, set the page state to dat (remove the no-dat state) on allocation time Change this rather complex logic to a simpler approach: - Set the whole physical memory (all pages) to "no-dat" - Explicitly set those page table pages to "dat" which are part of the kernel image (e.g. swapper_pg_dir) - For all subsequent page table allocations, set the page state to dat (remove the no-dat state) on allocation time In result the code is simpler, and this also allows to get rid of one odd usage of the PG_arch_1 bit. Reviewed-by: Claudio Imbrenda Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/boot/vmem.c | 17 ++++++ arch/s390/include/asm/setup.h | 2 - arch/s390/mm/init.c | 2 - arch/s390/mm/page-states.c | 127 +----------------------------------------- arch/s390/mm/vmem.c | 4 +- 5 files changed, 21 insertions(+), 131 deletions(-) commit 65d37f163add1c6ead3a63788acb2f9590159f94 Author: Heiko Carstens Date: Fri Oct 27 14:12:38 2023 +0200 s390/cmma: move arch_set_page_dat() to header file In order to be usable for early boot code move the simple arch_set_page_dat() function to header file, and add its counter-part arch_set_page_nodat(). Also change the parameters, and the function name slightly. This is required since there aren't any struct pages available in early boot code, and renaming of functions is done to make sure that all users are converted to the new API. Instead of a pointer to a struct page a virtual address is passed, and instead of an order the number of pages for which the page state needs be set. Reviewed-by: Claudio Imbrenda Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/include/asm/page-states.h | 17 +++++++++++++++++ arch/s390/include/asm/page.h | 1 - arch/s390/mm/gmap.c | 4 ++-- arch/s390/mm/page-states.c | 7 ------- arch/s390/mm/pgalloc.c | 13 ++++++++----- arch/s390/mm/vmem.c | 2 +- 6 files changed, 28 insertions(+), 16 deletions(-) commit a3e89e20fe00209779eb3e419621070b9158acdb Author: Heiko Carstens Date: Fri Oct 27 14:12:37 2023 +0200 s390/cmma: move set_page_stable() and friends to header file In order to be usable for early boot code move the simple set_page_xxx() function to header file. Also change the parameters, and the function names slightly. This is required since there aren't any struct pages available in early boot code, and renaming of functions is done to make sure that all users are converted to the new API. Instead of a pointer to a struct page a virtual address is passed, and instead of an order the number of pages for which the page state needs be set. Reviewed-by: Claudio Imbrenda Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/include/asm/page-states.h | 38 ++++++++++++++++++++++++++++++ arch/s390/mm/page-states.c | 47 ++++--------------------------------- 2 files changed, 43 insertions(+), 42 deletions(-) commit 468a3bc2b7b955a7cf97d47c6022bf1ae4a538a3 Author: Heiko Carstens Date: Fri Oct 27 14:12:36 2023 +0200 s390/cmma: move parsing of cmma kernel parameter to early boot code The "cmma=" kernel command line parameter needs to be parsed early for upcoming changes. Therefore move the parsing code. Note that EX_TABLE handling of cmma_test_essa() needs to be open-coded, since the early boot code doesn't have infrastructure for handling expected exceptions. Reviewed-by: Claudio Imbrenda Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/boot/ipl_parm.c | 8 +++++++ arch/s390/boot/startup.c | 44 +++++++++++++++++++++++++++++++++++++ arch/s390/include/asm/page-states.h | 4 ++++ arch/s390/include/asm/setup.h | 1 - arch/s390/kernel/early.c | 1 + arch/s390/mm/init.c | 2 -- arch/s390/mm/page-states.c | 40 +-------------------------------- 7 files changed, 58 insertions(+), 42 deletions(-) commit 92b519f3bc1c90e098bb3f12d8e739fc56c2d444 Author: Heiko Carstens Date: Fri Oct 27 14:12:35 2023 +0200 s390/cmma: cleanup inline assemblies Cleanup cmma related inline assemblies: - consolidate inline assemblies - use symbolic names - add same white space where missing - add braces to for-loops which contain a multi-line statement Reviewed-by: Claudio Imbrenda Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/mm/page-states.c | 48 +++++++++++++++++++++++++--------------------- 1 file changed, 26 insertions(+), 22 deletions(-) commit 5cf1a563a3284dc5c9f4ee8917ad2ebd51ff3def Author: Harald Freudenberger Date: Thu Oct 26 09:33:31 2023 +0200 s390/ap: fix vanishing crypto cards in SE environment A secure execution (SE, also known as confidential computing) guest may see asynchronous errors on a crypto firmware queue. The current implementation to gather information about cards and queues in ap_queue_info() simple returns if an asynchronous error is hanging on the firmware queue. If such a situation happened and it was the only queue visible for a crypto card within an SE guest, then the card vanished from sysfs as the AP bus scan function refuses to hold a card without any type information. As lszcrypt evaluates the sysfs such a card vanished from the lszcrypt card listing and the user is baffled and has no way to reset and thus clear the pending asynchronous error. This patch improves the named function to also evaluate GR2 of the TAPQ in case of asynchronous error pending. If there is a not-null value stored in, the info is processed now. In the end, a queue with pending asynchronous error does not lead to a vanishing card any more. Reviewed-by: Holger Dengler Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik drivers/s390/crypto/ap_bus.c | 43 ++++++++++++++++++++----------------------- 1 file changed, 20 insertions(+), 23 deletions(-) commit cfaef6516e9ac64e36967bd74d173b67fef6eee4 Author: Ingo Franzki Date: Thu Oct 26 11:24:03 2023 +0200 s390/zcrypt: don't report online if card or queue is in check-stop state If a card or a queue is in check-stop state, it can't be used by applications to perform crypto operations. Applications check the 'online' sysfs attribute to check if a card or queue is usable. Report a card or queue as offline in case it is in check-stop state. Furthermore, don't allow to set a card or queue online, if it is in check-stop state. This is similar to when the card or the queue is in deconfigured state, there it is also reported as being offline, and it can't be set online. Reviewed-by: Harald Freudenberger Signed-off-by: Ingo Franzki Signed-off-by: Vasily Gorbik drivers/s390/crypto/zcrypt_card.c | 4 ++-- drivers/s390/crypto/zcrypt_queue.c | 5 +++-- 2 files changed, 5 insertions(+), 4 deletions(-) commit aa44433ac4ee2ae59b4b11e01eddb6241ae24ef5 Author: Heiko Carstens Date: Mon Oct 30 16:50:47 2023 +0100 s390: add USER_STACKTRACE support Use the perf_callchain_user() code as blueprint to also add support for USER_STACKTRACE. To describe how to use this cite the commit message of the LoongArch implementation which came with commit 4d7bf939df08 ("LoongArch: Add USER_STACKTRACE support"), but replace -fno-omit-frame-pointer option with the s390 specific -mbackchain option: ====================================================================== To get the best stacktrace output, you can compile your userspace programs with frame pointers (at least glibc + the app you are tracing). 1, export "CC = gcc -mbackchain"; 2, compile your programs with "CC"; 3, use uprobe to get stacktrace output. ... echo 'p:malloc /usr/lib64/libc.so.6:0x0a4704 size=%r2:u64' > uprobe_events echo 'p:free /usr/lib64/libc.so.6:0x0a4d50 ptr=%r2:u64' >> uprobe_events echo 'comm == "demo"' > ./events/uprobes/malloc/filter echo 'comm == "demo"' > ./events/uprobes/free/filter echo 1 > ./options/userstacktrace echo 1 > ./options/sym-userobj ... ====================================================================== Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/Kconfig | 1 + arch/s390/kernel/stacktrace.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+) commit 504b73d00a55a68c0d1bb0e7c12e56e5f908e906 Author: Heiko Carstens Date: Mon Oct 30 16:50:46 2023 +0100 s390/perf: implement perf_callchain_user() Daan De Meyer and Neal Gompa reported that s390 does not support perf user stack unwinding. This was never implemented since this requires user space to be compiled with the -mbackchain compile option, which until now no distribution did. However this is going to change with Fedora. Therefore provide a perf_callchain_user() implementation. Note that due to the way s390 sets up stack frames the provided call chains can contain invalid values. This is especially true for the first stack frame, where it is not possible to tell if the return address has been written to the stack already or not. Reported-by: Daan De Meyer Reported-by: Neal Gompa Closes: https://lore.kernel.org/all/CAO8sHcn3+_qrnvp0580aK7jN0Wion5F7KYeBAa4MnCY4mqABPA@mail.gmail.com/ Link: https://lore.kernel.org/all/20231030123558.10816-A-hca@linux.ibm.com Reviewed-by: Neal Gompa Acked-by: Ilya Leoshkevich Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/include/asm/stacktrace.h | 7 +++++++ arch/s390/kernel/perf_event.c | 41 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+) commit e14aec23025eeb1f2159ba34dbc1458467c4c347 Author: Harald Freudenberger Date: Mon Oct 23 09:57:10 2023 +0200 s390/ap: fix AP bus crash on early config change callback invocation Fix kernel crash in AP bus code caused by very early invocation of the config change callback function via SCLP. After a fresh IML of the machine the crypto cards are still offline and will get switched online only with activation of any LPAR which has the card in it's configuration. A crypto card coming online is reported to the LPAR via SCLP and the AP bus offers a callback function to get this kind of information. However, it may happen that the callback is invoked before the AP bus init function is complete. As the callback triggers a synchronous AP bus scan, the scan may already run but some internal states are not initialized by the AP bus init function resulting in a crash like this: [ 11.635859] Unable to handle kernel pointer dereference in virtual kernel address space [ 11.635861] Failing address: 0000000000000000 TEID: 0000000000000887 [ 11.635862] Fault in home space mode while using kernel ASCE. [ 11.635864] AS:00000000894c4007 R3:00000001fece8007 S:00000001fece7800 P:000000000000013d [ 11.635879] Oops: 0004 ilc:1 [#1] SMP [ 11.635882] Modules linked in: [ 11.635884] CPU: 5 PID: 42 Comm: kworker/5:0 Not tainted 6.6.0-rc3-00003-g4dbf7cdc6b42 #12 [ 11.635886] Hardware name: IBM 3931 A01 751 (LPAR) [ 11.635887] Workqueue: events_long ap_scan_bus [ 11.635891] Krnl PSW : 0704c00180000000 0000000000000000 (0x0) [ 11.635895] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3 [ 11.635897] Krnl GPRS: 0000000001000a00 0000000000000000 0000000000000006 0000000089591940 [ 11.635899] 0000000080000000 0000000000000a00 0000000000000000 0000000000000000 [ 11.635901] 0000000081870c00 0000000089591000 000000008834e4e2 0000000002625a00 [ 11.635903] 0000000081734200 0000038000913c18 000000008834c6d6 0000038000913ac8 [ 11.635906] Krnl Code:>0000000000000000: 0000 illegal [ 11.635906] 0000000000000002: 0000 illegal [ 11.635906] 0000000000000004: 0000 illegal [ 11.635906] 0000000000000006: 0000 illegal [ 11.635906] 0000000000000008: 0000 illegal [ 11.635906] 000000000000000a: 0000 illegal [ 11.635906] 000000000000000c: 0000 illegal [ 11.635906] 000000000000000e: 0000 illegal [ 11.635915] Call Trace: [ 11.635916] [<0000000000000000>] 0x0 [ 11.635918] [<000000008834e4e2>] ap_queue_init_state+0x82/0xb8 [ 11.635921] [<000000008834ba1c>] ap_scan_domains+0x6fc/0x740 [ 11.635923] [<000000008834c092>] ap_scan_adapter+0x632/0x8b0 [ 11.635925] [<000000008834c3e4>] ap_scan_bus+0xd4/0x288 [ 11.635927] [<00000000879a33ba>] process_one_work+0x19a/0x410 [ 11.635930] Discipline DIAG cannot be used without z/VM [ 11.635930] [<00000000879a3a2c>] worker_thread+0x3fc/0x560 [ 11.635933] [<00000000879aea60>] kthread+0x120/0x128 [ 11.635936] [<000000008792afa4>] __ret_from_fork+0x3c/0x58 [ 11.635938] [<00000000885ebe62>] ret_from_fork+0xa/0x30 [ 11.635942] Last Breaking-Event-Address: [ 11.635942] [<000000008834c6d4>] ap_wait+0xcc/0x148 This patch improves the ap_bus_force_rescan() function which is invoked by the config change callback by checking if a first initial AP bus scan has been done. If not, the force rescan request is simple ignored. Anyhow it does not make sense to trigger AP bus re-scans even before the very first bus scan is complete. Cc: stable@vger.kernel.org Reviewed-by: Holger Dengler Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik drivers/s390/crypto/ap_bus.c | 4 ++++ 1 file changed, 4 insertions(+) commit c40284b3642554d6cf519525872f2f5784933d8d Author: Harald Freudenberger Date: Mon Oct 23 15:42:21 2023 +0200 s390/ap: re-enable interrupt for AP queues This patch introduces some code lines which check for interrupt support enabled on an AP queue after a reply has been received. This invocation has been chosen as there is a good chance to have the queue empty at that time. As the enablement of the irq imples a state machine change the queue should not have any pending requests or unreceived replies. Reviewed-by: Tony Krowiak Reviewed-by: Holger Dengler Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik drivers/s390/crypto/ap_queue.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit 01c89ab7f81b76de00daccf6a856a00eb63a17d7 Author: Harald Freudenberger Date: Mon Oct 23 14:50:11 2023 +0200 s390/ap: rework to use irq info from ap queue status This patch reworks the irq handling and reporting code for the AP queue interrupt handling to always use the irq info from the queue status. Until now the interrupt status of an AP queue was stored into a bool variable within the ap_queue struct. This variable was set on a successful interrupt enablement and cleared with kicking a reset. However, it may be that the interrupt state is manipulated outband for example by a hypervisor. This patch removes this variable and instead the irq bit from the AP queue status which is always reflecting the current irq state is used. Reviewed-by: Tony Krowiak Reviewed-by: Holger Dengler Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik drivers/s390/crypto/ap_bus.h | 1 - drivers/s390/crypto/ap_queue.c | 22 ++++++++++++---------- 2 files changed, 12 insertions(+), 11 deletions(-) commit 0547e0bd9b95da18747009c2091846fcb5691a6f Author: Alexander Gordeev Date: Mon Oct 23 21:16:41 2023 +0200 s390/mm: add missing conversion to use ptdescs Commit 6326c26c1514 ("s390: convert various pgalloc functions to use ptdescs") missed to convert tlb_remove_table() into tlb_remove_ptdesc() in few locations. Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev Signed-off-by: Vasily Gorbik arch/s390/include/asm/tlb.h | 4 ++-- arch/s390/mm/pgalloc.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) commit 77fa2fbe87fc605c4bfa87dff87be9bfded0e9a3 Merge: 1cfb751165ef 86f6c224c979 Author: Linus Torvalds Date: Sun Nov 5 09:02:32 2023 -1000 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: "vhost,virtio,vdpa: features, fixes, cleanups. vdpa/mlx5: - VHOST_BACKEND_F_ENABLE_AFTER_DRIVER_OK - new maintainer vdpa: - support for vq descriptor mappings - decouple reset of iotlb mapping from device reset and fixes, cleanups all over the place" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (34 commits) vdpa_sim: implement .reset_map support vdpa/mlx5: implement .reset_map driver op vhost-vdpa: clean iotlb map during reset for older userspace vdpa: introduce .compat_reset operation callback vhost-vdpa: introduce IOTLB_PERSIST backend feature bit vhost-vdpa: reset vendor specific mapping to initial state in .release vdpa: introduce .reset_map operation callback virtio_pci: add check for common cfg size virtio-blk: fix implicit overflow on virtio_max_dma_size virtio_pci: add build offset check for the new common cfg items virtio: add definition of VIRTIO_F_NOTIF_CONFIG_DATA feature bit vduse: make vduse_class constant vhost-scsi: Spelling s/preceeding/preceding/g virtio: kdoc for struct virtio_pci_modern_device vdpa: Update sysfs ABI documentation MAINTAINERS: Add myself as mlx5_vdpa driver virtio-balloon: correct the comment of virtballoon_migratepage() mlx5_vdpa: offer VHOST_BACKEND_F_ENABLE_AFTER_DRIVER_OK vdpa/mlx5: Update cvq iotlb mapping on ASID change vdpa/mlx5: Make iotlb helper functions more generic ... commit 1cfb751165ef685b80635218beff38d6afbce4e2 Merge: 3d05e493e461 c12d7aa7ffa4 Author: Linus Torvalds Date: Sun Nov 5 08:50:41 2023 -1000 Merge tag 'firewire-updates-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire update from Takashi Sakamoto: "A slight change for flexible length of array in core function. Kees Cook provides a patch to annotate the array embedded in fw_node structure referring to structure member for the length of array. The annotation would be defined by future extension of C compilers, and used for access bound-check at run-time enabled by UBSAN and FORTIFY_SOURCE" * tag 'firewire-updates-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: Annotate struct fw_node with __counted_by commit 3d05e493e461c4469a9b73e00e59ea16e1d8a416 Merge: 2153fc3d6817 10e806d39d30 Author: Linus Torvalds Date: Sun Nov 5 08:41:14 2023 -1000 Merge tag 'i2c-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "I2C has largely driver updates for 6.7, i.e. feature additions (like adding transfers while in atomic mode), using new helpers (like devm_clk_get_enabled), new IDs, documentation fixes and additions... you name it. The core got a memleak fix and better support for nested muxes" * tag 'i2c-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (53 commits) i2c: s3c2410: make i2c_s3c_irq_nextbyte() void i2c: qcom-geni: add ACPI device id for sc8180x Documentation: i2c: add fault code for not supporting 10 bit addresses i2c: sun6i-p2wi: Prevent potential division by zero i2c: mux: demux-pinctrl: Convert to use sysfs_emit_at() API i2c: i801: Use new helper acpi_use_parent_companion ACPI: Add helper acpi_use_parent_companion MAINTAINERS: add YAML file for i2c-demux-pinctrl i2c: core: fix lockdep warning for sparsely nested adapter chain i2c: axxia: eliminate kernel-doc warnings dt-bindings: i2c: i2c-demux-pinctrl: Convert to json-schema i2c: stm32f7: Use devm_clk_get_enabled() i2c: stm32f4: Use devm_clk_get_enabled() i2c: stm32f7: add description of atomic in struct stm32f7_i2c_dev i2c: fix memleak in i2c_new_client_device() i2c: exynos5: Calculate t_scl_l, t_scl_h according to i2c spec i2c: i801: Simplify class-based client device instantiation i2c: exynos5: add support for atomic transfers i2c: at91-core: Use devm_clk_get_enabled() eeprom: at24: add ST M24C64-D Additional Write lockable page support ... commit 2153fc3d68170bb67be8e389c2f6e0f4a9eb7cd3 Merge: 1c41041124bd 75690493591f Author: Linus Torvalds Date: Sun Nov 5 08:28:32 2023 -1000 Merge tag 'ubifs-for-linus-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs Pull UBI and UBIFS updates from Richard Weinberger: - UBI Fastmap improvements - Minor issues found by static analysis bots in both UBI and UBIFS - Fix for wrong dentry length UBIFS in fscrypt mode * tag 'ubifs-for-linus-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted ubi: block: Fix use-after-free in ubiblock_cleanup ubifs: fix possible dereference after free ubi: fastmap: Add control in 'UBI_IOCATT' ioctl to reserve PEBs for filling pools ubi: fastmap: Add module parameter to control reserving filling pool PEBs ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs ubi: fastmap: Get wl PEB even ec beyonds the 'max' if free PEBs are run out ubi: fastmap: may_reserve_for_fm: Don't reserve PEB if fm_anchor exists ubi: fastmap: Remove unneeded break condition while filling pools ubi: fastmap: Wait until there are enough free PEBs before filling pools ubi: fastmap: Use free pebs reserved for bad block handling ubi: Replace erase_block() with sync_erase() ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash ubi: fastmap: Fix missed ec updating after erasing old fastmap data block ubifs: Fix missing error code err ubifs: Fix memory leak of bud->log_hash ubifs: Fix some kernel-doc comments commit c7046ed0cf9bb33599aa7e72e7b67bba4be42d64 Author: Kent Overstreet Date: Sat Nov 4 22:34:37 2023 -0400 bcachefs: Improve stripe checksum error message We now include the name of the device in the error message - and also increment the number of checksum errors on that device. Signed-off-by: Kent Overstreet fs/bcachefs/ec.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) commit 853960d00b4b3df96acbf8e18980896f9115c45c Author: Kent Overstreet Date: Sat Nov 4 20:22:56 2023 -0400 bcachefs: Simplify, fix bch2_backpointer_get_key() - backpointer_not_found() checks backpointers_no_use_write_buffer, no need to do it inbackpointer_get_key(). - always use backpointer_get_node() for pointers to nodes: backpointer_get_key() was sometimes returning the key from the root node unlocked. Signed-off-by: Kent Overstreet fs/bcachefs/backpointers.c | 77 ++++++++++++++++++++-------------------------- 1 file changed, 33 insertions(+), 44 deletions(-) commit daba90f2da9d1a32b94552207f8dad5adb646a5c Author: Kent Overstreet Date: Sat Nov 4 21:22:34 2023 -0400 bcachefs: kill thing_it_points_to arg to backpointer_not_found() This can be calculated locally. Signed-off-by: Kent Overstreet fs/bcachefs/backpointers.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit aa982665887590a9443f12323fdf508a22d8c86f Author: Kent Overstreet Date: Sat Nov 4 00:25:52 2023 -0400 bcachefs: bch2_ec_read_extent() now takes btree_trans We're not supposed to have more than one btree_trans at a time in a given thread - that causes recursive locking deadlocks. Signed-off-by: Kent Overstreet fs/bcachefs/ec.c | 10 +++------- fs/bcachefs/ec.h | 2 +- fs/bcachefs/io_read.c | 2 +- 3 files changed, 5 insertions(+), 9 deletions(-) commit da4aa3b00123b8a588d23482993751e88bbaa324 Author: Kent Overstreet Date: Fri Nov 3 23:56:14 2023 -0400 bcachefs: bch2_stripe_to_text() now prints ptr gens Signed-off-by: Kent Overstreet fs/bcachefs/ec.c | 1 + 1 file changed, 1 insertion(+) commit 769b3600495b8a2ea3c2136121800ce6b566a457 Author: Kent Overstreet Date: Thu Nov 2 21:43:26 2023 -0400 bcachefs: Don't iterate over journal entries just for btree roots Small performance optimization, and a bit of a code cleanup too. Signed-off-by: Kent Overstreet fs/bcachefs/btree_update_interior.c | 12 +++------ fs/bcachefs/btree_update_interior.h | 2 +- fs/bcachefs/journal_io.c | 53 +++++++++++++++++-------------------- fs/bcachefs/sb-clean.c | 2 +- 4 files changed, 29 insertions(+), 40 deletions(-) commit 80396a47490936f73729548310ad60e9f5df61c9 Author: Kent Overstreet Date: Thu Nov 2 21:01:25 2023 -0400 bcachefs: Break up bch2_journal_write() Split up bch2_journal_write() to simplify locking: - bch2_journal_write_pick_flush(), which needs j->lock - bch2_journal_write_prep, which operates on the journal buffer to be written and will need the upcoming buf_lock for synchronization with the btree write buffer flush path Signed-off-by: Kent Overstreet fs/bcachefs/journal_io.c | 163 ++++++++++++++++++++++++++--------------------- 1 file changed, 92 insertions(+), 71 deletions(-) commit a973de85e3976f3418f35cf82112190fac2eeddb Author: Kent Overstreet Date: Fri Nov 3 11:40:32 2023 -0400 bcachefs: Replace ERANGE with private error codes We avoid using standard error codes: private, per-callsite error codes make debugging easier. Signed-off-by: Kent Overstreet fs/bcachefs/errcode.h | 2 ++ fs/bcachefs/opts.c | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) commit a8958a1a95b28e16dbca0654eeb6aa458bb1d3b0 Author: Kent Overstreet Date: Thu Nov 2 19:33:48 2023 -0400 bcachefs: bkey_copy() is no longer a macro Signed-off-by: Kent Overstreet fs/bcachefs/bkey.h | 22 +++++++++------------- fs/bcachefs/bkey_sort.c | 6 +++--- fs/bcachefs/btree_io.c | 4 ++-- fs/bcachefs/btree_update_interior.h | 2 +- 4 files changed, 15 insertions(+), 19 deletions(-) commit 103ffe9aaf85660f40c8b68797a374b80b29b91d Author: Kent Overstreet Date: Thu Nov 2 11:42:48 2023 -0400 bcachefs: x-macro-ify inode flags enum This lets us use bch2_prt_bitflags to print them out. Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs_format.h | 52 ++++++++++++++++++++----------------------- fs/bcachefs/fs-common.c | 2 +- fs/bcachefs/fs-ioctl.c | 4 ++-- fs/bcachefs/fs-ioctl.h | 28 +++++++++++------------ fs/bcachefs/fs.c | 6 ++--- fs/bcachefs/fsck.c | 34 ++++++++++++++-------------- fs/bcachefs/inode.c | 38 +++++++++++++++++++------------ fs/bcachefs/inode.h | 6 ++--- fs/bcachefs/io_write.c | 2 +- 9 files changed, 89 insertions(+), 83 deletions(-) commit d4c8bb69d0208907f98af6a0f4da02778f2d7bdb Author: Kent Overstreet Date: Tue Oct 31 22:35:49 2023 -0400 bcachefs: Convert bch2_fs_open() to darray Open coded dynamic arrays are deprecated. Signed-off-by: Kent Overstreet fs/bcachefs/darray.h | 6 ++++++ fs/bcachefs/super.c | 60 ++++++++++++++++++++++++---------------------------- 2 files changed, 34 insertions(+), 32 deletions(-) commit 0f0fc312380b93d203be3282b2cbaee7016f2b72 Author: Kent Overstreet Date: Tue Oct 31 23:19:59 2023 -0400 bcachefs: Move __bch2_members_v2_get_mut to sb-members.h Signed-off-by: Kent Overstreet fs/bcachefs/sb-members.c | 17 ++++++----------- fs/bcachefs/sb-members.h | 11 ++++++++--- 2 files changed, 14 insertions(+), 14 deletions(-) commit 59154f2c66ce5625bc00f3e66af7b71608e991f4 Author: Kent Overstreet Date: Tue Oct 31 23:43:47 2023 -0400 bcachefs: bch2_prt_datetime() Improved, better named version of pr_time(). Signed-off-by: Kent Overstreet fs/bcachefs/sb-errors.c | 5 +---- fs/bcachefs/sb-members.c | 2 +- fs/bcachefs/super-io.c | 2 +- fs/bcachefs/util.c | 18 ++++++++++++++++++ fs/bcachefs/util.h | 21 +-------------------- 5 files changed, 22 insertions(+), 26 deletions(-) commit 3ce99bd6357d4789c138898d9a07916d0f3b7f29 Merge: d3eabf2f2c81 015c3c370472 Author: Palmer Dabbelt Date: Sun Nov 5 09:41:57 2023 -0800 Merge patch series "Improve PTDUMP and introduce new fields" Yu Chien Peter Lin says: This patchset enhances PTDUMP by providing additional information from pagetable entries. The first patch fixes the RSW field, while the second and third patches introduce the PBMT and NAPOT fields, respectively, for RV64 systems. * b4-shazam-merge: riscv: Introduce NAPOT field to PTDUMP riscv: Introduce PBMT field to PTDUMP riscv: Improve PTDUMP to show RSW with non-zero value Link: https://lore.kernel.org/r/20230921025022.3989723-1-peterlin@andestech.com Signed-off-by: Palmer Dabbelt commit 015c3c370472290e37143d1387c000db7ec273ad Author: Yu Chien Peter Lin Date: Thu Sep 21 10:50:22 2023 +0800 riscv: Introduce NAPOT field to PTDUMP This patch introduces the NAPOT field to PTDUMP, allowing it to display the letter "N" for pages that have the 63rd bit set. Signed-off-by: Yu Chien Peter Lin Reviewed-by: Alexandre Ghiti Tested-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230921025022.3989723-4-peterlin@andestech.com Signed-off-by: Palmer Dabbelt arch/riscv/mm/ptdump.c | 4 ++++ 1 file changed, 4 insertions(+) commit 0713ff337173884bcaf163e44cadd6a56bc8193a Author: Yu Chien Peter Lin Date: Thu Sep 21 10:50:21 2023 +0800 riscv: Introduce PBMT field to PTDUMP This patch introduces the PBMT field to the PTDUMP, so it can display the memory attributes for NC or IO. Signed-off-by: Yu Chien Peter Lin Reviewed-by: Alexandre Ghiti Tested-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230921025022.3989723-3-peterlin@andestech.com Signed-off-by: Palmer Dabbelt arch/riscv/mm/ptdump.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit d5d2c264d33b9acf1a0216861942176ee3569258 Author: Yu Chien Peter Lin Date: Thu Sep 21 10:50:20 2023 +0800 riscv: Improve PTDUMP to show RSW with non-zero value RSW field can be used to encode 2 bits of software defined information. Currently, PTDUMP only prints "RSW" when its value is 1 or 3. To fix this issue and improve the debugging experience with PTDUMP, we redefine _PAGE_SPECIAL to its original value and use _PAGE_SOFT as the RSW mask, allow it to print the RSW with any non-zero value. This patch also removes the val from the struct prot_bits as it is no longer needed. Signed-off-by: Yu Chien Peter Lin Reviewed-by: Alexandre Ghiti Tested-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230921025022.3989723-2-peterlin@andestech.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/pgtable-bits.h | 4 ++-- arch/riscv/mm/ptdump.c | 35 +++++++++++++++-------------------- 2 files changed, 17 insertions(+), 22 deletions(-) commit d3eabf2f2c81f8b0de0b75c6f41b875c501eb33b Author: Conor Dooley Date: Fri Sep 15 16:40:44 2023 +0100 RISC-V: capitalise CMO op macros The CMO op macros initially used lower case, as the original iteration of the ALT_CMO_OP alternative stringified the first parameter to finalise the assembly for the standard variant. As a knock-on, the T-Head versions of these CMOs had to use mixed case defines. Commit dd23e9535889 ("RISC-V: replace cbom instructions with an insn-def") removed the asm construction with stringify, replacing it an insn-def macro, rending the lower-case surplus to requirements. As far as I can tell from a brief check, CBO_zero does not see similar use and didn't require the mixed case define in the first place. Replace the lower case characters now for consistency with other insn-def macros in the standard and T-Head forms, and adjust the callsites. Suggested-by: Andrew Jones Signed-off-by: Conor Dooley Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20230915-aloe-dollar-994937477776@spud Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/errata_list.h | 6 +++--- arch/riscv/include/asm/insn-def.h | 8 ++++---- arch/riscv/lib/clear_page.S | 32 ++++++++++++++++---------------- arch/riscv/mm/dma-noncoherent.c | 8 ++++---- arch/riscv/mm/pmem.c | 4 ++-- 5 files changed, 29 insertions(+), 29 deletions(-) commit c20d36cc2a2073d4cdcda92bd7a1bb9b3b3b7c79 Author: Jisheng Zhang Date: Tue Sep 12 23:40:40 2023 +0800 riscv: don't probe unaligned access speed if already done If misaligned_access_speed percpu var isn't so called "HWPROBE MISALIGNED UNKNOWN", it means the probe has happened(this is possible for example, hotplug off then hotplug on one cpu), and the percpu var has been set, don't probe again in this case. Signed-off-by: Jisheng Zhang Fixes: 584ea6564bca ("RISC-V: Probe for unaligned access speed") Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230912154040.3306-1-jszhang@kernel.org Signed-off-by: Palmer Dabbelt arch/riscv/kernel/cpufeature.c | 4 ++++ 1 file changed, 4 insertions(+) commit 07863871dfb162965b21bb8c2e4861bdb0019da3 Author: Jinyu Tang Date: Tue Sep 12 21:31:28 2023 +0800 riscv: defconfig : add CONFIG_MMC_DW for starfive If these config not set, mmc can't run for jh7110, rootfs can't be found when using SD card. So set CONFIG_MMC_DW=y like arm64 defconfig, and set CONFIG_MMC_DW_STARFIVE=y for starfive. Then starfive vf2 board can start SD card rootfs with mainline defconfig and dtb. Signed-off-by: Jinyu Tang Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230912133128.5247-1-tangjinyu@tinylab.org Signed-off-by: Palmer Dabbelt arch/riscv/configs/defconfig | 2 ++ 1 file changed, 2 insertions(+) commit ce4f78f1b53d3327fbd32764aa333bf05fb68818 Author: Haorong Lu Date: Thu Aug 3 15:44:54 2023 -0700 riscv: signal: handle syscall restart before get_signal In the current riscv implementation, blocking syscalls like read() may not correctly restart after being interrupted by ptrace. This problem arises when the syscall restart process in arch_do_signal_or_restart() is bypassed due to changes to the regs->cause register, such as an ebreak instruction. Steps to reproduce: 1. Interrupt the tracee process with PTRACE_SEIZE & PTRACE_INTERRUPT. 2. Backup original registers and instruction at new_pc. 3. Change pc to new_pc, and inject an instruction (like ebreak) to this address. 4. Resume with PTRACE_CONT and wait for the process to stop again after executing ebreak. 5. Restore original registers and instructions, and detach from the tracee process. 6. Now the read() syscall in tracee will return -1 with errno set to ERESTARTSYS. Specifically, during an interrupt, the regs->cause changes from EXC_SYSCALL to EXC_BREAKPOINT due to the injected ebreak, which is inaccessible via ptrace so we cannot restore it. This alteration breaks the syscall restart condition and ends the read() syscall with an ERESTARTSYS error. According to include/linux/errno.h, it should never be seen by user programs. X86 can avoid this issue as it checks the syscall condition using a register (orig_ax) exposed to user space. Arm64 handles syscall restart before calling get_signal, where it could be paused and inspected by ptrace/debugger. This patch adjusts the riscv implementation to arm64 style, which also checks syscall using a kernel register (syscallno). It ensures the syscall restart process is not bypassed when changes to the cause register occur, providing more consistent behavior across various architectures. For a simplified reproduction program, feel free to visit: https://github.com/ancientmodern/riscv-ptrace-bug-demo. Signed-off-by: Haorong Lu Link: https://lore.kernel.org/r/20230803224458.4156006-1-ancientmodern4@gmail.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/signal.c | 85 +++++++++++++++++++++++++--------------------- 1 file changed, 46 insertions(+), 39 deletions(-) commit 0619ff9f0273b80a5bf14a327f1eb0c808cafdb4 Merge: e1c05b3bf80f 9f23a5d2f6b0 Author: Palmer Dabbelt Date: Wed Nov 1 09:02:09 2023 -0700 Merge patch series "Add support to handle misaligned accesses in S-mode" Clément Léger says: Since commit 61cadb9 ("Provide new description of misaligned load/store behavior compatible with privileged architecture.") in the RISC-V ISA manual, it is stated that misaligned load/store might not be supported. However, the RISC-V kernel uABI describes that misaligned accesses are supported. In order to support that, this series adds support for S-mode handling of misaligned accesses as well support for prctl(PR_UNALIGN). Handling misaligned access in kernel allows for a finer grain control of the misaligned accesses behavior, and thanks to the prctl() call, can allow disabling misaligned access emulation to generate SIGBUS. User space can then optimize its software by removing such access based on SIGBUS generation. This series is useful when using a SBI implementation that does not handle misaligned traps as well as detecting misaligned accesses generated by userspace application using the prctrl(PR_SET_UNALIGN) feature. This series can be tested using the spike simulator[1] and a modified openSBI version[2] which allows to always delegate misaligned load/store to S-mode. A test[3] that exercise various instructions/registers can be executed to verify the unaligned access support. [1] https://github.com/riscv-software-src/riscv-isa-sim [2] https://github.com/rivosinc/opensbi/tree/dev/cleger/no_misaligned [3] https://github.com/clementleger/unaligned_test * b4-shazam-merge: riscv: add support for PR_SET_UNALIGN and PR_GET_UNALIGN riscv: report misaligned accesses emulation to hwprobe riscv: annotate check_unaligned_access_boot_cpu() with __init riscv: add support for sysctl unaligned_enabled control riscv: add floating point insn support to misaligned access emulation riscv: report perf event for misaligned fault riscv: add support for misaligned trap handling in S-mode riscv: remove unused functions in traps_misaligned.c Link: https://lore.kernel.org/r/20231004151405.521596-1-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt commit c12d7aa7ffa4c61443241fbc1ee405acf4aa17de Author: Kees Cook Date: Fri Sep 22 10:53:35 2023 -0700 firewire: Annotate struct fw_node with __counted_by Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct fw_node. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Takashi Sakamoto Cc: linux1394-devel@lists.sourceforge.net Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20230922175334.work.335-kees@kernel.org Signed-off-by: Takashi Sakamoto drivers/firewire/core.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1c41041124bd14dd6610da256a3da4e5b74ce6b1 Merge: b8cc56d0414e 9fd00df05e81 Author: Linus Torvalds Date: Sat Nov 4 16:25:36 2023 -1000 Merge tag 'i3c/for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Alexandre Belloni: "There are now more fixes because as stated in my previous pull request, people now have access to actual hardware. Core: - handle IBI in the proper order Drivers: - cdns: fix status register access - mipi-i3c-hci: many fixes now that the driver has been actually tested - svc: many IBI fixes, correct compatible string, fix hot join corner cases" * tag 'i3c/for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: (29 commits) i3c: master: handle IBIs in order they came i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data. i3c: master: svc: fix compatibility string mismatch with binding doc i3c: master: svc: fix random hot join failure since timeout error i3c: master: svc: fix SDA keep low when polling IBIWON timeout happen i3c: master: svc: fix check wrong status register in irq handler i3c: master: svc: fix ibi may not return mandatory data byte i3c: master: svc: fix wrong data return when IBI happen during start frame i3c: master: svc: fix race condition in ibi work thread i3c: Fix typo "Provisional ID" to "Provisioned ID" i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs i3c: mipi-i3c-hci: Resume controller after aborted transfer i3c: mipi-i3c-hci: Resume controller explicitly i3c: mipi-i3c-hci: Fix missing xfer->completion in hci_cmd_v1_daa() i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer i3c: mipi-i3c-hci: Set number of SW enabled Ring Bundles earlier i3c: mipi-i3c-hci: Fix race between bus cleanup and interrupt i3c: mipi-i3c-hci: Set ring start request together with enable i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out i3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler ... commit b8cc56d0414e2330d9fe05342843512b1ad8cdb7 Merge: 5e2cb28dd7e1 4b92894064b3 Author: Linus Torvalds Date: Sat Nov 4 16:20:36 2023 -1000 Merge tag 'cxl-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull CXL (Compute Express Link) updates from Dan Williams: "The main new functionality this time is work to allow Linux to natively handle CXL link protocol errors signalled via PCIe AER for current generation CXL platforms. This required some enlightenment of the PCIe AER core to workaround the fact that current generation RCH (Restricted CXL Host) platforms physically hide topology details and registers via a mechanism called RCRB (Root Complex Register Block). The next major highlight is reworks to address bugs in parsing region configurations for next generation VH (Virtual Host) topologies. The old broken algorithm is replaced with a simpler one that significantly increases the number of region configurations supported by Linux. This is again relevant for error handling so that forward and reverse address translation of memory errors can be carried out by Linux for memory regions instantiated by platform firmware. As for other cross-tree work, the ACPI table parsing code has been refactored for reuse parsing the "CDAT" structure which is an ACPI-like data structure that is reported by CXL devices. That work is in preparation for v6.8 support for CXL QoS. Think of this as dynamic generation of NUMA node topology information generated by Linux rather than platform firmware. Lastly, a number of internal object lifetime issues have been resolved along with misc. fixes and feature updates (decoders_committed sysfs ABI). Summary: - Add support for RCH (Restricted CXL Host) Error recovery - Fix several region assembly bugs - Fix mem-device lifetime issues relative to the sanitize command and RCH topology. - Refactor ACPI table parsing for CDAT parsing re-use in preparation for CXL QOS support" * tag 'cxl-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (50 commits) lib/fw_table: Remove acpi_parse_entries_array() export cxl/pci: Change CXL AER support check to use native AER cxl/hdm: Remove broken error path cxl/hdm: Fix && vs || bug acpi: Move common tables helper functions to common lib cxl: Add support for reading CXL switch CDAT table cxl: Add checksum verification to CDAT from CXL cxl: Export QTG ids from CFMWS to sysfs as qos_class attribute cxl: Add decoders_committed sysfs attribute to cxl_port cxl: Add cxl_decoders_committed() helper cxl/core/regs: Rework cxl_map_pmu_regs() to use map->dev for devm cxl/core/regs: Rename phys_addr in cxl_map_component_regs() PCI/AER: Unmask RCEC internal errors to enable RCH downstream port error handling PCI/AER: Forward RCH downstream port-detected errors to the CXL.mem dev handler cxl/pci: Disable root port interrupts in RCH mode cxl/pci: Add RCH downstream port error logging cxl/pci: Map RCH downstream AER registers for logging protocol errors cxl/pci: Update CXL error logging to use RAS register address PCI/AER: Refactor cper_print_aer() for use by CXL driver module cxl/pci: Add RCH downstream port AER register discovery ... commit bf61dcdfc12c3890c7a062cfcd46c443883defc9 Author: Kent Overstreet Date: Sat Nov 4 18:31:42 2023 -0400 bcachefs: CONFIG_BCACHEFS_DEBUG_TRANSACTIONS no longer defaults to y BCACHEFS_DEBUG_TRANSACTIONS is useful, but it's too expensive to have on by default - and it hasn't been coming up in bug reports. Turn it off by default until we figure out a way to make it cheaper. Signed-off-by: Kent Overstreet fs/bcachefs/Kconfig | 1 - 1 file changed, 1 deletion(-) commit 9fcdd23b6eea3f04475cd9cfb4497f6e26906061 Author: Kent Overstreet Date: Sat Nov 4 13:49:31 2023 -0400 bcachefs: Add a comment for BTREE_INSERT_NOJOURNAL usage BTREE_INSERT_NOJOURNAL is primarily used for a performance optimization related to inode updates and fsync - document it. Signed-off-by: Kent Overstreet fs/bcachefs/btree_iter.c | 2 +- fs/bcachefs/btree_iter.h | 3 +-- fs/bcachefs/btree_types.h | 2 +- fs/bcachefs/io_write.c | 11 +++++++++++ 4 files changed, 14 insertions(+), 4 deletions(-) commit d3c7727bb9269c7f7a2f17ef76b9e5c9b8cc8863 Author: Kent Overstreet Date: Fri Nov 3 18:30:08 2023 -0400 bcachefs: rebalance_work btree is not a snapshots btree rebalance_work entries may refer to entries in the extents btree, which is a snapshots btree, or they may also refer to entries in the reflink btree, which is not. Hence rebalance_work keys may use the snapshot field but it's not required to be nonzero - add a new btree flag to reflect this. Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs_format.h | 7 ++++--- fs/bcachefs/bkey_methods.c | 23 ++++++++++++++--------- fs/bcachefs/btree_iter.h | 1 + fs/bcachefs/btree_trans_commit.c | 1 + fs/bcachefs/btree_types.h | 11 +++++++++++ 5 files changed, 31 insertions(+), 12 deletions(-) commit 01ccee225a373d859eb6e5d42dbe0138a40a7e0a Author: Kent Overstreet Date: Fri Nov 3 12:06:18 2023 -0400 bcachefs: Add missing printk newlines This was causing error messages in -tools to not get printed. Signed-off-by: Kent Overstreet fs/bcachefs/super-io.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 5a53f851e6fe0e7cc41e682a4a9e40bb178fb80b Author: Kent Overstreet Date: Fri Nov 3 11:55:44 2023 -0400 bcachefs: Fix recovery when forced to use JSET_NO_FLUSH journal entry When we didn't find anything in the journal that we'd like to use, and we're forced to use whatever we can find - that entry will have been a JSET_NO_FLUSH entry with a garbage last_seq value, since it's not normally used. Initialize it to something sane, for bch2_fs_journal_start(). Signed-off-by: Kent Overstreet fs/bcachefs/recovery.c | 7 +++++++ 1 file changed, 7 insertions(+) commit ce3e9a8a10086b28444cab1431dfc926787ecfcb Author: Kent Overstreet Date: Thu Nov 2 16:54:00 2023 -0400 bcachefs: .get_parent() should return an error pointer Delete the useless check for inum == 0; we'll return -ENOENT without it, which is what we want. Signed-off-by: Kent Overstreet fs/bcachefs/fs.c | 3 --- 1 file changed, 3 deletions(-) commit 4bd156c4b44ef34bd57d20a0a48aad829e1c54c1 Author: Kent Overstreet Date: Thu Nov 2 15:28:15 2023 -0400 bcachefs: Fix bch2_delete_dead_inodes() - the fsck_err() check for the filesystem being clean was incorrect, causing us to always fail to delete unlinked inodes - if a snapshot had been taken, the unlinked inode needs to be propagated to snapshot leaves so the unlink can happen there - fixed. Signed-off-by: Kent Overstreet fs/bcachefs/inode.c | 78 +++++++++++++++++++++++++++++++++++++++-------------- fs/bcachefs/inode.h | 13 +++++++-- 2 files changed, 69 insertions(+), 22 deletions(-) commit 7cb2a7895d94db2979c29e4a20f33b5557c702d5 Author: Brian Foster Date: Fri Nov 3 09:09:38 2023 -0400 bcachefs: use swab40 for bch_backpointer.bucket_offset bitfield The bucket_offset field of bch_backpointer is a 40-bit bitfield, but the bch2_backpointer_swab() helper uses swab32. This leads to inconsistency when an on-disk fs is accessed from an opposite endian machine. As it turns out, we already have an internal swab40() helper that is used from the bch_alloc_v4 swab callback. Lift it into the backpointers header file and use it consistently in both places. Signed-off-by: Brian Foster Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 9 --------- fs/bcachefs/backpointers.c | 2 +- fs/bcachefs/backpointers.h | 9 +++++++++ 3 files changed, 10 insertions(+), 10 deletions(-) commit 0996c72a0f300bfedf8df52a8e437435494fc204 Author: Brian Foster Date: Fri Nov 3 09:09:37 2023 -0400 bcachefs: byte order swap bch_alloc_v4.fragmentation_lru field A simple test to populate a filesystem on one CPU architecture and fsck on an arch of the opposite byte order produces errors related to the fragmentation LRU. This occurs because the 64-bit fragmentation_lru field is not byte-order swapped when reads detect that the on-disk/bset key values were written in opposite byte-order of the current CPU. Update the bch2_alloc_v4 swab callback to handle fragmentation_lru as is done for other multi-byte fields. This doesn't affect existing filesystems when accessed by CPUs of the same endianness because the ->swab() callback is only called when the bset flags indicate an endianness mismatch between the CPU and on-disk data. Signed-off-by: Brian Foster Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 1 + 1 file changed, 1 insertion(+) commit 2a4e7497604b20b19b6d9dbd109c42900892d7c9 Author: Brian Foster Date: Fri Nov 3 09:09:36 2023 -0400 bcachefs: allow writeback to fill bio completely The bcachefs folio writeback code includes a bio full check as well as a fixed size check to determine when to split off and submit writeback I/O. The inclusive check of the latter against the limit means that writeback can submit slightly prematurely. This is not a functional problem, but results in unnecessarily split I/Os and extent merging. This can be observed with a buffered write sized exactly to the current maximum value (1MB) and with key_merging_disabled=1. The latter prevents the merge from the second write such that a subsequent check of the extent list shows a 1020k extent followed by a contiguous 4k extent. The purpose for the fixed size check is also undocumented and somewhat obscure. Lift this check into a new helper that wraps the bio check, fix the comparison logic, and add a comment to document the purpose and how we might improve on this in the future. Signed-off-by: Brian Foster Signed-off-by: Kent Overstreet fs/bcachefs/fs-io-buffered.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) commit 0e91d3a6d59ed3c6630c7c50f17534f2b02d2abf Author: Brian Foster Date: Wed Nov 1 09:01:02 2023 -0400 bcachefs: fix odebug warn and lockdep splat due to on-stack rhashtable Guenter Roeck reports a lockdep splat and DEBUG_OBJECTS_WORK related warning when bch2_copygc_thread() initializes its rhashtable. The lockdep splat relates to a warning print caused by the fact that the rhashtable exists on the stack but is not annotated as so. This is something that could be addressed by INIT_WORK_ONSTACK(), but rhashtable doesn't expose that control and probably isnt worth the churn for just one user. Instead, dynamically allocate the buckets_in_flight structure and avoid the splat that way. Reported-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Brian Foster Signed-off-by: Kent Overstreet fs/bcachefs/movinggc.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) commit e0fb0dccfd6fd8dd9c07adc6eafb1a12e2121a36 Author: Brian Foster Date: Wed Nov 1 15:02:45 2023 -0400 bcachefs: update alloc cursor in early bucket allocator A recent bug report uncovered a scenario where a filesystem never runs with freespace_initialized, and therefore the user observes significantly degraded write performance by virtue of running the early bucket allocator. The associated bug aside, the primary cause of the performance drop in this particular instance is that the early bucket allocator does not update the allocation cursor. This means that every allocation walks the alloc btree from the first bucket of the associated device looking for a bucket marked as free space. Update the early allocator code to set the alloc cursor to the last processed position in the tree, similar to how the freelist allocator behaves. With the alloc_cursor being updated, the retry logic also needs to be updated to restart from the beginning of the device when a free bucket is not available between the cursor and the end of the device. Track the restart position in a first_bucket variable to make the code a bit more easily readable and consistent with the freelist allocator. Signed-off-by: Brian Foster Signed-off-by: Kent Overstreet fs/bcachefs/alloc_foreground.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 385a82f62a9b46d84d545062375274bdc6f50c37 Author: Brian Foster Date: Wed Nov 1 15:02:44 2023 -0400 bcachefs: serialize on cached key in early bucket allocator bcachefs had a transient bug where freespace_initialized was not properly being set, which lead to unexpected use of the early bucket allocator at runtime. This issue has been fixed, but the existence of it uncovered a coherency issue in the early bucket allocation code that is somewhat related to how uncached iterators deal with the key cache. The problem itself manifests as occasional failure of generic/113 due to corruption, often seen as a duplicate backpointer or multiple data types per-bucket error. The immediate cause of the error is a racing bucket allocation along the lines of the following sequence: - Task 1 selects key A in bch2_bucket_alloc_early() and schedules. - Task 2 selects the same key A, but proceeds to complete the allocation and associated I/O, after which it releases the open_bucket. - Task 1 resumes with key A, but does not recognize the bucket is now allocated because the open_bucket has been removed from the hash when it was released in the previous step. This generally shouldn't happen because the allocating task updates the alloc btree key before releasing the bucket. This is not sufficient in this particular instance, however, because an uncached iterator for a cached btree doesn't actually lock the key cache slot when no key exists for a given slot in the cache. Thus the fact that the allocation side updates the cached key means that multiple uncached iters can stumble across the same alloc key and duplicate the bucket allocation as described above. This is something that probably needs a longer term fix in the iterator code. As a short term fix, close the race through explicit use of a cached iterator for likely allocation candidates. We don't want to scan the btree with a cached iterator because that would unnecessarily pollute the cache. This mitigates cache pollution by primarily scanning the tree with an uncached iterator, but closes the race by creating a key cache entry for any prospective slot prior to the bucket allocation attempt (also similar to how _alloc_freelist() works via try_alloc_bucket()). This survives many iterations of generic/113 on a kernel hacked to always use the early bucket allocator. Signed-off-by: Brian Foster Signed-off-by: Kent Overstreet fs/bcachefs/alloc_foreground.c | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) commit f82755e4e8b83a4a98ebd6d819d716547fe11919 Author: Kent Overstreet Date: Mon Oct 30 15:13:09 2023 -0400 bcachefs: Data move path now uses bch2_trans_unlock_long() Signed-off-by: Kent Overstreet fs/bcachefs/btree_iter.c | 12 +++++++++++- fs/bcachefs/move.c | 13 ++++++++----- fs/bcachefs/move.h | 1 + fs/bcachefs/movinggc.c | 4 ++-- fs/bcachefs/rebalance.c | 2 +- 5 files changed, 23 insertions(+), 9 deletions(-) commit 5e2cb28dd7e182dfa641550dfa225913509ad45d Merge: b1dfbda8636b f4738f56d1dc Author: Linus Torvalds Date: Sat Nov 4 15:58:13 2023 -1000 Merge tag 'tsm-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/linux Pull unified attestation reporting from Dan Williams: "In an ideal world there would be a cross-vendor standard attestation report format for confidential guests along with a common device definition to act as the transport. In the real world the situation ended up with multiple platform vendors inventing their own attestation report formats with the SEV-SNP implementation being a first mover to define a custom sev-guest character device and corresponding ioctl(). Later, this configfs-tsm proposal intercepted an attempt to add a tdx-guest character device and a corresponding new ioctl(). It also anticipated ARM and RISC-V showing up with more chardevs and more ioctls(). The proposal takes for granted that Linux tolerates the vendor report format differentiation until a standard arrives. From talking with folks involved, it sounds like that standardization work is unlikely to resolve anytime soon. It also takes the position that kernfs ABIs are easier to maintain than ioctl(). The result is a shared configfs mechanism to return per-vendor report-blobs with the option to later support a standard when that arrives. Part of the goal here also is to get the community into the "uncomfortable, but beneficial to the long term maintainability of the kernel" state of talking to each other about their differentiation and opportunities to collaborate. Think of this like the device-driver equivalent of the common memory-management infrastructure for confidential-computing being built up in KVM. As for establishing an "upstream path for cross-vendor confidential-computing device driver infrastructure" this is something I want to discuss at Plumbers. At present, the multiple vendor proposals for assigning devices to confidential computing VMs likely needs a new dedicated repository and maintainer team, but that is a discussion for v6.8. For now, Greg and Thomas have acked this approach and this is passing is AMD, Intel, and Google tests. Summary: - Introduce configfs-tsm as a shared ABI for confidential computing attestation reports - Convert sev-guest to additionally support configfs-tsm alongside its vendor specific ioctl() - Added signed attestation report retrieval to the tdx-guest driver forgoing a new vendor specific ioctl() - Misc cleanups and a new __free() annotation for kvfree()" * tag 'tsm-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/linux: virt: tdx-guest: Add Quote generation support using TSM_REPORTS virt: sevguest: Add TSM_REPORTS support for SNP_GET_EXT_REPORT mm/slab: Add __free() support for kvfree virt: sevguest: Prep for kernel internal get_ext_report() configfs-tsm: Introduce a shared ABI for attestation reports virt: coco: Add a coco/Makefile and coco/Kconfig virt: sevguest: Fix passing a stack buffer as a scatterlist target commit b1dfbda8636b54cde21f9f5d352fd25c4deff584 Merge: e70703890b25 6d55d31e927e Author: Linus Torvalds Date: Sat Nov 4 11:04:30 2023 -1000 Merge tag 'mtd/for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd updates from Miquel Raynal: "The main set of changes is related to Uwe's work converting platform remove callbacks to return void. Comes next (in number of changes) Kees' additional structures annotations to improve the sanitizers. The usual amount of cleanups apply. About the more substancial contribution, one main function of the partitions core could return an error which was not checked, this is now fixed. On the bindings side, fixed partitions can now have a compression property. Finally, an erroneous situation is now always avoided in the MAP RAM driver. CFI: - A several years old byte swap has been fixed. NAND: - The subsystem has, as usual, seen a bit of cleanup being done this cycle, typically return values of platform_get_irq() and devm_kasprintf(). There is also a better ECC check in the Arasan driver. This comes with smaller misc changes. - In the SPI-NAND world there is now support for Foresee F35SQA002G, Winbond W25N and XTX XT26 chips. SPI NOR: - For SPI NOR we cleaned the flash info entries in order to have them slimmer and self explanatory. In order to make the entries as slim as possible, we introduced sane default values so that the actual flash entries don't need to specify them. We now use a flexible macro to specify the flash ID instead of the previous INFOx() macros that had hardcoded ID lengths. Instead of: { "w25q512nwm", INFO(0xef8020, 0, 64 * 1024, 0) OTP_INFO(256, 3, 0x1000, 0x1000) }, We now use: .id = SNOR_ID(0xef, 0x80, 0x20), .name = "w25q512nwm", .otp = SNOR_OTP(256, 3, 0x1000, 0x1000), - We also removed some flash entries: the very old Catalyst SPI EEPROMs that were introduced once with the SPI-NOR subsystem, and a Fujitsu MRAM. Both should use the at25 EEPROM driver. The latter even has device tree bindings for the at25 driver. - We made sure that the conversion didn't introduce any unwanted changes by comparing the .rodata segment before and after the conversion. The patches landed in linux-next immediately after v6.6-rc2, we haven't seen any regressions yet. - Apart of the autumn cleaning we introduced a new flash entry, at25ff321a, and added block protection support for mt25qu512a" * tag 'mtd/for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (91 commits) mtd: cfi_cmdset_0001: Byte swap OTP info mtd: rawnand: meson: check return value of devm_kasprintf() mtd: rawnand: intel: check return value of devm_kasprintf() mtd: rawnand: sh_flctl: Convert to module_platform_driver() mtd: spi-nor: micron-st: use SFDP table for mt25qu512a mtd: spi-nor: micron-st: enable lock/unlock for mt25qu512a mtd: rawnand: Remove unused of_gpio.h inclusion mtd: spinand: Add support for XTX XT26xxxDxxxxx mtd: spinand: winbond: add support for serial NAND flash mtd: rawnand: cadence: Annotate struct cdns_nand_chip with __counted_by mtd: rawnand: Annotate struct mtk_nfc_nand_chip with __counted_by mtd: spinand: add support for FORESEE F35SQA002G mtd: rawnand: rockchip: Use struct_size() mtd: rawnand: arasan: Include ECC syndrome along with in-band data while checking for ECC failure mtd: Use device_get_match_data() mtd: spi-nor: nxp-spifi: Convert to platform remove callback returning void mtd: spi-nor: hisi-sfc: Convert to platform remove callback returning void mtd: maps: sun_uflash: Convert to platform remove callback returning void mtd: maps: sa1100-flash: Convert to platform remove callback returning void mtd: maps: pxa2xx-flash: Convert to platform remove callback returning void ... commit e70703890b2586bc3567365d391c260d23fb7a94 Merge: aea6bf908d73 8d55b0a940bb Author: Linus Torvalds Date: Sat Nov 4 10:42:07 2023 -1000 Merge tag 'topic/nvidia-gsp-2023-11-03' of git://anongit.freedesktop.org/drm/drm Pull drm nouveau GSP support from Dave Airlie: "This adds the initial support for the NVIDIA GSP firmware to nouveau. This firmware is a new direction for Turing+ GPUs, and is only enabled by default on Ada generation. Other generations need to use nouveau.config=NvGspRm=1 The GSP firmware takes nearly all the GPU init and power management tasks onto a risc-v CPU on the GPU. This series is mostly the work from Ben Skeggs, and Dave added some patches to rebase it to the latest firmware release which is where we will stay for as long as possible as the firmwares have no ABI stability" * tag 'topic/nvidia-gsp-2023-11-03' of git://anongit.freedesktop.org/drm/drm: (49 commits) nouveau/gsp: add some basic registry entries. nouveau/gsp: fix message signature. nouveau/gsp: move to 535.113.01 nouveau/disp: fix post-gsp build on 32-bit arm. nouveau: fix r535 build on 32-bit arm. drm/nouveau/ofa/r535: initial support drm/nouveau/nvjpg/r535: initial support drm/nouveau/nvenc/r535: initial support drm/nouveau/nvdec/r535: initial support drm/nouveau/gr/r535: initial support drm/nouveau/ce/r535: initial support drm/nouveau/fifo/r535: initial support drm/nouveau/disp/r535: initial support drm/nouveau/mmu/r535: initial support drm/nouveau/gsp/r535: add interrupt handling drm/nouveau/gsp/r535: add support for rm alloc drm/nouveau/gsp/r535: add support for rm control drm/nouveau/gsp/r535: add support for booting GSP-RM drm/nouveau/nvkm: support loading fws into sg_table drm/nouveau/kms/tu102-: disable vbios parsing when running on RM ... commit aea6bf908d730b01bd264a8821159db9463c111c Merge: c9b93cafb69c 1e7bef5f90ed Author: Linus Torvalds Date: Sat Nov 4 09:26:23 2023 -1000 Merge tag 'f2fs-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "In this cycle, we introduce a bigger page size support by changing the internal f2fs's block size aligned to the page size. We also continue to improve zoned block device support regarding the power off recovery. As usual, there are some bug fixes regarding the error handling routines in compression and ioctl. Enhancements: - Support Block Size == Page Size - let f2fs_precache_extents() traverses in file range - stop iterating f2fs_map_block if hole exists - preload extent_cache for POSIX_FADV_WILLNEED - compress: fix to avoid fragment w/ OPU during f2fs_ioc_compress_file() Bug fixes: - do not return EFSCORRUPTED, but try to run online repair - finish previous checkpoints before returning from remount - fix error handling of __get_node_page and __f2fs_build_free_nids - clean up zones when not successfully unmounted - fix to initialize map.m_pblk in f2fs_precache_extents() - fix to drop meta_inode's page cache in f2fs_put_super() - set the default compress_level on ioctl - fix to avoid use-after-free on dic - fix to avoid redundant compress extension - do sanity check on cluster when CONFIG_F2FS_CHECK_FS is on - fix deadloop in f2fs_write_cache_pages()" * tag 'f2fs-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: f2fs: finish previous checkpoints before returning from remount f2fs: fix error handling of __get_node_page f2fs: do not return EFSCORRUPTED, but try to run online repair f2fs: fix error path of __f2fs_build_free_nids f2fs: Clean up errors in segment.h f2fs: clean up zones when not successfully unmounted f2fs: let f2fs_precache_extents() traverses in file range f2fs: avoid format-overflow warning f2fs: fix to initialize map.m_pblk in f2fs_precache_extents() f2fs: Support Block Size == Page Size f2fs: stop iterating f2fs_map_block if hole exists f2fs: preload extent_cache for POSIX_FADV_WILLNEED f2fs: set the default compress_level on ioctl f2fs: compress: fix to avoid fragment w/ OPU during f2fs_ioc_compress_file() f2fs: fix to drop meta_inode's page cache in f2fs_put_super() f2fs: split initial and dynamic conditions for extent_cache f2fs: compress: fix to avoid redundant compress extension f2fs: compress: do sanity check on cluster when CONFIG_F2FS_CHECK_FS is on f2fs: compress: fix to avoid use-after-free on dic f2fs: compress: fix deadloop in f2fs_write_cache_pages() commit c9b93cafb69cbbbe375de29c1ebf410dbc33ebfc Merge: 766e9cf3bd64 ce0708796420 Author: Linus Torvalds Date: Sat Nov 4 09:20:04 2023 -1000 Merge tag '9p-for-6.7-rc1' of https://github.com/martinetd/linux Pull 9p updates from Dominique Martinet: A bunch of small fixes: - three W=1 warning fixes: the NULL -> "" replacement isn't trivial but is serialized identically by the protocol layer and has been tested - one syzbot/KCSAN datarace annotation where we don't care about users messing with the fd they passed to mount -t 9p - removing a declaration without implementation - yet another race fix for trans_fd around connection close: the 'err' field is also used in potentially racy calls and this isn't complete, but it's better than what we had - and finally a theorical memory leak fix on serialization failure" * tag '9p-for-6.7-rc1' of https://github.com/martinetd/linux: 9p/net: fix possible memory leak in p9_check_errors() 9p/fs: add MODULE_DESCRIPTION 9p/net: xen: fix false positive printf format overflow warning 9p: v9fs_listxattr: fix %s null argument warning 9p/trans_fd: Annotate data-racy writes to file::f_flags fs/9p: Remove unused function declaration v9fs_inode2stat() 9p/trans_fd: avoid sending req to a cancelled conn commit 766e9cf3bd64c45fcace3acc6f8b3df815448ea3 Merge: 4c975a43fa38 d9a6d7809605 Author: Linus Torvalds Date: Sat Nov 4 09:13:50 2023 -1000 Merge tag '6.7-rc-smb3-client-fixes-part1' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client updates from Steve French: - use after free fixes and deadlock fix - symlink timestamp fix - hashing perf improvement - multichannel fixes - minor debugging improvements - fix creating fifos when using "sfu" mounts - NTLMSSP authentication improvement - minor fixes to include some missing create flags and structures from recently updated protocol documentation * tag '6.7-rc-smb3-client-fixes-part1' of git://git.samba.org/sfrench/cifs-2.6: cifs: force interface update before a fresh session setup cifs: do not reset chan_max if multichannel is not supported at mount cifs: reconnect helper should set reconnect for the right channel smb: client: fix use-after-free in smb2_query_info_compound() smb: client: remove extra @chan_count check in __cifs_put_smb_ses() cifs: add xid to query server interface call cifs: print server capabilities in DebugData smb: use crypto_shash_digest() in symlink_hash() smb: client: fix use-after-free bug in cifs_debug_data_proc_show() smb: client: fix potential deadlock when releasing mids smb3: fix creating FIFOs when mounting with "sfu" mount option Add definition for new smb3.1.1 command type SMB3: clarify some of the unused CreateOption flags cifs: Add client version details to NTLM authenticate message smb3: fix touch -h of symlink commit 4c975a43fa380676828321ebe5b662c743c14d9e Merge: 0a23fb262d17 5329aa5101f7 Author: Linus Torvalds Date: Sat Nov 4 08:54:20 2023 -1000 Merge tag 'efi-next-for-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI update from Ard Biesheuvel: "This is the only remaining EFI change, as everything else was taken via -tip this cycle: - implement uid/gid mount options for efivarfs" * tag 'efi-next-for-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efivarfs: Add uid/gid mount options commit 96cb7a4e296da9aaae0ad61394fdb2828e0a21b5 Author: Neil Armstrong Date: Wed Oct 25 10:25:47 2023 +0200 dt-bindings: mailbox: qcom-ipcc: document the SM8650 Inter-Processor Communication Controller Document the Inter-Processor Communication Controller on the SM8650 Platform. Signed-off-by: Neil Armstrong Reviewed-by: Krzysztof Kozlowski Reviewed-by: Manivannan Sadhasivam Signed-off-by: Jassi Brar Documentation/devicetree/bindings/mailbox/qcom-ipcc.yaml | 1 + 1 file changed, 1 insertion(+) commit 0a23fb262d17f587c9bb1e6cc83ad4158b21f16e Merge: 5c5e048b2417 cf5ab01c8703 Author: Linus Torvalds Date: Sat Nov 4 08:46:37 2023 -1000 Merge tag 'x86_microcode_for_v6.7_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 microcode loading updates from Borislac Petkov: "Major microcode loader restructuring, cleanup and improvements by Thomas Gleixner: - Restructure the code needed for it and add a temporary initrd mapping on 32-bit so that the loader can access the microcode blobs. This in itself is a preparation for the next major improvement: - Do not load microcode on 32-bit before paging has been enabled. Handling this has caused an endless stream of headaches, issues, ugly code and unnecessary hacks in the past. And there really wasn't any sensible reason to do that in the first place. So switch the 32-bit loading to happen after paging has been enabled and turn the loader code "real purrty" again - Drop mixed microcode steppings loading on Intel - there, a single patch loaded on the whole system is sufficient - Rework late loading to track which CPUs have updated microcode successfully and which haven't, act accordingly - Move late microcode loading on Intel in NMI context in order to guarantee concurrent loading on all threads - Make the late loading CPU-hotplug-safe and have the offlined threads be woken up for the purpose of the update - Add support for a minimum revision which determines whether late microcode loading is safe on a machine and the microcode does not change software visible features which the machine cannot use anyway since feature detection has happened already. Roughly, the minimum revision is the smallest revision number which must be loaded currently on the system so that late updates can be allowed - Other nice leanups, fixess, etc all over the place" * tag 'x86_microcode_for_v6.7_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (40 commits) x86/microcode/intel: Add a minimum required revision for late loading x86/microcode: Prepare for minimal revision check x86/microcode: Handle "offline" CPUs correctly x86/apic: Provide apic_force_nmi_on_cpu() x86/microcode: Protect against instrumentation x86/microcode: Rendezvous and load in NMI x86/microcode: Replace the all-in-one rendevous handler x86/microcode: Provide new control functions x86/microcode: Add per CPU control field x86/microcode: Add per CPU result state x86/microcode: Sanitize __wait_for_cpus() x86/microcode: Clarify the late load logic x86/microcode: Handle "nosmt" correctly x86/microcode: Clean up mc_cpu_down_prep() x86/microcode: Get rid of the schedule work indirection x86/microcode: Mop up early loading leftovers x86/microcode/amd: Use cached microcode for AP load x86/microcode/amd: Cache builtin/initrd microcode early x86/microcode/amd: Cache builtin microcode too x86/microcode/amd: Use correct per CPU ucode_cpu_info ... commit c4accde498dd7db8352d574958d19a5f710aba69 Author: Kent Overstreet Date: Mon Oct 30 12:30:52 2023 -0400 bcachefs: Ensure srcu lock is not held too long The SRCU read lock that btree_trans takes exists to make it safe for bch2_trans_relock() to deref pointers to btree nodes/key cache items we don't have locked, but as a side effect it blocks reclaim from freeing those items. Thus, it's important to not hold it for too long: we need to differentiate between bch2_trans_unlock() calls that will be only for a short duration, and ones that will be for an unbounded duration. This introduces bch2_trans_unlock_long(), to be used mainly by the data move paths. Signed-off-by: Kent Overstreet fs/bcachefs/btree_iter.c | 42 +++++++++++++++++++++++++++++------------- fs/bcachefs/btree_iter.h | 4 ++++ fs/bcachefs/btree_locking.c | 6 ++++++ fs/bcachefs/btree_types.h | 1 + 4 files changed, 40 insertions(+), 13 deletions(-) commit 6dfa10ab22a6a322269a3454d7ac720dc2f8bf11 Author: Kent Overstreet Date: Tue Oct 31 18:05:22 2023 -0400 bcachefs: Fix build errors with gcc 10 gcc 10 seems to complain about array bounds in situations where gcc 11 does not - curious. This unfortunately requires adding some casts for now; we may investigate getting rid of our __u64 _data[] VLA in a future patch so that our start[0] members can be VLAs. Reported-by: John Stoffel Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs_format.h | 4 +--- fs/bcachefs/btree_trans_commit.c | 6 +++--- fs/bcachefs/btree_update_interior.c | 2 +- fs/bcachefs/btree_update_interior.h | 2 +- fs/bcachefs/recovery.c | 2 +- 5 files changed, 7 insertions(+), 9 deletions(-) commit 4db8ac8629b1ee75316849b0e8ea5bbf90335706 Author: Kent Overstreet Date: Tue Oct 31 12:29:58 2023 -0400 bcachefs: Fix MEAN_AND_VARIANCE kconfig options Fixes: https://lore.kernel.org/linux-bcachefs/CAMuHMdXpwMdLuoWsNGa8qacT_5Wv-vSTz0xoBR5n_fnD9cNOuQ@mail.gmail.com/ Signed-off-by: Kent Overstreet fs/bcachefs/Kconfig | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 1f7056b735d59843faee70f504f71e1fbffc51d8 Author: Kent Overstreet Date: Mon Oct 30 13:15:36 2023 -0400 bcachefs: Ensure copygc does not spin If copygc does no work - finds no fragmented buckets - wait for a bit of IO to happen. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 11 +++++++++++ fs/bcachefs/alloc_background.h | 1 + fs/bcachefs/movinggc.c | 20 ++++++++++++++++++-- fs/bcachefs/rebalance.c | 10 ++++------ 4 files changed, 34 insertions(+), 8 deletions(-) commit 5c5e048b2417a56b7b52bdbb66d4fc99d0c20dd2 Merge: 3062a9879afb 5f56cb030e4b Author: Linus Torvalds Date: Sat Nov 4 08:07:19 2023 -1000 Merge tag 'kbuild-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - Implement the binary search in modpost for faster symbol lookup - Respect HOSTCC when linking host programs written in Rust - Change the binrpm-pkg target to generate kernel-devel RPM package - Fix endianness issues for tee and ishtp MODULE_DEVICE_TABLE - Unify vdso_install rules - Remove unused __memexit* annotations - Eliminate stale whitelisting for __devinit/__devexit from modpost - Enable dummy-tools to handle the -fpatchable-function-entry flag - Add 'userldlibs' syntax * tag 'kbuild-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (30 commits) kbuild: support 'userldlibs' syntax kbuild: dummy-tools: pretend we understand -fpatchable-function-entry kbuild: Correct missing architecture-specific hyphens modpost: squash ALL_{INIT,EXIT}_TEXT_SECTIONS to ALL_TEXT_SECTIONS modpost: merge sectioncheck table entries regarding init/exit sections modpost: use ALL_INIT_SECTIONS for the section check from DATA_SECTIONS modpost: disallow the combination of EXPORT_SYMBOL and __meminit* modpost: remove EXIT_SECTIONS macro modpost: remove MEM_INIT_SECTIONS macro modpost: remove more symbol patterns from the section check whitelist modpost: disallow *driver to reference .meminit* sections linux/init: remove __memexit* annotations modpost: remove ALL_EXIT_DATA_SECTIONS macro kbuild: simplify cmd_ld_multi_m kbuild: avoid too many execution of scripts/pahole-flags.sh kbuild: remove ARCH_POSTLINK from module builds kbuild: unify no-compiler-targets and no-sync-config-targets kbuild: unify vdso_install rules docs: kbuild: add INSTALL_DTBS_PATH UML: remove unused cmd_vdso_install ... commit 3062a9879afbca810d9f1613698963ecfcb35701 Merge: 90b0c2b2edd1 4b27d5c42033 Author: Linus Torvalds Date: Sat Nov 4 07:54:21 2023 -1000 Merge tag 'acpi-6.7-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Fix the acpi_thermal_add() error path that may do a double-free in some cases after recent changes (Dan Carpenter)" * tag 'acpi-6.7-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: thermal: Fix acpi_thermal_unregister_thermal_zone() cleanup commit 6d55d31e927eec68ba6db344688044ed253223e9 Merge: 3a8ab4a13d17 5a985960a4dd Author: Miquel Raynal Date: Sat Nov 4 11:50:22 2023 +0100 Merge tag 'nand/for-6.7' into mtd/next The raw NAND subsystem has, as usual, seen a bit of cleanup being done this cycle, typically return values of platform_get_irq() and devm_kasprintf(), plus structure annotations for sanitizers. There is also a better ECC check in the Arasan driver. This comes with smaller misc changes. In the SPI-NAND world there is now support for Foresee F35SQA002G, Winbond W25N and XTX XT26 chips. Signed-off-by: Miquel Raynal commit 3a8ab4a13d17f2a16cd4f125e5238096c1c55149 Merge: 565fe150624e 6823a8383420 Author: Miquel Raynal Date: Sat Nov 4 11:49:52 2023 +0100 Merge tag 'spi-nor/for-6.7' into mtd/next For SPI NOR we cleaned the flash info entries in order to have them slimmer and self explanatory. In order to make the entries as slim as possible, we introduced sane default values so that the actual flash entries don't need to specify them. We now use a flexible macro to specify the flash ID instead of the previous INFOx() macros that had hardcoded ID lengths. Instead of: - { "w25q512nwm", INFO(0xef8020, 0, 64 * 1024, 0) - OTP_INFO(256, 3, 0x1000, 0x1000) }, We now use: + .id = SNOR_ID(0xef, 0x80, 0x20), + .name = "w25q512nwm", + .otp = SNOR_OTP(256, 3, 0x1000, 0x1000), We also removed some flash entries: the very old Catalyst SPI EEPROMs that were introduced once with the SPI-NOR subsystem, and a Fujitsu MRAM. Both should use the at25 EEPROM driver. The latter even has device tree bindings for the at25 driver. We made sure that the conversion didn't introduce any unwanted changes by comparing the .rodata segment before and after the conversion. The patches landed in linux-next immediately after v6.6-rc2, we haven't seen any regressions yet. Apart of the autumn cleaning we introduced a new flash entry, at25ff321a, and added block protection support for mt25qu512a. Signed-off-by: Miquel Raynal commit 5be55473a06475cc1128ccd93831ff57a068a81e Author: Bartosz Golaszewski Date: Tue Oct 10 14:35:19 2023 +0200 pinctrl: tegra: drop the wrapper around pinctrl_gpio_request() pinctrl_gpio_request() now has the same signature as the wrapper around it so we can drop them. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/gpio/gpio-tegra.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit 8e1df2f5d689e361ee1892cbc804995f71793b7e Author: Bartosz Golaszewski Date: Tue Oct 10 14:33:08 2023 +0200 pinctrl: em: drop the wrapper around pinctrl_gpio_request() pinctrl_gpio_request() now has the same signature as the wrapper around it so we can drop them. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/gpio/gpio-em.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit 11d84b2033ade571b86e1c7fed2892ce3c556aff Author: Bartosz Golaszewski Date: Fri Oct 13 14:04:28 2023 +0200 pinctrl: nuvoton: npcm8xx: drop wrappers around pinctrl_gpio_request/free() pinctrl_gpio_*() helpers now have signatures corresponding with those of the GPIOLIB callbacks. We can drop the wrappers. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit de38bdbe011b3102e673add59c58c44bd162c86f Author: Bartosz Golaszewski Date: Fri Oct 13 14:04:10 2023 +0200 pinctrl: nuvoton: npcm7xx: drop wrappers around pinctrl_gpio_request/free() pinctrl_gpio_*() helpers now have signatures corresponding with those of the GPIOLIB callbacks. We can drop the wrappers. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit b04ce10d22bb5d1a48c74dd476e75f88d5d8982c Author: Bartosz Golaszewski Date: Tue Oct 10 12:16:14 2023 +0200 pinctrl: stm32: drop wrappers around pinctrl_gpio_free/input() pinctrl_gpio_*() helpers now have signatures corresponding with those of the GPIOLIB callbacks. We can drop the wrappers. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/stm32/pinctrl-stm32.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) commit 895bf1d82656ae938fb19d6c439c98f23abc413a Author: Bartosz Golaszewski Date: Fri Oct 13 14:03:43 2023 +0200 pinctrl: starfive: jh7110: drop wrappers around pinctrl_gpio_request/free() pinctrl_gpio_*() helpers now have signatures corresponding with those of the GPIOLIB callbacks. We can drop the wrappers. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) commit 0b261df49ff8484d0e8faaa4ff82002a9bfa26fd Author: Bartosz Golaszewski Date: Fri Oct 13 14:03:31 2023 +0200 pinctrl: starfive: jh7100: drop wrappers around pinctrl_gpio_request/free() pinctrl_gpio_*() helpers now have signatures corresponding with those of the GPIOLIB callbacks. We can drop the wrappers. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) commit 653e95f1fc466b40417b9d66da6aeec76bc29571 Author: Bartosz Golaszewski Date: Tue Oct 10 12:09:17 2023 +0200 pinctrl: ocelot: drop the wrapper around pinctrl_gpio_direction_input() pinctrl_gpio_direction_input() now has the same signature as the wrapper around it so we can drop them. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/pinctrl-ocelot.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit d35e579d60a7cdd87fa13d2cad04a95ec27e0383 Author: Bartosz Golaszewski Date: Tue Oct 10 12:08:04 2023 +0200 pinctrl: cirrus: drop the wrapper around pinctrl_gpio_direction_input() pinctrl_gpio_direction_input() now has the same signature as the wrapper around it so we can drop them. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/cirrus/pinctrl-cs42l43.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit c1649a7db47ffa51f1ad637f0d2d4114eff403b7 Author: Bartosz Golaszewski Date: Fri Oct 13 13:57:42 2023 +0200 pinctrl: mediatek: common: drop the wrappers around pinctrl_gpio_direction_input() pinctrl_gpio_direction_input() now has the same signature as the wrappers around it so we can drop them. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit f00f921fd3f49e3a8f2303719e3c5945805fd5aa Author: Bartosz Golaszewski Date: Fri Oct 13 13:57:27 2023 +0200 pinctrl: mediatek: moore: drop the wrappers around pinctrl_gpio_direction_input() pinctrl_gpio_direction_input() now has the same signature as the wrappers around it so we can drop them. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/mediatek/pinctrl-moore.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit 5835b3f2a2cb6fff443e46192e6aa8e2a92a3347 Author: Bartosz Golaszewski Date: Tue Oct 10 12:00:06 2023 +0200 pinctrl: rk805: drop the wrapper around pinctrl_gpio_direction_input() pinctrl_gpio_direction_input() now has the same signature as the wrapper around it so we can drop them. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/pinctrl-rk805.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit 36077c86fee25c24de749c8f4e483f76920c659c Author: Bartosz Golaszewski Date: Tue Oct 10 11:58:42 2023 +0200 pinctrl: axp209: drop the wrapper around pinctrl_gpio_direction_input() pinctrl_gpio_direction_input() now has the same signature as the wrapper around it so we can drop them. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/pinctrl-axp209.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit ffed728761214d705bddcb611956cfbb74549465 Author: Bartosz Golaszewski Date: Tue Oct 10 11:56:24 2023 +0200 pinctrl: vt8500: drop the wrapper around pinctrl_gpio_direction_input() pinctrl_gpio_direction_input() now has the same signature as the wrapper around it so we can drop them. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/vt8500/pinctrl-wmt.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit 54d9eab19e769dbedf33968da9a729a4df105327 Author: Bartosz Golaszewski Date: Tue Oct 10 11:53:40 2023 +0200 pinctrl: as3722: drop the wrapper around pinctrl_gpio_direction_input() pinctrl_gpio_direction_input() now has the same signature as the wrapper around it so we can drop them. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/pinctrl-as3722.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit 22c7203db32040f4f36aba9fb2217db792f29725 Author: Bartosz Golaszewski Date: Tue Oct 10 10:40:47 2023 +0200 pinctrl: ingenic: drop the wrapper around pinctrl_gpio_direction_input() pinctrl_gpio_direction_input() now has the same signature as the wrapper around it so we can drop them. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/pinctrl-ingenic.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) commit b6d83d010db67bff883240116ee84ebdffe6711b Author: Bartosz Golaszewski Date: Tue Oct 10 10:40:25 2023 +0200 pinctrl: st: drop the wrapper around pinctrl_gpio_direction_input() pinctrl_gpio_direction_input() now has the same signature as the wrapper around it so we can drop it. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/pinctrl-st.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) commit 6042aaef3158bd34c2851d77a134f7fc711acb1e Author: Bartosz Golaszewski Date: Tue Oct 10 16:22:16 2023 +0200 pinctrl: change the signature of pinctrl_ready_for_gpio_range() Modify pinctrl_ready_for_gpio_range() to be in line with public GPIO helpers and take a pair of GPIO chip & offset as arguments Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Acked-by: Linus Walleij drivers/pinctrl/core.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) commit 31d4e8d10177ff2e96a905480dd6779cdf17a596 Author: Bartosz Golaszewski Date: Tue Oct 10 16:17:01 2023 +0200 pinctrl: change the signature of gpio_to_pin() Modify gpio_to_pin() to be in line with public GPIO helpers and take a pair of GPIO chip & offset as arguments. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Acked-by: Linus Walleij drivers/pinctrl/core.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) commit 58e772f43774aef0bbb099c5e63801562a467d5a Author: Bartosz Golaszewski Date: Tue Oct 10 16:13:14 2023 +0200 pinctrl: change the signature of pinctrl_match_gpio_range() Modify pinctrl_match_gpio_range() to be in line with public GPIO helpers and take a pair of GPIO chip & offset as arguments. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Acked-by: Linus Walleij drivers/pinctrl/core.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 82059c3d78409b29d9bb436a137e72453d30277a Author: Bartosz Golaszewski Date: Tue Oct 10 15:34:28 2023 +0200 pinctrl: change the signature of pinctrl_get_device_gpio_range() Modify pinctrl_get_device_gpio_range() to be in line with public GPIO helpers and take a pair of GPIO chip & offset as arguments. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Acked-by: Linus Walleij drivers/pinctrl/core.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) commit 315c4418ac659bca89120fb4270ede71257d5070 Author: Bartosz Golaszewski Date: Tue Oct 10 15:32:52 2023 +0200 pinctrl: change the signature of pinctrl_gpio_direction() Modify pinctrl_gpio_direction() to be in line with public GPIO helpers and take a pair of GPIO chip & offset as arguments. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Acked-by: Linus Walleij drivers/pinctrl/core.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit acf2981b84c344428baa10dbc9234749c68dedae Author: Bartosz Golaszewski Date: Tue Oct 3 12:01:01 2023 +0200 treewide: rename pinctrl_gpio_set_config_new() Now that pinctrl_gpio_set_config() is no longer used, let's drop the '_new' suffix from its improved variant. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/gpio/gpio-aspeed.c | 2 +- drivers/gpio/gpiolib.c | 2 +- drivers/pinctrl/core.c | 6 +++--- include/linux/pinctrl/consumer.h | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) commit b679d6c06b2b29187374f9f4da7eea1961c2eeaa Author: Bartosz Golaszewski Date: Tue Oct 3 11:59:51 2023 +0200 treewide: rename pinctrl_gpio_direction_output_new() Now that pinctrl_gpio_direction_output() is no longer used, let's drop the '_new' suffix from its improved variant. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/gpio/gpio-mvebu.c | 2 +- drivers/gpio/gpio-pxa.c | 2 +- drivers/gpio/gpio-rockchip.c | 2 +- drivers/gpio/gpio-tegra.c | 2 +- drivers/gpio/gpio-vf610.c | 2 +- drivers/pinctrl/cirrus/pinctrl-cs42l43.c | 2 +- drivers/pinctrl/cirrus/pinctrl-lochnagar.c | 2 +- drivers/pinctrl/core.c | 7 +++---- drivers/pinctrl/intel/pinctrl-cherryview.c | 2 +- drivers/pinctrl/intel/pinctrl-intel.c | 2 +- drivers/pinctrl/intel/pinctrl-lynxpoint.c | 2 +- drivers/pinctrl/mediatek/pinctrl-moore.c | 2 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 2 +- drivers/pinctrl/mediatek/pinctrl-paris.c | 2 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 2 +- drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 2 +- drivers/pinctrl/pinctrl-as3722.c | 2 +- drivers/pinctrl/pinctrl-cy8c95x0.c | 2 +- drivers/pinctrl/pinctrl-ingenic.c | 4 ++-- drivers/pinctrl/pinctrl-ocelot.c | 2 +- drivers/pinctrl/pinctrl-rk805.c | 2 +- drivers/pinctrl/pinctrl-st.c | 2 +- drivers/pinctrl/renesas/gpio.c | 2 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +- drivers/pinctrl/vt8500/pinctrl-wmt.c | 2 +- include/linux/pinctrl/consumer.h | 6 +++--- 26 files changed, 31 insertions(+), 32 deletions(-) commit 315c46f9b696be82972290d50349c7824276b844 Author: Bartosz Golaszewski Date: Tue Oct 3 11:58:30 2023 +0200 treewide: rename pinctrl_gpio_direction_input_new() Now that pinctrl_gpio_direction_input() is no longer used, let's drop the '_new' suffix from its improved variant. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/gpio/gpio-mvebu.c | 2 +- drivers/gpio/gpio-pxa.c | 2 +- drivers/gpio/gpio-rockchip.c | 2 +- drivers/gpio/gpio-tegra.c | 2 +- drivers/gpio/gpio-vf610.c | 2 +- drivers/pinctrl/cirrus/pinctrl-cs42l43.c | 2 +- drivers/pinctrl/core.c | 6 +++--- drivers/pinctrl/intel/pinctrl-cherryview.c | 2 +- drivers/pinctrl/intel/pinctrl-intel.c | 2 +- drivers/pinctrl/intel/pinctrl-lynxpoint.c | 2 +- drivers/pinctrl/mediatek/pinctrl-moore.c | 2 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 2 +- drivers/pinctrl/mediatek/pinctrl-paris.c | 2 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 2 +- drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 2 +- drivers/pinctrl/pinctrl-as3722.c | 2 +- drivers/pinctrl/pinctrl-axp209.c | 2 +- drivers/pinctrl/pinctrl-cy8c95x0.c | 2 +- drivers/pinctrl/pinctrl-ingenic.c | 2 +- drivers/pinctrl/pinctrl-ocelot.c | 2 +- drivers/pinctrl/pinctrl-rk805.c | 2 +- drivers/pinctrl/pinctrl-st.c | 2 +- drivers/pinctrl/renesas/gpio.c | 2 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +- drivers/pinctrl/vt8500/pinctrl-wmt.c | 2 +- include/linux/pinctrl/consumer.h | 6 +++--- 26 files changed, 30 insertions(+), 30 deletions(-) commit 4fccb263f3a0dc07b306213930e0c25d1c9002b0 Author: Bartosz Golaszewski Date: Tue Oct 3 11:57:17 2023 +0200 treewide: rename pinctrl_gpio_free_new() Now that pinctrl_gpio_free()() is no longer used, let's drop the '_new' suffix from its improved variant. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/gpio/gpio-aspeed.c | 2 +- drivers/gpio/gpio-em.c | 2 +- drivers/gpio/gpio-rcar.c | 2 +- drivers/gpio/gpio-tegra.c | 2 +- drivers/gpio/gpiolib.c | 2 +- drivers/pinctrl/bcm/pinctrl-iproc-gpio.c | 2 +- drivers/pinctrl/core.c | 6 +++--- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 2 +- drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 2 +- drivers/pinctrl/renesas/gpio.c | 2 +- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 +- drivers/pinctrl/renesas/pinctrl-rzv2m.c | 2 +- drivers/pinctrl/spear/pinctrl-plgpio.c | 4 ++-- drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c | 2 +- drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c | 2 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +- include/linux/pinctrl/consumer.h | 4 ++-- 17 files changed, 21 insertions(+), 21 deletions(-) commit acb38be654f9af05fe626b37ea83e119cd310c3c Author: Bartosz Golaszewski Date: Tue Oct 3 11:56:03 2023 +0200 treewide: rename pinctrl_gpio_request_new() Now that pinctrl_gpio_request() is no longer used, let's drop the '_new' suffix from its improved variant. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/gpio/gpio-aspeed.c | 2 +- drivers/gpio/gpio-em.c | 2 +- drivers/gpio/gpio-rcar.c | 2 +- drivers/gpio/gpio-tegra.c | 2 +- drivers/gpio/gpiolib.c | 2 +- drivers/pinctrl/bcm/pinctrl-iproc-gpio.c | 2 +- drivers/pinctrl/core.c | 6 +++--- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 2 +- drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 2 +- drivers/pinctrl/renesas/gpio.c | 2 +- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 +- drivers/pinctrl/renesas/pinctrl-rzv2m.c | 2 +- drivers/pinctrl/spear/pinctrl-plgpio.c | 2 +- drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c | 2 +- drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c | 2 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +- include/linux/pinctrl/consumer.h | 4 ++-- 17 files changed, 20 insertions(+), 20 deletions(-) commit 00762e416cd2001270a59fab417fbb1c30e2b7e5 Author: Bartosz Golaszewski Date: Tue Oct 3 11:54:45 2023 +0200 treewide: rename pinctrl_gpio_can_use_line_new() Now that pinctrl_gpio_can_use_line() is no longer used, let's drop the '_new' suffix from its improved variant. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/gpio/gpiolib-cdev.c | 2 +- drivers/pinctrl/core.c | 4 ++-- include/linux/pinctrl/consumer.h | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) commit ab56e2bfceecae12e3b656b1641ecb961de6f92c Author: Bartosz Golaszewski Date: Tue Oct 10 15:16:54 2023 +0200 pinctrl: remove pinctrl_gpio_set_config() There are no more users of pinctrl_gpio_set_config() so remove it. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/core.c | 36 +++++++++++++++--------------------- include/linux/pinctrl/consumer.h | 6 ------ 2 files changed, 15 insertions(+), 27 deletions(-) commit 45d2055b0067739253883dc541f37c86aad45c92 Author: Bartosz Golaszewski Date: Tue Oct 10 15:14:33 2023 +0200 pinctrl: remove pinctrl_gpio_direction_output() There are no more users of pinctrl_gpio_direction_output() so remove it. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/core.c | 9 +-------- include/linux/pinctrl/consumer.h | 6 ------ 2 files changed, 1 insertion(+), 14 deletions(-) commit aec96797f9efcaf444400a9d92900de3acc13e51 Author: Bartosz Golaszewski Date: Tue Oct 10 15:13:38 2023 +0200 pinctrl: remove pinctrl_gpio_direction_input() There are no more users of pinctrl_gpio_direction_input() so remove it. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/core.c | 9 +-------- include/linux/pinctrl/consumer.h | 6 ------ 2 files changed, 1 insertion(+), 14 deletions(-) commit 1d2c88450f77d9d62883a4a2ecc5e840cc7c74ee Author: Bartosz Golaszewski Date: Tue Oct 10 15:11:28 2023 +0200 pinctrl: remove pinctrl_gpio_free() There are no more users of pinctrl_gpio_free() so remove it. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/core.c | 41 +++++++++++++++++----------------------- include/linux/pinctrl/consumer.h | 5 ----- 2 files changed, 17 insertions(+), 29 deletions(-) commit 699f0784631eee4f482291fdcc23c87a055ab5f7 Author: Bartosz Golaszewski Date: Tue Oct 10 15:04:24 2023 +0200 pinctrl: remove pinctrl_gpio_request() There are no more users of pinctrl_gpio_request() so remove it. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/core.c | 41 +++++++++++++++++----------------------- include/linux/pinctrl/consumer.h | 6 ------ 2 files changed, 17 insertions(+), 30 deletions(-) commit a063e57adf7baa91eee52eb4131557c3a43f4c3a Author: Bartosz Golaszewski Date: Tue Oct 10 14:59:36 2023 +0200 pinctrl: remove pinctrl_gpio_can_use_line() There are no more users of pinctrl_gpio_can_use_line() so remove it. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/core.c | 12 +++--------- include/linux/pinctrl/consumer.h | 6 ------ 2 files changed, 3 insertions(+), 15 deletions(-) commit c6801e23322d03e57c299ff16d013bd37a5d9360 Author: Bartosz Golaszewski Date: Tue Oct 3 10:53:52 2023 +0200 pinctrl: st: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Reviewed-by: Patrice Chotard Acked-by: Linus Walleij drivers/pinctrl/pinctrl-st.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 578d009b1b9da36593c2da5d5c265317551a480a Author: Bartosz Golaszewski Date: Fri Oct 13 13:54:53 2023 +0200 pinctrl: lynxpoint: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Acked-by: Mika Westerberg Acked-by: Linus Walleij drivers/pinctrl/intel/pinctrl-lynxpoint.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 262abd2d17b605b1f7c0828d8296d7da7acd553a Author: Bartosz Golaszewski Date: Fri Oct 13 13:54:33 2023 +0200 pinctrl: intel: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Acked-by: Mika Westerberg Acked-by: Linus Walleij drivers/pinctrl/intel/pinctrl-intel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 588ad2b1b62a92f94168eb26d876150ba944fade Author: Bartosz Golaszewski Date: Fri Oct 13 13:54:10 2023 +0200 pinctrl: cherryview: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Acked-by: Mika Westerberg Acked-by: Linus Walleij drivers/pinctrl/intel/pinctrl-cherryview.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 78329866ef57bf7d41e690922fd56092138f9fd2 Author: Bartosz Golaszewski Date: Tue Oct 3 10:51:02 2023 +0200 pinctrl: ingenic: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/pinctrl-ingenic.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 4125651b3d7db5d8dcb0bdb58462efbb04c53365 Author: Bartosz Golaszewski Date: Tue Oct 3 10:22:10 2023 +0200 pinctrl: as3722: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/pinctrl-as3722.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b2979a1786bcaca324b879f0d9f2590979b525e2 Author: Bartosz Golaszewski Date: Tue Oct 3 10:21:02 2023 +0200 pinctrl: cy8c95x0: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Acked-by: Linus Walleij drivers/pinctrl/pinctrl-cy8c95x0.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f7fdb230ca16f1f4516f6ef826548aa044e9a521 Author: Bartosz Golaszewski Date: Tue Oct 3 10:17:57 2023 +0200 pinctrl: vt8500: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/vt8500/pinctrl-wmt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ddfba5bde6b843cc7204e43246155f7ba6474b8e Author: Bartosz Golaszewski Date: Tue Oct 3 10:16:51 2023 +0200 pinctrl: axp209: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/pinctrl-axp209.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 47ad5c97ba898898d279af037443e21e051a5dd2 Author: Bartosz Golaszewski Date: Fri Oct 13 13:53:24 2023 +0200 pinctrl: mediatek: paris: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/mediatek/pinctrl-paris.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6232d8b9346fd4460c3cab733c48390186c24c37 Author: Bartosz Golaszewski Date: Fri Oct 13 13:53:04 2023 +0200 pinctrl: mediatek: common: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1b5f829b171215be194d06298ba4738da5e2a644 Author: Bartosz Golaszewski Date: Fri Oct 13 13:52:36 2023 +0200 pinctrl: mediatek: moore: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/mediatek/pinctrl-moore.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3607ac37a4f378cd5f673d6bdb3776e45a899e2c Author: Bartosz Golaszewski Date: Tue Oct 3 10:12:12 2023 +0200 pinctrl: cirrus: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Charles Keepax Acked-by: Linus Walleij drivers/pinctrl/cirrus/pinctrl-cs42l43.c | 4 ++-- drivers/pinctrl/cirrus/pinctrl-lochnagar.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) commit 91dff6b66e5e6a72136b5a0b276bc32d40ae2796 Author: Bartosz Golaszewski Date: Tue Oct 3 10:11:27 2023 +0200 pinctrl: rk805: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/pinctrl-rk805.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit da70bf79efad5a2a5891e92f2fef9bfb8ac24d92 Author: Bartosz Golaszewski Date: Tue Oct 3 10:10:39 2023 +0200 pinctrl: ocelot: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/pinctrl-ocelot.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit fed493fce82be8dc0ab4ed15ea6acfd27d73f05b Author: Bartosz Golaszewski Date: Fri Oct 13 14:02:58 2023 +0200 pinctrl: starfive: jh7110: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7cdd1db6afa1b7726433799db5964d8a99073490 Author: Bartosz Golaszewski Date: Fri Oct 13 14:02:45 2023 +0200 pinctrl: starfive: jh7100: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a3305049053a66e04def76e62fc94d7980d88a84 Author: Bartosz Golaszewski Date: Tue Oct 3 09:59:58 2023 +0200 pinctrl: spear: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Viresh Kumar Acked-by: Linus Walleij drivers/pinctrl/spear/pinctrl-plgpio.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit 164fcf1eb3bff52ebc6655287ab74428b80aaccc Author: Bartosz Golaszewski Date: Tue Oct 3 09:56:50 2023 +0200 pinctrl: stm32: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/stm32/pinctrl-stm32.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 0bea3e7c157f6a1622c5b71eb8972502bd9b3241 Author: Bartosz Golaszewski Date: Tue Oct 3 09:55:27 2023 +0200 pinctrl: bcm: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/bcm/pinctrl-iproc-gpio.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit af80a91199a57a29f509943b2363b233d961b214 Author: Bartosz Golaszewski Date: Tue Oct 3 09:54:07 2023 +0200 pinctrl: renesas: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Reviewed-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Acked-by: Linus Walleij drivers/pinctrl/renesas/gpio.c | 8 ++++---- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 4 ++-- drivers/pinctrl/renesas/pinctrl-rzv2m.c | 4 ++-- 3 files changed, 8 insertions(+), 8 deletions(-) commit 481a59fb3d988b2d86c86a341b8040804ed9a282 Author: Bartosz Golaszewski Date: Fri Oct 13 14:02:14 2023 +0200 pinctrl: nuvoton: npcm8xx: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit c54d686d7d9975c2bdc5fca6ec30f1600817a628 Author: Bartosz Golaszewski Date: Fri Oct 13 14:02:00 2023 +0200 pinctrl: nuvoton: npcm7xx: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 506e94e1084fec07f0f657883f4d5845c0c76bd5 Author: Bartosz Golaszewski Date: Tue Oct 3 10:06:39 2023 +0200 gpio: vf610: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/gpio/gpio-vf610.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7233d90aead374eb58513f035079acd15f9f51b2 Author: Bartosz Golaszewski Date: Tue Oct 3 10:06:22 2023 +0200 gpio: rockchip: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Heiko Stuebner Acked-by: Linus Walleij drivers/gpio/gpio-rockchip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 566e684e70cbfcb06039edcdf89637f211c914ba Author: Bartosz Golaszewski Date: Tue Oct 3 10:06:08 2023 +0200 gpio: pxa: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/gpio/gpio-pxa.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4df6c2ec22b2f8e933f4ee7b357bec4312747707 Author: Bartosz Golaszewski Date: Tue Oct 3 10:05:54 2023 +0200 gpio: mvebu: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Uwe Kleine-König Acked-by: Linus Walleij drivers/gpio/gpio-mvebu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 09a88bed64352f205bb1b9d0a12294ca43c25f21 Author: Bartosz Golaszewski Date: Tue Oct 3 09:41:14 2023 +0200 gpio: aspeed: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andrew Jeffery Acked-by: Uwe Kleine-König Acked-by: Linus Walleij drivers/gpio/gpio-aspeed.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 9626b3d74d383539cfe3a54168335f07f5e0c125 Author: Bartosz Golaszewski Date: Tue Oct 3 09:24:26 2023 +0200 gpio: em: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/gpio/gpio-em.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f6c54ab976154b0986d40fb28dd40c7279a26e35 Author: Bartosz Golaszewski Date: Tue Oct 3 09:23:37 2023 +0200 gpio: tegra: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/gpio/gpio-tegra.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit dd4e1f9cd6994146236215dbed44851567498a95 Author: Bartosz Golaszewski Date: Tue Oct 3 09:21:14 2023 +0200 gpio: rcar: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Reviewed-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Acked-by: Linus Walleij drivers/gpio/gpio-rcar.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 32fb7d23e76a4a89f9796c81dfde91b3d84257ef Author: Bartosz Golaszewski Date: Tue Oct 3 09:15:14 2023 +0200 gpio: cdev: use pinctrl_gpio_can_use_line_new() Use the improved variant of pinctrl_gpio_can_use_line() which takes a pointer to the gpio_chip and a controller-relative offset. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Acked-by: Linus Walleij drivers/gpio/gpiolib-cdev.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit e3d3ab299ba63c61776f3579d8a58c486eba5044 Author: Bartosz Golaszewski Date: Tue Oct 3 09:25:29 2023 +0200 gpiolib: generic: use new pinctrl GPIO helpers Replace the pinctrl helpers taking the global GPIO number as argument with the improved variants that instead take a pointer to the GPIO chip and the controller-relative offset. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Acked-by: Linus Walleij drivers/gpio/gpiolib.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit ec963d04ca8651cc3738bc8e013b3ab7fdb95e3d Author: Bartosz Golaszewski Date: Tue Oct 3 09:12:13 2023 +0200 pinctrl: provide new GPIO-to-pinctrl glue helpers Currently the pinctrl GPIO helpers all take a number from the global GPIO numberspace - of which we're trying to get rid of as argument. These helpers are almost universally called from GPIOLIB driver callbacks which take a pointer to the backing gpio_chip and the controller-relative offset as arguments. Let's provide improved variants of these functions that match the GPIOLIB signatures as the first step in removing the older flavor. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij drivers/pinctrl/core.c | 108 ++++++++++++++++++++++++++++----------- include/linux/pinctrl/consumer.h | 46 +++++++++++++++++ 2 files changed, 125 insertions(+), 29 deletions(-) commit 9596ebf87c4f3f439d658af4d7cc2a302bea3750 Author: Bartosz Golaszewski Date: Mon Oct 2 20:53:47 2023 +0200 pinctrl: remove unneeded extern specifiers from consumer.h The 'extern' specifiers are not needed for function declarations. Remove all of them from the pinctrl/consumer.h header. Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko include/linux/pinctrl/consumer.h | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) commit 2654521d774f9461234bcf3d089185404abd110b Author: Bartosz Golaszewski Date: Tue Sep 5 20:53:09 2023 +0200 gpiolib: remove gpiochip_find() With all users of gpiochip_find() converted to using gpio_device_find(), we can now remove this function from the kernel. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Reviewed-by: Linus Walleij drivers/gpio/gpiolib.c | 22 ---------------------- include/linux/gpio/driver.h | 3 --- 2 files changed, 25 deletions(-) commit 90b0c2b2edd1adff742c621e246562fbefa11b70 Merge: be47c8e326c2 63bffc2d3a99 Author: Linus Torvalds Date: Fri Nov 3 19:15:19 2023 -1000 Merge tag 'pinctrl-v6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "No pin control core changes this time. New drivers: - Realtek RTD family pin control driver and RTD1619B, RTD1319D and RTD1315E subdrivers - Nuvoton NPCM8xx combined pin control and GPIO driver - Amlogic T7 pin control driver - Renesas RZ/G3S pin control driver Improvements: - A number of additional UART groups added to the Mediatek MT7981 driver - MPM pin maps added for Qualcomm MSM8996, SM6115, SM6125 and SDM660 - Extra GPIO banks for the Sunxi H616 - MLSP I2C6 function support in Qualcomm MSM8226 - Some __counted_by() annotations for dynamic arrays - Ongoing work to make remove() return void - LSBC groups and functions in the Renesas R8A7778" * tag 'pinctrl-v6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (110 commits) pinctrl: Use device_get_match_data() dt-bindings: pinctrl: qcom,sa8775p-tlmm: add missing wakeup-parent dt-bindings: pinctrl: nuvoton,npcm845: Add missing additionalProperties on gpio child nodes dt-bindings: pinctrl: brcm: Ensure all child node properties are documented pinctrl: renesas: rzn1: Convert to platform remove callback returning void pinctrl: renesas: rzg2l: Add RZ/G3S support dt-bindings: pinctrl: renesas: Document RZ/G3S SoC pinctrl: renesas: rzg2l: Add support for different DS values on different groups pinctrl: renesas: rzg2l: Move DS and OI to SoC-specific configuration pinctrl: renesas: rzg2l: Adapt function number for RZ/G3S pinctrl: renesas: rzg2l: Adapt for different SD/PWPR register offsets pinctrl: renesas: rzg2l: Index all registers based on port offset pinctrl: renesas: rzg2l: Add validation of GPIO pin in rzg2l_gpio_request() pinctrl: renesas: r8a7778: Add LBSC pins, groups, and functions pinctrl: intel: fetch community only when we need it pinctrl: cherryview: reduce scope of PIN_CONFIG_BIAS_HIGH_IMPEDANCE case pinctrl: cherryview: Convert to platform remove callback returning void pinctrl: sprd-sc9860: Convert to platform remove callback returning void pinctrl: qcom/msm: Convert to platform remove callback returning void pinctrl: qcom/lpi: Convert to platform remove callback returning void ... commit be47c8e326c2375200473e442f3481c386a955c4 Merge: bfafa2c19d70 4ea2b6d3128e Author: Linus Torvalds Date: Fri Nov 3 19:10:41 2023 -1000 Merge tag 'soundwire-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire updates from Vinod Koul: - Core now has improved handling of errors for clock stop - Support for qcom v2.0.0 status registers and command ignored interrupt and more logging for failures - DMI quirk for HP Omen machine * tag 'soundwire-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: dmi-quirks: update HP Omen match soundwire: bus: improve error handling for clock stop prepare/deprepare soundwire: qcom: Log clk_get("iface") failures soundwire: qcom: handle command ignored interrupt soundwire: qcom: use newer link status tregister on v2.0.0 commit bfafa2c19d706ab1db0b581f9d3886469fab8627 Merge: d934aef6bb9e d688c8264b8e Author: Linus Torvalds Date: Fri Nov 3 19:06:12 2023 -1000 Merge tag 'phy-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull generic phy updates from Vinod Koul: "New Support: - Qualcomm sa8775p qmp-pcie, IPQ5018, and SC7280 qmp-ufs support - Mediatek MT8188 support Updates: - Device tree device_get_match_data() usage and dropping of_match_device() calls - Qualcomm qmp usb and combo phy updates for v6 register layout - Qualcomm eusb2-repeater updates for tuning overrides, regmap fields - STih407 usb binding and ralink usb-phy yaml conversion - renesas r8a779f0 serdes init sequencing updates" * tag 'phy-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (32 commits) phy: Remove duplicated include in phy-ralink-usb.c phy: Kconfig: Select GENERIC_PHY for GENERIC_PHY_MIPI_DPHY phy: qcom-qmp-pcie: add endpoint support for sa8775p dt-bindings: phy: ralink-usb-phy: convert to dtschema dt-bindings: phy: Convert PXA1928 USB/HSIC PHY to DT schema phy: Drop unnecessary of_match_device() calls phy: rockchip-inno-usb2: Drop unnecessary DT includes phy: Use device_get_match_data() phy: realtek: Replace of_device.h with explicit includes phy: renesas: r8a779f0-ether-serdes: Add .exit() ops phy: renesas: r8a779f0-ether-serdes: Reset in .init() phy: qcom-qmp-combo: use v6 registers in v6 regs layout phy: qcom-qmp-usb: move PCS v6 register to the proper header phy: qcom-qmp-combo: fix the prefix for the PCS_USB v6 registers phy: sun4i-usb: update array size phy: qualcomm: phy-qcom-eusb2-repeater: Add tuning overrides phy: qualcomm: phy-qcom-eusb2-repeater: Zero out untouched tuning regs phy: qualcomm: phy-qcom-eusb2-repeater: Use regmap_fields dt-bindings: phy: qcom,snps-eusb2-repeater: Add magic tuning overrides dt-bindings: phy: Add compatible for Mediatek MT8188 ... commit d934aef6bb9ec1b42dfe1f5c1f945fa0d2d0752c Merge: 2c40c1c6adab 03f25d53b145 Author: Linus Torvalds Date: Fri Nov 3 18:56:51 2023 -1000 Merge tag 'dmaengine-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: - Big pile of __counted_by attribute annotations to several structures for bounds checking of flexible arrays at run-time - Another big pile platform remove callback returning void changes - Device tree device_get_match_data() usage and dropping of_match_device() calls - Minor driver updates to pxa, idxd fsl, hisi etc drivers * tag 'dmaengine-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (106 commits) dmaengine: stm32-mdma: correct desc prep when channel running dmaengine: dw-axi-dmac: Add support DMAX_NUM_CHANNELS > 16 dmaengine: xilinx: xilinx_dma: Fix kernel doc about xilinx_dma_remove() dmaengine: mmp_tdma: drop unused variable 'of_id' MAINTAINERS: Add entries for NXP(Freescale) eDMA drivers dmaengine: xilinx: xdma: Support cyclic transfers dmaengine: xilinx: xdma: Prepare the introduction of cyclic transfers dmaengine: Drop unnecessary of_match_device() calls dmaengine: Use device_get_match_data() dmaengine: pxa_dma: Annotate struct pxad_desc_sw with __counted_by dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() dmaengine: xilinx: xdma: Use resource_size() in xdma_probe() dmaengine: fsl-dpaa2-qdma: Remove redundant initialization owner in dpaa2_qdma_driver dmaengine: Remove unused declaration dma_chan_cleanup() dmaengine: mmp: fix Wvoid-pointer-to-enum-cast warning dmaengine: qcom: fix Wvoid-pointer-to-enum-cast warning dmaengine: fsl-edma: Remove redundant dev_err() for platform_get_irq() dmaengine: ep93xx_dma: Annotate struct ep93xx_dma_engine with __counted_by dmaengine: idxd: add wq driver name support for accel-config user tool dmaengine: fsl-edma: Annotate struct struct fsl_edma_engine with __counted_by ... commit 2c40c1c6adab90ee4660caf03722b3a3ec67767b Merge: 1f24458a1071 c70793fb7632 Author: Linus Torvalds Date: Fri Nov 3 16:00:42 2023 -1000 Merge tag 'usb-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/Thunderbolt updates from Greg KH: "Here is the "big" set of USB and Thunderbolt changes for 6.7-rc1. Nothing really major in here, just lots of constant development for new hardware. Included in here are: - Thunderbolt (i.e. USB4) fixes for reported issues and support for new hardware types and devices - USB typec additions of new drivers and cleanups for some existing ones - xhci cleanups and expanded tracing support and some platform specific updates - USB "La Jolla Cove Adapter (LJCA)" support added, and the gpio, spi, and i2c drivers for that type of device (all acked by the respective subsystem maintainers.) - lots of USB gadget driver updates and cleanups - new USB dwc3 platforms supported, as well as other dwc3 fixes and cleanups - USB chipidea driver updates - other smaller driver cleanups and additions, full details in the shortlog All of these have been in the linux-next tree for a while with no reported problems" * tag 'usb-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (167 commits) usb: gadget: uvc: Add missing initialization of ssp config descriptor usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility usb: raw-gadget: report suspend, resume, reset, and disconnect events usb: raw-gadget: don't disable device if usb_ep_queue fails usb: raw-gadget: properly handle interrupted requests usb:cdnsp: remove TRB_FLUSH_ENDPOINT command usb: gadget: aspeed_udc: Convert to platform remove callback returning void dt-bindings: usb: fsa4480: Add compatible for OCP96011 usb: typec: fsa4480: Add support to swap SBU orientation dt-bindings: usb: fsa4480: Add data-lanes property to endpoint usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() Revert "dt-bindings: usb: Add bindings for multiport properties on DWC3 controller" Revert "dt-bindings: usb: qcom,dwc3: Add bindings for SC8280 Multiport" thunderbolt: Fix one kernel-doc comment usb: gadget: f_ncm: Always set current gadget in ncm_bind() usb: core: Remove duplicated check in usb_hub_create_port_device usb: typec: tcpm: Add additional checks for contaminant arm64: dts: rockchip: rk3588s: Add USB3 host controller usb: dwc3: add optional PHY interface clocks dt-bindings: usb: add rk3588 compatible to rockchip,dwc3 ... commit 1f24458a1071f006e3f7449c08ae0f12af493923 Merge: 4c7a0c95adc3 64ebf8797249 Author: Linus Torvalds Date: Fri Nov 3 15:44:25 2023 -1000 Merge tag 'tty-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty and serial updates from Greg KH: "Here is the big set of tty/serial driver changes for 6.7-rc1. Included in here are: - console/vgacon cleanups and removals from Arnd - tty core and n_tty cleanups from Jiri - lots of 8250 driver updates and cleanups - sc16is7xx serial driver updates - dt binding updates - first set of port lock wrapers from Thomas for the printk fixes coming in future releases - other small serial and tty core cleanups and updates All of these have been in linux-next for a while with no reported issues" * tag 'tty-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (193 commits) serdev: Replace custom code with device_match_acpi_handle() serdev: Simplify devm_serdev_device_open() function serdev: Make use of device_set_node() tty: n_gsm: add copyright Siemens Mobility GmbH tty: n_gsm: fix race condition in status line change on dead connections serial: core: Fix runtime PM handling for pending tx vgacon: fix mips/sibyte build regression dt-bindings: serial: drop unsupported samsung bindings tty: serial: samsung: drop earlycon support for unsupported platforms tty: 8250: Add note for PX-835 tty: 8250: Fix IS-200 PCI ID comment tty: 8250: Add Brainboxes Oxford Semiconductor-based quirks tty: 8250: Add support for Intashield IX cards tty: 8250: Add support for additional Brainboxes PX cards tty: 8250: Fix up PX-803/PX-857 tty: 8250: Fix port count of PX-257 tty: 8250: Add support for Intashield IS-100 tty: 8250: Add support for Brainboxes UP cards tty: 8250: Add support for additional Brainboxes UC cards tty: 8250: Remove UC-257 and UC-431 ... commit 4c7a0c95adc3ed8cc5e4c2187521aea3e40ba1aa Merge: b06f58ad8e8c a4000df5300f Author: Linus Torvalds Date: Fri Nov 3 15:31:04 2023 -1000 Merge tag 'staging-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is the big set of staging driver updates for 6.7-rc1. A bit bigger than 6.6 this time around, as it coincided with the Outreachy and mentorship application process, so we got a bunch of new developers sending in their first changes, which is nice to see. Also in here is a removal of the qlge ethernet driver, and the rtl8192u wireless driver. Both of these were very old and no one was maintaining them, the wireless driver removal was due to no one using it anymore, and no hardware to be found, and is part of a larger effort to remove unused and old wifi drivers from the system. The qlge ethernet driver did have one user pop up after it was dropped, and we are working with the network mainainers to figure out what tree it will come back in from and who will be responsible for it, and if it really is being used or not. Odds are it will show up in a network subsystem pull request after -rc1 is out, but we aren't sure yet. Other smaller changes in here are: - Lots of vc04_services work by Umang to clean up the mess created by the rpi developers long ago, bringing it almost into good enough shape to get out of staging, hopefully next major release, it's getting close. - rtl8192e variable cleanups and removal of unused code and structures - vme_user coding style cleanups - other small coding style cleanups to lots of the staging drivers - octeon typedef removals, and then last-minute revert when it was found to break the build in some configurations (it's a hard driver to build properly, none of the normal automated testing catches it.) All of these have been in linux-next for a while with no reported issues" * tag 'staging-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (256 commits) Revert "staging: octeon: remove typedef in enum cvmx_spi_mode_t" Revert "staging: octeon: remove typedef in enum cvmx_helper_interface_mode_t" Revert "staging: octeon: remove typedef in enum cvmx_pow_wait_t" Revert "staging: octeon: remove typedef in struct cvmx_pko_lock_t" Revert "staging: octeon: remove typedef in enum cvmx_pko_status_t" Revert "staging: octeon: remove typedef in structs cvmx_pip_port_status_t and cvmx_pko_port_status_t" staging: vt6655: Type encoding info dropped from variable name "byRxRate" staging: vt6655: Type encoding info dropped from function name "CARDbUpdateTSF" staging: vt6655: Type encoding info dropped from function name "CARDvSetRSPINF" staging: vt6655: Type encoding info dropped from function name "CARDbyGetPktType" staging: vt6655: Type encoding info dropped from variable name "byPacketType" staging: vt6655: Type encoding info dropped from function name "CARDbSetPhyParameter" staging: vt6655: Type encoding info dropped from variable name "pbyRsvTime" staging: vt6655: Type encoding info dropped from variable name "pbyTxRate" staging: vt6655: Type encoding info dropped from function name "s_vCalculateOFDMRParameter" staging: vt6655: Type encoding info dropped from array name "cwRXBCNTSFOff" staging: fbtft: Convert to platform remove callback returning void staging: olpc_dcon: Remove I2C_CLASS_DDC support staging: vc04_services: use snprintf instead of sprintf staging: rtl8192e: Fix line break issue at priv->rx_buf[priv->rx_idx] ... commit b06f58ad8e8c4154bc88d83b4fd70f74ede50193 Merge: d99b91a99be4 effd7c70eaa0 Author: Linus Torvalds Date: Fri Nov 3 15:15:47 2023 -1000 Merge tag 'driver-core-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core updates from Greg KH: "Here is the set of driver core updates for 6.7-rc1. Nothing major in here at all, just a small number of changes including: - minor cleanups and updates from Andy Shevchenko - __counted_by addition - firmware_loader update for aborting loads cleaner - other minor changes, details in the shortlog - documentation update All of these have been in linux-next for a while with no reported issues" * tag 'driver-core-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (21 commits) firmware_loader: Abort all upcoming firmware load request once reboot triggered firmware_loader: Refactor kill_pending_fw_fallback_reqs() Documentation: security-bugs.rst: linux-distros relaxed their rules driver core: Release all resources during unbind before updating device links driver core: class: remove boilerplate code driver core: platform: Annotate struct irq_affinity_devres with __counted_by resource: Constify resource crosscheck APIs resource: Unify next_resource() and next_resource_skip_children() resource: Reuse for_each_resource() macro PCI: Implement custom llseek for sysfs resource entries kernfs: sysfs: support custom llseek method for sysfs entries debugfs: Fix __rcu type comparison warning device property: Replace custom implementation of COUNT_ARGS() drivers: base: test: Make property entry API test modular driver core: Add missing parameter description to __fwnode_link_add() device property: Clarify usage scope of some struct fwnode_handle members devres: rename the first parameter of devm_add_action(_or_reset) driver core: platform: Unify the firmware node type check driver core: platform: Use temporary variable in platform_device_add() driver core: platform: Refactor error path in a couple places ... commit d99b91a99be430be45413052bb428107c435918b Merge: e392ea4d4d00 fa10f413091a Author: Linus Torvalds Date: Fri Nov 3 14:51:08 2023 -1000 Merge tag 'char-misc-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc updates from Greg KH: "Here is the big set of char/misc and other small driver subsystem changes for 6.7-rc1. Included in here are: - IIO subsystem driver updates and additions (largest part of this pull request) - FPGA subsystem driver updates - Counter subsystem driver updates - ICC subsystem driver updates - extcon subsystem driver updates - mei driver updates and additions - nvmem subsystem driver updates and additions - comedi subsystem dependency fixes - parport driver fixups - cdx subsystem driver and core updates - splice support for /dev/zero and /dev/full - other smaller driver cleanups All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (326 commits) cdx: add sysfs for subsystem, class and revision cdx: add sysfs for bus reset cdx: add support for bus enable and disable cdx: Register cdx bus as a device on cdx subsystem cdx: Create symbol namespaces for cdx subsystem cdx: Introduce lock to protect controller ops cdx: Remove cdx controller list from cdx bus system dts: ti: k3-am625-beagleplay: Add beaglecc1352 greybus: Add BeaglePlay Linux Driver dt-bindings: net: Add ti,cc1352p7 dt-bindings: eeprom: at24: allow NVMEM cells based on old syntax dt-bindings: nvmem: SID: allow NVMEM cells based on old syntax Revert "nvmem: add new config option" MAINTAINERS: coresight: Add missing Coresight files misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support firmware: xilinx: Move EXPORT_SYMBOL_GPL next to zynqmp_pm_feature definition uacce: make uacce_class constant ocxl: make ocxl_class constant cxl: make cxl_class constant misc: phantom: make phantom_class constant ... commit 9fd00df05e81a2e1080ce6e9abc35533dca99d74 Author: Zbigniew Lukwinski Date: Mon Oct 16 00:23:34 2023 +0200 i3c: master: handle IBIs in order they came IBI shall be handled in order they appear on the bus. Otherwise could hit case when order of handling them in device driver will be different. It may lead to invalid assembling fragmented packets or events order broken. Added separate workqueue with option WQ_MEM_RECLAIM for each device driver. This ensures IBI handling order and improves IBI handling performance: IBI handlers for device B are not blocked by IBI handlers for device A. Original solution (single workqueue in main driver) was able to handle also general IBI (not related to specific device) like HJ or MR. So leaving this for such purposes. Signed-off-by: Zbigniew Lukwinski Link: https://lore.kernel.org/r/20231015222334.1652401-2-zbigniew.lukwinski@linux.intel.com Signed-off-by: Alexandre Belloni drivers/i3c/master.c | 14 +++++++++++++- include/linux/i3c/master.h | 4 +++- 2 files changed, 16 insertions(+), 2 deletions(-) commit b53e9758a31c683fc8615df930262192ed5f034b Author: Billy Tsai Date: Mon Oct 23 16:02:37 2023 +0800 i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data. The `i3c_master_bus_init` function may attach the I2C devices before the I3C bus initialization. In this flow, the DAT `alloc_entry`` will be used before the DAT `init`. Additionally, if the `i3c_master_bus_init` fails, the DAT `cleanup` will execute before the device is detached, which will execue DAT `free_entry` function. The above scenario can cause the driver to use DAT_data when it is NULL. Signed-off-by: Billy Tsai Link: https://lore.kernel.org/r/20231023080237.560936-1-billy_tsai@aspeedtech.com Signed-off-by: Alexandre Belloni drivers/i3c/master/mipi-i3c-hci/dat_v1.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) commit 56d2e2cfa21315c12945c22e141c7e7ec8b0a630 Author: Christian Brauner Date: Mon Aug 7 15:26:26 2023 +0200 ceph: allow idmapped mounts Now that we converted cephfs internally to account for idmapped mounts allow the creation of idmapped mounts on by setting the FS_ALLOW_IDMAP flag. Signed-off-by: Christian Brauner Signed-off-by: Alexander Mikhalitsyn Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov fs/ceph/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8a051b40abd6f948a599dc6328e9356f4697e77d Author: Christian Brauner Date: Mon Aug 7 15:26:25 2023 +0200 ceph: allow idmapped atomic_open inode op Enable ceph_atomic_open() to handle idmapped mounts. This is just a matter of passing down the mount's idmapping. [ aleksandr.mikhalitsyn: adapted to 5fadbd9929 ("ceph: rely on vfs for setgid stripping") ] Signed-off-by: Christian Brauner Signed-off-by: Alexander Mikhalitsyn Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov fs/ceph/file.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit 2cce72dda2b5c494f6489ba78588c4ce191c6b61 Author: Christian Brauner Date: Mon Aug 7 15:26:24 2023 +0200 ceph: allow idmapped set_acl inode op Enable ceph_set_acl() to handle idmapped mounts. This is just a matter of passing down the mount's idmapping. Signed-off-by: Christian Brauner Signed-off-by: Alexander Mikhalitsyn Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov fs/ceph/acl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a04aff2588e05bdefc6abb3f16999312db14c333 Author: Christian Brauner Date: Mon Aug 7 15:26:23 2023 +0200 ceph: allow idmapped setattr inode op Enable __ceph_setattr() to handle idmapped mounts. This is just a matter of passing down the mount's idmapping. [ aleksandr.mikhalitsyn: adapted to b27c82e12965 ("attr: port attribute changes to new types") ] Signed-off-by: Christian Brauner Signed-off-by: Alexander Mikhalitsyn Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov fs/ceph/inode.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) commit 79c66a0c8c4a5d341e948dd6a41111957b315f20 Author: Alexander Mikhalitsyn Date: Mon Aug 7 15:26:22 2023 +0200 ceph: pass idmap to __ceph_setattr Just pass down the mount's idmapping to __ceph_setattr, because we will need it later. Signed-off-by: Alexander Mikhalitsyn Acked-by: Christian Brauner Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov fs/ceph/acl.c | 4 ++-- fs/ceph/crypto.c | 2 +- fs/ceph/inode.c | 6 +++--- fs/ceph/super.h | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) commit 8995375fae40a9a014622fd2a0567fe8a2252e66 Author: Christian Brauner Date: Mon Aug 7 15:26:21 2023 +0200 ceph: allow idmapped permission inode op Enable ceph_permission() to handle idmapped mounts. This is just a matter of passing down the mount's idmapping. Signed-off-by: Christian Brauner Signed-off-by: Alexander Mikhalitsyn Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov fs/ceph/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0513043ec491500237d7215bf1ccfed54f292e86 Author: Christian Brauner Date: Mon Aug 7 15:26:20 2023 +0200 ceph: allow idmapped getattr inode op Enable ceph_getattr() to handle idmapped mounts. This is just a matter of passing down the mount's idmapping. Signed-off-by: Christian Brauner Signed-off-by: Alexander Mikhalitsyn Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov fs/ceph/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 09838f1bfd40f483cd6442788e810ea042e91177 Author: Christian Brauner Date: Mon Aug 7 15:26:19 2023 +0200 ceph: pass an idmapping to mknod/symlink/mkdir Enable mknod/symlink/mkdir iops to handle idmapped mounts. This is just a matter of passing down the mount's idmapping. Signed-off-by: Christian Brauner Signed-off-by: Alexander Mikhalitsyn Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov fs/ceph/dir.c | 4 ++++ 1 file changed, 4 insertions(+) commit 673478b6e59b25079a590eb5ba89d7a3ec9c1c78 Author: Alexander Mikhalitsyn Date: Mon Aug 7 15:26:18 2023 +0200 ceph: add enable_unsafe_idmap module parameter This parameter is used to decide if we allow to perform IO on idmapped mount in case when MDS lacks support of CEPHFS_FEATURE_HAS_OWNER_UIDGID feature. In this case we can't properly handle MDS permission checks and if UID/GID-based restrictions are enabled on the MDS side then IO requests which go through an idmapped mount may fail with -EACCESS/-EPERM. Fortunately, for most of users it's not a case and everything should work fine. But we put work "unsafe" in the module parameter name to warn users about possible problems with this feature and encourage update of cephfs MDS. Suggested-by: Stéphane Graber Signed-off-by: Alexander Mikhalitsyn Acked-by: Christian Brauner Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov fs/ceph/mds_client.c | 28 +++++++++++++++++++++------- fs/ceph/mds_client.h | 2 ++ fs/ceph/super.c | 5 +++++ 3 files changed, 28 insertions(+), 7 deletions(-) commit 5ccd8530dd7ba97531a50ffa11eabe258d65a7af Author: Christian Brauner Date: Mon Aug 7 15:26:17 2023 +0200 ceph: handle idmapped mounts in create_request_message() Inode operations that create a new filesystem object such as ->mknod, ->create, ->mkdir() and others don't take a {g,u}id argument explicitly. Instead the caller's fs{g,u}id is used for the {g,u}id of the new filesystem object. In order to ensure that the correct {g,u}id is used map the caller's fs{g,u}id for creation requests. This doesn't require complex changes. It suffices to pass in the relevant idmapping recorded in the request message. If this request message was triggered from an inode operation that creates filesystem objects it will have passed down the relevant idmaping. If this is a request message that was triggered from an inode operation that doens't need to take idmappings into account the initial idmapping is passed down which is an identity mapping. This change uses a new cephfs protocol extension CEPHFS_FEATURE_HAS_OWNER_UIDGID which adds two new fields (owner_{u,g}id) to the request head structure. So, we need to ensure that MDS supports it otherwise we need to fail any IO that comes through an idmapped mount because we can't process it in a proper way. MDS server without such an extension will use caller_{u,g}id fields to set a new inode owner UID/GID which is incorrect because caller_{u,g}id values are unmapped. At the same time we can't map these fields with an idmapping as it can break UID/GID-based permission checks logic on the MDS side. This problem was described with a lot of details at [1], [2]. [1] https://lore.kernel.org/lkml/CAEivzxfw1fHO2TFA4dx3u23ZKK6Q+EThfzuibrhA3RKM=ZOYLg@mail.gmail.com/ [2] https://lore.kernel.org/all/20220104140414.155198-3-brauner@kernel.org/ Link: https://github.com/ceph/ceph/pull/52575 Link: https://tracker.ceph.com/issues/62217 Co-Developed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner Signed-off-by: Alexander Mikhalitsyn Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov fs/ceph/mds_client.c | 56 ++++++++++++++++++++++++++++++++++++++++---- fs/ceph/mds_client.h | 5 +++- include/linux/ceph/ceph_fs.h | 10 +++++++- 3 files changed, 65 insertions(+), 6 deletions(-) commit 9c2df2271c6901ba67d3437494b3d889dc43645b Author: Christian Brauner Date: Mon Aug 7 15:26:16 2023 +0200 ceph: stash idmapping in mdsc request When sending a mds request cephfs will send relevant data for the requested operation. For creation requests the caller's fs{g,u}id is used to set the ownership of the newly created filesystem object. For setattr requests the caller can pass in arbitrary {g,u}id values to which the relevant filesystem object is supposed to be changed. If the caller is performing the relevant operation via an idmapped mount cephfs simply needs to take the idmapping into account when it sends the relevant mds request. In order to support idmapped mounts for cephfs we stash the idmapping whenever they are relevant for the operation for the duration of the request. Since mds requests can be queued and performed asynchronously we make sure to keep the idmapping around and release it once the request has finished. In follow-up patches we will use this to send correct ownership information over the wire. This patch just adds the basic infrastructure to keep the idmapping around. The actual conversion patches are all fairly minimal. Signed-off-by: Christian Brauner Signed-off-by: Alexander Mikhalitsyn Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov fs/ceph/mds_client.c | 5 +++++ fs/ceph/mds_client.h | 1 + 2 files changed, 6 insertions(+) commit 1b90344614cc5949666328b37f03edec1d4e2873 Author: Alexander Mikhalitsyn Date: Mon Aug 7 15:26:15 2023 +0200 fs: export mnt_idmap_get/mnt_idmap_put These helpers are required to support idmapped mounts in CephFS. Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Alexander Mikhalitsyn Reviewed-by: Christian Brauner Signed-off-by: Ilya Dryomov fs/mnt_idmapping.c | 2 ++ include/linux/mnt_idmapping.h | 3 +++ 2 files changed, 5 insertions(+) commit 522dc5108f07ef30e2c7399e59b9547d382308ff Author: Xiubo Li Date: Mon Jun 12 15:41:10 2023 +0800 libceph, ceph: move mdsmap.h to fs/ceph The mdsmap.h is only used by CephFS, so move it to fs/ceph. Signed-off-by: Xiubo Li Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov fs/ceph/mds_client.h | 2 +- fs/ceph/mdsmap.c | 2 +- {include/linux => fs}/ceph/mdsmap.h | 0 3 files changed, 2 insertions(+), 2 deletions(-) commit 38d46409c4639a1d659ebfa70e27a8bed6b8ee1d Author: Xiubo Li Date: Mon Jun 12 09:04:07 2023 +0800 ceph: print cluster fsid and client global_id in all debug logs Multiple CephFS mounts on a host is increasingly common so disambiguating messages like this is necessary and will make it easier to debug issues. At the same this will improve the debug logs to make them easier to troubleshooting issues, such as print the ino# instead only printing the memory addresses of the corresponding inodes and print the dentry names instead of the corresponding memory addresses for the dentry,etc. Link: https://tracker.ceph.com/issues/61590 Signed-off-by: Xiubo Li Reviewed-by: Patrick Donnelly Reviewed-by: Milind Changire Signed-off-by: Ilya Dryomov fs/ceph/acl.c | 6 +- fs/ceph/addr.c | 279 +++++++++++--------- fs/ceph/caps.c | 710 +++++++++++++++++++++++++++++---------------------- fs/ceph/crypto.c | 39 ++- fs/ceph/debugfs.c | 6 +- fs/ceph/dir.c | 218 +++++++++------- fs/ceph/export.c | 39 +-- fs/ceph/file.c | 245 ++++++++++-------- fs/ceph/inode.c | 485 +++++++++++++++++++---------------- fs/ceph/ioctl.c | 13 +- fs/ceph/locks.c | 57 +++-- fs/ceph/mds_client.c | 558 ++++++++++++++++++++++------------------ fs/ceph/mdsmap.c | 24 +- fs/ceph/metric.c | 5 +- fs/ceph/quota.c | 29 ++- fs/ceph/snap.c | 174 +++++++------ fs/ceph/super.c | 70 ++--- fs/ceph/super.h | 6 + fs/ceph/xattr.c | 96 ++++--- 19 files changed, 1747 insertions(+), 1312 deletions(-) commit 5995d90d2d19f337df6a50bcf4699ef053214dac Author: Xiubo Li Date: Mon Jun 12 10:50:38 2023 +0800 ceph: rename _to_client() to _to_fs_client() We need to covert the inode to ceph_client in the following commit, and will add one new helper for that, here we rename the old helper to _fs_client(). Link: https://tracker.ceph.com/issues/61590 Signed-off-by: Xiubo Li Reviewed-by: Patrick Donnelly Reviewed-by: Milind Changire Signed-off-by: Ilya Dryomov fs/ceph/addr.c | 20 ++++++++++---------- fs/ceph/cache.c | 2 +- fs/ceph/caps.c | 40 ++++++++++++++++++++-------------------- fs/ceph/crypto.c | 2 +- fs/ceph/dir.c | 22 +++++++++++----------- fs/ceph/export.c | 10 +++++----- fs/ceph/file.c | 24 ++++++++++++------------ fs/ceph/inode.c | 14 +++++++------- fs/ceph/ioctl.c | 8 ++++---- fs/ceph/mds_client.c | 2 +- fs/ceph/snap.c | 2 +- fs/ceph/super.c | 22 +++++++++++----------- fs/ceph/super.h | 10 +++++----- fs/ceph/xattr.c | 12 ++++++------ 14 files changed, 95 insertions(+), 95 deletions(-) commit 197b7d792d6aead2e30d4b2c054ffabae2ed73dc Author: Xiubo Li Date: Fri Jun 9 15:15:47 2023 +0800 ceph: pass the mdsc to several helpers We will use the 'mdsc' to get the global_id in the following commits. Link: https://tracker.ceph.com/issues/61590 Signed-off-by: Xiubo Li Reviewed-by: Patrick Donnelly Reviewed-by: Milind Changire Signed-off-by: Ilya Dryomov fs/ceph/caps.c | 15 +++++++++------ fs/ceph/debugfs.c | 4 ++-- fs/ceph/dir.c | 2 +- fs/ceph/file.c | 2 +- fs/ceph/mds_client.c | 39 ++++++++++++++++++++++----------------- fs/ceph/mds_client.h | 3 ++- fs/ceph/mdsmap.c | 3 ++- fs/ceph/snap.c | 16 ++++++++++------ fs/ceph/super.h | 3 ++- include/linux/ceph/mdsmap.h | 5 ++++- 10 files changed, 55 insertions(+), 37 deletions(-) commit 5c5f0d2b5f92c47baf82b9b211e27edd7d195158 Author: Xiubo Li Date: Fri Jun 9 13:04:14 2023 +0800 libceph: add doutc and *_client debug macros support This will help print the fsid and client's global_id in debug logs, and also print the function names. [ idryomov: %lld -> %llu, leading space for doutc(), don't include __func__ in pr_*() variants ] Link: https://tracker.ceph.com/issues/61590 Signed-off-by: Xiubo Li Reviewed-by: Patrick Donnelly Reviewed-by: Milind Changire Signed-off-by: Ilya Dryomov include/linux/ceph/ceph_debug.h | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) commit c692800cb2ef7a4f4940c68d765cd4649aff3e46 Author: Kirill A. Shutemov Date: Thu Nov 2 02:33:14 2023 +0300 MAINTAINERS: Add Intel TDX entry Add myself as Intel TDX maintainer. I drove upstreaming most of TDX code so far and I will continue working on TDX for foreseeable future. [ dhansen: * Add myself as a reviewer too * Swap Maintained=>Supported. I double checked Kirill is still being paid * Add drivers/virt/coco/tdx-guest ] Suggested-by: Dave Hansen Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Acked-by: Dave Hansen Acked-by: Kuppuswamy Sathyanarayanan Acked-by: Kai Huang Link: https://lore.kernel.org/all/20231101233314.2567-1-kirill.shutemov%40linux.intel.com MAINTAINERS | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit e392ea4d4d00880bf94550151b1ace4f88a4b17a Merge: 707df298cbde 991a211aa99f Author: Linus Torvalds Date: Fri Nov 3 10:17:22 2023 -1000 Merge tag 's390-6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Vasily Gorbik: - Get rid of private VM_FAULT flags - Add word-at-a-time implementation - Add DCACHE_WORD_ACCESS support - Cleanup control register handling - Disallow CPU hotplug of CPU 0 to simplify its handling complexity, following a similar restriction in x86 - Optimize pai crypto map allocation - Update the list of crypto express EP11 coprocessor operation modes - Fixes and improvements for secure guests AP pass-through - Several fixes to address incorrect page marking for address translation with the "cmma no-dat" feature, preventing potential incorrect guest TLB flushes - Fix early IPI handling - Several virtual vs physical address confusion fixes - Various small fixes and improvements all over the code * tag 's390-6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (74 commits) s390/cio: replace deprecated strncpy with strscpy s390/sclp: replace deprecated strncpy with strtomem s390/cio: fix virtual vs physical address confusion s390/cio: export CMG value as decimal s390: delete the unused store_prefix() function s390/cmma: fix handling of swapper_pg_dir and invalid_pg_dir s390/cmma: fix detection of DAT pages s390/sclp: handle default case in sclp memory notifier s390/pai_crypto: remove per-cpu variable assignement in event initialization s390/pai: initialize event count once at initialization s390/pai_crypto: use PERF_ATTACH_TASK define for per task detection s390/mm: add missing arch_set_page_dat() call to gmap allocations s390/mm: add missing arch_set_page_dat() call to vmem_crst_alloc() s390/cmma: fix initial kernel address space page table walk s390/diag: add missing virt_to_phys() translation to diag224() s390/mm,fault: move VM_FAULT_ERROR handling to do_exception() s390/mm,fault: remove VM_FAULT_BADMAP and VM_FAULT_BADACCESS s390/mm,fault: remove VM_FAULT_SIGNAL s390/mm,fault: remove VM_FAULT_BADCONTEXT s390/mm,fault: simplify kfence fault handling ... commit 707df298cbde200b939c70be2577b20775fe3345 Merge: 6bdfe2d88b9f 303d77a6e170 Author: Linus Torvalds Date: Fri Nov 3 10:07:39 2023 -1000 Merge tag 'powerpc-6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Michael Ellerman: - Add support for KVM running as a nested hypervisor under development versions of PowerVM, using the new PAPR nested virtualisation API - Add support for the BPF prog pack allocator - A rework of the non-server MMU handling to support execute-only on all platforms - Some optimisations & cleanups for the powerpc qspinlock code - Various other small features and fixes Thanks to Aboorva Devarajan, Aditya Gupta, Amit Machhiwal, Benjamin Gray, Christophe Leroy, Dr. David Alan Gilbert, Gaurav Batra, Gautam Menghani, Geert Uytterhoeven, Haren Myneni, Hari Bathini, Joel Stanley, Jordan Niethe, Julia Lawall, Kautuk Consul, Kuan-Wei Chiu, Michael Neuling, Minjie Du, Muhammad Muzammil, Naveen N Rao, Nicholas Piggin, Nick Child, Nysal Jan K.A, Peter Lafreniere, Rob Herring, Sachin Sant, Sebastian Andrzej Siewior, Shrikanth Hegde, Srikar Dronamraju, Stanislav Kinsburskii, Vaibhav Jain, Wang Yufen, Yang Yingliang, and Yuan Tan. * tag 'powerpc-6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (100 commits) powerpc/vmcore: Add MMU information to vmcoreinfo Revert "powerpc: add `cur_cpu_spec` symbol to vmcoreinfo" powerpc/bpf: use bpf_jit_binary_pack_[alloc|finalize|free] powerpc/bpf: rename powerpc64_jit_data to powerpc_jit_data powerpc/bpf: implement bpf_arch_text_invalidate for bpf_prog_pack powerpc/bpf: implement bpf_arch_text_copy powerpc/code-patching: introduce patch_instructions() powerpc/32s: Implement local_flush_tlb_page_psize() powerpc/pseries: use kfree_sensitive() in plpks_gen_password() powerpc/code-patching: Perform hwsync in __patch_instruction() in case of failure powerpc/fsl_msi: Use device_get_match_data() powerpc: Remove cpm_dp...() macros powerpc/qspinlock: Rename yield_propagate_owner tunable powerpc/qspinlock: Propagate sleepy if previous waiter is preempted powerpc/qspinlock: don't propagate the not-sleepy state powerpc/qspinlock: propagate owner preemptedness rather than CPU number powerpc/qspinlock: stop queued waiters trying to set lock sleepy powerpc/perf: Fix disabling BHRB and instruction sampling powerpc/trace: Add support for HAVE_FUNCTION_ARG_ACCESS_API powerpc/tools: Pass -mabi=elfv2 to gcc-check-mprofile-kernel.sh ... commit 6bdfe2d88b9ff8b0cce32ce87cd47c0e9d665f48 Merge: 136cc1e1f5be 6cede10161be Author: Linus Torvalds Date: Fri Nov 3 09:48:17 2023 -1000 Merge tag 'apparmor-pr-2023-11-03' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor Pull apparmor updates from John Johansen: "This adds initial support for mediating io_uring and userns creation. Adds a new restriction that tightens the use of change_profile, and a couple of optimizations to reduce performance bottle necks that have been found when retrieving the current task's secid and allocating work buffers. The majority of the patch set continues cleaning up and simplifying the code (fixing comments, removing now dead functions, and macros etc). Finally there are 4 bug fixes, with the regression fix having had a couple months of testing. Features: - optimize retrieving current task secid - add base io_uring mediation - add base userns mediation - improve buffer allocation - allow restricting unprivilege change_profile Cleanups: - Fix kernel doc comments - remove unused declarations - remove unused functions - remove unneeded #ifdef - remove unused macros - mark fns static - cleanup fn with unused return values - cleanup audit data - pass cred through to audit data - refcount the pdb instead of using duplicates - make SK_CTX macro an inline fn - some comment cleanups Bug fixes: - fix regression in mount mediation - fix invalid refenece - use passed in gfp flags - advertise avaiability of extended perms and disconnected.path" * tag 'apparmor-pr-2023-11-03' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: (39 commits) apparmor: Fix some kernel-doc comments apparmor: Fix one kernel-doc comment apparmor: Fix some kernel-doc comments apparmor: mark new functions static apparmor: Fix regression in mount mediation apparmor: cache buffers on percpu list if there is lock contention apparmor: add io_uring mediation apparmor: add user namespace creation mediation apparmor: allow restricting unprivileged change_profile apparmor: advertise disconnected.path is available apparmor: refcount the pdb apparmor: provide separate audit messages for file and policy checks apparmor: pass cred through to audit info. apparmor: rename audit_data->label to audit_data->subj_label apparmor: combine common_audit_data and apparmor_audit_data apparmor: rename SK_CTX() to aa_sock and make it an inline fn apparmor: Optimize retrieving current task secid apparmor: remove unused functions in policy_ns.c/.h apparmor: remove unneeded #ifdef in decompress_zstd() apparmor: fix invalid reference on profile->disconnected ... commit 136cc1e1f5be75f57f1e0404b94ee1c8792cb07d Merge: 7ab89417ed23 f12f8f84509a Author: Linus Torvalds Date: Fri Nov 3 09:28:53 2023 -1000 Merge tag 'landlock-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull landlock updates from Mickaël Salaün: "A Landlock ruleset can now handle two new access rights: LANDLOCK_ACCESS_NET_BIND_TCP and LANDLOCK_ACCESS_NET_CONNECT_TCP. When handled, the related actions are denied unless explicitly allowed by a Landlock network rule for a specific port. The related patch series has been reviewed for almost two years, it has evolved a lot and we now have reached a decent design, code and testing. The refactored kernel code and the new test helpers also bring the foundation to support more network protocols. Test coverage for security/landlock is 92.4% of 710 lines according to gcc/gcov-13, and it was 93.1% of 597 lines before this series. The decrease in coverage is due to code refactoring to make the ruleset management more generic (i.e. dealing with inodes and ports) that also added new WARN_ON_ONCE() checks not possible to test from user space. syzkaller has been updated accordingly [4], and such patched instance (tailored to Landlock) has been running for a month, covering all the new network-related code [5]" Link: https://lore.kernel.org/r/20231026014751.414649-1-konstantin.meskhidze@huawei.com [1] Link: https://lore.kernel.org/r/CAHC9VhS1wwgH6NNd+cJz4MYogPiRV8NyPDd1yj5SpaxeUB4UVg@mail.gmail.com [2] Link: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next-history.git/commit/?id=c8dc5ee69d3a [3] Link: https://github.com/google/syzkaller/pull/4266 [4] Link: https://storage.googleapis.com/syzbot-assets/82e8608dec36/ci-upstream-linux-next-kasan-gce-root-ab577164.html#security%2flandlock%2fnet.c [5] * tag 'landlock-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: selftests/landlock: Add tests for FS topology changes with network rules landlock: Document network support samples/landlock: Support TCP restrictions selftests/landlock: Add network tests selftests/landlock: Share enforce_ruleset() helper landlock: Support network rules with TCP bind and connect landlock: Refactor landlock_add_rule() syscall landlock: Refactor layer helpers landlock: Move and rename layer helpers landlock: Refactor merge/inherit_ruleset helpers landlock: Refactor landlock_find_rule/insert_rule helpers landlock: Allow FS topology changes for domains without such rule type landlock: Make ruleset's access masks more generic commit f8f9ab2d98116e79d220f1d089df7464ad4e026d Author: Jens Axboe Date: Fri Nov 3 10:35:40 2023 -0600 io_uring/net: ensure socket is marked connected on connect retry io_uring does non-blocking connection attempts, which can yield some unexpected results if a connect request is re-attempted by an an application. This is equivalent to the following sync syscall sequence: sock = socket(AF_INET, SOCK_STREAM | SOCK_NONBLOCK, IPPROTO_TCP); connect(sock, &addr, sizeof(addr); ret == -1 and errno == EINPROGRESS expected here. Now poll for POLLOUT on sock, and when that returns, we expect the socket to be connected. But if we follow that procedure with: connect(sock, &addr, sizeof(addr)); you'd expect ret == -1 and errno == EISCONN here, but you actually get ret == 0. If we attempt the connection one more time, then we get EISCON as expected. io_uring used to do this, but turns out that bluetooth fails with EBADFD if you attempt to re-connect. Also looks like EISCONN _could_ occur with this sequence. Retain the ->in_progress logic, but work-around a potential EISCONN or EBADFD error and only in those cases look at the sock_error(). This should work in general and avoid the odd sequence of a repeated connect request returning success when the socket is already connected. This is all a side effect of the socket state being in a CONNECTING state when we get EINPROGRESS, and only a re-connect or other related operation will turn that into CONNECTED. Cc: stable@vger.kernel.org Fixes: 3fb1bd688172 ("io_uring/net: handle -EINPROGRESS correct for IORING_OP_CONNECT") Link: https://github.com/axboe/liburing/issues/980 Signed-off-by: Jens Axboe io_uring/net.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) commit 8911eae9c8a947e5c1cc4fcce40473f1f5e475cd Author: Frank Li Date: Tue Oct 17 15:46:56 2023 -0400 i3c: master: svc: fix compatibility string mismatch with binding doc In the binding documentation, the compatible string is specified as 'silvaco,i3c-master-v1', but in the driver, it is defined as 'silvaco,i3c-master'. Rename 'silvaco,i3c-master' to 'silvaco,i3c-master-v1' to ensure compatibility with the documentation. Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20231017194657.3199749-1-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni drivers/i3c/master/svc-i3c-master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9aaeef113c55248ecf3ab941c2e4460aaa8b8b9a Author: Frank Li Date: Mon Oct 23 12:16:58 2023 -0400 i3c: master: svc: fix random hot join failure since timeout error master side report: silvaco-i3c-master 44330000.i3c-master: Error condition: MSTATUS 0x020090c7, MERRWARN 0x00100000 BIT 20: TIMEOUT error The module has stalled too long in a frame. This happens when: - The TX FIFO or RX FIFO is not handled and the bus is stuck in the middle of a message, - No STOP was issued and between messages, - IBI manual is used and no decision was made. The maximum stall period is 100 μs. This can be considered as being just a warning as the system IRQ latency can easily be greater than 100us. Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") Cc: Signed-off-by: Frank Li Reviewed-by: Miquel Raynal Link: https://lore.kernel.org/r/20231023161658.3890811-7-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni drivers/i3c/master/svc-i3c-master.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit dfd7cd6aafdb1f5ba93828e97e56b38304b23a05 Author: Frank Li Date: Mon Oct 23 12:16:57 2023 -0400 i3c: master: svc: fix SDA keep low when polling IBIWON timeout happen Upon IBIWON timeout, the SDA line will always be kept low if we don't emit a stop. Calling svc_i3c_master_emit_stop() there will let the bus return to idle state. Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") Cc: Reviewed-by: Miquel Raynal Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20231023161658.3890811-6-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni drivers/i3c/master/svc-i3c-master.c | 1 + 1 file changed, 1 insertion(+) commit 225d5ef048c4ed01a475c95d94833bd7dd61072d Author: Frank Li Date: Mon Oct 23 12:16:56 2023 -0400 i3c: master: svc: fix check wrong status register in irq handler svc_i3c_master_irq_handler() wrongly checks register SVC_I3C_MINTMASKED. It should be SVC_I3C_MSTATUS. Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") Cc: Reviewed-by: Miquel Raynal Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20231023161658.3890811-5-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni drivers/i3c/master/svc-i3c-master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c85e209b799f12d18a90ae6353b997b1bb1274a5 Author: Frank Li Date: Mon Oct 23 12:16:55 2023 -0400 i3c: master: svc: fix ibi may not return mandatory data byte MSTATUS[RXPEND] is only updated after the data transfer cycle started. This creates an issue when the I3C clock is slow, and the CPU is running fast enough that MSTATUS[RXPEND] may not be updated when the code reaches checking point. As a result, mandatory data can be missed. Add a wait for MSTATUS[COMPLETE] to ensure that all mandatory data is already in FIFO. It also works without mandatory data. Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") Cc: Reviewed-by: Miquel Raynal Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20231023161658.3890811-4-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni drivers/i3c/master/svc-i3c-master.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 5e5e3c92e748a6d859190e123b9193cf4911fcca Author: Frank Li Date: Mon Oct 23 12:16:54 2023 -0400 i3c: master: svc: fix wrong data return when IBI happen during start frame ┌─────┐ ┏──┐ ┏──┐ ┏──┐ ┏──┐ ┏──┐ ┏──┐ ┏──┐ ┏──┐ ┌───── SCL: ┘ └─────┛ └──┛ └──┛ └──┛ └──┛ └──┛ └──┛ └──┛ └──┘ ───┐ ┌─────┐ ┌─────┐ ┌───────────┐ SDA: └───────────────────────┘ └─────┘ └─────┘ └───── xxx╱ ╲╱ ╲╱ ╲╱ ╲╱ ╲ : xxx╲IBI ╱╲ Addr(0x0a) ╱╲ RW ╱╲NACK╱╲ S ╱ If an In-Band Interrupt (IBI) occurs and IBI work thread is not immediately scheduled, when svc_i3c_master_priv_xfers() initiates the I3C transfer and attempts to send address 0x7e, the target interprets it as an IBI handler and returns the target address 0x0a. However, svc_i3c_master_priv_xfers() does not handle this case and proceeds with other transfers, resulting in incorrect data being returned. Add IBIWON check in svc_i3c_master_xfer(). In case this situation occurs, return a failure to the driver. Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") Cc: Reviewed-by: Miquel Raynal Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20231023161658.3890811-3-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni drivers/i3c/master/svc-i3c-master.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) commit 6bf3fc268183816856c96b8794cd66146bc27b35 Author: Frank Li Date: Mon Oct 23 12:16:53 2023 -0400 i3c: master: svc: fix race condition in ibi work thread The ibi work thread operates asynchronously with other transfers, such as svc_i3c_master_priv_xfers(). Introduce mutex protection to ensure the completion of the entire i3c/i2c transaction. Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") Cc: Reviewed-by: Miquel Raynal Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20231023161658.3890811-2-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni drivers/i3c/master/svc-i3c-master.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit 7ab89417ed235f56d84c7893d38d4905e38d2692 Merge: 31e5f934ff96 fed3a1be6433 Author: Linus Torvalds Date: Fri Nov 3 08:17:38 2023 -1000 Merge tag 'perf-tools-for-v6.7-1-2023-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools updates from Namhyung Kim: "Build: - Compile BPF programs by default if clang (>= 12.0.1) is available to enable more features like kernel lock contention, off-cpu profiling, kwork, sample filtering and so on. This can be disabled by passing BUILD_BPF_SKEL=0 to make. - Produce better error messages for bison on debug build (make DEBUG=1) by defining YYDEBUG symbol internally. perf record: - Track sideband events (like FORK/MMAP) from all CPUs even if perf record targets a subset of CPUs only (using -C option). Otherwise it may lose some information happened on a CPU out of the target list. - Fix checking raw sched_switch tracepoint argument using system BTF. This affects off-cpu profiling which attaches a BPF program to the raw tracepoint. perf lock contention: - Add --lock-cgroup option to see contention by cgroups. This should be used with BPF only (using -b option). $ sudo perf lock con -ab --lock-cgroup -- sleep 1 contended total wait max wait avg wait cgroup 835 14.06 ms 41.19 us 16.83 us /system.slice/led.service 25 122.38 us 13.77 us 4.89 us / 44 23.73 us 3.87 us 539 ns /user.slice/user-657345.slice/session-c4.scope 1 491 ns 491 ns 491 ns /system.slice/connectd.service - Add -G/--cgroup-filter option to see contention only for given cgroups. This can be useful when you identified a cgroup in the above command and want to investigate more on it. It also works with other output options like -t/--threads and -l/--lock-addr. $ sudo perf lock con -ab -G /user.slice/user-657345.slice/session-c4.scope -- sleep 1 contended total wait max wait avg wait type caller 8 77.11 us 17.98 us 9.64 us spinlock futex_wake+0xc8 2 24.56 us 14.66 us 12.28 us spinlock tick_do_update_jiffies64+0x25 1 4.97 us 4.97 us 4.97 us spinlock futex_q_lock+0x2a - Use per-cpu array for better spinlock tracking. This is to improve performance of the BPF program and to avoid nested contention on a lock in the BPF hash map. - Update callstack check for PowerPC. To find a representative caller of a lock, it needs to look up the call stacks. It ends the lookup when it sees 0 in the call stack buffer. However, PowerPC call stacks can have 0 values in the beginning so skip them when it expects valid call stacks after. perf kwork: - Support 'sched' class (for -k option) so that it can see task scheduling event (using sched_switch tracepoint) as well as irq and workqueue items. - Add perf kwork top subcommand to show more accurate cpu utilization with sched class above. It works both with a recorded data (using perf kwork record command) and BPF (using -b option). Unlike perf top command, it does not support interactive mode (yet). $ sudo perf kwork top -b -k sched Starting trace, Hit to stop and report ^C Total : 160702.425 ms, 8 cpus %Cpu(s): 36.00% id, 0.00% hi, 0.00% si %Cpu0 [|||||||||||||||||| 61.66%] %Cpu1 [|||||||||||||||||| 61.27%] %Cpu2 [||||||||||||||||||| 66.40%] %Cpu3 [|||||||||||||||||| 61.28%] %Cpu4 [|||||||||||||||||| 61.82%] %Cpu5 [||||||||||||||||||||||| 77.41%] %Cpu6 [|||||||||||||||||| 61.73%] %Cpu7 [|||||||||||||||||| 63.25%] PID SPID %CPU RUNTIME COMMMAND ------------------------------------------------------------- 0 0 38.72 8089.463 ms [swapper/1] 0 0 38.71 8084.547 ms [swapper/3] 0 0 38.33 8007.532 ms [swapper/0] 0 0 38.26 7992.985 ms [swapper/6] 0 0 38.17 7971.865 ms [swapper/4] 0 0 36.74 7447.765 ms [swapper/7] 0 0 33.59 6486.942 ms [swapper/2] 0 0 22.58 3771.268 ms [swapper/5] 9545 9351 2.48 447.136 ms sched-messaging 9574 9351 2.09 418.583 ms sched-messaging 9724 9351 2.05 372.407 ms sched-messaging 9531 9351 2.01 368.804 ms sched-messaging 9512 9351 2.00 362.250 ms sched-messaging 9514 9351 1.95 357.767 ms sched-messaging 9538 9351 1.86 384.476 ms sched-messaging 9712 9351 1.84 386.490 ms sched-messaging 9723 9351 1.83 380.021 ms sched-messaging 9722 9351 1.82 382.738 ms sched-messaging 9517 9351 1.81 354.794 ms sched-messaging 9559 9351 1.79 344.305 ms sched-messaging 9725 9351 1.77 365.315 ms sched-messaging - Add hard/soft-irq statistics to perf kwork top. This will show the total CPU utilization with IRQ stats like below: $ sudo perf kwork top -b -k sched,irq,softirq Starting trace, Hit to stop and report ^C Total : 12554.889 ms, 8 cpus %Cpu(s): 96.23% id, 0.10% hi, 0.19% si <---- here %Cpu0 [| 4.60%] %Cpu1 [| 4.59%] %Cpu2 [ 2.73%] %Cpu3 [| 3.81%] perf bench: - Add -G/--cgroups option to perf bench sched pipe. The pipe bench is good to measure context switch overhead. With this option, it puts the reader and writer tasks in separate cgroups to enforce context switch between two different cgroups. Also it needs to set CPU affinity of the tasks in a CPU to accurately measure the impact of cgroup context switches. $ sudo perf stat -e context-switches,cgroup-switches -- \ > taskset -c 0 perf bench sched pipe -l 100000 # Running 'sched/pipe' benchmark: # Executed 100000 pipe operations between two processes Total time: 0.307 [sec] 3.078180 usecs/op 324867 ops/sec Performance counter stats for 'taskset -c 0 perf bench sched pipe -l 100000': 200,026 context-switches 63 cgroup-switches 0.321637922 seconds time elapsed You can see small number of cgroup-switches because both write and read tasks are in the same cgroup. $ sudo mkdir /sys/fs/cgroup/{AAA,BBB} $ sudo perf stat -e context-switches,cgroup-switches -- \ > taskset -c 0 perf bench sched pipe -l 100000 -G AAA,BBB # Running 'sched/pipe' benchmark: # Executed 100000 pipe operations between two processes Total time: 0.351 [sec] 3.512990 usecs/op 284657 ops/sec Performance counter stats for 'taskset -c 0 perf bench sched pipe -l 100000 -G AAA,BBB': 200,020 context-switches 200,019 cgroup-switches 0.365034567 seconds time elapsed Now context-switches and cgroup-switches are almost same. And you can see the pipe operation took little more. - Kill child processes when perf bench sched messaging exited abnormally. Otherwise it'd leave the child doing unnecessary work. perf test: - Fix various shellcheck issues on the tests written in shell script. - Skip tests when condition is not satisfied: - object code reading test for non-text section addresses. - CoreSight test if cs_etm// event is not available. - lock contention test if not enough CPUs. Event parsing: - Make PMU alias name loading lazy to reduce the startup time in the event parsing code for perf record, stat and others in the general case. - Lazily compute PMU default config. In the same sense, delay PMU initialization until it's really needed to reduce the startup cost. - Fix event term values that are raw events. The event specification can have several terms including event name. But sometimes it clashes with raw event encoding which starts with 'r' and has hex-digits. For example, an event named 'read' should be processed as a normal event but it was mis-treated as a raw encoding and caused a failure. $ perf stat -e 'uncore_imc_free_running/event=read/' -a sleep 1 event syntax error: '..nning/event=read/' \___ parser error Run 'perf list' for a list of valid events Usage: perf stat [] [] -e, --event event selector. use 'perf list' to list available events Event metrics: - Add "Compat" regex to match event with multiple identifiers. - Usual updates for Intel, Power10, Arm telemetry/CMN and AmpereOne. Misc: - Assorted memory leak fixes and footprint reduction. - Add "bpf_skeletons" to perf version --build-options so that users can check whether their perf tools have BPF support easily. - Fix unaligned access in Intel-PT packet decoder found by undefined-behavior sanitizer. - Avoid frequency mode for the dummy event. Surprisingly it'd impact kernel timer tick handler performance by force iterating all PMU events. - Update bash shell completion for events and metrics" * tag 'perf-tools-for-v6.7-1-2023-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (187 commits) perf vendor events intel: Update tsx_cycles_per_elision metrics perf vendor events intel: Update bonnell version number to v5 perf vendor events intel: Update westmereex events to v4 perf vendor events intel: Update meteorlake events to v1.06 perf vendor events intel: Update knightslanding events to v16 perf vendor events intel: Add typo fix for ivybridge FP perf vendor events intel: Update a spelling in haswell/haswellx perf vendor events intel: Update emeraldrapids to v1.01 perf vendor events intel: Update alderlake/alderlake events to v1.23 perf build: Disable BPF skeletons if clang version is < 12.0.1 perf callchain: Fix spelling mistake "statisitcs" -> "statistics" perf report: Fix spelling mistake "heirachy" -> "hierarchy" perf python: Fix binding linkage due to rename and move of evsel__increase_rlimit() perf tests: test_arm_coresight: Simplify source iteration perf vendor events intel: Add tigerlake two metrics perf vendor events intel: Add broadwellde two metrics perf vendor events intel: Fix broadwellde tma_info_system_dram_bw_use metric perf mem_info: Add and use map_symbol__exit and addr_map_symbol__exit perf callchain: Minor layout changes to callchain_list perf callchain: Make brtype_stat in callchain_list optional ... commit 31e5f934ff962820995c82a6953176a1c7d18ff5 Merge: fd912e49986a 70a9affa930c Author: Linus Torvalds Date: Fri Nov 3 07:41:18 2023 -1000 Merge tag 'trace-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: - Remove eventfs_file descriptor This is the biggest change, and the second part of making eventfs create its files dynamically. In 6.6 the first part was added, and that maintained a one to one mapping between eventfs meta descriptors and the directories and file inodes and dentries that were dynamically created. The directories were represented by a eventfs_inode and the files were represented by a eventfs_file. In v6.7 the eventfs_file is removed. As all events have the same directory make up (sched_switch has an "enable", "id", "format", etc files), the handing of what files are underneath each leaf eventfs directory is moved back to the tracing subsystem via a callback. When an event is added to the eventfs, it registers an array of evenfs_entry's. These hold the names of the files and the callbacks to call when the file is referenced. The callback gets the name so that the same callback may be used by multiple files. The callback then supplies the filesystem_operations structure needed to create this file. This has brought the memory footprint of creating multiple eventfs instances down by 2 megs each! - User events now has persistent events that are not associated to a single processes. These are privileged events that hang around even if no process is attached to them - Clean up of seq_buf There's talk about using seq_buf more to replace strscpy() and friends. But this also requires some minor modifications of seq_buf to be able to do this - Expand instance ring buffers individually Currently if boot up creates an instance, and a trace event is enabled on that instance, the ring buffer for that instance and the top level ring buffer are expanded (1.4 MB per CPU). This wastes memory as this happens when nothing is using the top level instance - Other minor clean ups and fixes * tag 'trace-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (34 commits) seq_buf: Export seq_buf_puts() seq_buf: Export seq_buf_putc() eventfs: Use simple_recursive_removal() to clean up dentries eventfs: Remove special processing of dput() of events directory eventfs: Delete eventfs_inode when the last dentry is freed eventfs: Hold eventfs_mutex when calling callback functions eventfs: Save ownership and mode eventfs: Test for ei->is_freed when accessing ei->dentry eventfs: Have a free_ei() that just frees the eventfs_inode eventfs: Remove "is_freed" union with rcu head eventfs: Fix kerneldoc of eventfs_remove_rec() tracing: Have the user copy of synthetic event address use correct context eventfs: Remove extra dget() in eventfs_create_events_dir() tracing: Have trace_event_file have ref counters seq_buf: Introduce DECLARE_SEQ_BUF and seq_buf_str() eventfs: Fix typo in eventfs_inode union comment eventfs: Fix WARN_ON() in create_file_dentry() powerpc: Remove initialisation of readpos tracing/histograms: Simplify last_cmd_set() seq_buf: fix a misleading comment ... commit fd912e49986aa7ec5bef1bc9cd92d7d68a57e383 Merge: 2a80532c0745 696444a544ec Author: Linus Torvalds Date: Fri Nov 3 07:29:54 2023 -1000 Merge tag 'trace-tools-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing tools updates from Steven Rostedt: "RTLA: - In rtla/utils.c, initialize the 'found' variable to avoid garbage when a mount point is not found. Verification: - Remove duplicated imports on dot2k python script" * tag 'trace-tools-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rtla: Fix uninitialized variable found verification/dot2k: Delete duplicate imports commit 2a80532c0745e140852e6b579bbe8371332bb45d Merge: 00657bb3dbec 2966bd369845 Author: Linus Torvalds Date: Fri Nov 3 07:24:22 2023 -1000 Merge tag 'printk-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk updates from Petr Mladek: - Another preparation step for introducing printk kthreads. The main piece is a per-console lock with several features: - Support three priorities: normal, emergency, and panic. They will be defined by a context where the lock is taken. A context with a higher priority is allowed to take over the lock from a context with a lower one. The plan is to use the emergency context for Oops and WARN() messages, and also by watchdogs. The panic() context will be used on panic CPU. - The owner might enter/exit regions where it is not safe to take over the lock. It allows the take over the lock a safe way in the middle of a message. For example, serial drivers emit characters one by one. And the serial port is in a safe state in between. Only the final console_flush_in_panic() will be allowed to take over the lock even in the unsafe state (last chance, pray, and hope). - A higher priority context might busy wait with a timeout. The current owner is informed about the waiter and releases the lock on exit from the unsafe state. - The new lock is safe even in atomic contexts, including NMI. Another change is a safe manipulation of per-console sequence number counter under the new lock. - simple_strntoull() micro-optimization - Reduce pr_flush() pooling time. - Calm down false warning about possible buffer invalid access to console buffers when CONFIG_PRINTK is disabled. [ .. and Thomas Gleixner wants to point out that while several of the commits are attributed to him, he only authored the early versions of said commits, and that John Ogness and Petr Mladek have been the ones who sorted out the details and really should be those who get the credit - Linus ] * tag 'printk-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: vsprintf: uninline simple_strntoull(), reorder arguments printk: printk: Remove unnecessary statements＇len = 0;＇ printk: Reduce pr_flush() pooling time printk: fix illegal pbufs access for !CONFIG_PRINTK printk: nbcon: Allow drivers to mark unsafe regions and check state printk: nbcon: Add emit function and callback function for atomic printing printk: nbcon: Add sequence handling printk: nbcon: Add ownership state functions printk: nbcon: Add buffer management printk: Make static printk buffers available to nbcon printk: nbcon: Add acquire/release logic printk: Add non-BKL (nbcon) console basic infrastructure commit 00657bb3dbecee324336e1da1ad71b670b6aee60 Merge: 9a719c2145c9 67e18e132f0f Author: Linus Torvalds Date: Fri Nov 3 07:21:54 2023 -1000 Merge tag 'livepatching-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching Pull livepatching update from Petr Mladek: - Add missing newline character to avoid waiting for a continuous message * tag 'livepatching-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching: livepatch: Fix missing newline character in klp_resolve_symbols() commit 9a719c2145c9942d1215c05a954dd4bf6c9587e7 Merge: 8f6f76a6a29f bdcb37a5d8de Author: Linus Torvalds Date: Fri Nov 3 07:08:36 2023 -1000 Merge tag 'bitmap-for-6.7' of https://github.com/norov/linux Pull bitmap updates from Yury Norov: "This includes the 'bitmap: cleanup bitmap_*_region() implementation' series, and scattered cleanup patches" * tag 'bitmap-for-6.7' of https://github.com/norov/linux: buildid: reduce header file dependencies for module bitmap: move bitmap_*_region() functions to bitmap.h bitmap: drop _reg_op() function bitmap: replace _reg_op(REG_OP_ISFREE) with find_next_bit() bitmap: replace _reg_op(REG_OP_RELEASE) with bitmap_clear() bitmap: replace _reg_op(REG_OP_ALLOC) with bitmap_set() bitmap: fix opencoded bitmap_allocate_region() bitmap: add test for bitmap_*_region() functions bitmap: align __reg_op() wrappers with modern coding style lib/bitmap: split-out string-related operations to a separate files bitmap: Remove dead code, i.e. bitmap_copy_le() bitmap: Fix a typo ("identify map") cpumask: kernel-doc cleanups and additions commit 6d5e0032a92df3a030cd47d91905310591466687 Author: Ilya Bakoulin Date: Thu Oct 12 16:42:11 2023 -0400 drm/amd/display: Enable fast update on blendTF change [Why] Full update is not required on surface blend TF change. [How] Update full_update_required condition. Reviewed-by: Aric Cyr Acked-by: Hersen Wu Signed-off-by: Ilya Bakoulin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc.c | 1 - 1 file changed, 1 deletion(-) commit 5d853ad5a866dd52ff519afd073f4156cca3cf7f Author: Ilya Bakoulin Date: Thu Oct 12 12:21:34 2023 -0400 drm/amd/display: Fix blend LUT programming [Why] LUT write index does not get reset to zero when writing the LUT values for each separate RGB component, which results in wrong data for 2 of the 3 components. [How] Reset LUT write index to zero before writing each component's data. Reviewed-by: Krunoslav Kovac Acked-by: Hersen Wu Signed-off-by: Ilya Bakoulin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c | 3 +++ drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c | 3 +++ 2 files changed, 6 insertions(+) commit 995dedb7a4fa9703d1ae584914b0aa12b5da454c Author: Sung Joon Kim Date: Wed Oct 11 15:48:51 2023 -0400 drm/amd/display: Program plane color setting correctly [why] There are some registers for plane color that are skipped programming on resume. Need to add those as part of the sequence. [how] Add new function hook for programming plane color control. Reviewed-by: Duncan Ma Acked-by: Hersen Wu Signed-off-by: Sung Joon Kim Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c | 2 +- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.h | 5 + drivers/gpu/drm/amd/display/dc/dcn35/dcn35_hubp.c | 137 +++++++++++++++++++++- drivers/gpu/drm/amd/display/dc/dcn35/dcn35_hubp.h | 14 +++ 4 files changed, 156 insertions(+), 2 deletions(-) commit 23618280cca543183d29ae4f286e3319066774d2 Author: Hawking Zhang Date: Thu Oct 19 14:47:53 2023 +0800 drm/amdgpu: Query and report boot status Query boot status and report boot errors. A follow up change is needed to stop GPU initialization if boot fails. v2: only invoke the call for dGPU (Le/Lijo) Signed-off-by: Hawking Zhang Reviewed-by: Tao Zhou Reviewed-by: Yang Wang Reviewed-by: Le Ma Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 ++ 1 file changed, 2 insertions(+) commit df57e019d5c341305e82e6f041f3b373ad7c6529 Author: Hawking Zhang Date: Fri Nov 3 13:28:04 2023 +0800 drm/amdgpu: Add psp v13 function to query boot status Add psp v13 function to query boot status. v2: limit the use case to dGPU only (Lijo) Signed-off-by: Hawking Zhang Reviewed-by: Tao Zhou Reviewed-by: Yang Wang Reviewed-by: Le Ma Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 15 +++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h | 3 ++ drivers/gpu/drm/amd/amdgpu/psp_v13_0.c | 78 +++++++++++++++++++++++++++++++++ 3 files changed, 96 insertions(+) commit 908cebc9a48062167620d0113f3f0285daec2455 Author: Li Ma Date: Mon Oct 30 18:30:48 2023 +0800 drm/amd/swsmu: remove fw version check in sw_init. dorp fw version check and using max table size to init table. Signed-off-by: Li Ma Reviewed-by: Yifan Zhang Reviewed-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) commit 34ec3cedcaf94c0a75e0df1314d82d66c783612e Author: Li Ma Date: Mon Oct 30 18:27:27 2023 +0800 drm/amd/swsmu: update smu v14_0_0 driver if and metrics table Update driver if headers and metrics table in smu v14_0_0 after smu fw promotion. Drop the legacy metrics table and add warning of checking pmfw version. Signed-off-by: Li Ma Reviewed-by: Yifan Zhang Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/include/kgd_pp_interface.h | 30 +-- .../pm/swsmu/inc/pmfw_if/smu14_driver_if_v14_0_0.h | 120 +++------- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 2 + .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c | 260 ++++----------------- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 3 + 5 files changed, 97 insertions(+), 318 deletions(-) commit 38a64e3a33bb542a9929cb4d2109789bce0c6e46 Author: Hawking Zhang Date: Fri Oct 27 11:53:46 2023 +0800 drm/amdgpu: Add C2PMSG_109/126 reg field shift/masks Add MP0_C2PMSG_109/126 register field shift/masks that are used to identify boot status by driver. Signed-off-by: Hawking Zhang Reviewed-by: Tao Zhou Reviewed-by: Yang Wang Reviewed-by: Le Ma Signed-off-by: Alex Deucher .../amd/include/asic_reg/mp/mp_13_0_2_sh_mask.h | 28 ++++++++++++++++++++++ 1 file changed, 28 insertions(+) commit dbab63561b3cf6acfa3f089319dcc0e78ad31586 Author: Ma Jun Date: Tue Oct 31 19:10:47 2023 +0800 drm/amdgpu: Optimize the asic type fix code Use a new struct array to define the asic information which asic type needs to be fixed. Signed-off-by: Ma Jun Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 35 ++++++++++++++++++++++++--------- include/drm/amd_asic_type.h | 5 +++++ 2 files changed, 31 insertions(+), 9 deletions(-) commit 36e7ff5c13cb15cb7b06c76d42bb76cbf6b7ea75 Author: Tim Huang Date: Wed Nov 1 14:22:04 2023 +0800 drm/amdgpu: fix GRBM read timeout when do mes_self_test Use a proper MEID to make sure the CP_HQD_* and CP_GFX_HQD_* registers can be touched when initialize the compute and gfx mqd in mes_self_test. Otherwise, we expect no response from CP and an GRBM eventual timeout. Signed-off-by: Tim Huang Acked-by: Alex Deucher Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 18eae367cb74d05b5e37ce77ef4025b735df012e Author: Tao Zhou Date: Mon Oct 30 20:44:37 2023 +0800 drm/amdgpu: check recovery status of xgmi hive in ras_reset_error_count Handle xgmi hive case. Suggested-by: Hawking Zhang Signed-off-by: Tao Zhou Reviewed-by: Stanley.Yang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit 88e5c8f8745b389b8e088a743a70840ead1dad37 Author: Ma Jun Date: Thu Oct 26 09:58:15 2023 +0800 drm/amd/pm: only check sriov vf flag once when creating hwmon sysfs The current code checks sriov vf flag multiple times when creating hwmon sysfs. So fix it. Signed-off-by: Ma Jun Reviewed-by: Yang Wang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/amdgpu_pm.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) commit 0e2e7c5b3d712f4589b3bf0eb2988337966648b6 Author: Felix Kuehling Date: Wed Mar 16 18:03:59 2022 -0400 drm/amdgpu: Attach eviction fence on alloc Instead of attaching the eviction fence when a KFD BO is first mapped, attach it when it is allocated or imported. This in preparation to allow KFD BOs to be mapped using the render node API. Signed-off-by: Felix Kuehling Acked-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 79 ++++++++++++++---------- 1 file changed, 48 insertions(+), 31 deletions(-) commit 5a104cb97c4e2bc8918b026a770188313b1d5fb3 Author: Felix Kuehling Date: Wed Mar 16 17:21:40 2022 -0400 drm/amdkfd: Improve amdgpu_vm_handle_moved Let amdgpu_vm_handle_moved update all BO VA mappings of BOs reserved by the caller. This will be useful for handling extra BO VA mappings in KFD VMs that are managed through the render node API. v2: rebase against drm_exec changes (Alex) Signed-off-by: Felix Kuehling Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 7 ++++++- drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 19 ++++++++++++++----- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 3 ++- 4 files changed, 23 insertions(+), 8 deletions(-) commit 6740ec97bcdbe96ac7df147f986c030eddfebe65 Author: Nathan Chancellor Date: Thu Nov 2 10:40:52 2023 -0700 drm/amd/display: Increase frame warning limit with KASAN or KCSAN in dml2 When building ARCH=x86_64 allmodconfig with clang, which will typically have sanitizers enabled, there is a warning about a large stack frame. drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/display_mode_core.c:6265:13: error: stack frame size (2520) exceeds limit (2048) in 'dml_prefetch_check' [-Werror,-Wframe-larger-than] 6265 | static void dml_prefetch_check(struct display_mode_lib_st *mode_lib) | ^ 1 error generated. Notably, GCC 13.2.0 does not do too much of a better job, as it is right at the current limit of 2048 (and others have reported being over with older GCC versions): drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/display_mode_core.c: In function 'dml_prefetch_check': drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/display_mode_core.c:6705:1: error: the frame size of 2048 bytes is larger than 1800 bytes [-Werror=frame-larger-than=] 6705 | } | ^ In the past, these warnings have been avoided by reducing the number of parameters to various functions so that not as many arguments need to be passed on the stack. However, these patches take a good amount of effort to write despite being mechanical due to code structure and complexity and they are never carried forward to new generations of the code so that effort has to be expended every new hardware generation, which becomes harder to justify as time goes on. To avoid having a noticeable or lengthy breakage in all{mod,yes}config, which are easy testing targets that have -Werror enabled, increase the limit for configurations that have KASAN or KCSAN enabled by 50% so that cases of extremely poor code generation can still be caught while not breaking the majority of builds. CONFIG_KMSAN also causes high stack usage but the frame limit is already set to zero when it is enabled, which is accounted for by the check for CONFIG_FRAME_WARN=0 in the dml2 Makefile. Signed-off-by: Nathan Chancellor Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dml2/Makefile | 4 ++++ 1 file changed, 4 insertions(+) commit b1904ed480cee3f9f4036ea0e36d139cb5fee2d6 Author: Wayne Lin Date: Fri Sep 8 10:14:49 2023 +0800 drm/amd/display: Avoid NULL dereference of timing generator [Why & How] Check whether assigned timing generator is NULL or not before accessing its funcs to prevent NULL dereference. Reviewed-by: Jun Lei Acked-by: Hersen Wu Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit be457b2252b6b49d74c4217224263c8d1e2a894d Author: Mukul Joshi Date: Fri Oct 27 11:33:32 2023 -0400 drm/amdkfd: Update cache info for GFX 9.4.3 Update cache info reporting based on compute and memory partitioning modes. Signed-off-by: Mukul Joshi Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) commit 0ce8edae8be74eb883b8721ac6acd2f501b34a9f Author: Mukul Joshi Date: Fri Oct 27 11:30:25 2023 -0400 drm/amdkfd: Populate cache info for GFX 9.4.3 GFX 9.4.3 uses a new version of the GC info table which contains the cache info. This patch adds a new function to populate the cache info from IP discovery for GFX 9.4.3. Signed-off-by: Mukul Joshi Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 66 ++++++++++++++++++++++++++++++++++- 1 file changed, 65 insertions(+), 1 deletion(-) commit ba0fb4b48c19a2d2380fc16ca4af236a0871d279 Author: Alex Deucher Date: Thu Oct 26 14:37:31 2023 -0400 drm/amdgpu: don't put MQDs in VRAM on ARM | ARM64 Issues were reported with commit 1cfb4d612127 ("drm/amdgpu: put MQDs in VRAM") on an ADLINK Ampere Altra Developer Platform (AVA developer platform). Various ARM systems seem to have problems related to PCIe and MMIO access. In this case, I'm not sure if this is specific to the ADLINK platform or ARM in general. Seems to be some coherency issue with VRAM. For now, just don't put MQDs in VRAM on ARM. Link: https://lists.freedesktop.org/archives/amd-gfx/2023-October/100453.html Fixes: 1cfb4d612127 ("drm/amdgpu: put MQDs in VRAM") Acked-by: Christian König Signed-off-by: Alex Deucher Cc: alexey.klimov@linaro.org drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 2 ++ 1 file changed, 2 insertions(+) commit 23170863ea0a0965d224342c0eb2ad8303b1f267 Author: Alex Deucher Date: Wed Nov 1 15:48:14 2023 -0400 drm/amdgpu/smu13: drop compute workload workaround This was fixed in PMFW before launch and is no longer required. Reviewed-by: Yang Wang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 32 ++-------------------- 1 file changed, 2 insertions(+), 30 deletions(-) commit 3938eb956e383ef88b8fc7d556492336ebee52df Author: Alex Deucher Date: Thu Oct 19 13:56:56 2023 -0400 drm/amdgpu: add a retry for IP discovery init AMD dGPUs have integrated FW that runs as soon as the device gets power and initializes the board (determines the amount of memory, provides configuration details to the driver, etc.). For direct PCIe attached cards this happens as soon as power is applied and normally completes well before the OS has even started loading. However, with hotpluggable ports like USB4, the driver needs to wait for this to complete before initializing the device. This normally takes 60-100ms, but could take longer on some older boards periodically due to memory training. Retry for up to a second. In the non-hotplug case, there should be no change in behavior and this should complete on the first try. v2: adjust test criteria v3: adjust checks for the masks, only enable on removable devices v4: skip bif_fb_en check Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2925 Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) commit 886b92f63573eab4ba30b06c4514b8f4af114e6a Author: Perry Yuan Date: Thu Jul 27 01:45:30 2023 -0400 drm/amdgpu: ungate power gating when system suspend [Why] During suspend, if GFX DPM is enabled and GFXOFF feature is enabled the system may get hung. So, it is suggested to disable GFXOFF feature during suspend and enable it after resume. [How] Update the code to disable GFXOFF feature during suspend and enable it after resume. [ 311.396526] amdgpu 0000:03:00.0: amdgpu: SMU: I'm not done with your previous command: SMN_C2PMSG_66:0x0000001E SMN_C2PMSG_82:0x00000000 [ 311.396530] amdgpu 0000:03:00.0: amdgpu: Fail to disable dpm features! [ 311.396531] [drm:amdgpu_device_ip_suspend_phase2 [amdgpu]] *ERROR* suspend of IP block failed -62 Acked-by: Yang Wang Reviewed-by: Kenneth Feng Signed-off-by: Perry Yuan Signed-off-by: Kun Liu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 3a50f41bc20a26dfa8cd18ef3ae924feec25c95e Author: José Pekkarinen Date: Tue Oct 31 19:08:47 2023 +0200 drm/radeon: replace 1-element arrays with flexible-array members Reported by coccinelle, the following patch will move the following 1 element arrays to flexible arrays. drivers/gpu/drm/radeon/atombios.h:5523:32-48: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:5545:32-48: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:5461:34-44: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:4447:30-40: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:4236:30-41: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:7095:28-45: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:3896:27-37: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:5443:16-25: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:5454:34-43: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:4603:21-32: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:4628:32-46: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:6285:29-39: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:4296:30-36: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:4756:28-36: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:4064:22-35: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:7327:9-24: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:7332:32-53: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:7362:26-41: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:7369:29-44: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:7349:24-32: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) drivers/gpu/drm/radeon/atombios.h:7355:27-35: WARNING use flexible-array member instead (https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays) Signed-off-by: José Pekkarinen Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/atombios.h | 42 +++++++++++++++++++-------------------- 1 file changed, 21 insertions(+), 21 deletions(-) commit 49afe91370b86566857a3c2c39612cf098110885 Author: Alex Deucher Date: Fri Oct 27 16:40:47 2023 -0400 drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers For pptable structs that use flexible array sizes, use flexible arrays. Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039926 Reviewed-by: Mario Limonciello Acked-by: Christian König Signed-off-by: Alex Deucher .../gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 4 ++-- .../drm/amd/pm/powerplay/hwmgr/vega10_pptable.h | 24 +++++++++++----------- 2 files changed, 14 insertions(+), 14 deletions(-) commit 7b1c6263eaf4fd64ffe1cafdc504a42ee4bfbb33 Author: Alex Deucher Date: Tue Oct 17 16:30:00 2023 -0400 drm/amdgpu: don't use pci_is_thunderbolt_attached() It's only valid on Intel systems with the Intel VSEC. Use dev_is_removable() instead. This should do the right thing regardless of the platform. Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2925 Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++---- drivers/gpu/drm/amd/amdgpu/nbio_v2_3.c | 5 +++-- 2 files changed, 7 insertions(+), 6 deletions(-) commit 432e664e7c98c243fab4c3c95bd463bea3aeed28 Author: Alex Deucher Date: Tue Oct 17 15:40:01 2023 -0400 drm/amdgpu: don't use ATRM for external devices The ATRM ACPI method is for fetching the dGPU vbios rom image on laptops and all-in-one systems. It should not be used for external add in cards. If the dGPU is thunderbolt connected, don't try ATRM. v2: pci_is_thunderbolt_attached only works for Intel. Use pdev->external_facing instead. v3: dev_is_removable() seems to be what we want Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2925 Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 5 +++++ 1 file changed, 5 insertions(+) commit cd63ffbd23edc176f09cac5c9287db732d7cbb73 Author: Filipe Manana Date: Mon Oct 30 11:54:23 2023 +0000 btrfs: fix error pointer dereference after failure to allocate fs devices At device_list_add() we allocate a btrfs_fs_devices structure and then before checking if the allocation failed (pointer is ERR_PTR(-ENOMEM)), we dereference the error pointer in a memcpy() argument if the feature BTRFS_FEATURE_INCOMPAT_METADATA_UUID is enabled. Fix this by checking for an allocation error before trying the memcpy(). Fixes: f7361d8c3fc3 ("btrfs: sipmlify uuid parameters of alloc_fs_devices()") Reviewed-by: Qu Wenruo Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/volumes.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 47e2b06b7b5cb356a987ba3429550c3a89ea89d6 Author: Qu Wenruo Date: Sat Oct 28 13:28:45 2023 +1030 btrfs: make found_logical_ret parameter mandatory for function queue_scrub_stripe() [BUG] There is a compilation warning reported on commit ae76d8e3e135 ("btrfs: scrub: fix grouping of read IO"), where gcc (14.0.0 20231022 experimental) is reporting the following uninitialized variable: fs/btrfs/scrub.c: In function ‘scrub_simple_mirror.isra’: fs/btrfs/scrub.c:2075:29: error: ‘found_logical’ may be used uninitialized [-Werror=maybe-uninitialized[https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wmaybe-uninitialized]] 2075 | cur_logical = found_logical + BTRFS_STRIPE_LEN; fs/btrfs/scrub.c:2040:21: note: ‘found_logical’ was declared here 2040 | u64 found_logical; | ^~~~~~~~~~~~~ [CAUSE] This is a false alert, as @found_logical is passed as parameter @found_logical_ret of function queue_scrub_stripe(). As long as queue_scrub_stripe() returned 0, we would update @found_logical_ret. And if queue_scrub_stripe() returned >0 or <0, the caller would not utilized @found_logical, thus there should be nothing wrong. Although the triggering gcc is still experimental, it looks like the extra check on "if (found_logical_ret)" can sometimes confuse the compiler. Meanwhile the only caller of queue_scrub_stripe() is always passing a valid pointer, there is no need for such check at all. [FIX] Although the report itself is a false alert, we can still make it more explicit by: - Replace the check for @found_logical_ret with ASSERT() - Initialize @found_logical to U64_MAX - Add one extra ASSERT() to make sure @found_logical got updated Link: https://lore.kernel.org/linux-btrfs/87fs1x1p93.fsf@gentoo.org/ Fixes: ae76d8e3e135 ("btrfs: scrub: fix grouping of read IO") Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/scrub.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit d8ba2a91fc3cd0347823435971f58f473cbba7aa Author: Josef Bacik Date: Fri Oct 13 15:18:17 2023 -0400 btrfs: get correct owning_root when dropping snapshot Dave reported a bug where we were aborting the transaction while trying to cleanup the squota reservation for an extent. This turned out to be because we're doing btrfs_header_owner(next) in do_walk_down when we decide to free the block. However in this code block we haven't explicitly read next, so it could be stale. We would then get whatever garbage happened to be in the pages at this point. The commit that introduced that is "btrfs: track owning root in btrfs_ref". Fix this by saving the owner_root when we do the btrfs_lookup_extent_info(). We always do this in do_walk_down, it is how we make the decision of whether or not to delete the block. This is cheap because we've already done the extent item lookup at this point, so it's straightforward to just grab the owner root as well. Then we can use this when deleting the metadata block without needing to force a read of the extent buffer to find the owner. This fixes the problem that Dave reported. Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Signed-off-by: David Sterba fs/btrfs/ctree.c | 2 +- fs/btrfs/extent-tree.c | 25 +++++++++++++++++-------- fs/btrfs/extent-tree.h | 3 ++- 3 files changed, 20 insertions(+), 10 deletions(-) commit 776a838f1fa95670c1c1cf7109a898090b473fa3 Author: Naohiro Aota Date: Tue Oct 17 17:00:31 2023 +0900 btrfs: zoned: wait for data BG to be finished on direct IO allocation Running the fio command below on a ZNS device results in "Resource temporarily unavailable" error. $ sudo fio --name=w --directory=/mnt --filesize=1GB --bs=16MB --numjobs=16 \ --rw=write --ioengine=libaio --iodepth=128 --direct=1 fio: io_u error on file /mnt/w.2.0: Resource temporarily unavailable: write offset=117440512, buflen=16777216 fio: io_u error on file /mnt/w.2.0: Resource temporarily unavailable: write offset=134217728, buflen=16777216 ... This happens because -EAGAIN error returned from btrfs_reserve_extent() called from btrfs_new_extent_direct() is spilling over to the userland. btrfs_reserve_extent() returns -EAGAIN when there is no active zone available. Then, the caller should wait for some other on-going IO to finish a zone and retry the allocation. This logic is already implemented for buffered write in cow_file_range(), but it is missing for the direct IO counterpart. Implement the same logic for it. Reported-by: Shinichiro Kawasaki Fixes: 2ce543f47843 ("btrfs: zoned: wait until zone is finished when allocation didn't progress") CC: stable@vger.kernel.org # 6.1+ Tested-by: Shinichiro Kawasaki Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba fs/btrfs/inode.c | 7 +++++++ 1 file changed, 7 insertions(+) commit dfcb03ae8a341600d72fbf3c79429f306764d653 Author: Naohiro Aota Date: Tue Oct 17 16:23:22 2023 +0900 btrfs: zoned: drop no longer valid write pointer check There is a check of the write pointer vs the zone size to reject an invalid write pointer. However, as of now, we have RAID0/RAID10 on the zoned mode, we can have a block group whose size is larger than the zone size. As an equivalent check against the block group's zone_capacity is already there, we can just drop this invalid check. Fixes: 568220fa9657 ("btrfs: zoned: support RAID0/1/10 on top of raid stripe tree") Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba fs/btrfs/zoned.c | 7 ------- 1 file changed, 7 deletions(-) commit b8212814d1e8428a082234223105e4071b844fab Author: Dan Carpenter Date: Thu Oct 12 12:42:55 2023 +0300 btrfs: directly return 0 on no error code in btrfs_insert_raid_extent() It's more obvious to return a literal zero instead of "return ret;". Plus Smatch complains that ret could be uninitialized if the ordered_extent->bioc_list list is empty and this silences that warning. Signed-off-by: Dan Carpenter Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/raid-stripe-tree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit dec96fc2dcb59723e041416b8dc53e011b4bfc2e Author: Filipe Manana Date: Fri Oct 13 10:05:48 2023 +0100 btrfs: use u64 for buffer sizes in the tree search ioctls In the tree search v2 ioctl we use the type size_t, which is an unsigned long, to track the buffer size in the local variable 'buf_size'. An unsigned long is 32 bits wide on a 32 bits architecture. The buffer size defined in struct btrfs_ioctl_search_args_v2 is a u64, so when we later try to copy the local variable 'buf_size' to the argument struct, when the search returns -EOVERFLOW, we copy only 32 bits which will be a problem on big endian systems. Fix this by using a u64 type for the buffer sizes, not only at btrfs_ioctl_tree_search_v2(), but also everywhere down the call chain so that we can use the u64 at btrfs_ioctl_tree_search_v2(). Fixes: cc68a8a5a433 ("btrfs: new ioctl TREE_SEARCH_V2") Reported-by: Dan Carpenter Link: https://lore.kernel.org/linux-btrfs/ce6f4bd6-9453-4ffe-ba00-cee35495e10f@moroto.mountain/ Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ioctl.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit b3c942bb6c32a8ddc1d52ee6bc24b8cf732dddf4 Author: Alex Deucher Date: Thu Oct 26 14:47:57 2023 -0400 drm/amdgpu/gfx10,11: use memcpy_to/fromio for MQDs Since they were moved to VRAM, we need to use the IO variants of memcpy. Fixes: 1cfb4d612127 ("drm/amdgpu: put MQDs in VRAM") Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 12 ++++++------ drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 12 ++++++------ 2 files changed, 12 insertions(+), 12 deletions(-) commit f7aeee73461560bf70ef48b238dd6a48068debff Author: Tao Zhou Date: Fri Oct 27 11:38:18 2023 +0800 drm/amdgpu: use mode-2 reset for RAS poison consumption Switch from mode-1 reset to mode-2 for poison consumption. Signed-off-by: Tao Zhou Reviewed-by: Stanley.Yang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit b77cc85bdbad83dfea533c5ea881665aa0673d65 Author: Lin.Cao Date: Mon Oct 30 17:55:08 2023 +0800 drm/amdgpu doorbell range should be set when gpu recovery GFX doorbell range should be set after flr otherwise the gfx doorbell range will be overlap with MEC. v2: remove "amdgpu_sriov_vf" and "amdgpu_in_reset" check, and add grbm select for the case of 2 gfx rings. Signed-off-by: Lin.Cao Acked-by: ZhenGuo Yin Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 42ef313754f2c89f2584dfb6c052e745ad3a3ca1 Author: Ma Jun Date: Thu Oct 26 18:16:06 2023 +0800 drm/amd/pm: Return 0 as default min power limit for legacy asics Return 0 as the default min power limit for the asics use powerplay. Signed-off-by: Ma Jun Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 3 +++ 1 file changed, 3 insertions(+) commit 0df96fb71a395b4fc9c80180306420c743f395a8 Author: Jens Axboe Date: Fri Nov 3 09:26:13 2023 -0600 io_uring/rw: don't attempt to allocate async data if opcode doesn't need it The new read multishot method doesn't need to allocate async data ever, as it doesn't do vectored IO and it must only be used with provided buffers. While it doesn't have ->prep_async() set, it also sets ->async_size to 0, which is different from any other read/write type we otherwise support. If it's used on a file type that isn't pollable, we do try and allocate this async data, and then try and use that data. But since we passed in a size of 0 for the data, we get a NULL back on data allocation. We then proceed to dereference that to copy state, and that obviously won't end well. Add a check in io_setup_async_rw() for this condition, and avoid copying state. Also add a check for whether or not buffer selection is specified in prep while at it. Fixes: fc68fcda0491 ("io_uring/rw: add support for IORING_OP_READ_MULTISHOT") Link: https://bugzilla.kernel.org/show_bug.cgi?id=218101 Signed-off-by: Jens Axboe io_uring/rw.c | 7 +++++++ 1 file changed, 7 insertions(+) commit d1f6be54eafe177bdea6d42b4ef3b45bb00660b3 Merge: ad1871ad8d9b 5b5b5806f223 Author: Rafael J. Wysocki Date: Fri Nov 3 15:31:57 2023 +0100 Merge tag 'cpufreq-arm-updates-6.7-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Merge ARM cpufreq updates for 6.7 (part 2) from Viresh kumar: "- Add support for several Qualcomm SoC versions (Robert Marko and Varadarajan Narayanan)." * tag 'cpufreq-arm-updates-6.7-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: cpufreq: qcom-nvmem: Introduce cpufreq for ipq95xx cpufreq: qcom-nvmem: Enable cpufreq for ipq53xx cpufreq: qcom-nvmem: add support for IPQ8074 soc: qcom: socinfo: Add IDs for IPQ8174 family dt-bindings: arm: qcom,ids: Add IDs for IPQ8174 family dt-bindings: qcom: geni-se: Allow dma-coherent soc: qcom: socinfo: Add SoC ID for QCM6490 dt-bindings: arm: qcom,ids: Add SoC ID for QCM6490 soc: qcom: socinfo: Add SM8550-adjacent PMICs soc: qcom: wcnss_ctrl: Remove redundant initialization owner in wcnss_ctrl_driver soc: qcom: socinfo: Add Soc ID for SM7150P dt-bindings: arm: qcom,ids: Add Soc ID for SM7150P firmware: Add support for Qualcomm UEFI Secure Application firmware: qcom_scm: Add support for Qualcomm Secure Execution Environment SCM interface lib/ucs2_string: Add UCS-2 strscpy function commit a563c99f222f2b8e5d53cfae8eb84a345209530b Merge: ad1871ad8d9b 6feb1a964119 Author: Rafael J. Wysocki Date: Fri Nov 3 15:30:10 2023 +0100 Merge tag 'linux-cpupower-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux Merge cpupower utility update for 6.7-rc1 from Shuah Khan: "This cpupower update for Linux 6.7-rc1 consists of a single fix to documentation to fix reference to a removed document." * tag 'linux-cpupower-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: cpupower: fix reference to nonexistent document commit 1373ca10ec04afba9199de1fab01fde91338a78b Author: Yuezhang Mo Date: Tue Oct 31 17:36:39 2023 +0800 exfat: fix ctime is not updated Commit 4c72a36edd54 ("exfat: convert to new timestamp accessors") removed attr_copy() from exfat_set_attr(). It causes xfstests generic/221 to fail. In xfstests generic/221, it tests ctime should be updated even if futimens() update atime only. But in this case, ctime will not be updated if attr_copy() is removed. attr_copy() may also update other attributes, and removing it may cause other bugs, so this commit restores to call attr_copy() in exfat_set_attr(). Fixes: 4c72a36edd54 ("exfat: convert to new timestamp accessors") Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon fs/exfat/file.c | 1 + 1 file changed, 1 insertion(+) commit fc12a722e6b799d1d3c1520dc9ba9aab4fda04bf Author: Yuezhang Mo Date: Tue Oct 31 17:52:13 2023 +0800 exfat: fix setting uninitialized time to ctime/atime An uninitialized time is set to ctime/atime in __exfat_write_inode(). It causes xfstests generic/003 and generic/192 to fail. And since there will be a time gap between setting ctime/atime to the inode and writing back the inode, so ctime/atime should not be set again when writing back the inode. Fixes: 4c72a36edd54 ("exfat: convert to new timestamp accessors") Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon fs/exfat/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 004fc58edea6f00db9ad07b40b882e8d976f7a54 Author: Eugen Hristev Date: Tue Oct 31 12:31:39 2023 +0200 ASoC: mediatek: mt8186_mt6366_rt1019_rt5682s: trivial: fix error messages Property 'playback-codecs' is referenced as 'speaker-codec' in the error message, and this can lead to confusion. Correct the error message such that the correct property name is referenced. Fixes: 0da16e370dd7 ("ASoC: mediatek: mt8186: add machine driver with mt6366, rt1019 and rt5682s") Signed-off-by: Eugen Hristev Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20231031103139.77395-1-eugen.hristev@collabora.com Signed-off-by: Mark Brown sound/soc/mediatek/mt8186/mt8186-mt6366-rt1019-rt5682s.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 016b9332a3346e97a6cacffea0f9dc10e1235a75 Author: Jakub Kicinski Date: Wed Nov 1 21:57:24 2023 -0700 netlink: fill in missing MODULE_DESCRIPTION() W=1 builds now warn if a module is built without a MODULE_DESCRIPTION(). Fill it in for sock_diag. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller net/netlink/diag.c | 1 + 1 file changed, 1 insertion(+) commit 02f0717e9835dbdeee26084e42086fbd32e64eb8 Author: Eric Dumazet Date: Wed Nov 1 04:52:33 2023 +0000 net/tcp: fix possible out-of-bounds reads in tcp_hash_fail() syzbot managed to trigger a fault by sending TCP packets with all flags being set. v2: - While fixing this bug, add PSH flag handling and represent flags the way tcpdump does : [S], [S.], [P.] - Print 4-tuples more consistently between families. BUG: KASAN: stack-out-of-bounds in string_nocheck lib/vsprintf.c:645 [inline] BUG: KASAN: stack-out-of-bounds in string+0x394/0x3d0 lib/vsprintf.c:727 Read of size 1 at addr ffffc9000397f3f5 by task syz-executor299/5039 CPU: 1 PID: 5039 Comm: syz-executor299 Not tainted 6.6.0-rc7-syzkaller-02075-g55c900477f5b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xc4/0x620 mm/kasan/report.c:475 kasan_report+0xda/0x110 mm/kasan/report.c:588 string_nocheck lib/vsprintf.c:645 [inline] string+0x394/0x3d0 lib/vsprintf.c:727 vsnprintf+0xc5f/0x1870 lib/vsprintf.c:2818 vprintk_store+0x3a0/0xb80 kernel/printk/printk.c:2191 vprintk_emit+0x14c/0x5f0 kernel/printk/printk.c:2288 vprintk+0x7b/0x90 kernel/printk/printk_safe.c:45 _printk+0xc8/0x100 kernel/printk/printk.c:2332 tcp_inbound_hash.constprop.0+0xdb2/0x10d0 include/net/tcp.h:2760 tcp_v6_rcv+0x2b31/0x34d0 net/ipv6/tcp_ipv6.c:1882 ip6_protocol_deliver_rcu+0x33b/0x13d0 net/ipv6/ip6_input.c:438 ip6_input_finish+0x14f/0x2f0 net/ipv6/ip6_input.c:483 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip6_input+0xce/0x440 net/ipv6/ip6_input.c:492 dst_input include/net/dst.h:461 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ipv6_rcv+0x563/0x720 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core+0x115/0x180 net/core/dev.c:5527 __netif_receive_skb+0x1f/0x1b0 net/core/dev.c:5641 netif_receive_skb_internal net/core/dev.c:5727 [inline] netif_receive_skb+0x133/0x700 net/core/dev.c:5786 tun_rx_batched+0x429/0x780 drivers/net/tun.c:1579 tun_get_user+0x29e7/0x3bc0 drivers/net/tun.c:2002 tun_chr_write_iter+0xe8/0x210 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1956 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x650/0xe40 fs/read_write.c:584 ksys_write+0x12f/0x250 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 2717b5adea9e ("net/tcp: Add tcp_hash_fail() ratelimited logs") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Dmitry Safonov Cc: Francesco Ruggeri Cc: David Ahern Reviewed-by: Dmitry Safonov Signed-off-by: David S. Miller include/net/tcp_ao.h | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit 153a58c6d8976f289b52e6652932c1cb28a2eacd Author: Ronald Wahl Date: Tue Oct 31 13:20:05 2023 +0100 net: ethernet: ti: am65-cpsw: rx_pause/tx_pause controls wrong direction The rx_pause flag says that whether we support receiving Pause frames. When a Pause frame is received TX is delayed for some time. This is TX flow control. In the same manner tx_pause is actually RX flow control. Signed-off-by: Ronald Wahl Signed-off-by: David S. Miller drivers/net/ethernet/ti/am65-cpsw-nuss.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 421b605edb1ce611dee06cf6fd9a1c1f2fd85ad0 Author: Dominique Martinet Date: Fri Nov 3 09:42:20 2023 +0900 Revert "mmc: core: Capture correct oemid-bits for eMMC cards" This reverts commit 84ee19bffc9306128cd0f1c650e89767079efeff. The commit above made quirks with an OEMID fail to be applied, as they were checking card->cid.oemid for the full 16 bits defined in MMC_FIXUP macros but the field would only contain the bottom 8 bits. eMMC v5.1A might have bogus values in OEMID's higher bits so another fix will be made, but it has been decided to revert this until that is ready. Fixes: 84ee19bffc93 ("mmc: core: Capture correct oemid-bits for eMMC cards") Link: https://lkml.kernel.org/r/ZToJsSLHr8RnuTHz@codewreck.org Link: https://lkml.kernel.org/r/CAPDyKFqkKibcXnwjnhc3+W1iJBHLeqQ9BpcZrSwhW2u9K2oUtg@mail.gmail.com Signed-off-by: Dominique Martinet Cc: stable@vger.kernel.org Cc: Alex Fetters Reviewed-by: Avri Altman Link: https://lore.kernel.org/r/20231103004220.1666641-1-asmadeus@codewreck.org Signed-off-by: Ulf Hansson drivers/mmc/core/mmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b44f9da81783fda72632ef9b0d05ea3f3ca447a5 Author: Dan Carpenter Date: Thu Nov 2 10:51:06 2023 +0300 mmc: vub300: fix an error code This error path should return -EINVAL instead of success. Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver") Signed-off-by: Dan Carpenter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/0769d30c-ad80-421b-bf5d-7d6f5d85604e@moroto.mountain Signed-off-by: Ulf Hansson drivers/mmc/host/vub300.c | 1 + 1 file changed, 1 insertion(+) commit ed9009ad300c0f15a3ecfe9613547b1962bde02c Author: Bean Huo Date: Mon Oct 30 23:48:09 2023 +0100 mmc: Add quirk MMC_QUIRK_BROKEN_CACHE_FLUSH for Micron eMMC Q2J54A Micron MTFC4GACAJCN eMMC supports cache but requires that flush cache operation be allowed only after a write has occurred. Otherwise, the cache flush command or subsequent commands will time out. Signed-off-by: Bean Huo Signed-off-by: Rafael Beims Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20231030224809.59245-1-beanhuo@iokpp.de Signed-off-by: Ulf Hansson drivers/mmc/core/block.c | 4 +++- drivers/mmc/core/card.h | 4 ++++ drivers/mmc/core/mmc.c | 8 ++++++-- drivers/mmc/core/quirks.h | 7 ++++--- include/linux/mmc/card.h | 2 ++ 5 files changed, 19 insertions(+), 6 deletions(-) commit 40592064a1a536adcced4ffea435c392eb9e7192 Author: Uwe Kleine-König Date: Thu Oct 12 23:02:29 2023 +0200 pwm: samsung: Document new member .channel in struct samsung_pwm_chip My earlier commit reworking how driver data is tracked added a new member to struct samsung_pwm_chip but failed to add matching documentation. Make up leeway. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202310130404.uQ33q5Dk-lkp@intel.com/ Fixes: e3fe982b2e4e ("pwm: samsung: Put per-channel data into driver data") Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding drivers/pwm/pwm-samsung.c | 1 + 1 file changed, 1 insertion(+) commit 71956d0cb56c1e5f9feeb4819db87a076418e930 Author: Nitin Yadav Date: Thu Oct 26 11:44:58 2023 +0530 mmc: sdhci_am654: fix start loop index for TAP value parsing ti,otap-del-sel-legacy/ti,itap-del-sel-legacy passed from DT are currently ignored for all SD/MMC and eMMC modes. Fix this by making start loop index to MMC_TIMING_LEGACY. Fixes: 8ee5fc0e0b3b ("mmc: sdhci_am654: Update OTAPDLY writes") Signed-off-by: Nitin Yadav Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20231026061458.1116276-1-n-yadav@ti.com Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci_am654.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cdbab6236605dc11780779d9af689aea7d58cab1 Author: Eric Dumazet Date: Tue Oct 31 06:19:45 2023 +0000 tcp: fix fastopen code vs usec TS After blamed commit, TFO client-ack-dropped-then-recovery-ms-timestamps packetdrill test failed. David Morley and Neal Cardwell started investigating and Neal pointed that we had : tcp_conn_request() tcp_try_fastopen() -> tcp_fastopen_create_child -> child = inet_csk(sk)->icsk_af_ops->syn_recv_sock() -> tcp_create_openreq_child() -> copy req_usec_ts from req: newtp->tcp_usec_ts = treq->req_usec_ts; // now the new TFO server socket always does usec TS, no matter // what the route options are... send_synack() -> tcp_make_synack() // disable tcp_rsk(req)->req_usec_ts if route option is not present: if (tcp_rsk(req)->req_usec_ts < 0) tcp_rsk(req)->req_usec_ts = dst_tcp_usec_ts(dst); tcp_conn_request() has the initial dst, we can initialize tcp_rsk(req)->req_usec_ts there instead of later in send_synack(); This means tcp_rsk(req)->req_usec_ts can be a boolean. Many thanks to David an Neal for their help. Fixes: 614e8316aa4c ("tcp: add support for usec resolution in TCP TS values") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202310302216.f79d78bc-oliver.sang@intel.com Suggested-by: Neal Cardwell Signed-off-by: Eric Dumazet Cc: David Morley Acked-by: Neal Cardwell Signed-off-by: David S. Miller include/linux/tcp.h | 2 +- net/ipv4/syncookies.c | 2 +- net/ipv4/tcp_input.c | 7 ++++--- net/ipv4/tcp_output.c | 2 -- 4 files changed, 6 insertions(+), 7 deletions(-) commit 63e201916b27260218e528a2f8758be47f99bbf4 Author: Hangbin Liu Date: Tue Oct 31 11:47:32 2023 +0800 selftests: pmtu.sh: fix result checking In the PMTU test, when all previous tests are skipped and the new test passes, the exit code is set to 0. However, the current check mistakenly treats this as an assignment, causing the check to pass every time. Consequently, regardless of how many tests have failed, if the latest test passes, the PMTU test will report a pass. Fixes: 2a9d3716b810 ("selftests: pmtu.sh: improve the test result processing") Signed-off-by: Hangbin Liu Acked-by: Po-Hsu Lin Signed-off-by: David S. Miller tools/testing/selftests/net/pmtu.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit db456d90a4c1b43b6251fa4348c8adc59b583274 Author: Furong Xu <0x1207@gmail.com> Date: Tue Oct 31 10:27:29 2023 +0800 net: stmmac: xgmac: Enable support for multiple Flexible PPS outputs From XGMAC Core 3.20 and later, each Flexible PPS has individual PPSEN bit to select Fixed mode or Flexible mode. The PPSEN must be set, or it stays in Fixed PPS mode by default. XGMAC Core prior 3.20, only PPSEN0(bit 4) is writable. PPSEN{1,2,3} are read-only reserved, and they are already in Flexible mode by default, our new code always set PPSEN{1,2,3} do not make things worse ;-) Fixes: 95eaf3cd0a90 ("net: stmmac: dwxgmac: Add Flexible PPS support") Reviewed-by: Serge Semin Reviewed-by: Jacob Keller Signed-off-by: Furong Xu <0x1207@gmail.com> Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 2 +- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 14 +++++++++++++- 2 files changed, 14 insertions(+), 2 deletions(-) commit e8ae8ad479e2d037daa33756e5e72850a7bd37a9 Author: NeilBrown Date: Tue Oct 24 09:53:33 2023 +1100 Fix termination state for idr_for_each_entry_ul() The comment for idr_for_each_entry_ul() states after normal termination @entry is left with the value NULL This is not correct in the case where UINT_MAX has an entry in the idr. In that case @entry will be non-NULL after termination. No current code depends on the documentation being correct, but to save future code we should fix it. Also fix idr_for_each_entry_continue_ul(). While this is not documented as leaving @entry as NULL, the mellanox driver appears to depend on it doing so. So make that explicit in the documentation as well as in the code. Fixes: e33d2b74d805 ("idr: fix overflow case for idr_for_each_entry_ul()") Cc: Matthew Wilcox Cc: Chris Mi Cc: Cong Wang Signed-off-by: NeilBrown Signed-off-by: David S. Miller include/linux/idr.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit a5e3b127455d073f146a2a4ea3e7117635d34c5c Author: Petr Tesarik Date: Thu Nov 2 10:36:49 2023 +0100 swiotlb: do not free decrypted pages if dynamic Fix these two error paths: 1. When set_memory_decrypted() fails, pages may be left fully or partially decrypted. 2. Decrypted pages may be freed if swiotlb_alloc_tlb() determines that the physical address is too high. To fix the first issue, call set_memory_encrypted() on the allocated region after a failed decryption attempt. If that also fails, leak the pages. To fix the second issue, check that the TLB physical address is below the requested limit before decrypting. Let the caller differentiate between unsuitable physical address (=> retry from a lower zone) and allocation failures (=> no point in retrying). Cc: stable@vger.kernel.org Fixes: 79636caad361 ("swiotlb: if swiotlb is full, fall back to a transient memory pool") Signed-off-by: Petr Tesarik Reviewed-by: Rick Edgecombe Signed-off-by: Christoph Hellwig kernel/dma/swiotlb.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) commit 7269cba53d906cf257c139d3b3a53ad272176bca Author: Sumit Garg Date: Thu Nov 2 13:00:55 2023 +0530 tee: optee: Fix supplicant based device enumeration Currently supplicant dependent optee device enumeration only registers devices whenever tee-supplicant is invoked for the first time. But it forgets to remove devices when tee-supplicant daemon stops running and closes its context gracefully. This leads to following error for fTPM driver during reboot/shutdown: [ 73.466791] tpm tpm0: ftpm_tee_tpm_op_send: SUBMIT_COMMAND invoke error: 0xffff3024 Fix this by adding an attribute for supplicant dependent devices so that the user-space service can detect and detach supplicant devices before closing the supplicant: $ for dev in /sys/bus/tee/devices/*; do if [[ -f "$dev/need_supplicant" && -f "$dev/driver/unbind" ]]; \ then echo $(basename "$dev") > $dev/driver/unbind; fi done Reported-by: Jan Kiszka Closes: https://github.com/OP-TEE/optee_os/issues/6094 Fixes: 5f178bb71e3a ("optee: enable support for multi-stage bus enumeration") Signed-off-by: Sumit Garg Reviewed-by: Ilias Apalodimas Acked-by: Jerome Forissier [jw: fixed up Date documentation] Signed-off-by: Jens Wiklander Documentation/ABI/testing/sysfs-bus-optee-devices | 9 +++++++++ drivers/tee/optee/device.c | 17 +++++++++++++++-- 2 files changed, 24 insertions(+), 2 deletions(-) commit 8f6f76a6a29f36d2f3e4510d0bde5046672f6924 Merge: ecae0bd5173b 6620999f0d41 Author: Linus Torvalds Date: Thu Nov 2 20:53:31 2023 -1000 Merge tag 'mm-nonmm-stable-2023-11-02-14-08' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull non-MM updates from Andrew Morton: "As usual, lots of singleton and doubleton patches all over the tree and there's little I can say which isn't in the individual changelogs. The lengthier patch series are - 'kdump: use generic functions to simplify crashkernel reservation in arch', from Baoquan He. This is mainly cleanups and consolidation of the 'crashkernel=' kernel parameter handling - After much discussion, David Laight's 'minmax: Relax type checks in min() and max()' is here. Hopefully reduces some typecasting and the use of min_t() and max_t() - A group of patches from Oleg Nesterov which clean up and slightly fix our handling of reads from /proc/PID/task/... and which remove task_struct.thread_group" * tag 'mm-nonmm-stable-2023-11-02-14-08' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (64 commits) scripts/gdb/vmalloc: disable on no-MMU scripts/gdb: fix usage of MOD_TEXT not defined when CONFIG_MODULES=n .mailmap: add address mapping for Tomeu Vizoso mailmap: update email address for Claudiu Beznea tools/testing/selftests/mm/run_vmtests.sh: lower the ptrace permissions .mailmap: map Benjamin Poirier's address scripts/gdb: add lx_current support for riscv ocfs2: fix a spelling typo in comment proc: test ProtectionKey in proc-empty-vm test proc: fix proc-empty-vm test with vsyscall fs/proc/base.c: remove unneeded semicolon do_io_accounting: use sig->stats_lock do_io_accounting: use __for_each_thread() ocfs2: replace BUG_ON() at ocfs2_num_free_extents() with ocfs2_error() ocfs2: fix a typo in a comment scripts/show_delta: add __main__ judgement before main code treewide: mark stuff as __ro_after_init fs: ocfs2: check status values proc: test /proc/${pid}/statm compiler.h: move __is_constexpr() to compiler.h ... commit ecae0bd5173b1014f95a14a8dfbe40ec10367dcf Merge: bc3012f4e3a9 973233600676 Author: Linus Torvalds Date: Thu Nov 2 19:38:47 2023 -1000 Merge tag 'mm-stable-2023-11-01-14-33' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: "Many singleton patches against the MM code. The patch series which are included in this merge do the following: - Kemeng Shi has contributed some compation maintenance work in the series 'Fixes and cleanups to compaction' - Joel Fernandes has a patchset ('Optimize mremap during mutual alignment within PMD') which fixes an obscure issue with mremap()'s pagetable handling during a subsequent exec(), based upon an implementation which Linus suggested - More DAMON/DAMOS maintenance and feature work from SeongJae Park i the following patch series: mm/damon: misc fixups for documents, comments and its tracepoint mm/damon: add a tracepoint for damos apply target regions mm/damon: provide pseudo-moving sum based access rate mm/damon: implement DAMOS apply intervals mm/damon/core-test: Fix memory leaks in core-test mm/damon/sysfs-schemes: Do DAMOS tried regions update for only one apply interval - In the series 'Do not try to access unaccepted memory' Adrian Hunter provides some fixups for the recently-added 'unaccepted memory' feature. To increase the feature's checking coverage. 'Plug a few gaps where RAM is exposed without checking if it is unaccepted memory' - In the series 'cleanups for lockless slab shrink' Qi Zheng has done some maintenance work which is preparation for the lockless slab shrinking code - Qi Zheng has redone the earlier (and reverted) attempt to make slab shrinking lockless in the series 'use refcount+RCU method to implement lockless slab shrink' - David Hildenbrand contributes some maintenance work for the rmap code in the series 'Anon rmap cleanups' - Kefeng Wang does more folio conversions and some maintenance work in the migration code. Series 'mm: migrate: more folio conversion and unification' - Matthew Wilcox has fixed an issue in the buffer_head code which was causing long stalls under some heavy memory/IO loads. Some cleanups were added on the way. Series 'Add and use bdev_getblk()' - In the series 'Use nth_page() in place of direct struct page manipulation' Zi Yan has fixed a potential issue with the direct manipulation of hugetlb page frames - In the series 'mm: hugetlb: Skip initialization of gigantic tail struct pages if freed by HVO' has improved our handling of gigantic pages in the hugetlb vmmemmep optimizaton code. This provides significant boot time improvements when significant amounts of gigantic pages are in use - Matthew Wilcox has sent the series 'Small hugetlb cleanups' - code rationalization and folio conversions in the hugetlb code - Yin Fengwei has improved mlock()'s handling of large folios in the series 'support large folio for mlock' - In the series 'Expose swapcache stat for memcg v1' Liu Shixin has added statistics for memcg v1 users which are available (and useful) under memcg v2 - Florent Revest has enhanced the MDWE (Memory-Deny-Write-Executable) prctl so that userspace may direct the kernel to not automatically propagate the denial to child processes. The series is named 'MDWE without inheritance' - Kefeng Wang has provided the series 'mm: convert numa balancing functions to use a folio' which does what it says - In the series 'mm/ksm: add fork-exec support for prctl' Stefan Roesch makes is possible for a process to propagate KSM treatment across exec() - Huang Ying has enhanced memory tiering's calculation of memory distances. This is used to permit the dax/kmem driver to use 'high bandwidth memory' in addition to Optane Data Center Persistent Memory Modules (DCPMM). The series is named 'memory tiering: calculate abstract distance based on ACPI HMAT' - In the series 'Smart scanning mode for KSM' Stefan Roesch has optimized KSM by teaching it to retain and use some historical information from previous scans - Yosry Ahmed has fixed some inconsistencies in memcg statistics in the series 'mm: memcg: fix tracking of pending stats updates values' - In the series 'Implement IOCTL to get and optionally clear info about PTEs' Peter Xu has added an ioctl to /proc//pagemap which permits us to atomically read-then-clear page softdirty state. This is mainly used by CRIU - Hugh Dickins contributed the series 'shmem,tmpfs: general maintenance', a bunch of relatively minor maintenance tweaks to this code - Matthew Wilcox has increased the use of the VMA lock over file-backed page faults in the series 'Handle more faults under the VMA lock'. Some rationalizations of the fault path became possible as a result - In the series 'mm/rmap: convert page_move_anon_rmap() to folio_move_anon_rmap()' David Hildenbrand has implemented some cleanups and folio conversions - In the series 'various improvements to the GUP interface' Lorenzo Stoakes has simplified and improved the GUP interface with an eye to providing groundwork for future improvements - Andrey Konovalov has sent along the series 'kasan: assorted fixes and improvements' which does those things - Some page allocator maintenance work from Kemeng Shi in the series 'Two minor cleanups to break_down_buddy_pages' - In thes series 'New selftest for mm' Breno Leitao has developed another MM self test which tickles a race we had between madvise() and page faults - In the series 'Add folio_end_read' Matthew Wilcox provides cleanups and an optimization to the core pagecache code - Nhat Pham has added memcg accounting for hugetlb memory in the series 'hugetlb memcg accounting' - Cleanups and rationalizations to the pagemap code from Lorenzo Stoakes, in the series 'Abstract vma_merge() and split_vma()' - Audra Mitchell has fixed issues in the procfs page_owner code's new timestamping feature which was causing some misbehaviours. In the series 'Fix page_owner's use of free timestamps' - Lorenzo Stoakes has fixed the handling of new mappings of sealed files in the series 'permit write-sealed memfd read-only shared mappings' - Mike Kravetz has optimized the hugetlb vmemmap optimization in the series 'Batch hugetlb vmemmap modification operations' - Some buffer_head folio conversions and cleanups from Matthew Wilcox in the series 'Finish the create_empty_buffers() transition' - As a page allocator performance optimization Huang Ying has added automatic tuning to the allocator's per-cpu-pages feature, in the series 'mm: PCP high auto-tuning' - Roman Gushchin has contributed the patchset 'mm: improve performance of accounted kernel memory allocations' which improves their performance by ~30% as measured by a micro-benchmark - folio conversions from Kefeng Wang in the series 'mm: convert page cpupid functions to folios' - Some kmemleak fixups in Liu Shixin's series 'Some bugfix about kmemleak' - Qi Zheng has improved our handling of memoryless nodes by keeping them off the allocation fallback list. This is done in the series 'handle memoryless nodes more appropriately' - khugepaged conversions from Vishal Moola in the series 'Some khugepaged folio conversions'" [ bcachefs conflicts with the dynamically allocated shrinkers have been resolved as per Stephen Rothwell in https://lore.kernel.org/all/20230913093553.4290421e@canb.auug.org.au/ with help from Qi Zheng. The clone3 test filtering conflict was half-arsed by yours truly ] * tag 'mm-stable-2023-11-01-14-33' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (406 commits) mm/damon/sysfs: update monitoring target regions for online input commit mm/damon/sysfs: remove requested targets when online-commit inputs selftests: add a sanity check for zswap Documentation: maple_tree: fix word spelling error mm/vmalloc: fix the unchecked dereference warning in vread_iter() zswap: export compression failure stats Documentation: ubsan: drop "the" from article title mempolicy: migration attempt to match interleave nodes mempolicy: mmap_lock is not needed while migrating folios mempolicy: alloc_pages_mpol() for NUMA policy without vma mm: add page_rmappable_folio() wrapper mempolicy: remove confusing MPOL_MF_LAZY dead code mempolicy: mpol_shared_policy_init() without pseudo-vma mempolicy trivia: use pgoff_t in shared mempolicy tree mempolicy trivia: slightly more consistent naming mempolicy trivia: delete those ancient pr_debug()s mempolicy: fix migrate_pages(2) syscall return nr_failed kernfs: drop shared NUMA mempolicy hooks hugetlbfs: drop shared NUMA mempolicy pretence mm/damon/sysfs-test: add a unit test for damon_sysfs_set_targets() ... commit 8d55b0a940bb10592ffaad68d14314823ddf4cdf Author: Dave Airlie Date: Mon Oct 30 16:48:08 2023 +1000 nouveau/gsp: add some basic registry entries. The nvidia driver sets these two basic registry entries always, so copy it. Reviewed-by: Danilo Krummrich Signed-off-by: Dave Airlie drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 45 ++++++++++++++++++++------ 1 file changed, 35 insertions(+), 10 deletions(-) commit 5177e5fa6e9e32decfc5beedf82823a0e57bdcff Author: Dave Airlie Date: Mon Oct 30 13:49:36 2023 +1000 nouveau/gsp: fix message signature. This original one was backwards, compared to traces from nvidia driver. Reviewed-by: Danilo Krummrich Signed-off-by: Dave Airlie drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b5bad8c16b9b67be5ce04b8c2f0f1e22c68d8fd9 Author: Dave Airlie Date: Thu Sep 21 13:13:01 2023 +1000 nouveau/gsp: move to 535.113.01 This moves the initial effort to the latest 535 firmware. The gsp msg structs have changed, and the message passing also. The wpr also seems to have some struct changes. This version of the firmware will be what we are stuck on for a while, until we can refactor the driver and work out a better path forward. Reviewed-by: Danilo Krummrich Signed-off-by: Dave Airlie .../common/sdk/nvidia/inc/alloc/alloc_channel.h | 13 +++- .../common/sdk/nvidia/inc/class/cl0000.h | 4 +- .../common/sdk/nvidia/inc/class/cl0005.h | 2 +- .../common/sdk/nvidia/inc/class/cl0080.h | 2 +- .../common/sdk/nvidia/inc/class/cl2080.h | 2 +- .../sdk/nvidia/inc/class/cl2080_notification.h | 2 +- .../common/sdk/nvidia/inc/class/cl84a0.h | 2 +- .../common/sdk/nvidia/inc/class/cl90f1.h | 2 +- .../common/sdk/nvidia/inc/class/clc0b5sw.h | 2 +- .../sdk/nvidia/inc/ctrl/ctrl0073/ctrl0073common.h | 2 +- .../sdk/nvidia/inc/ctrl/ctrl0073/ctrl0073dfp.h | 2 +- .../sdk/nvidia/inc/ctrl/ctrl0073/ctrl0073dp.h | 4 +- .../nvidia/inc/ctrl/ctrl0073/ctrl0073specific.h | 2 +- .../sdk/nvidia/inc/ctrl/ctrl0073/ctrl0073system.h | 2 +- .../sdk/nvidia/inc/ctrl/ctrl0080/ctrl0080fifo.h | 2 +- .../sdk/nvidia/inc/ctrl/ctrl0080/ctrl0080gpu.h | 2 +- .../sdk/nvidia/inc/ctrl/ctrl0080/ctrl0080gr.h | 2 +- .../sdk/nvidia/inc/ctrl/ctrl2080/ctrl2080bios.h | 2 +- .../sdk/nvidia/inc/ctrl/ctrl2080/ctrl2080ce.h | 2 +- .../sdk/nvidia/inc/ctrl/ctrl2080/ctrl2080event.h | 2 +- .../sdk/nvidia/inc/ctrl/ctrl2080/ctrl2080fb.h | 2 +- .../sdk/nvidia/inc/ctrl/ctrl2080/ctrl2080fifo.h | 2 +- .../sdk/nvidia/inc/ctrl/ctrl2080/ctrl2080gpu.h | 2 +- .../sdk/nvidia/inc/ctrl/ctrl2080/ctrl2080gr.h | 2 +- .../nvidia/inc/ctrl/ctrl2080/ctrl2080internal.h | 2 +- .../common/sdk/nvidia/inc/ctrl/ctrl90f1.h | 2 +- .../sdk/nvidia/inc/ctrl/ctrla06f/ctrla06fgpfifo.h | 2 +- .../common/sdk/nvidia/inc/nvlimits.h | 2 +- .../common/sdk/nvidia/inc/nvos.h | 2 +- .../common/shared/msgq/inc/msgq/msgq_priv.h | 2 +- .../uproc/os/common/include/libos_init_args.h | 2 +- .../arch/nvalloc/common/inc/gsp/gsp_fw_sr_meta.h | 2 +- .../arch/nvalloc/common/inc/gsp/gsp_fw_wpr_meta.h | 47 +++++++++---- .../nvidia/arch/nvalloc/common/inc/rmRiscvUcode.h | 2 +- .../nvidia/arch/nvalloc/common/inc/rmgspseq.h | 2 +- .../nvidia/generated/g_allclasses.h | 2 +- .../nvidia/generated/g_chipset_nvoc.h | 2 +- .../nvidia/generated/g_fbsr_nvoc.h | 2 +- .../nvidia/generated/g_gpu_nvoc.h | 2 +- .../nvidia/generated/g_kernel_channel_nvoc.h | 2 +- .../nvidia/generated/g_kernel_fifo_nvoc.h | 2 +- .../nvidia/generated/g_mem_desc_nvoc.h | 2 +- .../nvidia/generated/g_os_nvoc.h | 2 +- .../nvidia/generated/g_rpc-structures.h | 6 +- .../nvidia/generated/g_sdk-structures.h | 4 +- .../nvidia/inc/kernel/gpu/gpu_acpi_data.h | 4 +- .../nvidia/inc/kernel/gpu/gpu_engine_type.h | 2 +- .../nvidia/inc/kernel/gpu/gsp/gsp_fw_heap.h | 2 +- .../nvidia/inc/kernel/gpu/gsp/gsp_init_args.h | 2 +- .../nvidia/inc/kernel/gpu/gsp/gsp_static_config.h | 26 ++++---- .../nvidia/inc/kernel/gpu/intr/engine_idx.h | 2 +- .../nvidia/inc/kernel/gpu/nvbitmask.h | 4 +- .../nvidia/inc/kernel/os/nv_memory_type.h | 2 +- .../nvidia/kernel/inc/vgpu/rpc_global_enums.h | 2 +- .../nvidia/kernel/inc/vgpu/rpc_headers.h | 2 +- .../nvidia/kernel/inc/vgpu/sdk-structures.h | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/ce/r535.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/r535.c | 20 +++--- drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c | 20 +++--- drivers/gpu/drm/nouveau/nvkm/engine/gr/r535.c | 10 +-- drivers/gpu/drm/nouveau/nvkm/engine/nvdec/r535.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/nvenc/r535.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/nvjpg/r535.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/ofa/r535.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/bar/r535.c | 6 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/ad102.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/ga100.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/ga102.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 76 +++++++++++++--------- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/tu102.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/tu116.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/instmem/r535.c | 12 ++-- drivers/gpu/drm/nouveau/nvkm/subdev/mmu/r535.c | 6 +- 73 files changed, 217 insertions(+), 171 deletions(-) commit bc3012f4e3a9765de81f454cb8f9bb16aafc6ff5 Merge: 6803bd7956ca a312e07a65fb Author: Linus Torvalds Date: Thu Nov 2 16:15:30 2023 -1000 Merge tag 'v6.7-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "API: - Add virtual-address based lskcipher interface - Optimise ahash/shash performance in light of costly indirect calls - Remove ahash alignmask attribute Algorithms: - Improve AES/XTS performance of 6-way unrolling for ppc - Remove some uses of obsolete algorithms (md4, md5, sha1) - Add FIPS 202 SHA-3 support in pkcs1pad - Add fast path for single-page messages in adiantum - Remove zlib-deflate Drivers: - Add support for S4 in meson RNG driver - Add STM32MP13x support in stm32 - Add hwrng interface support in qcom-rng - Add support for deflate algorithm in hisilicon/zip" * tag 'v6.7-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (283 commits) crypto: adiantum - flush destination page before unmapping crypto: testmgr - move pkcs1pad(rsa,sha3-*) to correct place Documentation/module-signing.txt: bring up to date module: enable automatic module signing with FIPS 202 SHA-3 crypto: asymmetric_keys - allow FIPS 202 SHA-3 signatures crypto: rsa-pkcs1pad - Add FIPS 202 SHA-3 support crypto: FIPS 202 SHA-3 register in hash info for IMA x509: Add OIDs for FIPS 202 SHA-3 hash and signatures crypto: ahash - optimize performance when wrapping shash crypto: ahash - check for shash type instead of not ahash type crypto: hash - move "ahash wrapping shash" functions to ahash.c crypto: talitos - stop using crypto_ahash::init crypto: chelsio - stop using crypto_ahash::init crypto: ahash - improve file comment crypto: ahash - remove struct ahash_request_priv crypto: ahash - remove crypto_ahash_alignmask crypto: gcm - stop using alignmask of ahash crypto: chacha20poly1305 - stop using alignmask of ahash crypto: ccm - stop using alignmask of ahash net: ipv6: stop checking crypto_ahash_alignmask ... commit 6803bd7956ca8fc43069c2e42016f17f3c2fbf30 Merge: 5be9911406ad 45b890f7689e Author: Linus Torvalds Date: Thu Nov 2 15:45:15 2023 -1000 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm updates from Paolo Bonzini: "ARM: - Generalized infrastructure for 'writable' ID registers, effectively allowing userspace to opt-out of certain vCPU features for its guest - Optimization for vSGI injection, opportunistically compressing MPIDR to vCPU mapping into a table - Improvements to KVM's PMU emulation, allowing userspace to select the number of PMCs available to a VM - Guest support for memory operation instructions (FEAT_MOPS) - Cleanups to handling feature flags in KVM_ARM_VCPU_INIT, squashing bugs and getting rid of useless code - Changes to the way the SMCCC filter is constructed, avoiding wasted memory allocations when not in use - Load the stage-2 MMU context at vcpu_load() for VHE systems, reducing the overhead of errata mitigations - Miscellaneous kernel and selftest fixes LoongArch: - New architecture for kvm. The hardware uses the same model as x86, s390 and RISC-V, where guest/host mode is orthogonal to supervisor/user mode. The virtualization extensions are very similar to MIPS, therefore the code also has some similarities but it's been cleaned up to avoid some of the historical bogosities that are found in arch/mips. The kernel emulates MMU, timer and CSR accesses, while interrupt controllers are only emulated in userspace, at least for now. RISC-V: - Support for the Smstateen and Zicond extensions - Support for virtualizing senvcfg - Support for virtualized SBI debug console (DBCN) S390: - Nested page table management can be monitored through tracepoints and statistics x86: - Fix incorrect handling of VMX posted interrupt descriptor in KVM_SET_LAPIC, which could result in a dropped timer IRQ - Avoid WARN on systems with Intel IPI virtualization - Add CONFIG_KVM_MAX_NR_VCPUS, to allow supporting up to 4096 vCPUs without forcing more common use cases to eat the extra memory overhead. - Add virtualization support for AMD SRSO mitigation (IBPB_BRTYPE and SBPB, aka Selective Branch Predictor Barrier). - Fix a bug where restoring a vCPU snapshot that was taken within 1 second of creating the original vCPU would cause KVM to try to synchronize the vCPU's TSC and thus clobber the correct TSC being set by userspace. - Compute guest wall clock using a single TSC read to avoid generating an inaccurate time, e.g. if the vCPU is preempted between multiple TSC reads. - "Virtualize" HWCR.TscFreqSel to make Linux guests happy, which complain about a "Firmware Bug" if the bit isn't set for select F/M/S combos. Likewise "virtualize" (ignore) MSR_AMD64_TW_CFG to appease Windows Server 2022. - Don't apply side effects to Hyper-V's synthetic timer on writes from userspace to fix an issue where the auto-enable behavior can trigger spurious interrupts, i.e. do auto-enabling only for guest writes. - Remove an unnecessary kick of all vCPUs when synchronizing the dirty log without PML enabled. - Advertise "support" for non-serializing FS/GS base MSR writes as appropriate. - Harden the fast page fault path to guard against encountering an invalid root when walking SPTEs. - Omit "struct kvm_vcpu_xen" entirely when CONFIG_KVM_XEN=n. - Use the fast path directly from the timer callback when delivering Xen timer events, instead of waiting for the next iteration of the run loop. This was not done so far because previously proposed code had races, but now care is taken to stop the hrtimer at critical points such as restarting the timer or saving the timer information for userspace. - Follow the lead of upstream Xen and ignore the VCPU_SSHOTTMR_future flag. - Optimize injection of PMU interrupts that are simultaneous with NMIs. - Usual handful of fixes for typos and other warts. x86 - MTRR/PAT fixes and optimizations: - Clean up code that deals with honoring guest MTRRs when the VM has non-coherent DMA and host MTRRs are ignored, i.e. EPT is enabled. - Zap EPT entries when non-coherent DMA assignment stops/start to prevent using stale entries with the wrong memtype. - Don't ignore guest PAT for CR0.CD=1 && KVM_X86_QUIRK_CD_NW_CLEARED=y This was done as a workaround for virtual machine BIOSes that did not bother to clear CR0.CD (because ancient KVM/QEMU did not bother to set it, in turn), and there's zero reason to extend the quirk to also ignore guest PAT. x86 - SEV fixes: - Report KVM_EXIT_SHUTDOWN instead of EINVAL if KVM intercepts SHUTDOWN while running an SEV-ES guest. - Clean up the recognition of emulation failures on SEV guests, when KVM would like to "skip" the instruction but it had already been partially emulated. This makes it possible to drop a hack that second guessed the (insufficient) information provided by the emulator, and just do the right thing. Documentation: - Various updates and fixes, mostly for x86 - MTRR and PAT fixes and optimizations" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (164 commits) KVM: selftests: Avoid using forced target for generating arm64 headers tools headers arm64: Fix references to top srcdir in Makefile KVM: arm64: Add tracepoint for MMIO accesses where ISV==0 KVM: arm64: selftest: Perform ISB before reading PAR_EL1 KVM: arm64: selftest: Add the missing .guest_prepare() KVM: arm64: Always invalidate TLB for stage-2 permission faults KVM: x86: Service NMI requests after PMI requests in VM-Enter path KVM: arm64: Handle AArch32 SPSR_{irq,abt,und,fiq} as RAZ/WI KVM: arm64: Do not let a L1 hypervisor access the *32_EL2 sysregs KVM: arm64: Refine _EL2 system register list that require trap reinjection arm64: Add missing _EL2 encodings arm64: Add missing _EL12 encodings KVM: selftests: aarch64: vPMU test for validating user accesses KVM: selftests: aarch64: vPMU register test for unimplemented counters KVM: selftests: aarch64: vPMU register test for implemented counters KVM: selftests: aarch64: Introduce vpmu_counter_access test tools: Import arm_pmuv3.h KVM: arm64: PMU: Allow userspace to limit PMCR_EL0.N for the guest KVM: arm64: Sanitize PM{C,I}NTEN{SET,CLR}, PMOVS{SET,CLR} before first run KVM: arm64: Add {get,set}_user for PM{C,I}NTEN{SET,CLR}, PMOVS{SET,CLR} ... commit 5be9911406ada8fe6187db7ce402f7ff4c21ebdf Merge: c9cacf7db3e4 63f1ee206170 Author: Linus Torvalds Date: Thu Nov 2 15:34:59 2023 -1000 Merge tag 'sh-for-v6.7-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux Pull sh updates from John Paul Adrian Glaubitz: "While the previously announced patch series for converting arch/sh to device trees is not yet ready for inclusion to mainline and therefore didn't make it for this pull request, there are still a small number changes for v6.7 which include one platform (board plus CPU and driver code) removal plus two fixes. The removal sent in by Arnd Bergmann concerns the microdev board which was an early SuperH prototype board that was never used in production. With the board removed, we were able to drop the now unused code for the SH4-202 CPU and well as the driver code for the superhyway bus and a custom implementation for ioport_map() and ioport_unmap() which will allow us to simplify ioport handling in the future. Another patch set by Geert Uytterhoeven revives SuperH BIOS earlyprintk support which got accidentally disabled in e76fe57447e88916 ("sh: Remove old early serial console code V2"), the second patch in the series updates the documentation. Finally, a patch by Masami Hiramatsu fixes a regression reported by the kernel test robot which uncovered that arch/sh is not implementing arch_cmpxchg_local() and therefore needs use __generic_cmpxchg_local() instead" * tag 'sh-for-v6.7-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux: locking/atomic: sh: Use generic_cmpxchg_local for arch_cmpxchg_local() Documentation: kernel-parameters: Add earlyprintk=bios on SH sh: bios: Revive earlyprintk support sh: machvec: Remove custom ioport_{un,}map() sh: Remove superhyway bus support sh: Remove unused SH4-202 support sh: Remove stale microdev board commit c9cacf7db3e4802fd38cf7a7cbee4db2528bd256 Merge: 8c04bddc27d6 c7368ddba2ff Author: Linus Torvalds Date: Thu Nov 2 15:32:53 2023 -1000 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM updates from Russell King: - fix some kernel-doc warnings - fix stack depot IRQ stack filter - cast memset() byte to unsigned char - explicitly include correct DI includes - fix ARCH_LOW_ADDRESS_LIMIT with CONFIG_ZONE_DMA - fix get_user() problems when linker uses a veneer - make including linux/uaccess.h self-contained on ARM * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 9326/1: make self-contained for ARM ARM: 9324/1: fix get_user() broken with veneer ARM: 9323/1: mm: Fix ARCH_LOW_ADDRESS_LIMIT when CONFIG_ZONE_DMA ARM: 9322/1: Explicitly include correct DT includes ARM: 9321/1: memset: cast the constant byte to unsigned char ARM: 9320/1: fix stack depot IRQ stack filter ARM: 9319/1: sa1111: fix sa1111_probe kernel-doc warnings commit 8c04bddc27d60df8ca5cb5bea40374c3ca1d75fc Merge: 43468456c95b 2508b608f402 Author: Linus Torvalds Date: Thu Nov 2 15:31:01 2023 -1000 Merge tag 'm68knommu-for-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu updates from Greg Ungerer: "A few changes, most of them related to fixing warnings when compiling with "W=1". These follow up Geert's recent changes for M68K for this too. These ones complete the fixes for the nommu and ColdFire specific code. Also a couple of other fixes to improve ROM default addressing and compiling for the Cleopatra boards. Summary: - improve default Kconfig ROM section settings - fix compilation for some Cleopatra boards - fixes and cleanups for warnings compiling with 'W=1'" * tag 'm68knommu-for-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k: 68000: fix warning in timer code m68k: 68000: fix warnings in 68000 interrupt handling m68k: coldfire: remove unused variable in MMU code m68k: coldfire: fix warnings in uboot argument processing m68k: coldfire: make mcf_maskimr() static m68k: coldfire: ensure gpio prototypes visible m68k: coldfire: add and use "vectors.h" m68knommu: fix compilation for ColdFire/Cleopatra boards m68knommu: improve config ROM setting defaults commit 43468456c95b9e13c0592de51a9a530caa525c1f Merge: 6ed92e559a2e 2ef422f063b7 Author: Linus Torvalds Date: Thu Nov 2 15:20:30 2023 -1000 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "Nothing exciting this cycle, most of the diffstat is changing SPDX 'or' to 'OR'. Summary: - Bugfixes for hns, mlx5, and hfi1 - Hardening patches for size_*, counted_by, strscpy - rts fixes from static analysis - Dump SRQ objects in rdma netlink, with hns support - Fix a performance regression in mlx5 MR deregistration - New XDR (200Gb/lane) link speed - SRQ record doorbell latency optimization for hns - IPSEC support for mlx5 multi-port mode - ibv_rereg_mr() support for irdma - Affiliated event support for bnxt_re - Opt out for the spec compliant qkey security enforcement as we discovered SW that breaks under enforcement - Comment and trivial updates" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (50 commits) IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF RDMA/mlx5: Fix mkey cache WQ flush RDMA/hfi1: Workaround truncation compilation error IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock RDMA/core: Remove NULL check before dev_{put, hold} RDMA/hfi1: Remove redundant assignment to pointer ppd RDMA/mlx5: Change the key being sent for MPV device affiliation RDMA/bnxt_re: Fix clang -Wimplicit-fallthrough in bnxt_re_handle_cq_async_error() RDMA/hns: Fix init failure of RoCE VF and HIP08 RDMA/hns: Fix unnecessary port_num transition in HW stats allocation RDMA/hns: The UD mode can only be configured with DCQCN RDMA/hns: Add check for SL RDMA/hns: Fix signed-unsigned mixed comparisons RDMA/hns: Fix uninitialized ucmd in hns_roce_create_qp_common() RDMA/hns: Fix printing level of asynchronous events RDMA/core: Add support to set privileged QKEY parameter RDMA/bnxt_re: Do not report SRQ error in srq notification RDMA/bnxt_re: Report async events and errors RDMA/bnxt_re: Update HW interface headers IB/mlx5: Fix rdma counter binding for RAW QP ... commit 6ed92e559a2ea572ae2bac5cbeddd1dc8cb667b6 Merge: 90a300dc0553 a75a16c62a25 Author: Linus Torvalds Date: Thu Nov 2 15:13:50 2023 -1000 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "Updates to the usual drivers (ufs, megaraid_sas, lpfc, target, ibmvfc, scsi_debug) plus the usual assorted minor fixes and updates. The major change this time around is a prep patch for rethreading of the driver reset handler API not to take a scsi_cmd structure which starts to reduce various drivers' dependence on scsi_cmd in error handling" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (132 commits) scsi: ufs: core: Leave space for '\0' in utf8 desc string scsi: ufs: core: Conversion to bool not necessary scsi: ufs: core: Fix race between force complete and ISR scsi: megaraid: Fix up debug message in megaraid_abort_and_reset() scsi: aic79xx: Fix up NULL command in ahd_done() scsi: message: fusion: Initialize return value in mptfc_bus_reset() scsi: mpt3sas: Fix loop logic scsi: snic: Remove useless code in snic_dr_clean_pending_req() scsi: core: Add comment to target_destroy in scsi_host_template scsi: core: Clean up scsi_dev_queue_ready() scsi: pmcraid: Add missing scsi_device_put() in pmcraid_eh_target_reset_handler() scsi: target: core: Fix kernel-doc comment scsi: pmcraid: Fix kernel-doc comment scsi: core: Handle depopulation and restoration in progress scsi: ufs: core: Add support for parsing OPP scsi: ufs: core: Add OPP support for scaling clocks and regulators scsi: ufs: dt-bindings: common: Add OPP table scsi: scsi_debug: Add param to control sdev's allow_restart scsi: scsi_debug: Add debugfs interface to fail target reset scsi: scsi_debug: Add new error injection type: Reset LUN failed ... commit 90a300dc0553c5c4a3324ca6de5877c834d27af7 Merge: e5760335882b 9ea459e477dc Author: Linus Torvalds Date: Thu Nov 2 15:06:04 2023 -1000 Merge tag 'libnvdimm-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm updates from Ira Weiny: - updates to deprecated and changed interfaces - bug/kdoc fixes * tag 'libnvdimm-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: libnvdimm: remove kernel-doc warnings: testing: nvdimm: make struct class structures constant libnvdimm: Annotate struct nd_region with __counted_by nd_btt: Make BTT lanes preemptible libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its return value dax: refactor deprecated strncpy commit e5760335882bd91137873b8f2230b6c1f91da52b Merge: 431f1051884e b00839ca4cca Author: Linus Torvalds Date: Thu Nov 2 15:01:33 2023 -1000 Merge tag 'for-linus-6.7-1' of https://github.com/cminyard/linux-ipmi Pull IPMI update from Corey Minyard: "Only one change, and I would normally just wait, but it will make the people trying to get rid of strncpy happy. Its a good change, anyway" * tag 'for-linus-6.7-1' of https://github.com/cminyard/linux-ipmi: ipmi: refactor deprecated strncpy commit 431f1051884e38d2a5751e4731d69b2ff289ee56 Merge: 38984d787218 b9604be24158 Author: Linus Torvalds Date: Thu Nov 2 14:53:19 2023 -1000 Merge tag 'leds-next-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: "Core Frameworks: - Add support for a bunch more colours New Drivers: - Add support for Kinetic KTD2026/7 RGB/White LEDs New Functionality: - Add support for device to enter HW Controlled Mode to Turris Omnia LEDs - Add support for HW Gamma Correction to Turris Omnia LEDs Fix-ups: - Apply new __counted_by() annotation to several data structures containing flexible arrays - Rid the return value from Platform's .remove() operation - Use *_cansleep() variants for instances were threads can sleep - Improve the semantics when setting the brightness - Generic clean-ups; code reduction, coding style, standard patterns - Replace strncpy() with strscpy() - Fix-up / add various documentation - Re-author the GPIO associated Trigger to use trigger-sources - Move to using standard APIs and helpers - Improve error checking - Stop using static GPIO bases Bug Fixes: - Fix Pointer to Enum casing warnings - Do not pretend that I2C backed device supports SMBUS - Ensure PWM LEDs are extinguished when disabled, rather than held in a state - Fix 'output may be truncated' warnings" * tag 'leds-next-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (43 commits) leds: lp5521: Add an error check in lp5521_post_init_device leds: gpio: Update headers leds: gpio: Remove unneeded assignment leds: gpio: Move temporary variable for struct device to gpio_led_probe() leds: gpio: Refactor code to use devm_gpiod_get_index_optional() leds: gpio: Utilise PTR_ERR_OR_ZERO() leds: gpio: Keep driver firmware interface agnostic leds: core: Refactor led_update_brightness() to use standard pattern leds: turris-omnia: Fix brightness setting and trigger activating leds: sc27xx: Move mutex_init() down leds: trigger: netdev: Move size check in set_device_name leds: Add ktd202x driver dt-bindings: leds: Add Kinetic KTD2026/2027 LED leds: core: Add more colors from DT bindings to led_colors dt-bindings: leds: Last color ID is now 14 (LED_COLOR_ID_LIME) leds: tca6507: Don't use fixed GPIO base leds: lp3952: Convert to use maple tree register cache leds: lm392x: Convert to use maple tree register cache leds: aw200xx: Convert to use maple tree register cache leds: lm3601x: Convert to use maple tree register cache ... commit 38984d78721811c45c4a194784133254903697eb Merge: 27bc0782ef8e d5272d39995f Author: Linus Torvalds Date: Thu Nov 2 14:46:31 2023 -1000 Merge tag 'backlight-next-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "New Functionality: - Add new Device Tree binding for Monolithic Power (MPS) MP3309C step-up converter - Document brightness-levels in bindings for; generic, LED and PWM Bug Fixes: - Ensure PWMs are disabled on .shutdown(), .suspend() and .remove()" * tag 'backlight-next-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: dt-bindings: backlight: Add brightness-levels related common properties backlight: pwm_bl: Disable PWM on shutdown, suspend and remove dt-bindings: backlight: Add MPS MP3309C commit 27bc0782ef8ec26ed94b9fa16c75c11fdb3cd78b Merge: edd8e84ae951 2b481822446e Author: Linus Torvalds Date: Thu Nov 2 14:40:51 2023 -1000 Merge tag 'mfd-next-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "Core Frameworks: - Allow all MFD Cell properties to be filled in dynamically at runtime - Skip disabled device nodes and continue to look for subsequent devices New Device Support: - Add support for Lunar Lake-M PCI to Intel LPSS PCI - Add support for Denverton to Intel ICH LPC New Functionality: - Add support for Clocks to Texas Instruments TWL* Core - Add support for Interrupts to STMicroelectronics STM32 Timers Fix-ups: - Convert to new devm-* (managed) power-off API - Remove superfluous code - Bunch of Device Tree additions, conversions and adaptions - Simplify obtaining resources (memory, device data) using unified API helpers - Trivial coding-style / spelling type clean-ups - Constify / staticify changes - Expand or edit on existing documentation - Convert some Regmap configurations to use the Maple Tree cache - Apply new __counted_by() annotation to several data structures containing flexible arrays - Replace strncpy() with strscpy() Bug Fixes: - Remove double put creating reference imbalances - Ensure headphone/lineout detection gets set when booting with ACPI" * tag 'mfd-next-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (73 commits) mfd: lpc_ich: Mark *_gpio_offsets data with const spmi: rename spmi device lookup helper spmi: document spmi_device_from_of() refcounting dt-bindings: mfd: armltd: Move Arm board syscon's to separate schema mfd: rk8xx: Add support for RK806 power off mfd: rk8xx: Add support for standard system-power-controller property dt-bindings: mfd: rk806: Allow system-power-controller property dt-bindings: mfd: rk8xx: Deprecate rockchip,system-power-controller dt-bindings: mfd: max8925: Convert to DT schema format mfd: Use i2c_get_match_data() in a selection of drivers mfd: Use device_get_match_data() in a bunch of drivers mfd: mc13xxx-spi/wm831x-spi: Use spi_get_device_match_data() mfd: motorola-cpcap: Drop unnecessary of_match_device() call mfd: arizona-spi: Set pdata.hpdet_channel for ACPI enumerated devs mfd: qcom-spmi-pmic: Switch to EXPORT_SYMBOL_GPL() mfd: qcom-spmi-pmic: Fix revid implementation mfd: qcom-spmi-pmic: Fix reference leaks in revid helper mfd: intel-m10-bmc: Change contact for ABI docs mfd: max8907: Convert to use maple tree register cache mfd: max77686: Convert to use maple tree register cache ... commit edd8e84ae9514e93368f56c3715b11af52df6c3b Merge: 4ea4ed22b578 dc6e08b1a2ae Author: Linus Torvalds Date: Thu Nov 2 14:34:14 2023 -1000 Merge tag 'sound-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "Most of changes at this time are for ASoC, spread over ASoC core and drivers due to the API prefix standardization. Other than that, there have little change wrt API, rather lots of driver-specific updates and fixes. Some highlight below: ASoC: - Standardization of API prefix - GPIO API usage improvements - Support for HDA patches - Lots of work on SOF, including crash dump support - Fixes for noise when stopping some Sounwire CODECs - Support for AMD platforms with es83xx, AMD ACP 6.3 and 7.0, Awinc AT87390 and AW88399, many Intel platforms, many Mediatek platforms, Qualcomm SM6115 and SC7180 platforms, Richtek RTQ9128 and Texas Instruments TAS575x HD-audio and USB-audio: - Deferred probe support of audio component binding - More fixes and enhancements for Cirrus subcodecs - USB Scarlett2 mixer and McIntosh DSD quirk Others: - More enhancement of snd-aloop driver - Update MAINTAINERS entry for linux-sound mailing list" * tag 'sound-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (485 commits) ALSA: hda: cs35l41: Fix missing error code in cs35l41_smart_amp() ALSA: hda: cs35l41: mark cs35l41_verify_id() static ASoC: codecs: wsa883x: make use of new mute_unmute_on_trigger flag ASoC: soc-dai: add flag to mute and unmute stream during trigger ASoC: ams-delta.c: use component after check ASoC: amd: acp: select SND_SOC_AMD_ACP_LEGACY_COMMON for ACP63 ASoC: codecs: aw88399: fix typo in Kconfig select ASoC: amd: acp: add ACPI dependency ASoC: Intel: avs: Add rt5514 machine board ASoC: Intel: avs: Add rt5514 machine board ALSA: scarlett2: Add missing check with firmware version control ALSA: virtio: use ack callback ALSA: scarlett2: Remap Level Meter values ALSA: scarlett2: Allow passing any output to line_out_remap() ALSA: scarlett2: Add support for reading firmware version ALSA: scarlett2: Rename Gen 3 config sets ALSA: scarlett2: Rename scarlett_gen2 to scarlett2 ASoC: cs35l41: Detect CSPL errors when sending CSPL commands ALSA: hda: cs35l41: Check CSPL state after loading firmware ALSA: hda: cs35l41: Do not unload firmware before reset in system suspend ... commit 4ea4ed22b57846facd9cb4af5f67cb7bd2792cf3 Merge: 27beb3ca347f 1372e73a1813 Author: Linus Torvalds Date: Thu Nov 2 14:29:10 2023 -1000 Merge tag 'for-linus-2023110101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - fixes for crashes detected by CONFIG_KUNIT_ALL_TESTS in hid-uclogic driver (Jinjie Ruan) - HID selftests fixes and improvements (Benjamin Tissoires) - probe error handling path fixes in hid-nvidia-shield driver (Christophe JAILLET) - cleanup of LED handling in hid-nintendo (Martino Fontana) - big cleanup of logitech-hidpp probe code (Hans de Goede) - Suspend/Resume fix for USB Thinkpad Compact Keyboard (Jamie Lentin) - firmware detection improvement for Lenovo cptkbd (Mikhail Khvainitski) - IRQ shutdown and workqueue initialization fixes for hid-cp2112 driver (Danny Kaehn) - #ifdef CONFIG_PM removal from HID code (Thomas Weißschuh) - other assorted device-ID additions and quirks * tag 'for-linus-2023110101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (31 commits) HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W HID: logitech-hidpp: Stop IO before calling hid_connect() HID: logitech-hidpp: Drop HIDPP_QUIRK_UNIFYING HID: logitech-hidpp: Drop delayed_work_cb() HID: logitech-hidpp: Fix connect event race HID: logitech-hidpp: Remove unused connected param from *_connect() HID: logitech-hidpp: Remove connected check for non-unifying devices HID: logitech-hidpp: Add hidpp_non_unifying_init() helper HID: logitech-hidpp: Move hidpp_overwrite_name() to before connect check HID: logitech-hidpp: Move g920_get_config() to just before hidpp_ff_init() HID: logitech-hidpp: Remove wtp_get_config() call from probe() HID: logitech-hidpp: Move get_wireless_feature_index() check to hidpp_connect_event() HID: logitech-hidpp: Revert "Don't restart communication if not necessary" HID: logitech-hidpp: Don't restart IO, instead defer hid_connect() only HID: rmi: remove #ifdef CONFIG_PM HID: multitouch: remove #ifdef CONFIG_PM HID: usbhid: remove #ifdef CONFIG_PM HID: core: remove #ifdef CONFIG_PM from hid_driver hid: lenovo: Resend all settings on reset_resume for compact keyboards HID: uclogic: Fix a work->entry not empty bug in __queue_work() ... commit 27beb3ca347fa29fef5c23b351120239b8cf0612 Merge: 4652b8e4f3ff 50b3ef14c26b Author: Linus Torvalds Date: Thu Nov 2 14:05:18 2023 -1000 Merge tag 'pci-v6.7-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci updates from Bjorn Helgaas: "Enumeration: - Use acpi_evaluate_dsm_typed() instead of open-coding _DSM evaluation to learn device characteristics (Andy Shevchenko) - Tidy multi-function header checks using new PCI_HEADER_TYPE_MASK definition (Ilpo Järvinen) - Simplify config access error checking in various drivers (Ilpo Järvinen) - Use pcie_capability_clear_word() (not pcie_capability_clear_and_set_word()) when only clearing (Ilpo Järvinen) - Add pci_get_base_class() to simplify finding devices using base class only (ignoring subclass and programming interface) (Sui Jingfeng) - Add pci_is_vga(), which includes ancient PCI_CLASS_NOT_DEFINED_VGA devices from before the Class Code was added to PCI (Sui Jingfeng) - Use pci_is_vga() for vgaarb, sysfs "boot_vga", virtio, qxl to include ancient VGA devices (Sui Jingfeng) Resource management: - Make pci_assign_unassigned_resources() non-init because sparc uses it after init (Randy Dunlap) Driver binding: - Retain .remove() and .probe() callbacks (previously __init) because sysfs may cause them to be called later (Uwe Kleine-König) - Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device, so it can be claimed by dwc3 instead (Vicki Pfau) PCI device hotplug: - Add Ampere Altra Attention Indicator extension driver for acpiphp (D Scott Phillips) Power management: - Quirk VideoPropulsion Torrent QN16e with longer delay after reset (Lukas Wunner) - Prevent users from overriding drivers that say we shouldn't use D3cold (Lukas Wunner) - Avoid PME from D3hot/D3cold for AMD Rembrandt and Phoenix USB4 because wakeup interrupts from those states don't work if amd-pmc has put the platform in a hardware sleep state (Mario Limonciello) IOMMU: - Disable ATS for Intel IPU E2000 devices with invalidation message endianness erratum (Bartosz Pawlowski) Error handling: - Factor out interrupt enable/disable into helpers (Kai-Heng Feng) Peer-to-peer DMA: - Fix flexible-array usage in struct pci_p2pdma_pagemap in case we ever use pagemaps with multiple entries (Gustavo A. R. Silva) ASPM: - Revert a change that broke when drivers disabled L1 and users later enabled an L1.x substate via sysfs, and fix a similar issue when users disabled L1 via sysfs (Heiner Kallweit) Endpoint framework: - Fix double free in __pci_epc_create() (Dan Carpenter) - Use IS_ERR_OR_NULL() to simplify endpoint core (Ruan Jinjie) Cadence PCIe controller driver: - Drop unused "is_rc" member (Li Chen) Freescale Layerscape PCIe controller driver: - Enable 64-bit addressing in endpoint mode (Guanhua Gao) Intel VMD host bridge driver: - Fix multi-function header check (Ilpo Järvinen) Microsoft Hyper-V host bridge driver: - Annotate struct hv_dr_state with __counted_by (Kees Cook) NVIDIA Tegra194 PCIe controller driver: - Drop setting of LNKCAP_MLW (max link width) since dw_pcie_setup() already does this via dw_pcie_link_set_max_link_width() (Yoshihiro Shimoda) Qualcomm PCIe controller driver: - Use PCIE_SPEED2MBS_ENC() to simplify encoding of link speed (Manivannan Sadhasivam) - Add a .write_dbi2() callback so DBI2 register writes, e.g., for setting the BAR size, work correctly (Manivannan Sadhasivam) - Enable ASPM for platforms that use 1.9.0 ops, because the PCI core doesn't enable ASPM states that haven't been enabled by the firmware (Manivannan Sadhasivam) Renesas R-Car Gen4 PCIe controller driver: - Add DesignWare core support (set max link width, EDMA_UNROLL flag, .pre_init(), .deinit(), etc) for use by R-Car Gen4 driver (Yoshihiro Shimoda) - Add driver and DT schema for DesignWare-based Renesas R-Car Gen4 controller in both host and endpoint mode (Yoshihiro Shimoda) Xilinx NWL PCIe controller driver: - Update ECAM size to support 256 buses (Thippeswamy Havalige) - Stop setting bridge primary/secondary/subordinate bus numbers, since PCI core does this (Thippeswamy Havalige) Xilinx XDMA controller driver: - Add driver and DT schema for Zynq UltraScale+ MPSoCs devices with Xilinx XDMA Soft IP (Thippeswamy Havalige) Miscellaneous: - Use FIELD_GET()/FIELD_PREP() to simplify and reduce use of _SHIFT macros (Ilpo Järvinen, Bjorn Helgaas) - Remove logic_outb(), _outw(), outl() duplicate declarations (John Sanpe) - Replace unnecessary UTF-8 in Kconfig help text because menuconfig doesn't render it correctly (Liu Song)" * tag 'pci-v6.7-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (102 commits) PCI: qcom-ep: Add dedicated callback for writing to DBI2 registers PCI: Simplify pcie_capability_clear_and_set_word() to ..._clear_word() PCI: endpoint: Fix double free in __pci_epc_create() PCI: xilinx-xdma: Add Xilinx XDMA Root Port driver dt-bindings: PCI: xilinx-xdma: Add schemas for Xilinx XDMA PCIe Root Port Bridge PCI: xilinx-cpm: Move IRQ definitions to a common header PCI: xilinx-nwl: Modify ECAM size to enable support for 256 buses PCI: xilinx-nwl: Rename the NWL_ECAM_VALUE_DEFAULT macro dt-bindings: PCI: xilinx-nwl: Modify ECAM size in the DT example PCI: xilinx-nwl: Remove redundant code that sets Type 1 header fields PCI: hotplug: Add Ampere Altra Attention Indicator extension driver PCI/AER: Factor out interrupt toggling into helpers PCI: acpiphp: Allow built-in drivers for Attention Indicators PCI/portdrv: Use FIELD_GET() PCI/VC: Use FIELD_GET() PCI/PTM: Use FIELD_GET() PCI/PME: Use FIELD_GET() PCI/ATS: Use FIELD_GET() PCI/ATS: Show PASID Capability register width in bitmasks PCI/ASPM: Fix L1 substate handling in aspm_attr_store_common() ... commit 4b92894064b3df472b2cf5741c7f080e16dcd1ec Author: Dan Williams Date: Thu Nov 2 15:07:02 2023 -0700 lib/fw_table: Remove acpi_parse_entries_array() export Stephen reports that the ACPI helper library rework, CONFIG_FIRMWARE_TABLE, introduces a new compiler warning: WARNING: modpost: vmlinux: acpi_parse_entries_array: EXPORT_SYMBOL used for init symbol. Remove __init or EXPORT_SYMBOL. Delete this export as it turns out it is unneeded, and future work wraps this in another exported helper. Note that in general EXPORT_SYMBOL_ACPI_LIB() is needed for exporting symbols that are marked __init_or_acpilib, but in this case no export is required. Fixes: a103f46633fd ("acpi: Move common tables helper functions to common lib") Cc: Dave Jiang Reported-by: Stephen Rothwell Closes: http://lore.kernel.org/r/20231030160523.670a7569@canb.auug.org.au Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/169896282222.70775.940454758280866379.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams lib/fw_table.c | 1 - 1 file changed, 1 deletion(-) commit b3741ac86c8e648709506102f7ab51905d50df43 Author: Terry Bowman Date: Thu Nov 2 10:52:32 2023 -0500 cxl/pci: Change CXL AER support check to use native AER Native CXL protocol errors are delivered to the OS through AER reporting. The owner of AER owns CXL Protocol error management with respect to _OSC negotiation.[1] CXL device errors are handled by a separate interrupt with native control gated by _OSC control field 'CXL Memory Error Reporting Control'. The CXL driver incorrectly checks for 'CXL Memory Error Reporting Control' before accessing AER registers and caching RCH downport AER registers. Replace the current check in these 2 cases with native AER checks. [1] CXL 3.0 - 9.17.2 CXL _OSC, Table-9-26, Interpretation of CXL _OSC Support Fields, p.641 Fixes: f05fd10d138d ("cxl/pci: Add RCH downstream port AER register discovery") Signed-off-by: Terry Bowman Reviewed-by: Smita Koralahalli Link: https://lore.kernel.org/r/20231102155232.1421261-1-terry.bowman@amd.com Signed-off-by: Dan Williams drivers/cxl/core/pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e1c05b3bf80f829ced464bdca90f1dfa96e8d251 Author: Andrew Jones Date: Tue Oct 10 18:51:02 2023 +0200 RISC-V: hwprobe: Fix vDSO SIGSEGV A hwprobe pair key is signed, but the hwprobe vDSO function was only checking that the upper bound was valid. In order to help avoid this type of problem in the future, and in anticipation of this check becoming more complicated with sparse keys, introduce and use a "key is valid" predicate function for the check. Fixes: aa5af0aa90ba ("RISC-V: Add hwprobe vDSO function and data") Signed-off-by: Andrew Jones Reviewed-by: Evan Green Link: https://lore.kernel.org/r/20231010165101.14942-2-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/hwprobe.h | 5 +++++ arch/riscv/kernel/vdso/hwprobe.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) commit 653301077c1f3e18af33f7950014cda8b4bf4935 Author: Lad Prabhakar Date: Fri Sep 29 01:07:04 2023 +0100 riscv: configs: defconfig: Enable configs required for RZ/Five SoC Enable the configs required by the below IP blocks which are present on RZ/Five SoC: * ADC * CANFD * DMAC * eMMC/SDHI * OSTM * RAVB (+ Micrel PHY) * RIIC * RSPI * SSI (Sound+WM8978 codec) * Thermal * USB (PHY/RESET/OTG) Along with the above some core configs are enabled too, -> CPU frequency scaling as RZ/Five does support this. -> MTD is enabled as RSPI can be connected to flash chips -> Enabled I2C chardev so that it enables userspace to read/write i2c devices (similar to arm64) -> Thermal configs as RZ/Five SoC does have thermal unit -> GPIO regulator as we might have IP blocks for which voltage levels are controlled by GPIOs -> OTG configs as RZ/Five USB can support host/function -> Gadget configs so that we can test USB function (as done in arm64 all the gadget configs are enabled) Signed-off-by: Lad Prabhakar Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230929000704.53217-6-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Palmer Dabbelt arch/riscv/configs/defconfig | 52 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) commit 24005d184aaa80984e0511c4ec6e6a0860fdddb8 Merge: 4630d6daaba8 245561ba6d5d Author: Palmer Dabbelt Date: Thu Nov 2 14:05:23 2023 -0700 Merge patch series "riscv: SCS support" Sami Tolvanen says: This series adds Shadow Call Stack (SCS) support for RISC-V. SCS uses compiler instrumentation to store return addresses in a separate shadow stack to protect them against accidental or malicious overwrites. More information about SCS can be found here: https://clang.llvm.org/docs/ShadowCallStack.html Patch 1 is from Deepak, and it simplifies VMAP_STACK overflow handling by adding support for accessing per-CPU variables directly in assembly. The patch is included in this series to make IRQ stack switching cleaner with SCS, and I've simply rebased it and fixed a couple of minor issues. Patch 2 uses this functionality to clean up the stack switching by moving duplicate code into a single function. On RISC-V, the compiler uses the gp register for storing the current shadow call stack pointer, which is incompatible with global pointer relaxation. Patch 3 moves global pointer loading into a macro that can be easily disabled with SCS. Patch 4 implements SCS register loading and switching, and allows the feature to be enabled, and patch 5 adds separate per-CPU IRQ shadow call stacks when CONFIG_IRQ_STACKS is enabled. Patch 6 fixes the backward-edge CFI test in lkdtm for RISC-V. Note that this series requires Clang 17. Earlier Clang versions support SCS on RISC-V, but use the x18 register instead of gp, which isn't ideal. gcc has SCS support for arm64, but I'm not aware of plans to support RISC-V. Once the Zicfiss extension is ratified, it's probably preferable to use hardware-backed shadow stacks instead of SCS on hardware that supports the extension, and we may want to consider implementing CONFIG_DYNAMIC_SCS to patch between the implementation at runtime (similarly to the arm64 implementation, which switches to SCS when hardware PAC support isn't available). * b4-shazam-merge: lkdtm: Fix CFI_BACKWARD on RISC-V riscv: Use separate IRQ shadow call stacks riscv: Implement Shadow Call Stack riscv: Move global pointer loading to a macro riscv: Deduplicate IRQ stack switching riscv: VMAP_STACK overflow detection thread-safe Link: https://lore.kernel.org/r/20230927224757.1154247-8-samitolvanen@google.com Signed-off-by: Palmer Dabbelt commit 4630d6daaba81560379d7ee5107100671c305992 Merge: b8c2f6617fd7 27fb27197cbb Author: Palmer Dabbelt Date: Fri Oct 27 06:22:52 2023 -0700 Merge patch "riscv: errata: improve T-Head CMO" This fixes an encoding issue with T-Head's dcache.cva and fixes the comment about the T-Head encodings. The first of these was a fix and got picked up earlier, I'm merging the second on top of it as they touch the same comment. * b4-shazam-merge: riscv: errata: prefix T-Head mnemonics with th. riscv: errata: fix T-Head dcache.cva encoding Link: https://lore.kernel.org/r/20230827090813.1353-1-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit 27fb27197cbbdfd917417ac2492f9bf15d23e5c4 Author: Icenowy Zheng Date: Sun Aug 27 17:08:13 2023 +0800 riscv: errata: prefix T-Head mnemonics with th. T-Head now maintains some specification for their extended instructions at [1], in which all instructions are prefixed "th.". Follow this practice in the kernel comments. Link: https://github.com/T-head-Semi/thead-extension-spec [1] Signed-off-by: Icenowy Zheng Reviewed-by: Guo Ren Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/errata_list.h | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit 92099f0c92270c8c7a79e6bc6e0312ad248ea331 Author: Andreas Gruenbacher Date: Fri Oct 20 01:32:15 2023 +0200 gfs2: Add metapath_dibh helper Add a metapath_dibh() helper for extracting the inode's buffer head from a metapath. Signed-off-by: Andreas Gruenbacher fs/gfs2/bmap.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 1f7b0a84c86eca74155dc292cd2f965d6bb79884 Author: Andreas Gruenbacher Date: Fri Oct 20 21:02:59 2023 +0200 gfs2: Clean up quota.c:print_message Function print_message() in quota.c doesn't return a meaningful return value. Turn it into a void function and stop abusing it for setting variable error to 0 in gfs2_quota_check(). Signed-off-by: Andreas Gruenbacher fs/gfs2/quota.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit f7e4c610cb9afcb94d45c6252c312b95038d52bc Author: Andreas Gruenbacher Date: Fri Oct 20 22:02:04 2023 +0200 gfs2: Clean up gfs2_alloc_parms initializers When intializing a struct, all fields that are not explicitly mentioned are zeroed out already. Signed-off-by: Andreas Gruenbacher fs/gfs2/file.c | 4 ++-- fs/gfs2/quota.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) commit 703df114f9b70b4b672d71bdf751497cf7643b75 Author: Andreas Gruenbacher Date: Sun Oct 22 00:06:41 2023 +0200 gfs2: Two quota=account mode fixes Make sure we don't skip accounting for quota changes with the quota=account mount option. Reviewed-by: Bob Peterson Signed-off-by: Andreas Gruenbacher fs/gfs2/quota.c | 6 ++---- fs/gfs2/quota.h | 3 +-- 2 files changed, 3 insertions(+), 6 deletions(-) commit 4652b8e4f3ffa48c706ec334f048c217a7d9750d Merge: 71fb7b320b28 67797da8a4b8 Author: Linus Torvalds Date: Thu Nov 2 08:32:07 2023 -1000 Merge tag '6.7-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server updates from Steve French: "Seven ksmbd server fixes: - logoff improvement for multichannel bound connections - unicode fix for surrogate pairs - RDMA (smbdirect) fix for IB devices - fix locking deadlock in kern_path_create during rename - iov memory allocation fix - two minor cleanup patches (doc cleanup, and unused variable)" * tag '6.7-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: no need to wait for binded connection termination at logoff ksmbd: add support for surrogate pair conversion ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev() ksmbd: fix recursive locking in vfs helpers ksmbd: fix kernel-doc comment of ksmbd_vfs_setxattr() ksmbd: reorganize ksmbd_iov_pin_rsp() ksmbd: Remove unused field in ksmbd_user struct commit 71fb7b320b2820903210acd60427e09b1962cfd3 Merge: 5efad0a7658c 1758cd2e95d3 Author: Linus Torvalds Date: Thu Nov 2 08:27:04 2023 -1000 Merge tag 'fsnotify_for_v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify update from Jan Kara: "This time just one tiny cleanup for fsnotify" * tag 'fsnotify_for_v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fanotify: delete useless parenthesis in FANOTIFY_INLINE_FH macro commit 5efad0a7658cea6dfd22d4e75d247692e48dde10 Merge: e9806ff8a0f9 82dd620653b3 Author: Linus Torvalds Date: Thu Nov 2 08:19:51 2023 -1000 Merge tag 'fs_for_v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull ext2, udf, and quota updates from Jan Kara: - conversion of ext2 directory code to use folios - cleanups in UDF declarations - bugfix for quota interaction with file encryption * tag 'fs_for_v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: ext2: Convert ext2_prepare_chunk and ext2_commit_chunk to folios ext2: Convert ext2_make_empty() to use a folio ext2: Convert ext2_unlink() and ext2_rename() to use folios ext2: Convert ext2_delete_entry() to use folios ext2: Convert ext2_empty_dir() to use a folio ext2: Convert ext2_add_link() to use a folio ext2: Convert ext2_readdir to use a folio ext2: Add ext2_get_folio() ext2: Convert ext2_check_page to ext2_check_folio highmem: Add folio_release_kmap() udf: Avoid unneeded variable length array in struct fileIdentDesc udf: Annotate struct udf_bitmap with __counted_by quota: explicitly forbid quota files from being encrypted commit e9806ff8a0f9e6eb193326383a7b88bf30ad0533 Merge: dc737f11c218 a779ed754e52 Author: Linus Torvalds Date: Thu Nov 2 08:08:28 2023 -1000 Merge tag 'jfs-6.7' of https://github.com/kleikamp/linux-shaggy Pull jfs updates from Dave Kleikamp: "Minor stability improvements" * tag 'jfs-6.7' of https://github.com/kleikamp/linux-shaggy: jfs: define xtree root and page independently jfs: fix array-index-out-of-bounds in diAlloc jfs: fix array-index-out-of-bounds in dbFindLeaf fs/jfs: Add validity check for db_maxag and db_agpref fs/jfs: Add check for negative db_l2nbperpage commit dc737f11c218969d01799dd8eb478582b67aaa24 Merge: 87a201b43bbe ee785c15b590 Author: Linus Torvalds Date: Thu Nov 2 08:00:53 2023 -1000 Merge tag 'exfat-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat updates from Namjae Jeon: - Add ioctls to get and set file attribute that is used in the fatattr util - Add zero_size_dir mount option to avoid allocating a cluster when creating a directory * tag 'exfat-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: support create zero-size directory exfat: support handle zero-size directory exfat: add ioctls for accessing attributes commit 87a201b43bbe14ddf8dc2d73fa15741b7403afc3 Merge: 57aff9974504 1a0ac8bd7a4f Author: Linus Torvalds Date: Thu Nov 2 07:53:57 2023 -1000 Merge tag 'erofs-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: "Nothing exciting lands for this cycle, since we're still busying in developing support for sub-page blocks and large-folios of compressed data for new scenarios on Android. In this cycle, MicroLZMA format is marked as stable, and there are minor cleanups around documentation and codebase. In addition, it also fixes incorrect lockref usage in erofs_insert_workgroup(). Summary: - Fix inode metadata space layout documentation - Avoid warning for MicroLZMA format anymore - Fix erofs_insert_workgroup() lockref usage - Some cleanups" * tag 'erofs-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix erofs_insert_workgroup() lockref usage erofs: tidy up redundant includes erofs: get rid of ROOT_NID() erofs: simplify compression configuration parser erofs: don't warn MicroLZMA format anymore erofs: fix inode metadata space layout description in documentation commit 57aff997450420b8a7da6a72f45c3677ac1c2f86 Merge: 91a683cdf602 91562895f803 Author: Linus Torvalds Date: Thu Nov 2 07:45:14 2023 -1000 Merge tag 'ext4_for_linus-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "Cleanup ext4's multi-block allocator, including adding some unit tests, as well as cleaning how we update the backup superblock after online resizes or updating the label or uuid. Optimize handling of released data blocks in ext4's commit machinery to avoid a potential lock contention on s_md_lock spinlock. Fix a number of ext4 bugs: - fix race between writepages and remount - fix racy may inline data check in dio write - add missed brelse in an error path in update_backups - fix umask handling when ACL support is disabled - fix lost EIO error when a journal commit races with a fsync of the blockdev - fix potential improper i_size when there is a crash right after an O_SYNC direct write. - check extent node for validity before potentially using what might be an invalid pointer - fix potential stale data exposure when writing to an unwritten extent and the file system is nearly out of space - fix potential accounting error around block reservations when writing partial delayed allocation writes to a bigalloc cluster - avoid memory allocation failure when tracking partial delayed allocation writes to a bigalloc cluster - fix various debugging print messages" * tag 'ext4_for_linus-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (41 commits) ext4: properly sync file size update after O_SYNC direct IO ext4: fix racy may inline data check in dio write ext4: run mballoc test with different layouts setting ext4: add first unit test for ext4_mb_new_blocks_simple in mballoc ext4: add some kunit stub for mballoc kunit test ext4: call ext4_mb_mark_context in ext4_group_add_blocks() ext4: Separate block bitmap and buddy bitmap freeing in ext4_group_add_blocks() ext4: call ext4_mb_mark_context in ext4_mb_clear_bb ext4: Separate block bitmap and buddy bitmap freeing in ext4_mb_clear_bb() ext4: call ext4_mb_mark_context in ext4_mb_mark_diskspace_used ext4: extend ext4_mb_mark_context to support allocation under journal ext4: call ext4_mb_mark_context in ext4_free_blocks_simple ext4: factor out codes to update block bitmap and group descriptor on disk from ext4_mb_mark_bb ext4: make state in ext4_mb_mark_bb to be bool jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev ext4: apply umask if ACL support is disabled ext4: mark buffer new if it is unwritten to avoid stale data exposure ext4: move 'ix' sanity check to corrent position jbd2: fix printk format type for 'io_block' in do_one_pass() jbd2: print io_block if check data block checksum failed when do recovery ... commit 91a683cdf602a593ea1f7783346a605e0cd470df Merge: 17fc8084aa8f eb53c01873ca Author: Linus Torvalds Date: Thu Nov 2 07:40:07 2023 -1000 Merge tag 'dlm-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm Pull dlm updates from David Teigland: "This set of patches has some minor fixes for message handling, some misc cleanups, and updates the maintainers entry" * tag 'dlm-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: MAINTAINERS: Update dlm maintainer and web page dlm: slow down filling up processing queue dlm: fix no ack after final message dlm: be sure we reset all nodes at forced shutdown dlm: fix remove member after close call dlm: fix creating multiple node structures fs: dlm: Remove some useless memset() fs: dlm: Fix the size of a buffer in dlm_create_debug_file() fs: dlm: Simplify buffer size computation in dlm_create_debug_file() commit 17fc8084aa8f9d5235f252fc3978db657dd77e92 Author: Andrea Righi Date: Thu Nov 2 09:19:14 2023 +0100 module/decompress: use kvmalloc() consistently We consistently switched from kmalloc() to vmalloc() in module decompression to prevent potential memory allocation failures with large modules, however vmalloc() is not as memory-efficient and fast as kmalloc(). Since we don't know in general the size of the workspace required by the decompression algorithm, it is more reasonable to use kvmalloc() consistently, also considering that we don't have special memory requirements here. Suggested-by: Linus Torvalds Tested-by: Andrea Righi Signed-off-by: Andrea Righi Signed-off-by: Linus Torvalds kernel/module/decompress.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit ca219be012786654d5c802ee892433aaa0016d10 Merge: 21e80f3841c0 b836c4d29f27 Author: Linus Torvalds Date: Thu Nov 2 06:53:22 2023 -1000 Merge tag 'integrity-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity updates from Mimi Zohar: "Four integrity changes: two IMA-overlay updates, an integrity Kconfig cleanup, and a secondary keyring update" * tag 'integrity-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: detect changes to the backing overlay file certs: Only allow certs signed by keys on the builtin keyring integrity: fix indentation of config attributes ima: annotate iint mutex to avoid lockdep false positive warnings commit d84b139f53e8fa8048f16814c6b2a53d7bc15c3d Author: Björn Töpel Date: Thu Nov 2 11:35:37 2023 +0100 selftests/bpf: Fix broken build where char is unsigned There are architectures where char is not signed. If so, the following error is triggered: | xdp_hw_metadata.c:435:42: error: result of comparison of constant -1 \ | with expression of type 'char' is always true \ | [-Werror,-Wtautological-constant-out-of-range-compare] | 435 | while ((opt = getopt(argc, argv, "mh")) != -1) { | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~ | 1 error generated. Correct by changing the char to int. Fixes: bb6a88885fde ("selftests/bpf: Add options and frags to xdp_hw_metadata") Signed-off-by: Björn Töpel Acked-by: Larysa Zaremba Tested-by: Anders Roxell Link: https://lore.kernel.org/r/20231102103537.247336-1-bjorn@kernel.org Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/xdp_hw_metadata.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d9a6d78096056a3cb5c5f07a730ab92f2f9ac4e6 Author: Shyam Prasad N Date: Mon Oct 30 11:00:11 2023 +0000 cifs: force interface update before a fresh session setup During a session reconnect, it is possible that the server moved to another physical server (happens in case of Azure files). So at this time, force a query of server interfaces again (in case of multichannel session), such that the secondary channels connect to the right IP addresses (possibly updated now). Cc: stable@vger.kernel.org Signed-off-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/connect.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 6e5e64c9477d58e73cb1a0e83eacad1f8df247cf Author: Shyam Prasad N Date: Mon Oct 30 11:00:10 2023 +0000 cifs: do not reset chan_max if multichannel is not supported at mount If the mount command has specified multichannel as a mount option, but multichannel is found to be unsupported by the server at the time of mount, we set chan_max to 1. Which means that the user needs to remount the share if the server starts supporting multichannel. This change removes this reset. What it means is that if the user specified multichannel or max_channels during mount, and at this time, multichannel is not supported, but the server starts supporting it at a later point, the client will be capable of scaling out the number of channels. Cc: stable@vger.kernel.org Signed-off-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/sess.c | 1 - 1 file changed, 1 deletion(-) commit c3326a61cdbf3ce1273d9198b6cbf90965d7e029 Author: Shyam Prasad N Date: Mon Oct 30 11:00:09 2023 +0000 cifs: reconnect helper should set reconnect for the right channel We introduced a helper function to be used by non-cifsd threads to mark the connection for reconnect. For multichannel, when only a particular channel needs to be reconnected, this had a bug. This change fixes that by marking that particular channel for reconnect. Fixes: dca65818c80c ("cifs: use a different reconnect helper for non-cifsd threads") Cc: stable@vger.kernel.org Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/connect.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 5c86919455c1edec99ebd3338ad213b59271a71b Author: Paulo Alcantara Date: Mon Oct 30 17:19:56 2023 -0300 smb: client: fix use-after-free in smb2_query_info_compound() The following UAF was triggered when running fstests generic/072 with KASAN enabled against Windows Server 2022 and mount options 'multichannel,max_channels=2,vers=3.1.1,mfsymlinks,noperm' BUG: KASAN: slab-use-after-free in smb2_query_info_compound+0x423/0x6d0 [cifs] Read of size 8 at addr ffff888014941048 by task xfs_io/27534 CPU: 0 PID: 27534 Comm: xfs_io Not tainted 6.6.0-rc7 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 Call Trace: dump_stack_lvl+0x4a/0x80 print_report+0xcf/0x650 ? srso_alias_return_thunk+0x5/0x7f ? srso_alias_return_thunk+0x5/0x7f ? __phys_addr+0x46/0x90 kasan_report+0xda/0x110 ? smb2_query_info_compound+0x423/0x6d0 [cifs] ? smb2_query_info_compound+0x423/0x6d0 [cifs] smb2_query_info_compound+0x423/0x6d0 [cifs] ? __pfx_smb2_query_info_compound+0x10/0x10 [cifs] ? srso_alias_return_thunk+0x5/0x7f ? __stack_depot_save+0x39/0x480 ? kasan_save_stack+0x33/0x60 ? kasan_set_track+0x25/0x30 ? ____kasan_slab_free+0x126/0x170 smb2_queryfs+0xc2/0x2c0 [cifs] ? __pfx_smb2_queryfs+0x10/0x10 [cifs] ? __pfx___lock_acquire+0x10/0x10 smb311_queryfs+0x210/0x220 [cifs] ? __pfx_smb311_queryfs+0x10/0x10 [cifs] ? srso_alias_return_thunk+0x5/0x7f ? __lock_acquire+0x480/0x26c0 ? lock_release+0x1ed/0x640 ? srso_alias_return_thunk+0x5/0x7f ? do_raw_spin_unlock+0x9b/0x100 cifs_statfs+0x18c/0x4b0 [cifs] statfs_by_dentry+0x9b/0xf0 fd_statfs+0x4e/0xb0 __do_sys_fstatfs+0x7f/0xe0 ? __pfx___do_sys_fstatfs+0x10/0x10 ? srso_alias_return_thunk+0x5/0x7f ? lockdep_hardirqs_on_prepare+0x136/0x200 ? srso_alias_return_thunk+0x5/0x7f do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Allocated by task 27534: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x8f/0xa0 open_cached_dir+0x71b/0x1240 [cifs] smb2_query_info_compound+0x5c3/0x6d0 [cifs] smb2_queryfs+0xc2/0x2c0 [cifs] smb311_queryfs+0x210/0x220 [cifs] cifs_statfs+0x18c/0x4b0 [cifs] statfs_by_dentry+0x9b/0xf0 fd_statfs+0x4e/0xb0 __do_sys_fstatfs+0x7f/0xe0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 27534: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x50 ____kasan_slab_free+0x126/0x170 slab_free_freelist_hook+0xd0/0x1e0 __kmem_cache_free+0x9d/0x1b0 open_cached_dir+0xff5/0x1240 [cifs] smb2_query_info_compound+0x5c3/0x6d0 [cifs] smb2_queryfs+0xc2/0x2c0 [cifs] This is a race between open_cached_dir() and cached_dir_lease_break() where the cache entry for the open directory handle receives a lease break while creating it. And before returning from open_cached_dir(), we put the last reference of the new @cfid because of !@cfid->has_lease. Besides the UAF, while running xfstests a lot of missed lease breaks have been noticed in tests that run several concurrent statfs(2) calls on those cached fids CIFS: VFS: \\w22-root1.gandalf.test No task to wake, unknown frame... CIFS: VFS: \\w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1... CIFS: VFS: \\w22-root1.gandalf.test smb buf 00000000715bfe83 len 108 CIFS: VFS: Dump pending requests: CIFS: VFS: \\w22-root1.gandalf.test No task to wake, unknown frame... CIFS: VFS: \\w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1... CIFS: VFS: \\w22-root1.gandalf.test smb buf 000000005aa7316e len 108 ... To fix both, in open_cached_dir() ensure that @cfid->has_lease is set right before sending out compounded request so that any potential lease break will be get processed by demultiplex thread while we're still caching @cfid. And, if open failed for some reason, re-check @cfid->has_lease to decide whether or not put lease reference. Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/cached_dir.c | 84 +++++++++++++++++++++++++++------------------- 1 file changed, 49 insertions(+), 35 deletions(-) commit c37ed2d7d09869f30d291b9c6cba56ea4f0b0417 Author: Paulo Alcantara Date: Mon Oct 30 17:19:53 2023 -0300 smb: client: remove extra @chan_count check in __cifs_put_smb_ses() If @ses->chan_count <= 1, then for-loop body will not be executed so no need to check it twice. Reviewed-by: Shyam Prasad N Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/connect.c | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) commit efa5f1311c4998e9e6317c52bc5ee93b3a0f36df Author: Patrick Thompson Date: Mon Oct 30 16:50:14 2023 -0400 net: r8169: Disable multicast filter for RTL8168H and RTL8107E RTL8168H and RTL8107E ethernet adapters erroneously filter unicast eapol packets unless allmulti is enabled. These devices correspond to RTL_GIGA_MAC_VER_46 and VER_48. Add an exception for VER_46 and VER_48 in the same way that VER_35 has an exception. Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E") Signed-off-by: Patrick Thompson Reviewed-by: Jacob Keller Reviewed-by: Heiner Kallweit Link: https://lore.kernel.org/r/20231030205031.177855-1-ptf@google.com Signed-off-by: Paolo Abeni drivers/net/ethernet/realtek/r8169_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 2966bd3698451a2172a57e7e97eebb4adbfc48a2 Merge: 86098bcddeb1 98a0465531a5 Author: Petr Mladek Date: Thu Nov 2 13:04:59 2023 +0100 Merge branch 'rework/nbcon-base' into for-linus commit 86098bcddeb10ae7975d701c3440d912bd2ebe12 Merge: adb982ad4b9d 29fda1ad2a64 Author: Petr Mladek Date: Thu Nov 2 13:00:34 2023 +0100 Merge branch 'rework/misc-cleanups' into for-linus commit adb982ad4b9d691f707061fbe90eff80d391a0ef Merge: 9277abd2c172 72fcce70faf0 Author: Petr Mladek Date: Thu Nov 2 13:00:20 2023 +0100 Merge branch 'for-6.7' into for-linus commit ff2c051fdc70081addbffbb09da1ade704eeaa08 Merge: a1602d749097 23be1e0e2a83 Author: Paolo Abeni Date: Thu Nov 2 12:56:03 2023 +0100 Merge branch 'dccp-tcp-relocate-security_inet_conn_request' Kuniyuki Iwashima says: ==================== dccp/tcp: Relocate security_inet_conn_request(). security_inet_conn_request() reads reqsk's remote address, but it's not initialised in some places. Let's make sure the address is set before security_inet_conn_request(). ==================== Link: https://lore.kernel.org/r/20231030201042.32885-1-kuniyu@amazon.com Signed-off-by: Paolo Abeni commit 23be1e0e2a83a8543214d2599a31d9a2185a796b Author: Kuniyuki Iwashima Date: Mon Oct 30 13:10:42 2023 -0700 dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. Initially, commit 4237c75c0a35 ("[MLSXFRM]: Auto-labeling of child sockets") introduced security_inet_conn_request() in some functions where reqsk is allocated. The hook is added just after the allocation, so reqsk's IPv6 remote address was not initialised then. However, SELinux/Smack started to read it in netlbl_req_setattr() after commit e1adea927080 ("calipso: Allow request sockets to be relabelled by the lsm."). Commit 284904aa7946 ("lsm: Relocate the IPv4 security_inet_conn_request() hooks") fixed that kind of issue only in TCPv4 because IPv6 labeling was not supported at that time. Finally, the same issue was introduced again in IPv6. Let's apply the same fix on DCCPv6 and TCPv6. Fixes: e1adea927080 ("calipso: Allow request sockets to be relabelled by the lsm.") Signed-off-by: Kuniyuki Iwashima Acked-by: Paul Moore Signed-off-by: Paolo Abeni net/dccp/ipv6.c | 6 +++--- net/ipv6/syncookies.c | 7 ++++--- 2 files changed, 7 insertions(+), 6 deletions(-) commit fa2df45af13091f76b89adb84a28f13818d5d631 Author: Kuniyuki Iwashima Date: Mon Oct 30 13:10:41 2023 -0700 dccp: Call security_inet_conn_request() after setting IPv4 addresses. Initially, commit 4237c75c0a35 ("[MLSXFRM]: Auto-labeling of child sockets") introduced security_inet_conn_request() in some functions where reqsk is allocated. The hook is added just after the allocation, so reqsk's IPv4 remote address was not initialised then. However, SELinux/Smack started to read it in netlbl_req_setattr() after the cited commits. This bug was partially fixed by commit 284904aa7946 ("lsm: Relocate the IPv4 security_inet_conn_request() hooks"). This patch fixes the last bug in DCCPv4. Fixes: 389fb800ac8b ("netlabel: Label incoming TCP connections correctly in SELinux") Fixes: 07feee8f812f ("netlabel: Cleanup the Smack/NetLabel code to fix incoming TCP connections") Signed-off-by: Kuniyuki Iwashima Acked-by: Paul Moore Signed-off-by: Paolo Abeni net/dccp/ipv4.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit a1602d749097386ec9e8e411a16a9c37ff6cd5fc Author: Gerd Bayer Date: Mon Oct 30 18:03:43 2023 +0100 net/smc: fix documentation of buffer sizes Since commit 833bac7ec392 ("net/smc: Fix setsockopt and sysctl to specify same buffer size again") the SMC protocol uses its own default values for the smc.rmem and smc.wmem sysctl variables which are no longer derived from the TCP IPv4 buffer sizes. Fixup the kernel documentation to reflect this change, too. Fixes: 833bac7ec392 ("net/smc: Fix setsockopt and sysctl to specify same buffer size again") Signed-off-by: Gerd Bayer Reviewed-by: Wenjia Zhang Reviewed-by: Dust Li Link: https://lore.kernel.org/r/20231030170343.748097-1-gbayer@linux.ibm.com Signed-off-by: Paolo Abeni Documentation/networking/smc-sysctl.rst | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 8ffbd1669ed1d58939d6e878dffaa2f60bf961a4 Author: Jian Shen Date: Mon Oct 30 17:12:56 2023 +0800 net: page_pool: add missing free_percpu when page_pool_init fail When ptr_ring_init() returns failure in page_pool_init(), free_percpu() is not called to free pool->recycle_stats, which may cause memory leak. Fixes: ad6fa1e1ab1b ("page_pool: Add recycle stats") Signed-off-by: Jian Shen Signed-off-by: Jijie Shao Reviewed-by: Yunsheng Lin Reviewed-by: Jiri Pirko Reviewed-by: Somnath Kotur Reviewed-by: Ilias Apalodimas Link: https://lore.kernel.org/r/20231030091256.2915394-1-shaojijie@huawei.com Signed-off-by: Paolo Abeni net/core/page_pool.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit f55d8e60f10909dbc5524e261041e1d28d7d20d8 Author: Andrew Lunn Date: Sat Oct 28 21:25:11 2023 +0200 net: ethtool: Fix documentation of ethtool_sprintf() This function takes a pointer to a pointer, unlike sprintf() which is passed a plain pointer. Fix up the documentation to make this clear. Fixes: 7888fe53b706 ("ethtool: Add common function for filling out strings") Cc: Alexander Duyck Cc: Justin Stitt Cc: stable@vger.kernel.org Signed-off-by: Andrew Lunn Reviewed-by: Justin Stitt Link: https://lore.kernel.org/r/20231028192511.100001-1-andrew@lunn.ch Signed-off-by: Paolo Abeni include/linux/ethtool.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 5a22fbcc10f3f7d94c5d88afbbffa240a3677057 Author: Alexander Sverdlin Date: Fri Oct 27 08:57:38 2023 +0200 net: dsa: lan9303: consequently nested-lock physical MDIO When LAN9303 is MDIO-connected two callchains exist into mdio->bus->write(): 1. switch ports 1&2 ("physical" PHYs): virtual (switch-internal) MDIO bus (lan9303_switch_ops->phy_{read|write})-> lan9303_mdio_phy_{read|write} -> mdiobus_{read|write}_nested 2. LAN9303 virtual PHY: virtual MDIO bus (lan9303_phy_{read|write}) -> lan9303_virt_phy_reg_{read|write} -> regmap -> lan9303_mdio_{read|write} If the latter functions just take mutex_lock(&sw_dev->device->bus->mdio_lock) it triggers a LOCKDEP false-positive splat. It's false-positive because the first mdio_lock in the second callchain above belongs to virtual MDIO bus, the second mdio_lock belongs to physical MDIO bus. Consequent annotation in lan9303_mdio_{read|write} as nested lock (similar to lan9303_mdio_phy_{read|write}, it's the same physical MDIO bus) prevents the following splat: WARNING: possible circular locking dependency detected 5.15.71 #1 Not tainted ------------------------------------------------------ kworker/u4:3/609 is trying to acquire lock: ffff000011531c68 (lan9303_mdio:131:(&lan9303_mdio_regmap_config)->lock){+.+.}-{3:3}, at: regmap_lock_mutex but task is already holding lock: ffff0000114c44d8 (&bus->mdio_lock){+.+.}-{3:3}, at: mdiobus_read which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&bus->mdio_lock){+.+.}-{3:3}: lock_acquire __mutex_lock mutex_lock_nested lan9303_mdio_read _regmap_read regmap_read lan9303_probe lan9303_mdio_probe mdio_probe really_probe __driver_probe_device driver_probe_device __device_attach_driver bus_for_each_drv __device_attach device_initial_probe bus_probe_device deferred_probe_work_func process_one_work worker_thread kthread ret_from_fork -> #0 (lan9303_mdio:131:(&lan9303_mdio_regmap_config)->lock){+.+.}-{3:3}: __lock_acquire lock_acquire.part.0 lock_acquire __mutex_lock mutex_lock_nested regmap_lock_mutex regmap_read lan9303_phy_read dsa_slave_phy_read __mdiobus_read mdiobus_read get_phy_device mdiobus_scan __mdiobus_register dsa_register_switch lan9303_probe lan9303_mdio_probe mdio_probe really_probe __driver_probe_device driver_probe_device __device_attach_driver bus_for_each_drv __device_attach device_initial_probe bus_probe_device deferred_probe_work_func process_one_work worker_thread kthread ret_from_fork other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&bus->mdio_lock); lock(lan9303_mdio:131:(&lan9303_mdio_regmap_config)->lock); lock(&bus->mdio_lock); lock(lan9303_mdio:131:(&lan9303_mdio_regmap_config)->lock); *** DEADLOCK *** 5 locks held by kworker/u4:3/609: #0: ffff000002842938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work #1: ffff80000bacbd60 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work #2: ffff000007645178 (&dev->mutex){....}-{3:3}, at: __device_attach #3: ffff8000096e6e78 (dsa2_mutex){+.+.}-{3:3}, at: dsa_register_switch #4: ffff0000114c44d8 (&bus->mdio_lock){+.+.}-{3:3}, at: mdiobus_read stack backtrace: CPU: 1 PID: 609 Comm: kworker/u4:3 Not tainted 5.15.71 #1 Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace show_stack dump_stack_lvl dump_stack print_circular_bug check_noncircular __lock_acquire lock_acquire.part.0 lock_acquire __mutex_lock mutex_lock_nested regmap_lock_mutex regmap_read lan9303_phy_read dsa_slave_phy_read __mdiobus_read mdiobus_read get_phy_device mdiobus_scan __mdiobus_register dsa_register_switch lan9303_probe lan9303_mdio_probe ... Cc: stable@vger.kernel.org Fixes: dc7005831523 ("net: dsa: LAN9303: add MDIO managed mode support") Signed-off-by: Alexander Sverdlin Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20231027065741.534971-1-alexander.sverdlin@siemens.com Signed-off-by: Paolo Abeni drivers/net/dsa/lan9303_mdio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7aeeb2cb7a2570bb69a87ad14018b03e06ce5be5 Author: Ratheesh Kannoth Date: Fri Oct 27 07:49:53 2023 +0530 octeontx2-pf: Fix holes in error code Error code strings are not getting printed properly due to holes. Print error code as well. Fixes: 51afe9026d0c ("octeontx2-pf: NIX TX overwrites SQ_CTX_HW_S[SQ_INT]") Signed-off-by: Ratheesh Kannoth Reviewed-by: Wojciech Drewek Link: https://lore.kernel.org/r/20231027021953.1819959-2-rkannoth@marvell.com Signed-off-by: Paolo Abeni .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 80 +++++++++++++--------- 1 file changed, 46 insertions(+), 34 deletions(-) commit 96b9a68d1a6e4f889d453874c9e359aa720b520f Author: Ratheesh Kannoth Date: Fri Oct 27 07:49:52 2023 +0530 octeontx2-pf: Fix error codes Some of error codes were wrong. Fix the same. Fixes: 51afe9026d0c ("octeontx2-pf: NIX TX overwrites SQ_CTX_HW_S[SQ_INT]") Signed-off-by: Ratheesh Kannoth Reviewed-by: Wojciech Drewek Link: https://lore.kernel.org/r/20231027021953.1819959-1-rkannoth@marvell.com Signed-off-by: Paolo Abeni .../ethernet/marvell/octeontx2/nic/otx2_struct.h | 34 +++++++++++----------- 1 file changed, 17 insertions(+), 17 deletions(-) commit 63f1ee206170ad2363aa25fd99bd5ae529c690ae Author: Masami Hiramatsu Date: Thu Oct 26 00:10:05 2023 +0900 locking/atomic: sh: Use generic_cmpxchg_local for arch_cmpxchg_local() Use __generic_cmpxchg_local() for arch_cmpxchg_local() implementation on SH architecture because it does not implement arch_cmpxchg_local(). Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202310241310.Ir5uukOG-lkp@intel.com/ Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Geert Uytterhoeven Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/169824660459.24340.14614817132696360531.stgit@devnote2 Signed-off-by: John Paul Adrian Glaubitz arch/sh/include/asm/cmpxchg.h | 9 +++++++++ 1 file changed, 9 insertions(+) commit 1726483b79a72e0150734d5367e4a0238bf8fcff Author: Eric Dumazet Date: Wed Oct 25 14:10:37 2023 +0000 inet: shrink struct flowi_common I am looking at syzbot reports triggering kernel stack overflows involving a cascade of ipvlan devices. We can save 8 bytes in struct flowi_common. This patch alone will not fix the issue, but is a start. Fixes: 24ba14406c5c ("route: Add multipath_hash in flowi_common to make user-define hash") Signed-off-by: Eric Dumazet Cc: wenxu Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20231025141037.3448203-1-edumazet@google.com Signed-off-by: Paolo Abeni include/net/flow.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 21e80f3841c01aeaf32d7aee7bbc87b3db1aa0c6 Merge: 426ee5196d18 ea0b0bcef491 Author: Linus Torvalds Date: Wed Nov 1 21:09:37 2023 -1000 Merge tag 'modules-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull modules updates from Luis Chamberlain: "The only thing worth highligthing is that gzip moves to use vmalloc() instead of kmalloc just as we had a fix for this for zstd on v6.6-rc1. The rest is regular house keeping, keeping things neat, tidy, and boring" [ The kmalloc -> vmalloc conversion is not the right approach. Unless you know you need huge areas or know you need to use virtual mappings for some reason (playing with protection bits or whatever), you should use kvmalloc()/kvfree, which automatically picks the right allocation model - Linus ] * tag 'modules-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: module: Annotate struct module_notes_attrs with __counted_by module: Fix comment typo module: Make is_valid_name() return bool module: Make is_mapping_symbol() return bool module/decompress: use vmalloc() for gzip decompression workspace MAINTAINERS: add include/linux/module*.h to modules module: Clarify documentation of module_param_call() commit 426ee5196d1821d70192923e70c0f8347faade47 Merge: babe393974de 8b793bcda61f Author: Linus Torvalds Date: Wed Nov 1 20:51:41 2023 -1000 Merge tag 'sysctl-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull sysctl updates from Luis Chamberlain: "To help make the move of sysctls out of kernel/sysctl.c not incur a size penalty sysctl has been changed to allow us to not require the sentinel, the final empty element on the sysctl array. Joel Granados has been doing all this work. On the v6.6 kernel we got the major infrastructure changes required to support this. For v6.7-rc1 we have all arch/ and drivers/ modified to remove the sentinel. Both arch and driver changes have been on linux-next for a bit less than a month. It is worth re-iterating the value: - this helps reduce the overall build time size of the kernel and run time memory consumed by the kernel by about ~64 bytes per array - the extra 64-byte penalty is no longer inncurred now when we move sysctls out from kernel/sysctl.c to their own files For v6.8-rc1 expect removal of all the sentinels and also then the unneeded check for procname == NULL. The last two patches are fixes recently merged by Krister Johansen which allow us again to use softlockup_panic early on boot. This used to work but the alias work broke it. This is useful for folks who want to detect softlockups super early rather than wait and spend money on cloud solutions with nothing but an eventual hung kernel. Although this hadn't gone through linux-next it's also a stable fix, so we might as well roll through the fixes now" * tag 'sysctl-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: (23 commits) watchdog: move softlockup_panic back to early_param proc: sysctl: prevent aliased sysctls from getting passed to init intel drm: Remove now superfluous sentinel element from ctl_table array Drivers: hv: Remove now superfluous sentinel element from ctl_table array raid: Remove now superfluous sentinel element from ctl_table array fw loader: Remove the now superfluous sentinel element from ctl_table array sgi-xp: Remove the now superfluous sentinel element from ctl_table array vrf: Remove the now superfluous sentinel element from ctl_table array char-misc: Remove the now superfluous sentinel element from ctl_table array infiniband: Remove the now superfluous sentinel element from ctl_table array macintosh: Remove the now superfluous sentinel element from ctl_table array parport: Remove the now superfluous sentinel element from ctl_table array scsi: Remove now superfluous sentinel element from ctl_table array tty: Remove now superfluous sentinel element from ctl_table array xen: Remove now superfluous sentinel element from ctl_table array hpet: Remove now superfluous sentinel element from ctl_table array c-sky: Remove now superfluous sentinel element from ctl_talbe array powerpc: Remove now superfluous sentinel element from ctl_table arrays riscv: Remove now superfluous sentinel element from ctl_table array x86/vdso: Remove now superfluous sentinel element from ctl_table array ... commit 94e88b8a3e50d3e60c3ba6a5c316729587595210 Merge: 698b8c5e3b55 3c41971550f5 Author: Alexei Starovoitov Date: Wed Nov 1 22:54:28 2023 -0700 Merge branch 'bpf-fix-precision-tracking-for-bpf_alu-bpf_to_be-bpf_end' Shung-Hsi Yu says: ==================== bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END Changes since v1: - add test for negation and bswap (Alexei, Eduard) - add test for BPF_TO_LE as well to cover all types of BPF_END opcode - remove vals map and trigger backtracking with jump instead, based of Eduard's code - v1 at https://lore.kernel.org/bpf/20231030132145.20867-1-shung-hsi.yu@suse.com This patchset fixes and adds selftest for the issue reported by Mohamed Mahmoud and Toke Høiland-Jørgensen where the kernel can run into a verifier bug during backtracking of BPF_ALU | BPF_TO_BE | BPF_END instruction[0]. As seen in the verifier log below, r0 was incorrectly marked as precise even tough its value was not being used. Patch 1 fixes the issue based on Andrii's analysis, and patch 2 adds a selftest for such case using inline assembly. Please see individual patch for detail. ... mark_precise: frame2: regs=r2 stack= before 1891: (77) r2 >>= 56 mark_precise: frame2: regs=r2 stack= before 1890: (dc) r2 = be64 r2 mark_precise: frame2: regs=r0,r2 stack= before 1889: (73) *(u8 *)(r1 +47) = r3 ... mark_precise: frame2: regs=r0 stack= before 212: (85) call pc+1617 BUG regs 1 processed 5112 insns (limit 1000000) max_states_per_insn 4 total_states 92 peak_states 90 mark_read 20 0: https://lore.kernel.org/r/87jzrrwptf.fsf@toke.dk Shung-Hsi Yu (2): bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END selftests/bpf: precision tracking test for BPF_NEG and BPF_END kernel/bpf/verifier.c | 7 +- .../selftests/bpf/prog_tests/verifier.c | 2 + .../selftests/bpf/progs/verifier_precision.c | 93 +++++++++++++++++++ 3 files changed, 101 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/bpf/progs/verifier_precision.c base-commit: c17cda15cc86e65e9725641daddcd7a63cc9ad01 ==================== Link: https://lore.kernel.org/r/20231102053913.12004-1-shung-hsi.yu@suse.com Signed-off-by: Alexei Starovoitov commit 3c41971550f58f2e006c58aa71e8c23ad312110f Author: Shung-Hsi Yu Date: Thu Nov 2 13:39:05 2023 +0800 selftests/bpf: precision tracking test for BPF_NEG and BPF_END As seen from previous commit that fix backtracking for BPF_ALU | BPF_TO_BE | BPF_END, both BPF_NEG and BPF_END require special handling. Add tests written with inline assembly to check that the verifier does not incorrecly use the src_reg field of BPF_NEG and BPF_END (including bswap added in v4). Suggested-by: Eduard Zingerman Signed-off-by: Shung-Hsi Yu Link: https://lore.kernel.org/r/20231102053913.12004-4-shung-hsi.yu@suse.com Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/prog_tests/verifier.c | 2 + .../selftests/bpf/progs/verifier_precision.c | 93 ++++++++++++++++++++++ 2 files changed, 95 insertions(+) commit 291d044fd51f8484066300ee42afecf8c8db7b3a Author: Shung-Hsi Yu Date: Thu Nov 2 13:39:03 2023 +0800 bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END BPF_END and BPF_NEG has a different specification for the source bit in the opcode compared to other ALU/ALU64 instructions, and is either reserved or use to specify the byte swap endianness. In both cases the source bit does not encode source operand location, and src_reg is a reserved field. backtrack_insn() currently does not differentiate BPF_END and BPF_NEG from other ALU/ALU64 instructions, which leads to r0 being incorrectly marked as precise when processing BPF_ALU | BPF_TO_BE | BPF_END instructions. This commit teaches backtrack_insn() to correctly mark precision for such case. While precise tracking of BPF_NEG and other BPF_END instructions are correct and does not need fixing, this commit opt to process all BPF_NEG and BPF_END instructions within the same if-clause to better align with current convention used in the verifier (e.g. check_alu_op). Fixes: b5dc0163d8fd ("bpf: precise scalar_value tracking") Cc: stable@vger.kernel.org Reported-by: Mohamed Mahmoud Closes: https://lore.kernel.org/r/87jzrrwptf.fsf@toke.dk Tested-by: Toke Høiland-Jørgensen Tested-by: Tao Lyu Acked-by: Eduard Zingerman Signed-off-by: Shung-Hsi Yu Link: https://lore.kernel.org/r/20231102053913.12004-2-shung-hsi.yu@suse.com Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 698b8c5e3b5505ac00102caf9e4843b71192b586 Merge: 9af3775962af d8234d47c4aa Author: Alexei Starovoitov Date: Wed Nov 1 22:49:20 2023 -0700 Merge branch 'relax-allowlist-for-open-coded-css_task-iter' Chuyi Zhou says: ==================== Relax allowlist for open-coded css_task iter Hi, The patchset aims to relax the allowlist for open-coded css_task iter suggested by Alexei[1]. Please see individual patches for more details. And comments are always welcome. Patch summary: * Patch #1: Relax the allowlist and let css_task iter can be used in bpf iters and any sleepable progs. * Patch #2: Add a test in cgroup_iters.c which demonstrates how css_task iters can be combined with cgroup iter. * Patch #3: Add a test to prove css_task iter can be used in normal * sleepable progs. link[1]:https://lore.kernel.org/lkml/CAADnVQKafk_junRyE=-FVAik4hjTRDtThymYGEL8hGTuYoOGpA@mail.gmail.com/ --- Changes in v2: * Fix the incorrect logic in check_css_task_iter_allowlist. Use expected_attach_type to check whether we are using bpf_iters. * Link to v1:https://lore.kernel.org/bpf/20231022154527.229117-1-zhouchuyi@bytedance.com/T/#m946f9cde86b44a13265d9a44c5738a711eb578fd Changes in v3: * Add a testcase to prove css_task can be used in fentry.s * Link to v2:https://lore.kernel.org/bpf/20231024024240.42790-1-zhouchuyi@bytedance.com/T/#m14a97041ff56c2df21bc0149449abd275b73f6a3 Changes in v4: * Add Yonghong's ack for patch #1 and patch #2. * Solve Yonghong's comments for patch #2 * Move prog 'iter_css_task_for_each_sleep' from iters_task_failure.c to iters_css_task.c. Use RUN_TESTS to prove we can load this prog. * Link to v3:https://lore.kernel.org/bpf/20231025075914.30979-1-zhouchuyi@bytedance.com/T/#m3200d8ad29af4ffab97588e297361d0a45d7585d --- ==================== Link: https://lore.kernel.org/r/20231031050438.93297-1-zhouchuyi@bytedance.com Signed-off-by: Alexei Starovoitov commit d8234d47c4aa494d789b85562fa90e837b4575f9 Author: Chuyi Zhou Date: Tue Oct 31 13:04:38 2023 +0800 selftests/bpf: Add test for using css_task iter in sleepable progs This Patch add a test to prove css_task iter can be used in normal sleepable progs. Signed-off-by: Chuyi Zhou Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20231031050438.93297-4-zhouchuyi@bytedance.com Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/prog_tests/iters.c | 1 + tools/testing/selftests/bpf/progs/iters_css_task.c | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+) commit f49843afde6771ef6ed5d021eacafacfc98a58bf Author: Chuyi Zhou Date: Tue Oct 31 13:04:37 2023 +0800 selftests/bpf: Add tests for css_task iter combining with cgroup iter This patch adds a test which demonstrates how css_task iter can be combined with cgroup iter and it won't cause deadlock, though cgroup iter is not sleepable. Signed-off-by: Chuyi Zhou Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20231031050438.93297-3-zhouchuyi@bytedance.com Signed-off-by: Alexei Starovoitov .../testing/selftests/bpf/prog_tests/cgroup_iter.c | 33 ++++++++++++++++ tools/testing/selftests/bpf/progs/iters_css_task.c | 44 ++++++++++++++++++++++ 2 files changed, 77 insertions(+) commit 3091b667498b0a212e760e1033e5f9b8c33a948f Author: Chuyi Zhou Date: Tue Oct 31 13:04:36 2023 +0800 bpf: Relax allowlist for css_task iter The newly added open-coded css_task iter would try to hold the global css_set_lock in bpf_iter_css_task_new, so the bpf side has to be careful in where it allows to use this iter. The mainly concern is dead locking on css_set_lock. check_css_task_iter_allowlist() in verifier enforced css_task can only be used in bpf_lsm hooks and sleepable bpf_iter. This patch relax the allowlist for css_task iter. Any lsm and any iter (even non-sleepable) and any sleepable are safe since they would not hold the css_set_lock before entering BPF progs context. This patch also fixes the misused BPF_TRACE_ITER in check_css_task_iter_allowlist which compared bpf_prog_type with bpf_attach_type. Fixes: 9c66dc94b62ae ("bpf: Introduce css_task open-coded iterator kfuncs") Signed-off-by: Chuyi Zhou Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20231031050438.93297-2-zhouchuyi@bytedance.com Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 16 ++++++++++++---- tools/testing/selftests/bpf/progs/iters_task_failure.c | 4 ++-- 2 files changed, 14 insertions(+), 6 deletions(-) commit 9af3775962afa8b5cd0cc30c1e454405a650c1f3 Author: Andrii Nakryiko Date: Sat Oct 28 18:15:09 2023 -0700 selftests/bpf: fix test_maps' use of bpf_map_create_opts Use LIBBPF_OPTS() macro to properly initialize bpf_map_create_opts in test_maps' tests. Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20231029011509.2479232-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov .../selftests/bpf/map_tests/map_percpu_stats.c | 20 +++++--------------- 1 file changed, 5 insertions(+), 15 deletions(-) commit fd381ce60a2d79cc967506208085336d3d268ae0 Author: Hou Tao Date: Mon Oct 30 14:36:16 2023 +0800 bpf: Check map->usercnt after timer->timer is assigned When there are concurrent uref release and bpf timer init operations, the following sequence diagram is possible. It will break the guarantee provided by bpf_timer: bpf_timer will still be alive after userspace application releases or unpins the map. It also will lead to kmemleak for old kernel version which doesn't release bpf_timer when map is released. bpf program X: bpf_timer_init() lock timer->lock read timer->timer as NULL read map->usercnt != 0 process Y: close(map_fd) // put last uref bpf_map_put_uref() atomic_dec_and_test(map->usercnt) array_map_free_timers() bpf_timer_cancel_and_free() // just return read timer->timer is NULL t = bpf_map_kmalloc_node() timer->timer = t unlock timer->lock Fix the problem by checking map->usercnt after timer->timer is assigned, so when there are concurrent uref release and bpf timer init, either bpf_timer_cancel_and_free() from uref release reads a no-NULL timer or the newly-added atomic64_read() returns a zero usercnt. Because atomic_dec_and_test(map->usercnt) and READ_ONCE(timer->timer) in bpf_timer_cancel_and_free() are not protected by a lock, so add a memory barrier to guarantee the order between map->usercnt and timer->timer. Also use WRITE_ONCE(timer->timer, x) to match the lockless read of timer->timer in bpf_timer_cancel_and_free(). Reported-by: Hsin-Wei Hung Closes: https://lore.kernel.org/bpf/CABcoxUaT2k9hWsS1tNgXyoU3E-=PuOgMn737qK984fbFmfYixQ@mail.gmail.com Fixes: b00628b1c7d5 ("bpf: Introduce bpf timers.") Signed-off-by: Hou Tao Link: https://lore.kernel.org/r/20231030063616.1653024-1-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov kernel/bpf/helpers.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) commit 5b5b5806f22390808b8e8fa180fe35b003a4a74d Author: Varadarajan Narayanan Date: Tue Oct 31 12:41:39 2023 +0530 cpufreq: qcom-nvmem: Introduce cpufreq for ipq95xx IPQ95xx SoCs have different OPPs available for the CPU based on the SoC variant. This can be determined from an eFuse register present in the silicon. Added support for ipq95xx on nvmem driver which helps to determine OPPs at runtime based on the eFuse register which has the CPU frequency limits. opp-supported-hw dt binding can be used to indicate the available OPPs for each limit. Reviewed-by: Dmitry Baryshkov Signed-off-by: Praveenkumar I Signed-off-by: Kathiravan T Signed-off-by: Varadarajan Narayanan [ Viresh: Fixed subject ] Signed-off-by: Viresh Kumar drivers/cpufreq/cpufreq-dt-platdev.c | 1 + drivers/cpufreq/qcom-cpufreq-nvmem.c | 6 ++++++ 2 files changed, 7 insertions(+) commit ba5a61a08d83b18b99c461b4ddb9009947a4aa0e Author: Varadarajan Narayanan Date: Tue Oct 31 12:41:38 2023 +0530 cpufreq: qcom-nvmem: Enable cpufreq for ipq53xx IPQ53xx have different OPPs available for the CPU based on SoC variant. This can be determined through use of an eFuse register present in the silicon. Added support for ipq53xx on nvmem driver which helps to determine OPPs at runtime based on the eFuse register which has the CPU frequency limits. opp-supported-hw dt binding can be used to indicate the available OPPs for each limit. nvmem driver also creates the "cpufreq-dt" platform_device after passing the version matching data to the OPP framework so that the cpufreq-dt handles the actual cpufreq implementation. Reviewed-by: Dmitry Baryshkov Reviewed-by: Bryan O'Donoghue Signed-off-by: Kathiravan T Signed-off-by: Varadarajan Narayanan [ Viresh: Fixed subject ] Signed-off-by: Viresh Kumar drivers/cpufreq/cpufreq-dt-platdev.c | 1 + drivers/cpufreq/qcom-cpufreq-nvmem.c | 6 ++++++ 2 files changed, 7 insertions(+) commit 0b9cd949136f1b63f7aa9424b6e583a1ab261e36 Author: Robert Marko Date: Fri Oct 13 19:20:02 2023 +0200 cpufreq: qcom-nvmem: add support for IPQ8074 IPQ8074 comes in 3 families: * IPQ8070A/IPQ8071A (Acorn) up to 1.4GHz * IPQ8172/IPQ8173/IPQ8174 (Oak) up to 1.4GHz * IPQ8072A/IPQ8074A/IPQ8076A/IPQ8078A (Hawkeye) up to 2.2GHz So, in order to be able to share one OPP table lets add support for IPQ8074 family based of SMEM SoC ID-s as speedbin fuse is always 0 on IPQ8074. IPQ8074 compatible is blacklisted from DT platdev as the cpufreq device will get created by NVMEM CPUFreq driver. Signed-off-by: Robert Marko Acked-by: Konrad Dybcio [ Viresh: Fixed rebase conflict. ] Signed-off-by: Viresh Kumar drivers/cpufreq/cpufreq-dt-platdev.c | 1 + drivers/cpufreq/qcom-cpufreq-nvmem.c | 48 ++++++++++++++++++++++++++++++++++++ 2 files changed, 49 insertions(+) commit 477348dbfd37d3f4c813ff8e62ec96a6bbbfd06a Merge: 038ef0d990a0 e9104e73d4fc Author: Viresh Kumar Date: Thu Nov 2 11:04:33 2023 +0530 Merge branch 'cpufreq/arm/qcom-nvmem' into HEAD Merge base changes for cpufreq support for IPQ8074. commit 15fb6f2b6c4c3c129adc2412ae12ec15e60a6adb Author: Dave Marchevsky Date: Tue Oct 31 14:56:25 2023 -0700 bpf: Add __bpf_hook_{start,end} macros Not all uses of __diag_ignore_all(...) in BPF-related code in order to suppress warnings are wrapping kfunc definitions. Some "hook point" definitions - small functions meant to be used as attach points for fentry and similar BPF progs - need to suppress -Wmissing-declarations. We could use __bpf_kfunc_{start,end}_defs added in the previous patch in such cases, but this might be confusing to someone unfamiliar with BPF internals. Instead, this patch adds __bpf_hook_{start,end} macros, currently having the same effect as __bpf_kfunc_{start,end}_defs, then uses them to suppress warnings for two hook points in the kernel itself and some bpf_testmod hook points as well. Signed-off-by: Dave Marchevsky Cc: Yafang Shao Acked-by: Jiri Olsa Acked-by: Yafang Shao Link: https://lore.kernel.org/r/20231031215625.2343848-2-davemarchevsky@fb.com Signed-off-by: Alexei Starovoitov include/linux/btf.h | 2 ++ kernel/cgroup/rstat.c | 9 +++------ net/socket.c | 8 ++------ tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c | 6 ++---- 4 files changed, 9 insertions(+), 16 deletions(-) commit 391145ba2accc48b596f3d438af1a6255b62a555 Author: Dave Marchevsky Date: Tue Oct 31 14:56:24 2023 -0700 bpf: Add __bpf_kfunc_{start,end}_defs macros BPF kfuncs are meant to be called from BPF programs. Accordingly, most kfuncs are not called from anywhere in the kernel, which the -Wmissing-prototypes warning is unhappy about. We've peppered __diag_ignore_all("-Wmissing-prototypes", ... everywhere kfuncs are defined in the codebase to suppress this warning. This patch adds two macros meant to bound one or many kfunc definitions. All existing kfunc definitions which use these __diag calls to suppress -Wmissing-prototypes are migrated to use the newly-introduced macros. A new __diag_ignore_all - for "-Wmissing-declarations" - is added to the __bpf_kfunc_start_defs macro based on feedback from Andrii on an earlier version of this patch [0] and another recent mailing list thread [1]. In the future we might need to ignore different warnings or do other kfunc-specific things. This change will make it easier to make such modifications for all kfunc defs. [0]: https://lore.kernel.org/bpf/CAEf4BzaE5dRWtK6RPLnjTW-MW9sx9K3Fn6uwqCTChK2Dcb1Xig@mail.gmail.com/ [1]: https://lore.kernel.org/bpf/ZT+2qCc%2FaXep0%2FLf@krava/ Signed-off-by: Dave Marchevsky Suggested-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Cc: Jiri Olsa Acked-by: Jiri Olsa Acked-by: David Vernet Acked-by: Yafang Shao Link: https://lore.kernel.org/r/20231031215625.2343848-1-davemarchevsky@fb.com Signed-off-by: Alexei Starovoitov Documentation/bpf/kfuncs.rst | 6 ++---- include/linux/btf.h | 9 +++++++++ kernel/bpf/bpf_iter.c | 6 ++---- kernel/bpf/cgroup_iter.c | 6 ++---- kernel/bpf/cpumask.c | 6 ++---- kernel/bpf/helpers.c | 6 ++---- kernel/bpf/map_iter.c | 6 ++---- kernel/bpf/task_iter.c | 18 ++++++------------ kernel/trace/bpf_trace.c | 6 ++---- net/bpf/test_run.c | 7 +++---- net/core/filter.c | 13 ++++--------- net/core/xdp.c | 6 ++---- net/ipv4/fou_bpf.c | 6 ++---- net/netfilter/nf_conntrack_bpf.c | 6 ++---- net/netfilter/nf_nat_bpf.c | 6 ++---- net/xfrm/xfrm_interface_bpf.c | 6 ++---- 16 files changed, 46 insertions(+), 73 deletions(-) commit cd60f410ddc0cd663045d15936155421b6f708fd Author: Manu Bretelle Date: Tue Oct 31 15:36:06 2023 -0700 selftests/bpf: fix test_bpffs Currently this tests tries to umount /sys/kernel/debug (TDIR) but the system it is running on may have mounts below. For example, danobi/vmtest [0] VMs have mount -t tracefs tracefs /sys/kernel/debug/tracing as part of their init. This change instead creates a "random" directory under /tmp and uses this as TDIR. If the directory already exists, ignore the error and keep moving on. Test: Originally: $ vmtest -k $KERNEL_REPO/arch/x86_64/boot/bzImage "./test_progs -vv -a test_bpffs" => bzImage ===> Booting ===> Setting up VM ===> Running command [ 2.138818] bpf_testmod: loading out-of-tree module taints kernel. [ 2.140913] bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel bpf_testmod.ko is already unloaded. Loading bpf_testmod.ko... Successfully loaded bpf_testmod.ko. test_test_bpffs:PASS:clone 0 nsec fn:PASS:unshare 0 nsec fn:PASS:mount / 0 nsec fn:FAIL:umount /sys/kernel/debug unexpected error: -1 (errno 16) bpf_testmod.ko is already unloaded. Loading bpf_testmod.ko... Successfully loaded bpf_testmod.ko. test_test_bpffs:PASS:clone 0 nsec test_test_bpffs:PASS:waitpid 0 nsec test_test_bpffs:FAIL:bpffs test failed 255#282 test_bpffs:FAIL Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED Successfully unloaded bpf_testmod.ko. Command failed with exit code: 1 After this change: $ vmtest -k $(make image_name) 'cd tools/testing/selftests/bpf && ./test_progs -vv -a test_bpffs' => bzImage ===> Booting ===> Setting up VM ===> Running command [ 2.295696] bpf_testmod: loading out-of-tree module taints kernel. [ 2.296468] bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel bpf_testmod.ko is already unloaded. Loading bpf_testmod.ko... Successfully loaded bpf_testmod.ko. test_test_bpffs:PASS:clone 0 nsec fn:PASS:unshare 0 nsec fn:PASS:mount / 0 nsec fn:PASS:mount tmpfs 0 nsec fn:PASS:mkdir /tmp/test_bpffs_testdir/fs1 0 nsec fn:PASS:mkdir /tmp/test_bpffs_testdir/fs2 0 nsec fn:PASS:mount bpffs /tmp/test_bpffs_testdir/fs1 0 nsec fn:PASS:mount bpffs /tmp/test_bpffs_testdir/fs2 0 nsec fn:PASS:reading /tmp/test_bpffs_testdir/fs1/maps.debug 0 nsec fn:PASS:reading /tmp/test_bpffs_testdir/fs2/progs.debug 0 nsec fn:PASS:creating /tmp/test_bpffs_testdir/fs1/a 0 nsec fn:PASS:creating /tmp/test_bpffs_testdir/fs1/a/1 0 nsec fn:PASS:creating /tmp/test_bpffs_testdir/fs1/b 0 nsec fn:PASS:create_map(ARRAY) 0 nsec fn:PASS:pin map 0 nsec fn:PASS:stat(/tmp/test_bpffs_testdir/fs1/a) 0 nsec fn:PASS:renameat2(/fs1/a, /fs1/b, RENAME_EXCHANGE) 0 nsec fn:PASS:stat(/tmp/test_bpffs_testdir/fs1/b) 0 nsec fn:PASS:b should have a's inode 0 nsec fn:PASS:access(/tmp/test_bpffs_testdir/fs1/b/1) 0 nsec fn:PASS:stat(/tmp/test_bpffs_testdir/fs1/map) 0 nsec fn:PASS:renameat2(/fs1/c, /fs1/b, RENAME_EXCHANGE) 0 nsec fn:PASS:stat(/tmp/test_bpffs_testdir/fs1/b) 0 nsec fn:PASS:b should have c's inode 0 nsec fn:PASS:access(/tmp/test_bpffs_testdir/fs1/c/1) 0 nsec fn:PASS:renameat2(RENAME_NOREPLACE) 0 nsec fn:PASS:access(/tmp/test_bpffs_testdir/fs1/b) 0 nsec bpf_testmod.ko is already unloaded. Loading bpf_testmod.ko... Successfully loaded bpf_testmod.ko. test_test_bpffs:PASS:clone 0 nsec test_test_bpffs:PASS:waitpid 0 nsec test_test_bpffs:PASS:bpffs test 0 nsec #282 test_bpffs:OK Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED Successfully unloaded bpf_testmod.ko. [0] https://github.com/danobi/vmtest This is a follow-up of https://lore.kernel.org/bpf/20231024201852.1512720-1-chantr4@gmail.com/T/ v1 -> v2: - use a TDIR name that is related to test - use C-style comments Signed-off-by: Manu Bretelle Acked-by: Jiri Olsa Link: https://lore.kernel.org/r/20231031223606.2927976-1-chantr4@gmail.com Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/prog_tests/test_bpffs.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit b479d38ba959a8e3ffc4d9f760a9f2e4b9027e66 Merge: 05670f81d128 85eb035e6cfd Author: Alexei Starovoitov Date: Wed Nov 1 22:30:27 2023 -0700 Merge branch 'bpf-fix-incorrect-immediate-spill' Hao Sun says: ==================== bpf: Fix incorrect immediate spill Immediate is incorrectly cast to u32 before being spilled, losing sign information. The range information is incorrect after load again. Fix immediate spill by remove the cast. The second patch add a test case for this. Signed-off-by: Hao Sun --- Changes in v3: - Change the expected log to fix the test case - Link to v2: https://lore.kernel.org/r/20231101-fix-check-stack-write-v2-0-cb7c17b869b0@gmail.com Changes in v2: - Add fix and cc tags. - Link to v1: https://lore.kernel.org/r/20231026-fix-check-stack-write-v1-0-6b325ef3ce7e@gmail.com --- ==================== Link: https://lore.kernel.org/r/20231101-fix-check-stack-write-v3-0-f05c2b1473d5@gmail.com Signed-off-by: Alexei Starovoitov commit 85eb035e6cfd615071256592e1dbe72c1d99c24b Author: Hao Sun Date: Wed Nov 1 13:33:52 2023 +0100 selftests/bpf: Add test for immediate spilled to stack Add a test to check if the verifier correctly reason about the sign of an immediate spilled to stack by BPF_ST instruction. Signed-off-by: Hao Sun Link: https://lore.kernel.org/r/20231101-fix-check-stack-write-v3-2-f05c2b1473d5@gmail.com Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/verifier/bpf_st_mem.c | 32 +++++++++++++++++++++++ 1 file changed, 32 insertions(+) commit 811c363645b33e6e22658634329e95f383dfc705 Author: Hao Sun Date: Wed Nov 1 13:33:51 2023 +0100 bpf: Fix check_stack_write_fixed_off() to correctly spill imm In check_stack_write_fixed_off(), imm value is cast to u32 before being spilled to the stack. Therefore, the sign information is lost, and the range information is incorrect when load from the stack again. For the following prog: 0: r2 = r10 1: *(u64*)(r2 -40) = -44 2: r0 = *(u64*)(r2 - 40) 3: if r0 s<= 0xa goto +2 4: r0 = 1 5: exit 6: r0 = 0 7: exit The verifier gives: func#0 @0 0: R1=ctx(off=0,imm=0) R10=fp0 0: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 1: (7a) *(u64 *)(r2 -40) = -44 ; R2_w=fp0 fp-40_w=4294967252 2: (79) r0 = *(u64 *)(r2 -40) ; R0_w=4294967252 R2_w=fp0 fp-40_w=4294967252 3: (c5) if r0 s< 0xa goto pc+2 mark_precise: frame0: last_idx 3 first_idx 0 subseq_idx -1 mark_precise: frame0: regs=r0 stack= before 2: (79) r0 = *(u64 *)(r2 -40) 3: R0_w=4294967252 4: (b7) r0 = 1 ; R0_w=1 5: (95) exit verification time 7971 usec stack depth 40 processed 6 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 So remove the incorrect cast, since imm field is declared as s32, and __mark_reg_known() takes u64, so imm would be correctly sign extended by compiler. Fixes: ecdf985d7615 ("bpf: track immediate values written to stack by BPF_ST instruction") Cc: stable@vger.kernel.org Signed-off-by: Hao Sun Acked-by: Shung-Hsi Yu Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20231101-fix-check-stack-write-v3-1-f05c2b1473d5@gmail.com Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 61e4a86600029e6e8d468d1fad6b6c749bebed19 Author: David Howells Date: Fri Oct 27 00:49:34 2023 +0100 rxrpc: Fix two connection reaping bugs Fix two connection reaping bugs: (1) rxrpc_connection_expiry is in units of seconds, so rxrpc_disconnect_call() needs to multiply it by HZ when adding it to jiffies. (2) rxrpc_client_conn_reap_timeout() should set RXRPC_CLIENT_REAP_TIMER if local->kill_all_client_conns is clear, not if it is set (in which case we don't need the timer). Without this, old client connections don't get cleaned up until the local endpoint is cleaned up. Fixes: 5040011d073d ("rxrpc: Make the local endpoint hold a ref on a connected call") Fixes: 0d6bf319bc5a ("rxrpc: Move the client conn cache management to the I/O thread") Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/783911.1698364174@warthog.procyon.org.uk Signed-off-by: Jakub Kicinski net/rxrpc/conn_object.c | 2 +- net/rxrpc/local_object.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 05670f81d1287c40ec861186e4c4e3401013e7fb Author: Matthieu Baerts Date: Wed Nov 1 19:16:01 2023 +0100 bpf: fix compilation error without CGROUPS Our MPTCP CI complained [1] -- and KBuild too -- that it was no longer possible to build the kernel without CONFIG_CGROUPS: kernel/bpf/task_iter.c: In function 'bpf_iter_css_task_new': kernel/bpf/task_iter.c:919:14: error: 'CSS_TASK_ITER_PROCS' undeclared (first use in this function) 919 | case CSS_TASK_ITER_PROCS | CSS_TASK_ITER_THREADED: | ^~~~~~~~~~~~~~~~~~~ kernel/bpf/task_iter.c:919:14: note: each undeclared identifier is reported only once for each function it appears in kernel/bpf/task_iter.c:919:36: error: 'CSS_TASK_ITER_THREADED' undeclared (first use in this function) 919 | case CSS_TASK_ITER_PROCS | CSS_TASK_ITER_THREADED: | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf/task_iter.c:927:60: error: invalid application of 'sizeof' to incomplete type 'struct css_task_iter' 927 | kit->css_it = bpf_mem_alloc(&bpf_global_ma, sizeof(struct css_task_iter)); | ^~~~~~ kernel/bpf/task_iter.c:930:9: error: implicit declaration of function 'css_task_iter_start'; did you mean 'task_seq_start'? [-Werror=implicit-function-declaration] 930 | css_task_iter_start(css, flags, kit->css_it); | ^~~~~~~~~~~~~~~~~~~ | task_seq_start kernel/bpf/task_iter.c: In function 'bpf_iter_css_task_next': kernel/bpf/task_iter.c:940:16: error: implicit declaration of function 'css_task_iter_next'; did you mean 'class_dev_iter_next'? [-Werror=implicit-function-declaration] 940 | return css_task_iter_next(kit->css_it); | ^~~~~~~~~~~~~~~~~~ | class_dev_iter_next kernel/bpf/task_iter.c:940:16: error: returning 'int' from a function with return type 'struct task_struct *' makes pointer from integer without a cast [-Werror=int-conversion] 940 | return css_task_iter_next(kit->css_it); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf/task_iter.c: In function 'bpf_iter_css_task_destroy': kernel/bpf/task_iter.c:949:9: error: implicit declaration of function 'css_task_iter_end' [-Werror=implicit-function-declaration] 949 | css_task_iter_end(kit->css_it); | ^~~~~~~~~~~~~~~~~ This patch simply surrounds with a #ifdef the new code requiring CGroups support. It seems enough for the compiler and this is similar to bpf_iter_css_{new,next,destroy}() functions where no other #ifdef have been added in kernel/bpf/helpers.c and in the selftests. Fixes: 9c66dc94b62a ("bpf: Introduce css_task open-coded iterator kfuncs") Link: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/6665206927 Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202310260528.aHWgVFqq-lkp@intel.com/ Signed-off-by: Matthieu Baerts [ added missing ifdefs for BTF_ID cgroup definitions ] Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20231101181601.1493271-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov kernel/bpf/helpers.c | 8 +++++--- kernel/bpf/task_iter.c | 4 ++++ kernel/bpf/verifier.c | 8 ++++++++ 3 files changed, 17 insertions(+), 3 deletions(-) commit 74da77921333171766031ea213b11f1e650814f9 Author: Dan Carpenter Date: Tue Oct 31 12:51:09 2023 +0300 net/tcp_sigpool: Fix some off by one bugs The "cpool_populated" variable is the number of elements in the cpool[] array that have been populated. It is incremented in tcp_sigpool_alloc_ahash() every time we populate a new element. Unpopulated elements are NULL but if we have populated every element then this code will read one element beyond the end of the array. Fixes: 8c73b26315aa ("net/tcp: Prepare tcp_md5sig_pool for TCP-AO") Signed-off-by: Dan Carpenter Reviewed-by: Dmitry Safonov Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/ce915d61-04bc-44fb-b450-35fcc9fc8831@moroto.mountain Signed-off-by: Jakub Kicinski net/ipv4/tcp_sigpool.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 19b3f72a41a8751e26bffc093bb7e1cef29ad579 Author: Shigeru Yoshida Date: Mon Oct 30 16:55:40 2023 +0900 tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING syzbot reported the following uninit-value access issue [1]: ===================================================== BUG: KMSAN: uninit-value in strlen lib/string.c:418 [inline] BUG: KMSAN: uninit-value in strstr+0xb8/0x2f0 lib/string.c:756 strlen lib/string.c:418 [inline] strstr+0xb8/0x2f0 lib/string.c:756 tipc_nl_node_reset_link_stats+0x3ea/0xb50 net/tipc/node.c:2595 genl_family_rcv_msg_doit net/netlink/genetlink.c:971 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1051 [inline] genl_rcv_msg+0x11ec/0x1290 net/netlink/genetlink.c:1066 netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2545 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1075 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] sock_sendmsg net/socket.c:753 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595 __sys_sendmsg net/socket.c:2624 [inline] __do_sys_sendmsg net/socket.c:2633 [inline] __se_sys_sendmsg net/socket.c:2631 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559 __alloc_skb+0x318/0x740 net/core/skbuff.c:650 alloc_skb include/linux/skbuff.h:1286 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1214 [inline] netlink_sendmsg+0xb34/0x13d0 net/netlink/af_netlink.c:1885 sock_sendmsg_nosec net/socket.c:730 [inline] sock_sendmsg net/socket.c:753 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595 __sys_sendmsg net/socket.c:2624 [inline] __do_sys_sendmsg net/socket.c:2633 [inline] __se_sys_sendmsg net/socket.c:2631 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd TIPC bearer-related names including link names must be null-terminated strings. If a link name which is not null-terminated is passed through netlink, strstr() and similar functions can cause buffer overrun. This causes the above issue. This patch changes the nla_policy for bearer-related names from NLA_STRING to NLA_NUL_STRING. This resolves the issue by ensuring that only null-terminated strings are accepted as bearer-related names. syzbot reported similar uninit-value issue related to bearer names [2]. The root cause of this issue is that a non-null-terminated bearer name was passed. This patch also resolved this issue. Fixes: 7be57fc69184 ("tipc: add link get/dump to new netlink api") Fixes: 0655f6a8635b ("tipc: add bearer disable/enable to new netlink api") Reported-and-tested-by: syzbot+5138ca807af9d2b42574@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5138ca807af9d2b42574 [1] Reported-and-tested-by: syzbot+9425c47dccbcb4c17d51@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9425c47dccbcb4c17d51 [2] Signed-off-by: Shigeru Yoshida Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/20231030075540.3784537-1-syoshida@redhat.com Signed-off-by: Jakub Kicinski net/tipc/netlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 876f8ab52363f649bcc74072157dfd7adfbabc0d Author: Dan Carpenter Date: Fri Oct 27 15:19:01 2023 +0300 hsr: Prevent use after free in prp_create_tagged_frame() The prp_fill_rct() function can fail. In that situation, it frees the skb and returns NULL. Meanwhile on the success path, it returns the original skb. So it's straight forward to fix bug by using the returned value. Fixes: 451d8123f897 ("net: prp: add packet handling support") Signed-off-by: Dan Carpenter Acked-by: Paolo Abeni Link: https://lore.kernel.org/r/57af1f28-7f57-4a96-bcd3-b7a0f2340845@moroto.mountain Signed-off-by: Jakub Kicinski net/hsr/hsr_forward.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 7b3ba18703a63f6fd487183b9262b08e5632da1b Author: Willem de Bruijn Date: Wed Oct 25 19:42:38 2023 -0400 llc: verify mac len before reading mac header LLC reads the mac header with eth_hdr without verifying that the skb has an Ethernet header. Syzbot was able to enter llc_rcv on a tun device. Tun can insert packets without mac len and with user configurable skb->protocol (passing a tun_pi header when not configuring IFF_NO_PI). BUG: KMSAN: uninit-value in llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline] BUG: KMSAN: uninit-value in llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111 llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline] llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111 llc_rcv+0xc5d/0x14a0 net/llc/llc_input.c:218 __netif_receive_skb_one_core net/core/dev.c:5523 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637 netif_receive_skb_internal net/core/dev.c:5723 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5782 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x54c5/0x69c0 drivers/net/tun.c:2002 Add a mac_len test before all three eth_hdr(skb) calls under net/llc. There are further uses in include/net/llc_pdu.h. All these are protected by a test skb->protocol == ETH_P_802_2. Which does not protect against this tun scenario. But the mac_len test added in this patch in llc_fixup_skb will indirectly protect those too. That is called from llc_rcv before any other LLC code. It is tempting to just add a blanket mac_len check in llc_rcv, but not sure whether that could break valid LLC paths that do not assume an Ethernet header. 802.2 LLC may be used on top of non-802.3 protocols in principle. The below referenced commit shows that used to, on top of Token Ring. At least one of the three eth_hdr uses goes back to before the start of git history. But the one that syzbot exercises is introduced in this commit. That commit is old enough (2008), that effectively all stable kernels should receive this. Fixes: f83f1768f833 ("[LLC]: skb allocation size for responses") Reported-by: syzbot+a8c7be6dee0de1b669cc@syzkaller.appspotmail.com Signed-off-by: Willem de Bruijn Link: https://lore.kernel.org/r/20231025234251.3796495-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski net/llc/llc_input.c | 10 ++++++++-- net/llc/llc_s_ac.c | 3 +++ net/llc/llc_station.c | 3 +++ 3 files changed, 14 insertions(+), 2 deletions(-) commit d280783c3ad9ae31c01c1b3bdd2e8353a223599b Author: Linus Walleij Date: Sat Oct 28 22:48:35 2023 +0200 net: xscale: Drop unused PHY number For some cargoculted reason on incomplete cleanup, we have a PHY number which refers to nothing and gives confusing messages about PHY 0 on all ports. Print the name of the actual PHY device instead. Reported-by: Howard Harte Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20231028-ixp4xx-eth-id-v1-1-57be486d7f0f@linaro.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/xscale/ixp4xx_eth.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 2b7ac0c87d985c92e519995853c52b9649ea4b07 Author: Jakub Kicinski Date: Fri Oct 27 15:34:08 2023 -0700 tools: ynl-gen: don't touch the output file if content is the same I often regenerate all YNL files in the tree to make sure they are in sync with the codegen and specs. Generator rewrites the files unconditionally, so since make looks at file modification time to decide what to rebuild - my next build takes longer. We already generate the code to a tempfile most of the time, only overwrite the target when we have to. Before: $ stat include/uapi/linux/netdev.h File: include/uapi/linux/netdev.h Size: 2307 Blocks: 8 IO Block: 4096 regular file Access: 2023-10-27 15:19:56.347071940 -0700 Modify: 2023-10-27 15:19:45.089000900 -0700 Change: 2023-10-27 15:19:45.089000900 -0700 Birth: 2023-10-27 15:19:45.088000894 -0700 $ ./tools/net/ynl/ynl-regen.sh -f [...] $ stat include/uapi/linux/netdev.h File: include/uapi/linux/netdev.h Size: 2307 Blocks: 8 IO Block: 4096 regular file Access: 2023-10-27 15:19:56.347071940 -0700 Modify: 2023-10-27 15:22:18.417968446 -0700 Change: 2023-10-27 15:22:18.417968446 -0700 Birth: 2023-10-27 15:19:45.088000894 -0700 After: $ stat include/uapi/linux/netdev.h File: include/uapi/linux/netdev.h Size: 2307 Blocks: 8 IO Block: 4096 regular file Access: 2023-10-27 15:22:41.520114221 -0700 Modify: 2023-10-27 15:22:18.417968446 -0700 Change: 2023-10-27 15:22:18.417968446 -0700 Birth: 2023-10-27 15:19:45.088000894 -0700 $ ./tools/net/ynl/ynl-regen.sh -f [...] $ stat include/uapi/linux/netdev.h File: include/uapi/linux/netdev.h Size: 2307 Blocks: 8 IO Block: 4096 regular file Access: 2023-10-27 15:22:41.520114221 -0700 Modify: 2023-10-27 15:22:18.417968446 -0700 Change: 2023-10-27 15:22:18.417968446 -0700 Birth: 2023-10-27 15:19:45.088000894 -0700 Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/20231027223408.1865704-1-kuba@kernel.org Signed-off-by: Jakub Kicinski tools/net/ynl/ynl-gen-c.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 05f0431bb90f2ee3657e7fc2678f11a1f9b778b7 Author: Jiri Pirko Date: Mon Oct 30 17:17:50 2023 +0100 netlink: specs: devlink: add forgotten port function caps enum values Add two enum values that the blamed commit omitted. Fixes: f2f9dd164db0 ("netlink: specs: devlink: add the remaining command to generate complete split_ops") Signed-off-by: Jiri Pirko Link: https://lore.kernel.org/r/20231030161750.110420-1-jiri@resnulli.us Signed-off-by: Jakub Kicinski Documentation/netlink/specs/devlink.yaml | 4 ++++ net/devlink/netlink_gen.c | 2 +- tools/net/ynl/generated/devlink-user.c | 2 ++ 3 files changed, 7 insertions(+), 1 deletion(-) commit 5ed8499b64c664c39bf8cd712a0f3f959b075267 Merge: aca080970e4e 031fba65fc20 Author: Jakub Kicinski Date: Wed Nov 1 21:50:58 2023 -0700 Merge branch 'add-missing-module_descriptions' Andrew Lunn says: ==================== Add missing MODULE_DESCRIPTIONS Fixup PHY and MDIO drivers which are missing MODULE_DESCRIPTION. ==================== Link: https://lore.kernel.org/r/20231028184458.99448-1-andrew@lunn.ch Signed-off-by: Jakub Kicinski commit 031fba65fc202abf1f193e321be7a2c274fd88ba Author: Andrew Lunn Date: Sat Oct 28 20:44:58 2023 +0200 net: mdio: fill in missing MODULE_DESCRIPTION()s W=1 builds now warn if a module is built without a MODULE_DESCRIPTION(). Fill them in based on the Kconfig text, or similar. Signed-off-by: Andrew Lunn Reviewed-by: Florian Fainelli Acked-by: Andrew Jeffery Link: https://lore.kernel.org/r/20231028184458.99448-3-andrew@lunn.ch Signed-off-by: Jakub Kicinski drivers/net/mdio/acpi_mdio.c | 1 + drivers/net/mdio/fwnode_mdio.c | 1 + drivers/net/mdio/mdio-aspeed.c | 1 + drivers/net/mdio/mdio-bitbang.c | 1 + drivers/net/mdio/of_mdio.c | 1 + 5 files changed, 5 insertions(+) commit dd9d75fcf0f427ddcde4bde736908684ee05c353 Author: Andrew Lunn Date: Sat Oct 28 20:44:57 2023 +0200 net: phy: fill in missing MODULE_DESCRIPTION()s W=1 builds now warn if a module is built without a MODULE_DESCRIPTION(). Fill them in based on the Kconfig text, or similar. Signed-off-by: Andrew Lunn Reviewed-by: Florian Fainelli Acked-by: Russell King (Oracle) Link: https://lore.kernel.org/r/20231028184458.99448-2-andrew@lunn.ch Signed-off-by: Jakub Kicinski drivers/net/phy/bcm-phy-ptp.c | 1 + drivers/net/phy/bcm87xx.c | 1 + drivers/net/phy/phylink.c | 1 + drivers/net/phy/sfp.c | 1 + 4 files changed, 4 insertions(+) commit aca080970e4eb371bb2520ef4f67a8286f66f336 Merge: ff269e2cd5ad f96118c5d86f Author: Jakub Kicinski Date: Wed Nov 1 21:49:11 2023 -0700 Merge branch 'net-sched-fill-in-missing-module_descriptions-for-net-sched' Victor Nogueira says: ==================== net: sched: Fill in missing MODULE_DESCRIPTIONs for net/sched W=1 builds now warn if module is built without a MODULE_DESCRIPTION(). Fill in the missing MODULE_DESCRIPTIONs for net/sched ==================== Link: https://lore.kernel.org/r/20231027155045.46291-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski commit f96118c5d86f03d81bc24c7941f133ae5dd56a7b Author: Victor Nogueira Date: Fri Oct 27 08:50:45 2023 -0700 net: sched: Fill in missing MODULE_DESCRIPTION for qdiscs W=1 builds now warn if module is built without a MODULE_DESCRIPTION(). Fill in missing MODULE_DESCRIPTIONs for TC qdiscs. Signed-off-by: Victor Nogueira Acked-by: Jamal Hadi Salim Reviewed-by: Vinicius Costa Gomes Link: https://lore.kernel.org/r/20231027155045.46291-4-victor@mojatatu.com Signed-off-by: Jakub Kicinski net/sched/sch_cbs.c | 1 + net/sched/sch_choke.c | 1 + net/sched/sch_drr.c | 1 + net/sched/sch_etf.c | 1 + net/sched/sch_ets.c | 1 + net/sched/sch_fifo.c | 1 + net/sched/sch_gred.c | 1 + net/sched/sch_hfsc.c | 1 + net/sched/sch_htb.c | 1 + net/sched/sch_ingress.c | 1 + net/sched/sch_mqprio.c | 1 + net/sched/sch_mqprio_lib.c | 1 + net/sched/sch_multiq.c | 1 + net/sched/sch_netem.c | 1 + net/sched/sch_plug.c | 1 + net/sched/sch_prio.c | 1 + net/sched/sch_qfq.c | 1 + net/sched/sch_red.c | 1 + net/sched/sch_sfq.c | 1 + net/sched/sch_skbprio.c | 1 + net/sched/sch_taprio.c | 1 + net/sched/sch_tbf.c | 1 + net/sched/sch_teql.c | 1 + 23 files changed, 23 insertions(+) commit a9c92771fa23b263ac747fc5a12e0e233aed23d5 Author: Victor Nogueira Date: Fri Oct 27 08:50:44 2023 -0700 net: sched: Fill in missing MODULE_DESCRIPTION for classifiers W=1 builds now warn if module is built without a MODULE_DESCRIPTION(). Fill in missing MODULE_DESCRIPTIONs for TC classifiers. Signed-off-by: Victor Nogueira Acked-by: Jamal Hadi Salim Reviewed-by: Vinicius Costa Gomes Link: https://lore.kernel.org/r/20231027155045.46291-3-victor@mojatatu.com Signed-off-by: Jakub Kicinski net/sched/cls_basic.c | 1 + net/sched/cls_cgroup.c | 1 + net/sched/cls_fw.c | 1 + net/sched/cls_route.c | 1 + net/sched/cls_u32.c | 1 + 5 files changed, 5 insertions(+) commit 49b02a19c23a6541026ae8d36fee85ce8af11b60 Author: Victor Nogueira Date: Fri Oct 27 08:50:43 2023 -0700 net: sched: Fill in MODULE_DESCRIPTION for act_gate W=1 builds now warn if module is built without a MODULE_DESCRIPTION(). Gate is the only TC action that is lacking such description. Fill MODULE_DESCRIPTION for Gate TC ACTION. Signed-off-by: Victor Nogueira Acked-by: Jamal Hadi Salim Reviewed-by: Vinicius Costa Gomes Link: https://lore.kernel.org/r/20231027155045.46291-2-victor@mojatatu.com Signed-off-by: Jakub Kicinski net/sched/act_gate.c | 1 + 1 file changed, 1 insertion(+) commit 70a9affa930c7aeba27893c7d402ef1294f43aa2 Author: Christophe JAILLET Date: Wed Nov 1 18:59:06 2023 +0100 seq_buf: Export seq_buf_puts() Mark seq_buf_puts() which is part of the seq_buf API to be exported to kernel loadable GPL modules. Link: https://lkml.kernel.org/r/b9e3737f66ec2450221b492048ce0d9c65c84953.1698861216.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET Signed-off-by: Steven Rostedt (Google) lib/seq_buf.c | 1 + 1 file changed, 1 insertion(+) commit 685b38c7650a0f461f56761cf61936b453d5bb24 Author: Christophe JAILLET Date: Wed Nov 1 18:59:05 2023 +0100 seq_buf: Export seq_buf_putc() Mark seq_buf_putc() which is part of the seq_buf API to be exported to kernel loadable GPL modules. Link: https://lkml.kernel.org/r/5c9a5ed97ac37dbdcd9c1e7bcbdec9ac166e79be.1698861216.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET Signed-off-by: Steven Rostedt (Google) lib/seq_buf.c | 1 + 1 file changed, 1 insertion(+) commit 407c6726ca71b33330d2d6345d9ea7ebc02575e9 Author: Steven Rostedt (Google) Date: Wed Nov 1 13:25:49 2023 -0400 eventfs: Use simple_recursive_removal() to clean up dentries Looking at how dentry is removed via the tracefs system, I found that eventfs does not do everything that it did under tracefs. The tracefs removal of a dentry calls simple_recursive_removal() that does a lot more than a simple d_invalidate(). As it should be a requirement that any eventfs_inode that has a dentry, so does its parent. When removing a eventfs_inode, if it has a dentry, a call to simple_recursive_removal() on that dentry should clean up all the dentries underneath it. Add WARN_ON_ONCE() to check for the parent having a dentry if any children do. Link: https://lore.kernel.org/all/20231101022553.GE1957730@ZenIV/ Link: https://lkml.kernel.org/r/20231101172650.552471568@goodmis.org Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Andrew Morton Cc: Al Viro Fixes: 5bdcd5f5331a2 ("eventfs: Implement removal of meta data from eventfs") Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 77 +++++++++++++++++++++++++++--------------------- fs/tracefs/internal.h | 2 -- 2 files changed, 44 insertions(+), 35 deletions(-) commit 62d65cac119d08d39f751b4e3e2063ed996edc05 Author: Steven Rostedt (Google) Date: Wed Nov 1 13:25:48 2023 -0400 eventfs: Remove special processing of dput() of events directory The top level events directory is no longer special with regards to how it should be delete. Remove the extra processing for it in eventfs_set_ei_status_free(). Link: https://lkml.kernel.org/r/20231101172650.340876747@goodmis.org Cc: Ajay Kaher Cc: Mark Rutland Cc: Andrew Morton Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-) commit 020010fbfa202aa528a52743eba4ab0da3400a4e Author: Steven Rostedt (Google) Date: Wed Nov 1 13:25:47 2023 -0400 eventfs: Delete eventfs_inode when the last dentry is freed There exists a race between holding a reference of an eventfs_inode dentry and the freeing of the eventfs_inode. If user space has a dentry held long enough, it may still be able to access the dentry's eventfs_inode after it has been freed. To prevent this, have he eventfs_inode freed via the last dput() (or via RCU if the eventfs_inode does not have a dentry). This means reintroducing the eventfs_inode del_list field at a temporary place to put the eventfs_inode. It needs to mark it as freed (via the list) but also must invalidate the dentry immediately as the return from eventfs_remove_dir() expects that they are. But the dentry invalidation must not be called under the eventfs_mutex, so it must be done after the eventfs_inode is marked as free (put on a deletion list). Link: https://lkml.kernel.org/r/20231101172650.123479767@goodmis.org Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Andrew Morton Cc: Ajay Kaher Fixes: 5bdcd5f5331a2 ("eventfs: Implement removal of meta data from eventfs") Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 146 ++++++++++++++++++++++------------------------- fs/tracefs/internal.h | 2 + 2 files changed, 69 insertions(+), 79 deletions(-) commit 44365329f8219fc379097c2c9a75ff53f123764f Author: Steven Rostedt (Google) Date: Wed Nov 1 13:25:46 2023 -0400 eventfs: Hold eventfs_mutex when calling callback functions The callback function that is used to create inodes and dentries is not protected by anything and the data that is passed to it could become stale. After eventfs_remove_dir() is called by the tracing system, it is free to remove the events that are associated to that directory. Unfortunately, that means the callbacks must not be called after that. CPU0 CPU1 ---- ---- eventfs_root_lookup() { eventfs_remove_dir() { mutex_lock(&event_mutex); ei->is_freed = set; mutex_unlock(&event_mutex); } kfree(event_call); for (...) { entry = &ei->entries[i]; r = entry->callback() { call = data; // call == event_call above if (call->flags ...) [ USE AFTER FREE BUG ] The safest way to protect this is to wrap the callback with: mutex_lock(&eventfs_mutex); if (!ei->is_freed) r = entry->callback(); else r = -1; mutex_unlock(&eventfs_mutex); This will make sure that the callback will not be called after it is freed. But now it needs to be known that the callback is called while holding internal eventfs locks, and that it must not call back into the eventfs / tracefs system. There's no reason it should anyway, but document that as well. Link: https://lore.kernel.org/all/CA+G9fYu9GOEbD=rR5eMR-=HJ8H6rMsbzDC2ZY5=Y50WpWAE7_Q@mail.gmail.com/ Link: https://lkml.kernel.org/r/20231101172649.906696613@goodmis.org Cc: Ajay Kaher Cc: Mark Rutland Cc: Andrew Morton Fixes: 5790b1fb3d672 ("eventfs: Remove eventfs_file and just use eventfs_inode") Reported-by: Linux Kernel Functional Testing Reported-by: Naresh Kamboju Tested-by: Linux Kernel Functional Testing Tested-by: Naresh Kamboju Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 22 ++++++++++++++++++++-- include/linux/tracefs.h | 43 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 63 insertions(+), 2 deletions(-) commit 28e12c09f5aa081b2d13d1340e3610070b6c624d Author: Steven Rostedt (Google) Date: Wed Nov 1 13:25:45 2023 -0400 eventfs: Save ownership and mode Now that inodes and dentries are created on the fly, they are also reclaimed on memory pressure. Since the ownership and file mode are saved in the inode, if they are freed, any changes to the ownership and mode will be lost. To counter this, if the user changes the permissions or ownership, save them, and when creating the inodes again, restore those changes. Link: https://lkml.kernel.org/r/20231101172649.691841445@goodmis.org Cc: stable@vger.kernel.org Cc: Ajay Kaher Cc: Mark Rutland Cc: Andrew Morton Fixes: 63940449555e7 ("eventfs: Implement eventfs lookup, read, open functions") Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 148 ++++++++++++++++++++++++++++++++++++++++++----- fs/tracefs/internal.h | 16 +++++ 2 files changed, 151 insertions(+), 13 deletions(-) commit 77a06c33a22d13f3a6e31f06f6ee6bca666e6898 Author: Steven Rostedt (Google) Date: Wed Nov 1 13:25:44 2023 -0400 eventfs: Test for ei->is_freed when accessing ei->dentry The eventfs_inode (ei) is protected by SRCU, but the ei->dentry is not. It is protected by the eventfs_mutex. Anytime the eventfs_mutex is released, and access to the ei->dentry needs to be done, it should first check if ei->is_freed is set under the eventfs_mutex. If it is, then the ei->dentry is invalid and must not be used. The ei->dentry must only be accessed under the eventfs_mutex and after checking if ei->is_freed is set. When the ei is being freed, it will (under the eventfs_mutex) set is_freed and at the same time move the dentry to a free list to be cleared after the eventfs_mutex is released. This means that any access to the ei->dentry must check first if ei->is_freed is set, because if it is, then the dentry is on its way to be freed. Also add comments to describe this better. Link: https://lore.kernel.org/all/CA+G9fYt6pY+tMZEOg=SoEywQOe19fGP3uR15SGowkdK+_X85Cg@mail.gmail.com/ Link: https://lore.kernel.org/all/CA+G9fYuDP3hVQ3t7FfrBAjd_WFVSurMgCepTxunSJf=MTe=6aA@mail.gmail.com/ Link: https://lkml.kernel.org/r/20231101172649.477608228@goodmis.org Cc: Ajay Kaher Cc: Mark Rutland Cc: Andrew Morton Fixes: 5790b1fb3d672 ("eventfs: Remove eventfs_file and just use eventfs_inode") Reported-by: Linux Kernel Functional Testing Reported-by: Naresh Kamboju Reported-by: Beau Belgrave Reviewed-by: Masami Hiramatsu (Google) Tested-by: Linux Kernel Functional Testing Tested-by: Naresh Kamboju Tested-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 45 +++++++++++++++++++++++++++++++++++++++------ fs/tracefs/internal.h | 3 ++- 2 files changed, 41 insertions(+), 7 deletions(-) commit db3a397209b00d2e4e0a068608e5c546fc064b82 Author: Steven Rostedt (Google) Date: Wed Nov 1 13:25:43 2023 -0400 eventfs: Have a free_ei() that just frees the eventfs_inode As the eventfs_inode is freed in two different locations, make a helper function free_ei() to make sure all the allocated fields of the eventfs_inode is freed. This requires renaming the existing free_ei() which is called by the srcu handler to free_rcu_ei() and have free_ei() just do the freeing, where free_rcu_ei() will call it. Link: https://lkml.kernel.org/r/20231101172649.265214087@goodmis.org Cc: Ajay Kaher Cc: Mark Rutland Cc: Andrew Morton Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) commit f2f496370afcbc5227d7002da28c74b91fed12ff Author: Steven Rostedt (Google) Date: Wed Nov 1 13:25:42 2023 -0400 eventfs: Remove "is_freed" union with rcu head The eventfs_inode->is_freed was a union with the rcu_head with the assumption that when it was on the srcu list the head would contain a pointer which would make "is_freed" true. But that was a wrong assumption as the rcu head is a single link list where the last element is NULL. Instead, split the nr_entries integer so that "is_freed" is one bit and the nr_entries is the next 31 bits. As there shouldn't be more than 10 (currently there's at most 5 to 7 depending on the config), this should not be a problem. Link: https://lkml.kernel.org/r/20231101172649.049758712@goodmis.org Cc: stable@vger.kernel.org Cc: Mark Rutland Cc: Andrew Morton Cc: Ajay Kaher Fixes: 63940449555e7 ("eventfs: Implement eventfs lookup, read, open functions") Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 2 ++ fs/tracefs/internal.h | 6 +++--- 2 files changed, 5 insertions(+), 3 deletions(-) commit 9037caa09ed345b35325200f0e4acf5a94ae0a65 Author: Steven Rostedt (Google) Date: Mon Oct 30 12:15:23 2023 -0400 eventfs: Fix kerneldoc of eventfs_remove_rec() The eventfs_remove_rec() had some missing parameters in the kerneldoc comment above it. Also, rephrase the description a bit more to have a bit more correct grammar. Link: https://lore.kernel.org/linux-trace-kernel/20231030121523.0b2225a7@gandalf.local.home Cc: Masami Hiramatsu Cc: Mark Rutland Fixes: 5790b1fb3d672 ("eventfs: Remove eventfs_file and just use eventfs_inode"); Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202310052216.4SgqasWo-lkp@intel.com/ Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 4f7969bcd6d33042d62e249b41b5578161e4c868 Author: Steven Rostedt (Google) Date: Tue Oct 31 15:10:33 2023 -0400 tracing: Have the user copy of synthetic event address use correct context A synthetic event is created by the synthetic event interface that can read both user or kernel address memory. In reality, it reads any arbitrary memory location from within the kernel. If the address space is in USER (where CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE is set) then it uses strncpy_from_user_nofault() to copy strings otherwise it uses strncpy_from_kernel_nofault(). But since both functions use the same variable there's no annotation to what that variable is (ie. __user). This makes sparse complain. Quiet sparse by typecasting the strncpy_from_user_nofault() variable to a __user pointer. Link: https://lore.kernel.org/linux-trace-kernel/20231031151033.73c42e23@gandalf.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Fixes: 0934ae9977c2 ("tracing: Fix reading strings from synthetic events"); Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311010013.fm8WTxa5-lkp@intel.com/ Signed-off-by: Steven Rostedt (Google) kernel/trace/trace_events_synth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 77bc4d4921bd3497678ba8e7f4e480de35692f05 Author: Steven Rostedt (Google) Date: Tue Oct 31 12:42:29 2023 -0400 eventfs: Remove extra dget() in eventfs_create_events_dir() The creation of the top events directory does a dget() at the end of the creation in eventfs_create_events_dir() with a comment saying the final dput() will happen when it is removed. The problem is that a dget() is already done on the dentry when it was created with tracefs_start_creating()! The dget() now just causes a memory leak of that dentry. Remove the extra dget() as the final dput() in the deletion of the events directory actually matches the one in tracefs_start_creating(). Link: https://lore.kernel.org/linux-trace-kernel/20231031124229.4f2e3fa1@gandalf.local.home Cc: Masami Hiramatsu Cc: Mark Rutland Fixes: 5790b1fb3d672 ("eventfs: Remove eventfs_file and just use eventfs_inode") Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 3 --- 1 file changed, 3 deletions(-) commit bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4 Author: Steven Rostedt (Google) Date: Tue Oct 31 12:24:53 2023 -0400 tracing: Have trace_event_file have ref counters The following can crash the kernel: # cd /sys/kernel/tracing # echo 'p:sched schedule' > kprobe_events # exec 5>>events/kprobes/sched/enable # > kprobe_events # exec 5>&- The above commands: 1. Change directory to the tracefs directory 2. Create a kprobe event (doesn't matter what one) 3. Open bash file descriptor 5 on the enable file of the kprobe event 4. Delete the kprobe event (removes the files too) 5. Close the bash file descriptor 5 The above causes a crash! BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 877 Comm: bash Not tainted 6.5.0-rc4-test-00008-g2c6b6b1029d4-dirty #186 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:tracing_release_file_tr+0xc/0x50 What happens here is that the kprobe event creates a trace_event_file "file" descriptor that represents the file in tracefs to the event. It maintains state of the event (is it enabled for the given instance?). Opening the "enable" file gets a reference to the event "file" descriptor via the open file descriptor. When the kprobe event is deleted, the file is also deleted from the tracefs system which also frees the event "file" descriptor. But as the tracefs file is still opened by user space, it will not be totally removed until the final dput() is called on it. But this is not true with the event "file" descriptor that is already freed. If the user does a write to or simply closes the file descriptor it will reference the event "file" descriptor that was just freed, causing a use-after-free bug. To solve this, add a ref count to the event "file" descriptor as well as a new flag called "FREED". The "file" will not be freed until the last reference is released. But the FREE flag will be set when the event is removed to prevent any more modifications to that event from happening, even if there's still a reference to the event "file" descriptor. Link: https://lore.kernel.org/linux-trace-kernel/20231031000031.1e705592@gandalf.local.home/ Link: https://lore.kernel.org/linux-trace-kernel/20231031122453.7a48b923@gandalf.local.home Cc: stable@vger.kernel.org Cc: Mark Rutland Fixes: f5ca233e2e66d ("tracing: Increase trace array ref count on enable and filter files") Reported-by: Beau Belgrave Tested-by: Beau Belgrave Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) include/linux/trace_events.h | 4 ++++ kernel/trace/trace.c | 15 +++++++++++++++ kernel/trace/trace.h | 3 +++ kernel/trace/trace_events.c | 31 +++++++++++++++++++++++++++---- kernel/trace/trace_events_filter.c | 3 +++ 5 files changed, 52 insertions(+), 4 deletions(-) commit babe393974de0351c0e6cca50f5f84edaf8d7fa1 Merge: 7dc0e9c7dda6 cf63348b4c45 Author: Linus Torvalds Date: Wed Nov 1 17:11:41 2023 -1000 Merge tag 'docs-6.7' of git://git.lwn.net/linux Pull documentation updates from Jonathan Corbet: "The number of commits for documentation is not huge this time around, but there are some significant changes nonetheless: - Some more Spanish-language and Chinese translations - The much-discussed documentation of the confidential-computing threat model - Powerpc and RISCV documentation move under Documentation/arch - these complete this particular bit of documentation churn - A large traditional-Chinese documentation update - A new document on backporting and conflict resolution - Some kernel-doc and Sphinx fixes Plus the usual smattering of smaller updates and typo fixes" * tag 'docs-6.7' of git://git.lwn.net/linux: (40 commits) scripts/kernel-doc: Fix the regex for matching -Werror flag docs: backporting: address feedback Documentation: driver-api: pps: Update PPS generator documentation speakup: Document USB support doc: blk-ioprio: Bring the doc in line with the implementation docs: usb: fix reference to nonexistent file in UVC Gadget docs: doc-guide: mention 'make refcheckdocs' Documentation: fix typo in dynamic-debug howto scripts/kernel-doc: match -Werror flag strictly Documentation/sphinx: Remove the repeated word "the" in comments. docs: sparse: add SPDX-License-Identifier docs/zh_CN: Add subsystem-apis Chinese translation docs/zh_TW: update contents for zh_TW docs: submitting-patches: encourage direct notifications to commenters docs: add backporting and conflict resolution document docs: move riscv under arch docs: update link to powerpc/vmemmap_dedup.rst mm/memory-hotplug: fix typo in documentation docs: move powerpc under arch PCI: Update the devres documentation regarding to pcim_*() ... commit 7dc0e9c7dda66bd91eeada00d90033e3eb647fc3 Merge: 5eda8f25377f 5247e6dbed00 Author: Linus Torvalds Date: Wed Nov 1 17:08:10 2023 -1000 Merge tag 'linux_kselftest-next-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest updates from Shuah Khan: - kbuild kselftest-merge target fixes - fixes to several tests - resctrl test fixes and enhancements - ksft_perror() helper and reporting improvements - printf attribute to kselftest prints to improve reporting - documentation and clang build warning fixes The bulk of the patches are for resctrl fixes and enhancements. * tag 'linux_kselftest-next-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: (51 commits) selftests/resctrl: Fix MBM test failure when MBA unavailable selftests/clone3: Report descriptive test names selftests:modify the incorrect print format selftests/efivarfs: create-read: fix a resource leak selftests/ftrace: Add riscv support for kprobe arg tests selftests/ftrace: add loongarch support for kprobe args char tests selftests/amd-pstate: Added option to provide perf binary path selftests/amd-pstate: Fix broken paths to run workloads in amd-pstate-ut selftests/resctrl: Move run_benchmark() to a more fitting file selftests/resctrl: Fix schemata write error check selftests/resctrl: Reduce failures due to outliers in MBA/MBM tests selftests/resctrl: Fix feature checks selftests/resctrl: Refactor feature check to use resource and feature name selftests/resctrl: Move _GNU_SOURCE define into Makefile selftests/resctrl: Remove duplicate feature check from CMT test selftests/resctrl: Extend signal handler coverage to unmount on receiving signal selftests/resctrl: Fix uninitialized .sa_flags selftests/resctrl: Cleanup benchmark argument parsing selftests/resctrl: Remove ben_count variable selftests/resctrl: Make benchmark command const and build it with pointers ... commit 5eda8f25377f3d6de697eaa1d9801b9781d09dbc Merge: 463f46e114f7 8040345fdae4 Author: Linus Torvalds Date: Wed Nov 1 17:02:29 2023 -1000 Merge tag 'linux_kselftest-kunit-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit updates from Shuah Khan: - string-stream testing enhancements - several fixes memory leaks - fix to reset status during parameter handling * tag 'linux_kselftest-kunit-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: test: Fix the possible memory leak in executor_test kunit: Fix possible memory leak in kunit_filter_suites() kunit: Fix the wrong kfree of copy for kunit_filter_suites() kunit: Fix missed memory release in kunit_free_suite_set() kunit: Reset test status on each param iteration kunit: string-stream: Test performance of string_stream kunit: Use string_stream for test log kunit: string-stream: Add tests for freeing resource-managed string_stream kunit: string-stream: Decouple string_stream from kunit kunit: string-stream: Add kunit_alloc_string_stream() kunit: Don't use a managed alloc in is_literal() kunit: string-stream-test: Add cases for string_stream newline appending kunit: string-stream: Add option to make all lines end with newline kunit: string-stream: Improve testing of string_stream kunit: string-stream: Don't create a fragment for empty strings commit 463f46e114f74465cf8d01b124e7b74ad1ce2afd Merge: ff269e2cd5ad b2b67c997bf7 Author: Linus Torvalds Date: Wed Nov 1 16:44:56 2023 -1000 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd updates from Jason Gunthorpe: "This brings three new iommufd capabilities: - Dirty tracking for DMA. AMD/ARM/Intel CPUs can now record if a DMA writes to a page in the IOPTEs within the IO page table. This can be used to generate a record of what memory is being dirtied by DMA activities during a VM migration process. A VMM like qemu will combine the IOMMU dirty bits with the CPU's dirty log to determine what memory to transfer. VFIO already has a DMA dirty tracking framework that requires PCI devices to implement tracking HW internally. The iommufd version provides an alternative that the VMM can select, if available. The two are designed to have very similar APIs. - Userspace controlled attributes for hardware page tables (HWPT/iommu_domain). There are currently a few generic attributes for HWPTs (support dirty tracking, and parent of a nest). This is an entry point for the userspace iommu driver to control the HW in detail. - Nested translation support for HWPTs. This is a 2D translation scheme similar to the CPU where a DMA goes through a first stage to determine an intermediate address which is then translated trough a second stage to a physical address. Like for CPU translation the first stage table would exist in VM controlled memory and the second stage is in the kernel and matches the VM's guest to physical map. As every IOMMU has a unique set of parameter to describe the S1 IO page table and its associated parameters the userspace IOMMU driver has to marshal the information into the correct format. This is 1/3 of the feature, it allows creating the nested translation and binding it to VFIO devices, however the API to support IOTLB and ATC invalidation of the stage 1 io page table, and forwarding of IO faults are still in progress. The series includes AMD and Intel support for dirty tracking. Intel support for nested translation. Along the way are a number of internal items: - New iommu core items: ops->domain_alloc_user(), ops->set_dirty_tracking, ops->read_and_clear_dirty(), IOMMU_DOMAIN_NESTED, and iommu_copy_struct_from_user - UAF fix in iopt_area_split() - Spelling fixes and some test suite improvement" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: (52 commits) iommufd: Organize the mock domain alloc functions closer to Joerg's tree iommufd/selftest: Fix page-size check in iommufd_test_dirty() iommufd: Add iopt_area_alloc() iommufd: Fix missing update of domains_itree after splitting iopt_area iommu/vt-d: Disallow read-only mappings to nest parent domain iommu/vt-d: Add nested domain allocation iommu/vt-d: Set the nested domain to a device iommu/vt-d: Make domain attach helpers to be extern iommu/vt-d: Add helper to setup pasid nested translation iommu/vt-d: Add helper for nested domain allocation iommu/vt-d: Extend dmar_domain to support nested domain iommufd: Add data structure for Intel VT-d stage-1 domain allocation iommu/vt-d: Enhance capability check for nested parent domain allocation iommufd/selftest: Add coverage for IOMMU_HWPT_ALLOC with nested HWPTs iommufd/selftest: Add nested domain allocation for mock domain iommu: Add iommu_copy_struct_from_user helper iommufd: Add a nested HW pagetable object iommu: Pass in parent domain with user_data to domain_alloc_user op iommufd: Share iommufd_hwpt_alloc with IOMMUFD_OBJ_HWPT_NESTED iommufd: Derive iommufd_hwpt_paging from iommufd_hw_pagetable ... commit ff269e2cd5adce4ae14f883fc9c8803bc43ee1e9 Merge: 05bf73aa27ba f2fbb9081123 Author: Linus Torvalds Date: Wed Nov 1 16:33:20 2023 -1000 Merge tag 'net-next-6.7-followup' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull more networking updates from Jakub Kicinski: - Support GRO decapsulation for IPsec ESP in UDP - Add a handful of MODULE_DESCRIPTION()s - Drop questionable alignment check in TCP AO to avoid build issue after changes in the crypto tree * tag 'net-next-6.7-followup' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: net: tcp: remove call to obsolete crypto_ahash_alignmask() net: fill in MODULE_DESCRIPTION()s under drivers/net/ net: fill in MODULE_DESCRIPTION()s under net/802* net: fill in MODULE_DESCRIPTION()s under net/core net: fill in MODULE_DESCRIPTION()s in kuba@'s modules xfrm: policy: fix layer 4 flowi decoding xfrm Fix use after free in __xfrm6_udp_encap_rcv. xfrm: policy: replace session decode with flow dissector xfrm: move mark and oif flowi decode into common code xfrm: pass struct net to xfrm_decode_session wrappers xfrm: Support GRO for IPv6 ESP in UDP encapsulation xfrm: Support GRO for IPv4 ESP in UDP encapsulation xfrm: Use the XFRM_GRO to indicate a GRO call on input xfrm: Annotate struct xfrm_sec_ctx with __counted_by xfrm: Remove unused function declarations commit 05bf73aa27ba89474763cea7b9cd2626eda61e01 Merge: 1b10d2c8c621 4758560fa268 Author: Linus Torvalds Date: Wed Nov 1 16:15:42 2023 -1000 Merge tag 'probes-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes updates from Masami Hiramatsu: "Cleanups: - kprobes: Fixes typo in kprobes samples - tracing/eprobes: Remove 'break' after return kretprobe/fprobe performance improvements: - lib: Introduce new `objpool`, which is a high performance lockless object queue. This uses per-cpu ring array to allocate/release objects from the pre-allocated object pool. Since the index of ring array is a 32bit sequential counter, we can retry to push/pop the object pointer from the ring without lock (as seq-lock does) - lib: Add an objpool test module to test the functionality and evaluate the performance under some circumstances - kprobes/fprobe: Improve kretprobe and rethook scalability performance with objpool. This improves both legacy kretprobe and fprobe exit handler (which is based on rethook) to be scalable on SMP systems. Even with 8-threads parallel test, it shows a great scalability improvement - Remove unneeded freelist.h which is replaced by objpool - objpool: Add maintainers entry for the objpool - objpool: Fix to remove unused include header lines" * tag 'probes-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: kprobes: unused header files removed MAINTAINERS: objpool added kprobes: freelist.h removed kprobes: kretprobe scalability improvement lib: objpool test module added lib: objpool added: ring-array based lockless MPMC tracing/eprobe: drop unneeded breaks samples: kprobes: Fixes a typo commit 1b10d2c8c6219bfc86d8c7d53a4f97a0a706d1ba Merge: 1e0c505e1316 acbc3ecb806e Author: Linus Torvalds Date: Wed Nov 1 16:07:05 2023 -1000 Merge tag 'bootconfig-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull bootconfig updates from Masami Hiramatsu: - Documentation update for /proc/cmdline, which includes both the parameters from bootloader and the embedded parameters in the kernel - fs/proc: Add bootloader argument as a comment line to /proc/bootconfig so that the user can distinguish what parameters were passed from bootloader even if bootconfig modified that - Documentation fix to add /proc/bootconfig to proc.rst * tag 'bootconfig-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: doc: Add /proc/bootconfig to proc.rst fs/proc: Add boot loader arguments as comment to /proc/bootconfig doc: Update /proc/cmdline documentation to include boot config commit 2ba446f82142d0d42fc5ea7bea7af581d33a7939 Merge: 631808095a82 1399ebacbf59 Author: Dave Airlie Date: Thu Nov 2 11:52:50 2023 +1000 Merge tag 'shmob-drm-atomic-dt-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into drm-next drm: renesas: shmobile: Atomic conversion + DT support Currently, there are two drivers for the LCD controller on Renesas SuperH-based and ARM-based SH-Mobile and R-Mobile SoCs: 1. sh_mobile_lcdcfb, using the fbdev framework, 2. shmob_drm, using the DRM framework. However, only the former driver is used, as all platform support integrates the former. None of these drivers support DT-based systems. Convert the SH-Mobile DRM driver to atomic modesetting, and add DT support, complemented by the customary set of fixes and improvements. Acked-by: Laurent Pinchart Link: https://lore.kernel.org/r/cover.1694767208.git.geert+renesas@glider.be/ Signed-off-by: Dave Airlie From: Geert Uytterhoeven Link: https://patchwork.freedesktop.org/patch/msgid/CAMuHMdUF61V5qNyKbrTGxZfEJvCVuLO7q2R5MqZYkzRC_cNr0w@mail.gmail.com commit 1e0c505e13162a2abe7c984309cfe2ae976b428d Merge: 4684e928dbee 550087a0ba91 Author: Linus Torvalds Date: Wed Nov 1 15:28:33 2023 -1000 Merge tag 'asm-generic-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull ia64 removal and asm-generic updates from Arnd Bergmann: - The ia64 architecture gets its well-earned retirement as planned, now that there is one last (mostly) working release that will be maintained as an LTS kernel. - The architecture specific system call tables are updated for the added map_shadow_stack() syscall and to remove references to the long-gone sys_lookup_dcookie() syscall. * tag 'asm-generic-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: hexagon: Remove unusable symbols from the ptrace.h uapi asm-generic: Fix spelling of architecture arch: Reserve map_shadow_stack() syscall number for all architectures syscalls: Cleanup references to sys_lookup_dcookie() Documentation: Drop or replace remaining mentions of IA64 lib/raid6: Drop IA64 support Documentation: Drop IA64 from feature descriptions kernel: Drop IA64 support from sig_fault handlers arch: Remove Itanium (IA-64) architecture commit dc7a15fb90bf658be8289c9540c11f50993d10ff Author: Kent Overstreet Date: Fri Oct 27 19:37:24 2023 -0400 bcachefs: Skip deleted members in member_to_text() This fixes show-super output - we shouldn't be printing members that have been deleted. Signed-off-by: Kent Overstreet fs/bcachefs/sb-members.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit df94cb2e57b2cc539f325003e7abb76d3060d55b Author: Kent Overstreet Date: Fri Oct 27 17:19:31 2023 -0400 bcachefs: Fix an integer overflow Fixes: bcachefs (e7fdc10e-54a3-49d9-bd0c-390370889d84): disk usage increased 4294967296 more than 2823707312 sectors reserved) transaction updates for __bchfs_fallocate journal seq 467859 update: btree=extents cached=0 bch2_trans_update+0x4e8/0x540 old u64s 5 type deleted 536925940:3559337304:4294967283 len 0 ver 0 new u64s 6 type reservation 536925940:3559337304:4294967283 len 3559337304 ver 0: generation 0 replicas 2 update: btree=inodes cached=1 bch2_extent_update_i_size_sectors+0x305/0x3b0 old u64s 19 type inode_v3 0:536925940:4294967283 len 0 ver 0: mode 100600 flags 15300000 journal_seq 467859 bi_size 0 bi_sectors 0 bi_version 0 bi_atime 40905301656446 bi_ctime 40905301656446 bi_mtime 40905301656446 bi_otime 40905301656446 bi_uid 0 bi_gid 0 bi_nlink 0 bi_generation 0 bi_dev 0 bi_data_checksum 0 bi_compression 0 bi_project 0 bi_background_compression 0 bi_data_replicas 0 bi_promote_target 0 bi_foreground_target 0 bi_background_target 0 bi_erasure_code 0 bi_fields_set 0 bi_dir 1879048193 bi_dir_offset 3384856038735393365 bi_subvol 0 bi_parent_subvol 0 bi_nocow 0 new u64s 19 type inode_v3 0:536925940:4294967283 len 0 ver 0: mode 100600 flags 15300000 journal_seq 467859 bi_size 0 bi_sectors 3559337304 bi_version 0 bi_atime 40905301656446 bi_ctime 40905301656446 bi_mtime 40905301656446 bi_otime 40905301656446 bi_uid 0 bi_gid 0 bi_nlink 0 bi_generation 0 bi_dev 0 bi_data_checksum 0 bi_compression 0 bi_project 0 bi_background_compression 0 bi_data_replicas 0 bi_promote_target 0 bi_foreground_target 0 bi_background_target 0 bi_erasure_code 0 bi_fields_set 0 bi_dir 1879048193 bi_dir_offset 3384856038735393365 bi_subvol 0 bi_parent_subvol 0 bi_nocow 0 Kernel panic - not syncing: bcachefs (e7fdc10e-54a3-49d9-bd0c-390370889d84): panic after error CPU: 4 PID: 5154 Comm: rsync Not tainted 6.5.9-gateway-gca1614174cc0-dirty #1 Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./X570 Phantom Gaming 4, BIOS P4.20 08/02/2021 Call Trace: dump_stack_lvl+0x5a/0x90 panic+0x105/0x300 ? console_unlock+0xf1/0x130 ? bch2_printbuf_exit+0x16/0x30 ? srso_return_thunk+0x5/0x10 bch2_inconsistent_error+0x6f/0x80 bch2_trans_fs_usage_apply+0x279/0x3d0 __bch2_trans_commit+0x112a/0x1df0 ? bch2_extent_update+0x13a/0x1d0 bch2_extent_update+0x13a/0x1d0 bch2_extent_fallocate+0x58e/0x740 bch2_fallocate_dispatch+0xb7c/0x1030 ? do_filp_open+0xa0/0x140 vfs_fallocate+0x18e/0x1d0 __x64_sys_fallocate+0x46/0x70 do_syscall_64+0x48/0xa0 ? exit_to_user_mode_prepare+0x4d/0xa0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 RIP: 0033:0x7fc85d91bbb3 Code: 64 89 02 b8 ff ff ff ff eb bd 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 80 3d 31 da 0d 00 00 49 89 ca 74 14 b8 1d 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5d c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 10 Signed-off-by: Kent Overstreet fs/bcachefs/buckets.c | 4 ++-- fs/bcachefs/io_misc.c | 4 ++-- fs/bcachefs/io_misc.h | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) commit be9e782df3cb557715630a61dc79d9f966737859 Author: Kent Overstreet Date: Fri Oct 27 15:23:46 2023 -0400 bcachefs: Don't downgrade locks on transaction restart We should only be downgrading locks on success - otherwise, our transaction restarts won't be getting the correct locks and we'll livelock. Signed-off-by: Kent Overstreet fs/bcachefs/btree_iter.c | 3 ++- fs/bcachefs/btree_key_cache.c | 2 +- fs/bcachefs/btree_locking.c | 38 +++++++++++++++++++++++------- fs/bcachefs/btree_locking.h | 18 ++++++++++---- fs/bcachefs/btree_trans_commit.c | 9 +++---- fs/bcachefs/btree_types.h | 2 ++ fs/bcachefs/btree_update_interior.c | 2 +- fs/bcachefs/data_update.c | 12 +--------- fs/bcachefs/trace.h | 47 +++++++++++++++++++++++++++++++++---- 9 files changed, 96 insertions(+), 37 deletions(-) commit 2e7acdfbcad8b60eeef29d3beb3eb9a7085e3768 Author: Kent Overstreet Date: Fri Oct 27 13:53:07 2023 -0400 bcachefs: Fix deleted inodes btree in snapshot deletion Signed-off-by: Kent Overstreet fs/bcachefs/snapshot.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 85103d15ca3fe3b987f912873cb4f91b6f557c6c Author: Kent Overstreet Date: Thu Oct 26 23:02:42 2023 -0400 bcachefs: Fix error path in bch2_replicas_gc_end() We were dropping a lock we hadn't taken when entering with an error. Signed-off-by: Kent Overstreet fs/bcachefs/replicas.c | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) commit b65db750e2bb9252321fd54c284edd73c1595a09 Author: Kent Overstreet Date: Tue Oct 24 20:44:36 2023 -0400 bcachefs: Enumerate fsck errors This patch adds a superblock error counter for every distinct fsck error; this means that when analyzing filesystems out in the wild we'll be able to see what sorts of inconsistencies are being found and repair, and hence what bugs to look for. Errors validating bkeys are not yet considered distinct fsck errors, but this patch adds a new helper, bkey_fsck_err(), in order to add distinct error types for them as well. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 158 ++++++++++++----------- fs/bcachefs/alloc_background.h | 10 +- fs/bcachefs/backpointers.c | 20 +-- fs/bcachefs/backpointers.h | 2 +- fs/bcachefs/bkey_methods.c | 147 ++++++++++----------- fs/bcachefs/bkey_methods.h | 5 +- fs/bcachefs/btree_gc.c | 124 +++++++++++------- fs/bcachefs/btree_io.c | 174 ++++++++++++++++++------- fs/bcachefs/btree_update_interior.c | 4 +- fs/bcachefs/buckets.c | 13 +- fs/bcachefs/dirent.c | 76 +++++------ fs/bcachefs/dirent.h | 2 +- fs/bcachefs/ec.c | 29 ++--- fs/bcachefs/ec.h | 2 +- fs/bcachefs/error.c | 7 +- fs/bcachefs/error.h | 80 ++++++++---- fs/bcachefs/extents.c | 236 ++++++++++++++++------------------ fs/bcachefs/extents.h | 8 +- fs/bcachefs/fsck.c | 96 ++++++++------ fs/bcachefs/inode.c | 143 +++++++++++---------- fs/bcachefs/inode.h | 8 +- fs/bcachefs/journal_io.c | 73 ++++++++--- fs/bcachefs/lru.c | 18 +-- fs/bcachefs/lru.h | 2 +- fs/bcachefs/quota.c | 15 ++- fs/bcachefs/quota.h | 2 +- fs/bcachefs/recovery.c | 10 +- fs/bcachefs/reflink.c | 6 +- fs/bcachefs/reflink.h | 6 +- fs/bcachefs/sb-clean.c | 3 + fs/bcachefs/sb-errors.h | 246 +++++++++++++++++++++++++++++++++++- fs/bcachefs/snapshot.c | 104 +++++++-------- fs/bcachefs/snapshot.h | 4 +- fs/bcachefs/subvolume.c | 18 +-- fs/bcachefs/subvolume.h | 2 +- fs/bcachefs/xattr.c | 58 ++++----- fs/bcachefs/xattr.h | 2 +- 37 files changed, 1175 insertions(+), 738 deletions(-) commit f5d26fa31ed2e260589f0bc8af010bb742f1231e Author: Kent Overstreet Date: Wed Oct 25 15:51:16 2023 -0400 bcachefs: bch_sb_field_errors Add a new superblock section to keep counts of errors seen since filesystem creation: we'll be addingcounters for every distinct fsck error. The new superblock section has entries of the for [ id, count, time_of_last_error ]; this is intended to let us see what errors are occuring - and getting fixed - via show-super output. Signed-off-by: Kent Overstreet fs/bcachefs/Makefile | 1 + fs/bcachefs/bcachefs.h | 14 ++-- fs/bcachefs/bcachefs_format.h | 14 +++- fs/bcachefs/errcode.h | 1 + fs/bcachefs/error.c | 22 +++--- fs/bcachefs/sb-errors.c | 175 ++++++++++++++++++++++++++++++++++++++++++ fs/bcachefs/sb-errors.h | 26 +++++++ fs/bcachefs/sb-errors_types.h | 16 ++++ fs/bcachefs/sb-members.c | 2 +- fs/bcachefs/sb-members.h | 2 +- fs/bcachefs/super-io.c | 3 + fs/bcachefs/super-io.h | 5 ++ fs/bcachefs/super.c | 12 ++- 13 files changed, 270 insertions(+), 23 deletions(-) commit 94119eeb02d114aa1f78dcfaabdca50b9b626790 Author: Kent Overstreet Date: Wed Oct 25 16:29:37 2023 -0400 bcachefs: Add IO error counts to bch_member We now track IO errors per device since filesystem creation. IO error counts can be viewed in sysfs, or with the 'bcachefs show-super' command. Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 2 + fs/bcachefs/bcachefs_format.h | 15 ++++++ fs/bcachefs/btree_io.c | 23 +++++--- fs/bcachefs/ec.c | 6 ++- fs/bcachefs/error.c | 3 +- fs/bcachefs/error.h | 10 ++-- fs/bcachefs/io_read.c | 4 +- fs/bcachefs/io_write.c | 2 +- fs/bcachefs/journal_io.c | 8 +-- fs/bcachefs/opts.c | 5 -- fs/bcachefs/opts.h | 1 - fs/bcachefs/sb-members.c | 121 ++++++++++++++++++++++++++++++++++++------ fs/bcachefs/sb-members.h | 42 ++++++++++++++- fs/bcachefs/super-io.c | 9 +++- fs/bcachefs/super-io.h | 35 ------------ fs/bcachefs/super.c | 5 ++ fs/bcachefs/sysfs.c | 20 +++++-- 17 files changed, 225 insertions(+), 86 deletions(-) commit 5394fe9494011de19baff276ce02a2f00eef568a Author: Kent Overstreet Date: Thu Oct 26 16:20:08 2023 -0400 bcachefs: Fix snapshot skiplists Signed-off-by: Kent Overstreet fs/bcachefs/snapshot.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit e84843489c15bf9d39eec3a9a95870f98a71ac24 Author: Kent Overstreet Date: Thu Oct 26 17:00:36 2023 -0400 bcachefs: Fix a kasan splat in bch2_dev_add() This fixes a use after free - mi is dangling after the resize call. Additionally, resizing the device's member info section was useless - we were attempting to preallocate the space required before adding it to the filesystem superblock, but there's other sections that we should have been preallocating as well for that to work. Signed-off-by: Kent Overstreet fs/bcachefs/super.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) commit 5c1ab40e76dd873bfbfbe4df98ca3e08de31d30d Author: Kent Overstreet Date: Thu Oct 26 14:56:53 2023 -0400 bcachefs: Fix kasan splat in members_v1_get() This fixes an incorrect memcpy() in the recent members_v2 code - a members_v1 member is BCH_MEMBER_V1_BYTES, not sizeof(struct bch_member). Signed-off-by: Kent Overstreet fs/bcachefs/sb-members.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit fb3f57bb1177ae4d5550bbb431f90ebf277329e8 Author: Kent Overstreet Date: Fri Oct 20 13:33:14 2023 -0400 bcachefs: rebalance_work This adds a new btree, rebalance_work, to eliminate scanning required for finding extents that need work done on them in the background - i.e. for the background_target and background_compression options. rebalance_work is a bitset btree, where a KEY_TYPE_set corresponds to an extent in the extents or reflink btree at the same pos. A new extent field is added, bch_extent_rebalance, which indicates that this extent has work that needs to be done in the background - and which options to use. This allows per-inode options to be propagated to indirect extents - at least in some circumstances. In this patch, changing IO options on a file will not propagate the new options to indirect extents pointed to by that file. Updating (setting/clearing) the rebalance_work btree is done by the extent trigger, which looks at the bch_extent_rebalance field. Scanning is still requrired after changing IO path options - either just for a given inode, or for the whole filesystem. We indicate that scanning is required by adding a KEY_TYPE_cookie key to the rebalance_work btree: the cookie counter is so that we can detect that scanning is still required when an option has been flipped mid-way through an existing scan. Future possible work: - Propagate options to indirect extents when being changed - Add other IO path options - nr_replicas, ec, to rebalance_work so they can be applied in the background when they change - Add a counter, for bcachefs fs usage output, showing the pending amount of rebalance work: we'll probably want to do this after the disk space accounting rewrite (moving it to a new btree) Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 1 + fs/bcachefs/bcachefs_format.h | 34 +-- fs/bcachefs/buckets.c | 10 + fs/bcachefs/compress.c | 18 +- fs/bcachefs/compress.h | 2 + fs/bcachefs/data_update.c | 11 +- fs/bcachefs/extents.c | 155 +++++++++++- fs/bcachefs/extents.h | 20 ++ fs/bcachefs/io_misc.c | 11 +- fs/bcachefs/io_write.c | 20 +- fs/bcachefs/rebalance.c | 553 +++++++++++++++++++++++++----------------- fs/bcachefs/rebalance.h | 9 +- fs/bcachefs/rebalance_types.h | 31 ++- fs/bcachefs/recovery.c | 1 + fs/bcachefs/recovery_types.h | 1 + fs/bcachefs/reflink.c | 21 +- fs/bcachefs/sysfs.c | 14 +- fs/bcachefs/xattr.c | 2 +- 18 files changed, 599 insertions(+), 315 deletions(-) commit 4684e928dbee00d625b5102ea23c216cc2d85f46 Merge: a39ba9b429a4 a9838799e2fa Author: Linus Torvalds Date: Wed Nov 1 15:06:28 2023 -1000 Merge tag 'soc-arm-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC code updates from Arnd Bergmann: "The AMD Pensando DPU platform gets added to arm64, and some minor updates make it into Renesas' 32-bit platforms" * tag 'soc-arm-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: arm: debug: reuse the config DEBUG_OMAP2UART{1,2} for OMAP{3,4,5} arm64: Add config for AMD Pensando SoC platforms MAINTAINERS: Add entry for AMD PENSANDO ARM: shmobile: sh73a0: Reserve boot area when SMP is enabled ARM: shmobile: r8a7779: Reserve boot area when SMP is enabled ARM: shmobile: rcar-gen2: Reserve boot area when SMP is enabled ARM: shmobile: rcar-gen2: Remove unneeded once handling commit a39ba9b429a4671913e79da9d6a20476f10796b1 Merge: 385903a7ec75 216da5ebb83a Author: Linus Torvalds Date: Wed Nov 1 15:04:32 2023 -1000 Merge tag 'soc-defconfig-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM defconfig updates from Arnd Bergmann: "These are the usual trivial changes to enable a couple of newly added device drivers and remove lines for Kconfig options that are no longer needed" * tag 'soc-defconfig-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (24 commits) arm64: defconfig: enable DisplayPort altmode support arm64: defconfig: enable CONFIG_TYPEC_QCOM_PMIC arm64: defconfig: add various drivers for Amlogic based boards ARM: config: aspeed: Remove FIRMWARE_MEMMAP ARM: config: aspeed_g5: Enable SSIF BMC driver ARM: config: aspeed: Add Ampere SMPro drivers ARM: config: aspeed: Add new FSI drivers arm64: defconfig: Enable TPS6593 PMIC for SK-AM62A ARM: exynos_defconfig: add driver for ISL29018 ARM: multi_v7_defconfig: add drivers for S5C73M3 & S5K6A3 camera sensors arm64: defconfig: Enable RZ/G3S (R9A08G045) SoC ARM: multi_v7_defconfig: add tm2-touchkey driver ARM: exynos_defconfig: replace SATA_AHCI_PLATFORM with AHCI_DWC driver ARM: multi_v7_defconfig: add AHCI_DWC driver ARM: multi_v7_defconfig: make Exynos related PHYs modules ARM: s5pv210_defconfig: enable IIO required by MAX17040 ARM: shmobile: defconfig: Refresh for v6.6-rc3 ARM: defconfig: cleanup orphaned CONFIGs arm64: defconfig: Enable Samsung DSIM driver arm64: defconfig: Enable CONFIG_USB_MASS_STORAGE ... commit 385903a7ec75bb400f4bf0f07d8d5ad61390270d Merge: c035f0268b87 dfae947836d8 Author: Linus Torvalds Date: Wed Nov 1 14:46:51 2023 -1000 Merge tag 'soc-drivers-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC driver updates from Arnd Bergmann: "The highlights for the driver support this time are - Qualcomm platforms gain support for the Qualcomm Secure Execution Environment firmware interface to access EFI variables on certain devices, and new features for multiple platform and firmware drivers. - Arm FF-A firmware support gains support for v1.1 specification features, in particular notification and memory transaction descriptor changes. - SCMI firmware support now support v3.2 features for clock and DVFS configuration and a new transport for Qualcomm platforms. - Minor cleanups and bugfixes are added to pretty much all the active platforms: qualcomm, broadcom, dove, ti-k3, rockchip, sifive, amlogic, atmel, tegra, aspeed, vexpress, mediatek, samsung and more. In particular, this contains portions of the treewide conversion to use __counted_by annotations and the device_get_match_data helper" * tag 'soc-drivers-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (156 commits) soc: qcom: pmic_glink_altmode: Print return value on error firmware: qcom: scm: remove unneeded 'extern' specifiers firmware: qcom: scm: add a missing forward declaration for struct device firmware: qcom: move Qualcomm code into its own directory soc: samsung: exynos-chipid: Convert to platform remove callback returning void soc: qcom: apr: Add __counted_by for struct apr_rx_buf and use struct_size() soc: qcom: pmic_glink: fix connector type to be DisplayPort soc: ti: k3-socinfo: Avoid overriding return value soc: ti: k3-socinfo: Fix typo in bitfield documentation soc: ti: knav_qmss_queue: Use device_get_match_data() firmware: ti_sci: Use device_get_match_data() firmware: qcom: qseecom: add missing include guards soc/pxa: ssp: Convert to platform remove callback returning void soc/mediatek: mtk-mmsys: Convert to platform remove callback returning void soc/mediatek: mtk-devapc: Convert to platform remove callback returning void soc/loongson: loongson2_guts: Convert to platform remove callback returning void soc/litex: litex_soc_ctrl: Convert to platform remove callback returning void soc/ixp4xx: ixp4xx-qmgr: Convert to platform remove callback returning void soc/ixp4xx: ixp4xx-npe: Convert to platform remove callback returning void soc/hisilicon: kunpeng_hccs: Convert to platform remove callback returning void ... commit c035f0268b87fc21f517f638b3bad26c81babc85 Merge: deefd5024f07 c505e1e4b10d Author: Linus Torvalds Date: Wed Nov 1 14:37:04 2023 -1000 Merge tag 'soc-dt-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC DT updates from Arnd Bergmann: "There are a couple new SoCs that are supported for the first time: - AMD Pensando Elba is a data processing unit based on Cortex-A72 CPU cores - Sophgo makes RISC-V based chips, and we now support the CV1800B chip used in the milkv-duo board and the massive sg2042 chip in the milkv-pioneer, a 64-core developer workstation. - Qualcomm Snapdragon 720G (sm7125) is a close relative of Snapdragon 7c and gets added with some Xiaomi phones - Renesas gains support for the R8A779F4 (R-Car S4-8) automotive SoC and the RZ/G3S (R9A08G045) embedded SoC. There are also a bunch of newly supported machines that use already supported chips. On the 32-bit side, we have: - USRobotics USR8200 is a NAS/Firewall/router based on the ancient Intel IXP4xx platform - A couple of machines based on the NXP i.MX5 and i.MX6 platforms - One machine each for Allwinner V3s, Aspeed AST2600, Microchip sama5d29 and ST STM32mp157 The other ones all use arm64 cores on chips from allwinner, amlogic, freescale, mediatek, qualcomm and rockchip" * tag 'soc-dt-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (641 commits) ARM: dts: BCM5301X: Set switch ports for Linksys EA9200 ARM: dts: BCM5301X: Set fixed-link for extra Netgear R8000 CPU ports ARM: dts: BCM5301X: Explicitly disable unused switch CPU ports ARM: dts: BCM5301X: Relicense Vivek's code to the GPL 2.0+ / MIT ARM: dts: BCM5301X: Relicense Felix's code to the GPL 2.0+ / MIT ARM: dts: BCM5301X: Set MAC address for Asus RT-AC87U arm64: dts: socionext: add missing cache properties riscv: dts: thead: convert isa detection to new properties arm64: dts: Update cache properties for socionext arm64: dts: ti: k3-am654-idk: Add ICSSG Ethernet ports arm64: dts: ti: k3-am654-icssg2: add ICSSG2 Ethernet support arm64: dts: ti: k3-am65-main: Add ICSSG IEP nodes arm64: dts: ti: k3-am62p5-sk: Updates for SK EVM arm64: dts: ti: k3-am62p: Add nodes for more IPs arm64: dts: rockchip: Add Turing RK1 SoM support dt-bindings: arm: rockchip: Add Turing RK1 dt-bindings: vendor-prefixes: add turing arm64: dts: rockchip: Add DFI to rk3588s arm64: dts: rockchip: Add DFI to rk356x arm64: dts: rockchip: Always enable DFI on rk3399 ... commit deefd5024f0772cf56052ace9a8c347dc70bcaf3 Merge: 009fbfc97b63 2b88119e35b0 Author: Linus Torvalds Date: Wed Nov 1 13:55:40 2023 -1000 Merge tag 'vfio-v6.7-rc1' of https://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Add support for "chunk mode" in the mlx5-vfio-pci variant driver, which allows both larger device image sizes for migration, beyond the previous 4GB limit, and also read-ahead support for improved migration performance (Yishai Hadas) - A new bus master control interface for the CDX bus driver where there is no in-band mechanism to toggle device DMA as there is through config space on PCI devices (Nipun Gupta) - Add explicit alignment directives to vfio data structures to reduce the chance of breaking 32-bit userspace. In most cases this is transparent and the remaining cases where data structures are padded work within the existing rules for extending data structures within vfio (Stefan Hajnoczi) - Resolve a bug in the cdx bus driver noted when compiled with clang where missing parenthesis result in the wrong operation (Nathan Chancellor) - Resolve errors reported by smatch for a function when dealing with invalid inputs (Alex Williamson) - Add migration support to the mtty vfio/mdev sample driver for testing and integration purposes, allowing CI of migration without specific hardware requirements. Also resolve many of the short- comings of this driver relative to implementation of the vfio interrupt ioctl along the way (Alex Williamson) * tag 'vfio-v6.7-rc1' of https://github.com/awilliam/linux-vfio: vfio/mtty: Enable migration support vfio/mtty: Overhaul mtty interrupt handling vfio: Fix smatch errors in vfio_combine_iova_ranges() vfio/cdx: Add parentheses between bitwise AND expression and logical NOT vfio/mlx5: Activate the chunk mode functionality vfio/mlx5: Add support for READING in chunk mode vfio/mlx5: Add support for SAVING in chunk mode vfio/mlx5: Pre-allocate chunks for the STOP_COPY phase vfio/mlx5: Rename some stuff to match chunk mode vfio/mlx5: Enable querying state size which is > 4GB vfio/mlx5: Refactor the SAVE callback to activate a work only upon an error vfio/mlx5: Wake up the reader post of disabling the SAVING migration file vfio: use __aligned_u64 in struct vfio_device_ioeventfd vfio: use __aligned_u64 in struct vfio_device_gfx_plane_info vfio: trivially use __aligned_u64 for ioctl structs vfio-cdx: add bus mastering device feature support vfio: add bus master feature to device feature ioctl cdx: add support for bus mastering commit 009fbfc97b6367762efa257f1478ec86d37949f9 Merge: 3c86a44d623e 36d91e851598 Author: Linus Torvalds Date: Wed Nov 1 13:15:54 2023 -1000 Merge tag 'dma-mapping-6.7-2023-10-30' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping updates from Christoph Hellwig: - get rid of the fake support for coherent DMA allocation on coldfire with caches (Christoph Hellwig) - add a few Kconfig dependencies so that Kconfig catches the use of invalid configurations (Christoph Hellwig) - fix a type in dma-debug output (Chuck Lever) - rewrite a comment in swiotlb (Sean Christopherson) * tag 'dma-mapping-6.7-2023-10-30' of git://git.infradead.org/users/hch/dma-mapping: dma-debug: Fix a typo in a debugging eye-catcher swiotlb: rewrite comment explaining why the source is preserved on DMA_FROM_DEVICE m68k: remove unused includes from dma.c m68k: don't provide arch_dma_alloc for nommu/coldfire net: fec: use dma_alloc_noncoherent for data cache enabled coldfire m68k: use the coherent DMA code for coldfire without data cache dma-direct: warn when coherent allocations aren't supported dma-direct: simplify the use atomic pool logic in dma_direct_alloc dma-direct: add a CONFIG_ARCH_HAS_DMA_ALLOC symbol dma-direct: add dependencies to CONFIG_DMA_GLOBAL_POOL commit 3c86a44d623ee8734a02636d3544812e31496460 Merge: 40aa597c4a53 9e0cceadb7a5 Author: Linus Torvalds Date: Wed Nov 1 13:09:46 2023 -1000 Merge tag 'pmdomain-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain updates from Ulf Hansson: - Move Kconfig files into the pmdomain subsystem - Drop use of genpd's redundant ->opp_to_performance_state() callback - amlogic: - Add support for the T7 power-domains controller - Fix mask for the second NNA mem power-domain - bcm: Fixup ASB register read and comparison for bcm2835-power - imx: Fix device link problem for consumers of the pgc power-domain - mediatek: Add support for the MT8365 power domains - qcom: - Add support for the rpmhpds for SC8380XP power-domains - Add support for the rpmhpds for SM8650 power-domains - Add support for the rpmhpd clocks for SM7150 - Add support for the rpmpds for MSM8917 (families) power-domains - starfive: Add support for the JH7110 AON PMU * tag 'pmdomain-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: (56 commits) pmdomain: amlogic: Fix mask for the second NNA mem PD domain pmdomain: qcom: rpmhpd: Add SC8380XP power domains pmdomain: qcom: rpmhpd: Add SM8650 RPMh Power Domains dt-bindings: power: rpmpd: Add SC8380XP support dt-bindings: power: qcom,rpmhpd: Add GMXC PD index dt-bindings: power: qcom,rpmpd: document the SM8650 RPMh Power Domains pmdomain: imx: Make imx pgc power domain also set the fwnode pmdomain: qcom: rpmpd: Add QM215 power domains pmdomain: qcom: rpmpd: Add MSM8917 power domains dt-bindings: power: rpmpd: Add MSM8917, MSM8937 and QM215 pmdomain: bcm: bcm2835-power: check if the ASB register is equal to enable pmdomain: qcom: rpmhpd: Drop the ->opp_to_performance_state() callback pmdomain: qcom: rpmpd: Drop the ->opp_to_performance_state() callback pmdomain: qcom: cpr: Drop the ->opp_to_performance_state() callback pmdomain: Use device_get_match_data() pmdomain: ti: add missing of_node_put pmdomain: mediatek: Add support for MT8365 pmdomain: mediatek: Add support for MTK_SCPD_STRICT_BUS_PROTECTION cap pmdomain: mediatek: Add support for WAY_EN operations pmdomain: mediatek: Unify configuration for infracfg and smi ... commit 40aa597c4a53f7269367d1b5298bd44afcdcf473 Merge: 0364249d2073 5428a40a308f Author: Linus Torvalds Date: Wed Nov 1 13:05:44 2023 -1000 Merge tag 'mmc-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: " MMC core: - Enable host caps to be modified via debugfs to test speed-modes - Improve random I/O writes for 4k buffers for hsq enabled hosts MMC host: - atmel-mci/sdhci-of-at91: Aubin Constans takes over as maintainer - dw_mmc-starfive: Re-work tuning support - meson-gx: Fix bogus IRQ when using CMD_CFG_ERROR - mmci: Use peripheral flow control for the STM32 variant - renesas,sdhi: Add support for the RZ/G3S variant - sdhci-esdhc-imx: Optimize the manual tuning logic - sdhci-msm: Add support for the SM8650 variant - sdhci-npcm: Add driver to support the Nuvoton NPCM BMC variant - sdhci-pci-gli: Add workaround to allow GL9750 to enter ASPM L1.2" * tag 'mmc-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (25 commits) dt-bindings: mmc: sdhci-msm: document the SM8650 SDHCI Controller mmc: meson-gx: Remove setting of CMD_CFG_ERROR MAINTAINERS: mmc: take over as maintainer of MCI & SDHCI MICROCHIP DRIVERS mmc: jz4740: Use device_get_match_data() mmc: sdhci-npcm: Add NPCM SDHCI driver dt-bindings: mmc: npcm,sdhci: Document NPCM SDHCI controller mmc: sdhci-pltfm: Make driver OF independent mmc: sdhci-pltfm: Drop unnecessary error messages in sdhci_pltfm_init() mmc: sdhci-pci: Switch to use acpi_evaluate_dsm_typed() mmc: debugfs: Allow host caps to be modified mmc: core: Always reselect card type mmc: mmci: use peripheral flow control for STM32 mmc: vub300: replace deprecated strncpy with strscpy memstick: jmb38x_ms: Annotate struct jmb38x_ms with __counted_by mmc: starfive: Change tuning implementation dt-bindings: mmc: starfive: Remove properties from required mmc: hsq: Improve random I/O write performance for 4k buffers mmc: core: Allow dynamical updates of the number of requests for hsq mmc: sdhci-pci-gli: A workaround to allow GL9750 to enter ASPM L1.2 dt-bindings: mmc: renesas,sdhi: Document RZ/G3S support ... commit 0364249d2073c32c5214f02866999ce940bc35a2 Merge: 39714efc23be 9793c269da6c Author: Linus Torvalds Date: Wed Nov 1 12:55:54 2023 -1000 Merge tag 'for-6.7/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mike Snitzer: - Update DM core to directly call the map function for both the linear and stripe targets; which are provided by DM core - Various updates to use new safer string functions - Update DM core to respect REQ_NOWAIT flag in normal bios so that memory allocations are always attempted with GFP_NOWAIT - Add Mikulas Patocka to MAINTAINERS as a DM maintainer! - Improve DM delay target's handling of short delays (< 50ms) by using a kthread to check expiration of IOs rather than timers and a wq - Update the DM error target so that it works with zoned storage. This helps xfstests to provide proper IO error handling coverage when testing a filesystem with native zoned storage support - Update both DM crypt and integrity targets to improve performance by using crypto_shash_digest() rather than init+update+final sequence - Fix DM crypt target by backfilling missing memory allocation accounting for compound pages * tag 'for-6.7/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm crypt: account large pages in cc->n_allocated_pages dm integrity: use crypto_shash_digest() in sb_mac() dm crypt: use crypto_shash_digest() in crypt_iv_tcw_whitening() dm error: Add support for zoned block devices dm delay: for short delays, use kthread instead of timers and wq MAINTAINERS: add Mikulas Patocka as a DM maintainer dm: respect REQ_NOWAIT flag in normal bios issued to DM dm: enhance alloc_multiple_bios() to be more versatile dm: make __send_duplicate_bios return unsigned int dm log userspace: replace deprecated strncpy with strscpy dm ioctl: replace deprecated strncpy with strscpy_pad dm crypt: replace open-coded kmemdup_nul dm cache metadata: replace deprecated strncpy with strscpy dm: shortcut the calls to linear_map and stripe_map commit 39714efc23beb38ce850b29f4f132da6d997fc22 Merge: 90d624af2e5a 0e533cba3801 Author: Linus Torvalds Date: Wed Nov 1 12:50:12 2023 -1000 Merge tag 'ata-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ATA updates from Damien Le Moal: - Modify the AHCI driver to print the link power management policy used on scan, to help with debugging issues (Niklas) - Add support for the ASM2116 series adapters to the AHCI driver (Szuying) - Prepare libata for the coming gcc and Clang __counted_by attribute (Kees) - Following the recent estensive fixing of libata suspend/resume handling, several patches further cleanup and improve disk power state management (me) - Reduce the verbosity of some error messages for non-fatal temporary errors, e.g. slow response to device reset when scanning a port, and warning messages that are in fact normal, e.g. disabling a device on suspend or when removing it (me) - Cleanup DMA helper functions (me) - Fix sata_mv drive handling of potential errors durring probe (Ma) - Cleanup the xgene and imx drivers using the functions of_device_get_match_data() and device_get_match_data() (Rob) - Improve the tegra driver device tree (Rob) * tag 'ata-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: (22 commits) dt-bindings: ata: tegra: Disallow undefined properties ata: libata-core: Improve ata_dev_power_set_active() ata: libata-eh: Spinup disk on resume after revalidation ata: imx: Use device_get_match_data() ata: xgene: Use of_device_get_match_data() ata: sata_mv: aspeed: fix value check in mv_platform_probe() ata: ahci: Add Intel Alder Lake-P AHCI controller to low power chipsets list ata: libata: Cleanup inline DMA helper functions ata: libata-eh: Reduce "disable device" message verbosity ata: libata-eh: Improve reset error messages ata: libata-sata: Improve ata_sas_slave_configure() ata: libata-core: Do not resume runtime suspended ports ata: libata-core: Do not poweroff runtime suspended ports ata: libata-core: Remove ata_port_resume_async() ata: libata-core: Remove ata_port_suspend_async() ata: libata-core: Detach a port devices on shutdown ata: libata-core: Synchronize ata_port_detach() with hotplug ata: libata-scsi: Cleanup ata_scsi_start_stop_xlat() scsi: Remove scsi device no_start_on_resume flag ata: libata: Annotate struct ata_cpr_log with __counted_by ... commit 90d624af2e5a9945eedd5cafd6ae6d88f32cc977 Merge: 4de520f1fcef 0c696bb38f4c Author: Linus Torvalds Date: Wed Nov 1 12:30:07 2023 -1000 Merge tag 'for-6.7/block-2023-10-30' of git://git.kernel.dk/linux Pull block updates from Jens Axboe: - Improvements to the queue_rqs() support, and adding null_blk support for that as well (Chengming) - Series improving badblocks support (Coly) - Key store support for sed-opal (Greg) - IBM partition string handling improvements (Jan) - Make number of ublk devices supported configurable (Mike) - Cancelation improvements for ublk (Ming) - MD pull requests via Song: - Handle timeout in md-cluster, by Denis Plotnikov - Cleanup pers->prepare_suspend, by Yu Kuai - Rewrite mddev_suspend(), by Yu Kuai - Simplify md_seq_ops, by Yu Kuai - Reduce unnecessary locking array_state_store(), by Mariusz Tkaczyk - Make rdev add/remove independent from daemon thread, by Yu Kuai - Refactor code around quiesce() and mddev_suspend(), by Yu Kuai - NVMe pull request via Keith: - nvme-auth updates (Mark) - nvme-tcp tls (Hannes) - nvme-fc annotaions (Kees) - Misc cleanups and improvements (Jiapeng, Joel) * tag 'for-6.7/block-2023-10-30' of git://git.kernel.dk/linux: (95 commits) block: ublk_drv: Remove unused function md: cleanup pers->prepare_suspend() nvme-auth: allow mixing of secret and hash lengths nvme-auth: use transformed key size to create resp nvme-auth: alloc nvme_dhchap_key as single buffer nvmet-tcp: use 'spin_lock_bh' for state_lock() powerpc/pseries: PLPKS SED Opal keystore support block: sed-opal: keystore access for SED Opal keys block:sed-opal: SED Opal keystore ublk: simplify aborting request ublk: replace monitor with cancelable uring_cmd ublk: quiesce request queue when aborting queue ublk: rename mm_lock as lock ublk: move ublk_cancel_dev() out of ub->mutex ublk: make sure io cmd handled in submitter task context ublk: don't get ublk device reference in ublk_abort_queue() ublk: Make ublks_max configurable ublk: Limit dev_id/ub_number values md-cluster: check for timeout while a new disk adding nvme: rework NVME_AUTH Kconfig selection ... commit 4de520f1fcefd4ebb7dddcf28bde1b330c2f6b5d Merge: f5277ad1e976 8f350194d5cf Author: Linus Torvalds Date: Wed Nov 1 11:25:08 2023 -1000 Merge tag 'io_uring-futex-2023-10-30' of git://git.kernel.dk/linux Pull io_uring futex support from Jens Axboe: "This adds support for using futexes through io_uring - first futex wake and wait, and then the vectored variant of waiting, futex waitv. For both wait/wake/waitv, we support the bitset variant, as the 'normal' variants can be easily implemented on top of that. PI and requeue are not supported through io_uring, just the above mentioned parts. This may change in the future, but in the spirit of keeping this small (and based on what people have been asking for), this is what we currently have. Wake support is pretty straight forward, most of the thought has gone into the wait side to avoid needing to offload wait operations to a blocking context. Instead, we rely on the usual callbacks to retry and post a completion event, when appropriate. As far as I can recall, the first request for futex support with io_uring came from Andres Freund, working on postgres. His aio rework of postgres was one of the early adopters of io_uring, and futex support was a natural extension for that. This is relevant from both a usability point of view, as well as for effiency and performance. In Andres's words, for the former: Futex wait support in io_uring makes it a lot easier to avoid deadlocks in concurrent programs that have their own buffer pool: Obviously pages in the application buffer pool have to be locked during IO. If the initiator of IO A needs to wait for a held lock B, the holder of lock B might wait for the IO A to complete. The ability to wait for a lock and IO completions at the same time provides an efficient way to avoid such deadlocks and in terms of effiency, even without unlocking the full potential yet, Andres says: Futex wake support in io_uring is useful because it allows for more efficient directed wakeups. For some "locks" postgres has queues implemented in userspace, with wakeup logic that cannot easily be implemented with FUTEX_WAKE_BITSET on a single "futex word" (imagine waiting for journal flushes to have completed up to a certain point). Thus a "lock release" sometimes need to wake up many processes in a row. A quick-and-dirty conversion to doing these wakeups via io_uring lead to a 3% throughput increase, with 12% fewer context switches, albeit in a fairly extreme workload" * tag 'io_uring-futex-2023-10-30' of git://git.kernel.dk/linux: io_uring: add support for vectored futex waits futex: make the vectored futex operations available futex: make futex_parse_waitv() available as a helper futex: add wake_data to struct futex_q io_uring: add support for futex wake and wait futex: abstract out a __futex_wake_mark() helper futex: factor out the futex wake handling futex: move FUTEX2_VALID_MASK to futex.h commit f5277ad1e9768dbd05b1ae8dcdba690215d8c5b7 Merge: ffa059b262ba b9ec913212e6 Author: Linus Torvalds Date: Wed Nov 1 11:16:34 2023 -1000 Merge tag 'for-6.7/io_uring-sockopt-2023-10-30' of git://git.kernel.dk/linux Pull io_uring {get,set}sockopt support from Jens Axboe: "This adds support for using getsockopt and setsockopt via io_uring. The main use cases for this is to enable use of direct descriptors, rather than first instantiating a normal file descriptor, doing the option tweaking needed, then turning it into a direct descriptor. With this support, we can avoid needing a regular file descriptor completely. The net and bpf bits have been signed off on their side" * tag 'for-6.7/io_uring-sockopt-2023-10-30' of git://git.kernel.dk/linux: selftests/bpf/sockopt: Add io_uring support io_uring/cmd: Introduce SOCKET_URING_OP_SETSOCKOPT io_uring/cmd: Introduce SOCKET_URING_OP_GETSOCKOPT io_uring/cmd: return -EOPNOTSUPP if net is disabled selftests/net: Extract uring helpers to be reusable tools headers: Grab copy of io_uring.h io_uring/cmd: Pass compat mode in issue_flags net/socket: Break down __sys_getsockopt net/socket: Break down __sys_setsockopt bpf: Add sockptr support for setsockopt bpf: Add sockptr support for getsockopt commit a80712b9cc7e57830260ec5e1feb9cdb59e1da2f Author: Frederic Weisbecker Date: Fri Oct 27 16:40:49 2023 +0200 rcu/tasks-trace: Handle new PF_IDLE semantics The commit: cff9b2332ab7 ("kernel/sched: Modify initial boot task idle setup") has changed the semantics of what is to be considered an idle task in such a way that the idle task of an offline CPU may not carry the PF_IDLE flag anymore. However RCU-tasks-trace tests the opposite assertion, still assuming that idle tasks carry the PF_IDLE flag during their whole lifecycle. Remove this assumption to avoid spurious warnings but keep the initial test verifying that the idle task is the current task on any offline CPU. Reported-by: Naresh Kamboju Fixes: cff9b2332ab7 ("kernel/sched: Modify initial boot task idle setup") Suggested-by: Joel Fernandes Suggested-by: Paul E . McKenney" Acked-by: Peter Zijlstra (Intel) Signed-off-by: Frederic Weisbecker kernel/rcu/tasks.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ffa059b262ba72571e7fefe7fa2b4ebb6776b277 Merge: ca995ce438cc 6ce4a93dbb5b Author: Linus Torvalds Date: Wed Nov 1 11:09:19 2023 -1000 Merge tag 'for-6.7/io_uring-2023-10-30' of git://git.kernel.dk/linux Pull io_uring updates from Jens Axboe: "This contains the core io_uring updates, of which there are not many, and adds support for using WAITID through io_uring and hence not needing to block on these kinds of events. Outside of that, tweaks to the legacy provided buffer handling and some cleanups related to cancelations for uring_cmd support" * tag 'for-6.7/io_uring-2023-10-30' of git://git.kernel.dk/linux: io_uring/poll: use IOU_F_TWQ_LAZY_WAKE for wakeups io_uring/kbuf: Use slab for struct io_buffer objects io_uring/kbuf: Allow the full buffer id space for provided buffers io_uring/kbuf: Fix check of BID wrapping in provided buffers io_uring/rsrc: cleanup io_pin_pages() io_uring: cancelable uring_cmd io_uring: retain top 8bits of uring_cmd flags for kernel internal use io_uring: add IORING_OP_WAITID support exit: add internal include file with helpers exit: add kernel_waitid_prepare() helper exit: move core of do_wait() into helper exit: abstract out should_wake helper for child_wait_callback() io_uring/rw: add support for IORING_OP_READ_MULTISHOT io_uring/rw: mark readv/writev as vectored in the opcode definition io_uring/rw: split io_read() into a helper commit 9715ed501b585d47444865071674c961c0cc0020 Author: Frederic Weisbecker Date: Fri Oct 27 16:40:48 2023 +0200 rcu/tasks: Handle new PF_IDLE semantics The commit: cff9b2332ab7 ("kernel/sched: Modify initial boot task idle setup") has changed the semantics of what is to be considered an idle task in such a way that CPU boot code preceding the actual idle loop is excluded from it. This has however introduced new potential RCU-tasks stalls when either: 1) Grace period is started before init/0 had a chance to set PF_IDLE, keeping it stuck in the holdout list until idle ever schedules. 2) Grace period is started when some possible CPUs have never been online, keeping their idle tasks stuck in the holdout list until the CPU ever boots up. 3) Similar to 1) but with secondary CPUs: Grace period is started concurrently with secondary CPU booting, putting its idle task in the holdout list because PF_IDLE isn't yet observed on it. It stays then stuck in the holdout list until that CPU ever schedules. The effect is mitigated here by the hotplug AP thread that must run to bring the CPU up. Fix this with handling the new semantics of PF_IDLE, keeping in mind that it may or may not be set on an idle task. Take advantage of that to strengthen the coverage of an RCU-tasks quiescent state within an idle task, excluding the CPU boot code from it. Only the code running within the idle loop is now a quiescent state, along with offline CPUs. Fixes: cff9b2332ab7 ("kernel/sched: Modify initial boot task idle setup") Suggested-by: Joel Fernandes Suggested-by: Paul E . McKenney" Acked-by: Peter Zijlstra (Intel) Signed-off-by: Frederic Weisbecker kernel/rcu/tasks.h | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) commit 2be4686d866ad5896f2bb94d82fe892197aea9c7 Author: Frederic Weisbecker Date: Fri Oct 27 16:40:47 2023 +0200 rcu: Introduce rcu_cpu_online() Export the RCU point of view as to when a CPU is considered offline (ie: when does RCU consider that a CPU is sufficiently down in the hotplug process to not feature any possible read side). This will be used by RCU-tasks whose vision of an offline CPU should reasonably match the one of RCU core. Fixes: cff9b2332ab7 ("kernel/sched: Modify initial boot task idle setup") Acked-by: Peter Zijlstra (Intel) Signed-off-by: Frederic Weisbecker kernel/rcu/rcu.h | 2 ++ kernel/rcu/tree.c | 7 +++++++ 2 files changed, 9 insertions(+) commit ca995ce438cc641c47d4b8e4abeb1878a3d07c5f Merge: 8999ad99f4cb 2c269f42d0f3 Author: Linus Torvalds Date: Wed Nov 1 10:46:48 2023 -1000 Merge tag 'for-linus-6.7-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - two small cleanup patches - a fix for PCI passthrough under Xen - a four patch series speeding up virtio under Xen with user space backends * tag 'for-linus-6.7-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen-pciback: Consider INTx disabled when MSI/MSI-X is enabled xen: privcmd: Add support for ioeventfd xen: evtchn: Allow shared registration of IRQ handers xen: irqfd: Use _IOW instead of the internal _IOC() macro xen: Make struct privcmd_irqfd's layout architecture independent xen/xenbus: Add __counted_by for struct read_buffer and use struct_size() xenbus: fix error exit in xenbus_init() commit 85d68222ddc5f4522e456d97d201166acb50f716 Author: Peter Zijlstra Date: Tue Oct 31 09:53:08 2023 +0100 rcu: Break rcu_node_0 --> &rq->__lock order Commit 851a723e45d1 ("sched: Always clear user_cpus_ptr in do_set_cpus_allowed()") added a kfree() call to free any user provided affinity mask, if present. It was changed later to use kfree_rcu() in commit 9a5418bc48ba ("sched/core: Use kfree_rcu() in do_set_cpus_allowed()") to avoid a circular locking dependency problem. It turns out that even kfree_rcu() isn't safe for avoiding circular locking problem. As reported by kernel test robot, the following circular locking dependency now exists: &rdp->nocb_lock --> rcu_node_0 --> &rq->__lock Solve this by breaking the rcu_node_0 --> &rq->__lock chain by moving the resched_cpu() out from under rcu_node lock. [peterz: heavily borrowed from Waiman's Changelog] [paulmck: applied Z qiang feedback] Fixes: 851a723e45d1 ("sched: Always clear user_cpus_ptr in do_set_cpus_allowed()") Reported-by: kernel test robot Acked-by: Waiman Long Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/oe-lkp/202310302207.a25f1a30-oliver.sang@intel.com Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker kernel/rcu/tree.c | 36 +++++++++++++++++++++++++----------- 1 file changed, 25 insertions(+), 11 deletions(-) commit 8999ad99f4cb19638d9ecb8017831f9a0ab8dc3d Merge: f00593e09968 9ee4318c157b Author: Linus Torvalds Date: Wed Nov 1 10:28:32 2023 -1000 Merge tag 'x86_tdx_for_6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 TDX updates from Dave Hansen: "The majority of this is a rework of the assembly and C wrappers that are used to talk to the TDX module and VMM. This is a nice cleanup in general but is also clearing the way for using this code when Linux is the TDX VMM. There are also some tidbits to make TDX guests play nicer with Hyper-V and to take advantage the hardware TSC. Summary: - Refactor and clean up TDX hypercall/module call infrastructure - Handle retrying/resuming page conversion hypercalls - Make sure to use the (shockingly) reliable TSC in TDX guests" [ TLA reminder: TDX is "Trust Domain Extensions", Intel's guest VM confidentiality technology ] * tag 'x86_tdx_for_6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/tdx: Mark TSC reliable x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed() x86/virt/tdx: Make TDX_MODULE_CALL handle SEAMCALL #UD and #GP x86/virt/tdx: Wire up basic SEAMCALL functions x86/tdx: Remove 'struct tdx_hypercall_args' x86/tdx: Reimplement __tdx_hypercall() using TDX_MODULE_CALL asm x86/tdx: Make TDX_HYPERCALL asm similar to TDX_MODULE_CALL x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs x86/tdx: Pass TDCALL/SEAMCALL input/output registers via a structure x86/tdx: Rename __tdx_module_call() to __tdcall() x86/tdx: Make macros of TDCALLs consistent with the spec x86/tdx: Skip saving output regs when SEAMCALL fails with VMFailInvalid x86/tdx: Zero out the missing RSI in TDX_HYPERCALL macro x86/tdx: Retry partially-completed page conversion hypercalls commit 984a4afdc87a1fc226fd657b1cd8255c13d3fc1a Author: Ben Wolsieffer Date: Wed Nov 1 10:29:27 2023 -0400 regmap: prevent noinc writes from clobbering cache Currently, noinc writes are cached as if they were standard incrementing writes, overwriting unrelated register values in the cache. Instead, we want to cache the last value written to the register, as is done in the accelerated noinc handler (regmap_noinc_readwrite). Fixes: cdf6b11daa77 ("regmap: Add regmap_noinc_write API") Signed-off-by: Ben Wolsieffer Link: https://lore.kernel.org/r/20231101142926.2722603-2-ben.wolsieffer@hefring.com Signed-off-by: Mark Brown drivers/base/regmap/regmap.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) commit f00593e09968ed6dfcd10aebb13f470fbe3343b4 Merge: 979ff1e5af8a 8a32aa17c1cd Author: Linus Torvalds Date: Wed Nov 1 10:21:07 2023 -1000 Merge tag 'parisc-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "Usual fixes and updates: - Add up to 12 nops after TLB inserts for PA8x00 CPUs as the specification requires (Dave Anglin) - Simplify the parisc smp_prepare_boot_cpu() code (Russell King) - Use 64-bit little-endian values in SBA IOMMU PDIR table for AGP Since there is upcoming support for booting a 64-bit kernel on QEMU, some corner cases were fixed and improvements added: - Fix 64-bit kernel crash in STI (graphics console) font setup code which miscalculated the font start address as it gets signed vs unsigned offsets wrong - Support building an uncompressed Linux kernel - Add support for soft power-off in qemu" * tag 'parisc-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: fbdev: stifb: Make the STI next font pointer a 32-bit signed offset parisc: Show default CPU PSW.W setting as reported by PDC parisc/pdc: Add width field to struct pdc_model parisc: Add nop instructions after TLB inserts parisc: simplify smp_prepare_boot_cpu() parisc/agp: Use 64-bit LE values in SBA IOMMU PDIR table parisc/firmware: Use PDC constants for narrow/wide firmware parisc: Move parisc_narrow_firmware variable to header file parisc/power: Trivial whitespace cleanups and license update parisc/power: Add power soft-off when running on qemu parisc: Allow building uncompressed Linux kernel parisc: Add some missing PDC functions and constants parisc: sba-iommu: Fix comment when calculating IOC number commit 979ff1e5af8a46f75a69ffa86209f8650547f42f Merge: 56ec8e4cd8cb 03191fb3db3d Author: Linus Torvalds Date: Wed Nov 1 10:13:07 2023 -1000 Merge tag 'm68k-for-v6.7-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - misc aesthetical improvements for the floating point emulator - remove the last user of strlcpy() - use kernel's generic libgcc functions - misc fixes for W=1 builds - misc indentation fixes - misc fixes and improvements - defconfig updates * tag 'm68k-for-v6.7-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: (72 commits) m68k: lib: Include for __muldi3() m68k: fpsp040: Fix indentation by 5 spaces m68k: Fix indentation by 2 or 5 spaces in m68k: kernel: Fix indentation by 7 spaces in traps.c m68k: sun3: Fix indentation by 5 or 7 spaces m68k: Fix indentation by 7 spaces in m68k: defconfig: Update virt_defconfig for v6.6-rc3 m68k: defconfig: Update defconfigs for v6.6-rc1 m68k: io: Mark mmio read addresses as const m68k: Replace GPL 2.0+ README.legal boilerplate with SPDX m68k: sun3: Change led_pattern[] to unsigned char m68k: Add missing types to asm/irq.h m68k: sun3/3x: Add and use "sun3.h" m68k: sun3x: Make dvma_print() static m68k: sun3x: Make sun3x_halt() static m68k: sun3x: Do not mark dvma_map_iommu() inline m68k: sun3x: Fix signature of sun3_leds() m68k: sun3: Make sun3_platform_init() static m68k: sun3: Make print_pte() static m68k: sun3: Annotate prom_printf() with __printf() ... commit ea0b0bcef4917a2640ecc100c768b8e785784834 Author: Kees Cook Date: Fri Sep 22 10:52:53 2023 -0700 module: Annotate struct module_notes_attrs with __counted_by Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct module_notes_attrs. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Luis Chamberlain Cc: linux-modules@vger.kernel.org Signed-off-by: Kees Cook Signed-off-by: Luis Chamberlain kernel/module/sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fd06da776130ec2611c30272a0868f6a54cdf9d2 Author: Zhu Mao Date: Wed Sep 20 17:13:09 2023 -0700 module: Fix comment typo Delete duplicated word in comment. Signed-off-by: Zhu Mao Signed-off-by: Luis Chamberlain kernel/module/stats.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 04311b9b306388288f72cf6ebde659274b06ffd6 Author: Tiezhu Yang Date: Fri Jun 16 09:51:33 2023 +0800 module: Make is_valid_name() return bool The return value of is_valid_name() is true or false, so change its type to reflect that. Signed-off-by: Tiezhu Yang Signed-off-by: Luis Chamberlain scripts/mod/modpost.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 60da3640b07ce03706a8c77a3740ebad8b9af063 Author: Tiezhu Yang Date: Fri Jun 16 09:51:32 2023 +0800 module: Make is_mapping_symbol() return bool The return value of is_mapping_symbol() is true or false, so change its type to reflect that. Suggested-by: Xi Zhang Signed-off-by: Tiezhu Yang Signed-off-by: Luis Chamberlain include/linux/module_symbol.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3737df782c740b944912ed93420c57344b1cf864 Author: Andrea Righi Date: Wed Aug 30 17:58:20 2023 +0200 module/decompress: use vmalloc() for gzip decompression workspace Use a similar approach as commit a419beac4a07 ("module/decompress: use vmalloc() for zstd decompression workspace") and replace kmalloc() with vmalloc() also for the gzip module decompression workspace. In this case the workspace is represented by struct inflate_workspace that can be fairly large for kmalloc() and it can potentially lead to allocation errors on certain systems: $ pahole inflate_workspace struct inflate_workspace { struct inflate_state inflate_state; /* 0 9544 */ /* --- cacheline 149 boundary (9536 bytes) was 8 bytes ago --- */ unsigned char working_window[32768]; /* 9544 32768 */ /* size: 42312, cachelines: 662, members: 2 */ /* last cacheline: 8 bytes */ }; Considering that there is no need to use continuous physical memory, simply switch to vmalloc() to provide a more reliable in-kernel module decompression. Fixes: b1ae6dc41eaa ("module: add in-kernel support for decompressing") Signed-off-by: Andrea Righi Signed-off-by: Luis Chamberlain kernel/module/decompress.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 62eedac264159690b4fed78aeec4d3623ce253b7 Author: Luis Chamberlain Date: Wed Sep 20 14:07:58 2023 -0700 MAINTAINERS: add include/linux/module*.h to modules Use glob include/linux/module*.h to capture all module changes. Suggested-by: Kees Cook Reviewed-by: Kees Cook Signed-off-by: Luis Chamberlain MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2c7ccb3c362bc86aeb3e52d6fbf15f7f480ca961 Author: Kees Cook Date: Wed Sep 13 16:54:14 2023 -0700 module: Clarify documentation of module_param_call() Commit 9bbb9e5a3310 ("param: use ops in struct kernel_param, rather than get and set fns directly") added the comment that module_param_call() was deprecated, during a large scale refactoring to bring sanity to type casting back then. In 2017 following more cleanups, it became useful again as it wraps a common pattern of creating an ops struct for a given get/set pair: b2f270e87473 ("module: Prepare to convert all module_param_call() prototypes") ece1996a21ee ("module: Do not paper over type mismatches in module_param_call()") static const struct kernel_param_ops __param_ops_##name = \ { .flags = 0, .set = _set, .get = _get }; \ __module_param_call(MODULE_PARAM_PREFIX, \ name, &__param_ops_##name, arg, perm, -1, 0) __module_param_call(MODULE_PARAM_PREFIX, name, ops, arg, perm, -1, 0) Many users of module_param_cb() appear to be almost universally open-coding the same thing that module_param_call() does now. Don't discourage[1] people from using module_param_call(): clarify the comment to show that module_param_cb() is useful if you repeatedly use the same pair of get/set functions. [1] https://lore.kernel.org/lkml/202308301546.5C789E5EC@keescook/ Cc: Luis Chamberlain Cc: Johan Hovold Cc: Jessica Yu Cc: Sagi Grimberg Cc: Nick Desaulniers Cc: Miguel Ojeda Cc: Joe Perches Cc: linux-modules@vger.kernel.org Reviewed-by: Miguel Ojeda Signed-off-by: Kees Cook Signed-off-by: Luis Chamberlain include/linux/moduleparam.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 6620999f0d41e4fd6f047727936a964c3399d249 Author: Ben Wolsieffer Date: Tue Oct 31 16:22:36 2023 -0400 scripts/gdb/vmalloc: disable on no-MMU vmap_area does not exist on no-MMU, therefore the GDB scripts fail to load: Traceback (most recent call last): File "<...>/vmlinux-gdb.py", line 51, in import linux.vmalloc File "<...>/scripts/gdb/linux/vmalloc.py", line 14, in vmap_area_ptr_type = vmap_area_type.get_type().pointer() ^^^^^^^^^^^^^^^^^^^^^^^^^ File "<...>/scripts/gdb/linux/utils.py", line 28, in get_type self._type = gdb.lookup_type(self._name) ^^^^^^^^^^^^^^^^^^^^^^^^^^^ gdb.error: No struct type named vmap_area. To fix this, disable the command and add an informative error message if CONFIG_MMU is not defined, following the example of lx-slabinfo. Link: https://lkml.kernel.org/r/20231031202235.2655333-2-ben.wolsieffer@hefring.com Fixes: 852622bf3616 ("scripts/gdb/vmalloc: add vmallocinfo support") Signed-off-by: Ben Wolsieffer Cc: Jan Kiszka Cc: Kieran Bingham Cc: Kuan-Ying Lee Cc: Signed-off-by: Andrew Morton scripts/gdb/linux/constants.py.in | 1 + scripts/gdb/linux/vmalloc.py | 8 ++++++-- 2 files changed, 7 insertions(+), 2 deletions(-) commit 16501630bdeb107141a0139ddc33f92ab5582c6f Author: Clément Léger Date: Tue Oct 31 13:49:04 2023 +0000 scripts/gdb: fix usage of MOD_TEXT not defined when CONFIG_MODULES=n MOD_TEXT is only defined if CONFIG_MODULES=y which lead to loading failure of the gdb scripts when kernel is built without CONFIG_MODULES=y: Reading symbols from vmlinux... Traceback (most recent call last): File "/foo/vmlinux-gdb.py", line 25, in import linux.constants File "/foo/scripts/gdb/linux/constants.py", line 14, in LX_MOD_TEXT = gdb.parse_and_eval("MOD_TEXT") ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ gdb.error: No symbol "MOD_TEXT" in current context. Add a conditional check on CONFIG_MODULES to fix this error. Link: https://lkml.kernel.org/r/20231031134848.119391-1-da.gomez@samsung.com Fixes: b4aff7513df3 ("scripts/gdb: use mem instead of core_layout to get the module address") Signed-off-by: Clément Léger Tested-by: Daniel Gomez Signed-off-by: Daniel Gomez Cc: Jan Kiszka Cc: Kieran Bingham Cc: Luis Chamberlain Cc: Pankaj Raghav Signed-off-by: Andrew Morton scripts/gdb/linux/constants.py.in | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 4aa8f278b94e1885a9b42c1c765c4edddfdc42f1 Author: Bagas Sanjaya Date: Tue Oct 31 08:40:00 2023 +0700 .mailmap: add address mapping for Tomeu Vizoso He's no longer working in Collabora (and his email address there bounces). Map it to his personal address. Link: https://lkml.kernel.org/r/20231031014009.22765-2-bagasdotme@gmail.com Signed-off-by: Bagas Sanjaya Acked-by: Tomeu Vizoso Cc: Bjorn Andersson Cc: Heiko Stuebner Cc: Jakub Kicinski Cc: Jens Axboe Cc: Konrad Dybcio Cc: Stephen Hemminger Signed-off-by: Andrew Morton .mailmap | 1 + 1 file changed, 1 insertion(+) commit fbbc2af38463add04af0117671b006866052e43b Author: Claudiu Beznea Date: Mon Oct 30 08:36:32 2023 +0200 mailmap: update email address for Claudiu Beznea Claudiu Beznea's Microchip email address is no longer valid. Map it to a valid one. Link: https://lkml.kernel.org/r/20231030063632.1707372-1-claudiu.beznea@tuxon.dev Signed-off-by: Claudiu Beznea Cc: Bjorn Andersson Cc: Heiko Stuebner Cc: Jakub Kicinski Cc: Jens Axboe Cc: Konrad Dybcio Cc: Oleksij Rempel Signed-off-by: Andrew Morton .mailmap | 1 + 1 file changed, 1 insertion(+) commit 2ffc27b15b11c9584ac46335c2ed2248d2aa4137 Author: Itaru Kitayama Date: Mon Oct 30 17:54:45 2023 +0900 tools/testing/selftests/mm/run_vmtests.sh: lower the ptrace permissions On Ubuntu and probably other distros, ptrace permissions are tightend a bit by default; i.e., /proc/sys/kernel/yama/ptrace_score is set to 1. This cases memfd_secret's ptrace attach test fails with a permission error. Set it to 0 piror to running the program. Link: https://lkml.kernel.org/r/20231030-selftest-v1-1-743df68bb996@linux.dev Signed-off-by: Itaru Kitayama Cc: Shuah Khan Signed-off-by: Andrew Morton tools/testing/selftests/mm/run_vmtests.sh | 1 + 1 file changed, 1 insertion(+) commit 90723a82d8a54d98b3ed77161eb5f786ec2b3927 Author: Bagas Sanjaya Date: Mon Oct 30 21:24:55 2023 +0700 .mailmap: map Benjamin Poirier's address Map out to his gmail address as he had left SUSE some time ago. Link: https://lkml.kernel.org/r/20231030142454.22127-2-bagasdotme@gmail.com Signed-off-by: Bagas Sanjaya Acked-by: Benjamin Poirier Cc: Bjorn Andersson Cc: Greg Kroah-Hartman Cc: Heiko Stuebner Cc: Jakub Kicinski Cc: Konrad Dybcio Cc: Oleksij Rempel Cc: Stephen Hemminger Signed-off-by: Andrew Morton .mailmap | 1 + 1 file changed, 1 insertion(+) commit cd24f44050f31d69ed5851b55ef77ea6346aa814 Author: Deepak Gupta Date: Thu Oct 26 16:38:23 2023 -0700 scripts/gdb: add lx_current support for riscv csr_sscratch CSR holds current task_struct address when hart is in user space. Trap handler on entry spills csr_sscratch into "tp" (x2) register and zeroes out csr_sscratch CSR. Trap handler on exit reloads "tp" with expected user mode value and place current task_struct address again in csr_sscratch CSR. This patch assumes "tp" is pointing to task_struct. If value in csr_sscratch is numerically greater than "tp" then it assumes csr_sscratch is correct address of current task_struct. This logic holds when - hart is in user space, "tp" will be less than csr_sscratch. - hart is in kernel space but not in trap handler, "tp" will be more than csr_sscratch (csr_sscratch being equal to 0). - hart is executing trap handler - "tp" is still pointing to user mode but csr_sscratch contains ptr to task_struct. Thus numerically higher. - "tp" is pointing to task_struct but csr_sscratch now contains either 0 or numerically smaller value (transiently holds user mode tp) Link: https://lkml.kernel.org/r/20231026233837.612405-1-debug@rivosinc.com Signed-off-by: Deepak Gupta Reviewed-by: Andrew Jones Reviewed-by: Palmer Dabbelt Acked-by: Palmer Dabbelt Tested-by: Hsieh-Tseng Shen Cc: Albert Ou Cc: Glenn Washburn Cc: Jan Kiszka Cc: Jeff Xie Cc: Kieran Bingham Cc: Palmer Dabbelt Cc: Paul Walmsley Signed-off-by: Andrew Morton scripts/gdb/linux/cpus.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit e3bc0c427f2aee757c249e0f087b0a0e810d66e3 Author: Kunwu Chan Date: Wed Oct 25 15:29:06 2023 +0800 ocfs2: fix a spelling typo in comment Fix a spelling typo in comment. Link: https://lkml.kernel.org/r/20231025072906.14285-1-chentao@kylinos.cn Signed-off-by: Kunwu Chan Acked-by: Joseph Qi Signed-off-by: Andrew Morton fs/ocfs2/buffer_head_io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bf5add391eeb450b502d2593c05f84982724e6a2 Author: Swarup Laxman Kotiaklapudi Date: Fri Oct 27 17:26:24 2023 +0300 proc: test ProtectionKey in proc-empty-vm test Check ProtectionKey field in /proc/*/smaps output, if system supports protection keys feature. [adobriyan@gmail.com: test support in the beginning of the program, use syscall, not glibc pkey_alloc(3) which may not compile] Link: https://lkml.kernel.org/r/ac05efa7-d2a0-48ad-b704-ffdd5450582e@p183 Signed-off-by: Swarup Laxman Kotiaklapudi Signed-off-by: Alexey Dobriyan Reviewed-by: Swarup Laxman Kotikalapudi Tested-by: Swarup Laxman Kotikalapudi Signed-off-by: Andrew Morton tools/testing/selftests/proc/proc-empty-vm.c | 79 +++++++++++++++++++++------- 1 file changed, 61 insertions(+), 18 deletions(-) commit 20e34aa7e08dbac5d7f757fea81fae8df462aa42 Author: Alexey Dobriyan Date: Fri Oct 27 17:21:03 2023 +0300 proc: fix proc-empty-vm test with vsyscall * fix embarassing /proc/*/smaps test bug due to a typo in variable name it tested only the first line of the output if vsyscall is enabled: ffffffffff600000-ffffffffff601000 r-xp ... so test passed but tested only VMA location and permissions. * add "KSM" entry, unnoticed because (1) * swap "r-xp" and "--xp" vsyscall test strings, also unnoticed because (1) Link: https://lkml.kernel.org/r/76f42cce-b1ab-45ec-b6b2-4c64f0dccb90@p183 Signed-off-by: Alexey Dobriyan Tested-by: Swarup Laxman Kotikalapudi Signed-off-by: Andrew Morton tools/testing/selftests/proc/proc-empty-vm.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 639931020e1a70308a5c71f4702443429cb6899c Author: Yang Li Date: Thu Oct 26 08:56:34 2023 +0800 fs/proc/base.c: remove unneeded semicolon ./fs/proc/base.c:3829:2-3: Unneeded semicolon Link: https://lkml.kernel.org/r/20231026005634.6581-1-yang.lee@linux.alibaba.com Signed-off-by: Yang Li Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=7057 Acked-by: Oleg Nesterov Signed-off-by: Andrew Morton fs/proc/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1df4bd83cdfdbd0720ddb2c6488b7e9a432ba468 Author: Oleg Nesterov Date: Mon Oct 23 17:34:05 2023 +0200 do_io_accounting: use sig->stats_lock Rather than lock_task_sighand(), sig->stats_lock was specifically designed for this type of use. This way the "if (whole)" branch runs lockless in the likely case. Link: https://lkml.kernel.org/r/20231023153405.GA4639@redhat.com Signed-off-by: Oleg Nesterov Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton fs/proc/base.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) commit 2320222067887f58dc9d7dba2e3ec285d02d45f3 Author: Oleg Nesterov Date: Mon Oct 23 17:33:43 2023 +0200 do_io_accounting: use __for_each_thread() Rather than while_each_thread() which should be avoided when possible. This makes the code more clear and allows the next change. Link: https://lkml.kernel.org/r/20231023153343.GA4629@redhat.com Signed-off-by: Oleg Nesterov Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton fs/proc/base.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 873ed7222c17cfd3cba1b1147552171581ffa6ca Author: Jia Rui Date: Thu Oct 19 03:18:11 2023 +0800 ocfs2: replace BUG_ON() at ocfs2_num_free_extents() with ocfs2_error() The BUG_ON() at ocfs2_num_free_extents() handles the error that l_tree_deepth of leaf extent block just read form disk is invalid. This error is mostly caused by file system metadata corruption on the disk. There is no need to call BUG_ON() to handle such errors. We can return error code, since the caller can deal with errors from ocfs2_num_free_extents(). Also, we should make the file system read-only to avoid the damage from expanding. Therefore, BUG_ON() is removed and ocfs2_error() is called instead. Link: https://lkml.kernel.org/r/20231018191811.412458-1-jindui71@gmail.com Signed-off-by: Jia Rui Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton fs/ocfs2/alloc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit f003a717ae9086b1e8a4663124a96862df7282e7 Author: Matthew Wilcox (Oracle) Date: Fri Sep 15 18:33:33 2023 +0100 nfs: Convert nfs_symlink() to use a folio Use the folio APIs, saving about four calls to compound_head(). Convert back to a page in each of the individual protocol implementations. Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Trond Myklebust fs/nfs/dir.c | 29 ++++++++++++----------------- fs/nfs/nfs3proc.c | 3 ++- fs/nfs/nfs4proc.c | 7 ++++--- fs/nfs/proc.c | 3 ++- include/linux/nfs_xdr.h | 2 +- 5 files changed, 21 insertions(+), 23 deletions(-) commit bfca5fb4e97c46503ddfc582335917b0cc228264 Author: felix Date: Mon Oct 23 09:40:19 2023 +0800 SUNRPC: Fix RPC client cleaned up the freed pipefs dentries RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir() workqueue,which takes care about pipefs superblock locking. In some special scenarios, when kernel frees the pipefs sb of the current client and immediately alloctes a new pipefs sb, rpc_remove_pipedir function would misjudge the existence of pipefs sb which is not the one it used to hold. As a result, the rpc_remove_pipedir would clean the released freed pipefs dentries. To fix this issue, rpc_remove_pipedir should check whether the current pipefs sb is consistent with the original pipefs sb. This error can be catched by KASAN: ========================================================= [ 250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200 [ 250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503 [ 250.500549] Workqueue: events rpc_free_client_work [ 250.501001] Call Trace: [ 250.502880] kasan_report+0xb6/0xf0 [ 250.503209] ? dget_parent+0x195/0x200 [ 250.503561] dget_parent+0x195/0x200 [ 250.503897] ? __pfx_rpc_clntdir_depopulate+0x10/0x10 [ 250.504384] rpc_rmdir_depopulate+0x1b/0x90 [ 250.504781] rpc_remove_client_dir+0xf5/0x150 [ 250.505195] rpc_free_client_work+0xe4/0x230 [ 250.505598] process_one_work+0x8ee/0x13b0 ... [ 22.039056] Allocated by task 244: [ 22.039390] kasan_save_stack+0x22/0x50 [ 22.039758] kasan_set_track+0x25/0x30 [ 22.040109] __kasan_slab_alloc+0x59/0x70 [ 22.040487] kmem_cache_alloc_lru+0xf0/0x240 [ 22.040889] __d_alloc+0x31/0x8e0 [ 22.041207] d_alloc+0x44/0x1f0 [ 22.041514] __rpc_lookup_create_exclusive+0x11c/0x140 [ 22.041987] rpc_mkdir_populate.constprop.0+0x5f/0x110 [ 22.042459] rpc_create_client_dir+0x34/0x150 [ 22.042874] rpc_setup_pipedir_sb+0x102/0x1c0 [ 22.043284] rpc_client_register+0x136/0x4e0 [ 22.043689] rpc_new_client+0x911/0x1020 [ 22.044057] rpc_create_xprt+0xcb/0x370 [ 22.044417] rpc_create+0x36b/0x6c0 ... [ 22.049524] Freed by task 0: [ 22.049803] kasan_save_stack+0x22/0x50 [ 22.050165] kasan_set_track+0x25/0x30 [ 22.050520] kasan_save_free_info+0x2b/0x50 [ 22.050921] __kasan_slab_free+0x10e/0x1a0 [ 22.051306] kmem_cache_free+0xa5/0x390 [ 22.051667] rcu_core+0x62c/0x1930 [ 22.051995] __do_softirq+0x165/0x52a [ 22.052347] [ 22.052503] Last potentially related work creation: [ 22.052952] kasan_save_stack+0x22/0x50 [ 22.053313] __kasan_record_aux_stack+0x8e/0xa0 [ 22.053739] __call_rcu_common.constprop.0+0x6b/0x8b0 [ 22.054209] dentry_free+0xb2/0x140 [ 22.054540] __dentry_kill+0x3be/0x540 [ 22.054900] shrink_dentry_list+0x199/0x510 [ 22.055293] shrink_dcache_parent+0x190/0x240 [ 22.055703] do_one_tree+0x11/0x40 [ 22.056028] shrink_dcache_for_umount+0x61/0x140 [ 22.056461] generic_shutdown_super+0x70/0x590 [ 22.056879] kill_anon_super+0x3a/0x60 [ 22.057234] rpc_kill_sb+0x121/0x200 Fixes: 0157d021d23a ("SUNRPC: handle RPC client pipefs dentries by network namespace aware routines") Signed-off-by: felix Signed-off-by: Trond Myklebust include/linux/sunrpc/clnt.h | 1 + net/sunrpc/clnt.c | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) commit 5cc7688bae7f0757c39c1d3dfdd827b724061067 Author: Olga Kornievskaia Date: Fri Oct 13 11:04:10 2023 -0400 NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO If the client is doing pnfs IO and Kerberos is configured and EXCHANGEID successfully negotiated SP4_MACH_CRED and WRITE/COMMIT are on the list of state protected operations, then we need to make sure to choose the DS's rpc_client structure instead of the MDS's one. Fixes: fb91fb0ee7b2 ("NFS: Move call to nfs4_state_protect_write() to nfs4_write_setup()") Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust fs/nfs/nfs4proc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 4f3ed837186fc0d2722ba8d2457a594322e9c2ef Author: Dan Carpenter Date: Wed Oct 11 11:00:22 2023 +0300 SUNRPC: Add an IS_ERR() check back to where it was This IS_ERR() check was deleted during in a cleanup because, at the time, the rpcb_call_async() function could not return an error pointer. That changed in commit 25cf32ad5dba ("SUNRPC: Handle allocation failure in rpc_new_task()") and now it can return an error pointer. Put the check back. A related revert was done in commit 13bd90141804 ("Revert "SUNRPC: Remove unreachable error condition""). Fixes: 037e910b52b0 ("SUNRPC: Remove unreachable error condition in rpcb_getport_async()") Signed-off-by: Dan Carpenter Signed-off-by: Trond Myklebust net/sunrpc/rpcb_clnt.c | 4 ++++ 1 file changed, 4 insertions(+) commit 6bd1a77dc72dea0b0d8b6014f231143984d18f6d Author: Olga Kornievskaia Date: Fri Sep 15 15:21:16 2023 -0400 NFSv4.1: fix handling NFS4ERR_DELAY when testing for session trunking Currently when client sends an EXCHANGE_ID for a possible trunked connection, for any error that happened, the trunk will be thrown out. However, an NFS4ERR_DELAY is a transient error that should be retried instead. Fixes: e818bd085baf ("NFSv4.1 remove xprt from xprt_switch if session trunking test fails") Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust fs/nfs/nfs4proc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit a68c6fbb638a1aaad34b99f9e647072dcc711021 Author: Mkrtchyan, Tigran Date: Mon Sep 11 16:59:04 2023 +0200 nfs41: drop dependency between flexfiles layout driver and NFSv3 modules The flexfiles layout driver depends on NFSv3 module as data servers might be configure to provide nfsv3 only. Disabling the nfsv3 protocol completely disables the flexfiles layout driver, however, the data server still might support v4.1 protocol. Thus the strond couling betwwen flexfiles and nfsv3 modules should be relaxed, as layout driver will return UNSUPPORTED if not matching protocol is found. Signed-off-by: Tigran Mkrtchyan Signed-off-by: Trond Myklebust fs/nfs/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9732336006764e2ee61225387e3c70eae9139035 Author: SeongJae Park Date: Tue Oct 31 17:01:31 2023 +0000 mm/damon/sysfs: update monitoring target regions for online input commit When user input is committed online, DAMON sysfs interface is ignoring the user input for the monitoring target regions. Such request is valid and useful for fixed monitoring target regions-based monitoring ops like 'paddr' or 'fvaddr'. Update the region boundaries as user specified, too. Note that the monitoring results of the regions that overlap between the latest monitoring target regions and the new target regions are preserved. Treat empty monitoring target regions user request as a request to just make no change to the monitoring target regions. Otherwise, users should set the monitoring target regions same to current one for every online input commit, and it could be challenging for dynamic monitoring target regions update DAMON ops like 'vaddr'. If the user really need to remove all monitoring target regions, they can simply remove the target and then create the target again with empty target regions. Link: https://lkml.kernel.org/r/20231031170131.46972-1-sj@kernel.org Fixes: da87878010e5 ("mm/damon/sysfs: support online inputs update") Signed-off-by: SeongJae Park Cc: [5.19+] Signed-off-by: Andrew Morton mm/damon/sysfs.c | 47 ++++++++++++++++++++++++++++++----------------- 1 file changed, 30 insertions(+), 17 deletions(-) commit 19467a950b49432a84bf6dbadbbb17bdf89418b7 Author: SeongJae Park Date: Sun Oct 22 21:07:33 2023 +0000 mm/damon/sysfs: remove requested targets when online-commit inputs damon_sysfs_set_targets(), which updates the targets of the context for online commitment, do not remove targets that removed from the corresponding sysfs files. As a result, more than intended targets of the context can exist and hence consume memory and monitoring CPU resource more than expected. Fix it by removing all targets of the context and fill up again using the user input. This could cause unnecessary memory dealloc and realloc operations, but this is not a hot code path. Also, note that damon_target is stateless, and hence no data is lost. [sj@kernel.org: fix unnecessary monitoring results removal] Link: https://lkml.kernel.org/r/20231028213353.45397-1-sj@kernel.org Link: https://lkml.kernel.org/r/20231022210735.46409-2-sj@kernel.org Fixes: da87878010e5 ("mm/damon/sysfs: support online inputs update") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: [5.19.x] Signed-off-by: Andrew Morton mm/damon/sysfs.c | 70 +++++++++++++++++++++++++++++--------------------------- 1 file changed, 36 insertions(+), 34 deletions(-) commit 6479b29203dedb724f4f4e08e1cc0dcf432c333b Author: Nhat Pham Date: Fri Oct 20 15:20:09 2023 -0700 selftests: add a sanity check for zswap We recently encountered a bug that makes all zswap store attempt fail. Specifically, after: "141fdeececb3 mm/zswap: delay the initialization of zswap" if we build a kernel with zswap disabled by default, then enabled after the swapfile is set up, the zswap tree will not be initialized. As a result, all zswap store calls will be short-circuited. We have to perform another swapon to get zswap working properly again. Fortunately, this issue has since been fixed by the patch that kills frontswap: "42c06a0e8ebe mm: kill frontswap" which performs zswap_swapon() unconditionally, i.e always initializing the zswap tree. This test add a sanity check that ensure zswap storing works as intended. Link: https://lkml.kernel.org/r/20231020222009.2358953-1-nphamcs@gmail.com Signed-off-by: Nhat Pham Acked-by: Rik van Riel Cc: Domenico Cerasuolo Cc: Johannes Weiner Cc: Shuah Khan Cc: Tejun Heo Cc: Zefan Li Signed-off-by: Andrew Morton tools/testing/selftests/cgroup/test_zswap.c | 48 +++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) commit 9e1b016a0bc97112a18427bce1b6849d28c6eb91 Author: Tom Yang Date: Mon Oct 23 17:57:37 2023 +0800 Documentation: maple_tree: fix word spelling error The "first" is spelled "fist". Link: https://lkml.kernel.org/r/20231023095737.21823-1-yangqixiao@inspur.com Signed-off-by: Tom Yang Reviewed-by: Liam R. Howlett Signed-off-by: Andrew Morton Documentation/core-api/maple_tree.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ca6c2ce1b481996ae5b16e4589d3c0dd61899fa8 Author: Baoquan He Date: Wed Oct 18 22:50:14 2023 +0800 mm/vmalloc: fix the unchecked dereference warning in vread_iter() LKP reported smatch warning as below: =================== smatch warnings: mm/vmalloc.c:3689 vread_iter() error: we previously assumed 'vm' could be null (see line 3667) ...... 06c8994626d1b7 @3667 size = vm ? get_vm_area_size(vm) : va_size(va); ...... 06c8994626d1b7 @3689 else if (!(vm->flags & VM_IOREMAP)) ^^^^^^^^^ Unchecked dereference ===================== This is not a runtime bug because the possible null 'vm' in the pointed place could only happen when flags == VMAP_BLOCK. However, the case 'flags == VMAP_BLOCK' should never happen and has been detected with WARN_ON. Please check vm_map_ram() implementation and the earlier checking in vread_iter() at below: ~~~~~~~~~~~~~~~~~~~~~~~~~~ /* * VMAP_BLOCK indicates a sub-type of vm_map_ram area, need * be set together with VMAP_RAM. */ WARN_ON(flags == VMAP_BLOCK); if (!vm && !flags) continue; ~~~~~~~~~~~~~~~~~~~~~~~~~~ So add checking on whether 'vm' could be null when dereferencing it in vread_iter(). This mutes smatch complaint. Link: https://lkml.kernel.org/r/ZTCURc8ZQE+KrTvS@MiWiFi-R3L-srv Link: https://lkml.kernel.org/r/ZS/2k6DIMd0tZRgK@MiWiFi-R3L-srv Signed-off-by: Baoquan He Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202310171600.WCrsOwFj-lkp@intel.com/ Cc: Lorenzo Stoakes Cc: Philip Li Signed-off-by: Andrew Morton mm/vmalloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cb61dad80fdc6a8f01b101e823a9335cd6d61071 Author: Nhat Pham Date: Tue Oct 24 16:45:09 2023 -0700 zswap: export compression failure stats During a zswap store attempt, the compression algorithm could fail (for e.g due to the page containing incompressible random data). This is not tracked in any of existing zswap counters, making it hard to monitor for and investigate. We have run into this problem several times in our internal investigations on zswap store failures. This patch adds a dedicated debugfs counter for compression algorithm failures. Link: https://lkml.kernel.org/r/20231024234509.2680539-1-nphamcs@gmail.com Signed-off-by: Nhat Pham Reviewed-by: Sergey Senozhatsky Cc: Dan Streetman Cc: Domenico Cerasuolo Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Cc: Seth Jennings Cc: Shakeel Butt Cc: Vitaly Wool Cc: Yosry Ahmed Signed-off-by: Andrew Morton mm/zswap.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 9fb2047d23d5087e124e7bc7a0abdc3f0d7f5d7e Author: Andrey Konovalov Date: Tue Oct 24 17:37:50 2023 +0200 Documentation: ubsan: drop "the" from article title Drop "the" from the title of the documentation article for UBSAN, as it is redundant. Also add SPDX-License-Identifier for ubsan.rst. Link: https://lkml.kernel.org/r/5fb11a4743eea9d9232a5284dea0716589088fec.1698161845.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Documentation/dev-tools/ubsan.rst | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 56ec8e4cd8cbff3c96c53cd8303bba924613b5ce Merge: 7d461b291e65 14dcf78a6c04 Author: Linus Torvalds Date: Wed Nov 1 09:34:55 2023 -1000 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Catalin Marinas: "No major architecture features this time around, just some new HWCAP definitions, support for the Ampere SoC PMUs and a few fixes/cleanups. The bulk of the changes is reworking of the CPU capability checking code (cpus_have_cap() etc). - Major refactoring of the CPU capability detection logic resulting in the removal of the cpus_have_const_cap() function and migrating the code to "alternative" branches where possible - Backtrace/kgdb: use IPIs and pseudo-NMI - Perf and PMU: - Add support for Ampere SoC PMUs - Multi-DTC improvements for larger CMN configurations with multiple Debug & Trace Controllers - Rework the Arm CoreSight PMU driver to allow separate registration of vendor backend modules - Fixes: add missing MODULE_DEVICE_TABLE to the amlogic perf driver; use device_get_match_data() in the xgene driver; fix NULL pointer dereference in the hisi driver caused by calling cpuhp_state_remove_instance(); use-after-free in the hisi driver - HWCAP updates: - FEAT_SVE_B16B16 (BFloat16) - FEAT_LRCPC3 (release consistency model) - FEAT_LSE128 (128-bit atomic instructions) - SVE: remove a couple of pseudo registers from the cpufeature code. There is logic in place already to detect mismatched SVE features - Miscellaneous: - Reduce the default swiotlb size (currently 64MB) if no ZONE_DMA bouncing is needed. The buffer is still required for small kmalloc() buffers - Fix module PLT counting with !RANDOMIZE_BASE - Restrict CPU_BIG_ENDIAN to LLVM IAS 15.x or newer move synchronisation code out of the set_ptes() loop - More compact cpufeature displaying enabled cores - Kselftest updates for the new CPU features" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (83 commits) arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer arm64: module: Fix PLT counting when CONFIG_RANDOMIZE_BASE=n arm64, irqchip/gic-v3, ACPI: Move MADT GICC enabled check into a helper perf: hisi: Fix use-after-free when register pmu fails drivers/perf: hisi_pcie: Initialize event->cpu only on success drivers/perf: hisi_pcie: Check the type first in pmu::event_init() arm64: cpufeature: Change DBM to display enabled cores arm64: cpufeature: Display the set of cores with a feature perf/arm-cmn: Enable per-DTC counter allocation perf/arm-cmn: Rework DTC counters (again) perf/arm-cmn: Fix DTC domain detection drivers: perf: arm_pmuv3: Drop some unused arguments from armv8_pmu_init() drivers: perf: arm_pmuv3: Read PMMIR_EL1 unconditionally drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process clocksource/drivers/arm_arch_timer: limit XGene-1 workaround arm64: Remove system_uses_lse_atomics() arm64: Mark the 'addr' argument to set_ptes() and __set_pte_at() as unused drivers/perf: xgene: Use device_get_match_data() perf/amlogic: add missing MODULE_DEVICE_TABLE arm64/mm: Hoist synchronization out of set_ptes() loop ... commit a9b8d90f87263f985fa14250fc8caf7bfcde8803 Author: Benjamin Coddington Date: Thu Aug 24 14:52:19 2023 -0400 NFSv4: fairly test all delegations on a SEQ4_ revocation When the client is required to use TEST_STATEID to discover which delegation(s) have been revoked, it may continually test delegations at the head of the list if the server continues to be unsatisfied and send SEQ4_STATUS_RECALLABLE_STATE_REVOKED. For a large number of delegations this behavior is prone to live-lock because the client may never be able to test and free revoked state at the end of the list since the SEQ4_STATUS_RECALLABLE_STATE_REVOKED will cause us to flag delegations at the head of the list to be tested. This problem is further exacerbated by the state manager's willingness to be scheduled out on a busy system while testing the list of delegations. Keep a generation counter for each attempt to test all delegations, and skip delegations that have already been tested in the current pass. Signed-off-by: Benjamin Coddington Tested-by: Torkil Svensgaard Tested-by: Ruben Vestergaard Signed-off-by: Trond Myklebust fs/nfs/delegation.c | 7 ++++++- fs/nfs/delegation.h | 1 + include/linux/nfs_fs_sb.h | 1 + 3 files changed, 8 insertions(+), 1 deletion(-) commit 8b793bcda61f6c3ed4f5b2ded7530ef6749580cb Author: Krister Johansen Date: Fri Oct 27 14:46:53 2023 -0700 watchdog: move softlockup_panic back to early_param Setting softlockup_panic from do_sysctl_args() causes it to take effect later in boot. The lockup detector is enabled before SMP is brought online, but do_sysctl_args runs afterwards. If a user wants to set softlockup_panic on boot and have it trigger should a softlockup occur during onlining of the non-boot processors, they could do this prior to commit f117955a2255 ("kernel/watchdog.c: convert {soft/hard}lockup boot parameters to sysctl aliases"). However, after this commit the value of softlockup_panic is set too late to be of help for this type of problem. Restore the prior behavior. Signed-off-by: Krister Johansen Cc: stable@vger.kernel.org Fixes: f117955a2255 ("kernel/watchdog.c: convert {soft/hard}lockup boot parameters to sysctl aliases") Signed-off-by: Luis Chamberlain fs/proc/proc_sysctl.c | 1 - kernel/watchdog.c | 7 +++++++ 2 files changed, 7 insertions(+), 1 deletion(-) commit 8001f49394e353f035306a45bcf504f06fca6355 Author: Krister Johansen Date: Fri Oct 27 14:46:40 2023 -0700 proc: sysctl: prevent aliased sysctls from getting passed to init The code that checks for unknown boot options is unaware of the sysctl alias facility, which maps bootparams to sysctl values. If a user sets an old value that has a valid alias, a message about an invalid parameter will be printed during boot, and the parameter will get passed to init. Fix by checking for the existence of aliased parameters in the unknown boot parameter code. If an alias exists, don't return an error or pass the value to init. Signed-off-by: Krister Johansen Cc: stable@vger.kernel.org Fixes: 0a477e1ae21b ("kernel/sysctl: support handling command line aliases") Signed-off-by: Luis Chamberlain fs/proc/proc_sysctl.c | 7 +++++++ include/linux/sysctl.h | 6 ++++++ init/main.c | 4 ++++ 3 files changed, 17 insertions(+) commit 5c81f752c95313e0d7e7ab148b61c7152d1a824c Merge: ab5201e20c18 b729598c1747 Author: Mark Brown Date: Wed Nov 1 17:02:32 2023 +0000 ASoC: codecs: Modify some error codes Merge series from wangweidong.a@awinic.com: The maximum value that calib can set should be consistent with the maximum value of re. An error code should be return when the re is greater than the maximum value or less than the minimum value The value of vsense_select should be either 32 or 0 in both cases, so modify the AW88399_DEV_VDSEL_VSENSE macro to 32. commit 7d461b291e65938f15f56fe58da2303b07578a76 Merge: 8bc9e6515183 631808095a82 Author: Linus Torvalds Date: Wed Nov 1 06:28:35 2023 -1000 Merge tag 'drm-next-2023-10-31-1' of git://anongit.freedesktop.org/drm/drm Pull drm updates from Dave Airlie: "Highlights: - AMD adds some more upcoming HW platforms - Intel made Meteorlake stable and started adding Lunarlake - nouveau has a bunch of display rework in prepartion for the NVIDIA GSP firmware support - msm adds a7xx support - habanalabs has finished migration to accel subsystem Detail summary: kernel: - add initial vmemdup-user-array core: - fix platform remove() to return void - drm_file owner updated to reflect owner - move size calcs to drm buddy allocator - let GPUVM build as a module - allow variable number of run-queues in scheduler edid: - handle bad h/v sync_end in EDIDs panfrost: - add Boris as maintainer fbdev: - use fb_ops helpers more - only allow logo use from fbcon - rename fb_pgproto to pgprot_framebuffer - add HPD state to drm_connector_oob_hotplug_event - convert to fbdev i/o mem helpers i915: - Enable meteorlake by default - Early Xe2 LPD/Lunarlake display enablement - Rework subplatforms into IP version checks - GuC based TLB invalidation for Meteorlake - Display rework for future Xe driver integration - LNL FBC features - LNL display feature capability reads - update recommended fw versions for DG2+ - drop fastboot module parameter - added deviceid for Arrowlake-S - drop preproduction workarounds - don't disable preemption for resets - cleanup inlines in headers - PXP firmware loading fix - Fix sg list lengths - DSC PPS state readout/verification - Add more RPL P/U PCI IDs - Add new DG2-G12 stepping - DP enhanced framing support to state checker - Improve shared link bandwidth management - stop using GEM macros in display code - refactor related code into display code - locally enable W=1 warnings - remove PSR watchdog timers on LNL amdgpu: - RAS/FRU EEPROM updatse - IP discovery updatses - GC 11.5 support - DCN 3.5 support - VPE 6.1 support - NBIO 7.11 support - DML2 support - lots of IP updates - use flexible arrays for bo list handling - W=1 fixes - Enable seamless boot in more cases - Enable context type property for HDMI - Rework GPUVM TLB flushing - VCN IB start/size alignment fixes amdkfd: - GC 10/11 fixes - GC 11.5 support - use partial migration in GPU faults radeon: - W=1 Fixes - fix some possible buffer overflow/NULL derefs nouveau: - update uapi for NO_PREFETCH - scheduler/fence fixes - rework suspend/resume for GSP-RM - rework display in preparation for GSP-RM habanalabs: - uapi: expose tsc clock - uapi: block access to eventfd through control device - uapi: force dma-buf export to PAGE_SIZE alignments - complete move to accel subsystem - move firmware interface include files - perform hard reset on PCIe AXI drain event - optimise user interrupt handling msm: - DP: use existing helpers for DPCD - DPU: interrupts reworked - gpu: a7xx (a730/a740) support - decouple msm_drv from kms for headless devices mediatek: - MT8188 dsi/dp/edp support - DDP GAMMA - 12 bit LUT support - connector dynamic selection capability rockchip: - rv1126 mipi-dsi/vop support - add planar formats ast: - rename constants panels: - Mitsubishi AA084XE01 - JDI LPM102A188A - LTK050H3148W-CTA6 ivpu: - power management fixes qaic: - add detach slice bo api komeda: - add NV12 writeback tegra: - support NVSYNC/NHSYNC - host1x suspend fixes ili9882t: - separate into own driver" * tag 'drm-next-2023-10-31-1' of git://anongit.freedesktop.org/drm/drm: (1803 commits) drm/amdgpu: Remove unused variables from amdgpu_show_fdinfo drm/amdgpu: Remove duplicate fdinfo fields drm/amd/amdgpu: avoid to disable gfxhub interrupt when driver is unloaded drm/amdgpu: Add EXT_COHERENT support for APU and NUMA systems drm/amdgpu: Retrieve CE count from ce_count_lo_chip in EccInfo table drm/amdgpu: Identify data parity error corrected in replay mode drm/amdgpu: Fix typo in IP discovery parsing drm/amd/display: fix S/G display enablement drm/amdxcp: fix amdxcp unloads incompletely drm/amd/amdgpu: fix the GPU power print error in pm info drm/amdgpu: Use pcie domain of xcc acpi objects drm/amd: check num of link levels when update pcie param drm/amdgpu: Add a read to GFX v9.4.3 ring test drm/amd/pm: call smu_cmn_get_smc_version in is_mode1_reset_supported. drm/amdgpu: get RAS poison status from DF v4_6_2 drm/amdgpu: Use discovery table's subrevision drm/amd/display: 3.2.256 drm/amd/display: add interface to query SubVP status drm/amd/display: Read before writing Backlight Mode Set Register drm/amd/display: Disable SYMCLK32_SE RCO on DCN314 ... commit 4d75fc6ceba4d154f8a9b0905c669bac6ac570c2 Author: Darrick J. Wong Date: Tue Oct 31 16:48:20 2023 -0700 iomap: rotate maintainers Per a discussion last week, let's improve coordination between fs/iomap/ and the rest of the VFS by shifting Christian into the role of git tree maintainer. I'll stay on as reviewer and main developer, which will free up some more time to clean up the code base a bit and help filesystem maintainers port off of bufferheads and onto iomap. Link: https://lore.kernel.org/linux-fsdevel/20231026-gehofft-vorfreude-a5079bff7373@brauner/ Signed-off-by: Darrick J. Wong Link: https://lore.kernel.org/r/20231031234820.GB1205221@frogsfrogsfrogs Signed-off-by: Christian Brauner MAINTAINERS | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 9f23a5d2f6b01c2ab91d791109731a0d87ec2239 Author: Clément Léger Date: Wed Oct 4 17:14:05 2023 +0200 riscv: add support for PR_SET_UNALIGN and PR_GET_UNALIGN Now that trap support is ready to handle misalignment errors in S-mode, allow the user to control the behavior of misaligned accesses using prctl(PR_SET_UNALIGN). Add an align_ctl flag in thread_struct which will be used to determine if we should SIGBUS the process or not on such fault. Signed-off-by: Clément Léger Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20231004151405.521596-9-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/processor.h | 9 +++++++++ arch/riscv/kernel/process.c | 18 ++++++++++++++++++ arch/riscv/kernel/traps_misaligned.c | 6 ++++++ 3 files changed, 33 insertions(+) commit 71c54b3d169db5569655cbd2a3616bc701fd5eec Author: Clément Léger Date: Wed Oct 4 17:14:04 2023 +0200 riscv: report misaligned accesses emulation to hwprobe hwprobe provides a way to report if misaligned access are emulated. In order to correctly populate that feature, we can check if it actually traps when doing a misaligned access. This can be checked using an exception table entry which will actually be used when a misaligned access is done from kernel mode. Signed-off-by: Clément Léger Link: https://lore.kernel.org/r/20231004151405.521596-8-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/cpufeature.h | 18 ++++++++++++ arch/riscv/kernel/cpufeature.c | 4 +++ arch/riscv/kernel/smpboot.c | 2 +- arch/riscv/kernel/traps_misaligned.c | 56 ++++++++++++++++++++++++++++++++++++ 4 files changed, 79 insertions(+), 1 deletion(-) commit 90b11b470b2e88ff583e04be109e6441cb69f54d Author: Clément Léger Date: Wed Oct 4 17:14:03 2023 +0200 riscv: annotate check_unaligned_access_boot_cpu() with __init This function is solely called as an initcall, thus annotate it with __init. Signed-off-by: Clément Léger Reviewed-by: Evan Green Link: https://lore.kernel.org/r/20231004151405.521596-7-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/cpufeature.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bc38f61313d316d74c16ce7287d6dba2f42502c9 Author: Clément Léger Date: Wed Oct 4 17:14:02 2023 +0200 riscv: add support for sysctl unaligned_enabled control This sysctl tuning option allows the user to disable misaligned access handling globally on the system. This will also be used by misaligned detection code to temporarily disable misaligned access handling. Signed-off-by: Clément Léger Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20231004151405.521596-6-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 1 + arch/riscv/kernel/traps_misaligned.c | 9 +++++++++ 2 files changed, 10 insertions(+) commit 7c586a555a48a952f64d883d2f20402fb61d9164 Author: Clément Léger Date: Wed Oct 4 17:14:01 2023 +0200 riscv: add floating point insn support to misaligned access emulation This support is partially based of openSBI misaligned emulation floating point instruction support. It provides support for the existing floating point instructions (both for 32/64 bits as well as compressed ones). Since floating point registers are not part of the pt_regs struct, we need to modify them directly using some assembly. We also dirty the pt_regs status in case we modify them to be sure context switch will save FP state. With this support, Linux is on par with openSBI support. Signed-off-by: Clément Léger Link: https://lore.kernel.org/r/20231004151405.521596-5-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/fpu.S | 121 ++++++++++++++++++++++++++++ arch/riscv/kernel/traps_misaligned.c | 152 ++++++++++++++++++++++++++++++++++- 2 files changed, 269 insertions(+), 4 deletions(-) commit 89c12fecdc4d46c1f08a81dab5d305304cc626eb Author: Clément Léger Date: Wed Oct 4 17:14:00 2023 +0200 riscv: report perf event for misaligned fault Add missing calls to account for misaligned fault event using perf_sw_event(). Signed-off-by: Clément Léger Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20231004151405.521596-4-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/traps_misaligned.c | 5 +++++ 1 file changed, 5 insertions(+) commit 7c83232161f609bbc452a1255f823f41afc411dd Author: Clément Léger Date: Wed Oct 4 17:13:59 2023 +0200 riscv: add support for misaligned trap handling in S-mode Misalignment trap handling is only supported for M-mode and uses direct accesses to user memory. In S-mode, when handling usermode fault, this requires to use the get_user()/put_user() accessors. Implement load_u8(), store_u8() and get_insn() using these accessors for userspace and direct text access for kernel. Signed-off-by: Clément Léger Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20231004151405.521596-3-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 8 +++ arch/riscv/include/asm/entry-common.h | 14 ++++ arch/riscv/kernel/Makefile | 2 +- arch/riscv/kernel/traps.c | 9 --- arch/riscv/kernel/traps_misaligned.c | 119 ++++++++++++++++++++++++++++++---- 5 files changed, 129 insertions(+), 23 deletions(-) commit f19c3b4239f5bfb69aacbaf75d4277c095e7aa7d Author: Clément Léger Date: Wed Oct 4 17:13:58 2023 +0200 riscv: remove unused functions in traps_misaligned.c Replace macros by the only two function calls that are done from this file, store_u8() and load_u8(). Signed-off-by: Clément Léger Link: https://lore.kernel.org/r/20231004151405.521596-2-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/traps_misaligned.c | 46 ++++++------------------------------ 1 file changed, 7 insertions(+), 39 deletions(-) commit 72fcce70faf06dd7442bf0b41b71f071d7fa29a4 Author: Alexey Dobriyan Date: Fri Oct 27 17:13:58 2023 +0300 vsprintf: uninline simple_strntoull(), reorder arguments * uninline simple_strntoull(), gcc overinlines and this function is not performance critical * reorder arguments, so that appending INT_MAX as 4th argument generates very efficient tail call Space savings: add/remove: 1/0 grow/shrink: 0/3 up/down: 27/-179 (-152) Function old new delta simple_strntoll - 27 +27 simple_strtoull 15 10 -5 simple_strtoll 41 7 -34 vsscanf 1930 1790 -140 Signed-off-by: Alexey Dobriyan Reviewed-by: Andy Shevchenko Reviewed-by: Petr Mladek Signed-off-by: Petr Mladek Link: https://lore.kernel.org/all/82a2af6e-9b6c-4a09-89d7-ca90cc1cdad1@p183/ lib/vsprintf.c | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) commit 5f56cb030e4bcf14be2233332d5cd83fff62a376 Author: Masahiro Yamada Date: Wed Nov 1 03:11:57 2023 +0900 kbuild: support 'userldlibs' syntax This syntax is useful to specify libraries linked to all userspace programs in the Makefile. Signed-off-by: Masahiro Yamada Documentation/kbuild/makefiles.rst | 4 ++++ scripts/Makefile.userprogs | 6 +++--- 2 files changed, 7 insertions(+), 3 deletions(-) commit 1bfaa37fd3486e66131de9cb87747c84b4c89a05 Author: Jiri Slaby (SUSE) Date: Mon Oct 30 12:34:16 2023 +0100 kbuild: dummy-tools: pretend we understand -fpatchable-function-entry Commit 0f71dcfb4aef ("powerpc/ftrace: Add support for -fpatchable-function-entry") added a script to check for -fpatchable-function-entry compiler support. The script expects compiler to emit the section __patchable_function_entries and few nops after a function entry. If the compiler understands and emits the above, CONFIG_ARCH_USING_PATCHABLE_FUNCTION_ENTRY is set. So teach dummy-tools' gcc about this. Signed-off-by: Jiri Slaby (SUSE) Reviewed-by: Nathan Chancellor Signed-off-by: Masahiro Yamada scripts/dummy-tools/gcc | 10 ++++++++++ 1 file changed, 10 insertions(+) commit e07754e0a1ea2d63fb29574253d1fd7405607343 Author: Dan Carpenter Date: Fri Oct 27 15:12:54 2023 +0300 vhost-vdpa: fix use after free in vhost_vdpa_probe() The put_device() calls vhost_vdpa_release_dev() which calls ida_simple_remove() and frees "v". So this call to ida_simple_remove() is a use after free and a double free. Fixes: ebe6a354fa7e ("vhost-vdpa: Call ida_simple_remove() when failed") Signed-off-by: Dan Carpenter Message-Id: Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang drivers/vhost/vdpa.c | 1 - 1 file changed, 1 deletion(-) commit b2c8b644fac1087dfe69a1762c04df090178a5ae Author: Jakub Sitnicki Date: Wed Oct 25 16:53:19 2023 +0200 virtio_pci: Switch away from deprecated irq_set_affinity_hint Since commit 65c7cdedeb30 ("genirq: Provide new interfaces for affinity hints") irq_set_affinity_hint is being phased out. Switch to new interfaces for setting and applying irq affinity hints. Signed-off-by: Jakub Sitnicki Message-Id: <20231025145319.380775-1-jakub@cloudflare.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo drivers/virtio/virtio_pci_common.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit f2de37a572853d340f945a7748f74e3ed8c6b743 Author: Björn Töpel Date: Thu Oct 12 12:28:52 2023 +0200 riscv, qemu_fw_cfg: Add support for RISC-V architecture Qemu fw_cfg support was missing for RISC-V, which made it hard to do proper vmcore dumps from qemu. Add the missing RISC-V arch-defines. You can now do vmcore dumps from qemu. Add "-device vmcoreinfo" to the qemu command-line. From the qemu monitor: (qemu) dump-guest-memory vmcore The vmcore can now be used, e.g., with the "crash" utility. Acked-by: "Michael S. Tsirkin" Acked-by: Alistair Francis Tested-by: Clément Léger Signed-off-by: Björn Töpel Message-Id: <20231012102852.234442-1-bjorn@kernel.org> Signed-off-by: Michael S. Tsirkin drivers/firmware/Kconfig | 2 +- drivers/firmware/qemu_fw_cfg.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 0d82410252ea324f0064e75b9865bb74cccc1dda Author: Stefano Garzarella Date: Tue Oct 31 15:43:39 2023 +0100 vdpa_sim_blk: allocate the buffer zeroed Deleting and recreating a device can lead to having the same content as the old device, so let's always allocate buffers completely zeroed out. Fixes: abebb16254b3 ("vdpa_sim_blk: support shared backend") Suggested-by: Qing Wang Signed-off-by: Stefano Garzarella Message-Id: <20231031144339.121453-1-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin Acked-by: Eugenio Pérez Acked-by: Jason Wang drivers/vdpa/vdpa_sim/vdpa_sim_blk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3503895788d402d6a3814085ed582c364ec3e903 Author: Michael S. Tsirkin Date: Tue Oct 31 12:02:06 2023 -0400 virtio_pci: move structure to a header These are guest/host interfaces, so they belong in the header where e.g. qemu will know to find them. Note: we added a new structure as opposed to extending existing one because someone might be relying on the size of the existing structure staying unchanged. Add a warning to avoid using sizeof. Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo drivers/virtio/virtio_pci_modern_dev.c | 7 ++++--- include/linux/virtio_pci_modern.h | 7 ------- include/uapi/linux/virtio_pci.h | 11 +++++++++++ 3 files changed, 15 insertions(+), 10 deletions(-) commit 86f6c224c97911b4392cb7b402e6a4ed323a449e Author: Si-Wei Liu Date: Sat Oct 21 02:25:19 2023 -0700 vdpa_sim: implement .reset_map support In order to reduce excessive memory mapping cost in live migration and VM reboot, it is desirable to decouple the vhost-vdpa IOTLB abstraction from the virtio device life cycle, i.e. mappings can be kept intact across virtio device reset. Leverage the .reset_map callback, which is meant to destroy the iotlb on the given ASID and recreate the 1:1 passthrough/identity mapping. To be consistent, the mapping on device creation is initiailized to passthrough/identity with PA 1:1 mapped as IOVA. With this the device .reset op doesn't have to maintain and clean up memory mappings by itself. Additionally, implement .compat_reset to cater for older userspace, which may wish to see mapping to be cleared during reset. Signed-off-by: Si-Wei Liu Tested-by: Stefano Garzarella Message-Id: <1697880319-4937-8-git-send-email-si-wei.liu@oracle.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang drivers/vdpa/vdpa_sim/vdpa_sim.c | 52 +++++++++++++++++++++++++++++++++------- 1 file changed, 43 insertions(+), 9 deletions(-) commit 2eacf4b5e3ebe771f0fca0c8913c5a10a1953b72 Author: Si-Wei Liu Date: Sat Oct 21 02:25:18 2023 -0700 vdpa/mlx5: implement .reset_map driver op Since commit 6f5312f80183 ("vdpa/mlx5: Add support for running with virtio_vdpa"), mlx5_vdpa starts with preallocate 1:1 DMA MR at device creation time. This 1:1 DMA MR will be implicitly destroyed while the first .set_map call is invoked, in which case callers like vhost-vdpa will start to set up custom mappings. When the .reset callback is invoked, the custom mappings will be cleared and the 1:1 DMA MR will be re-created. In order to reduce excessive memory mapping cost in live migration, it is desirable to decouple the vhost-vdpa IOTLB abstraction from the virtio device life cycle, i.e. mappings can be kept around intact across virtio device reset. Leverage the .reset_map callback, which is meant to destroy the regular MR (including cvq mapping) on the given ASID and recreate the initial DMA mapping. That way, the device .reset op runs free from having to maintain and clean up memory mappings by itself. Additionally, implement .compat_reset to cater for older userspace, which may wish to see mapping to be cleared during reset. Co-developed-by: Dragos Tatulea Signed-off-by: Dragos Tatulea Signed-off-by: Si-Wei Liu Message-Id: <1697880319-4937-7-git-send-email-si-wei.liu@oracle.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang drivers/vdpa/mlx5/core/mlx5_vdpa.h | 1 + drivers/vdpa/mlx5/core/mr.c | 17 +++++++++++++++++ drivers/vdpa/mlx5/net/mlx5_vnet.c | 27 ++++++++++++++++++++++++--- 3 files changed, 42 insertions(+), 3 deletions(-) commit bc91df5c70ac720eca18bd1f4a288f2582713d3e Author: Si-Wei Liu Date: Sat Oct 21 02:25:17 2023 -0700 vhost-vdpa: clean iotlb map during reset for older userspace Using .compat_reset op from the previous patch, the buggy .reset behaviour can be kept as-is on older userspace apps, which don't ack the IOTLB_PERSIST backend feature. As this compatibility quirk is limited to those drivers that used to be buggy in the past, it won't affect change the behaviour or affect ABI on the setups with API compliant driver. The separation of .compat_reset from the regular .reset allows vhost-vdpa able to know which driver had broken behaviour before, so it can apply the corresponding compatibility quirk to the individual driver whenever needed. Compared to overloading the existing .reset with flags, .compat_reset won't cause any extra burden to the implementation of every compliant driver. [mst: squashed in two fixup commits] Message-Id: <1697880319-4937-6-git-send-email-si-wei.liu@oracle.com> Message-Id: <1698102863-21122-1-git-send-email-si-wei.liu@oracle.com> Reported-by: Dragos Tatulea Tested-by: Dragos Tatulea Message-Id: <1698275594-19204-1-git-send-email-si-wei.liu@oracle.com> Reported-by: Lei Yang Signed-off-by: Si-Wei Liu Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang drivers/vhost/vdpa.c | 20 ++++++++++++++++---- drivers/virtio/virtio_vdpa.c | 2 +- include/linux/vdpa.h | 7 +++++-- 3 files changed, 22 insertions(+), 7 deletions(-) commit a26f2e4e68ee3130e5d5acb4f58807041aaea905 Author: Si-Wei Liu Date: Sat Oct 21 02:25:16 2023 -0700 vdpa: introduce .compat_reset operation callback Some device specific IOMMU parent drivers have long standing bogus behaviour that mistakenly clean up the maps during .reset. By definition, this is violation to the on-chip IOMMU ops (i.e. .set_map, or .dma_map & .dma_unmap) in those offending drivers, as the removal of internal maps is completely agnostic to the upper layer, causing inconsistent view between the userspace and the kernel. Some userspace app like QEMU gets around of this brokenness by proactively removing and adding back all the maps around vdpa device reset, but such workaround actually penaltize other well-behaved driver setup, where vdpa reset always comes with the associated mapping cost, especially for kernel vDPA devices (use_va=false) that have high cost on pinning. It's imperative to rectify this behaviour and remove the problematic code from all those non-compliant parent drivers. However, we cannot unconditionally remove the bogus map-cleaning code from the buggy .reset implementation, as there might exist userspace apps that already rely on the behaviour on some setup. Introduce a .compat_reset driver op to keep compatibility with older userspace. New and well behaved parent driver should not bother to implement such op, but only those drivers that are doing or used to do non-compliant map-cleaning reset will have to. Signed-off-by: Si-Wei Liu Message-Id: <1697880319-4937-5-git-send-email-si-wei.liu@oracle.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang include/linux/vdpa.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 4398776f7a6d532c466f9e41f601c9a291fac5ef Author: Si-Wei Liu Date: Sat Oct 21 02:25:15 2023 -0700 vhost-vdpa: introduce IOTLB_PERSIST backend feature bit Userspace needs this feature flag to distinguish if vhost-vdpa iotlb in the kernel can be trusted to persist IOTLB mapping across vDPA reset. Without it, userspace has no way to tell apart if it's running on an older kernel, which could silently drop all iotlb mapping across vDPA reset, especially with broken parent driver implementation for the .reset driver op. The broken driver may incorrectly drop all mappings of its own as part of .reset, which inadvertently ends up with corrupted mapping state between vhost-vdpa userspace and the kernel. As a workaround, to make the mapping behaviour predictable across reset, userspace has to pro-actively remove all mappings before vDPA reset, and then restore all the mappings afterwards. This workaround is done unconditionally on top of all parent drivers today, due to the parent driver implementation issue and no means to differentiate. This workaround had been utilized in QEMU since day one when the corresponding vhost-vdpa userspace backend came to the world. There are 3 cases that backend may claim this feature bit on for: - parent device that has to work with platform IOMMU - parent device with on-chip IOMMU that has the expected .reset_map support in driver - parent device with vendor specific IOMMU implementation with persistent IOTLB mapping already that has to specifically declare this backend feature The reason why .reset_map is being one of the pre-condition for persistent iotlb is because without it, vhost-vdpa can't switch back iotlb to the initial state later on, especially for the on-chip IOMMU case which starts with identity mapping at device creation. virtio-vdpa requires on-chip IOMMU to perform 1:1 passthrough translation from PA to IOVA as-is to begin with, and .reset_map is the only means to turn back iotlb to the identity mapping mode after vhost-vdpa is gone. The difference in behavior did not matter as QEMU unmaps all the memory unregistering the memory listener at vhost_vdpa_dev_start( started = false), but the backend acknowledging this feature flag allows QEMU to make sure it is safe to skip this unmap & map in the case of vhost stop & start cycle. In that sense, this feature flag is actually a signal for userspace to know that the driver bug has been solved. Not offering it indicates that userspace cannot trust the kernel will retain the maps. Signed-off-by: Si-Wei Liu Acked-by: Eugenio Pérez Message-Id: <1697880319-4937-4-git-send-email-si-wei.liu@oracle.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang drivers/vhost/vdpa.c | 15 +++++++++++++++ include/uapi/linux/vhost_types.h | 2 ++ 2 files changed, 17 insertions(+) commit 1d0f874bfe7871837fb215999979284d579fc373 Author: Si-Wei Liu Date: Sat Oct 21 02:25:14 2023 -0700 vhost-vdpa: reset vendor specific mapping to initial state in .release Devices with on-chip IOMMU or vendor specific IOTLB implementation may need to restore iotlb mapping to the initial or default state using the .reset_map op, as it's desirable for some parent devices to not work with DMA ops and maintain a simple IOMMU model with .reset_map. In particular, device reset should not cause mapping to go away on such IOTLB model, so persistent mapping is implied across reset. Before the userspace process using vhost-vdpa is gone, give it a chance to reset iotlb back to the initial state in vhost_vdpa_cleanup(). Signed-off-by: Si-Wei Liu Acked-by: Eugenio Pérez Message-Id: <1697880319-4937-3-git-send-email-si-wei.liu@oracle.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang drivers/vhost/vdpa.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) commit d2cf1b6e3b85dcb2bb3e8cd7924beede34fbbf0e Author: Si-Wei Liu Date: Sat Oct 21 02:25:13 2023 -0700 vdpa: introduce .reset_map operation callback Some device specific IOMMU parent drivers have long standing bogus behavior that mistakenly clean up the maps during .reset. By definition, this is violation to the on-chip IOMMU ops (i.e. .set_map, or .dma_map & .dma_unmap) in those offending drivers, as the removal of internal maps is completely agnostic to the upper layer, causing inconsistent view between the userspace and the kernel. Some userspace app like QEMU gets around of this brokenness by proactively removing and adding back all the maps around vdpa device reset, but such workaround actually penalize other well-behaved driver setup, where vdpa reset always comes with the associated mapping cost, especially for kernel vDPA devices (use_va=false) that have high cost on pinning. It's imperative to rectify this behavior and remove the problematic code from all those non-compliant parent drivers. The reason why a separate .reset_map op is introduced is because this allows a simple on-chip IOMMU model without exposing too much device implementation detail to the upper vdpa layer. The .dma_map/unmap or .set_map driver API is meant to be used to manipulate the IOTLB mappings, and has been abstracted in a way similar to how a real IOMMU device maps or unmaps pages for certain memory ranges. However, apart from this there also exists other mapping needs, in which case 1:1 passthrough mapping has to be used by other users (read virtio-vdpa). To ease parent/vendor driver implementation and to avoid abusing DMA ops in an unexpacted way, these on-chip IOMMU devices can start with 1:1 passthrough mapping mode initially at the time of creation. Then the .reset_map op can be used to switch iotlb back to this initial state without having to expose a complex two-dimensional IOMMU device model. The .reset_map is not a MUST for every parent that implements the .dma_map or .set_map API, because device may work with DMA ops directly by implement their own to manipulate system memory mappings, so don't have to use .reset_map to achieve a simple IOMMU device model for 1:1 passthrough mapping. Signed-off-by: Si-Wei Liu Acked-by: Eugenio Pérez Acked-by: Jason Wang Message-Id: <1697880319-4937-2-git-send-email-si-wei.liu@oracle.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang include/linux/vdpa.h | 10 ++++++++++ 1 file changed, 10 insertions(+) commit e0592acd1ef2497b861ef7ed6eda14b092b1e667 Author: Xuan Zhuo Date: Thu Oct 19 11:49:02 2023 +0800 virtio_pci: add check for common cfg size Some buggy devices, the common cfg size may not match the features. This patch checks the common cfg size for the features(VIRTIO_F_NOTIF_CONFIG_DATA, VIRTIO_F_RING_RESET). When the common cfg size does not match the corresponding feature, we fail the probe and print error message. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20231019034902.7346-1-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_modern.c | 36 ++++++++++++++++++++++++++++++++++ drivers/virtio/virtio_pci_modern_dev.c | 2 +- include/linux/virtio_pci_modern.h | 1 + 3 files changed, 38 insertions(+), 1 deletion(-) commit fafb51a67fb883eb2dde352539df939a251851be Author: zhenwei pi Date: Mon Sep 4 14:10:45 2023 +0800 virtio-blk: fix implicit overflow on virtio_max_dma_size The following codes have an implicit conversion from size_t to u32: (u32)max_size = (size_t)virtio_max_dma_size(vdev); This may lead overflow, Ex (size_t)4G -> (u32)0. Once virtio_max_dma_size() has a larger size than U32_MAX, use U32_MAX instead. Signed-off-by: zhenwei pi Message-Id: <20230904061045.510460-1-pizhenwei@bytedance.com> Signed-off-by: Michael S. Tsirkin drivers/block/virtio_blk.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 327e0ab32cd050513ffaf0aa9234884a2b4ca424 Author: Xuan Zhuo Date: Tue Oct 10 11:11:20 2023 +0800 virtio_pci: add build offset check for the new common cfg items Add checks to the check_offsets(void) for queue_notify_data and queue_reset. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20231010031120.81272-5-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_modern_dev.c | 4 ++++ 1 file changed, 4 insertions(+) commit 70e16c90ee23233bdd45462e1ebba72ff0c25c3a Author: Xuan Zhuo Date: Tue Oct 10 11:11:17 2023 +0800 virtio: add definition of VIRTIO_F_NOTIF_CONFIG_DATA feature bit This patch adds the definition of VIRTIO_F_NOTIF_CONFIG_DATA feature bit in the relevant header file. This feature indicates that the driver uses the data provided by the device as a virtqueue identifier in available buffer notifications. It comes from here: https://github.com/oasis-tcs/virtio-spec/issues/89 Signed-off-by: Xuan Zhuo Message-Id: <20231010031120.81272-2-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang include/uapi/linux/virtio_config.h | 5 +++++ 1 file changed, 5 insertions(+) commit 484f0a071f8d482649eaf025dee7b76a7202fec9 Author: Greg Kroah-Hartman Date: Fri Oct 6 16:30:44 2023 +0200 vduse: make vduse_class constant Now that the driver core allows for struct class to be in read-only memory, we should make all 'class' structures declared at build time placing them into read-only memory, instead of having to be dynamically allocated at runtime. Cc: "Michael S. Tsirkin" Cc: Jason Wang Cc: Xuan Zhuo Cc: Xie Yongji Signed-off-by: Greg Kroah-Hartman Message-Id: <2023100643-tricolor-citizen-6c2d@gregkh> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xie Yongji Acked-by: Jason Wang drivers/vdpa/vdpa_user/vduse_dev.c | 40 ++++++++++++++++++++------------------ 1 file changed, 21 insertions(+), 19 deletions(-) commit 5ff1f51eefb1cd2c20c3f49538a64c09a1cc98be Author: Geert Uytterhoeven Date: Thu Sep 28 14:18:33 2023 +0200 vhost-scsi: Spelling s/preceeding/preceding/g Fix a misspelling of "preceding". Signed-off-by: Geert Uytterhoeven Message-Id: Signed-off-by: Michael S. Tsirkin Reviewed-by: Simon Horman Reviewed-by: Stefan Hajnoczi drivers/vhost/scsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a5d7df87843dd9025015e4038dd927e893cc8b8b Author: Shannon Nelson Date: Mon Sep 11 14:31:04 2023 -0700 virtio: kdoc for struct virtio_pci_modern_device Finally following up to Simon's suggestion for some kdoc attention on struct virtio_pci_modern_device. Link: https://lore.kernel.org/netdev/ZE%2FQS0lnUvxFacjf@corigine.com/ Cc: Simon Horman Signed-off-by: Shannon Nelson Acked-by: Eugenio Pérez Message-Id: <20230911213104.14391-1-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang include/linux/virtio_pci_modern.h | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) commit fbe299388c9496f04172ec59bf9bb211f0d2defa Author: Shawn.Shao Date: Mon Aug 21 09:15:35 2023 +0800 vdpa: Update sysfs ABI documentation Fix the wrong drivers_autoprobe path name in the document Signed-off-by: Shawn.Shao Message-Id: <20230821011535.1117-1-shawn.shao@jaguarmicro.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Documentation/ABI/testing/sysfs-bus-vdpa | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit dd1f4bc143a7845579d22ca1302e1c498e52182d Author: Dragos Tatulea Date: Mon Sep 25 19:06:51 2023 +0300 MAINTAINERS: Add myself as mlx5_vdpa driver As Eli Cohen moved to other work, I'll be the contact point for mlx5_vdpa. Acked-by: Jason Wang Signed-off-by: Dragos Tatulea Message-Id: <20230925160654.1558627-1-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin MAINTAINERS | 6 ++++++ 1 file changed, 6 insertions(+) commit 0cd43eef0ae275611557f29cc2ba2c6211a4c5fa Author: Xueshi Hu Date: Sun Aug 13 22:07:09 2023 +0800 virtio-balloon: correct the comment of virtballoon_migratepage() After commit 68f2736a8583 ("mm: Convert all PageMovable users to movable_operations"), the execution path has been changed to move_to_new_folio movable_operations->migrate_page balloon_page_migrate balloon_page_migrate->balloon_page_migrate balloon_page_migrate Correct the outdated comment. Signed-off-by: Xueshi Hu Message-Id: <20230813140709.835536-1-xueshi.hu@smartx.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: David Hildenbrand Reviewed-by: Xuan Zhuo drivers/virtio/virtio_balloon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c695964474f3a80e1b7503e7cb15dd7d7f7245a1 Author: Eugenio Pérez Date: Mon Jul 3 16:25:14 2023 +0200 mlx5_vdpa: offer VHOST_BACKEND_F_ENABLE_AFTER_DRIVER_OK Offer this backend feature as mlx5 is compatible with it. It allows it to do live migration with CVQ, dynamically switching between passthrough and shadow virtqueue. Signed-off-by: Eugenio Pérez Message-Id: <20230703142514.363256-1-eperezma@redhat.com> Signed-off-by: Michael S. Tsirkin drivers/vdpa/mlx5/net/mlx5_vnet.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 5dc31bd245a4fd7fe2d1fd79b7a2a81c96d6d33c Author: Dragos Tatulea Date: Wed Oct 18 20:14:55 2023 +0300 vdpa/mlx5: Update cvq iotlb mapping on ASID change For the following sequence: - cvq group is in ASID 0 - .set_map(1, cvq_iotlb) - .set_group_asid(cvq_group, 1) ... the cvq mapping from ASID 0 will be used. This is not always correct behaviour. This patch adds support for the above mentioned flow by saving the iotlb on each .set_map and updating the cvq iotlb with it on a cvq group change. Acked-by: Jason Wang Acked-by: Eugenio Pérez Signed-off-by: Dragos Tatulea Message-Id: <20231018171456.1624030-18-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Si-Wei Liu Tested-by: Si-Wei Liu Tested-by: Lei Yang drivers/vdpa/mlx5/core/mlx5_vdpa.h | 2 ++ drivers/vdpa/mlx5/core/mr.c | 26 ++++++++++++++++++++++++++ drivers/vdpa/mlx5/net/mlx5_vnet.c | 9 ++++++++- 3 files changed, 36 insertions(+), 1 deletion(-) commit cf6e024cf7683551ae218ce9af56b82e68a0ef06 Author: Dragos Tatulea Date: Wed Oct 18 20:14:54 2023 +0300 vdpa/mlx5: Make iotlb helper functions more generic They will be used in a follow-up patch. For dup_iotlb, avoid the src == dst case. This is an error. Acked-by: Jason Wang Acked-by: Eugenio Pérez Signed-off-by: Dragos Tatulea Message-Id: <20231018171456.1624030-17-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Si-Wei Liu Tested-by: Si-Wei Liu Tested-by: Lei Yang drivers/vdpa/mlx5/core/mr.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) commit 03dd63c8fae4599439a30e0dde91061789260dbe Author: Dragos Tatulea Date: Wed Oct 18 20:14:53 2023 +0300 vdpa/mlx5: Enable hw support for vq descriptor mapping Vq descriptor mappings are supported in hardware by filling in an additional mkey which contains the descriptor mappings to the hw vq. A previous patch in this series added support for hw mkey (mr) creation for ASID 1. This patch fills in both the vq data and vq descriptor mkeys based on group ASID mapping. The feature is signaled to the vdpa core through the presence of the .get_vq_desc_group op. Acked-by: Jason Wang Acked-by: Eugenio Pérez Signed-off-by: Dragos Tatulea Message-Id: <20231018171456.1624030-16-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Si-Wei Liu Tested-by: Si-Wei Liu Tested-by: Lei Yang drivers/vdpa/mlx5/net/mlx5_vnet.c | 24 +++++++++++++++++++++++- include/linux/mlx5/mlx5_ifc_vdpa.h | 7 ++++++- 2 files changed, 29 insertions(+), 2 deletions(-) commit 55229eab8cd767a5811a4fb112b3ca9db6eaa9d2 Author: Dragos Tatulea Date: Wed Oct 18 20:14:52 2023 +0300 vdpa/mlx5: Introduce mr for vq descriptor Introduce the vq descriptor group and mr per ASID. Until now .set_map on ASID 1 was only updating the cvq iotlb. From now on it also creates a mkey for it. The current patch doesn't use it but follow-up patches will add hardware support for mapping the vq descriptors. Acked-by: Jason Wang Acked-by: Eugenio Pérez Signed-off-by: Dragos Tatulea Message-Id: <20231018171456.1624030-15-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Si-Wei Liu Tested-by: Si-Wei Liu Tested-by: Lei Yang drivers/vdpa/mlx5/core/mlx5_vdpa.h | 5 +++-- drivers/vdpa/mlx5/core/mr.c | 14 +++++++++----- drivers/vdpa/mlx5/net/mlx5_vnet.c | 20 +++++++++++++------- 3 files changed, 25 insertions(+), 14 deletions(-) commit 625e4b59a923d2bb30759b88ecca34d12735fa7e Author: Dragos Tatulea Date: Wed Oct 18 20:14:51 2023 +0300 vdpa/mlx5: Improve mr update flow The current flow for updating an mr works directly on mvdev->mr which makes it cumbersome to handle multiple new mr structs. This patch makes the flow more straightforward by having mlx5_vdpa_create_mr return a new mr which will update the old mr (if any). The old mr will be deleted and unlinked from mvdev. For the case when the iotlb is empty (not NULL), the old mr will be cleared. This change paves the way for adding mrs for different ASIDs. The initialized bool is no longer needed as mr is now a pointer in the mlx5_vdpa_dev struct which will be NULL when not initialized. Acked-by: Eugenio Pérez Acked-by: Jason Wang Signed-off-by: Dragos Tatulea Message-Id: <20231018171456.1624030-14-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Si-Wei Liu Tested-by: Si-Wei Liu Tested-by: Lei Yang drivers/vdpa/mlx5/core/mlx5_vdpa.h | 14 +++--- drivers/vdpa/mlx5/core/mr.c | 87 ++++++++++++++++++++------------------ drivers/vdpa/mlx5/net/mlx5_vnet.c | 53 ++++++++++++----------- 3 files changed, 82 insertions(+), 72 deletions(-) commit 186e25387ed6f1403a1b464e31f5381ba4424681 Author: Dragos Tatulea Date: Wed Oct 18 20:14:50 2023 +0300 vdpa/mlx5: Move mr mutex out of mr struct The mutex is named like it is supposed to protect only the mkey but in reality it is a global lock for all mr resources. Shift the mutex to it's rightful location (struct mlx5_vdpa_dev) and give it a more appropriate name. Signed-off-by: Dragos Tatulea Acked-by: Eugenio Pérez Acked-by: Jason Wang Message-Id: <20231018171456.1624030-13-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Si-Wei Liu Tested-by: Si-Wei Liu Tested-by: Lei Yang drivers/vdpa/mlx5/core/mlx5_vdpa.h | 4 ++-- drivers/vdpa/mlx5/core/mr.c | 13 +++++++------ drivers/vdpa/mlx5/core/resources.c | 6 +++--- 3 files changed, 12 insertions(+), 11 deletions(-) commit 1b3ce9576f169ce2122ab98b39bf2357d377ee5b Author: Dragos Tatulea Date: Wed Oct 18 20:14:49 2023 +0300 vdpa/mlx5: Allow creation/deletion of any given mr struct This patch adapts the mr creation/deletion code to be able to work with any given mr struct pointer. All the APIs are adapted to take an extra parameter for the mr. mlx5_vdpa_create/delete_mr doesn't need a ASID parameter anymore. The check is done in the caller instead (mlx5_set_map). This change is needed for a followup patch which will introduce an additional mr for the vq descriptor data. Signed-off-by: Dragos Tatulea Acked-by: Eugenio Pérez Acked-by: Jason Wang Message-Id: <20231018171456.1624030-12-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Si-Wei Liu Tested-by: Si-Wei Liu Tested-by: Lei Yang drivers/vdpa/mlx5/core/mlx5_vdpa.h | 8 +++--- drivers/vdpa/mlx5/core/mr.c | 53 +++++++++++++++++--------------------- drivers/vdpa/mlx5/net/mlx5_vnet.c | 10 ++++--- 3 files changed, 36 insertions(+), 35 deletions(-) commit 07a2da402416891c97335b79a00f23e06549c578 Author: Dragos Tatulea Date: Wed Oct 18 20:14:48 2023 +0300 vdpa/mlx5: Rename mr destroy functions Make mlx5_destroy_mr symmetric to mlx5_create_mr. Acked-by: Jason Wang Acked-by: Eugenio Pérez Signed-off-by: Dragos Tatulea Message-Id: <20231018171456.1624030-11-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Si-Wei Liu Tested-by: Si-Wei Liu Tested-by: Lei Yang drivers/vdpa/mlx5/core/mlx5_vdpa.h | 4 ++-- drivers/vdpa/mlx5/core/mr.c | 6 +++--- drivers/vdpa/mlx5/net/mlx5_vnet.c | 12 ++++++------ 3 files changed, 11 insertions(+), 11 deletions(-) commit 1c06cd56746a33047d89df02716ff6af9187dd80 Author: Dragos Tatulea Date: Wed Oct 18 20:14:47 2023 +0300 vdpa/mlx5: Collapse "dvq" mr add/delete functions Now that the cvq code is out of mlx5_vdpa_create/destroy_mr, the "dvq" functions can be folded into their callers. Having "dvq" in the naming will no longer be accurate in the downstream patches. Acked-by: Jason Wang Acked-by: Eugenio Pérez Signed-off-by: Dragos Tatulea Message-Id: <20231018171456.1624030-10-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Si-Wei Liu Tested-by: Si-Wei Liu Tested-by: Lei Yang drivers/vdpa/mlx5/core/mr.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) commit 4c6b97416a0427146c221039ed62718c9e897ec0 Author: Dragos Tatulea Date: Wed Oct 18 20:14:46 2023 +0300 vdpa/mlx5: Take cvq iotlb lock during refresh The reslock is taken while refresh is called but iommu_lock is more specific to this resource. So take the iommu_lock during cvq iotlb refresh. Based on Eugenio's patch [0]. [0] https://lore.kernel.org/lkml/20230112142218.725622-4-eperezma@redhat.com/ Acked-by: Jason Wang Suggested-by: Eugenio Pérez Reviewed-by: Eugenio Pérez Signed-off-by: Dragos Tatulea Message-Id: <20231018171456.1624030-9-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Si-Wei Liu Tested-by: Si-Wei Liu Tested-by: Lei Yang drivers/vdpa/mlx5/core/mr.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit 512c0cdd80c19ec11f6dbe769d5899dcfefcd5c9 Author: Dragos Tatulea Date: Wed Oct 18 20:14:45 2023 +0300 vdpa/mlx5: Decouple cvq iotlb handling from hw mapping code The handling of the cvq iotlb is currently coupled with the creation and destruction of the hardware mkeys (mr). This patch moves cvq iotlb handling into its own function and shifts it to a scope that is not related to mr handling. As cvq handling is just a prune_iotlb + dup_iotlb cycle, put it all in the same "update" function. Finally, the destruction path is handled by directly pruning the iotlb. After this move is done the ASID mr code can be collapsed into a single function. Acked-by: Jason Wang Acked-by: Eugenio Pérez Signed-off-by: Dragos Tatulea Message-Id: <20231018171456.1624030-8-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Si-Wei Liu Tested-by: Si-Wei Liu Tested-by: Lei Yang drivers/vdpa/mlx5/core/mlx5_vdpa.h | 3 ++ drivers/vdpa/mlx5/core/mr.c | 57 +++++++++++++------------------------- drivers/vdpa/mlx5/net/mlx5_vnet.c | 7 +++-- 3 files changed, 28 insertions(+), 39 deletions(-) commit 049cbeab861ef483e39f1f65540305400d33771a Author: Dragos Tatulea Date: Wed Oct 18 20:14:44 2023 +0300 vdpa/mlx5: Create helper function for dma mappings Necessary for upcoming cvq separation from mr allocation. Acked-by: Jason Wang Signed-off-by: Dragos Tatulea Message-Id: <20231018171456.1624030-7-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Si-Wei Liu Tested-by: Si-Wei Liu Tested-by: Lei Yang drivers/vdpa/mlx5/core/mlx5_vdpa.h | 1 + drivers/vdpa/mlx5/core/mr.c | 5 +++++ drivers/vdpa/mlx5/net/mlx5_vnet.c | 4 ++-- 3 files changed, 8 insertions(+), 2 deletions(-) commit c8068d9bae0c78e8880451b94668253449b2d71d Author: Si-Wei Liu Date: Wed Oct 18 20:14:43 2023 +0300 vhost-vdpa: uAPI to get dedicated descriptor group id With _F_DESC_ASID backend feature, the device can now support the VHOST_VDPA_GET_VRING_DESC_GROUP ioctl, and it may expose the descriptor table (including avail and used ring) in a different group than the buffers it contains. This new uAPI will fetch the group ID of the descriptor table. Signed-off-by: Si-Wei Liu Acked-by: Eugenio Pérez Acked-by: Jason Wang Message-Id: <20231018171456.1624030-6-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Si-Wei Liu Tested-by: Si-Wei Liu Tested-by: Lei Yang drivers/vhost/vdpa.c | 10 ++++++++++ include/uapi/linux/vhost.h | 8 ++++++++ 2 files changed, 18 insertions(+) commit 7db0d6027e69f47431800b510192436563ba415b Author: Si-Wei Liu Date: Wed Oct 18 20:14:42 2023 +0300 vhost-vdpa: introduce descriptor group backend feature Userspace knows if the device has dedicated descriptor group or not by checking this feature bit. It's only exposed if the vdpa driver backend implements the .get_vq_desc_group() operation callback. Userspace trying to negotiate this feature when it or the dependent _F_IOTLB_ASID feature hasn't been exposed will result in an error. Signed-off-by: Si-Wei Liu Acked-by: Eugenio Pérez Acked-by: Jason Wang Message-Id: <20231018171456.1624030-5-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Si-Wei Liu Tested-by: Si-Wei Liu Tested-by: Lei Yang drivers/vhost/vdpa.c | 17 +++++++++++++++++ include/uapi/linux/vhost_types.h | 5 +++++ 2 files changed, 22 insertions(+) commit a72cac6067fdfde280ece0ec5c055659a8de6508 Author: Si-Wei Liu Date: Wed Oct 18 20:14:41 2023 +0300 vdpa: introduce dedicated descriptor group for virtqueue In some cases, the access to the virtqueue's descriptor area, device and driver areas (precluding indirect descriptor table in guest memory) may have to be confined to a different address space than where its buffers reside. Without loss of simplicity and generality with already established terminology, let's fold up these 3 areas and call them as a whole as descriptor table group, or descriptor group for short. Specifically, in case of split virtqueues, descriptor group consists of regions for Descriptor Table, Available Ring and Used Ring; for packed virtqueues layout, descriptor group contains Descriptor Ring, Driver and Device Event Suppression structures. The group ID for a dedicated descriptor group can be obtained through a new .get_vq_desc_group() op. If driver implements this op, it means that the descriptor, device and driver areas of the virtqueue may reside in a dedicated group than where its buffers reside, a.k.a the default virtqueue group through the .get_vq_group() op. In principle, the descriptor group may or may not have same group ID as the default group. Even if the descriptor group has a different ID, meaning the vq's descriptor group areas can optionally move to a separate address space than where guest memory resides, the descriptor group may still start from a default address space, same as where its buffers reside. To move the descriptor group to a different address space, .set_group_asid() has to be called to change the ASID binding for the group, which is no different than what needs to be done on any other virtqueue group. On the other hand, the .reset() semantics also applies on descriptor table group, meaning the device reset will clear all ASID bindings and move all virtqueue groups including descriptor group back to the default address space, i.e. in ASID 0. QEMU's shadow virtqueue is going to utilize dedicated descriptor group to speed up map and unmap operations, yielding tremendous downtime reduction by avoiding the full and slow remap cycle in SVQ switching. Signed-off-by: Si-Wei Liu Acked-by: Eugenio Pérez Acked-by: Jason Wang Message-Id: <20231018171456.1624030-4-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Si-Wei Liu Tested-by: Si-Wei Liu Tested-by: Lei Yang include/linux/vdpa.h | 11 +++++++++++ 1 file changed, 11 insertions(+) commit ab5201e20c181563774631258f737caeefed2364 Author: David Rau Date: Wed Nov 1 10:25:07 2023 +0800 ASoC: da7219: Improve system suspend and resume handling When DA7219 is suspended, prevent the AAD IRQ handler is unexpectedly executed and cause the I2C driver "Transfer while suspended" failure. Signed-off-by: David Rau Link: https://lore.kernel.org/r/20231101022507.6226-1-David.Rau.opensource@dm.renesas.com Signed-off-by: Mark Brown sound/soc/codecs/da7219-aad.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit b729598c1747576bb9a4c997190be3f7c2915726 Author: Weidong Wang Date: Wed Nov 1 17:02:10 2023 +0800 ASoC: codecs: Modify macro value error The value of vsense_select should be either 32 or 0 in both cases, so modify the AW88399_DEV_VDSEL_VSENSE macro to 32. Signed-off-by: Weidong Wang Link: https://lore.kernel.org/r/20231101090211.177125-4-wangweidong.a@awinic.com Signed-off-by: Mark Brown sound/soc/codecs/aw88399.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit baf46c3c763809fbeabcff5ec6e2ff3081f755f2 Author: Weidong Wang Date: Wed Nov 1 17:02:09 2023 +0800 ASoC: codecs: Modify the wrong judgment of re value An error code should be return when the re is greater than the maximum value or less than the minimum value Signed-off-by: Weidong Wang Link: https://lore.kernel.org/r/20231101090211.177125-3-wangweidong.a@awinic.com Signed-off-by: Mark Brown sound/soc/codecs/aw88399.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c9e920ffa752b9047d65041cd70495409c768dd7 Author: Weidong Wang Date: Wed Nov 1 17:02:08 2023 +0800 ASoC: codecs: Modify the maximum value of calib The maximum value that calib can set should be consistent with the maximum value of re. Signed-off-by: Weidong Wang Link: https://lore.kernel.org/r/20231101090211.177125-2-wangweidong.a@awinic.com Signed-off-by: Mark Brown sound/soc/codecs/aw88395/aw88395.c | 2 +- sound/soc/codecs/aw88399.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 71d47b31e9ab579a00698cf9c059fa3adc312882 Merge: ffc253263a13 d424348b060d Author: Michael S. Tsirkin Date: Wed Nov 1 09:14:52 2023 -0400 Merge branch 'mlx5-vhost' of https://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux.git This merges a single commit that contains changes to mlx5_ifc.h It's required to support vq descriptor mappings in mlx5/vdpa Signed-off-by: Michael S. Tsirkin commit b9604be241587fb29c0f40450e53d0a37dc611b5 Author: Su Hui Date: Fri Oct 20 17:19:31 2023 +0800 leds: lp5521: Add an error check in lp5521_post_init_device lp55xx_write() can return an error code, add a check for this. Signed-off-by: Su Hui Link: https://lore.kernel.org/r/20231020091930.207870-1-suhui@nfschina.com Signed-off-by: Lee Jones drivers/leds/leds-lp5521.c | 2 ++ 1 file changed, 2 insertions(+) commit 2038d3fdc7434d522369c58cb7a4acd5315eebec Author: Andy Shevchenko Date: Mon Oct 16 19:10:05 2023 +0300 leds: gpio: Update headers Include headers which we are direct users of, no need to have proxies. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231016161005.1471768-6-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones drivers/leds/leds-gpio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 7b2d8a059c77344eca0f5281f97224d1accfb88a Author: Andy Shevchenko Date: Mon Oct 16 19:10:04 2023 +0300 leds: gpio: Remove unneeded assignment The initial ret is not used anywhere, drop the unneeded assignment. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231016161005.1471768-5-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones drivers/leds/leds-gpio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 54e657d604ae27a30ce4f84c243661d9b744bbce Author: Andy Shevchenko Date: Mon Oct 16 19:10:03 2023 +0300 leds: gpio: Move temporary variable for struct device to gpio_led_probe() Use temporary variable for struct device in gpio_led_probe() in order to make code neater. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231016161005.1471768-4-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones drivers/leds/leds-gpio.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) commit 5ac50ec712921f6250188732387bf5dac33736ae Author: Andy Shevchenko Date: Mon Oct 16 19:10:02 2023 +0300 leds: gpio: Refactor code to use devm_gpiod_get_index_optional() Instead of checking for the specific error codes, replace devm_gpiod_get_index() with devm_gpiod_get_index_optional(). In this case we just return all errors to the caller and simply check for NULL in case if legacy GPIO is being used. As the result the code is easier to read and maintain. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231016161005.1471768-3-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones drivers/leds/leds-gpio.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit f5ad594e389c57dfe19059ce868392809f9b1a71 Author: Andy Shevchenko Date: Mon Oct 16 19:10:01 2023 +0300 leds: gpio: Utilise PTR_ERR_OR_ZERO() Avoid a boilerplate code by using PTR_ERR_OR_ZERO() in create_gpio_led(). Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231016161005.1471768-2-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones drivers/leds/leds-gpio.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) commit e80fc4bfc820aa44c500cf4c61e08765f36d3c63 Author: Andy Shevchenko Date: Mon Oct 16 19:10:00 2023 +0300 leds: gpio: Keep driver firmware interface agnostic The of.h is used as a proxy to mod_devicetable, replace former by latter. The commit 2d6180147e92 ("leds: gpio: Configure per-LED pin control") added yet another unneeded OF APIs. Replace with direct use of fwnode. Altogether this makes driver agnostic to the firmware interface in use. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231016161005.1471768-1-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones drivers/leds/leds-gpio.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 49e50aad22aebaaca3ff7abbdd462deaf16c5f35 Author: Andy Shevchenko Date: Mon Oct 16 18:30:51 2023 +0300 leds: core: Refactor led_update_brightness() to use standard pattern The standard conditional pattern is to check for errors first and bail out if any. Refactor led_update_brightness() accordingly. While at it, drop unneeded assignment and return 0 unconditionally on success. Signed-off-by: Andy Shevchenko Acked-by: Denis Osterland-Heim Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20231016153051.1409074-1-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones drivers/leds/led-core.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 78cbcfd8b13cefe089296d053f222934a53e153d Author: Marek Behún Date: Mon Oct 16 16:15:38 2023 +0200 leds: turris-omnia: Fix brightness setting and trigger activating I have improperly refactored commits 4d5ed2621c24 ("leds: turris-omnia: Make set_brightness() more efficient") and aaf38273cf76 ("leds: turris-omnia: Support HW controlled mode via private trigger") after Lee requested a change in API semantics of the new functions I introduced in commit 28350bc0ac77 ("leds: turris-omnia: Do not use SMBUS calls"). Before the change, the function omnia_cmd_write_u8() returned 0 on success, and afterwards it returned a positive value (number of bytes written). The latter version was applied, but the following commits did not properly account for this change. This results in non-functional LED's .brightness_set_blocking() and trigger's .activate() methods. The main reasoning behind the semantics change was that read/write methods should return the number of read/written bytes on success. It was pointed to me [1] that this is not always true (for example the regmap API does not do so), and since the driver never uses this number of read/written bytes information, I decided to fix this issue by changing the functions to the original semantics (return 0 on success). [1] https://lore.kernel.org/linux-gpio/ZQnn+Gi0xVlsGCYA@smile.fi.intel.com/ Fixes: 28350bc0ac77 ("leds: turris-omnia: Do not use SMBUS calls") Signed-off-by: Marek Behún Link: https://lore.kernel.org/r/20231016141538.30037-1-kabel@kernel.org Signed-off-by: Lee Jones drivers/leds/leds-turris-omnia.c | 37 ++++++++++++++++++++----------------- 1 file changed, 20 insertions(+), 17 deletions(-) commit 50be9e029b3ac72848685d7a74d1bd32b36309bf Author: Chunyan Zhang Date: Fri Oct 13 10:20:10 2023 +0800 leds: sc27xx: Move mutex_init() down Move the mutex_init() to avoid redundant mutex_destroy() calls after that for each time the probe fails. Signed-off-by: Chunyan Zhang Reviewed-by: Baolin Wang Link: https://lore.kernel.org/r/20231013022010.854367-1-chunyan.zhang@unisoc.com Signed-off-by: Lee Jones drivers/leds/leds-sc27xx-bltc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 259e33cbb1712a7dd844fc9757661cc47cb0e39b Author: Christian Marangi Date: Sat Oct 7 15:10:42 2023 +0200 leds: trigger: netdev: Move size check in set_device_name GCC 13.2 complains about array subscript 17 is above array bounds of 'char[16]' with IFNAMSIZ set to 16. The warning is correct but this scenario is impossible. set_device_name is called by device_name_store (store sysfs entry) and netdev_trig_activate. device_name_store already check if size is >= of IFNAMSIZ and return -EINVAL. (making the warning scenario impossible) netdev_trig_activate works on already defined interface, where the name has already been checked and should already follow the condition of strlen() < IFNAMSIZ. Aside from the scenario being impossible, set_device_name can be improved to both mute the warning and make the function safer. To make it safer, move size check from device_name_store directly to set_device_name and prevent any out of bounds scenario. Cc: stable@vger.kernel.org Fixes: 28a6a2ef18ad ("leds: trigger: netdev: refactor code setting device name") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202309192035.GTJEEbem-lkp@intel.com/ Signed-off-by: Christian Marangi Link: https://lore.kernel.org/r/20231007131042.15032-1-ansuelsmth@gmail.com Signed-off-by: Lee Jones drivers/leds/trigger/ledtrig-netdev.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 0ebdb7210943eb345992bea9892adbd15a206193 Author: André Apitzsch Date: Mon Oct 2 18:48:28 2023 +0200 leds: Add ktd202x driver This commit adds support for Kinetic KTD2026/7 RGB/White LED driver. Signed-off-by: André Apitzsch Link: https://lore.kernel.org/r/20231002-ktd202x-v6-2-26be8eefeb88@apitzsch.eu Signed-off-by: Lee Jones drivers/leds/rgb/Kconfig | 13 + drivers/leds/rgb/Makefile | 1 + drivers/leds/rgb/leds-ktd202x.c | 625 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 639 insertions(+) commit 000b1eab4fce227dc81c312cd5fef05fce71d004 Author: André Apitzsch Date: Mon Oct 2 18:48:27 2023 +0200 dt-bindings: leds: Add Kinetic KTD2026/2027 LED Document Kinetic KTD2026/2027 LED driver devicetree bindings. Signed-off-by: André Apitzsch Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231002-ktd202x-v6-1-26be8eefeb88@apitzsch.eu Signed-off-by: Lee Jones .../devicetree/bindings/leds/kinetic,ktd202x.yaml | 171 +++++++++++++++++++++ 1 file changed, 171 insertions(+) commit a067943129b4ec6b835e02cfd5fbef01093c1471 Author: Ondrej Jirman Date: Sun Oct 8 16:40:13 2023 +0200 leds: core: Add more colors from DT bindings to led_colors The colors are already part of DT bindings. Make sure the kernel is able to convert them to strings. Signed-off-by: Ondrej Jirman Link: https://lore.kernel.org/r/20231008144014.1180334-1-megi@xff.cz Signed-off-by: Lee Jones drivers/leds/led-core.c | 5 +++++ 1 file changed, 5 insertions(+) commit 43962eb5de20d8d19f17556ce2a01b3fa4528ac2 Author: Ondrej Jirman Date: Sun Oct 8 16:21:00 2023 +0200 dt-bindings: leds: Last color ID is now 14 (LED_COLOR_ID_LIME) Increase the limit to match available values in dt-bindings/leds/common.h Fixes: 472d7b9e8141 ("dt-bindings: leds: Expand LED_COLOR_ID definitions") Signed-off-by: Ondrej Jirman Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231008142103.1174028-1-megi@xff.cz Signed-off-by: Lee Jones Documentation/devicetree/bindings/leds/common.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9ddf40434ee4e1aac6ce2535fa852fbbad6f6d68 Author: Andy Shevchenko Date: Mon Oct 2 16:56:29 2023 +0300 leds: tca6507: Don't use fixed GPIO base First of all, the fixed GPIO base is source of troubles and it doesn't scale. Second, there is no in-kernel user of this base, so drop it. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231002135629.2605462-1-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones drivers/leds/leds-tca6507.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit fc8e107e7b15906a92afbeed9b289cc695984d5e Author: Mark Brown Date: Fri Sep 29 17:23:38 2023 +0200 leds: lp3952: Convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230929-leds-maple-v1-4-ba5f9dcb1e75@kernel.org Signed-off-by: Lee Jones drivers/leds/leds-lp3952.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5d97716f3fd2bb0f4462df23e4e1088dfcd85e5d Author: Mark Brown Date: Fri Sep 29 17:23:37 2023 +0200 leds: lm392x: Convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230929-leds-maple-v1-3-ba5f9dcb1e75@kernel.org Signed-off-by: Lee Jones drivers/leds/leds-lm3692x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 65e9b51344cbd5a71fce160ae3142fdc70e43989 Author: Mark Brown Date: Fri Sep 29 17:23:36 2023 +0200 leds: aw200xx: Convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230929-leds-maple-v1-2-ba5f9dcb1e75@kernel.org Signed-off-by: Lee Jones drivers/leds/leds-aw200xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8e31906c75bcb8d36b51992fea318c879f2ae82b Author: Mark Brown Date: Fri Sep 29 17:23:35 2023 +0200 leds: lm3601x: Convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230929-leds-maple-v1-1-ba5f9dcb1e75@kernel.org Signed-off-by: Lee Jones drivers/leds/flash/leds-lm3601x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4a11dbf04f31c71eb458c062129e95b7aa308464 Author: Linus Walleij Date: Tue Sep 26 23:48:13 2023 +0200 leds: triggers: gpio: Rewrite to use trigger-sources By providing a GPIO line as "trigger-sources" in the FWNODE (such as from the device tree) and combining with the GPIO trigger, we can support a GPIO LED trigger in a natural way from the hardware description instead of using the custom sysfs and deprecated global GPIO numberspace. Example: gpio: gpio@0 { compatible "my-gpio"; gpio-controller; #gpio-cells = <2>; interrupt-controller; #interrupt-cells = <2>; #trigger-source-cells = <2>; }; leds { compatible = "gpio-leds"; led-my-gpio { label = "device:blue:myled"; gpios = <&gpio 0 GPIO_ACTIVE_HIGH>; default-state = "off"; linux,default-trigger = "gpio"; trigger-sources = <&gpio 1 GPIO_ACTIVE_HIGH>; }; }; Make this the norm, unmark the driver as broken. Delete the sysfs handling of GPIOs. Since GPIO descriptors inherently can describe inversion, the inversion handling can just be deleted. Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20230926-gpio-led-trigger-dt-v2-3-e06e458b788e@linaro.org Signed-off-by: Lee Jones drivers/leds/trigger/Kconfig | 5 +- drivers/leds/trigger/ledtrig-gpio.c | 137 +++++++++++------------------------- 2 files changed, 41 insertions(+), 101 deletions(-) commit f9be4d5bb62ab41723db04d7b3abed2ad6c34825 Author: Linus Walleij Date: Tue Sep 26 23:48:12 2023 +0200 dt-bindings: leds: Mention GPIO triggers We reuse the trigger-sources phandle to just point to GPIOs we may want to use as LED triggers. Example: gpio: gpio@0 { compatible "my-gpio"; gpio-controller; #gpio-cells = <2>; interrupt-controller; #interrupt-cells = <2>; #trigger-source-cells = <2>; }; leds { compatible = "gpio-leds"; led-my-gpio { label = "device:blue:myled"; gpios = <&gpio 0 GPIO_ACTIVE_HIGH>; default-state = "off"; linux,default-trigger = "gpio"; trigger-sources = <&gpio 1 GPIO_ACTIVE_HIGH>; }; }; Signed-off-by: Linus Walleij Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20230926-gpio-led-trigger-dt-v2-2-e06e458b788e@linaro.org Signed-off-by: Lee Jones Documentation/devicetree/bindings/leds/common.yaml | 2 ++ 1 file changed, 2 insertions(+) commit 8d3fd7edd5f70fb814c07a321f347b5fe21d3fac Author: Biju Das Date: Sat Sep 23 18:19:21 2023 +0100 leds: pca955x: Cleanup OF/ID table terminators Some cleanups: * Remove the trailing comma in the terminator entry for the OF table making code robust against (theoretical) misrebases or other similar things where the new entry goes _after_ the termination without the compiler noticing. * Drop a space from terminator entry for ID table. While at it, move OF/ID table near to the user. Signed-off-by: Biju Das Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230923171921.53503-3-biju.das.jz@bp.renesas.com Signed-off-by: Lee Jones drivers/leds/leds-pca955x.c | 40 ++++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 20 deletions(-) commit 3b581cb58816d07b033c800d42a040d7ba566fb6 Author: Biju Das Date: Sat Sep 23 18:19:20 2023 +0100 leds: pca955x: Convert enum->pointer for data in the match tables Convert enum->pointer for data in the match tables, so that device_get_match_data() can do match against OF/ACPI/I2C tables, once i2c bus type match support added to it. Replace enum->struct *pca955x_chipdefs for data in the match table. Simplify the probe() by replacing device_get_match_data() and ID lookup for retrieving data by i2c_get_match_data(). While at it, add const definition to pca955x_chipdefs[]. Signed-off-by: Biju Das Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230923171921.53503-2-biju.das.jz@bp.renesas.com Signed-off-by: Lee Jones drivers/leds/leds-pca955x.c | 49 +++++++++++++++++---------------------------- 1 file changed, 18 insertions(+), 31 deletions(-) commit a337ee0d25ba24212269c2442981dc4fb5232a8c Author: Justin Stitt Date: Fri Sep 22 15:27:17 2023 +0000 leds: lp3952: Replace deprecated strncpy with strscpy `strncpy` is deprecated for use on NUL-terminated destination strings [1] and as such we should prefer more robust and less ambiguous string interfaces. We expect `dest` to be NUL-terminated due to its use with dev_err. lp3952_get_label()'s dest argument is priv->leds[i].name: | acpi_ret = lp3952_get_label(&priv->client->dev, led_name_hdl[i], | priv->leds[i].name); ... which is then assigned to: | priv->leds[i].cdev.name = priv->leds[i].name; ... which is used with a format string | dev_err(&priv->client->dev, | "couldn't register LED %s\n", | priv->leds[i].cdev.name); There is no indication that NUL-padding is required but if it is let's opt for strscpy_pad. Considering the above, a suitable replacement is `strscpy` [2] due to the fact that it guarantees NUL-termination on the destination buffer without unnecessarily NUL-padding. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Link: https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html [2] Link: https://github.com/KSPP/linux/issues/90 Signed-off-by: Justin Stitt Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20230922-strncpy-drivers-leds-leds-lp3952-c-v1-1-4941d6f60ca4@google.com Signed-off-by: Lee Jones drivers/leds/leds-lp3952.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ff50f53276131a3059e8307d11293af388ed2bcd Author: Christophe JAILLET Date: Sat Sep 23 09:15:38 2023 +0200 leds: trigger: ledtrig-cpu:: Fix 'output may be truncated' issue for 'cpu' In order to teach the compiler that 'trig->name' will never be truncated, we need to tell it that 'cpu' is not negative. When building with W=1, this fixes the following warnings: drivers/leds/trigger/ledtrig-cpu.c: In function ‘ledtrig_cpu_init’: drivers/leds/trigger/ledtrig-cpu.c:155:56: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 5 [-Werror=format-truncation=] 155 | snprintf(trig->name, MAX_NAME_LEN, "cpu%d", cpu); | ^~ drivers/leds/trigger/ledtrig-cpu.c:155:52: note: directive argument in the range [-2147483648, 7] 155 | snprintf(trig->name, MAX_NAME_LEN, "cpu%d", cpu); | ^~~~~~~ drivers/leds/trigger/ledtrig-cpu.c:155:17: note: ‘snprintf’ output between 5 and 15 bytes into a destination of size 8 155 | snprintf(trig->name, MAX_NAME_LEN, "cpu%d", cpu); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: 8f88731d052d ("led-triggers: create a trigger for CPU activity") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/3f4be7a99933cf8566e630da54f6ab913caac432.1695453322.git.christophe.jaillet@wanadoo.fr Signed-off-by: Lee Jones drivers/leds/trigger/ledtrig-cpu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 76fe464c8e64e71b2e4af11edeef0e5d85eeb6aa Author: Uwe Kleine-König Date: Fri Sep 22 21:28:34 2023 +0200 leds: pwm: Don't disable the PWM when the LED should be off Disabling a PWM (i.e. calling pwm_apply_state with .enabled = false) gives no guarantees what the PWM output does. It might freeze where it currently is, or go in a High-Z state or drive the active or inactive state, it might even continue to toggle. To ensure that the LED gets really disabled, don't disable the PWM even when .duty_cycle is zero. This fixes disabling a leds-pwm LED on i.MX28. The PWM on this SoC is one of those that freezes its output on disable, so if you disable an LED that is full on, it stays on. If you disable a LED with half brightness it goes off in 50% of the cases and full on in the other 50%. Fixes: 41c42ff5dbe2 ("leds: simple driver for pwm driven LEDs") Reported-by: Rogan Dawes Reported-by: Fabio Estevam Signed-off-by: Uwe Kleine-König Reviewed-by: Fabio Estevam Link: https://lore.kernel.org/r/20230922192834.1695727-1-u.kleine-koenig@pengutronix.de Signed-off-by: Lee Jones drivers/leds/leds-pwm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 43e9082fbccc7df8b2028c1ba040c58cefda703f Author: Marek Behún Date: Mon Sep 18 18:11:04 2023 +0200 leds: turris-omnia: Add support for enabling/disabling HW gamma correction If the MCU on Turris Omnia is running newer firmware versions, the LED controller supports RGB gamma correction (and enables it by default for newer boards). Determine whether the gamma correction setting feature is supported and add the ability to set it via sysfs attribute file. Signed-off-by: Marek Behún Link: https://lore.kernel.org/r/20230918161104.20860-5-kabel@kernel.org Signed-off-by: Lee Jones .../testing/sysfs-class-led-driver-turris-omnia | 14 +++ drivers/leds/leds-turris-omnia.c | 137 ++++++++++++++++++--- 2 files changed, 134 insertions(+), 17 deletions(-) commit cbd6954fecbeb822cf380fa2573ccb4a3a457e88 Author: Marek Behún Date: Mon Sep 18 18:11:03 2023 +0200 leds: turris-omnia: Support HW controlled mode via private trigger Add support for enabling MCU controlled mode of the Turris Omnia LEDs via a LED private trigger called "omnia-mcu". Recall that private LED triggers will only be listed in the sysfs trigger file for LEDs that support them (currently there is no user of this mechanism). When in MCU controlled mode, the user can still set LED color, but the blinking is done by MCU, which does different things for different LEDs: - WAN LED is blinked according to the LED[0] pin of the WAN PHY - LAN LEDs are blinked according to the LED[0] output of the corresponding port of the LAN switch - PCIe LEDs are blinked according to the logical OR of the MiniPCIe port LED pins In the future I want to make the netdev trigger to transparently offload the blinking to the HW if user sets compatible settings for the netdev trigger (for LEDs associated with network devices). There was some work on this already, and hopefully we will be able to complete it sometime, but for now there are still multiple blockers for this, and even if there weren't, we still would not be able to configure HW controlled mode for the LEDs associated with MiniPCIe ports. In the meantime let's support HW controlled mode via the private LED trigger mechanism. If, in the future, we manage to complete the netdev trigger offloading, we can still keep this private trigger for backwards compatibility, if needed. We also set "omnia-mcu" to cdev->default_trigger, so that the MCU keeps control until the user first wants to take over it. If a different default trigger is specified in device-tree via the 'linux,default-trigger' property, LED class will overwrite cdev->default_trigger, and so the DT property will be respected. Signed-off-by: Marek Behún Link: https://lore.kernel.org/r/20230918161104.20860-4-kabel@kernel.org Signed-off-by: Lee Jones drivers/leds/Kconfig | 1 + drivers/leds/leds-turris-omnia.c | 98 ++++++++++++++++++++++++++++++++++++---- 2 files changed, 91 insertions(+), 8 deletions(-) commit 9f028c9e1c32249cb2487d2103512d6b9597b932 Author: Marek Behún Date: Mon Sep 18 18:11:02 2023 +0200 leds: turris-omnia: Make set_brightness() more efficient Implement caching of the LED color and state values that are sent to MCU in order to make the set_brightness() operation more efficient by avoiding I2C transactions which are not needed. On Turris Omnia's MCU, which acts as the RGB LED controller, each LED has a RGB color, and a ON/OFF state, which are configurable via I2C commands CMD_LED_COLOR and CMD_LED_STATE. The CMD_LED_COLOR command sends 5 bytes and the CMD_LED_STATE command 2 bytes over the I2C bus, which operates at 100 kHz. With I2C overhead this allows ~1670 color changing commands and ~3200 state changing commands per second (or around 1000 color + state changes per second). This may seem more than enough, but the issue is that the I2C bus is shared with another peripheral, the MCU. The MCU exposes an interrupt interface, and it can trigger hundreds of interrupts per second. Each time, we need to read the interrupt state register over this I2C bus. Whenever we are sending a LED color/state changing command, the interrupt reading is waiting. Currently, every time LED brightness or LED multi intensity is changed, we send a CMD_LED_STATE command, and if the computed color (brightness adjusted multi_intensity) is non-zero, we also send a CMD_LED_COLOR command. Consider for example the situation when we have a netdev trigger enabled for a LED. The netdev trigger does not change the LED color, only the brightness (either to 0 or to currently configured brightness), and so there is no need to send the CMD_LED_COLOR command. But each change of brightness to 0 sends one CMD_LED_STATE command, and each change of brightness to max_brightness sends one CMD_LED_STATE command and one CMD_LED_COLOR command: set_brightness(0) -> CMD_LED_STATE set_brightness(255) -> CMD_LED_STATE + CMD_LED_COLOR (unnecessary) We can avoid the unnecessary I2C transactions if we cache the values of state and color that are sent to the controller. If the color does not change from the one previously sent, there is no need to do the CMD_LED_COLOR I2C transaction, and if the state does not change, there is no need to do the CMD_LED_STATE transaction. Because we need to make sure that our cached values are consistent with the controller state, add explicit setting of the LED color to white at probe time (this is the default setting when MCU resets, but does not necessarily need to be the case, for example if U-Boot played with the LED colors). Signed-off-by: Marek Behún Link: https://lore.kernel.org/r/20230918161104.20860-3-kabel@kernel.org Signed-off-by: Lee Jones drivers/leds/leds-turris-omnia.c | 96 ++++++++++++++++++++++++++++++++-------- 1 file changed, 78 insertions(+), 18 deletions(-) commit 6de283b96b31b4890e3ee8c86caca2a3a30d1011 Author: Marek Behún Date: Mon Sep 18 18:11:01 2023 +0200 leds: turris-omnia: Do not use SMBUS calls The leds-turris-omnia driver uses three function for I2C access: - i2c_smbus_write_byte_data() and i2c_smbus_read_byte_data(), which cause an emulated SMBUS transfer, - i2c_master_send(), which causes an ordinary I2C transfer. The Turris Omnia MCU LED controller is not semantically SMBUS, it operates as a simple I2C bus. It does not implement any of the SMBUS specific features, like PEC, or procedure calls, or anything. Moreover the I2C controller driver also does not implement SMBUS, and so the emulated SMBUS procedure from drivers/i2c/i2c-core-smbus.c is used for the SMBUS calls, which gives an unnecessary overhead. When I first wrote the driver, I was unaware of these facts, and I simply used the first function that worked. Drop the I2C SMBUS calls and instead use simple I2C transfers. Fixes: 089381b27abe ("leds: initial support for Turris Omnia LEDs") Signed-off-by: Marek Behún Link: https://lore.kernel.org/r/20230918161104.20860-2-kabel@kernel.org Signed-off-by: Lee Jones drivers/leds/leds-turris-omnia.c | 54 +++++++++++++++++++++++++++++++--------- 1 file changed, 42 insertions(+), 12 deletions(-) commit 7c977019c53ed2689e5509ebd1d89a424cf3d313 Author: Stefan Eichenberger Date: Mon Sep 18 16:32:38 2023 +0200 leds: lp55xx: Use gpiod_set_value_cansleep() Use gpiod_set_value_cansleep in the init_device function. Without this change, the driver may print a warning if the LP55xx enable pin is connected to a GPIO chip which can sleep (e.g. a GPIO expander): WARNING: CPU: 0 PID: 2719 at drivers/gpio/gpiolib.c:3051 gpiod_set_value+0x64/0xbc Signed-off-by: Stefan Eichenberger Link: https://lore.kernel.org/r/20230918143238.75600-1-eichest@gmail.com Signed-off-by: Lee Jones drivers/leds/leds-lp55xx-common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e3c9d952139c1eb42f35bdcdcb85a66a72587b34 Author: Kees Cook Date: Fri Sep 15 13:10:52 2023 -0700 leds: mt6370: Annotate struct mt6370_priv with __counted_by Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct mt6370_priv. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230915201051.never.429-kees@kernel.org Signed-off-by: Lee Jones drivers/leds/flash/leds-mt6370-flash.c | 2 +- drivers/leds/rgb/leds-mt6370-rgb.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 476301c15d44831413b94d54f248233b14c0ad85 Author: Kees Cook Date: Fri Sep 15 13:10:20 2023 -0700 leds: mt6360: Annotate struct mt6360_priv with __counted_by Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct mt6360_priv. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230915201020.never.433-kees@kernel.org Signed-off-by: Lee Jones drivers/leds/flash/leds-mt6360.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6061302092305a0584aacf0d82a9d5e66653884c Author: Uwe Kleine-König Date: Sun Sep 17 15:09:47 2023 +0200 leds: Convert all platform drivers to return void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). All platform drivers below drivers/leds/ unconditionally return zero in their remove callback and so can be converted trivially to the variant returning void. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230917130947.1122198-1-u.kleine-koenig@pengutronix.de Signed-off-by: Lee Jones drivers/leds/blink/leds-lgm-sso.c | 6 ++---- drivers/leds/flash/leds-aat1290.c | 6 ++---- drivers/leds/flash/leds-ktd2692.c | 6 ++---- drivers/leds/flash/leds-max77693.c | 6 ++---- drivers/leds/flash/leds-mt6360.c | 5 ++--- drivers/leds/flash/leds-qcom-flash.c | 5 ++--- drivers/leds/flash/leds-rt8515.c | 6 ++---- drivers/leds/flash/leds-sgm3140.c | 6 ++---- drivers/leds/leds-88pm860x.c | 6 ++---- drivers/leds/leds-adp5520.c | 6 ++---- drivers/leds/leds-clevo-mail.c | 5 ++--- drivers/leds/leds-da903x.c | 6 ++---- drivers/leds/leds-da9052.c | 6 ++---- drivers/leds/leds-lm3533.c | 6 ++---- drivers/leds/leds-mc13783.c | 6 ++---- drivers/leds/leds-mlxreg.c | 6 ++---- drivers/leds/leds-mt6323.c | 6 ++---- drivers/leds/leds-nic78bx.c | 6 ++---- drivers/leds/leds-powernv.c | 5 ++--- drivers/leds/leds-rb532.c | 5 ++--- drivers/leds/leds-regulator.c | 5 ++--- drivers/leds/leds-sc27xx-bltc.c | 5 ++--- drivers/leds/leds-sunfire.c | 8 +++----- drivers/leds/leds-wm831x-status.c | 6 ++---- drivers/leds/leds-wm8350.c | 5 ++--- drivers/leds/rgb/leds-qcom-lpg.c | 6 ++---- 26 files changed, 53 insertions(+), 97 deletions(-) commit eccc489ef68d70cfdd850ba24933f1febbf2893e Author: Uwe Kleine-König Date: Sat Sep 16 18:45:16 2023 +0200 leds: simatic-ipc-leds-gpio: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Make simatic_ipc_leds_gpio_remove() return void instead of returning zero unconditionally. After that the three remove callbacks that use this function were trivial to convert to return void, too. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230916164516.1063380-1-u.kleine-koenig@pengutronix.de Signed-off-by: Lee Jones drivers/leds/simple/simatic-ipc-leds-gpio-apollolake.c | 8 ++++---- drivers/leds/simple/simatic-ipc-leds-gpio-core.c | 4 +--- drivers/leds/simple/simatic-ipc-leds-gpio-elkhartlake.c | 7 +++---- drivers/leds/simple/simatic-ipc-leds-gpio-f7188x.c | 8 ++++---- drivers/leds/simple/simatic-ipc-leds-gpio.h | 6 +++--- 5 files changed, 15 insertions(+), 18 deletions(-) commit 0847c33bafe5b58f2f223153c007c1e185f84f48 Author: Kees Cook Date: Fri Sep 15 13:11:00 2023 -0700 leds: qcom-lpg: Annotate struct lpg_led with __counted_by Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct lpg_led. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20230915201059.never.086-kees@kernel.org Signed-off-by: Lee Jones drivers/leds/rgb/leds-qcom-lpg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bcbadbb29cb6aa6f51505514ae635fd467ebca43 Author: Kees Cook Date: Fri Sep 15 13:10:10 2023 -0700 leds: lm3697: Annotate struct lm3697 with __counted_by Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct lm3697. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20230915201010.never.399-kees@kernel.org Signed-off-by: Lee Jones drivers/leds/leds-lm3697.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 52cd75108a426bdd43161d0e73e7bee95d103ed1 Author: Kees Cook Date: Fri Sep 15 13:10:04 2023 -0700 leds: gpio: Annotate struct gpio_leds_priv with __counted_by Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct gpio_leds_priv. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20230915201003.never.148-kees@kernel.org Signed-off-by: Lee Jones drivers/leds/leds-gpio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a29feca113687cc691fe9f0f23652fafbafddc90 Author: Kees Cook Date: Fri Sep 15 13:09:56 2023 -0700 leds: el15203000: Annotate struct el15203000 with __counted_by Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct el15203000. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20230915200955.never.871-kees@kernel.org Signed-off-by: Lee Jones drivers/leds/leds-el15203000.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 679cec1809b4140add538f28638546ea2f5c8959 Author: Kees Cook Date: Fri Sep 15 13:09:48 2023 -0700 leds: cr0014114: Annotate struct cr0014114 with __counted_by Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct cr0014114. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20230915200948.never.728-kees@kernel.org Signed-off-by: Lee Jones drivers/leds/leds-cr0014114.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ff861ca9f2d54a81d10cd3e8d2384fe17c10fdc4 Author: Kees Cook Date: Fri Sep 15 13:09:39 2023 -0700 leds: aw200xx: Annotate struct aw200xx with __counted_by Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct aw200xx. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20230915200938.never.767-kees@kernel.org Signed-off-by: Lee Jones drivers/leds/leds-aw200xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a09af0551f5cfa850ca4d39be4395bb3526c8bdf Author: Justin Stitt Date: Wed Aug 16 19:37:52 2023 +0000 leds: pca955x: Fix -Wvoid-pointer-to-enum-cast warning When building with clang 18 I see the following warning: | drivers/leds/leds-pca955x.c:487:15: warning: cast to smaller integer | type 'enum pca955x_type' from 'const void *' [-Wvoid-pointer-to-enum-cast] | 487 | chip_type = (enum pca955x_type)md; This is due to the fact that `md` is a void* while `enum pca995x_type` has the size of an int. Add uintptr_t cast to silence clang warning while also keeping enum cast for readability and consistency with other `chip_type` assignment just a few lines below: | chip_type = (enum pca955x_type)id->driver_data; Reported-by: Nathan Chancellor Closes: https://github.com/ClangBuiltLinux/linux/issues/1910 Signed-off-by: Justin Stitt Reviewed-by: Nathan Chancellor Link: https://lore.kernel.org/r/20230816-void-drivers-leds-leds-pca955x-v1-1-2967e4c1bdcc@google.com Signed-off-by: Lee Jones drivers/leds/leds-pca955x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2b481822446e30943fb7c02744a7b49ebec0e696 Author: Andy Shevchenko Date: Tue Oct 24 19:06:50 2023 +0300 mfd: lpc_ich: Mark *_gpio_offsets data with const There is no reason why the GPIO resource offsets should not be const. Mark them accordingly and update a qualifier in struct lpc_ich_gpio_info definition. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231024160650.3898959-1-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones drivers/mfd/lpc_ich.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 272f99edab36974b58347e97ee105885e385fa88 Author: Johan Hovold Date: Tue Oct 3 17:29:27 2023 +0200 spmi: rename spmi device lookup helper Rename the SPMI device helper which is used to lookup a device from its OF node as spmi_find_device_by_of_node() so that it reflects the implementation and matches how other helpers like this are named. This will specifically make it more clear that this is a lookup function which returns a reference counted structure. Signed-off-by: Johan Hovold Acked-by: Stephen Boyd Link: https://lore.kernel.org/r/20231003152927.15000-6-johan+linaro@kernel.org Signed-off-by: Lee Jones drivers/mfd/qcom-spmi-pmic.c | 2 +- drivers/spmi/spmi.c | 6 +++--- include/linux/spmi.h | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) commit ade7941a478e797f781040f96ae530a0abf7cbfe Author: Johan Hovold Date: Tue Oct 3 17:29:26 2023 +0200 spmi: document spmi_device_from_of() refcounting Add a comment documenting that the spmi_device_from_of() takes a reference to the embedded struct device that needs to be dropped after use. Signed-off-by: Johan Hovold Acked-by: Stephen Boyd Link: https://lore.kernel.org/r/20231003152927.15000-5-johan+linaro@kernel.org Signed-off-by: Lee Jones drivers/spmi/spmi.c | 3 +++ 1 file changed, 3 insertions(+) commit 36af195f7f35c205f716cddf5a8a8954c2e70bff Author: Rob Herring Date: Fri Oct 20 09:22:51 2023 -0500 dt-bindings: mfd: armltd: Move Arm board syscon's to separate schema The Arm Ltd board bindings are a bit unusual in that they define child nodes for various syscon's. The schemas are also incomplete as they lack constraints on having additional properties and some properties are missing. As the bindings for the different platforms only vary by compatibles, combine them into a single schema doc. Add the "arm,im-pd1-syscon" compatible which was not documented. Add "ranges", "#address-cells", and "#size-cells properties which were missing. With this, fix the error exposed in the register-bit-led binding. Signed-off-by: Rob Herring Reviewed-by: Linus Walleij Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20231020142252.3113716-2-robh@kernel.org Signed-off-by: Lee Jones .../devicetree/bindings/arm/arm,integrator.yaml | 39 ------------- .../devicetree/bindings/arm/arm,realview.yaml | 37 ------------ .../devicetree/bindings/arm/arm,versatile.yaml | 40 +++---------- .../devicetree/bindings/leds/register-bit-led.yaml | 2 +- .../bindings/mfd/arm,dev-platforms-syscon.yaml | 67 ++++++++++++++++++++++ 5 files changed, 76 insertions(+), 109 deletions(-) commit b0227e7081404448a0059b8698fdffd2dec280d2 Author: Ondrej Jirman Date: Thu Oct 19 18:57:26 2023 +0200 mfd: rk8xx: Add support for RK806 power off Use DEV_OFF bit to power off the RK806 PMIC, when system-power-controller is used in DTS. Signed-off-by: Ondrej Jirman Reviewed-by: Sebastian Reichel Link: https://lore.kernel.org/r/20231019165732.3818789-5-megi@xff.cz Signed-off-by: Lee Jones drivers/mfd/rk8xx-core.c | 4 ++++ 1 file changed, 4 insertions(+) commit 2a46cd97f401a669d71b3d36b78bd6653f8424ee Author: Ondrej Jirman Date: Thu Oct 19 18:57:25 2023 +0200 mfd: rk8xx: Add support for standard system-power-controller property DT property rockchip,system-power-controller is now deprecated. Signed-off-by: Ondrej Jirman Reviewed-by: Sebastian Reichel Link: https://lore.kernel.org/r/20231019165732.3818789-4-megi@xff.cz Signed-off-by: Lee Jones drivers/mfd/rk8xx-core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit f0eb624455426cf7ddb453c4e5204b388d134c2e Author: Ondrej Jirman Date: Thu Oct 19 18:57:24 2023 +0200 dt-bindings: mfd: rk806: Allow system-power-controller property Declare support for this property. Signed-off-by: Ondrej Jirman Reviewed-by: Rob Herring Reviewed-by: Sebastian Reichel Link: https://lore.kernel.org/r/20231019165732.3818789-3-megi@xff.cz Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/rockchip,rk806.yaml | 2 ++ 1 file changed, 2 insertions(+) commit 961748bb155590570c76b94e6e5fe2a5e2cb4029 Author: Ondrej Jirman Date: Thu Oct 19 18:57:23 2023 +0200 dt-bindings: mfd: rk8xx: Deprecate rockchip,system-power-controller Deprecate support for this property in favor of standard system-power-controller one. Signed-off-by: Ondrej Jirman Reviewed-by: Rob Herring Reviewed-by: Sebastian Reichel Link: https://lore.kernel.org/r/20231019165732.3818789-2-megi@xff.cz Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/rockchip,rk805.yaml | 3 +++ Documentation/devicetree/bindings/mfd/rockchip,rk808.yaml | 3 +++ Documentation/devicetree/bindings/mfd/rockchip,rk809.yaml | 3 +++ Documentation/devicetree/bindings/mfd/rockchip,rk817.yaml | 3 +++ Documentation/devicetree/bindings/mfd/rockchip,rk818.yaml | 3 +++ 5 files changed, 15 insertions(+) commit 93fae36e030d8f74ea3a862814f3c45755639929 Author: Sebastian Reichel Date: Mon Oct 23 15:12:20 2023 +0200 dt-bindings: mfd: max8925: Convert to DT schema format Convert the binding to DT schema format. The sub-functions of this MFD device do not have their own compatible string and are thus described directly in the MFD binding document after being converted to YAML. Signed-off-by: Sebastian Reichel Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20231023131409.1796451-1-sebastian.reichel@collabora.com Signed-off-by: Lee Jones .../bindings/leds/backlight/max8925-backlight.txt | 10 -- Documentation/devicetree/bindings/mfd/max8925.txt | 64 --------- .../devicetree/bindings/mfd/maxim,max8925.yaml | 145 +++++++++++++++++++++ .../bindings/power/supply/max8925_battery.txt | 18 --- 4 files changed, 145 insertions(+), 92 deletions(-) commit 0db434f513d5cde5420787f737c7538b21f93998 Author: Rob Herring Date: Tue Oct 17 15:36:02 2023 -0500 mfd: Use i2c_get_match_data() in a selection of drivers Use preferred i2c_get_match_data() instead of of_match_device() and i2c driver_data to get the driver match data. With this, adjust the includes to explicitly include the correct headers. Signed-off-by: Rob Herring Reviewed-by: Chanwoo Choi Link: https://lore.kernel.org/r/20231017203603.2700864-1-robh@kernel.org Signed-off-by: Lee Jones drivers/mfd/lochnagar-i2c.c | 9 ++------- drivers/mfd/lp87565.c | 9 +++------ drivers/mfd/max14577.c | 14 +++----------- drivers/mfd/rn5t618.c | 11 ++--------- drivers/mfd/wm831x-i2c.c | 16 ++++------------ drivers/mfd/wm8994-core.c | 11 +---------- 6 files changed, 15 insertions(+), 55 deletions(-) commit 830fafce06e6fc2e63e141799833f7c7a73cf62b Author: Rob Herring Date: Tue Oct 17 15:36:10 2023 -0500 mfd: Use device_get_match_data() in a bunch of drivers Use preferred device_get_match_data() instead of of_match_device() to get the driver match data. With this, adjust the includes to explicitly include the correct headers. Reviewed-by: Chen-Yu Tsai Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20231017203612.2701060-1-robh@kernel.org Signed-off-by: Lee Jones drivers/mfd/axp20x.c | 22 +++------------------- drivers/mfd/hi6421-pmic-core.c | 9 +++------ drivers/mfd/mxs-lradc.c | 9 ++------- drivers/mfd/qcom-spmi-pmic.c | 6 ++++-- drivers/mfd/qcom_rpm.c | 8 ++++---- drivers/mfd/tps65910.c | 11 ++--------- drivers/mfd/twl4030-power.c | 9 +++------ drivers/mfd/twl6030-irq.c | 10 +++++----- 8 files changed, 26 insertions(+), 58 deletions(-) commit 15d71e678ec14ce26f7a271fef363e5c04ec24bf Author: Rob Herring Date: Tue Oct 17 15:35:49 2023 -0500 mfd: mc13xxx-spi/wm831x-spi: Use spi_get_device_match_data() Use preferred spi_get_device_match_data() instead of of_match_device() and spi_get_device_id() to get the driver match data. With this, adjust the includes to explicitly include the correct headers. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20231017203550.2700601-1-robh@kernel.org Signed-off-by: Lee Jones tils.feedkeys.call.run(35) all.run(37) all.run(39) drivers/mfd/mc13xxx-spi.c | 14 ++------------ drivers/mfd/wm831x-spi.c | 16 ++++------------ 2 files changed, 6 insertions(+), 24 deletions(-) commit 9f58744c5eee149fae13c64b0b8b5b4405de3aa4 Author: Rob Herring Date: Tue Oct 17 15:35:36 2023 -0500 mfd: motorola-cpcap: Drop unnecessary of_match_device() call If probe is reached, we've already matched the device and in the case of DT matching, the struct device_node pointer will be set. Therefore, there is no need to call of_match_device() in probe. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20231017203537.2700340-1-robh@kernel.org Signed-off-by: Lee Jones drivers/mfd/motorola-cpcap.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit 831d1af85133e1763d41e20414912d9a1058ea72 Author: Hans de Goede Date: Sat Oct 14 22:54:14 2023 +0200 mfd: arizona-spi: Set pdata.hpdet_channel for ACPI enumerated devs Commit 9e86b2ad4c11 changed the channel used for HPDET detection (headphones vs lineout detection) from being hardcoded to ARIZONA_ACCDET_MODE_HPL (HP left channel) to it being configurable through arizona_pdata.hpdet_channel the DT/OF parsing added for filling arizona_pdata on devicetree platforms ensures that arizona_pdata.hpdet_channel gets set to ARIZONA_ACCDET_MODE_HPL when not specified in the devicetree-node. But on ACPI platforms where arizona_pdata is filled by arizona_spi_acpi_probe() arizona_pdata.hpdet_channel was not getting set, causing it to default to 0 aka ARIZONA_ACCDET_MODE_MIC. This causes headphones to get misdetected as line-out on some models. Fix this by setting hpdet_channel = ARIZONA_ACCDET_MODE_HPL. Fixes: e933836744a2 ("mfd: arizona: Add support for ACPI enumeration of WM5102 connected over SPI") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20231014205414.59415-1-hdegoede@redhat.com Signed-off-by: Lee Jones drivers/mfd/arizona-spi.c | 3 +++ 1 file changed, 3 insertions(+) commit 10450565b417d3520ef267a62cea07cd5590c982 Author: Johan Hovold Date: Tue Oct 3 17:29:25 2023 +0200 mfd: qcom-spmi-pmic: Switch to EXPORT_SYMBOL_GPL() Switch to using EXPORT_SYMBOL_GPL() for the revid helper as there is no reason not to use it. Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Acked-by: Caleb Connolly Link: https://lore.kernel.org/r/20231003152927.15000-4-johan+linaro@kernel.org Signed-off-by: Lee Jones drivers/mfd/qcom-spmi-pmic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7b439aaa62fee474a0d84d67a25f4984467e7b95 Author: Johan Hovold Date: Tue Oct 3 17:29:24 2023 +0200 mfd: qcom-spmi-pmic: Fix revid implementation The Qualcomm SPMI PMIC revid implementation is broken in multiple ways. First, it assumes that just because the sibling base device has been registered that means that it is also bound to a driver, which may not be the case (e.g. due to probe deferral or asynchronous probe). This could trigger a NULL-pointer dereference when attempting to access the driver data of the unbound device. Second, it accesses driver data of a sibling device directly and without any locking, which means that the driver data may be freed while it is being accessed (e.g. on driver unbind). Third, it leaks a struct device reference to the sibling device which is looked up using the spmi_device_from_of() every time a function (child) device is calling the revid function (e.g. on probe). Fix this mess by reimplementing the revid lookup so that it is done only at probe of the PMIC device; the base device fetches the revid info from the hardware, while any secondary SPMI device fetches the information from the base device and caches it so that it can be accessed safely from its children. If the base device has not been probed yet then probe of a secondary device is deferred. Fixes: e9c11c6e3a0e ("mfd: qcom-spmi-pmic: expose the PMIC revid information to clients") Cc: stable@vger.kernel.org # 6.0 Signed-off-by: Johan Hovold Acked-by: Caleb Connolly Link: https://lore.kernel.org/r/20231003152927.15000-3-johan+linaro@kernel.org Signed-off-by: Lee Jones drivers/mfd/qcom-spmi-pmic.c | 69 ++++++++++++++++++++++++++++++++++---------- 1 file changed, 53 insertions(+), 16 deletions(-) commit a0fa44c261e448c531f9adb3a5189a3520f3e316 Author: Johan Hovold Date: Tue Oct 3 17:29:23 2023 +0200 mfd: qcom-spmi-pmic: Fix reference leaks in revid helper The Qualcomm SPMI PMIC revid implementation is broken in multiple ways. First, it totally ignores struct device_node reference counting and leaks references to the parent bus node as well as each child it iterates over using an open-coded for_each_child_of_node(). Second, it leaks references to each spmi device on the bus that it iterates over by failing to drop the reference taken by the spmi_device_from_of() helper. Fix the struct device_node leaks by reimplementing the lookup using for_each_child_of_node() and adding the missing reference count decrements. Fix the sibling struct device leaks by dropping the unnecessary lookups of devices with the wrong USID. Note that this still leaves one struct device reference leak in case a base device is found but it is not the parent of the device used for the lookup. This will be addressed in a follow-on patch. Fixes: e9c11c6e3a0e ("mfd: qcom-spmi-pmic: expose the PMIC revid information to clients") Cc: stable@vger.kernel.org # 6.0 Signed-off-by: Johan Hovold Acked-by: Caleb Connolly Link: https://lore.kernel.org/r/20231003152927.15000-2-johan+linaro@kernel.org Signed-off-by: Lee Jones drivers/mfd/qcom-spmi-pmic.c | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-) commit fe74f7a96616faa3a3ec12b6ed1371e79974f2ab Author: Russ Weight Date: Thu Sep 28 09:47:38 2023 -0700 mfd: intel-m10-bmc: Change contact for ABI docs Change ABI documentation contact information from Russ Weight to Peter Colberg. Signed-off-by: Russ Weight Acked-by: Peter Colberg Link: https://lore.kernel.org/r/20230928164738.278635-1-russell.h.weight@intel.com Signed-off-by: Lee Jones Documentation/ABI/testing/sysfs-driver-intel-m10-bmc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4fddf148f7266fda21d1f3bf7b201695cf743449 Author: Mark Brown Date: Sun Oct 1 00:47:07 2023 +0100 mfd: max8907: Convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Mark Brown Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231001-mfd-maxim-maple-v1-3-cdfeb48a4d15@kernel.org Signed-off-by: Lee Jones drivers/mfd/max8907.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 728f337477a7559e1f6316d8d32394cbd4084689 Author: Mark Brown Date: Sun Oct 1 00:47:06 2023 +0100 mfd: max77686: Convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Mark Brown Reviewed-by: Krzysztof Kozlowski Reviewed-by: Chanwoo Choi Link: https://lore.kernel.org/r/20231001-mfd-maxim-maple-v1-2-cdfeb48a4d15@kernel.org Signed-off-by: Lee Jones drivers/mfd/max77686.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fc12429b406ebe8c545fa1b9d3996706ff07ef0c Author: Mark Brown Date: Sun Oct 1 00:47:05 2023 +0100 mfd: max77620: Convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20231001-mfd-maxim-maple-v1-1-cdfeb48a4d15@kernel.org Signed-off-by: Lee Jones drivers/mfd/max77620.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit aaca37ae369da657e6ba45b4e2f0e698692204c2 Author: Luca Weiss Date: Mon Oct 2 09:00:11 2023 +0200 dt-bindings: mfd: qcom,spmi-pmic: Drop unused labels from examples There's not much point in having unused labels in the binding example, so drop them. This patch was originally motivated by ea25d61b448a ("arm64: dts: qcom: Use plural _gpios node label for PMIC gpios") updating all dts files to use the plural _gpios label instead of the singular _gpio as label but this example wasn't updated. But since we should just drop the label alltogether, do that. Signed-off-by: Luca Weiss Acked-by: Conor Dooley Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231002-pm7250b-gpio-fixup-v2-1-debb8b599989@fairphone.com Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/qcom,spmi-pmic.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit e53b22b10c6e0de0cf2a03a92b18fdad70f266c7 Author: Jarkko Nikula Date: Mon Oct 2 11:33:44 2023 +0300 mfd: intel-lpss: Add Intel Lunar Lake-M PCI IDs Add Intel Lunar Lake-M SoC PCI IDs. Signed-off-by: Jarkko Nikula Link: https://lore.kernel.org/r/20231002083344.75611-1-jarkko.nikula@linux.intel.com Signed-off-by: Lee Jones drivers/mfd/intel-lpss-pci.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 7f70d4590d949e1488f8ff7ebc35ee238a1e0661 Author: Mark Brown Date: Sun Oct 1 00:44:22 2023 +0100 mfd: rk8xx: Convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20231001-mfd-rk88x-maple-v1-1-90434cfb2f90@kernel.org Signed-off-by: Lee Jones drivers/mfd/rk8xx-i2c.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 1c943dfd80075d15ac8c976d4b27bc77732d5d47 Author: Mark Brown Date: Sun Oct 1 11:27:54 2023 +0100 mfd: twl: Convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20231001-mfd-ti-maple-v1-7-0657862de3f6@kernel.org Signed-off-by: Lee Jones drivers/mfd/twl-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 214fbbd05ba95b9357f1e56c3787cf2e7258e392 Author: Mark Brown Date: Sun Oct 1 11:27:53 2023 +0100 mfd: tps65912: Convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20231001-mfd-ti-maple-v1-6-0657862de3f6@kernel.org Signed-off-by: Lee Jones drivers/mfd/tps65912-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 535cd579bc7be8c149b8cf0dd76891f5f53a1019 Author: Mark Brown Date: Sun Oct 1 11:27:52 2023 +0100 mfd: tps65910: Convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20231001-mfd-ti-maple-v1-5-0657862de3f6@kernel.org Signed-off-by: Lee Jones drivers/mfd/tps65910.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e142b022b3c155180f452452e075eae717b9b532 Author: Mark Brown Date: Sun Oct 1 11:27:51 2023 +0100 mfd: tps6586x: Convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20231001-mfd-ti-maple-v1-4-0657862de3f6@kernel.org Signed-off-by: Lee Jones drivers/mfd/tps6586x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2e9a3fc2f98e1f017b85316ec2f8a296f3ae81c3 Author: Mark Brown Date: Sun Oct 1 11:27:50 2023 +0100 mfd: tps65128: Convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20231001-mfd-ti-maple-v1-3-0657862de3f6@kernel.org Signed-off-by: Lee Jones drivers/mfd/tps65218.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 778eea25bff27b4cdc7c7f4e2c045e5c2008a924 Author: Mark Brown Date: Sun Oct 1 11:27:49 2023 +0100 mfd: tps65090: Convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20231001-mfd-ti-maple-v1-2-0657862de3f6@kernel.org Signed-off-by: Lee Jones drivers/mfd/tps65090.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6917c33322d14882b0e85fd338e203df7fbd3b1b Author: Mark Brown Date: Sun Oct 1 11:27:48 2023 +0100 mfd: tps65086: Convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20231001-mfd-ti-maple-v1-1-0657862de3f6@kernel.org Signed-off-by: Lee Jones drivers/mfd/tps65086.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6bce629689f094bb7729ac77567a76763912b392 Author: Justin Stitt Date: Wed Sep 27 05:10:54 2023 +0000 mfd: db8500-prcmu: Replace deprecated strncpy with strscpy `strncpy` is deprecated for use on NUL-terminated destination strings [1] and as such we should prefer more robust and less ambiguous string interfaces. We expect project_name to be NUL-terminated based on its use with pr_info: | pr_info("PRCMU firmware: %s(%d), version %d.%d.%d\n", | fw_info.version.project_name, | fw_info.version.project, | fw_info.version.api_version, | fw_info.version.func_version, | fw_info.version.errata); Moreover, NUL-padding does not seem to be needed. Considering the above, a suitable replacement is `strscpy` [2] due to the fact that it guarantees NUL-termination on the destination buffer without unnecessarily NUL-padding. Let's also change `PRCMU_FW_PROJECT_NAME_LEN` to just sizeof(fw_info.version.project_name) as this is more idiomatic strscpy usage. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Link: https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html [2] Link: https://github.com/KSPP/linux/issues/90 Cc: linux-hardening@vger.kernel.org Signed-off-by: Justin Stitt Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20230927-strncpy-drivers-mfd-db8500-prcmu-c-v1-1-db9693f92a68@google.com Signed-off-by: Lee Jones drivers/mfd/db8500-prcmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 61fdd1f1d2c183ec256527d16d75e75c3582af82 Author: Chen-Yu Tsai Date: Thu Sep 28 16:55:24 2023 +0800 dt-bindings: mfd: mt6397: Split out compatible for MediaTek MT6366 PMIC The MT6366 PMIC is mostly, but not fully, compatible with MT6358. It has a different set of regulators. Specifically, it lacks the camera related VCAM* LDOs and VLDO28, but has additional VM18, VMDDR, and VSRAM_CORE LDOs. The PMICs contain a chip ID register that can be used to detect which exact model is preset, so it is possible to share a common base compatible string. Add a separate compatible for the MT6366 PMIC, with a fallback to the MT6358 PMIC. Fixes: 49be16305587 ("dt-bindings: mfd: Add compatible for the MediaTek MT6366 PMIC") Signed-off-by: Chen-Yu Tsai Acked-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230928085537.3246669-2-wenst@chromium.org Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/mt6397.txt | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit b4e40505f90a9936e7dd2dd0b98a1af97d8941f0 Author: Andy Shevchenko Date: Tue Sep 26 22:08:34 2023 +0300 mfd: lpc_ich: Add a platform device for pinctrl Denverton This is to cater the need in non-ACPI system whereby a platform device has to be created in order to bind with the Denverton pinctrl driver. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230926190834.932233-4-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones drivers/mfd/lpc_ich.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) commit 1f84f88dc15036d63fa7c84833a440370f22a74b Author: Andy Shevchenko Date: Tue Sep 26 22:08:33 2023 +0300 mfd: lpc_ich: Move APL GPIO resources to a custom structure We are expecting more platforms that want to instantiate the GPIO device via P2SB. For them prepare the custom structure and move Apollo Lake data there. Refactor the code accordingly. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230926190834.932233-3-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones drivers/mfd/lpc_ich.c | 52 +++++++++++++++++++++++++++++++++++---------- include/linux/mfd/lpc_ich.h | 3 +++ 2 files changed, 44 insertions(+), 11 deletions(-) commit 16c4c1bb7e01d5de797c43d7a2396434f2078b0a Author: Andy Shevchenko Date: Tue Sep 26 22:08:32 2023 +0300 mfd: lpc_ich: Convert gpio_version to be enum We have an anonymous enum for the GPIO versions. Make it named and use this type for the gpio_version member of struct lpc_ich_info. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230926190834.932233-2-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones include/linux/mfd/lpc_ich.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b0eb61880f004290a62b71b135825e9c5f5bde99 Author: Andy Shevchenko Date: Tue Sep 26 22:08:31 2023 +0300 mfd: lpc_ich: Make struct lpc_ich_priv use enum for chipset member We have a specific enum for the supported chipsets. Make struct lpc_ich_priv use better type for the chipset member. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230926190834.932233-1-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones drivers/mfd/lpc_ich.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) commit 8cdbe51c2dcceb3fa15c16176849309fe6f99389 Author: Rob Herring Date: Mon Sep 25 16:27:24 2023 -0500 dt-bindings: mfd: Add missing unevaluatedProperties on child node schemas Just as unevaluatedProperties or additionalProperties are required at the top level of schemas, they should (and will) also be required for child node schemas. That ensures only documented properties are present for any node. Add unevaluatedProperties as needed, and then add any missing properties flagged by the addition. Signed-off-by: Rob Herring Acked-by: Conor Dooley Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230925212729.1976117-1-robh@kernel.org Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/maxim,max5970.yaml | 5 +++++ Documentation/devicetree/bindings/mfd/mediatek,mt6357.yaml | 2 ++ Documentation/devicetree/bindings/mfd/rockchip,rk805.yaml | 1 + Documentation/devicetree/bindings/mfd/rockchip,rk808.yaml | 1 + Documentation/devicetree/bindings/mfd/rockchip,rk809.yaml | 3 ++- Documentation/devicetree/bindings/mfd/rockchip,rk818.yaml | 1 + Documentation/devicetree/bindings/mfd/ti,lp87524-q1.yaml | 1 + Documentation/devicetree/bindings/mfd/ti,lp87561-q1.yaml | 1 + Documentation/devicetree/bindings/mfd/ti,lp87565-q1.yaml | 1 + 9 files changed, 15 insertions(+), 1 deletion(-) commit fd7a0ecf4e715c5f68a2a219fe774e1de730d0b7 Author: Andre Przywara Date: Tue Sep 19 11:39:12 2023 +0100 dt-bindings: mfd: x-powers,axp152: Make interrupt optional for more chips All X-Powers PMICs described by this binding have an IRQ pin, and so far (almost) all boards connected this to some NMI pin or GPIO on the SoC they are connected to. However we start to see boards that omit this connection, and technically the IRQ pin is not essential to the basic PMIC operation. The existing Linux driver allows skipping the IRQ pin setup for two chips already, so update the binding to also make the DT property optional for the missing chip. And while we are at it, add the AXP313a to that list, as they are actually boards out there not connecting the IRQ pin. This allows to have DTs correctly describing those boards not wiring up the interrupt. Signed-off-by: Andre Przywara Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20230919103913.463156-2-andre.przywara@arm.com Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/x-powers,axp152.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 759c409bc5fc496cbc22cd0b392d3cbb0c0e23eb Author: Dinghao Liu Date: Mon Sep 25 10:41:33 2023 +0800 mfd: dln2: Fix double put in dln2_probe The dln2_free() already contains usb_put_dev(). Therefore, the redundant usb_put_dev() before dln2_free() may lead to a double free. Fixes: 96da8f148396 ("mfd: dln2: Fix memory leak in dln2_probe()") Signed-off-by: Dinghao Liu Link: https://lore.kernel.org/r/20230925024134.9683-1-dinghao.liu@zju.edu.cn Signed-off-by: Lee Jones drivers/mfd/dln2.c | 1 - 1 file changed, 1 deletion(-) commit c4974eea6ca9f4080557bfdf0adc48396d8575f4 Author: Biju Das Date: Sat Sep 23 18:49:28 2023 +0100 mfd: max8998: Simplify obtaining I2C match data and drop max8998_i2c_get_driver_data() Simplify probe() by using i2c_get_match_data() instead of max8998_i2c_get_driver_data() for retrieving match data from OF/ID tables. Signed-off-by: Biju Das Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230923174928.56824-5-biju.das.jz@bp.renesas.com Signed-off-by: Lee Jones drivers/mfd/max8998.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) commit bffa42885f3bbddce56e17e619e083f041812f8a Author: Biju Das Date: Sat Sep 23 18:49:27 2023 +0100 mfd: max77541: Simplify obtaining I2C match data Simplify probe() by replacing device_get_match_data() and ID lookup for retrieving match data by i2c_get_match_data(). Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230923174928.56824-4-biju.das.jz@bp.renesas.com Signed-off-by: Lee Jones drivers/mfd/max77541.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit f1f23a1a79512a22f9153e9b6d1c98a2b4ab300f Author: Biju Das Date: Sat Sep 23 18:49:26 2023 +0100 mfd: madera-i2c: Simplify obtaining I2C match data Simplify probe() by replacing of_device_get_match_data() and ID lookup for retrieving match data by i2c_get_match_data(). Signed-off-by: Biju Das Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20230923174928.56824-3-biju.das.jz@bp.renesas.com Signed-off-by: Lee Jones drivers/mfd/madera-i2c.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit 7ec9f1f31d8b41a0725777e220d2eb6e9d0dbc83 Author: Biju Das Date: Sat Sep 23 18:49:25 2023 +0100 mfd: arizona-i2c: Simplify obtaining I2C match data Simplify probe() by replacing device_get_match_data() and ID lookup for retrieving match data by i2c_get_match_data(). After this drop intializing the variable type. Signed-off-by: Biju Das Acked-by: Charles Keepax Tested-by: Charles Keepax Link: https://lore.kernel.org/r/20230923174928.56824-2-biju.das.jz@bp.renesas.com Signed-off-by: Lee Jones drivers/mfd/arizona-i2c.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) commit 69c3f9154553c22066108427eb24d94f1645551b Author: Kees Cook Date: Fri Sep 22 10:53:38 2023 -0700 mfd: iqs62x: Annotate struct iqs62x_fw_blk with __counted_by Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct iqs62x_fw_blk. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20230922175337.work.150-kees@kernel.org Signed-off-by: Lee Jones drivers/mfd/iqs62x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1c7ea43fc42b09080657c83683846c4be672bd91 Author: Fabrice Gasnier Date: Tue Aug 29 15:40:25 2023 +0200 mfd: stm32-timers: Add support for interrupts There are two types of STM32 timers that may have: - a global interrupt line - 4 dedicated interrupt lines. Those interrupts are optional as defined in the dt-bindings. Enforce checks on either one, four or no interrupts are provided with their names. Optionally get them here, to be used by child devices. Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20230829134029.2402868-5-fabrice.gasnier@foss.st.com Signed-off-by: Lee Jones drivers/mfd/stm32-timers.c | 46 ++++++++++++++++++++++++++++++++++++++++ include/linux/mfd/stm32-timers.h | 11 ++++++++++ 2 files changed, 57 insertions(+) commit 63416320419e99ea4c6530587658e5d14e9402ba Author: Andreas Kemnade Date: Sat Sep 16 12:05:13 2023 +0200 mfd: twl-core: Add a clock subdevice for the TWL6032 Clock device needs no separate devicetree node, so add it as a platform device. Other devices in the family also have controllable clocks, but due to the lack of testing, just add it for the TWL6032 now. Signed-off-by: Andreas Kemnade Link: https://lore.kernel.org/r/20230916100515.1650336-4-andreas@kemnade.info Signed-off-by: Lee Jones drivers/mfd/twl-core.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit b06545fcb3c696f36fac6ba4c73023cef96d2f7f Author: Andreas Kemnade Date: Sat Sep 16 12:05:12 2023 +0200 dt-bindings: mfd: ti,twl: Add clock provider properties Since these devices provide clock outputs, add the corresponding property. Signed-off-by: Andreas Kemnade Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20230916100515.1650336-3-andreas@kemnade.info Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/ti,twl.yaml | 3 +++ 1 file changed, 3 insertions(+) commit 611ed1a5f394b41ab8ab892942c2e2ab42499245 Author: Andreas Kemnade Date: Sat Sep 16 12:05:11 2023 +0200 dt-bindings: mfd: Convert twl-family.txt to json-schema Convert the TWL[46]030 binding to DT schema format. To do it as a step by step work, do not include / handle nodes for subdevices yet, just convert things with minimal corrections. There are already some bindings for its subdevices in the tree. Signed-off-by: Andreas Kemnade Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230916100515.1650336-2-andreas@kemnade.info Signed-off-by: Lee Jones .../bindings/input/twl4030-pwrbutton.txt | 2 +- Documentation/devicetree/bindings/mfd/ti,twl.yaml | 64 ++++++++++++++++++++++ .../devicetree/bindings/mfd/twl-family.txt | 46 ---------------- 3 files changed, 65 insertions(+), 47 deletions(-) commit ad3a3c6e4aef5d77c4e5c1f9e46f40e8240079f7 Author: Manikandan Muralidharan Date: Fri Sep 15 16:18:42 2023 +0530 mfd: atmel-hlcdc: Add compatible for sam9x75 XLCD controller Add compatible for sam9x75 XLCD controller. Signed-off-by: Manikandan Muralidharan Link: https://lore.kernel.org/r/20230915104849.187146-2-manikandan.m@microchip.com Signed-off-by: Lee Jones drivers/mfd/atmel-hlcdc.c | 1 + 1 file changed, 1 insertion(+) commit cb523495ee2a5938fbdd30b8a35094d386c55c12 Author: Andrew Davis Date: Mon Sep 11 09:25:55 2023 -0500 dt-bindings: mfd: syscon: Add ti,am654-dss-oldi-io-ctrl compatible Add TI DSS OLDI-IO control registers compatible. This is a region of 5 32bit registers found in the TI AM65 CTRL_MMR0 register space[0]. They are used to control the characteristics of the OLDI DATA/CLK IO as needed by the DSS display controller node. [0] https://www.ti.com/lit/pdf/spruid7 Signed-off-by: Andrew Davis Acked-by: Krzysztof Kozlowski Reviewed-by: Aradhya Bhatia Link: https://lore.kernel.org/r/20230911142556.64108-1-afd@ti.com Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/syscon.yaml | 1 + 1 file changed, 1 insertion(+) commit 89b00c328f5623c428e6aa8563c3a648f8190252 Author: Ying Sun Date: Wed Sep 13 16:45:59 2023 +0800 mfd: ab8500: Remove non-existent configuration "#ifdef CONFIG_AB8500_DEBUG" The CONFIG_AB8500_DEBUG has been deleted in: 3d4d1266597c0 ("mfd: ab8500: Drop debugfs module") The condition "#ifdef CONFIG_AB8500_DEBUG" in: include/linux/mfd/abx500/ab8500.h:502 ...cannot be valid. It is recommended to delete redundant code. Suggested-by: Yanjie Ren Signed-off-by: Ying Sun Link: https://lore.kernel.org/r/20230913084559.18141-1-sunying@nj.iscas.ac.cn Signed-off-by: Lee Jones include/linux/mfd/abx500/ab8500.h | 6 ------ 1 file changed, 6 deletions(-) commit a50afa310d6a4c765a1787742b206eb149bb1d12 Author: Mark Brown Date: Tue Sep 12 12:36:46 2023 +0100 mfd: wcd934x: Update to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. In v6.5 it has also acquired the ability to generate multi-register writes in sync operations, bringing performance up to parity with the rbtree cache there. Update the wcd934x to use the more modern data structure. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230912-mfd-wcd934x-maple-v2-1-292a154113e3@kernel.org Signed-off-by: Lee Jones drivers/mfd/wcd934x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a8e498368d75230988860e818b6e565ad70a2c66 Author: Krzysztof Kozlowski Date: Mon Sep 11 14:01:35 2023 +0200 dt-bindings: mfd: maxim,max8998: Convert to DT schema Convert the bindings for Maxim MAX8998, National/TI LP3974 Power Management IC to DT schema. Adjust example to real DTS and make second interrupt optional (like on s5pv210-aries.dtsi). Signed-off-by: Krzysztof Kozlowski Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230911120135.37528-1-krzysztof.kozlowski@linaro.org Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/max8998.txt | 125 -------- .../devicetree/bindings/mfd/maxim,max8998.yaml | 324 +++++++++++++++++++++ 2 files changed, 324 insertions(+), 125 deletions(-) commit 917991aae60f4f8a224b30a9eca6701be08d64b5 Author: Tengfei Fan Date: Fri Sep 8 14:58:43 2023 +0800 dt-bindings: mfd: qcom,tcsr: Add compatible for sm4450 Document the qcom,sm4450-tcsr compatible. Signed-off-by: Tengfei Fan Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230908065847.28382-3-quic_tengfan@quicinc.com Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/qcom,tcsr.yaml | 1 + 1 file changed, 1 insertion(+) commit b2cb2ae22278f1918f7526b89760ee00b4a81393 Author: Andre Przywara Date: Mon Aug 28 22:32:29 2023 +0100 mfd: axp20x: Generalise handling without interrupt At the moment we allow the AXP15060 and the AXP806 PMICs to omit the interrupt line to the SoC, and we skip registering the PEK (power key) driver in this case, since that crashes when no IRQ is described in the DT node. The IRQ pin potentially not being connected to anything does affect more PMICs, though, and the PEK driver is not the only one requiring an interrupt: at least the AC power supply driver crashes in a similar fashion. Generalise the handling of AXP MFD devices when the platform tables describe no interrupt, by allowing each device to specify an alternative MFD list for this case. If no specific alternative is specified, we go with the safe default of "just the regulators", which matches the current situation. This enables new devices using the AXP313a PMIC, but not connecting the IRQ pin. Signed-off-by: Andre Przywara Reviewed-by: Jernej Skrabec Link: https://lore.kernel.org/r/20230828213229.20332-1-andre.przywara@arm.com Signed-off-by: Lee Jones drivers/mfd/axp20x.c | 44 ++++++++++++++++++++++++-------------------- 1 file changed, 24 insertions(+), 20 deletions(-) commit 9a41c31e40d867bb4ad93b527b0ba7cfaae4c9c4 Author: Biju Das Date: Thu Aug 31 19:31:53 2023 +0100 mfd: palmas: Make similar OF and ID table Make similar OF and ID table to extend support for ID match using i2c_match_data(). Currently it works only for OF match tables as the driver_data is wrong for ID match. Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230831183153.63750-5-biju.das.jz@bp.renesas.com Signed-off-by: Lee Jones drivers/mfd/palmas.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit a17e0bc66fd4f63c5a6090bdd140c988df8b6c47 Author: Biju Das Date: Thu Aug 31 19:31:52 2023 +0100 mfd: palmas: Move OF table closer to its consumer Move OF table near to the user. While at it, arrange compatible and data in single line. Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230831183153.63750-4-biju.das.jz@bp.renesas.com Signed-off-by: Lee Jones drivers/mfd/palmas.c | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-) commit 93ec3d0e02806e19caf2908d9b592ee509e2df9c Author: Biju Das Date: Thu Aug 31 19:31:51 2023 +0100 mfd: palmas: Constify .data in OF table and {palmas,tps65917}_irq_chip Constify .data in OF table and {palmas,tps65917}_irq_chip and replace the variable *features->features in struct palmas_driver_data and drop the {palmas,tps659038}_features variables and use their values directly in the named initialization. Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230831183153.63750-3-biju.das.jz@bp.renesas.com Signed-off-by: Lee Jones drivers/mfd/palmas.c | 27 +++++++++++---------------- 1 file changed, 11 insertions(+), 16 deletions(-) commit 3f9a06dc7975d6261bdd252ba7e099d8f3514466 Author: Biju Das Date: Thu Aug 31 19:31:50 2023 +0100 mfd: palmas: Remove trailing comma in the terminator entry Remove trailing comma in the terminator entry for OF table. Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230831183153.63750-2-biju.das.jz@bp.renesas.com Signed-off-by: Lee Jones drivers/mfd/palmas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e7df2d7c83a98d0fc0384d0315c86f3bb89de27d Author: Geert Uytterhoeven Date: Wed Aug 30 16:53:43 2023 +0200 dt-bindings: mfd: stericsson,db8500-prcmu: Spelling s/Cortex A-/Cortex-A/ Fix a misspelling of "Cortex-A9". Signed-off-by: Geert Uytterhoeven Reviewed-by: Linus Walleij Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/0789000f012122a7fa27ef709c738101b00cd834.1693407196.git.geert+renesas@glider.be Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/stericsson,db8500-prcmu.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 719a205707d67e715c5e807643edf4169a5ef1a3 Author: Alex Bee Date: Tue Aug 29 19:16:17 2023 +0200 dt-bindings: mfd: syscon: Add rockchip,rk3128-qos compatible Document Rockchip RK3128 SoC compatible for qos registers. Signed-off-by: Alex Bee Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230829171647.187787-2-knaerzche@gmail.com Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/syscon.yaml | 1 + 1 file changed, 1 insertion(+) commit 7ba7bdef4d14e3722e2842da3b48cbadb73e52d6 Author: Herve Codina Date: Fri Aug 18 18:39:17 2023 +0200 mfd: core: Ensure disabled devices are skipped without aborting The loop searching for a matching device based on its compatible string is aborted when a matching disabled device is found. This abort prevents to add devices as soon as one disabled device is found. Continue searching for an other device instead of aborting on the first disabled one fixes the issue. Fixes: 22380b65dc70 ("mfd: mfd-core: Ensure disabled devices are ignored without error") Signed-off-by: Herve Codina Reviewed-by: Christophe Leroy Signed-off-by: Christophe Leroy Link: https://lore.kernel.org/r/528425d6472176bb1d02d79596b51f8c28a551cc.1692376361.git.christophe.leroy@csgroup.eu Signed-off-by: Lee Jones drivers/mfd/mfd-core.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) commit 0202e408fa0c7da34adeb26958f42248c999a1a8 Author: Bryan O'Donoghue Date: Wed Aug 16 12:51:45 2023 +0100 dt-bindings: mfd: qcom,spmi-pmic: Add typec to SPMI device types Add the PMIC Type-C port driver to the list of devices. Signed-off-by: Bryan O'Donoghue Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230816115151.501736-2-bryan.odonoghue@linaro.org Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/qcom,spmi-pmic.yaml | 4 ++++ 1 file changed, 4 insertions(+) commit 676c26722333301e2d8794401f3c14e6c225f27f Author: Biju Das Date: Mon Aug 28 17:02:24 2023 +0100 mfd: max8997: Simplify obtaining I2C match data and drop max8997_i2c_get_driver_data() Simplify probe() by using i2c_get_match_data() instead of max8997_i2c_get_driver_data() for retrieving match data from OF/ID tables. Signed-off-by: Biju Das Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230828160224.92037-1-biju.das.jz@bp.renesas.com Signed-off-by: Lee Jones drivers/mfd/max8997.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) commit 3c70342f1f0045dc827bb2f02d814ce31e0e0d05 Author: Michał Mirosław Date: Mon Aug 28 22:16:11 2023 +0200 mfd: core: Un-constify mfd_cell.of_reg Enable dynamically filling in the whole mfd_cell structure. All other fields already allow that. Fixes: 466a62d7642f ("mfd: core: Make a best effort attempt to match devices with the correct of_nodes") Signed-off-by: Michał Mirosław Link: https://lore.kernel.org/r/b73fe4bc4bd6ba1af90940a640ed65fe254c0408.1693253717.git.mirq-linux@rere.qmqm.pl Signed-off-by: Lee Jones include/linux/mfd/core.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 26329c97fbba6467cdbb2e63fb37d12d03a40925 Author: Dmitry Baryshkov Date: Sun Aug 27 16:24:50 2023 +0300 dt-bindings: mfd: qcom-pm8xxx: Add missing child nodes Add gpio, keypad, led, mpps, pwrkey, vibrator and xoadc as possible child nodes of qcom,pm8xxx, referencing existint schema files. Signed-off-by: Dmitry Baryshkov Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230827132525.951475-3-dmitry.baryshkov@linaro.org Signed-off-by: Lee Jones .../devicetree/bindings/mfd/qcom-pm8xxx.yaml | 26 +++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) commit ea927f1909866350ec3cc4c83da835bf4065723b Author: Dmitry Baryshkov Date: Tue Aug 22 02:25:32 2023 +0300 dt-bindings: mfd: qcom-spmi-pmic: Add pm8450 entry Add bindings for the PM8450 PMIC (qcom,pm8450). No driver changes are necessary, since the PMIC is handled by the generic qcom,spmi-pmic entry. Signed-off-by: Dmitry Baryshkov Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230821232532.3110607-1-dmitry.baryshkov@linaro.org Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/qcom,spmi-pmic.yaml | 1 + 1 file changed, 1 insertion(+) commit 55bb1a507fe3940fb2db99077d9e31046ad52247 Merge: 0bb80ecc33a8 510f276df2b9 Author: Lee Jones Date: Wed Nov 1 10:00:28 2023 +0000 Merge tag 'ib-mfd-i2c-reboot-v6.7' into ibs-for-mfd-merged Immutable branch between MFD, I2C and Reboot due for the v6.7 merge window commit a312e07a65fb598ed239b940434392721385c722 Author: Eric Biggers Date: Fri Oct 27 13:30:17 2023 -0700 crypto: adiantum - flush destination page before unmapping Upon additional review, the new fast path in adiantum_finish() is missing the call to flush_dcache_page() that scatterwalk_map_and_copy() was doing. It's apparently debatable whether flush_dcache_page() is actually needed, as per the discussion at https://lore.kernel.org/lkml/YYP1lAq46NWzhOf0@casper.infradead.org/T/#u. However, it appears that currently all the helper functions that write to a page, such as scatterwalk_map_and_copy(), memcpy_to_page(), and memzero_page(), do the dcache flush. So do it to be consistent. Fixes: dadf5e56c967 ("crypto: adiantum - add fast path for single-page messages") Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/adiantum.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit b030c45844cfe0d4c89202cd6c9f4697b3a25a6a Author: Eric Biggers Date: Fri Oct 27 12:52:06 2023 -0700 crypto: testmgr - move pkcs1pad(rsa,sha3-*) to correct place alg_test_descs[] needs to be in sorted order, since it is used for binary search. This fixes the following boot-time warning: testmgr: alg_test_descs entries in wrong order: 'pkcs1pad(rsa,sha512)' before 'pkcs1pad(rsa,sha3-256)' Fixes: ee62afb9d02d ("crypto: rsa-pkcs1pad - Add FIPS 202 SHA-3 support") Signed-off-by: Eric Biggers Reviewed-by: Dimitri John Ledkov Signed-off-by: Herbert Xu crypto/testmgr.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 8bc9e6515183935fa0cccaf67455c439afe4982b Merge: f9ae180416e0 fe612629746c Author: Linus Torvalds Date: Tue Oct 31 18:50:13 2023 -1000 Merge tag 'devicetree-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: - Add a kselftest to check for unprobed DT devices - Fix address translation for some 3 address cells cases - Refactor firmware node refcounting for AMBA bus - Add bindings for qcom,sm4450-pdc, Qualcomm Kryo 465 CPU, and Freescale QMC HDLC - Add Marantec vendor prefix - Convert qcom,pm8921-keypad, cnxt,cx92755-wdt, da9062-wdt, and atmel,at91rm9200-wdt bindings to DT schema - Several additionalProperties/unevaluatedProperties on child node schemas fixes - Drop reserved-memory bindings which now live in dtschema project - Fix a reference to rockchip,inno-usb2phy.yaml - Remove backlight nodes from display panel examples - Expand example for using DT_SCHEMA_FILES - Merge simple LVDS panel bindings to one binding doc * tag 'devicetree-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (34 commits) dt-bindings: soc: fsl: cpm_qe: cpm1-scc-qmc: Add support for QMC HDLC dt-bindings: soc: fsl: cpm_qe: cpm1-scc-qmc: Add 'additionalProperties: false' in child nodes dt-bindings: soc: fsl: cpm_qe: cpm1-scc-qmc: Fix example property name dt-bindings: arm,coresight-cti: Add missing additionalProperties on child nodes dt-bindings: arm,coresight-cti: Drop type for 'cpu' property dt-bindings: soundwire: Add reference to soundwire-controller.yaml schema dt-bindings: input: syna,rmi4: Make "additionalProperties: true" explicit media: dt-bindings: ti,ds90ub960: Add missing type for "i2c-alias" dt-bindings: input: qcom,pm8921-keypad: convert to YAML format of: overlay: unittest: overlay_bad_unresolved: Spelling s/ok/okay/ of: address: Consolidate bus .map() functions of: address: Store number of bus flag cells rather than bool of: unittest: Add tests for address translations of: address: Remove duplicated functions of: address: Fix address translation when address-size is greater than 2 dt-bindings: watchdog: cnxt,cx92755-wdt: convert txt to yaml dt-bindings: watchdog: da9062-wdt: convert txt to yaml dt-bindings: watchdog: fsl,scu-wdt: Document imx8dl dt-bindings: watchdog: atmel,at91rm9200-wdt: convert txt to yaml dt-bindings: usb: rockchip,dwc3: update inno usb2 phy binding name ... commit f9ae180416e04bcee4d3cd216a6264a50f9299e6 Merge: fe4ae2fab00b 469d31745b9f Author: Linus Torvalds Date: Tue Oct 31 18:47:03 2023 -1000 Merge tag 'for-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "Core changes: - propagate of_node to child device - change from atomic to blocking notifier_call_chain New drivers: - pm8916 battery management system - mm8013 fuel gauge New features: - maxim max17040: add temperature support - gpio-poweroff: make priority configurable Cleanups: - simplify reset drivers using builtin_platform_driver() - convert all platform drivers to remove_new callback - replace all strncpy occurrences with strscpy - started converting drivers to i2c_get_match_data() - misc fixes and cleanups" * tag 'for-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (91 commits) power: reset: vexpress: Use device_get_match_data() power: supply: surface-charger: replace deprecated strncpy with strscpy power: supply: surface_battery: replace deprecated strncpy with strscpy power: supply: charger-manager: replace deprecated strncpy with strscpy power: supply: bq25980: replace deprecated strncpy with strscpy power: supply: bq256xx: replace deprecated strncpy with strscpy power: supply: bq2515x: replace deprecated strncpy with strscpy power: supply: bq24190_charger: replace deprecated strncpy with strscpy power: supply: cpcap: Drop non-DT driver matching power: reset: brcmstb: Depend on actual SoC dependencies power: reset: gpio-poweroff: make sys handler priority configurable dt-bindings: power: reset: gpio-poweroff: Add priority property power: reset: gpio-poweroff: use sys-off handler API power: reset: gpio-poweroff: use a struct to store the module variables power: supply: rt5033_charger: Replace "&pdev->dev" by "charger->dev" in probe power: supply: rt5033_charger: Simplify initialization of rt5033_charger_data power: supply: rt5033_charger: Add cable detection and USB OTG supply power: supply: core: remove opencoded string_lower() dt-bindings: power: supply: sbs-manager: Add missing unevaluatedProperties on child node schemas power: supply: mm8013: Fix an error checking issue in mm8013_checkdevice() ... commit fe4ae2fab00b4751265580c5865fdf23b62d80b3 Merge: c52894359395 0a6d7f8275f2 Author: Linus Torvalds Date: Tue Oct 31 18:42:56 2023 -1000 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk driver updates from Stephen Boyd: "Herein lies a smallish collection of clk driver updates and some core clk framework changes for the merge window. The core framework changes are only improving the debugfs interface to allow phase adjustments and report which consumers of a clk there are. These are most likely only of interest to kernel developers. On the clk driver side, it's a ghastly amount of updates with only a handful of new clk drivers. We have a couple new clk drivers for Qualcomm, per usual, and a driver for Renesas, Amlogic, and TI respectively. The updates are spread throughout the clk drivers. Some highlights are fixing kunit tests for different configurations like lockdep and big-endian, avoiding integer overflow in rate settable clks, moving clk_hw_onecell_data to the end of allocations so that drivers don't corrupt their private data, and migrating clk drivers to the regmap maple tree. Otherwise it's the usual fixes to clk drivers that only come along with testing the drivers on real hardware. New Drivers: - Add clock driver for TWL6032 - Initial support for the Qualcomm SM4450 Global Clock Controller and SM4450 RPMh clock controllers - Add Camera Clock Controller on Qualcomm SM8550 - Add support for the Renesas RZ/G3S (R9A08G045) SoC - Add Amlogic s4 main clock controller support Updates: - Make clk kunit tests work with lockdep - Fix clk gate kunit test for big-endian - Convert more than a handful of clk drivers to use regmap maple tree - Consider the CLK_FRAC_DIVIDER_ZERO_BASED in fractional divider clk implementation - Add consumer info to clk debugfs - Fix various clk drivers that have clk_hw_onecell_data not at the end of an allocation - Drop CLK_SET_RATE_PARENT for clocks with fixed-rate GPLLs across a variety of Qualcomm IPQ platforms - Add missing parent of APCS PLL on Qualcomm IPQ6018 - Add I2C QUP6 clk on Qualcomm IPQ6018 but mark it critical to avoid problems with RPM - Implement safe source switching for a53pll and use on Qualcomm IPQ5332 - Add support for Stromer Plus PLLs to Qualcomm clk driver - Switch Qualcomm SM8550 Video and GPU clock controllers to use OLE PLL configure method - Non critical fixes to halt bit checks in Qualcomm clk drivers - Add SMMU GDSC for Qualcomm MSM8998 - Fix possible integer overflow in Qualcomm RCG frequency calculation code - Remove RPM managed clks from Qualcomm MSM8996 GCC driver - Add HFPLL configuration for the three HFPLLs in Qualcomm MSM8976 - Switch Qualcomm MSM8996 CBF clock driver's remove function to return void - Fix missing dependency for s4 clock controllers - Select MXC_CLK when building in the CLK_IMX8QXP - Fixes for error handling paths in i.MX8 ACM driver - Move the clocks check in i.MX8 ACM driver in order to log any error - Drop the unused return value of clk_imx_acm_detach_pm_domains - Drop non-existant IMX8MP_CLK_AUDIOMIX_PDM_ROOT clock - Fix error handling in i.MX8MQ clock driver - Allow a different LCDIF1 clock parent if DT describes it for i.MX6SX - Keep the SCU resource table sorted in the i.MX8DXL rsrc driver - Move the elcdif PLL clock registration above lcd_clk, as it is its parent - Correct some ENET specific clocks for i.MX8DXL platform - Drop the VPU_UART and VPUCORE from i.MX8QM as latest HW revision doesn't have them - Remove "de-featured" MLB support from i.MX8QM/QXP/DXL platforms - Skip registering clocks owned by Cortex-A partition SCU-based platforms - Add CAN_1/2 to i.MX8QM and M4_0, PI_0_PWM_0 and PI_0_I2C_0 to i.MX8QXP resources" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (128 commits) clk: Fix clk gate kunit test on big-endian CPUs clk: si521xx: Increase stack based print buffer size in probe clk: mediatek: fix double free in mtk_clk_register_pllfh() clk: socfpga: agilex: Add bounds-checking coverage for struct stratix10_clock_data clk: socfpga: Fix undefined behavior bug in struct stratix10_clock_data clk: sifive: Allow building the driver as a module clk: analogbits: Allow building the library as a module clk: sprd: Composite driver support offset config clk: Allow phase adjustment from debugfs clk: Show active consumers of clocks in debugfs clk: Use device_get_match_data() clk: visconti: Add bounds-checking coverage for struct visconti_pll_provider clk: visconti: Fix undefined behavior bug in struct visconti_pll_provider clk: cdce925: Extend match support for OF tables clk: si570: Simplify probe clk: si5351: Simplify probe clk: rs9: Use i2c_get_match_data() instead of device_get_match_data() clk: clk-si544: Simplify probe() and is_valid_frequency() clk: si521xx: Use i2c_get_match_data() instead of device_get_match_data() clk: meson: S4: select CONFIG_COMMON_CLK_MESON_CLKC_UTILS ... commit c52894359395ea0a562b3ed556848ed66fbfff86 Merge: 59fff63cc2b7 fc62d5e214df Author: Linus Torvalds Date: Tue Oct 31 18:32:51 2023 -1000 Merge tag 'for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux Pull hte/timestamp updates from Dipen Patel: - Improve comments in the translate function - Reflect the GPIOLIB API changes during calculation of the GPIO base - Improve error handling in Tegra test and provider drivers - Improve code to set the line name * tag 'for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux: hte: Use kasprintf() instead of fixed buffer formatting hte: tegra: Fix missing error code in tegra_hte_test_probe() hte: tegra194: Switch to LATE_SIMPLE_DEV_PM_OPS() hte: tegra194: Remove redundant dev_err() hte: tegra194: improve the GPIO-related comment hte: allow building modules with COMPILE_TEST enabled hte: Annotate struct hte_device with __counted_by commit 59fff63cc2b75dcfe08f9eeb4b2187d73e53843d Merge: 3475b91ff258 94ace9eda882 Author: Linus Torvalds Date: Tue Oct 31 17:53:00 2023 -1000 Merge tag 'platform-drivers-x86-v6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Ilpo Järvinen: - asus-wmi: Support for screenpad and solve brightness key press duplication - int3472: Eliminate the last use of deprecated GPIO functions - mlxbf-pmc: New HW support - msi-ec: Support new EC configurations - thinkpad_acpi: Support reading aux MAC address during passthrough - wmi: Fixes & improvements - x86-android-tablets: Detection fix and avoid use of GPIO private APIs - Debug & metrics interface improvements - Miscellaneous cleanups / fixes / improvements * tag 'platform-drivers-x86-v6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (80 commits) platform/x86: inspur-platform-profile: Add platform profile support platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e platform/x86: wmi: Decouple WMI device removal from wmi_block_list platform/x86: wmi: Fix opening of char device platform/x86: wmi: Fix probe failure when failing to register WMI devices platform/x86: wmi: Fix refcounting of WMI devices in legacy functions platform/x86: wmi: Decouple probe deferring from wmi_block_list platform/x86/amd/hsmp: Fix iomem handling platform/x86: asus-wmi: Do not report brightness up/down keys when also reported by acpi_video platform/x86: thinkpad_acpi: replace deprecated strncpy with memcpy tools/power/x86/intel-speed-select: v1.18 release tools/power/x86/intel-speed-select: Use cgroup isolate for CPU 0 tools/power/x86/intel-speed-select: Increase max CPUs in one request tools/power/x86/intel-speed-select: Display error for core-power support tools/power/x86/intel-speed-select: No TRL for non compute domains tools/power/x86/intel-speed-select: turbo-mode enable disable swapped tools/power/x86/intel-speed-select: Update help for TRL tools/power/x86/intel-speed-select: Sanitize integer arguments platform/x86: acer-wmi: Remove void function return platform/x86/amd/pmc: Add dump_custom_stb module parameter ... commit 3475b91ff258b998b891964e8c263cff48384c01 Merge: f9a7eda4d73d 47ea0ddb1f56 Author: Linus Torvalds Date: Tue Oct 31 17:47:40 2023 -1000 Merge tag 'tag-chrome-platform-for-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Tzung-Bi Shih: "Improvements: - Annotate flexible array members with __counted_by - Convert platform drivers' .remove callbacks to return void Fixes: - Avoid MKBP event timeouts by disabling/enabling IRQ later/earlier Misc: - Minor cleanups and fixes" * tag 'tag-chrome-platform-for-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: (21 commits) platform/chrome: cros_ec_lpc: Separate host command and irq disable platform/chrome: kunit: make EC protocol tests independent platform/chrome: kunit: initialize lock for fake ec_dev platform/chrome: cros_ec: fix compilation warning platform/chrome: cros_ec_proto: Mark outdata as const platform/chrome: cros_typec_vdm: Mark port_amode_ops const platform/chrome: cros_ec_typec: Use dev_err_probe() more platform/chrome: cros_ec_typec: Use semi-colons instead of commas platform/chrome/wilco_ec: telemetry: Convert to platform remove callback returning void platform/chrome/wilco_ec: debugfs: Convert to platform remove callback returning void platform/chrome/wilco_ec: core: Convert to platform remove callback returning void platform/chrome: cros_usbpd_notify: Convert to platform remove callback returning void platform/chrome: cros_usbpd_logger: Convert to platform remove callback returning void platform/chrome: cros_typec_switch: Convert to platform remove callback returning void platform/chrome: cros_ec_vbc: Convert to platform remove callback returning void platform/chrome: cros_ec_sysfs: Convert to platform remove callback returning void platform/chrome: cros_ec_lpc: Convert to platform remove callback returning void platform/chrome: cros_ec_lightbar: Convert to platform remove callback returning void platform/chrome: cros_ec_debugfs: Convert to platform remove callback returning void platform/chrome: cros_ec_chardev: Convert to platform remove callback returning void ... commit f9a7eda4d73d44dc1d17d05cdc9aeb9fc5660740 Merge: 34aac0a33de2 0f564130e5c7 Author: Linus Torvalds Date: Tue Oct 31 17:44:17 2023 -1000 Merge tag 'hwmon-for-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "New drivers: - Driver for LTC2991 - Driver for POWER-Z Added chip / system support to existing drivers: - The ina238 driver now also supports INA237 - The asus-ec-sensors driver now supports ROG Crosshair X670E Gene - The aquacomputer_d5next now supports Aquacomputer High Flow USB and MPS Flow - The pmbus/mpq7932 driver now also supports MPQ2286 - The nct6683 now also supports ASRock X670E Taichi Various other minor improvements and fixes: - One patch series to call out is the conversion of hwmon platform drivers to use the platform remove callback returning void" * tag 'hwmon-for-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (69 commits) hwmon: (aquacomputer_d5next) Check if temp sensors of legacy devices are connected hwmon: (aquacomputer_d5next) Add support for Aquacomputer High Flow USB and MPS Flow dt-bindings: hwmon: npcm: Add npcm845 compatible string hwmon: Add driver for ltc2991 dt-bindings: hwmon: ltc2991: add bindings hwmon: (pmbus/max31785) Add delay between bus accesses hwmon: (ina238) add ina237 support dt-bindings: hwmon: ti,ina2xx: add ti,ina237 hwmon: (asus-ec-sensors) add ROG Crosshair X670E Gene. hwmon: (max31827) handle vref regulator hwmon: (ina3221) Add support for channel summation disable dt-bindings: hwmon: ina3221: Add ti,summation-disable dt-bindings: hwmon: ina3221: Convert to json-schema hwmon: (pmbus/mpq7932) Add a support for mpq2286 Power Management IC hwmon: (pmbus/core) Add helper macro to define single pmbus regulator regulator: dt-bindings: Add mps,mpq2286 power-management IC hwmon: (pmbus/mpq7932) Get page count based on chip info dt-bindings: hwmon: Add possible new properties to max31827 bindings hwmon: (max31827) Modify conversion wait time hwmon: (max31827) Make code cleaner ... commit 34aac0a33de21ec6e03b689342c0933a4989fbc2 Merge: 9d6c80f8054f 1b2e883e1af8 Author: Linus Torvalds Date: Tue Oct 31 17:40:35 2023 -1000 Merge tag 'spi-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "This is a very quiet release for SPI, we've got cleanups and minor fixes but only a few new driver specific features. The bulk of the changes in terms of diffstat are the cleanups, plus one bit of performance work for McSPI. - Conversions to use devm_clk_get_enabled() and to remove outdated terms for controller and device - Device mode support for the Renesas CSI - Cleanups and improvements to the device tree bindings aimed at making validation better - PIO FIFO usage for the OMAP2 McSPI, improving performance" * tag 'spi-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (75 commits) spi: omap2-mcspi: Add FIFO support without DMA spi: stm32: Explicitly include correct DT includes spi: Export acpi_spi_find_controller_by_adev() spi: nxp-fspi: use the correct ioremap function spi: Don't use flexible array in struct spi_message definition spi: bcm2835: add a sentinel at the end of the lookup array spi: spi-geni-qcom: Rename the label unmap_if_dma spi: rzv2m-csi: Add target mode support spi: renesas,rzv2m-csi: Add CSI (SPI) target related property spi: spidev: make spidev_class constant spi: mpc52xx-psc: Make mpc52xx_psc_spi_transfer_one_message() static spi: spi-cadence-quadspi: Fix missing unwind goto warnings spi: omap2-mcspi: Fix hardcoded reference clock spi: dt-bindings: Make "additionalProperties: true" explicit spi: at91-usart: Remove some dead code spi: dt-bindings: st,stm32-spi: Move "st,spi-midi-ns" to spi-peripheral-props.yaml spi: qup: Vote for interconnect bandwidth to DRAM spi: dt-bindings: qup: Document interconnects spi: qup: Parse OPP table for DVFS support spi: dt-bindings: qup: Document power-domains and OPP ... commit 9d6c80f8054f75326939b947185ec47ba3755d42 Merge: 5cbff4b2d9e2 3e0569ff8126 Author: Linus Torvalds Date: Tue Oct 31 17:33:21 2023 -1000 Merge tag 'regulator-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "This has been a fairly quiet release for the regulator API, the changes are dominated by some new drivers and a quite large set of cleanups and filling in the blanks of features for the existing MT6358 driver. - Cleanups and additional features for the Mediatek MT6358 driver - Under voltage detection in the fixed regulator - Support for Maxim MAX77503, Mediatek MT6366, Qualcomm PM8909, PM8919, PMA8048 and PMC8380" * tag 'regulator-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (45 commits) regulator (max5970): Remove duplicate line regulator (max5970): Add hwmon support regulator: qcom-rpmh: Fix smps4 regulator for pm8550ve regulator: qcom,rpmh: Add PMC8380 compatible regulator: qcom-rpmh: Add regulators support for PMC8380 regulator: fixed: add support for under-voltage IRQ regulator: dt-bindings: fixed-regulator: Add under-voltage interrupt support dt-bindings: regulator: dlg,da9210: Convert to json-schema regulator: dt-bindings: Add ADI MAX77503 support regulator: max77503: Add ADI MAX77503 support regulator: Use device_get_match_data() regulator: da9121: Use i2c_get_match_data() regulator: Drop unnecessary of_match_device() calls regulator: da9063: Annotate struct da9063_regulators with __counted_by regulator: da9062: Annotate struct da9062_regulators with __counted_by regulator: mt6358: Add supply names for MT6366 regulators regulator: mt6358: Add missing regulators for MT6366 regulator: mt6358: Make MT6366 vcn18 LDO configurable regulator: mt6358: fix and drop type prefix in MT6366 regulator node names regulator: mt6358: Add supply names for MT6358 regulators ... commit 5cbff4b2d9e2a59f4096af8b8f967e2b30f025f2 Merge: b05ddad00903 6bbebcc11a69 Author: Linus Torvalds Date: Tue Oct 31 17:28:48 2023 -1000 Merge tag 'regmap-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "The main change here is a fix for an issue where we were letting the selector for windowed register ranges get out of sync with the hardware during a cache sync plus associated KUnit tests. This was reported just at the end of the release cycle and only in -next for a day prior to the merge window so it seemed better to hold off for now, the bug had been present for more than a decade so wasn't causing too many practical problems hopefully. There's also a fix for error handling in the debugfs output from Christope Jaillet" * tag 'regmap-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: Ensure range selector registers are updated after cache sync regmap: kunit: Add test for cache sync interaction with ranges regmap: kunit: Fix marking of the range window as volatile regmap: debugfs: Fix a erroneous check after snprintf() commit b05ddad00903b24931cb4b45516f1bc1b5c288f2 Merge: ad1871ad8d9b 9bc633117d6a Author: Linus Torvalds Date: Tue Oct 31 17:21:54 2023 -1000 Merge tag 'gpio-updates-for-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "We don't have any new drivers. The loongson driver is getting extended with support for new models. There's a big refactor of gpio-pca953x and many small improvements to others. The GPIO code in the kernel has acquired a lot of cruft over the years as well as many abusers of the API across the kernel tree. This release cycle we have started a major cleanup and improvement effort that will most likely span several releases. We have started by converting external users of struct gpio_chip to accessing the wrapper around it - struct gpio_device. This is because the latter is reference counted while the former is removed when the provider is unbound. We also removed several instances of drivers accessing private GPIOLIB structures and including the private header from drivers/gpio/. To that end you'll see several commits aimed at different subsystems (acked by relevant maintainers) as well as two merges from the x86/platform tree. We'll then rework the locking in GPIOLIB which currently uses a big spinlock for many different things and could use becoming more fine-grained, especially as it doesn't even get the locking right. We'll also use SRCU for protecting the gpio_chip pointer against in-kernel hot-unplug crashes similar to what we saw triggered from user-space and fixed with semaphores in gpiolib-cdev. The core GPIOLIB is still vulnerable to these use-cases. I'm just mentioning the plans here, this is not part of this PR. You'll see some new instances of using __free(). We've added a gpio_device_put cleanup helper similar to the put_device one introduced by Peter Zijlstra and used it according to the preferred pattern except where it didn't make sense. GPIOLIB core: - provide interfaces allowing users to retrieve, manage and query the reference counted GPIO device instead of accessing the private gpio_chip structure - replace gpiochip_find() with gpio_device_find() - remove unused acpi_get_and_request_gpiod() - improve the ignore_interrupt functionality in GPIO ACPI - correct notifier return codes in gpiolib-of - unexport gpiod_set_transitory() as it's unused outside of core GPIO code - while there are still external users accessing struct gpio_chip, let's make gpiochip_get_desc() public so that they at least use the preferred helper - improve locking for lookup tables - annotate struct linereq with __counted_by - improve GPIOLIB docs - add an OF quirk for LED trigger sources Driver improvements: - convert all GPIO drivers with .remove() callbacks to using the new variant returning void instead of int - stop accessing the GPIOLIB private structures in gpio-mockup, i2c-mux-gpio, hte-tegra194, gpio-sim - use the recommended pattern for autofree variables in gpio-sim - add support for more models to gpio-loongson - use a notifier chain to notify other blocks about interrupts in gpio-eic-sprd instead of looking up GPIO devices on every interrupt - convert gpio-pca953x and gpio-fx6408 to using the maple tree regmap cache - don't include GPIOLIB internal headers in drivers which don't need them - move the ingenic NAND quirk into gpiolib-of - add an ignore interrupt quirk for Peaq C1010 - drop static GPIO base from gpio-omap, gpio-f7188x - use the preferred device_get_match_data() function in drivers that still don't - refactor gpio-pca953x: switch to using DEFINE_SIMPLE_DEV_PM_OPS(), use cleanup helpers, use dev_err_probe() where it makes sense, fully convert to using devres and some other minor tweaks DT bindings: - add support for a new model to gpio-vf610 and update existing properties - add support for more loongson models - add missing support for imx models that are used but undocumented - convert bindings for Intel IXP4xx to schema Minor stuff: - deprecate gpio-mockup in favor of gpio-sim - include missing headers here and there - stop using gpiochip_find() in OMAP1 board files - minor tweaks in gpio-vf610, gpio-hisi - remove unneeded 'extern' specifiers from headers" * tag 'gpio-updates-for-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (108 commits) hte: tegra194: add GPIOLIB dependency hte: tegra194: don't access struct gpio_chip gpiolib: provide gpio_device_get_base() i2c: mux: gpio: don't fiddle with GPIOLIB internals gpiolib: provide gpiod_to_gpio_device() gpiolib: provide gpio_device_to_device() gpio: hisi: Fix format specifier gpiolib: provide gpio_device_find_by_fwnode() gpio: acpi: remove acpi_get_and_request_gpiod() gpio: Use device_get_match_data() gpio: vf610: update comment for i.MX8ULP and i.MX93 legacy compatibles platform/x86: int3472: Switch to devm_get_gpiod() platform/x86: int3472: Stop using gpiod_toggle_active_low() platform/x86: int3472: Add new skl_int3472_gpiod_get_from_temp_lookup() helper platform/x86: int3472: Add new skl_int3472_fill_gpiod_lookup() helper gpio: vf610: simplify code by dropping data check gpio: vf610: add i.MX8ULP of_device_id entry dt-bindings: gpio: vf610: add i.MX95 compatible dt-bindings: gpio: vf610: correct i.MX8ULP and i.MX93 dt-bindings: gpio: vf610: update gpio-ranges ... commit a6bdc082ad1c91d389a6ba0c7a1945818f732114 Merge: ffc253263a13 99c9991f4e5d Author: Huacai Chen Date: Wed Nov 1 10:55:00 2023 +0800 Merge 'bpf-next 2023-10-16' into loongarch-next LoongArch architecture changes for 6.7 (BPF CPU v4 support) depend on the bpf changes to fix conflictions in selftests and work, so merge them to create a base. commit b8c2f6617fd734e6cf265b3b38383f16e47d2037 Merge: 87615e95f6f9 2960f371f165 Author: Palmer Dabbelt Date: Thu Oct 26 09:40:36 2023 -0700 Merge patch series "RISC-V: ACPI improvements" Sunil V L says: This series is a set of patches which were originally part of RFC v1 series [1] to add ACPI support in RISC-V interrupt controllers. Since these patches are independent of the interrupt controllers, creating this new series which helps to merge instead of waiting for big series. This set of patches primarily adds support below ECR [2] which is approved by the ASWG and adds below features. - Get CBO block sizes from RHCT on ACPI based systems. Additionally, the series contains a patch to improve acpi_os_ioremap(). [1] - https://lore.kernel.org/lkml/20230803175202.3173957-1-sunilvl@ventanamicro.com/ [2] - https://drive.google.com/file/d/1sKbOa8m1UZw1JkquZYe3F1zQBN1xXsaf/view?usp=sharing * b4-shazam-merge: RISC-V: cacheflush: Initialize CBO variables on ACPI systems RISC-V: ACPI: RHCT: Add function to get CBO block sizes RISC-V: ACPI: Update the return value of acpi_get_rhct() RISC-V: ACPI: Enhance acpi_os_ioremap with MMIO remapping Link: https://lore.kernel.org/r/20231018124007.1306159-1-sunilvl@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 87615e95f6f9ccd36d4a3905a2d87f91967ea9d2 Author: Nam Cao Date: Mon Aug 21 16:57:09 2023 +0200 riscv: put interrupt entries into .irqentry.text The interrupt entries are expected to be in the .irqentry.text section. For example, for kprobes to work properly, exception code cannot be probed; this is ensured by blacklisting addresses in the .irqentry.text section. Fixes: 7db91e57a0ac ("RISC-V: Task implementation") Signed-off-by: Nam Cao Link: https://lore.kernel.org/r/20230821145708.21270-1-namcaov@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt arch/riscv/kernel/entry.S | 2 ++ 1 file changed, 2 insertions(+) commit 559fe94a449cba5b50a7cffea60474b385598c00 Author: Song Shuai Date: Wed Aug 9 11:10:23 2023 +0800 riscv: mm: Update the comment of CONFIG_PAGE_OFFSET Since the commit 011f09d12052 set sv57 as default for CONFIG_64BIT, the comment of CONFIG_PAGE_OFFSET should be updated too. Fixes: 011f09d12052 ("riscv: mm: Set sv57 on defaultly") Signed-off-by: Song Shuai Link: https://lore.kernel.org/r/20230809031023.3575407-1-songshuaishuai@tinylab.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/page.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit dd16ac404a685cce07e67261a94c6225d90ea7ba Author: Minda Chen Date: Wed Aug 2 14:42:15 2023 +0800 riscv: Using TOOLCHAIN_HAS_ZIHINTPAUSE marco replace zihintpause Actually it is a part of Conor's commit aae538cd03bc ("riscv: fix detection of toolchain Zihintpause support"). It is looks like a merge issue. Samuel's commit 0b1d60d6dd9e ("riscv: Fix build with CONFIG_CC_OPTIMIZE_FOR_SIZE=y") do not base on Conor's commit and revert to __riscv_zihintpause. So this patch can fix it. Signed-off-by: Minda Chen Fixes: 3c349eacc559 ("Merge patch "riscv: Fix build with CONFIG_CC_OPTIMIZE_FOR_SIZE=y"") Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230802064215.31111-1-minda.chen@starfivetech.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/vdso/processor.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 92235d3d8365d24f6cc6701b545e764ef144806a Author: Xiao Wang Date: Thu Sep 21 22:16:52 2023 +0800 riscv/mm: Fix the comment for swap pte format Swap type takes bits 7-11 and swap offset should start from bit 12. Signed-off-by: Xiao Wang Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/20230921141652.2657054-1-xiao.w.wang@intel.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/pgtable.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8f501be87e45112eff74d0569dcfaab6bce39ef5 Author: Tsukasa OI Date: Wed Jul 26 05:44:16 2023 +0000 RISC-V: clarify the QEMU workaround in ISA parser Extensions prefixed with "Su" won't corrupt the workaround in many cases. The only exception is when the first multi-letter extension in the ISA string begins with "Su" and is not prefixed with an underscore. For instance, following ISA string can confuse this QEMU workaround. * "rv64imacsuclic" (RV64I + M + A + C + "Suclic") However, this case is very unlikely because extensions prefixed by either "Z", "Sm" or "Ss" will most likely precede first. For instance, the "Suclic" extension (draft as of now) will be placed after related "Smclic" and "Ssclic" extensions. It's also highly likely that other unprivileged extensions like "Zba" will precede. It's also possible to suppress the issue in the QEMU workaround with an underscore. Following ISA string won't confuse the QEMU workaround. * "rv64imac_suclic" (RV64I + M + A + C + delimited "Suclic") This fix is to tell kernel developers the nature of this workaround precisely. There are some "Su*" extensions to be ratified but don't worry about this workaround too much. This commit comes with other minor editorial fixes (for minor wording and spacing issues, without changing the meaning). Signed-off-by: Tsukasa OI Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/8a127608cf6194a6d288289f2520bd1744b81437.1690350252.git.research_trasio@irq.a4lg.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/cpufeature.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit e59e5e2754bf983fc58ad18f99b5eec01f1a0745 Author: Song Shuai Date: Tue Aug 29 21:39:20 2023 -0700 riscv: correct pt_level name via pgtable_l5/4_enabled The pt_level uses CONFIG_PGTABLE_LEVELS to display page table names. But if page mode is downgraded from kernel cmdline or restricted by the hardware in 64BIT, it will give a wrong name. Like, using no4lvl for sv39, ptdump named the 1G-mapping as "PUD" that should be "PGD": 0xffffffd840000000-0xffffffd900000000 0x00000000c0000000 3G PUD D A G . . W R V So select "P4D/PUD" or "PGD" via pgtable_l5/4_enabled to correct it. Fixes: e8a62cc26ddf ("riscv: Implement sv48 support") Reviewed-by: Alexandre Ghiti Signed-off-by: Song Shuai Link: https://lore.kernel.org/r/20230712115740.943324-1-suagrfillet@gmail.com Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230830044129.11481-3-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/mm/ptdump.c | 3 +++ 1 file changed, 3 insertions(+) commit 10128f8b1663a8bce27df051c750d116bb8cd737 Author: Palmer Dabbelt Date: Tue Aug 29 21:39:19 2023 -0700 RISC-V: Provide pgtable_l5_enabled on rv32 A few of the other page table level helpers are defined on rv32, but not pgtable_l5_enabled. This adds the definition as a constant and converts pgtable_l4_enabled to a constant as well. Link: https://lore.kernel.org/r/20230830044129.11481-2-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/pgtable-32.h | 3 +++ arch/riscv/include/asm/pgtable.h | 1 - arch/riscv/mm/init.c | 2 ++ 3 files changed, 5 insertions(+), 1 deletion(-) commit 60c46877e9cd4f7fd13fa844258f60cca4eb3e34 Author: Anup Patel Date: Mon Jul 10 18:49:02 2023 +0530 clocksource: timer-riscv: Increase rating of clock_event_device for Sstc When Sstc is available the RISC-V timer clock_event_device should be the preferred clock_event_device hence we increase clock_event_device rating for Sstc. Signed-off-by: Anup Patel Reviewed-by: Conor Dooley Acked-by: Palmer Dabbelt Link: https://lore.kernel.org/r/20230710131902.1459180-3-apatel@ventanamicro.com Signed-off-by: Palmer Dabbelt drivers/clocksource/timer-riscv.c | 2 ++ 1 file changed, 2 insertions(+) commit 5d98446f03c622cb917e15a5561601587c64aab2 Author: Anup Patel Date: Mon Jul 10 18:49:01 2023 +0530 clocksource: timer-riscv: Don't enable/disable timer interrupt Currently, we enable/disable timer interrupt at runtime to start/stop timer events. This makes timer interrupt state go out-of-sync with the Linux interrupt subsystem. To address the above issue, we can stop a per-HART timer interrupt by setting U64_MAX in timecmp CSR (or sbi_set_timer()) at the time of handling timer interrupt. Signed-off-by: Anup Patel Reviewed-by: Conor Dooley Acked-by: Palmer Dabbelt Link: https://lore.kernel.org/r/20230710131902.1459180-2-apatel@ventanamicro.com Signed-off-by: Palmer Dabbelt drivers/clocksource/timer-riscv.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit a9429d5f99bc25885ba5d4c2c58a25467f5d741b Merge: 71e11d066c1d a29e2a48afe3 Author: Palmer Dabbelt Date: Thu Sep 21 04:22:30 2023 -0700 Merge patch series "RISC-V: Enable cbo.zero in usermode" Andrew Jones says: In order for usermode to issue cbo.zero, it needs privilege granted to issue the extension instruction (patch 2) and to know that the extension is available and its block size (patch 3). Patch 1 could be separate from this series (it just fixes up some error messages), patches 4-5 convert the hwprobe selftest to a statically-linked, TAP test and patch 6 adds a new hwprobe test for the new information as well as testing CBO instructions can or cannot be issued as appropriate. * b4-shazam-merge: RISC-V: selftests: Add CBO tests RISC-V: selftests: Convert hwprobe test to kselftest API RISC-V: selftests: Statically link hwprobe test RISC-V: hwprobe: Expose Zicboz extension and its block size RISC-V: Enable cbo.zero in usermode RISC-V: Make zicbom/zicboz errors consistent Link: https://lore.kernel.org/r/20230918131518.56803-8-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 71e11d066c1db20f85240d248cd8c3c6ae8bd7d7 Merge: 0bb80ecc33a8 0f5f46a869a5 Author: Palmer Dabbelt Date: Tue Oct 31 19:15:41 2023 -0700 Merge patch series "riscv: kexec: cleanup and fixups" Song Shuai says: This series contains a cleanup for riscv_kexec_relocate() and two fixups for KEXEC_FILE and had passed the basic kexec test in my 64bit Qemu-virt. You can use this kexec-tools[3] to test the kexec-file-syscall and these patches. riscv: kexec: Cleanup riscv_kexec_relocate (patch1) ================================================== For readability and simplicity, cleanup the riscv_kexec_relocate code: - Re-sort the first 4 `mv` instructions against `riscv_kexec_method()` - Eliminate registers for debugging (s9,s10,s11) and storing const-value (s5,s6) - Replace `jalr` with `jr` for no-link jump riscv: kexec: Align the kexeced kernel entry (patch2) ================================================== The current riscv boot protocol requires 2MB alignment for RV64 and 4MB alignment for RV32. In KEXEC_FILE path, the elf_find_pbase() function should align the kexeced kernel entry according to the requirement, otherwise the kexeced kernel would silently BUG at the setup_vm(). riscv: kexec: Remove -fPIE for PURGATORY_CFLAGS (patch3) ================================================== With CONFIG_RELOCATABLE enabled, KBUILD_CFLAGS had a -fPIE option and then the purgatory/string.o was built to reference _ctype symbol via R_RISCV_GOT_HI20 relocations which can't be handled by purgatory. As a consequence, the kernel failed kexec_load_file() with: [ 880.386562] kexec_image: The entry point of kernel at 0x80200000 [ 880.388650] kexec_image: Unknown rela relocation: 20 [ 880.389173] kexec_image: Error loading purgatory ret=-8 So remove the -fPIE option for PURGATORY_CFLAGS to generate R_RISCV_PCREL_HI20 relocations type making puragtory work as it was. arch/riscv/kernel/elf_kexec.c | 8 ++++- arch/riscv/kernel/kexec_relocate.S | 52 +++++++++++++----------------- arch/riscv/purgatory/Makefile | 4 +++ 3 files changed, 34 insertions(+), 30 deletions(-) * b4-shazam-merge: riscv: kexec: Remove -fPIE for PURGATORY_CFLAGS riscv: kexec: Align the kexeced kernel entry riscv: kexec: Cleanup riscv_kexec_relocate Link: https://lore.kernel.org/r/20230907103304.590739-1-songshuaishuai@tinylab.org Signed-off-by: Palmer Dabbelt commit ad1871ad8d9b3d252390ade8e2bcab7b773173ad Merge: d4b671d4c66c bf224871c27a Author: Linus Torvalds Date: Tue Oct 31 15:38:12 2023 -1000 Merge tag 'pm-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "These add new hardware support (new Qualcomm SoC versions in cpufreq, RK3568/RK3588 in devfreq), extend the OPP (operating performance points) framework, improve cpufreq governors, fix issues and clean up code (most of the changes are in cpufreq and devfreq). Specifics: - Add support for several Qualcomm SoC versions and other similar changes (Christian Marangi, Dmitry Baryshkov, Luca Weiss, Neil Armstrong, Richard Acayan, Robert Marko, Rohit Agarwal, Stephan Gerhold and Varadarajan Narayanan) - Clean up the tegra cpufreq driver (Sumit Gupta) - Use of_property_read_reg() to parse "reg" in pmac32 driver (Rob Herring) - Add support for TI's am62p5 Soc (Bryan Brattlof) - Make ARM_BRCMSTB_AVS_CPUFREQ depends on !ARM_SCMI_CPUFREQ (Florian Fainelli) - Update Kconfig to mention i.MX7 as well (Alexander Stein) - Revise global turbo disable check in intel_pstate (Srinivas Pandruvada) - Carry out initialization of sg_cpu in the schedutil cpufreq governor in one loop (Liao Chang) - Simplify the condition for storing 'down_threshold' in the conservative cpufreq governor (Liao Chang) - Use fine-grained mutex in the userspace cpufreq governor (Liao Chang) - Move is_managed indicator in the userspace cpufreq governor into a per-policy structure (Liao Chang) - Rebuild sched-domains when removing cpufreq driver (Pierre Gondois) - Fix buffer overflow detection in trans_stats() (Christian Marangi) - Switch to dev_pm_opp_find_freq_(ceil/floor)_indexed() APIs to support specific devices like UFS which handle multiple clocks through OPP (Operating Performance Point) framework (Manivannan Sadhasivam) - Add perf support to the Rockchip DFI (DDR Monitor Module) devfreq- event driver: * Generalize rockchip-dfi.c to support new RK3568/RK3588 using different DDR type (Sascha Hauer). * Convert DT binding document format to yaml (Sascha Hauer). * Add perf support for DFI (a unit suitable for measuring DDR utilization) to rockchip-dfi.c to extend DFI usage (Sascha Hauer) - Add locking to the OPP handling code in the Mediatek CCI devfreq driver, because the voltage of shared OPP might be changed by multiple drivers (Mark Tseng, Dan Carpenter) - Use device_get_match_data() in the Samsung Exynos PPMU devfreq-event driver (Rob Herring) - Extend support for the opp-level beyond required-opps (Ulf Hansson) - Add dev_pm_opp_find_level_floor() (Krishna chaitanya chundru) - dt-bindings: Allow opp-peak-kBpsfor kryo CPUs, support Qualcomm Krait SoCs and document named opp-microvolt property (Bjorn Andersson, Dmitry Baryshkov and Christian Marangi) - Fix -Wunsequenced warning _of_add_opp_table_v1() (Nathan Chancellor) - General cleanup of OPP code (Viresh Kumar) - Use __get_safe_page() rather than touching the list in hibernation snapshot code (Brian Geffon) - Fix symbol export for _SIMPLE_ variants of _PM_OPS() (Raag Jadav) - Clean up sync_read handling in snapshot_write_next() (Brian Geffon) - Fix kerneldoc comments for swsusp_check() and swsusp_close() to better match code (Christoph Hellwig) - Downgrade BIOS locked limits pr_warn() in the Intel RAPL power capping driver to pr_debug() (Ville Syrjälä) - Change the minimum python version for the intel_pstate_tracer utility from 2.7 to 3.6 (Doug Smythies)" * tag 'pm-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (82 commits) dt-bindings: cpufreq: qcom-hw: document SM8650 CPUFREQ Hardware cpufreq: arm: Kconfig: Add i.MX7 to supported SoC for ARM_IMX_CPUFREQ_DT cpufreq: qcom-nvmem: add support for IPQ8064 cpufreq: qcom-nvmem: also accept operating-points-v2-krait-cpu cpufreq: qcom-nvmem: drop pvs_ver for format a fuses dt-bindings: cpufreq: qcom-cpufreq-nvmem: Document krait-cpu cpufreq: qcom-nvmem: add support for IPQ6018 dt-bindings: cpufreq: qcom-cpufreq-nvmem: document IPQ6018 cpufreq: qcom-nvmem: Add MSM8909 cpufreq: qcom-nvmem: Simplify driver data allocation powercap: intel_rapl: Downgrade BIOS locked limits pr_warn() to pr_debug() cpufreq: stats: Fix buffer overflow detection in trans_stats() dt-bindings: devfreq: event: rockchip,dfi: Add rk3588 support dt-bindings: devfreq: event: rockchip,dfi: Add rk3568 support dt-bindings: devfreq: event: convert Rockchip DFI binding to yaml PM / devfreq: rockchip-dfi: add support for RK3588 PM / devfreq: rockchip-dfi: account for multiple DDRMON_CTRL registers PM / devfreq: rockchip-dfi: make register stride SoC specific PM / devfreq: rockchip-dfi: Add perf support PM / devfreq: rockchip-dfi: give variable a better name ... commit d4b671d4c66cd57ccebeae659d9b18e28a4fc9e8 Merge: 4ac4677fdb76 f4cb34a75e4a Author: Linus Torvalds Date: Tue Oct 31 15:33:26 2023 -1000 Merge tag 'acpi-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These fix issues, add new quirks, rearrange the IRQ override quirk definitions, add new helpers and switch over code to using them, rework a couple of interfaces to be more flexible, eliminate strncpy() usage from PNP, extend the ACPI PCC mailbox driver and clean up code. This is based on ACPI thermal driver changes that are present in the thermal control updates for 6.7-rc1 pull request (they are depended on by the ACPI utilities updates). However, the ACPI thermal driver changes are not included in the list of specific ACPI changes below. Specifics: - Add symbol definitions related to CDAT to the ACPICA code (Dave Jiang) - Use the acpi_device_is_present() helper in more places and rename acpi_scan_device_not_present() to be about enumeration (James Morse) - Add __printf format attribute to acpi_os_vprintf() (Su Hui) - Clean up departures from kernel coding style in the low-level interface for ACPICA (Jonathan Bergh) - Replace strncpy() with strscpy() in acpi_osi_setup() (Justin Stitt) - Fail FPDT parsing on zero length records and add proper handling for fpdt_process_subtable() to acpi_init_fpdt() (Vasily Khoruzhick) - Rework acpi_handle_list handling so as to manage it dynamically, including size computation (Rafael Wysocki) - Clean up ACPI utilities code so as to make it follow the kernel coding style (Jonathan Bergh) - Consolidate IRQ trigger-type override DMI tables and drop .ident values from dmi_system_id tables used for ACPI resources management quirks (Hans de Goede) - Add ACPI IRQ override for TongFang GMxXGxx (Werner Sembach) - Allow _DSD buffer data only for byte accessors and document the _DSD data buffer GUID (Andy Shevchenko) - Drop BayTrail and Lynxpoint pinctrl device IDs from the ACPI LPSS driver, because it does not need them (Raag Jadav) - Add acpi_backlight=vendor quirk for Toshiba Portégé R100 (Ondrej Zary) - Add "vendor" backlight quirks for 3 Lenovo x86 Android tablets (Hans de Goede) - Move Xiaomi Mi Pad 2 backlight quirk to its own section (Hans de Goede) - Annotate struct prm_module_info with __counted_by (Kees Cook) - Fix AER info corruption in aer_recover_queue() when error status data has multiple sections (Shiju Jose) - Make APEI use ERST maximum execution time for slow devices (Jeshua Smith) - Add support for platform notification handling to the PCC mailbox driver and modify it to support shared interrupts for multiple subspaces (Huisong Li) - Define common macros to use when referring to various bitfields in the PCC generic communications channel command and status fields and use them in some drivers (Sudeep Holla) - Add EC GPE detection quirk for HP 250 G7 Notebook PC (Jonathan Denose) - Fix and clean up create_pnp_modalias() and create_of_modalias() (Christophe JAILLET) - Modify 2 pieces of code to use acpi_evaluate_dsm_typed() (Andy Shevchenko) - Define acpi_dev_uid_match() for matching _UID and use it in several places (Raag Jadav) - Use acpi_device_uid() for fetching _UID in 2 places (Raag Jadav) - Add context argument to acpi_dev_install_notify_handler() (Rafael Wysocki) - Clarify ACPI bus concepts in the ACPI device enumeration documentation (Rafael Wysocki) - Switch over the ACPI AC and ACPI PAD drivers to using the platform driver interface which, is more logically consistent than binding a driver directly to an ACPI device object, and clean them up (Michal Wilczynski) - Replace strncpy() in the PNP code with either memcpy() or strscpy() as appropriate (Justin Stitt) - Clean up coding style in pnp.h (GuoHua Cheng)" * tag 'acpi-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (54 commits) ACPI: resource: Do IRQ override on TongFang GMxXGxx perf: arm_cspmu: use acpi_dev_hid_uid_match() for matching _HID and _UID ACPI: EC: Add quirk for HP 250 G7 Notebook PC ACPI: x86: use acpi_dev_uid_match() for matching _UID ACPI: utils: use acpi_dev_uid_match() for matching _UID pinctrl: intel: use acpi_dev_uid_match() for matching _UID ACPI: utils: Introduce acpi_dev_uid_match() for matching _UID ACPI: sysfs: Clean up create_pnp_modalias() and create_of_modalias() ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() ACPI: acpi_pad: Rename ACPI device from device to adev ACPI: acpi_pad: Use dev groups for sysfs ACPI: acpi_pad: Replace acpi_driver with platform_driver ACPI: APEI: Use ERST timeout for slow devices ACPI: scan: Rename acpi_scan_device_not_present() to be about enumeration PNP: replace deprecated strncpy() with memcpy() PNP: ACPI: replace deprecated strncpy() with strscpy() perf: qcom: use acpi_device_uid() for fetching _UID ACPI: sysfs: use acpi_device_uid() for fetching _UID ACPI: scan: Use the acpi_device_is_present() helper in more places ACPI: AC: Rename ACPI device from device to adev ... commit 4ac4677fdb76f644e09a6331bab65919b85f617d Merge: 89ed67ef126c 607218deac6e Author: Linus Torvalds Date: Tue Oct 31 15:28:37 2023 -1000 Merge tag 'thermal-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control updates from Rafael Wysocki: "These further rework the ACPI thermal driver, after the changes made to it in the previous cycle, to make it easier to grasp, get rid of redundant pieces of internal data structures and eliminate its reliance on a specific ordering of trip point objects in the thermal core, make thermal core adjustments needed for the ACPI thermal driver rework, modify the thermal governor interface so as to use trip pointers for representing trip points in it, switch over multiple thermal drivers to using void platform driver remove callbacks, add support for 2 hardware features to the Intel int340x thermal driver, add support for new hardware on ARM platforms, update documentation, fix problems, clean up code and update the MAINTAINERS record for thermal control. Specifics: - Untangle the initialization and updates of passive and active trip points in the ACPI thermal driver (Rafael Wysocki) - Reduce code duplication related to the initialization and updates of trip points in the ACPI thermal driver (Rafael Wysocki) - Use trip pointers for cooling device binding in the ACPI thermal driver (Rafael Wysocki) - Simplify critical and hot trips representation in the ACPI thermal driver (Rafael Wysocki) - Use trip pointers in thermal governors and in the related part of the thermal core (Rafael Wysocki) - Drop the trips_disabled bitmask that has become redundant from the thermal core (Rafael Wysocki) - Avoid updating trip points when the thermal zone temperature falls into a trip point's hysteresis range (ícolas F. R. A. Prado) - Add power floor notifications support to the int340x thermal control driver (Srinivas Pandruvada) - Rework updating trip points in the int340x thermal driver so that it does not access thermal zone internals directly (Rafael Wysocki) - Use param_get_byte() instead of param_get_int() as the max_idle module parameter .get() callback in the Intel powerclamp thermal driver to avoid possible out-of-bounds access (David Arcari) - Add workload hints support to the int340x thermal driver (Srinivas Pandruvada) - Add support for Mediatek LVTS MT8192 along with suspend/resume routines (Balsam Chihi) - Fix probe for THERMAL_V2 in the Mediatek LVTS driver (Markus Schneider-Pargmann) - Remove duplicate error message from the max76620 driver when thermal_of_zone_register() fails (Thierry Reding) - Add i.MX7D compatible bindings to fix a warning from dtbs_check for the imx6ul platform (Alexander Stein) - Add sa8775p compatible to the QCom tsens driver (Priyansh Jain) - Fix error check in lvts_debugfs_init() to be against PTR_ERR() in the LVTS Mediatek driver (Minjie Du) - Remove unused variable in thermal/tools (Kuan-Wei Chiu) - Document the imx8dl thermal sensor (Fabio Estevam) - Add variable names in callback prototypes to prevent warning from checkpatch.pl in the imx8mm driver (Bragatheswaran Manickavel) - Add missing unevaluatedProperties on child node schemas for tegra124 (Rob Herring) - Add mt7988 support to the Mediatek LVTS driver (Frank Wunderlich)" * tag 'thermal-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (111 commits) thermal: ACPI: Include the right header file thermal: core: Don't update trip points inside the hysteresis range thermal: core: Pass trip pointer to governor throttle callback thermal: gov_step_wise: Fold update_passive_instance() into its caller thermal: gov_power_allocator: Use trip pointers instead of trip indices thermal: gov_fair_share: Rearrange get_trip_level() thermal: trip: Define for_each_trip() macro thermal: trip: Simplify computing trip indices thermal/qcom/tsens: Drop ops_v0_1 thermal/drivers/mediatek/lvts_thermal: Update calibration data documentation thermal/drivers/mediatek/lvts_thermal: Add mt8192 support thermal/drivers/mediatek/lvts_thermal: Add suspend and resume dt-bindings: thermal: mediatek: Add LVTS thermal controller definition for mt8192 thermal/drivers/mediatek: Fix probe for THERMAL_V2 thermal/drivers/max77620: Remove duplicate error message dt-bindings: timer: add imx7d compatible dt-bindings: net: microchip: Allow nvmem-cell usage dt-bindings: imx-thermal: Add #thermal-sensor-cells property dt-bindings: thermal: tsens: Add sa8775p compatible thermal/drivers/mediatek/lvts_thermal: Fix error check in lvts_debugfs_init() ... commit 91562895f8030cb9a0470b1db49de79346a69f91 Author: Jan Kara Date: Fri Oct 13 14:13:50 2023 +0200 ext4: properly sync file size update after O_SYNC direct IO Gao Xiang has reported that on ext4 O_SYNC direct IO does not properly sync file size update and thus if we crash at unfortunate moment, the file can have smaller size although O_SYNC IO has reported successful completion. The problem happens because update of on-disk inode size is handled in ext4_dio_write_iter() *after* iomap_dio_rw() (and thus dio_complete() in particular) has returned and generic_file_sync() gets called by dio_complete(). Fix the problem by handling on-disk inode size update directly in our ->end_io completion handler. References: https://lore.kernel.org/all/02d18236-26ef-09b0-90ad-030c4fe3ee20@linux.alibaba.com Reported-by: Gao Xiang CC: stable@vger.kernel.org Fixes: 378f32bab371 ("ext4: introduce direct I/O write using iomap infrastructure") Signed-off-by: Jan Kara Tested-by: Joseph Qi Reviewed-by: "Ritesh Harjani (IBM)" Link: https://lore.kernel.org/r/20231013121350.26872-1-jack@suse.cz Signed-off-by: Theodore Ts'o fs/ext4/file.c | 153 ++++++++++++++++++++++++--------------------------------- 1 file changed, 65 insertions(+), 88 deletions(-) commit ce56d21355cd6f6937aca32f1f44ca749d1e4808 Author: Brian Foster Date: Mon Oct 2 14:50:20 2023 -0400 ext4: fix racy may inline data check in dio write syzbot reports that the following warning from ext4_iomap_begin() triggers as of the commit referenced below: if (WARN_ON_ONCE(ext4_has_inline_data(inode))) return -ERANGE; This occurs during a dio write, which is never expected to encounter an inode with inline data. To enforce this behavior, ext4_dio_write_iter() checks the current inline state of the inode and clears the MAY_INLINE_DATA state flag to either fall back to buffered writes, or enforce that any other writers in progress on the inode are not allowed to create inline data. The problem is that the check for existing inline data and the state flag can span a lock cycle. For example, if the ilock is originally locked shared and subsequently upgraded to exclusive, another writer may have reacquired the lock and created inline data before the dio write task acquires the lock and proceeds. The commit referenced below loosens the lock requirements to allow some forms of unaligned dio writes to occur under shared lock, but AFAICT the inline data check was technically already racy for any dio write that would have involved a lock cycle. Regardless, lift clearing of the state bit to the same lock critical section that checks for preexisting inline data on the inode to close the race. Cc: stable@kernel.org Reported-by: syzbot+307da6ca5cb0d01d581a@syzkaller.appspotmail.com Fixes: 310ee0902b8d ("ext4: allow concurrent unaligned dio overwrites") Signed-off-by: Brian Foster Link: https://lore.kernel.org/r/20231002185020.531537-1-bfoster@redhat.com Signed-off-by: Theodore Ts'o fs/ext4/file.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) commit 1372e73a18139d4f74731cc900085a6bf3c59daf Merge: e12f065db472 d45f72b3c275 Author: Jiri Kosina Date: Wed Nov 1 00:18:10 2023 +0100 Merge branch 'for-6.7/uclogic' into for-linus - fixes for crashes detected by CONFIG_KUNIT_ALL_TESTS in hid-uclogic driver (Jinjie Ruan) commit e12f065db4729f46bbc73afba91a1f4322fb5df3 Merge: eacaa65efaa7 91939636cac4 Author: Jiri Kosina Date: Wed Nov 1 00:17:20 2023 +0100 Merge branch 'for-6.7/selftests' into for-linus - HID selftests fixes and improvements (Benjamin Tissoires) commit eacaa65efaa70b292c174629a672916c60981059 Merge: 93cfa25b1795 81701f7132f8 Author: Jiri Kosina Date: Wed Nov 1 00:16:20 2023 +0100 Merge branch 'for-6.7/nvidia-shield' into for-linus - probe error handling path fixes in hid-nvidia-shield driver (Christophe JAILLET) commit 93cfa25b1795ec5f47fdba2241acc2d4957be597 Merge: 54021f902b37 928276075f16 Author: Jiri Kosina Date: Wed Nov 1 00:14:25 2023 +0100 Merge branch 'for-6.7/nintendo' into for-linus - cleanup of LED handling in hid-nintendo (Martino Fontana) commit 54021f902b374793ebcf90de2720a57b3bcaf9e3 Merge: 7601fef449c7 3e6b0bb22a80 Author: Jiri Kosina Date: Wed Nov 1 00:12:42 2023 +0100 Merge branch 'for-6.7/logitech' into for-linus - big cleanup of logitech-hidpp probe code (Hans de Goede) commit 7601fef449c7994c18cda47cbf470cb189e00fbd Merge: f5883ef15644 2f2bd7cbd1d1 Author: Jiri Kosina Date: Wed Nov 1 00:10:54 2023 +0100 Merge branch 'for-6.7/lenovo' into for-linus - Suspend/Resume fix for USB Thinkpad Compact Keyboard (Jamie Lentin) - firmware detection improvement for Lenovo cptkbd (Mikhail Khvainitski) commit f5883ef15644bdaf5f0850b9c0469e00d40bfb4f Merge: 20cd569d7ee8 dc3115e6c5d9 Author: Jiri Kosina Date: Wed Nov 1 00:09:51 2023 +0100 Merge branch 'for-6.7/cp2112' into for-linus - IRQ shutdown and workqueue initialization fixes for hid-cp2112 driver (Danny Kaehn) commit 20cd569d7ee8fce24e8753f0f43af6c420557b1f Merge: 62cc9c3cb3ec eeebfe6259ba Author: Jiri Kosina Date: Wed Nov 1 00:07:35 2023 +0100 Merge branch 'for-6.7/config_pm' into for-linus - #ifdef CONFIG_PM removal from HID code (Thomas Weißschuh) commit 2bfb0ca3dd0c40b929ecedf1fc941c139945d055 Author: Yang Wang Date: Tue Oct 31 10:12:00 2023 +0800 drm/amdgpu: remove unused macro HW_REV remove unused macro HW_REV Signed-off-by: Yang Wang Reviewed-by: Kenneth Feng Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu.h | 3 --- 1 file changed, 3 deletions(-) commit 7f3e6b840fa8b0889d776639310a5dc672c1e9e1 Author: Ma Jun Date: Tue Oct 31 11:11:04 2023 +0800 drm/amd/pm: Fix error of MACO flag setting code MACO only works if BACO is supported Signed-off-by: Ma Jun Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 8 ++++---- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 9 +++++---- 2 files changed, 9 insertions(+), 8 deletions(-) commit 9ae587f850a6702428273fcf4a2a9b392349b2a3 Author: Arunpravin Paneer Selvam Date: Mon Oct 30 09:25:37 2023 -0700 drm/amdgpu: Fix the vram base start address If the size returned by drm buddy allocator is higher than the required size, we take the higher size to calculate the buffer start address. This is required if we couldn't trim the buffer to the requested size. This will fix the display corruption issue on APU's which has limited VRAM size. Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2859 Fixes: 0a1844bf0b53 ("drm/buddy: Improve contiguous memory allocation") Signed-off-by: Arunpravin Paneer Selvam Acked-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit 5d09c63f11f083707b60c8ea0bb420651c47740f Author: Dan Williams Date: Tue Oct 31 14:09:19 2023 -0700 cxl/hdm: Remove broken error path Dan reports that cxl_decoder_commit() potentially leaks a hold of cxl_dpa_rwsem. The potential error case is a "should not" happen scenario, turn it into a "can not" happen scenario by adding the error check to cxl_port_setup_targets() where other setting validation occurs. Reported-by: Dan Carpenter Closes: http://lore.kernel.org/r/63295673-5d63-4919-b851-3b06d48734c0@moroto.mountain Reviewed-by: Dave Jiang Reviewed-by: Ira Weiny Fixes: 176baefb2eb5 ("cxl/hdm: Commit decoder state to hardware") Signed-off-by: Dan Williams drivers/cxl/core/hdm.c | 19 ++----------------- drivers/cxl/core/region.c | 8 ++++++++ 2 files changed, 10 insertions(+), 17 deletions(-) commit d539b0ad7c7cea6f7ebd8a1f12d2877c15563e73 Author: Tao Zhou Date: Fri Oct 27 12:02:05 2023 +0800 drm/amdgpu: set XGMI IP version manually for v6_4 The version can't be queried from discovery table. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 3 +++ 1 file changed, 3 insertions(+) commit 69d56b15a7941680aba8c3175b165221ecdf54b6 Author: Dan Carpenter Date: Tue Oct 31 12:53:52 2023 +0300 cxl/hdm: Fix && vs || bug If "info" is NULL then this code will crash. || was intended instead of &&. Fixes: 8ce520fdea24 ("cxl/hdm: Use stored Component Register mappings to map HDM decoder capability") Signed-off-by: Dan Carpenter Reviewed-by: Robert Richter Link: https://lore.kernel.org/r/60028378-d3d5-4d6d-90fd-f915f061e731@moroto.mountain Signed-off-by: Dan Williams drivers/cxl/core/hdm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 853eebe6ec4f6a277b8c8fb34da268aca6cf720b Author: Tong Liu01 Date: Fri Oct 27 11:26:46 2023 +0800 drm/amdgpu: add unmap latency when gfx11 set kiq resources [why] If driver does not set unmap latency for KIQ, the default value of KIQ unmap latency is zero. When do unmap queue, KIQ will return that almost immediately after receiving unmap command. So, the queue status will be saved to MQD incorrectly or lost in some chance. [how] Set unmap latency when do kiq set resources. The unmap latency is set to be 1 second that is synchronized with Windows driver. Acked-by: Alex Deucher Signed-off-by: Tong Liu01 Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 1 + 1 file changed, 1 insertion(+) commit 5f38ac54e60562323ea4abb1bfb37d043ee23357 Author: Kenneth Feng Date: Wed Oct 25 11:20:38 2023 +0800 drm/amd/pm: fix the high voltage and temperature issue fix the high voltage and temperature issue after the driver is unloaded on smu 13.0.0, smu 13.0.7 and smu 13.0.10 v2 - fix the code format and make sure it is used on the unload case only. Signed-off-by: Kenneth Feng Reviewed-by: Yang Wang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 24 +++++++++++----- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 33 ++++++++++++++++++++-- drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 1 + drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 2 ++ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 13 +++++++++ .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 18 ++++++++++-- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 18 ++++++++++-- 7 files changed, 94 insertions(+), 15 deletions(-) commit a17f574ab4a2d3dcbd9a49e3c1710fb0cbe8a901 Author: Yifan Zhang Date: Thu Oct 26 21:23:06 2023 +0800 drm/amdgpu: remove amdgpu_mes_self_test in gpu recover gpu tlb flush is skipped if reset sem is held, it makes mes_self_test fail since it involves add_hw_queue/remove_hw_queue which needs tlb flush functional. Remove mes_self_test in gpu recover sequence. This patch is to fix the recover failure in gfx11. [ 1831.768292] [drm] ring sdma_32769.3.3 was added [ 1831.768313] [drm] ring gfx_32769.1.1 ib test pass [ 1831.768337] [drm] ring compute_32769.2.2 ib test pass [ 1831.768399] amdgpu 0000:c2:00.0: amdgpu: [gfxhub] page fault (src_id:0 ring:24 vmid:8 pasid:32769, for process pid 0 thread pid 0) [ 1831.768434] amdgpu 0000:c2:00.0: amdgpu: in page starting at address 0x0000aec200000000 from client 10 [ 1831.768456] amdgpu 0000:c2:00.0: amdgpu: GCVM_L2_PROTECTION_FAULT_STATUS:0x00800A30 [ 1831.768473] amdgpu 0000:c2:00.0: amdgpu: Faulty UTCL2 client ID: CPC (0x5) [ 1831.768489] amdgpu 0000:c2:00.0: amdgpu: MORE_FAULTS: 0x0 [ 1831.768501] amdgpu 0000:c2:00.0: amdgpu: WALKER_ERROR: 0x0 [ 1831.768513] amdgpu 0000:c2:00.0: amdgpu: PERMISSION_FAULTS: 0x3 [ 1831.768521] amdgpu 0000:c2:00.0: amdgpu: MAPPING_ERROR: 0x0 [ 1831.768529] amdgpu 0000:c2:00.0: amdgpu: RW: 0x0 [ 1831.931229] amdgpu 0000:c2:00.0: [drm:amdgpu_ring_test_helper [amdgpu]] *ERROR* ring sdma_32769.3.3 test failed (-110) [ 1832.062917] [drm:mes_v11_0_submit_pkt_and_poll_completion.constprop.0 [amdgpu]] *ERROR* MES failed to response msg=3 [ 1832.063107] [drm:amdgpu_mes_remove_hw_queue [amdgpu]] *ERROR* failed to remove hardware queue, queue id = 3 Fixes: e2e3788850b9 ("drm/amdgpu: rework lock handling for flush_tlb v2") Reported-by: Li Ma Reviewed-by: Christian König Signed-off-by: Yifan Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ---- 1 file changed, 4 deletions(-) commit e020d01575166eaf4133f207bbf71d61774c5e68 Author: Candice Li Date: Fri Oct 27 18:13:28 2023 +0800 drm/amdgpu: Drop deferred error in uncorrectable error check Drop checking deferred error which can be handled by poison consumption. Signed-off-by: Candice Li Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/umc_v12_0.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 5575ce213241be6c495e1bd10f70cb59d2817db1 Author: Lijo Lazar Date: Fri Oct 27 11:02:26 2023 +0530 drm/amd/pm: Fix warnings Fixes warnings: drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu13/smu_v13_0_6_ppt.c:286:45: warning: '%s' directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu13/smu_v13_0_6_ppt.c:286:52: warning: '%s' directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu14/smu_v14_0.c:72:45: warning: '%s' directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu14/smu_v14_0.c:72:52: warning: '%s' directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] Signed-off-by: Lijo Lazar Reviewed-by: Yang Wang Reported-by: kernel test robot Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit d1d4c0b7b65b7fab2bc6f97af9e823b1c42ccdb0 Author: Tao Zhou Date: Wed Oct 25 11:03:24 2023 +0800 drm/amdgpu: check RAS supported first in ras_reset_error_count Not all platforms support RAS. Fixes: 73582be11ac8 ("drm/amdgpu: bypass RAS error reset in some conditions") Signed-off-by: Tao Zhou Reviewed-by: Yang Wang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 45b890f7689eb0aba454fc5831d2d79763781677 Merge: be47941980d5 123f42f0ad68 Author: Paolo Bonzini Date: Tue Oct 31 16:37:07 2023 -0400 Merge tag 'kvmarm-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 updates for 6.7 - Generalized infrastructure for 'writable' ID registers, effectively allowing userspace to opt-out of certain vCPU features for its guest - Optimization for vSGI injection, opportunistically compressing MPIDR to vCPU mapping into a table - Improvements to KVM's PMU emulation, allowing userspace to select the number of PMCs available to a VM - Guest support for memory operation instructions (FEAT_MOPS) - Cleanups to handling feature flags in KVM_ARM_VCPU_INIT, squashing bugs and getting rid of useless code - Changes to the way the SMCCC filter is constructed, avoiding wasted memory allocations when not in use - Load the stage-2 MMU context at vcpu_load() for VHE systems, reducing the overhead of errata mitigations - Miscellaneous kernel and selftest fixes commit f2fbb908112311423b09cd0d2b4978f174b99585 Author: Stephen Rothwell Date: Mon Oct 30 16:09:53 2023 +1100 net: tcp: remove call to obsolete crypto_ahash_alignmask() linux-next hit the following build error: net/ipv4/tcp_ao.c: In function 'tcp_ao_key_alloc': net/ipv4/tcp_ao.c:1536:13: error: implicit declaration of function 'crypto_ahash_alignmask'; did you mean 'crypto_ahash_alg_name'? [-Werror=implicit-function-declaration] 1536 | if (crypto_ahash_alignmask(tfm) > TCP_AO_KEY_ALIGN) { | ^~~~~~~~~~~~~~~~~~~~~~ | crypto_ahash_alg_name Caused by commit from the crypto tree 0f8660c82b79 ("crypto: ahash - remove crypto_ahash_alignmask") interacting with commit 4954f17ddefc ("net/tcp: Introduce TCP_AO setsockopt()s") from networking. crypto_ahash_alignmask() has been phased out by the former commit, drop the call in networking. Eric confirms that the check is safe to remove and was questionable here in the first place. Signed-off-by: Stephen Rothwell Acked-by: Herbert Xu Reviewed-by: Dmitry Safonov Signed-off-by: Jakub Kicinski net/ipv4/tcp_ao.c | 6 ------ 1 file changed, 6 deletions(-) commit 9793c269da6cd339757de6ba5b2c8681b54c99af Author: Mikulas Patocka Date: Tue Oct 31 19:12:54 2023 +0100 dm crypt: account large pages in cc->n_allocated_pages The commit 5054e778fcd9c ("dm crypt: allocate compound pages if possible") changed dm-crypt to use compound pages to improve performance. Unfortunately, there was an oversight: the allocation of compound pages was not accounted at all. Normal pages are accounted in a percpu counter cc->n_allocated_pages and dm-crypt is limited to allocate at most 2% of memory. Because compound pages were not accounted at all, dm-crypt could allocate memory over the 2% limit. Fix this by adding the accounting of compound pages, so that memory consumption of dm-crypt is properly limited. Signed-off-by: Mikulas Patocka Fixes: 5054e778fcd9c ("dm crypt: allocate compound pages if possible") Cc: stable@vger.kernel.org # v6.5+ Signed-off-by: Mike Snitzer drivers/md/dm-crypt.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) commit b3cfdbf6a062bcfb431153f92d6bc1ad20bfc687 Merge: de5512b2a293 05e37b2138a6 Author: Dan Williams Date: Tue Oct 31 11:00:08 2023 -0700 Merge branch 'for-6.7/cxl-commited' into cxl/next Add the committed decoder sysfs attribute for v6.7. commit de5512b2a293863261c6b04c0c73ec0ec09ed550 Merge: 624eda92abd4 fae6389f912e Author: Dan Williams Date: Tue Oct 31 10:59:44 2023 -0700 Merge branch 'for-6.7/cxl' into cxl/next Pickup some misc. CXL updates for v6.7. commit 624eda92abd47f35386028e4a54d423037a75d12 Merge: 7f946e6d830f a103f46633fd Author: Dan Williams Date: Tue Oct 31 10:59:26 2023 -0700 Merge branch 'for-6.7/cxl-qtg' into cxl/next Merge some prep-work for CXL QOS class support. This cycle saw large collisions with mm on this topic, so the bulk of this topic needs to wait. commit 7f946e6d830fbdf411cd0641314edf11831efc88 Merge: 8f61d48c83f6 e8db0701605b Author: Dan Williams Date: Tue Oct 31 10:59:00 2023 -0700 Merge branch 'for-6.7/cxl-rch-eh' into cxl/next Restricted CXL Host (RCH) Error Handling undoes the topology munging of CXL 1.1 to enabled some AER recovery, and lands some base infrastructure for handling Root-Complex-Event-Collectors (RCECs) with CXL. Include this long running series finally for v6.7. commit 4cf6e1101a25ca5e63d48adf49b0a8a64bae790f Author: Shyam Prasad N Date: Mon Oct 30 11:00:08 2023 +0000 cifs: add xid to query server interface call We were passing 0 as the xid for the call to query server interfaces. This is not great for debugging. This change adds a real xid. Signed-off-by: Shyam Prasad N Reviewed-by: Bharath SM Signed-off-by: Steve French fs/smb/client/connect.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 52768695d36a44d352e9fb79ba27468a5363ab8d Author: Shyam Prasad N Date: Mon Oct 30 11:00:07 2023 +0000 cifs: print server capabilities in DebugData In the output of /proc/fs/cifs/DebugData, we do not print the server->capabilities field today. With this change, we will do that. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/cifs_debug.c | 2 ++ 1 file changed, 2 insertions(+) commit 783fa2c94f4150fe1b7f7d88b3baf6d98f82b41b Author: Eric Biggers Date: Sat Oct 28 22:03:00 2023 -0700 smb: use crypto_shash_digest() in symlink_hash() Simplify symlink_hash() by using crypto_shash_digest() instead of an init+update+final sequence. This should also improve performance. Signed-off-by: Eric Biggers Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/link.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) commit d328c09ee9f15ee5a26431f5aad7c9239fa85e62 Author: Paulo Alcantara Date: Tue Oct 24 13:49:15 2023 -0300 smb: client: fix use-after-free bug in cifs_debug_data_proc_show() Skip SMB sessions that are being teared down (e.g. @ses->ses_status == SES_EXITING) in cifs_debug_data_proc_show() to avoid use-after-free in @ses. This fixes the following GPF when reading from /proc/fs/cifs/DebugData while mounting and umounting [ 816.251274] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6d81: 0000 [#1] PREEMPT SMP NOPTI ... [ 816.260138] Call Trace: [ 816.260329] [ 816.260499] ? die_addr+0x36/0x90 [ 816.260762] ? exc_general_protection+0x1b3/0x410 [ 816.261126] ? asm_exc_general_protection+0x26/0x30 [ 816.261502] ? cifs_debug_tcon+0xbd/0x240 [cifs] [ 816.261878] ? cifs_debug_tcon+0xab/0x240 [cifs] [ 816.262249] cifs_debug_data_proc_show+0x516/0xdb0 [cifs] [ 816.262689] ? seq_read_iter+0x379/0x470 [ 816.262995] seq_read_iter+0x118/0x470 [ 816.263291] proc_reg_read_iter+0x53/0x90 [ 816.263596] ? srso_alias_return_thunk+0x5/0x7f [ 816.263945] vfs_read+0x201/0x350 [ 816.264211] ksys_read+0x75/0x100 [ 816.264472] do_syscall_64+0x3f/0x90 [ 816.264750] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 816.265135] RIP: 0033:0x7fd5e669d381 Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/cifs_debug.c | 6 ++++++ 1 file changed, 6 insertions(+) commit e6322fd177c6885a21dd4609dc5e5c973d1a2eb7 Author: Paulo Alcantara Date: Wed Oct 25 14:58:35 2023 -0300 smb: client: fix potential deadlock when releasing mids All release_mid() callers seem to hold a reference of @mid so there is no need to call kref_put(&mid->refcount, __release_mid) under @server->mid_lock spinlock. If they don't, then an use-after-free bug would have occurred anyways. By getting rid of such spinlock also fixes a potential deadlock as shown below CPU 0 CPU 1 ------------------------------------------------------------------ cifs_demultiplex_thread() cifs_debug_data_proc_show() release_mid() spin_lock(&server->mid_lock); spin_lock(&cifs_tcp_ses_lock) spin_lock(&server->mid_lock) __release_mid() smb2_find_smb_tcon() spin_lock(&cifs_tcp_ses_lock) *deadlock* Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/cifsproto.h | 7 ++++++- fs/smb/client/smb2misc.c | 2 +- fs/smb/client/transport.c | 11 +---------- 3 files changed, 8 insertions(+), 12 deletions(-) commit dc6e08b1a2ae262c23e14f5c259b4ca63a554e4f Author: Harshit Mogalapalli Date: Mon Oct 30 00:08:36 2023 -0700 ALSA: hda: cs35l41: Fix missing error code in cs35l41_smart_amp() When firmware status is invalid, assign -EINVAL to ret as ret is '0' at that point and returning success is incorrect when firmware status is invalid. Fixes: a51d8ba03a4f ("ALSA: hda: cs35l41: Check CSPL state after loading firmware") Signed-off-by: Harshit Mogalapalli Link: https://lore.kernel.org/r/20231030070836.3234385-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda.c | 1 + 1 file changed, 1 insertion(+) commit 72bc63f5e23a38b65ff2a201bdc11401d4223fa9 Author: Steve French Date: Thu Oct 19 23:01:49 2023 -0500 smb3: fix creating FIFOs when mounting with "sfu" mount option Fixes some xfstests including generic/564 and generic/157 The "sfu" mount option can be useful for creating special files (character and block devices in particular) but could not create FIFOs. It did recognize existing empty files with the "system" attribute flag as FIFOs but this is too general, so to support creating FIFOs more safely use a new tag (but the same length as those for char and block devices ie "IntxLNK" and "IntxBLK") "LnxFIFO" to indicate that the file should be treated as a FIFO (when mounted with the "sfu"). For some additional context note that "sfu" followed the way that "Services for Unix" on Windows handled these special files (at least for character and block devices and symlinks), which is different than newer Windows which can handle special files as reparse points (which isn't an option to many servers). Cc: stable@vger.kernel.org Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French fs/smb/client/cifspdu.h | 2 +- fs/smb/client/inode.c | 4 ++++ fs/smb/client/smb2ops.c | 8 +++++++- 3 files changed, 12 insertions(+), 2 deletions(-) commit 4b27d5c420335dad7aea1aa6e799fe1d05c63b7e Author: Dan Carpenter Date: Tue Oct 31 12:53:06 2023 +0300 ACPI: thermal: Fix acpi_thermal_unregister_thermal_zone() cleanup The acpi_thermal_unregister_thermal_zone() is paired with acpi_thermal_register_thermal_zone() so it should mirror it. It should clean up all the resources that the register function allocated and leave the stuff that was allocated elsewhere. Unfortunately, it doesn't call thermal_zone_device_disable(). Also it calls kfree(tz->trip_table) when it shouldn't. That was allocated in acpi_thermal_add(). Putting the kfree() here leads to a double free in the acpi_thermal_add() clean up function. Likewise, the acpi_thermal_remove() should mirror acpi_thermal_add() so it should have an explicit kfree(tz->trip_table) as well. Fixes: ec23c1c462de ("ACPI: thermal: Use trip point table to register thermal zones") Signed-off-by: Dan Carpenter Signed-off-by: Rafael J. Wysocki drivers/acpi/thermal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 55c11a159d3ca4ca7f9d5c1275d0768474b12195 Author: Kent Overstreet Date: Fri Oct 20 14:05:31 2023 -0400 bcachefs: bch2_inum_opts_get() New helper for new rebalance code Signed-off-by: Kent Overstreet fs/bcachefs/inode.c | 12 ++++++++++++ fs/bcachefs/inode.h | 1 + 2 files changed, 13 insertions(+) commit 96a363a7e68832054f2a93249335fd3efd870aa3 Author: Kent Overstreet Date: Mon Oct 23 16:21:54 2023 -0400 bcachefs: move: move_stats refactoring data_progress_list is gone - it was redundant with moving_context_list The upcoming rebalance rewrite is going to have it using two different move_stats objects with the same moving_context, depending on whether it's scanning or using the rebalance_work btree - this patch plumbs stats around a bit differently so that will work. Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 3 -- fs/bcachefs/data_update.c | 2 +- fs/bcachefs/move.c | 98 +++++++++++++++++++++++++---------------------- fs/bcachefs/move.h | 5 ++- fs/bcachefs/move_types.h | 3 +- fs/bcachefs/movinggc.c | 1 + fs/bcachefs/trace.c | 1 + fs/bcachefs/trace.h | 31 ++++++++++----- 8 files changed, 82 insertions(+), 62 deletions(-) commit d5eade93452bd1a892e2155e9bb723f04992bdac Author: Kent Overstreet Date: Mon Oct 23 15:36:45 2023 -0400 bcachefs: move: convert to bbpos Signed-off-by: Kent Overstreet fs/bcachefs/bbpos.h | 14 +------------- fs/bcachefs/bbpos_types.h | 18 ++++++++++++++++++ fs/bcachefs/chardev.c | 4 ++-- fs/bcachefs/data_update.c | 8 +++++--- fs/bcachefs/data_update.h | 1 + fs/bcachefs/move.c | 19 ++++++++----------- fs/bcachefs/move_types.h | 5 +++-- 7 files changed, 38 insertions(+), 31 deletions(-) commit 633169035a7ccdfe3a9eba0202dc2135baa07c72 Author: Kent Overstreet Date: Fri Oct 20 13:32:42 2023 -0400 bcachefs: moving_context now owns a btree_trans btree_trans and moving_context are used together, and having the moving_context owns the transaction object reduces some plumbing. Signed-off-by: Kent Overstreet fs/bcachefs/data_update.c | 2 +- fs/bcachefs/move.c | 93 +++++++++++++++++++++-------------------------- fs/bcachefs/move.h | 27 ++++++-------- fs/bcachefs/movinggc.c | 36 ++++++++---------- 4 files changed, 70 insertions(+), 88 deletions(-) commit a0bfe3b065cabc669933063cb5a9066b104be406 Author: Kent Overstreet Date: Fri Oct 20 13:32:42 2023 -0400 bcachefs: move.c exports, refactoring Prep work for the new rebalance code - we need a few helpers exported. Signed-off-by: Kent Overstreet fs/bcachefs/move.c | 119 ++++++++++++++++++++++++++---------------------- fs/bcachefs/move.h | 22 ++++++++- fs/bcachefs/rebalance.c | 3 +- 3 files changed, 85 insertions(+), 59 deletions(-) commit 6ddedca2180b095aacca0f628e0d03a32477f68f Author: Kent Overstreet Date: Sun Oct 22 18:29:54 2023 -0400 bcachefs: Guard against unknown compression options Since compression options now include compression level, proper validation is a bit more involved. This adds bch2_compression_opt_valid(), and plumbs it around appropriately. Signed-off-by: Kent Overstreet fs/bcachefs/compress.c | 10 ++++++++++ fs/bcachefs/compress.h | 34 +++++++++++++++++++++++++--------- fs/bcachefs/errcode.h | 1 + fs/bcachefs/inode.c | 8 +++++--- fs/bcachefs/opts.c | 3 +++ fs/bcachefs/opts.h | 1 + 6 files changed, 45 insertions(+), 12 deletions(-) commit ef435abd6a99206d9bb93462a1b0508e0d876adb Author: Kent Overstreet Date: Sun Oct 22 15:06:27 2023 -0400 bcachefs: trivial extents.c refactoring Signed-off-by: Kent Overstreet fs/bcachefs/extents.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) commit 48f866e90f520855b6d941eebe46d75dbfbb9a81 Author: Kent Overstreet Date: Sun Oct 22 17:22:53 2023 -0400 bcachefs: Fix bch2_prt_bitflags() This fixes an infinite loop when there's a set bit at position >= 32. Signed-off-by: Kent Overstreet fs/bcachefs/printbuf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9db2f86060a8e54e80f99e3c3366832ce6a67d76 Author: Kent Overstreet Date: Sun Oct 22 11:33:02 2023 -0400 bcachefs: Check for too-large encoded extents We don't yet repair (split) them, just check. Signed-off-by: Kent Overstreet fs/bcachefs/extents.c | 8 ++++++++ fs/bcachefs/extents.h | 5 +++++ fs/bcachefs/fsck.c | 49 +++++++++++++++++++++++++++++++++++++++++++- fs/bcachefs/fsck.h | 1 + fs/bcachefs/io_write.c | 4 +--- fs/bcachefs/recovery_types.h | 1 + 6 files changed, 64 insertions(+), 4 deletions(-) commit 2d39081291470750cc605c917531d7cd85aebf94 Author: Kent Overstreet Date: Sun Oct 22 11:19:34 2023 -0400 bcachefs: Ensure we don't exceed encoded_extent_max The write path may (rarely) see an encoded (checksummed) extent that exceeds encoded_extent_max - this can happen when we're moving an existing extent that was not checksummed, but was given a checksum by bch2_write_rechecksum(). Signed-off-by: Kent Overstreet fs/bcachefs/io_write.c | 1 + 1 file changed, 1 insertion(+) commit e677179b35b7ecbe3cefe33011b69d45171e5e9f Author: Kent Overstreet Date: Sun Oct 22 11:12:14 2023 -0400 bcachefs: bch2_disk_path_to_text() no longer takes sb_lock We're going to be using bch2_target_to_text() -> bch2_disk_path_to_text() from bch2_bkey_ptrs_to_text() and bch2_bkey_ptrs_invalid(), which can be called in any context. This patch adds the actual label to bch_disk_group_cpu so that it can be used by bch2_disk_path_to_text, and splits out bch2_disk_path_to_text() into two variants - like the previous patch, one for when we have a running filesystem and another for when we only have a superblock. Signed-off-by: Kent Overstreet fs/bcachefs/disk_groups.c | 59 +++++++++++++++++++++++++++++++++++++---- fs/bcachefs/disk_groups.h | 4 ++- fs/bcachefs/disk_groups_types.h | 1 + fs/bcachefs/super.c | 2 +- fs/bcachefs/sysfs.c | 9 ++----- 5 files changed, 61 insertions(+), 14 deletions(-) commit 37707bb183b4746f27b0beaf0c3273fd7c79dc66 Author: Kent Overstreet Date: Sun Oct 22 10:58:38 2023 -0400 bcachefs: Split out disk_groups_types.h Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 1 + fs/bcachefs/disk_groups.h | 2 ++ fs/bcachefs/disk_groups_types.h | 17 +++++++++++++++++ fs/bcachefs/super_types.h | 12 ------------ 4 files changed, 20 insertions(+), 12 deletions(-) commit bf0d9e89de2e62fe9967ebb77b68d58d3812e4db Author: Kent Overstreet Date: Sun Oct 22 10:54:24 2023 -0400 bcachefs: Split apart bch2_target_to_text(), bch2_target_to_text_sb() Previously we just had bch2_opt_target_to_text() which could be passed either a filesystem object or just a superblock - depending on if we have a running filesystem or not. Split these into two functions for clarity. Signed-off-by: Kent Overstreet fs/bcachefs/disk_groups.c | 95 +++++++++++++++++++++++++++++------------------ fs/bcachefs/disk_groups.h | 1 + 2 files changed, 59 insertions(+), 37 deletions(-) commit 523f33efbf406f2eb0f071123d17fbbd9e40d692 Author: Kent Overstreet Date: Thu Jun 22 20:18:12 2023 -0400 bcachefs: All triggers are BTREE_TRIGGER_WANTS_OLD_AND_NEW Upcoming rebalance_work btree will require extent triggers to be BTREE_TRIGGER_WANTS_OLD_AND_NEW - so to reduce potential confusion, let's just make all triggers BTREE_TRIGGER_WANTS_OLD_AND_NEW. Signed-off-by: Kent Overstreet fs/bcachefs/bkey_methods.h | 10 ---- fs/bcachefs/btree_trans_commit.c | 6 +- fs/bcachefs/buckets.c | 123 ++++++++++++++++++++++++--------------- fs/bcachefs/buckets.h | 14 +++++ fs/bcachefs/reflink.c | 34 +++++------ 5 files changed, 105 insertions(+), 82 deletions(-) commit 8480905765c3729025331720d23735ce085ef070 Author: Kent Overstreet Date: Sat Oct 21 15:03:05 2023 -0400 bcachefs: Improve io option handling in data move path The data move path now correctly picks IO options when inodes in different snapshots have different options applied. Signed-off-by: Kent Overstreet fs/bcachefs/move.c | 131 +++++++++++++++++++++++++++++++++-------------------- fs/bcachefs/move.h | 26 +++++++++++ 2 files changed, 107 insertions(+), 50 deletions(-) commit bbe682c76789d679cb75effd7792d41b09efea00 Author: Kent Overstreet Date: Sat Oct 21 13:54:39 2023 -0400 bcachefs: Ensure devices are always correctly initialized We can't mark device superblocks or allocate journal on a device that isn't online. That means we may need to do this on every mount, because we may have formatted a new filesystem and then done the first mount (bch2_fs_initialize()) in degraded mode. Signed-off-by: Kent Overstreet fs/bcachefs/buckets.c | 32 ++++++++++++++++++++++++-------- fs/bcachefs/buckets.h | 1 + fs/bcachefs/journal.c | 19 +++++++++++++++++++ fs/bcachefs/journal.h | 1 + fs/bcachefs/recovery.c | 24 +++++++++--------------- fs/bcachefs/recovery_types.h | 2 ++ fs/bcachefs/super.c | 30 +++++++++++++++++------------- 7 files changed, 73 insertions(+), 36 deletions(-) commit d0261559c434abbd7254c9c97c68f5e024daabf4 Author: Kent Overstreet Date: Sat Oct 21 13:19:54 2023 -0400 bcachefs: Delete duplicate time stats initialization This code duplicated initialization already done in bch2_fs_btree_iter_init(). Signed-off-by: Kent Overstreet fs/bcachefs/super.c | 6 ------ 1 file changed, 6 deletions(-) commit e38356d65ed085a2c0ba056fa9048ad8845da1d0 Author: Kent Overstreet Date: Fri Oct 20 14:40:23 2023 -0400 bcachefs: Kill dead code extent_save() Signed-off-by: Kent Overstreet fs/bcachefs/extents.h | 18 ------------------ 1 file changed, 18 deletions(-) commit 253ba178c8d9065748fa56b39343e6a5a55b0023 Author: Kent Overstreet Date: Fri Oct 20 12:24:36 2023 -0400 bcachefs: Fix ca->oldest_gen allocation The ca->oldest_gen array needs to be the same size as the bucket_gens array; ca->mi.nbuckets is updated with only state_lock held, not gc_lock, so bch2_gc_gens() could race with device resize and allocate too small of an oldest_gens array. Signed-off-by: Kent Overstreet fs/bcachefs/btree_gc.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit a1d97d8417d3c2f2477847541303621c32652976 Author: Kent Overstreet Date: Fri Oct 20 12:02:14 2023 -0400 bcachefs: Fix shrinker names Shrinkers are now exported to debugfs, so the names can't have slashes in them. Signed-off-by: Kent Overstreet fs/bcachefs/btree_cache.c | 2 +- fs/bcachefs/btree_key_cache.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 50a38ca1baace3dc66027ad41393917b05318b14 Author: Kent Overstreet Date: Fri Oct 20 00:01:53 2023 -0400 bcachefs: Fix btree_node_type enum More forwards compatibility fixups: having BKEY_TYPE_btree at the end of the enum conflicts with unnkown btree IDs, this shifts BKEY_TYPE_btree to slot 0 and fixes things up accordingly. Signed-off-by: Kent Overstreet fs/bcachefs/bkey_methods.c | 22 ++++++++++++++++------ fs/bcachefs/btree_iter.h | 2 +- fs/bcachefs/btree_trans_commit.c | 11 +++++------ fs/bcachefs/btree_types.h | 35 +++++++++++++++++++---------------- 4 files changed, 41 insertions(+), 29 deletions(-) commit 88dfe193bd2abd08926c1a0d48b770bb68ac8ccb Author: Kent Overstreet Date: Thu Oct 19 22:49:08 2023 -0400 bcachefs: bch2_btree_id_str() Since we can run with unknown btree IDs, we can't directly index btree IDs into fixed size arrays. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 6 +++--- fs/bcachefs/backpointers.c | 4 ++-- fs/bcachefs/bbpos.h | 3 ++- fs/bcachefs/bkey_methods.c | 3 ++- fs/bcachefs/btree_cache.c | 21 +++++++++++++++++---- fs/bcachefs/btree_cache.h | 5 +++-- fs/bcachefs/btree_gc.c | 20 ++++++++++---------- fs/bcachefs/btree_io.c | 18 ++++-------------- fs/bcachefs/btree_iter.c | 14 +++++++------- fs/bcachefs/btree_key_cache.c | 4 ++-- fs/bcachefs/btree_trans_commit.c | 2 +- fs/bcachefs/debug.c | 8 ++++---- fs/bcachefs/fsck.c | 5 +++-- fs/bcachefs/journal_io.c | 2 +- fs/bcachefs/move.c | 2 +- fs/bcachefs/opts.c | 3 +-- fs/bcachefs/opts.h | 2 +- fs/bcachefs/recovery.c | 6 +++--- fs/bcachefs/sysfs.c | 2 +- fs/bcachefs/trace.h | 12 ++++++------ 20 files changed, 74 insertions(+), 68 deletions(-) commit b0b5bbf99fc269e10d01c2a9873de5a042bdc7f5 Author: Kent Overstreet Date: Thu Oct 19 21:25:04 2023 -0400 bcachefs: Don't run bch2_delete_dead_snapshots() unnecessarily Be a bit more careful about when bch2_delete_dead_snapshots needs to run: it only needs to run synchronously if we're running fsck, and it only needs to run at all if we have snapshot nodes to delete or if fsck has noticed that it needs to run. Also: Rename BCH_FS_HAVE_DELETED_SNAPSHOTS -> BCH_FS_NEED_DELETE_DEAD_SNAPSHOTS Kill bch2_delete_dead_snapshots_hook(), move functionality to bch2_mark_snapshot() Factor out bch2_check_snapshot_needs_deletion(), to explicitly check if we need to be running snapshot deletion. Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 2 +- fs/bcachefs/fsck.c | 1 + fs/bcachefs/recovery.c | 2 +- fs/bcachefs/recovery_types.h | 2 +- fs/bcachefs/snapshot.c | 77 ++++++++++++++++++++++++++------------------ fs/bcachefs/snapshot.h | 2 -- fs/bcachefs/subvolume.c | 19 ++--------- 7 files changed, 51 insertions(+), 54 deletions(-) commit 0dd092bf1091a114f22136e5776aec21e6e4af2a Author: Kent Overstreet Date: Thu Oct 19 15:23:56 2023 -0400 bcachefs: Fix lock ordering with snapshot_create_lock We must not hold btree locks while taking snapshot_create_lock - this fixes a lockdep splat. Signed-off-by: Kent Overstreet fs/bcachefs/snapshot.c | 1 + 1 file changed, 1 insertion(+) commit 89ed67ef126c4160349c1b96fdb775ea6170ac90 Merge: 5a6a09e97199 f1c73396133c Author: Linus Torvalds Date: Tue Oct 31 05:10:11 2023 -1000 Merge tag 'net-next-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from Jakub Kicinski: "Core & protocols: - Support usec resolution of TCP timestamps, enabled selectively by a route attribute. - Defer regular TCP ACK while processing socket backlog, try to send a cumulative ACK at the end. Increase single TCP flow performance on a 200Gbit NIC by 20% (100Gbit -> 120Gbit). - The Fair Queuing (FQ) packet scheduler: - add built-in 3 band prio / WRR scheduling - support bypass if the qdisc is mostly idle (5% speed up for TCP RR) - improve inactive flow reporting - optimize the layout of structures for better cache locality - Support TCP Authentication Option (RFC 5925, TCP-AO), a more modern replacement for the old MD5 option. - Add more retransmission timeout (RTO) related statistics to TCP_INFO. - Support sending fragmented skbs over vsock sockets. - Make sure we send SIGPIPE for vsock sockets if socket was shutdown(). - Add sysctl for ignoring lower limit on lifetime in Router Advertisement PIO, based on an in-progress IETF draft. - Add sysctl to control activation of TCP ping-pong mode. - Add sysctl to make connection timeout in MPTCP configurable. - Support rcvlowat and notsent_lowat on MPTCP sockets, to help apps limit the number of wakeups. - Support netlink GET for MDB (multicast forwarding), allowing user space to request a single MDB entry instead of dumping the entire table. - Support selective FDB flushing in the VXLAN tunnel driver. - Allow limiting learned FDB entries in bridges, prevent OOM attacks. - Allow controlling via configfs netconsole targets which were created via the kernel cmdline at boot, rather than via configfs at runtime. - Support multiple PTP timestamp event queue readers with different filters. - MCTP over I3C. BPF: - Add new veth-like netdevice where BPF program defines the logic of the xmit routine. It can operate in L3 and L2 mode. - Support exceptions - allow asserting conditions which should never be true but are hard for the verifier to infer. With some extra flexibility around handling of the exit / failure: https://lwn.net/Articles/938435/ - Add support for local per-cpu kptr, allow allocating and storing per-cpu objects in maps. Access to those objects operates on the value for the current CPU. This allows to deprecate local one-off implementations of per-CPU storage like BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE maps. - Extend cgroup BPF sockaddr hooks for UNIX sockets. The use case is for systemd to re-implement the LogNamespace feature which allows running multiple instances of systemd-journald to process the logs of different services. - Enable open-coded task_vma iteration, after maple tree conversion made it hard to directly walk VMAs in tracing programs. - Add open-coded task, css_task and css iterator support. One of the use cases is customizable OOM victim selection via BPF. - Allow source address selection with bpf_*_fib_lookup(). - Add ability to pin BPF timer to the current CPU. - Prevent creation of infinite loops by combining tail calls and fentry/fexit programs. - Add missed stats for kprobes to retrieve the number of missed kprobe executions and subsequent executions of BPF programs. - Inherit system settings for CPU security mitigations. - Add BPF v4 CPU instruction support for arm32 and s390x. Changes to common code: - overflow: add DEFINE_FLEX() for on-stack definition of structs with flexible array members. - Process doc update with more guidance for reviewers. Driver API: - Simplify locking in WiFi (cfg80211 and mac80211 layers), use wiphy mutex in most places and remove a lot of smaller locks. - Create a common DPLL configuration API. Allow configuring and querying state of PLL circuits used for clock syntonization, in network time distribution. - Unify fragmented and full page allocation APIs in page pool code. Let drivers be ignorant of PAGE_SIZE. - Rework PHY state machine to avoid races with calls to phy_stop(). - Notify DSA drivers of MAC address changes on user ports, improve correctness of offloads which depend on matching port MAC addresses. - Allow antenna control on injected WiFi frames. - Reduce the number of variants of napi_schedule(). - Simplify error handling when composing devlink health messages. Misc: - A lot of KCSAN data race "fixes", from Eric. - A lot of __counted_by() annotations, from Kees. - A lot of strncpy -> strscpy and printf format fixes. - Replace master/slave terminology with conduit/user in DSA drivers. - Handful of KUnit tests for netdev and WiFi core. Removed: - AppleTalk COPS. - AppleTalk ipddp. - TI AR7 CPMAC Ethernet driver. Drivers: - Ethernet high-speed NICs: - Intel (100G, ice, idpf): - add a driver for the Intel E2000 IPUs - make CRC/FCS stripping configurable - cross-timestamping for E823 devices - basic support for E830 devices - use aux-bus for managing client drivers - i40e: report firmware versions via devlink - nVidia/Mellanox: - support 4-port NICs - increase max number of channels to 256 - optimize / parallelize SF creation flow - Broadcom (bnxt): - enhance NIC temperature reporting - support PAM4 speeds and lane configuration - Marvell OcteonTX2: - PTP pulse-per-second output support - enable hardware timestamping for VFs - Solarflare/AMD: - conntrack NAT offload and offload for tunnels - Wangxun (ngbe/txgbe): - expose HW statistics - Pensando/AMD: - support PCI level reset - narrow down the condition under which skbs are linearized - Netronome/Corigine (nfp): - support CHACHA20-POLY1305 crypto in IPsec offload - Ethernet NICs embedded, slower, virtual: - Synopsys (stmmac): - add Loongson-1 SoC support - enable use of HW queues with no offload capabilities - enable PPS input support on all 5 channels - increase TX coalesce timer to 5ms - RealTek USB (r8152): improve efficiency of Rx by using GRO frags - xen: support SW packet timestamping - add drivers for implementations based on TI's PRUSS (AM64x EVM) - nVidia/Mellanox Ethernet datacenter switches: - avoid poor HW resource use on Spectrum-4 by better block selection for IPv6 multicast forwarding and ordering of blocks in ACL region - Ethernet embedded switches: - Microchip: - support configuring the drive strength for EMI compliance - ksz9477: partial ACL support - ksz9477: HSR offload - ksz9477: Wake on LAN - Realtek: - rtl8366rb: respect device tree config of the CPU port - Ethernet PHYs: - support Broadcom BCM5221 PHYs - TI dp83867: support hardware LED blinking - CAN: - add support for Linux-PHY based CAN transceivers - at91_can: clean up and use rx-offload helpers - WiFi: - MediaTek (mt76): - new sub-driver for mt7925 USB/PCIe devices - HW wireless <> Ethernet bridging in MT7988 chips - mt7603/mt7628 stability improvements - Qualcomm (ath12k): - WCN7850: - enable 320 MHz channels in 6 GHz band - hardware rfkill support - enable IEEE80211_HW_SINGLE_SCAN_ON_ALL_BANDS to make scan faster - read board data variant name from SMBIOS - QCN9274: mesh support - RealTek (rtw89): - TDMA-based multi-channel concurrency (MCC) - Silicon Labs (wfx): - Remain-On-Channel (ROC) support - Bluetooth: - ISO: many improvements for broadcast support - mark BCM4378/BCM4387 as BROKEN_LE_CODED - add support for QCA2066 - btmtksdio: enable Bluetooth wakeup from suspend" * tag 'net-next-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1816 commits) net: pcs: xpcs: Add 2500BASE-X case in get state for XPCS drivers net: bpf: Use sockopt_lock_sock() in ip_sock_set_tos() net: mana: Use xdp_set_features_flag instead of direct assignment vxlan: Cleanup IFLA_VXLAN_PORT_RANGE entry in vxlan_get_size() iavf: delete the iavf client interface iavf: add a common function for undoing the interrupt scheme iavf: use unregister_netdev iavf: rely on netdev's own registered state iavf: fix the waiting time for initial reset iavf: in iavf_down, don't queue watchdog_task if comms failed iavf: simplify mutex_trylock+sleep loops iavf: fix comments about old bit locks doc/netlink: Update schema to support cmd-cnt-name and cmd-max-name tools: ynl: introduce option to process unknown attributes or types ipvlan: properly track tx_errors netdevsim: Block until all devices are released nfp: using napi_build_skb() to replace build_skb() net: dsa: microchip: ksz9477: Fix spelling mistake "Enery" -> "Energy" net: dsa: microchip: Ensure Stable PME Pin State for Wake-on-LAN net: dsa: microchip: Refactor switch shutdown routine for WoL preparation ... commit 070bb43ab01e891db1b742d4ddd7291c7f8d7022 Author: Eric Biggers Date: Sat Oct 28 21:59:44 2023 -0700 dm integrity: use crypto_shash_digest() in sb_mac() Simplify sb_mac() by using crypto_shash_digest() instead of an init+update+final sequence. This should also improve performance. Signed-off-by: Eric Biggers Signed-off-by: Mike Snitzer drivers/md/dm-integrity.c | 30 ++++++++++-------------------- 1 file changed, 10 insertions(+), 20 deletions(-) commit 6d0ee3b68092ef556703d7827ead3d1b7d275399 Author: Eric Biggers Date: Sat Oct 28 21:59:23 2023 -0700 dm crypt: use crypto_shash_digest() in crypt_iv_tcw_whitening() Simplify crypt_iv_tcw_whitening() by using crypto_shash_digest() instead of an init+update+final sequence. This should also improve performance. Signed-off-by: Eric Biggers Signed-off-by: Mike Snitzer drivers/md/dm-crypt.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit a951104333bd25bb6e5d0f5bee9cbf155b66fac1 Author: Damien Le Moal Date: Thu Oct 26 14:12:05 2023 +0900 dm error: Add support for zoned block devices dm-error is used in several test cases in the xfstests test suite to check the handling of IO errors in file systems. However, with several file systems getting native support for zoned block devices (e.g. btrfs and f2fs), dm-error's lack of zoned block device support creates problems as the file system attempts executing zone commands (e.g. a zone append operation) against a dm-error non-zoned block device, which causes various issues in the block layer (e.g. WARN_ON triggers). This commit adds supports for zoned block devices to dm-error, allowing a DM device table containing an error target to be exposed as a zoned block device (if all targets have a compatible zoned model support and mapping). This is done as follows: 1) Allow passing 2 arguments to an error target, similar to dm-linear: a backing device and a start sector. These arguments are optional and dm-error retains its characteristics if the arguments are not specified. 2) Implement the iterate_devices method so that dm-core can normally check the zone support and restrictions (e.g. zone alignment of the targets). When the backing device arguments are not specified, the iterate_devices method never calls the fn() argument. When no backing device is specified, as before, we assume that the DM device is not zoned. When the backing device arguments are specified, the zoned model of the DM device will depend on the backing device type: - If the backing device is zoned and its model and mapping is compatible with other targets of the device, the resulting device will be zoned, with the dm-error mapped portion always returning errors (similar to the default non-zoned case). - If the backing device is not zoned, then the DM device will not be either. This zone support for dm-error requires the definition of a functional report_zones operation so that dm_revalidate_zones() can operate correctly and resources for emulating zone append operations initialized. This is necessary for cases where dm-error is used to partially map a device and have an overall correct handling of zone append. This means that dm-error does not fail report zones operations. Two changes that are not obvious are included to avoid issues: 1) dm_table_supports_zoned_model() is changed to directly check if the backing device of a wildcard target (= dm-error target) is zoned. Otherwise, we wouldn't be able to catch the invalid setup of dm-error without a backing device (non zoned case) being combined with zoned targets. 2) dm_table_supports_dax() is modified to return false if the wildcard target is found. Otherwise, when dm-error is set without a backing device, we end up with a NULL pointer dereference in set_dax_synchronous (dax_dev is NULL). This is consistent with the current behavior because dm_table_supports_dax() always returned false for targets that do not define the iterate_devices method. Signed-off-by: Damien Le Moal Tested-by: Christoph Hellwig Signed-off-by: Mike Snitzer drivers/md/dm-table.c | 23 ++++++++++- drivers/md/dm-target.c | 106 +++++++++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 125 insertions(+), 4 deletions(-) commit 70bbeb29fab09d6ea6cfe64109db60a97d84d739 Author: Christian Loehle Date: Fri Oct 20 12:46:05 2023 +0100 dm delay: for short delays, use kthread instead of timers and wq DM delay's current design of using timers and wq to realize the delays is insufficient for delays below ~50ms. This commit enhances the design to use a kthread to flush the expired delays, trading some CPU time (in some cases) for better delay accuracy and delays closer to what the user requested for smaller delays. The new design is chosen as long as all the delays are below 50ms. Since bios can't be completed in interrupt context using a kthread is probably the most reasonable way to approach this. Testing with echo "0 2097152 zero" | dmsetup create dm-zeros for i in $(seq 0 20); do echo "0 2097152 delay /dev/mapper/dm-zeros 0 $i" | dmsetup create dm-delay-${i}ms; done Some performance numbers for comparison, on beaglebone black (single core) CONFIG_HZ_1000=y: fio --name=1msread --rw=randread --bs=4k --runtime=60 --time_based \ --filename=/dev/mapper/dm-delay-1ms Theoretical maximum: 1000 IOPS Previous: 250 IOPS Kthread: 500 IOPS fio --name=10msread --rw=randread --bs=4k --runtime=60 --time_based \ --filename=/dev/mapper/dm-delay-10ms Theoretical maximum: 100 IOPS Previous: 45 IOPS Kthread: 50 IOPS fio --name=1mswrite --rw=randwrite --direct=1 --bs=4k --runtime=60 \ --time_based --filename=/dev/mapper/dm-delay-1ms Theoretical maximum: 1000 IOPS Previous: 498 IOPS Kthread: 1000 IOPS fio --name=10mswrite --rw=randwrite --direct=1 --bs=4k --runtime=60 \ --time_based --filename=/dev/mapper/dm-delay-10ms Theoretical maximum: 100 IOPS Previous: 90 IOPS Kthread: 100 IOPS (This one is just to prove the new design isn't impacting throughput, not really about delays): fio --name=10mswriteasync --rw=randwrite --direct=1 --bs=4k \ --runtime=60 --time_based --filename=/dev/mapper/dm-delay-10ms \ --numjobs=32 --iodepth=64 --ioengine=libaio --group_reporting Previous: 13.3k IOPS Kthread: 13.3k IOPS Signed-off-by: Christian Loehle [Harshit: kthread_create error handling fix in delay_ctr] Signed-off-by: Harshit Mogalapalli Signed-off-by: Mike Snitzer drivers/md/dm-delay.c | 103 ++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 88 insertions(+), 15 deletions(-) commit ed2232d49187cebc007ecf4e6374069b11ab3219 Author: Syed Saba Kareem Date: Tue Oct 31 19:29:34 2023 +0530 ASoC: amd: acp: fix for i2s mode register field update I2S mode register field will be set to 1 when tdm mode is enabled. Update the I2S mode field based on tdm_mode flag check. This will fix below smatch checker warning. sound/soc/amd/acp/acp-i2s.c:59 acp_set_i2s_clk() warn: odd binop '0x0 & 0x2' Fixes: 40f74d5f09d7 ("ASoC: amd: acp: refactor acp i2s clock generation code") Reported-By: Dan Carpenter Signed-off-by: Syed Saba Kareem Link: https://lore.kernel.org/r/20231031135949.1064581-3-Syed.SabaKareem@amd.com Signed-off-by: Mark Brown sound/soc/amd/acp/acp-i2s.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit be47941980d56238455eb54401c7b3de4ac5e269 Merge: d5cde2e0b317 006829954096 Author: Paolo Bonzini Date: Tue Oct 31 10:22:43 2023 -0400 Merge tag 'kvm-x86-svm-6.7' of https://github.com/kvm-x86/linux into HEAD KVM SVM changes for 6.7: - Report KVM_EXIT_SHUTDOWN instead of EINVAL if KVM intercepts SHUTDOWN while running an SEV-ES guest. - Clean up handling "failures" when KVM detects it can't emulate the "skip" action for an instruction that has already been partially emulated. Drop a hack in the SVM code that was fudging around the emulator code not giving SVM enough information to do the right thing. commit d5cde2e0b317bb179a39204b4a7820ac8b9011cc Merge: e122d7a10087 fad505b2cb83 Author: Paolo Bonzini Date: Tue Oct 31 10:22:23 2023 -0400 Merge tag 'kvm-x86-pmu-6.7' of https://github.com/kvm-x86/linux into HEAD KVM PMU change for 6.7: - Handle NMI/SMI requests after PMU/PMI requests so that a PMI=>NMI doesn't require redoing the entire run loop due to the NMI not being detected until the final kvm_vcpu_exit_request() check before entering the guest. commit e122d7a1008769af080b9dbd78fce54d3cd77f6f Merge: f0f59d069e0a 409f2e92a27a Author: Paolo Bonzini Date: Tue Oct 31 10:21:42 2023 -0400 Merge tag 'kvm-x86-xen-6.7' of https://github.com/kvm-x86/linux into HEAD KVM x86 Xen changes for 6.7: - Omit "struct kvm_vcpu_xen" entirely when CONFIG_KVM_XEN=n. - Use the fast path directly from the timer callback when delivering Xen timer events. Avoid the problematic races with using the fast path by ensuring the hrtimer isn't running when (re)starting the timer or saving the timer information (for userspace). - Follow the lead of upstream Xen and ignore the VCPU_SSHOTTMR_future flag. commit f0f59d069e0a33bd43afe664e16b4a86cf9d079c Merge: f292dc8aad10 1de9992f9de0 Author: Paolo Bonzini Date: Tue Oct 31 10:17:43 2023 -0400 Merge tag 'kvm-x86-mmu-6.7' of https://github.com/kvm-x86/linux into HEAD KVM x86 MMU changes for 6.7: - Clean up code that deals with honoring guest MTRRs when the VM has non-coherent DMA and host MTRRs are ignored, i.e. EPT is enabled. - Zap EPT entries when non-coherent DMA assignment stops/start to prevent using stale entries with the wrong memtype. - Don't ignore guest PAT for CR0.CD=1 && KVM_X86_QUIRK_CD_NW_CLEARED=y, as there's zero reason to ignore guest PAT if the effective MTRR memtype is WB. This will also allow for future optimizations of handling guest MTRR updates for VMs with non-coherent DMA and the quirk enabled. - Harden the fast page fault path to guard against encountering an invalid root when walking SPTEs. commit 2ef422f063b74adcc4a4a9004b0a87bb55e0a836 Author: George Kennedy Date: Tue Oct 24 13:01:58 2023 -0500 IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF In the unlikely event that workqueue allocation fails and returns NULL in mlx5_mkey_cache_init(), delete the call to mlx5r_umr_resource_cleanup() (which frees the QP) in mlx5_ib_stage_post_ib_reg_umr_init(). This will avoid attempted double free of the same QP when __mlx5_ib_add() does its cleanup. Resolves a splat: Syzkaller reported a UAF in ib_destroy_qp_user workqueue: Failed to create a rescuer kthread for wq "mkey_cache": -EINTR infiniband mlx5_0: mlx5_mkey_cache_init:981:(pid 1642): failed to create work queue infiniband mlx5_0: mlx5_ib_stage_post_ib_reg_umr_init:4075:(pid 1642): mr cache init failed -12 ================================================================== BUG: KASAN: slab-use-after-free in ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) Read of size 8 at addr ffff88810da310a8 by task repro_upstream/1642 Call Trace: kasan_report (mm/kasan/report.c:590) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4178) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ... Allocated by task 1642: __kmalloc (./include/linux/kasan.h:198 mm/slab_common.c:1026 mm/slab_common.c:1039) create_qp (./include/linux/slab.h:603 ./include/linux/slab.h:720 ./include/rdma/ib_verbs.h:2795 drivers/infiniband/core/verbs.c:1209) ib_create_qp_kernel (drivers/infiniband/core/verbs.c:1347) mlx5r_umr_resource_init (drivers/infiniband/hw/mlx5/umr.c:164) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4070) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ... Freed by task 1642: __kmem_cache_free (mm/slub.c:1826 mm/slub.c:3809 mm/slub.c:3822) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2112) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4076 drivers/infiniband/hw/mlx5/main.c:4065) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ... Fixes: 04876c12c19e ("RDMA/mlx5: Move init and cleanup of UMR to umr.c") Link: https://lore.kernel.org/r/1698170518-4006-1-git-send-email-george.kennedy@oracle.com Suggested-by: Leon Romanovsky Signed-off-by: George Kennedy Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/main.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit f292dc8aad10f8e3be2cfaa4714b92464f42c710 Merge: fadaf574a7fa 2770d4722036 Author: Paolo Bonzini Date: Tue Oct 31 10:15:15 2023 -0400 Merge tag 'kvm-x86-misc-6.7' of https://github.com/kvm-x86/linux into HEAD KVM x86 misc changes for 6.7: - Add CONFIG_KVM_MAX_NR_VCPUS to allow supporting up to 4096 vCPUs without forcing more common use cases to eat the extra memory overhead. - Add IBPB and SBPB virtualization support. - Fix a bug where restoring a vCPU snapshot that was taken within 1 second of creating the original vCPU would cause KVM to try to synchronize the vCPU's TSC and thus clobber the correct TSC being set by userspace. - Compute guest wall clock using a single TSC read to avoid generating an inaccurate time, e.g. if the vCPU is preempted between multiple TSC reads. - "Virtualize" HWCR.TscFreqSel to make Linux guests happy, which complain about a "Firmware Bug" if the bit isn't set for select F/M/S combos. - Don't apply side effects to Hyper-V's synthetic timer on writes from userspace to fix an issue where the auto-enable behavior can trigger spurious interrupts, i.e. do auto-enabling only for guest writes. - Remove an unnecessary kick of all vCPUs when synchronizing the dirty log without PML enabled. - Advertise "support" for non-serializing FS/GS base MSR writes as appropriate. - Use octal notation for file permissions through KVM x86. - Fix a handful of typo fixes and warts. commit fadaf574a7fabe27016f734bd02a3bd27d0fcc10 Merge: f23364676018 b35babd3abea Author: Paolo Bonzini Date: Tue Oct 31 10:12:45 2023 -0400 Merge tag 'kvm-x86-docs-6.7' of https://github.com/kvm-x86/linux into HEAD KVM x86 Documentation updates for 6.7: - Fix various typos, notably a confusing reference to the non-existent "struct kvm_vcpu_event" (the actual structure is kvm_vcpu_events, plural). - Update x86's kvm_mmu_page documentation to bring it closer to the code (this raced with the removal of async zapping and so the documentation is already stale; my bad). - Document the behavior of x86 PMU filters on fixed counters. commit f23364676018db8432f91c6247a30529195aff60 Merge: 140139c5bd9f 629d3698f695 Author: Paolo Bonzini Date: Tue Oct 31 10:11:19 2023 -0400 Merge tag 'kvm-x86-apic-6.7' of https://github.com/kvm-x86/linux into HEAD KVM x86 APIC changes for 6.7: - Purge VMX's posted interrupt descriptor *before* loading APIC state when handling KVM_SET_LAPIC. Purging the PID after loading APIC state results in lost APIC timer IRQs as the APIC timer can be armed as part of loading APIC state, i.e. can immediately pend an IRQ if the expiry is in the past. - Clear the ICR.BUSY bit when handling trap-like x2APIC writes. This avoids a WARN, due to KVM expecting the BUSY bit to be cleared when sending IPIs. commit 140139c5bd9f0f95706a6138fc41bfa59792695e Merge: 957eedc70350 70fea3019516 Author: Paolo Bonzini Date: Tue Oct 31 10:10:15 2023 -0400 Merge tag 'kvm-s390-next-6.7-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD - nested page table management performance counters commit 957eedc70350ad1b31aa76c4ed826372a46006fa Merge: ef12ea629e69 d9c00f44e5de Author: Paolo Bonzini Date: Tue Oct 31 10:09:39 2023 -0400 Merge tag 'kvm-riscv-6.7-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv changes for 6.7 - Smstateen and Zicond support for Guest/VM - Virtualized senvcfg CSR for Guest/VM - Added Smstateen registers to the get-reg-list selftests - Added Zicond to the get-reg-list selftests - Virtualized SBI debug console (DBCN) for Guest/VM - Added SBI debug console (DBCN) to the get-reg-list selftests commit a53e215f90079f617360439b1b6284820731e34c Author: Moshe Shemesh Date: Wed Oct 25 20:49:59 2023 +0300 RDMA/mlx5: Fix mkey cache WQ flush The cited patch tries to ensure no pending works on the mkey cache workqueue by disabling adding new works and call flush_workqueue(). But this workqueue also has delayed works which might still be pending the delay time to be queued. Add cancel_delayed_work() for the delayed works which waits to be queued and then the flush_workqueue() will flush all works which are already queued and running. Fixes: 374012b00457 ("RDMA/mlx5: Fix mkey cache possible deadlock on cleanup") Link: https://lore.kernel.org/r/b8722f14e7ed81452f791764a26d2ed4cfa11478.1698256179.git.leon@kernel.org Signed-off-by: Moshe Shemesh Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/mr.c | 2 ++ 1 file changed, 2 insertions(+) commit ef12ea629e69d12c8713218014bf569a788f17ae Merge: ffc253263a13 2c10cda4b777 Author: Paolo Bonzini Date: Tue Oct 31 09:55:40 2023 -0400 Merge tag 'loongarch-kvm-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson into HEAD LoongArch KVM changes for v6.7 Add LoongArch's KVM support. Loongson 3A5000/3A6000 supports hardware assisted virtualization. With cpu virtualization, there are separate hw-supported user mode and kernel mode in guest mode. With memory virtualization, there are two-level hw mmu table for guest mode and host mode. Also there is separate hw cpu timer with consant frequency in guest mode, so that vm can migrate between hosts with different freq. Currently, we are able to boot LoongArch Linux Guests. Few key aspects of KVM LoongArch added by this series are: 1. Enable kvm hardware function when kvm module is loaded. 2. Implement VM and vcpu related ioctl interface such as vcpu create, vcpu run etc. GET_ONE_REG/SET_ONE_REG ioctl commands are use to get general registers one by one. 3. Hardware access about MMU, timer and csr are emulated in kernel. 4. Hardwares such as mmio and iocsr device are emulated in user space such as IPI, irqchips, pci devices etc. commit 162e3480246ef69386d4647d2320d86741bf08a2 Merge: d4b2d165714c ffc253263a13 Author: Jason Gunthorpe Date: Tue Oct 31 10:54:48 2023 -0300 Merge tag 'v6.6' into rdma.git for-next Resolve conflict by taking the spin_lock hunk from for-next: https://lore.kernel.org/r/20230928113851.5197a1ec@canb.auug.org.au Required for the next patch. Signed-off-by: Jason Gunthorpe commit b836c4d29f2744200b2af41e14bf50758dddc818 Author: Mimi Zohar Date: Wed Oct 18 14:47:02 2023 -0400 ima: detect changes to the backing overlay file Commit 18b44bc5a672 ("ovl: Always reevaluate the file signature for IMA") forced signature re-evaulation on every file access. Instead of always re-evaluating the file's integrity, detect a change to the backing file, by comparing the cached file metadata with the backing file's metadata. Verifying just the i_version has not changed is insufficient. In addition save and compare the i_ino and s_dev as well. Reviewed-by: Amir Goldstein Tested-by: Eric Snowberg Tested-by: Raul E Rangel Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar fs/overlayfs/super.c | 2 +- security/integrity/ima/ima_api.c | 5 +++++ security/integrity/ima/ima_main.c | 16 +++++++++++++++- security/integrity/integrity.h | 2 ++ 4 files changed, 23 insertions(+), 2 deletions(-) commit b46503068cb9ed63ff1d8250f143354ead0b16eb Author: Mimi Zohar Date: Sun Oct 15 20:18:03 2023 -0400 certs: Only allow certs signed by keys on the builtin keyring Originally the secondary trusted keyring provided a keyring to which extra keys may be added, provided those keys were not blacklisted and were vouched for by a key built into the kernel or already in the secondary trusted keyring. On systems with the machine keyring configured, additional keys may also be vouched for by a key on the machine keyring. Prevent loading additional certificates directly onto the secondary keyring, vouched for by keys on the machine keyring, yet allow these certificates to be loaded onto other trusted keyrings. Reviewed-by: Jarkko Sakkinen Signed-off-by: Mimi Zohar certs/Kconfig | 16 +++++++++++++++- crypto/asymmetric_keys/restrict.c | 4 ++++ 2 files changed, 19 insertions(+), 1 deletion(-) commit 7b5c3086d1f85448a2a81947b685119c6c9894c8 Author: Prasad Pandit Date: Sun Oct 22 12:17:23 2023 +0530 integrity: fix indentation of config attributes Fix indentation of config attributes. Attributes are generally indented with a leading tab(\t) character. Signed-off-by: Prasad Pandit Signed-off-by: Mimi Zohar security/integrity/Kconfig | 44 ++++++++++++++++++++++---------------------- 1 file changed, 22 insertions(+), 22 deletions(-) commit e044374a8a0a99e46f4e6d6751d3042b6d9cc12e Author: Amir Goldstein Date: Thu Oct 5 14:15:58 2023 +0300 ima: annotate iint mutex to avoid lockdep false positive warnings It is not clear that IMA should be nested at all, but as long is it measures files both on overlayfs and on underlying fs, we need to annotate the iint mutex to avoid lockdep false positives related to IMA + overlayfs, same as overlayfs annotates the inode mutex. Reported-and-tested-by: syzbot+b42fe626038981fb7bfa@syzkaller.appspotmail.com Signed-off-by: Amir Goldstein Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar security/integrity/iint.c | 48 ++++++++++++++++++++++++++++++++++++----------- 1 file changed, 37 insertions(+), 11 deletions(-) commit 1a0ac8bd7a4fa5b2f4ef14c3b1e9d6e5a5faae06 Author: Gao Xiang Date: Tue Oct 31 14:05:24 2023 +0800 erofs: fix erofs_insert_workgroup() lockref usage As Linus pointed out [1], lockref_put_return() is fundamentally designed to be something that can fail. It behaves as a fastpath-only thing, and the failure case needs to be handled anyway. Actually, since the new pcluster was just allocated without being populated, it won't be accessed by others until it is inserted into XArray, so lockref helpers are actually unneeded here. Let's just set the proper reference count on initializing. [1] https://lore.kernel.org/r/CAHk-=whCga8BeQnJ3ZBh_Hfm9ctba_wpF444LpwRybVNMzO6Dw@mail.gmail.com Fixes: 7674a42f35ea ("erofs: use struct lockref to replace handcrafted approach") Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20231031060524.1103921-1-hsiangkao@linux.alibaba.com Signed-off-by: Gao Xiang fs/erofs/utils.c | 8 +------- fs/erofs/zdata.c | 1 + 2 files changed, 2 insertions(+), 7 deletions(-) commit acbc3ecb806e24eb9c0cafc29e0884490dda6169 Author: Paul E. McKenney Date: Thu Oct 5 10:17:47 2023 -0700 doc: Add /proc/bootconfig to proc.rst Add /proc/bootconfig description to Documentation/filesystems/proc.rst. Link: https://lore.kernel.org/all/20231005171747.541123-3-paulmck@kernel.org/ Reported-by: Masami Hiramatsu Signed-off-by: Paul E. McKenney Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) Documentation/filesystems/proc.rst | 5 +++++ 1 file changed, 5 insertions(+) commit 2dc15ff73b6a7b47db0e848498cb5b0479e781c6 Merge: c468b5dd759e bdb7e1922052 Author: Takashi Iwai Date: Tue Oct 31 09:01:25 2023 +0100 Merge tag 'asoc-v6.7-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v6.7 More updates for v6,7 following the early merge request: - Fixes for handling of component name prefixing when name prefixes are used by the machine driver. - Fixes for noise when stopping some Sounwire CODECs. - Support for AMD ACP 6.3 and 7.0, Awinc AW88399, more Intel platforms and more Qualcomm SC7180 platforms. commit c468b5dd759ede754b23cbc9c50b048a781d4217 Merge: 99248c8902f5 f71e0be5d297 Author: Takashi Iwai Date: Tue Oct 31 08:58:36 2023 +0100 Merge branch 'for-next' into for-linus Pull 6.7 materials Signed-off-by: Takashi Iwai commit 5a6a09e97199d6600d31383055f9d43fbbcbe86f Merge: 866b8870b6e6 a41796b5537d Author: Linus Torvalds Date: Mon Oct 30 20:58:48 2023 -1000 Merge tag 'cgroup-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: - cpuset now supports remote partitions where CPUs can be reserved for exclusive use down the tree without requiring all the intermediate nodes to be partitions. This makes it easier to use partitions without modifying existing cgroup hierarchy. - cpuset partition configuration behavior improvement - cgroup_favordynmods= boot param added to allow setting the flag on boot on cgroup1 - Misc code and doc updates * tag 'cgroup-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: docs/cgroup: Add the list of threaded controllers to cgroup-v2.rst cgroup: use legacy_name for cgroup v1 disable info cgroup/cpuset: Cleanup signedness issue in cpu_exclusive_check() cgroup/cpuset: Enable invalid to valid local partition transition cgroup: add cgroup_favordynmods= command-line option cgroup/cpuset: Extend test_cpuset_prs.sh to test remote partition cgroup/cpuset: Documentation update for partition cgroup/cpuset: Check partition conflict with housekeeping setup cgroup/cpuset: Introduce remote partition cgroup/cpuset: Add cpuset.cpus.exclusive for v2 cgroup/cpuset: Add cpuset.cpus.exclusive.effective for v2 cgroup/cpuset: Fix load balance state in update_partition_sd_lb() cgroup: Avoid extra dereference in css_populate_dir() cgroup: Check for ret during cgroup1_base_files cft addition commit 866b8870b6e6f478e9a1c51e732c9ba26dddbe91 Merge: 639409a4ac8e 265f3ed07703 Author: Linus Torvalds Date: Mon Oct 30 20:45:29 2023 -1000 Merge tag 'wq-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue update from Tejun Heo: "Just one commit to improve lockdep annotation for work_on_cpu() to avoid spurious warnings" * tag 'wq-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Provide one lock class key per work_on_cpu() callsite commit 639409a4ac8e1578ce34715338c6a4ddf9941294 Merge: 455cdcb45f8f 15b286d1fd05 Author: Linus Torvalds Date: Mon Oct 30 20:35:48 2023 -1000 Merge tag 'wq-for-6.7-rust-bindings' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue rust bindings from Tejun Heo: "Add rust bindings to allow rust code to schedule work items on workqueues. While the current bindings don't cover all of the workqueue API, it provides enough for basic usage and can be expanded as needed" * tag 'wq-for-6.7-rust-bindings' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: rust: workqueue: add examples rust: workqueue: add `try_spawn` helper method rust: workqueue: implement `WorkItemPointer` for pointer types rust: workqueue: add helper for defining work_struct fields rust: workqueue: define built-in queues rust: workqueue: add low-level workqueue bindings rust: sync: add `Arc::{from_raw, into_raw}` commit 455cdcb45f8fa9e7c70273e7bec0537ff02d5247 Merge: 2b93c2c3c02f 3857af38e57a Author: Linus Torvalds Date: Mon Oct 30 20:30:49 2023 -1000 Merge tag 'rust-6.7' of https://github.com/Rust-for-Linux/linux Pull rust updates from Miguel Ojeda: "A small one compared to the previous one in terms of features. In terms of lines, as usual, the 'alloc' version upgrade accounts for most of them. Toolchain and infrastructure: - Upgrade to Rust 1.73.0 This time around, due to how the kernel and Rust schedules have aligned, there are two upgrades in fact. They contain the fixes for a few issues we reported to the Rust project. In addition, a few cleanups indicated by the upgraded compiler or possible thanks to it. For instance, the compiler now detects redundant explicit links. - A couple changes to the Rust 'Makefile' so that it can be used with toybox tools, allowing Rust to be used in the Android kernel build. x86: - Enable IBT if enabled in C Documentation: - Add "The Rust experiment" section to the Rust index page MAINTAINERS: - Add Maintainer Entry Profile field ('P:'). - Update our 'W:' field to point to the webpage we have been building this year" * tag 'rust-6.7' of https://github.com/Rust-for-Linux/linux: docs: rust: add "The Rust experiment" section x86: Enable IBT in Rust if enabled in C rust: Use grep -Ev rather than relying on GNU grep rust: Use awk instead of recent xargs rust: upgrade to Rust 1.73.0 rust: print: use explicit link in documentation rust: task: remove redundant explicit link rust: kernel: remove `#[allow(clippy::new_ret_no_self)]` MAINTAINERS: add Maintainer Entry Profile field for Rust MAINTAINERS: update Rust webpage rust: upgrade to Rust 1.72.1 rust: arc: add explicit `drop()` around `Box::from_raw()` commit 2b93c2c3c02f4243d4c773b880fc86e2788f013d Merge: f5fc9e4a117d e50856067289 Author: Linus Torvalds Date: Mon Oct 30 20:13:17 2023 -1000 Merge tag 'lsm-pr-20231030' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull LSM updates from Paul Moore: - Add new credential functions, get_cred_many() and put_cred_many() to save some atomic_t operations for a few operations. While not strictly LSM related, this patchset had been rotting on the mailing lists for some time and since the LSMs do care a lot about credentials I thought it reasonable to give this patch a home. - Five patches to constify different LSM hook parameters. - Fix a spelling mistake. * tag 'lsm-pr-20231030' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: lsm: fix a spelling mistake cred: add get_cred_many and put_cred_many lsm: constify 'sb' parameter in security_sb_kern_mount() lsm: constify 'bprm' parameter in security_bprm_committed_creds() lsm: constify 'bprm' parameter in security_bprm_committing_creds() lsm: constify 'file' parameter in security_bprm_creds_from_file() lsm: constify 'sb' parameter in security_quotactl() commit f5fc9e4a117d4c118c95abb37e9d34d52b748c99 Merge: b9886c976668 19c1c9916dbf Author: Linus Torvalds Date: Mon Oct 30 19:47:06 2023 -1000 Merge tag 'selinux-pr-20231030' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: - improve the SELinux debugging configuration controls in Kconfig - print additional information about the hash table chain lengths when when printing SELinux debugging information - simplify the SELinux access vector hash table calcaulations - use a better hashing function for the SELinux role tansition hash table - improve SELinux load policy time through the use of optimized functions for calculating the number of bits set in a field - addition of a __counted_by annotation - simplify the avtab_inert_node() function through a simplified prototype * tag 'selinux-pr-20231030' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: simplify avtab_insert_node() prototype selinux: hweight optimization in avtab_read_item selinux: improve role transition hashing selinux: simplify avtab slot calculation selinux: improve debug configuration selinux: print sum of chain lengths^2 for hash tables selinux: Annotate struct sidtab_str_cache with __counted_by commit b9886c976668cae1614b46922b56f14b467da7be Merge: b9ff774548cd 47846d51348d Author: Linus Torvalds Date: Mon Oct 30 19:44:52 2023 -1000 Merge tag 'audit-pr-20231030' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit update from Paul Moore: "Only two audit patches for v6.7, both fairly small with a combined 11 lines of changes. The first patch is a simple __counted_by annontation, and the second fixes a a problem where audit could deadlock on task_lock() when an exe filter is configured. More information is available in the commit description and the patch is tagged for stable" * tag 'audit-pr-20231030' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: don't take task_lock() in audit_exe_compare() code path audit: Annotate struct audit_chunk with __counted_by commit b9ff774548cd91b45003b3b0d41f15cd52b25509 Merge: d82c0a37d431 03acb9ccec3f Author: Linus Torvalds Date: Mon Oct 30 19:41:52 2023 -1000 Merge tag 'tpmdd-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: "This is a small sized pull request. One commit I would like to pinpoint is my fix for init_trusted() rollback, as for actual patch I did not receive any feedback" * tag 'tpmdd-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: keys: Remove unused extern declarations integrity: powerpc: Do not select CA_MACHINE_KEYRING KEYS: trusted: tee: Refactor register SHM usage KEYS: trusted: Rollback init_trusted() consistently commit d82c0a37d431ada0d1dae9a2665fcfe17b0f9e14 Merge: 5e37269945b4 21ca59b365c0 Author: Linus Torvalds Date: Mon Oct 30 19:28:19 2023 -1000 Merge tag 'execve-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve updates from Kees Cook: - Support non-BSS ELF segments with zero filesz Eric Biederman and I refactored ELF segment loading to handle the case where a segment has a smaller filesz than memsz. Traditionally linkers only did this for .bss and it was always the last segment. As a result, the kernel only handled this case when it was the last segment. We've had two recent cases where linkers were trying to use these kinds of segments for other reasons, and the were in the middle of the segment list. There was no good reason for the kernel not to support this, and the refactor actually ends up making things more readable too. - Enable namespaced binfmt_misc Christian Brauner has made it possible to use binfmt_misc with mount namespaces. This means some traditionally root-only interfaces (for adding/removing formats) are now more exposed (but believed to be safe). - Remove struct tag 'dynamic' from ELF UAPI Alejandro Colomar noticed that the ELF UAPI has been polluting the struct namespace with an unused and overly generic tag named "dynamic" for no discernible reason for many many years. After double-checking various distro source repositories, it has been removed. - Clean up binfmt_elf_fdpic debug output (Greg Ungerer) * tag 'execve-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: binfmt_misc: enable sandboxed mounts binfmt_misc: cleanup on filesystem umount binfmt_elf_fdpic: clean up debug warnings mm: Remove unused vm_brk() binfmt_elf: Only report padzero() errors when PROT_WRITE binfmt_elf: Use elf_load() for library binfmt_elf: Use elf_load() for interpreter binfmt_elf: elf_bss no longer used by load_elf_binary() binfmt_elf: Support segments with 0 filesz and misaligned starts elf, uapi: Remove struct tag 'dynamic' commit 5e37269945b4d6117770666a40081848558f9501 Merge: befaa609f4c7 a19d48f7c5d5 Author: Linus Torvalds Date: Mon Oct 30 19:26:39 2023 -1000 Merge tag 'pstore-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore updates from Kees Cook: - Check for out-of-memory condition during initialization (Jiasheng Jiang) - Fix documentation typos (Tudor Ambarus) * tag 'pstore-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore/platform: Add check for kstrdup docs: pstore-blk.rst: fix typo, s/console/ftrace docs: pstore-blk.rst: use "about" as a preposition after "care" commit 7e6bd6409b66f57741dd69e0ee20f4ed4434b67c Author: Dave Airlie Date: Mon Oct 30 11:26:56 2023 +1000 nouveau/disp: fix post-gsp build on 32-bit arm. This converts a bunch of divides into the proper macros. Reviewed-by: Danilo Krummrich Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20231030012814.1208972-2-airlied@gmail.com drivers/gpu/drm/nouveau/dispnv50/disp.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) commit b76827a3a930fe8737ca64854e17c113687e94a9 Author: Dave Airlie Date: Mon Oct 30 11:26:17 2023 +1000 nouveau: fix r535 build on 32-bit arm. This needs the proper division macros. Reviewed-by: Danilo Krummrich Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20231030012814.1208972-1-airlied@gmail.com drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit befaa609f4c784f505c02ea3ff036adf4f4aa814 Merge: fdce8bd38037 9cca73d7b4bf Author: Linus Torvalds Date: Mon Oct 30 19:09:55 2023 -1000 Merge tag 'hardening-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: "One of the more voluminous set of changes is for adding the new __counted_by annotation[1] to gain run-time bounds checking of dynamically sized arrays with UBSan. - Add LKDTM test for stuck CPUs (Mark Rutland) - Improve LKDTM selftest behavior under UBSan (Ricardo Cañuelo) - Refactor more 1-element arrays into flexible arrays (Gustavo A. R. Silva) - Analyze and replace strlcpy and strncpy uses (Justin Stitt, Azeem Shaikh) - Convert group_info.usage to refcount_t (Elena Reshetova) - Add __counted_by annotations (Kees Cook, Gustavo A. R. Silva) - Add Kconfig fragment for basic hardening options (Kees Cook, Lukas Bulwahn) - Fix randstruct GCC plugin performance mode to stay in groups (Kees Cook) - Fix strtomem() compile-time check for small sources (Kees Cook)" * tag 'hardening-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (56 commits) hwmon: (acpi_power_meter) replace open-coded kmemdup_nul reset: Annotate struct reset_control_array with __counted_by kexec: Annotate struct crash_mem with __counted_by virtio_console: Annotate struct port_buffer with __counted_by ima: Add __counted_by for struct modsig and use struct_size() MAINTAINERS: Include stackleak paths in hardening entry string: Adjust strtomem() logic to allow for smaller sources hardening: x86: drop reference to removed config AMD_IOMMU_V2 randstruct: Fix gcc-plugin performance mode to stay in group mailbox: zynqmp: Annotate struct zynqmp_ipi_pdata with __counted_by drivers: thermal: tsens: Annotate struct tsens_priv with __counted_by irqchip/imx-intmux: Annotate struct intmux_data with __counted_by KVM: Annotate struct kvm_irq_routing_table with __counted_by virt: acrn: Annotate struct vm_memory_region_batch with __counted_by hwmon: Annotate struct gsc_hwmon_platform_data with __counted_by sparc: Annotate struct cpuinfo_tree with __counted_by isdn: kcapi: replace deprecated strncpy with strscpy_pad isdn: replace deprecated strncpy with strscpy NFS/flexfiles: Annotate struct nfs4_ff_layout_segment with __counted_by nfs41: Annotate struct nfs4_file_layout_dsaddr with __counted_by ... commit 015185cc670e8cb3325990dd41b1ddb502dd3a36 Author: Ben Skeggs Date: Tue Sep 19 06:21:49 2023 +1000 drm/nouveau/ofa/r535: initial support Adds support for allocating OFA classes from RM. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-45-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvif/cl0080.h | 1 + drivers/gpu/drm/nouveau/include/nvif/class.h | 4 + drivers/gpu/drm/nouveau/include/nvkm/engine/ofa.h | 9 ++ .../nvrm/535.54.03/common/sdk/nvidia/inc/nvos.h | 6 ++ .../nvidia/inc/kernel/gpu/intr/engine_idx.h | 2 + drivers/gpu/drm/nouveau/nvkm/engine/Kbuild | 1 + drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 11 +++ drivers/gpu/drm/nouveau/nvkm/engine/device/priv.h | 1 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/ofa/Kbuild | 6 ++ drivers/gpu/drm/nouveau/nvkm/engine/ofa/ad102.c | 44 +++++++++ drivers/gpu/drm/nouveau/nvkm/engine/ofa/ga100.c | 44 +++++++++ drivers/gpu/drm/nouveau/nvkm/engine/ofa/ga102.c | 44 +++++++++ drivers/gpu/drm/nouveau/nvkm/engine/ofa/priv.h | 8 ++ drivers/gpu/drm/nouveau/nvkm/engine/ofa/r535.c | 107 +++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 4 + 17 files changed, 294 insertions(+) commit ca9686340aba42e8316202c428ef76a304bed75a Author: Ben Skeggs Date: Tue Sep 19 06:21:48 2023 +1000 drm/nouveau/nvjpg/r535: initial support Adds support for allocating NVJPG classes from RM. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-44-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvif/cl0080.h | 1 + drivers/gpu/drm/nouveau/include/nvif/class.h | 3 + .../gpu/drm/nouveau/include/nvkm/engine/nvjpg.h | 8 ++ .../nvrm/535.54.03/common/sdk/nvidia/inc/nvos.h | 7 ++ .../nvidia/inc/kernel/gpu/intr/engine_idx.h | 5 + drivers/gpu/drm/nouveau/nvkm/engine/Kbuild | 1 + drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 6 ++ drivers/gpu/drm/nouveau/nvkm/engine/device/priv.h | 1 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/nvjpg/Kbuild | 5 + drivers/gpu/drm/nouveau/nvkm/engine/nvjpg/ad102.c | 44 +++++++++ drivers/gpu/drm/nouveau/nvkm/engine/nvjpg/ga100.c | 44 +++++++++ drivers/gpu/drm/nouveau/nvkm/engine/nvjpg/priv.h | 8 ++ drivers/gpu/drm/nouveau/nvkm/engine/nvjpg/r535.c | 107 +++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 4 + 16 files changed, 246 insertions(+) commit 08ab88f5a033c67625272eda99de4d245809e0f6 Author: Ben Skeggs Date: Tue Sep 19 06:21:47 2023 +1000 drm/nouveau/nvenc/r535: initial support Adds support for allocating VIDEO_ENCODER classes from RM. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-43-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvif/class.h | 4 + .../gpu/drm/nouveau/include/nvkm/engine/nvenc.h | 2 + .../nvrm/535.54.03/common/sdk/nvidia/inc/nvos.h | 7 ++ .../nvidia/inc/kernel/gpu/intr/engine_idx.h | 4 + drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 10 ++ drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/nvenc/Kbuild | 4 + drivers/gpu/drm/nouveau/nvkm/engine/nvenc/ad102.c | 44 +++++++++ drivers/gpu/drm/nouveau/nvkm/engine/nvenc/ga102.c | 44 +++++++++ drivers/gpu/drm/nouveau/nvkm/engine/nvenc/priv.h | 3 + drivers/gpu/drm/nouveau/nvkm/engine/nvenc/r535.c | 110 +++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/engine/nvenc/tu102.c | 12 ++- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 4 + 13 files changed, 248 insertions(+), 1 deletion(-) commit 142cd60243cac1dfa18d3714ed4dd0cdc3786180 Author: Ben Skeggs Date: Tue Sep 19 06:21:46 2023 +1000 drm/nouveau/nvdec/r535: initial support Adds support for allocating VIDEO_DECODER classes from RM. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-42-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvif/class.h | 5 + .../gpu/drm/nouveau/include/nvkm/engine/nvdec.h | 2 + .../nvidia/inc/ctrl/ctrl2080/ctrl2080internal.h | 16 +++ .../nvrm/535.54.03/common/sdk/nvidia/inc/nvos.h | 7 ++ .../nvidia/inc/kernel/gpu/intr/engine_idx.h | 6 ++ drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 6 ++ drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c | 91 ++++++++++++++++- drivers/gpu/drm/nouveau/nvkm/engine/fifo/runl.h | 5 + drivers/gpu/drm/nouveau/nvkm/engine/nvdec/Kbuild | 4 + drivers/gpu/drm/nouveau/nvkm/engine/nvdec/ad102.c | 44 +++++++++ drivers/gpu/drm/nouveau/nvkm/engine/nvdec/ga100.c | 44 +++++++++ drivers/gpu/drm/nouveau/nvkm/engine/nvdec/ga102.c | 14 ++- drivers/gpu/drm/nouveau/nvkm/engine/nvdec/priv.h | 5 + drivers/gpu/drm/nouveau/nvkm/engine/nvdec/r535.c | 110 +++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/engine/nvdec/tu102.c | 12 ++- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 4 + 16 files changed, 370 insertions(+), 5 deletions(-) commit 361c3cd8ae1277e601ab6e547cc62368dc5499a7 Author: Ben Skeggs Date: Tue Sep 19 06:21:45 2023 +1000 drm/nouveau/gr/r535: initial support Adds support for allocating GR classes from RM. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-41-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvif/class.h | 3 + drivers/gpu/drm/nouveau/include/nvkm/engine/fifo.h | 1 + drivers/gpu/drm/nouveau/include/nvkm/engine/gr.h | 1 + drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h | 5 + .../sdk/nvidia/inc/ctrl/ctrl0080/ctrl0080fifo.h | 57 +++ .../sdk/nvidia/inc/ctrl/ctrl2080/ctrl2080gpu.h | 42 ++ .../nvidia/inc/ctrl/ctrl2080/ctrl2080internal.h | 19 + .../nvidia/inc/kernel/gpu/intr/engine_idx.h | 3 + drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 5 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c | 34 ++ drivers/gpu/drm/nouveau/nvkm/engine/gr/Kbuild | 3 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ad102.c | 46 ++ drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.h | 2 + drivers/gpu/drm/nouveau/nvkm/engine/gr/r535.c | 508 +++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/engine/gr/tu102.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 11 + 17 files changed, 742 insertions(+), 2 deletions(-) commit b5ce219ab368bbb430f9f59a3e0b8f05bc7354ae Author: Ben Skeggs Date: Tue Sep 19 06:21:44 2023 +1000 drm/nouveau/ce/r535: initial support Adds support for allocating DMA_COPY classes from RM. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-40-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvkm/engine/fifo.h | 2 + .../common/sdk/nvidia/inc/class/clc0b5sw.h | 34 +++++++ .../nvidia/inc/kernel/gpu/intr/engine_idx.h | 4 + drivers/gpu/drm/nouveau/nvkm/engine/ce/Kbuild | 2 + drivers/gpu/drm/nouveau/nvkm/engine/ce/ga100.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/ce/ga102.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/ce/priv.h | 3 + drivers/gpu/drm/nouveau/nvkm/engine/ce/r535.c | 108 +++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/engine/ce/tu102.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 5 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c | 19 ++++ drivers/gpu/drm/nouveau/nvkm/engine/fifo/uchan.c | 9 ++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 4 + 13 files changed, 193 insertions(+), 3 deletions(-) commit 2a77d015b538866d6fbc90681e8da2dc7c5ff90b Author: Ben Skeggs Date: Tue Sep 19 06:21:43 2023 +1000 drm/nouveau/fifo/r535: initial support - Adds support for allocating CHANNEL_GPFIFO classes from RM. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-39-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvkm/engine/fifo.h | 13 + .../common/sdk/nvidia/inc/alloc/alloc_channel.h | 161 +++++++ .../sdk/nvidia/inc/class/cl2080_notification.h | 20 + .../sdk/nvidia/inc/ctrl/ctrl2080/ctrl2080ce.h | 35 ++ .../sdk/nvidia/inc/ctrl/ctrl2080/ctrl2080fifo.h | 52 +++ .../sdk/nvidia/inc/ctrl/ctrla06f/ctrla06fgpfifo.h | 42 ++ .../535.54.03/common/sdk/nvidia/inc/nvlimits.h | 2 + .../nvidia/generated/g_kernel_channel_nvoc.h | 62 +++ .../nvidia/generated/g_kernel_fifo_nvoc.h | 119 +++++ .../535.54.03/nvidia/generated/g_rpc-structures.h | 9 + drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 5 + drivers/gpu/drm/nouveau/nvkm/engine/falcon.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/fifo/Kbuild | 2 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/fifo/priv.h | 2 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c | 519 +++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/engine/fifo/tu102.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 30 ++ 19 files changed, 1079 insertions(+), 6 deletions(-) commit 9e99444490238d210a421cef3598432c5da2e086 Author: Ben Skeggs Date: Tue Sep 19 06:21:42 2023 +1000 drm/nouveau/disp/r535: initial support Adds support for modesetting on RM. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-38-skeggsb@gmail.com drivers/gpu/drm/nouveau/dispnv50/core.c | 1 + drivers/gpu/drm/nouveau/dispnv50/disp.c | 141 ++ drivers/gpu/drm/nouveau/include/nvif/class.h | 2 + drivers/gpu/drm/nouveau/include/nvkm/engine/disp.h | 19 + drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h | 35 + .../535.54.03/common/sdk/nvidia/inc/class/cl0005.h | 38 + .../sdk/nvidia/inc/class/cl2080_notification.h | 42 + .../sdk/nvidia/inc/ctrl/ctrl0073/ctrl0073common.h | 39 + .../sdk/nvidia/inc/ctrl/ctrl0073/ctrl0073dfp.h | 166 ++ .../sdk/nvidia/inc/ctrl/ctrl0073/ctrl0073dp.h | 335 ++++ .../nvidia/inc/ctrl/ctrl0073/ctrl0073specific.h | 216 +++ .../sdk/nvidia/inc/ctrl/ctrl0073/ctrl0073system.h | 34 + .../sdk/nvidia/inc/ctrl/ctrl2080/ctrl2080event.h | 41 + .../nvidia/inc/ctrl/ctrl2080/ctrl2080internal.h | 43 + .../nvrm/535.54.03/common/sdk/nvidia/inc/nvos.h | 27 + .../nvrm/535.54.03/nvidia/generated/g_allclasses.h | 33 + .../535.54.03/nvidia/generated/g_mem_desc_nvoc.h | 32 + .../535.54.03/nvidia/generated/g_rpc-structures.h | 13 + .../nvidia/inc/kernel/gpu/intr/engine_idx.h | 2 + .../nvidia/inc/kernel/os/nv_memory_type.h | 31 + drivers/gpu/drm/nouveau/nvif/disp.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 10 + drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild | 3 + drivers/gpu/drm/nouveau/nvkm/engine/disp/ad102.c | 52 + drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c | 3 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/chan.h | 4 + drivers/gpu/drm/nouveau/nvkm/engine/disp/ga102.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/gv100.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h | 2 + drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c | 3 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/priv.h | 3 + drivers/gpu/drm/nouveau/nvkm/engine/disp/r535.c | 1671 ++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/engine/disp/tu102.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/uconn.c | 31 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 129 ++ 35 files changed, 3202 insertions(+), 8 deletions(-) commit 5bf0257136a223d0e887441799527b320fc8313f Author: Ben Skeggs Date: Tue Sep 19 06:21:41 2023 +1000 drm/nouveau/mmu/r535: initial support - Valid VRAM regions are read from GSP-RM, and used to construct our MM - BAR1/BAR2 VMMs modified to be shared with RM - Client VMMs have RM VASPACE objects created for them - Adds FBSR to backup system objects in VRAM across suspend Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-37-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvkm/subdev/bar.h | 4 + drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h | 12 + .../gpu/drm/nouveau/include/nvkm/subdev/instmem.h | 5 + drivers/gpu/drm/nouveau/include/nvkm/subdev/mmu.h | 11 + .../535.54.03/common/sdk/nvidia/inc/class/cl84a0.h | 33 ++ .../535.54.03/common/sdk/nvidia/inc/class/cl90f1.h | 31 ++ .../nvidia/inc/ctrl/ctrl2080/ctrl2080internal.h | 22 ++ .../common/sdk/nvidia/inc/ctrl/ctrl90f1.h | 95 ++++++ .../nvrm/535.54.03/common/sdk/nvidia/inc/nvos.h | 94 ++++++ .../nvrm/535.54.03/nvidia/generated/g_fbsr_nvoc.h | 31 ++ .../535.54.03/nvidia/generated/g_rpc-structures.h | 20 ++ .../535.54.03/nvidia/generated/g_sdk-structures.h | 8 + .../535.54.03/nvidia/kernel/inc/vgpu/rpc_headers.h | 7 + .../nvidia/kernel/inc/vgpu/sdk-structures.h | 40 +++ drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 20 ++ drivers/gpu/drm/nouveau/nvkm/subdev/bar/Kbuild | 2 + drivers/gpu/drm/nouveau/nvkm/subdev/bar/priv.h | 3 + drivers/gpu/drm/nouveau/nvkm/subdev/bar/r535.c | 186 ++++++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/bar/tu102.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/fb/r535.c | 37 +++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 47 +++ drivers/gpu/drm/nouveau/nvkm/subdev/instmem/Kbuild | 2 + drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/instmem/priv.h | 3 + drivers/gpu/drm/nouveau/nvkm/subdev/instmem/r535.c | 333 +++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/mmu/Kbuild | 2 + drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c | 4 + drivers/gpu/drm/nouveau/nvkm/subdev/mmu/priv.h | 6 + drivers/gpu/drm/nouveau/nvkm/subdev/mmu/r535.c | 123 ++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/mmu/tu102.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/mmu/uvmm.c | 6 + drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c | 7 + drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c | 5 +- 33 files changed, 1201 insertions(+), 4 deletions(-) commit 830531e94712973af2eee1c0b731de8426aa5b70 Author: Ben Skeggs Date: Tue Sep 19 06:21:40 2023 +1000 drm/nouveau/gsp/r535: add interrupt handling Fetches the interrupt table from RM, and hooks up the GSP interrupt handler to message queue processing to catch async messages. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-36-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvkm/core/falcon.h | 3 + .../gpu/drm/nouveau/include/nvkm/engine/falcon.h | 2 + drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h | 12 +++ .../nvidia/inc/ctrl/ctrl2080/ctrl2080internal.h | 62 ++++++++++++ .../nvidia/inc/kernel/gpu/intr/engine_idx.h | 31 ++++++ drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 5 + drivers/gpu/drm/nouveau/nvkm/falcon/base.c | 7 ++ drivers/gpu/drm/nouveau/nvkm/falcon/ga100.c | 6 ++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c | 30 ++++++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/ga100.c | 19 +++- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/ga102.c | 2 + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 112 +++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/tu102.c | 1 + 13 files changed, 291 insertions(+), 1 deletion(-) commit 37e328a17c1f4f6dded7354fd9afa1fa5c74854a Author: Ben Skeggs Date: Tue Sep 19 06:21:39 2023 +1000 drm/nouveau/gsp/r535: add support for rm alloc Adds the plumbing to be able to allocate and free RM objects, and implements RM client/device/subdevice allocation with it. These will be used by subsequent patches. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-35-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h | 131 +++++++++++++++ .../535.54.03/common/sdk/nvidia/inc/class/cl0000.h | 38 +++++ .../535.54.03/common/sdk/nvidia/inc/class/cl0080.h | 43 +++++ .../535.54.03/common/sdk/nvidia/inc/class/cl2080.h | 35 ++++ .../535.54.03/common/sdk/nvidia/inc/nvlimits.h | 31 ++++ .../535.54.03/nvidia/generated/g_rpc-structures.h | 19 +++ .../535.54.03/nvidia/generated/g_sdk-structures.h | 37 +++++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 184 +++++++++++++++++++++ 8 files changed, 518 insertions(+) commit 4cf2c83eb3a4c42aebe31f4767c3db5788d362ea Author: Ben Skeggs Date: Tue Sep 19 06:21:38 2023 +1000 drm/nouveau/gsp/r535: add support for rm control Adds the plumbing to start making RM control calls, and initialises objects to represent internal RM objects provided to us during init. These will be used by subsequent patches. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-34-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h | 62 +++++++++++++ .../sdk/nvidia/inc/ctrl/ctrl0080/ctrl0080gpu.h | 48 ++++++++++ .../sdk/nvidia/inc/ctrl/ctrl0080/ctrl0080gr.h | 31 +++++++ .../sdk/nvidia/inc/ctrl/ctrl2080/ctrl2080bios.h | 40 ++++++++ .../sdk/nvidia/inc/ctrl/ctrl2080/ctrl2080fb.h | 51 +++++++++++ .../sdk/nvidia/inc/ctrl/ctrl2080/ctrl2080gpu.h | 25 +++++ .../sdk/nvidia/inc/ctrl/ctrl2080/ctrl2080gr.h | 41 +++++++++ .../nvrm/535.54.03/nvidia/generated/g_gpu_nvoc.h | 35 +++++++ .../535.54.03/nvidia/generated/g_rpc-structures.h | 11 +++ .../nvidia/inc/kernel/gpu/gpu_engine_type.h | 86 ++++++++++++++++++ .../nvidia/inc/kernel/gpu/gsp/gsp_static_config.h | 100 ++++++++++++++++++++ .../535.54.03/nvidia/inc/kernel/gpu/nvbitmask.h | 33 +++++++ .../535.54.03/nvidia/kernel/inc/vgpu/rpc_headers.h | 44 +++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 101 +++++++++++++++++++++ 14 files changed, 708 insertions(+) commit 176fdcbddfd288408ce8571c1760ad618d962096 Author: Ben Skeggs Date: Tue Sep 19 06:21:37 2023 +1000 drm/nouveau/gsp/r535: add support for booting GSP-RM This commit adds the initial code needed to boot the GSP-RM firmware provided by NVIDIA, bringing with it the beginnings of Ada support. Until it's had more testing and time to bake, support is disabled by default (except on Ada). GSP-RM usage can be enabled by passing the "config=NvGspRm=1" module option. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-33-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvif/cl0080.h | 1 + drivers/gpu/drm/nouveau/include/nvkm/core/device.h | 1 + drivers/gpu/drm/nouveau/include/nvkm/core/falcon.h | 4 + .../gpu/drm/nouveau/include/nvkm/engine/falcon.h | 2 + drivers/gpu/drm/nouveau/include/nvkm/subdev/bios.h | 1 + drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h | 171 ++- .../sdk/nvidia/inc/ctrl/ctrl0073/ctrl0073system.h | 31 + .../sdk/nvidia/inc/ctrl/ctrl2080/ctrl2080gpu.h | 33 + .../common/shared/msgq/inc/msgq/msgq_priv.h | 46 + .../uproc/os/common/include/libos_init_args.h | 52 + .../arch/nvalloc/common/inc/gsp/gsp_fw_sr_meta.h | 79 + .../arch/nvalloc/common/inc/gsp/gsp_fw_wpr_meta.h | 149 ++ .../nvidia/arch/nvalloc/common/inc/rmRiscvUcode.h | 82 + .../nvidia/arch/nvalloc/common/inc/rmgspseq.h | 100 ++ .../535.54.03/nvidia/generated/g_chipset_nvoc.h | 38 + .../nvrm/535.54.03/nvidia/generated/g_os_nvoc.h | 44 + .../535.54.03/nvidia/generated/g_rpc-structures.h | 52 + .../nvidia/inc/kernel/gpu/gpu_acpi_data.h | 74 + .../nvidia/inc/kernel/gpu/gsp/gsp_fw_heap.h | 33 + .../nvidia/inc/kernel/gpu/gsp/gsp_init_args.h | 57 + .../nvidia/inc/kernel/gpu/gsp/gsp_static_config.h | 74 + .../nvidia/kernel/inc/vgpu/rpc_global_enums.h | 262 ++++ drivers/gpu/drm/nouveau/include/nvrm/nvtypes.h | 24 + drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 66 + drivers/gpu/drm/nouveau/nvkm/engine/device/user.c | 1 + drivers/gpu/drm/nouveau/nvkm/falcon/Kbuild | 1 + drivers/gpu/drm/nouveau/nvkm/falcon/base.c | 9 + drivers/gpu/drm/nouveau/nvkm/falcon/ga102.c | 6 + drivers/gpu/drm/nouveau/nvkm/falcon/tu102.c | 28 + drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c | 8 + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/Kbuild | 5 + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/ad102.c | 57 + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c | 1 + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/fwsec.c | 359 +++++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/ga100.c | 22 + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/ga102.c | 138 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/priv.h | 42 + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 1561 ++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/tu102.c | 162 ++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/tu116.c | 22 + 40 files changed, 3896 insertions(+), 2 deletions(-) commit 17a74021a339a4d4bd27be1dd95b99442455a4ad Author: Ben Skeggs Date: Tue Sep 19 06:21:36 2023 +1000 drm/nouveau/nvkm: support loading fws into sg_table - preparation for GSP-RM, which has massive FW images - based on a patch by Dave Airlie Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-32-skeggsb@gmail.com .../gpu/drm/nouveau/include/nvkm/core/firmware.h | 6 +- drivers/gpu/drm/nouveau/nvkm/core/firmware.c | 74 +++++++++++++++++++++- 2 files changed, 76 insertions(+), 4 deletions(-) commit e672f5f30dd37460702ea7797d3d4591f8b5773c Author: Ben Skeggs Date: Tue Sep 19 06:21:35 2023 +1000 drm/nouveau/kms/tu102-: disable vbios parsing when running on RM - on HW, parts of this will still be used to support LVDS - LVDS appears to have dissapeared before Turing, so this won't be needed at all when running on RM Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-31-skeggsb@gmail.com drivers/gpu/drm/nouveau/nouveau_bios.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit f4032134b4612b8f40e793e2cf5be2e0a317f4c9 Author: Ben Skeggs Date: Tue Sep 19 06:21:34 2023 +1000 drm/nouveau/sec2/tu102-: prepare for GSP-RM - add (initial) R535 implementation of SEC2, needed for boot Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-30-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/engine/sec2/Kbuild | 2 + drivers/gpu/drm/nouveau/nvkm/engine/sec2/ga102.c | 8 +++- drivers/gpu/drm/nouveau/nvkm/engine/sec2/priv.h | 3 ++ drivers/gpu/drm/nouveau/nvkm/engine/sec2/r535.c | 54 ++++++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/engine/sec2/tu102.c | 8 +++- 5 files changed, 73 insertions(+), 2 deletions(-) commit 47c9136b0dae802b0e44412cea97e8a47ae6f0ec Author: Ben Skeggs Date: Tue Sep 19 06:21:33 2023 +1000 drm/nouveau/nvenc/tu102-: prepare for GSP-RM - (temporarily) disable if GSP-RM detected, will be added later - provide empty class list for non-GSP paths - split tu102 from gm107, it will provide host classes later Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-29-skeggsb@gmail.com .../gpu/drm/nouveau/include/nvkm/engine/nvenc.h | 1 + drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 10 +++---- drivers/gpu/drm/nouveau/nvkm/engine/nvenc/Kbuild | 1 + drivers/gpu/drm/nouveau/nvkm/engine/nvenc/base.c | 3 +- drivers/gpu/drm/nouveau/nvkm/engine/nvenc/gm107.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/nvenc/priv.h | 2 ++ drivers/gpu/drm/nouveau/nvkm/engine/nvenc/tu102.c | 34 ++++++++++++++++++++++ 7 files changed, 46 insertions(+), 7 deletions(-) commit 796928c6592722321324c02111590a39307b1d94 Author: Ben Skeggs Date: Tue Sep 19 06:21:32 2023 +1000 drm/nouveau/nvdec/tu102-: prepare for GSP-RM - (temporarily) disable if GSP-RM detected, will be added later - provide empty class list for non-GSP paths - split tu102- from gm107, they will provide host classes later - fixup HW engine instance masks Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-28-skeggsb@gmail.com .../gpu/drm/nouveau/include/nvkm/engine/nvdec.h | 1 + drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 20 ++++++------- drivers/gpu/drm/nouveau/nvkm/engine/nvdec/Kbuild | 1 + drivers/gpu/drm/nouveau/nvkm/engine/nvdec/base.c | 3 +- drivers/gpu/drm/nouveau/nvkm/engine/nvdec/ga102.c | 4 +++ drivers/gpu/drm/nouveau/nvkm/engine/nvdec/gm107.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/nvdec/priv.h | 2 ++ drivers/gpu/drm/nouveau/nvkm/engine/nvdec/tu102.c | 34 ++++++++++++++++++++++ 8 files changed, 55 insertions(+), 12 deletions(-) commit a6f992a83f0d7ae8ef9355bcd12cc0baa9d49f2f Author: Ben Skeggs Date: Tue Sep 19 06:21:31 2023 +1000 drm/nouveau/gr/tu102-: prepare for GSP-RM - (temporarily) disable if GSP-RM detected, will be added later - make init() optional Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-27-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/engine/gr/base.c | 6 +++++- drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c | 4 ++++ drivers/gpu/drm/nouveau/nvkm/engine/gr/tu102.c | 5 +++++ 3 files changed, 14 insertions(+), 1 deletion(-) commit da1fbcc09e0fec7ad8981b56d2f7634bc8241742 Author: Ben Skeggs Date: Tue Sep 19 06:21:30 2023 +1000 drm/nouveau/fifo/tu102-: prepare for GSP-RM - (temporarily) disable if GSP-RM detected, will be added later - add dtor() so GSP-RM paths can cleanup properly - add alternate engine context mapping interface for RM engines - add alternate chid interfaces to handle RM USERD oddities Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-26-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvkm/engine/fifo.h | 3 ++ drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.c | 9 ++++ drivers/gpu/drm/nouveau/nvkm/engine/fifo/cgrp.c | 3 ++ drivers/gpu/drm/nouveau/nvkm/engine/fifo/chan.c | 55 +++++++++++++--------- drivers/gpu/drm/nouveau/nvkm/engine/fifo/chan.h | 3 ++ drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c | 4 ++ drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c | 5 ++ drivers/gpu/drm/nouveau/nvkm/engine/fifo/priv.h | 2 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/runl.h | 1 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/tu102.c | 4 ++ 10 files changed, 67 insertions(+), 22 deletions(-) commit 8c186c83f995d81bf5761c30872e5fc525feb84f Author: Ben Skeggs Date: Tue Sep 19 06:21:29 2023 +1000 drm/nouveau/disp/tu102-: prepare for GSP-RM - (temporarily) disable if GSP-RM detected, will be added later - pass "suspend" flag down to chipset-specific DISP code Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-25-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c | 5 ++++- drivers/gpu/drm/nouveau/nvkm/engine/disp/ga102.c | 4 ++++ drivers/gpu/drm/nouveau/nvkm/engine/disp/gf119.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/gv100.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/priv.h | 11 ++++++----- drivers/gpu/drm/nouveau/nvkm/engine/disp/tu102.c | 4 ++++ 7 files changed, 21 insertions(+), 9 deletions(-) commit 0e55453fc8ab1dac5b3dc8b2de55789009f175b1 Author: Ben Skeggs Date: Tue Sep 19 06:21:28 2023 +1000 drm/nouveau/ce/tu102-: prepare for GSP-RM - (temporarily) disable if GSP-RM detected, will be added later Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-24-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/engine/ce/ga100.c | 4 ++++ drivers/gpu/drm/nouveau/nvkm/engine/ce/ga102.c | 5 +++++ drivers/gpu/drm/nouveau/nvkm/engine/ce/tu102.c | 5 +++++ 3 files changed, 14 insertions(+) commit 426cce57053c5504f24d09db99cb3d500bf3e2ba Author: Ben Skeggs Date: Tue Sep 19 06:21:27 2023 +1000 drm/nouveau/vfn/tu102-: prepare for GSP-RM - add R535 implementation of VFN, minus interrupt table Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-23-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/vfn/Kbuild | 2 + drivers/gpu/drm/nouveau/nvkm/subdev/vfn/ga100.c | 5 +++ drivers/gpu/drm/nouveau/nvkm/subdev/vfn/priv.h | 7 +++- drivers/gpu/drm/nouveau/nvkm/subdev/vfn/r535.c | 50 +++++++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/vfn/tu102.c | 5 +++ 5 files changed, 68 insertions(+), 1 deletion(-) commit d4c9cd346fcb3d61fa975a98746dc1ccd93482c6 Author: Ben Skeggs Date: Tue Sep 19 06:21:26 2023 +1000 drm/nouveau/top/tu102-: prepare for GSP-RM - disable TOP completely when GSP-RM detected Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-22-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/top/ga100.c | 5 +++++ drivers/gpu/drm/nouveau/nvkm/subdev/top/gk104.c | 5 +++++ 2 files changed, 10 insertions(+) commit f2b76a18251d08aae035288190c562b28da9bf35 Author: Ben Skeggs Date: Tue Sep 19 06:21:25 2023 +1000 drm/nouveau/therm/tu102-: prepare for GSP-RM - disable THERM completely when GSP-RM detected Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-21-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/therm/gp100.c | 5 +++++ 1 file changed, 5 insertions(+) commit fd7d598270724cc787982ea48bbe17ad383a8b7f Author: Ben Skeggs Date: Tue Sep 19 06:21:24 2023 +1000 drm/nouveau/privring/tu102-: prepare for GSP-RM - disable PRIVRING completely when GSP-RM detected Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-20-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/privring/gm200.c | 5 +++++ 1 file changed, 5 insertions(+) commit ab724be7a3d9ae47e80938ad00b111a62bf4266b Author: Ben Skeggs Date: Tue Sep 19 06:21:23 2023 +1000 drm/nouveau/pmu/tu102-: prepare for GSP-RM - disable PMU completely when GSP-RM detected Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-19-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp102.c | 5 +++++ 1 file changed, 5 insertions(+) commit f5a533a81e51d963bd267acc08dd1924bd93503e Author: Ben Skeggs Date: Tue Sep 19 06:21:22 2023 +1000 drm/nouveau/mmu/tu102-: prepare for GSP-RM - (temporarily) disable if GSP-RM detected, will be added later Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-18-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/mmu/tu102.c | 4 ++++ 1 file changed, 4 insertions(+) commit 3cd7924e0eddfd525ea532397932005d0ff2686b Author: Ben Skeggs Date: Tue Sep 19 06:21:21 2023 +1000 drm/nouveau/mc/tu102-: prepare for GSP-RM - disable MC completely when GSP-RM detected Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-17-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/mc/ga100.c | 5 +++++ drivers/gpu/drm/nouveau/nvkm/subdev/mc/gp100.c | 5 +++++ 2 files changed, 10 insertions(+) commit 1dc750dab1b14ac526c5192964176e756770a33d Author: Ben Skeggs Date: Tue Sep 19 06:21:20 2023 +1000 drm/nouveau/ltc/tu102-: prepare for GSP-RM - disable LTC completely when GSP-RM detected Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-16-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/ltc/ga102.c | 5 +++++ drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gp102.c | 5 +++++ 2 files changed, 10 insertions(+) commit 624c6f78cc8d9d1a87eeb4d905f231ea128f4a4f Author: Ben Skeggs Date: Tue Sep 19 06:21:19 2023 +1000 drm/nouveau/imem/tu102-: prepare for GSP-RM - move suspend/resume paths to HW-specific code - allow (future) RM paths to be based on nv50_instmem Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-15-skeggsb@gmail.com .../gpu/drm/nouveau/include/nvkm/subdev/instmem.h | 2 + drivers/gpu/drm/nouveau/nvkm/subdev/instmem/base.c | 40 +++++++------------ .../gpu/drm/nouveau/nvkm/subdev/instmem/gk20a.c | 2 + drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c | 45 ++++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c | 27 +++++++++++-- drivers/gpu/drm/nouveau/nvkm/subdev/instmem/priv.h | 10 +++++ 6 files changed, 96 insertions(+), 30 deletions(-) commit a25a5d560dada2d2edec1891bf1a89c12d9808ad Author: Ben Skeggs Date: Tue Sep 19 06:21:18 2023 +1000 drm/nouveau/i2c/tu102-: prepare for GSP-RM - disable I2C completely when GSP-RM detected Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-14-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/i2c/gm200.c | 5 +++++ 1 file changed, 5 insertions(+) commit 2cfad4b0489cc13a1f980782ca4af070e2675128 Author: Ben Skeggs Date: Tue Sep 19 06:21:17 2023 +1000 drm/nouveau/gpio/tu102-: prepare for GSP-RM - disable GPIO completely when GSP-RM detected Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-13-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/gpio/ga102.c | 5 +++++ drivers/gpu/drm/nouveau/nvkm/subdev/gpio/gk104.c | 5 +++++ 2 files changed, 10 insertions(+) commit c41aebc9aca41116c40e6fabce1d52250fc91b36 Author: Ben Skeggs Date: Tue Sep 19 06:21:16 2023 +1000 drm/nouveau/fuse/tu102-: prepare for GSP-RM - disable FUSE completely when GSP-RM detected Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-12-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/fuse/gm107.c | 5 +++++ 1 file changed, 5 insertions(+) commit 834a712b6ed2f5ae83ad0a0b038d0a3e1782abbb Author: Ben Skeggs Date: Tue Sep 19 06:21:15 2023 +1000 drm/nouveau/fb/tu102-: prepare for GSP-RM - add (initial) R535 implementation of FB, need VRAM size etc for boot - expose a way to "wrap" vram at a specific address/size as a standard nvkm_memory allocation, which will be used to write PTEs etc for RM- defined memory regions Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-11-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvkm/subdev/fb.h | 6 +-- drivers/gpu/drm/nouveau/nvkm/subdev/fb/Kbuild | 2 + drivers/gpu/drm/nouveau/nvkm/subdev/fb/ga100.c | 5 +++ drivers/gpu/drm/nouveau/nvkm/subdev/fb/ga102.c | 4 ++ drivers/gpu/drm/nouveau/nvkm/subdev/fb/priv.h | 3 ++ drivers/gpu/drm/nouveau/nvkm/subdev/fb/r535.c | 50 ++++++++++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/fb/ram.c | 46 +++++++++++++++++++--- drivers/gpu/drm/nouveau/nvkm/subdev/fb/tu102.c | 5 +++ 8 files changed, 113 insertions(+), 8 deletions(-) commit a613e7f3fe6d4be5e19429f28c21178ca74c3b56 Author: Ben Skeggs Date: Tue Sep 19 06:21:14 2023 +1000 drm/nouveau/fault/tu102-: prepare for GSP-RM - disable FAULT completely when GSP-RM detected - SVM support will be disabled when running on RM because of this Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-10-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/fault/tu102.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 15740541e8f0b2b966e718fa6d384b1818ebe555 Author: Ben Skeggs Date: Tue Sep 19 06:21:13 2023 +1000 drm/nouveau/devinit/tu102-: prepare for GSP-RM - add R535 implementation of DEVINIT, we need some of this for boot - add display disable fuse for ga100- Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-9-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/devinit/Kbuild | 2 + .../gpu/drm/nouveau/nvkm/subdev/devinit/ga100.c | 15 +++++++ drivers/gpu/drm/nouveau/nvkm/subdev/devinit/priv.h | 3 ++ drivers/gpu/drm/nouveau/nvkm/subdev/devinit/r535.c | 51 ++++++++++++++++++++++ .../gpu/drm/nouveau/nvkm/subdev/devinit/tu102.c | 4 ++ 5 files changed, 75 insertions(+) commit 6a0fd03a23fd833c98277701bedb6e7f25df22bd Author: Ben Skeggs Date: Tue Sep 19 06:21:12 2023 +1000 drm/nouveau/bus/tu102-: prepare for GSP-RM - disable BUS completely when GSP-RM detected Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-8-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/bus/gf100.c | 5 +++++ 1 file changed, 5 insertions(+) commit 45655ff0848040f09e4a4f812fe4aa79e1363624 Author: Ben Skeggs Date: Tue Sep 19 06:21:11 2023 +1000 drm/nouveau/bar/tu102-: prepare for GSP-RM - (temporarily) disable if GSP-RM detected, will be added later - move BAR2 teardown from dtor(), it doesn't belong there Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-7-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/bar/base.c | 10 +++++++++- drivers/gpu/drm/nouveau/nvkm/subdev/bar/tu102.c | 4 ++++ 2 files changed, 13 insertions(+), 1 deletion(-) commit 74e2011b11e0427908ff4e6a106f9ab96641cdd8 Author: Ben Skeggs Date: Tue Sep 19 06:21:10 2023 +1000 drm/nouveau/acr/tu102-: prepare for GSP-RM - disable ACR completely when GSP-RM detected Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-6-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/acr/ga102.c | 4 ++++ drivers/gpu/drm/nouveau/nvkm/subdev/acr/tu102.c | 3 +++ 2 files changed, 7 insertions(+) commit 015ef6187f69eca7d9029e3f8e358a86041e403a Author: Ben Skeggs Date: Tue Sep 19 06:21:09 2023 +1000 drm/nouveau/gsp: prepare for GSP-RM - move TOP after GSP, so we can disable TOP if GSP is in use - provide plumbing to support falcon-only and GSP-RM paths - provide a method for subdevs to detect GSP-RM paths - split tu102/tu116/ga100 paths from gv100, which can't support GSP-RM Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-5-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvkm/core/layout.h | 2 +- drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h | 9 +++++ drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 11 ++--- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/Kbuild | 3 ++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c | 47 +++++++++++++++++++--- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/ga100.c | 35 ++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/ga102.c | 8 +--- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/gv100.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/priv.h | 17 ++++++-- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/tu102.c | 35 ++++++++++++++++ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/tu116.c | 35 ++++++++++++++++ 11 files changed, 182 insertions(+), 24 deletions(-) commit e866927013557aa4562cd4ddf55433a64e3cab4f Author: Ben Skeggs Date: Tue Sep 19 06:21:08 2023 +1000 drm/nouveau/nvkm: bump maximum number of NVJPG RM (and GH100) support 8 NVJPG instances. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-4-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvkm/core/layout.h | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/top/ga100.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/top/gk104.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit 7e731d42aee7876f5b74518f875508e412c40eca Author: Ben Skeggs Date: Tue Sep 19 06:21:07 2023 +1000 drm/nouveau/nvkm: bump maximum number of NVDEC RM (and GH100) support 8 NVDEC instances. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-3-skeggsb@gmail.com drivers/gpu/drm/nouveau/include/nvkm/core/layout.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 743b7fc481f9e844c374bb51986f0d4db8a684a0 Author: Ben Skeggs Date: Tue Sep 19 06:21:06 2023 +1000 drm/nouveau/mmu/tu102-: remove write to 0x100e68 during tlb invalidate This was cargo-culted from traces of RM when the code was written, but we probably shouldn't be touching NV_PFB regs while GSP-RM is running. From traces, it looks like NVIDIA dropped this sometime between 510.54 and 515.48.07, so I guess we can too. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230918202149.4343-2-skeggsb@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c | 1 - 1 file changed, 1 deletion(-) commit fdce8bd38037a4a2b2961ca4abffaab195690b30 Merge: 2656821f1f20 90f055df1121 Author: Linus Torvalds Date: Mon Oct 30 19:03:30 2023 -1000 Merge tag 'slab-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab updates from Vlastimil Babka: - SLUB: slab order calculation refactoring (Vlastimil Babka, Feng Tang) Recent proposals to tune the slab order calculations have prompted us to look at the current code and refactor it to make it easier to follow and eliminate some odd corner cases. The refactoring is mostly non-functional changes, but should make the actual tuning easier to implement and review. * tag 'slab-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slub: refactor calculate_order() and calc_slab_order() mm/slub: attempt to find layouts up to 1/2 waste in calculate_order() mm/slub: remove min_objects loop from calculate_order() mm/slub: simplify the last resort slab order calculation mm/slub: add sanity check for slub_min/max_order cmdline setup commit 2656821f1f202d58224551b71eff41aafd1edf8b Merge: 9a0f53e0cfc2 d97ae6474ca0 Author: Linus Torvalds Date: Mon Oct 30 18:01:41 2023 -1000 Merge tag 'rcu-next-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/linux-dynticks Pull RCU updates from Frederic Weisbecker: - RCU torture, locktorture and generic torture infrastructure updates that include various fixes, cleanups and consolidations. Among the user visible things, ftrace dumps can now be found into their own file, and module parameters get better documented and reported on dumps. - Generic and misc fixes all over the place. Some highlights: * Hotplug handling has seen some light cleanups and comments * An RCU barrier can now be triggered through sysfs to serialize memory stress testing and avoid OOM * Object information is now dumped in case of invalid callback invocation * Also various SRCU issues, too hard to trigger to deserve urgent pull requests, have been fixed - RCU documentation updates - RCU reference scalability test minor fixes and doc improvements. - RCU tasks minor fixes - Stall detection updates. Introduce RCU CPU Stall notifiers that allows a subsystem to provide informations to help debugging. Also cure some false positive stalls. * tag 'rcu-next-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/linux-dynticks: (56 commits) srcu: Only accelerate on enqueue time locktorture: Check the correct variable for allocation failure srcu: Fix callbacks acceleration mishandling rcu: Comment why callbacks migration can't wait for CPUHP_RCUTREE_PREP rcu: Standardize explicit CPU-hotplug calls rcu: Conditionally build CPU-hotplug teardown callbacks rcu: Remove references to rcu_migrate_callbacks() from diagrams rcu: Assume rcu_report_dead() is always called locally rcu: Assume IRQS disabled from rcu_report_dead() rcu: Use rcu_segcblist_segempty() instead of open coding it rcu: kmemleak: Ignore kmemleak false positives when RCU-freeing objects srcu: Fix srcu_struct node grpmask overflow on 64-bit systems torture: Convert parse-console.sh to mktemp rcutorture: Traverse possible cpu to set maxcpu in rcu_nocb_toggle() rcutorture: Replace schedule_timeout*() 1-jiffy waits with HZ/20 torture: Add kvm.sh --debug-info argument locktorture: Rename readers_bind/writers_bind to bind_readers/bind_writers doc: Catch-up update for locktorture module parameters locktorture: Add call_rcu_chains module parameter locktorture: Add new module parameters to lock_torture_print_module_parms() ... commit 9a0f53e0cfc2ef262c05b8e4ab89e7f2accaf96c Merge: 6750f0de53b7 94b3f0b5af2c Author: Linus Torvalds Date: Mon Oct 30 17:56:53 2023 -1000 Merge tag 'csd-lock.2023.10.23a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull CSD lock update from Paul McKenney: "This adds a kernel boot parameter that causes the kernel to panic if one of the call_smp_function() APIs is stalled for more than the specified duration. This is useful in deployments in which a clean panic is preferable to an indefinite stall" * tag 'csd-lock.2023.10.23a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: smp,csd: Throw an error if a CSD lock is stuck for too long commit 6750f0de53b7d64a4deffa62944ea431a153ec48 Merge: c9049984f0e4 1566bf4b13da Author: Linus Torvalds Date: Mon Oct 30 17:54:43 2023 -1000 Merge tag 'lkmm.2023.10.28a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull Linux Kernel Memory Model updates from Paul McKenney: "This update adds paragraphs to the portions of memory-barriers.txt that have been marked historical due to changes in the way that the Linux kernel handles DEC Alpha. These paragraphs includes information on where to find the corresponding up-to-date information" * tag 'lkmm.2023.10.28a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: docs: memory-barriers: Add note on compiler transformation and address deps commit c9049984f0e470af865c497c7f785fe895e5da9c Merge: eb55307e6716 b8c60e8fc6f7 Author: Linus Torvalds Date: Mon Oct 30 17:52:45 2023 -1000 Merge tag 'nolibc.2023.10.23a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull nolibc updates from Paul McKenney: - Add stdarg.h header and a few additional system-call upgrades - Add support for constructors and destructors - Add tests to verify the ability to link multiple .o files against nolibc - Numerous string-function optimizations and improvements - Prevent redundant kernel relinks by avoiding embedding of initramfs into the kernel image - Allow building i386 with multiarch compiler and make ppc64le use qemu-system-ppc64 - Miscellaneous fixups, including addition of -nostdinc for nolibc-test, avoiding -Wstringop-overflow warnings, and avoiding unused parameter warnings for ENOSYS fallbacks * tag 'nolibc.2023.10.23a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: selftests/nolibc: add tests for multi-object linkage selftests/nolibc: use qemu-system-ppc64 for ppc64le tools/nolibc: add support for constructors and destructors tools/nolibc: drop test for getauxval(AT_PAGESZ) tools/nolibc: automatically detect necessity to use pselect6 tools/nolibc: don't define new syscall number tools/nolibc: avoid unused parameter warnings for ENOSYS fallbacks selftests/nolibc: allow building i386 with multiarch compiler selftests/nolibc: don't embed initramfs into kernel image selftests/nolibc: libc-test: avoid -Wstringop-overflow warnings tools/nolibc: string: Remove the `_nolibc_memcpy_up()` function tools/nolibc: string: Remove the `_nolibc_memcpy_down()` function tools/nolibc: x86-64: Use `rep stosb` for `memset()` tools/nolibc: x86-64: Use `rep movsb` for `memcpy()` and `memmove()` selftests/nolibc: use -nostdinc for nolibc-test tools/nolibc: add stdarg.h header commit eb55307e6716b1a02f7db05e27d60e8ca2289c03 Merge: 943af0e73a37 92fe9bb77b0c Author: Linus Torvalds Date: Mon Oct 30 17:37:47 2023 -1000 Merge tag 'x86-core-2023-10-29-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 core updates from Thomas Gleixner: - Limit the hardcoded topology quirk for Hygon CPUs to those which have a model ID less than 4. The newer models have the topology CPUID leaf 0xB correctly implemented and are not affected. - Make SMT control more robust against enumeration failures SMT control was added to allow controlling SMT at boottime or runtime. The primary purpose was to provide a simple mechanism to disable SMT in the light of speculation attack vectors. It turned out that the code is sensible to enumeration failures and worked only by chance for XEN/PV. XEN/PV has no real APIC enumeration which means the primary thread mask is not set up correctly. By chance a XEN/PV boot ends up with smp_num_siblings == 2, which makes the hotplug control stay at its default value "enabled". So the mask is never evaluated. The ongoing rework of the topology evaluation caused XEN/PV to end up with smp_num_siblings == 1, which sets the SMT control to "not supported" and the empty primary thread mask causes the hotplug core to deny the bringup of the APS. Make the decision logic more robust and take 'not supported' and 'not implemented' into account for the decision whether a CPU should be booted or not. - Fake primary thread mask for XEN/PV Pretend that all XEN/PV vCPUs are primary threads, which makes the usage of the primary thread mask valid on XEN/PV. That is consistent with because all of the topology information on XEN/PV is fake or even non-existent. - Encapsulate topology information in cpuinfo_x86 Move the randomly scattered topology data into a separate data structure for readability and as a preparatory step for the topology evaluation overhaul. - Consolidate APIC ID data type to u32 It's fixed width hardware data and not randomly u16, int, unsigned long or whatever developers decided to use. - Cure the abuse of cpuinfo for persisting logical IDs. Per CPU cpuinfo is used to persist the logical package and die IDs. That's really not the right place simply because cpuinfo is subject to be reinitialized when a CPU goes through an offline/online cycle. Use separate per CPU data for the persisting to enable the further topology management rework. It will be removed once the new topology management is in place. - Provide a debug interface for inspecting topology information Useful in general and extremly helpful for validating the topology management rework in terms of correctness or "bug" compatibility. * tag 'x86-core-2023-10-29-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits) x86/apic, x86/hyperv: Use u32 in hv_snp_boot_ap() too x86/cpu: Provide debug interface x86/cpu/topology: Cure the abuse of cpuinfo for persisting logical ids x86/apic: Use u32 for wakeup_secondary_cpu[_64]() x86/apic: Use u32 for [gs]et_apic_id() x86/apic: Use u32 for phys_pkg_id() x86/apic: Use u32 for cpu_present_to_apicid() x86/apic: Use u32 for check_apicid_used() x86/apic: Use u32 for APIC IDs in global data x86/apic: Use BAD_APICID consistently x86/cpu: Move cpu_l[l2]c_id into topology info x86/cpu: Move logical package and die IDs into topology info x86/cpu: Remove pointless evaluation of x86_coreid_bits x86/cpu: Move cu_id into topology info x86/cpu: Move cpu_core_id into topology info hwmon: (fam15h_power) Use topology_core_id() scsi: lpfc: Use topology_core_id() x86/cpu: Move cpu_die_id into topology info x86/cpu: Move phys_proc_id into topology info x86/cpu: Encapsulate topology information in cpuinfo_x86 ... commit 943af0e73a370b0c856340fd873c140e42822ec7 Merge: 63a3f1197599 b56ebe7c896d Author: Linus Torvalds Date: Mon Oct 30 17:27:56 2023 -1000 Merge tag 'x86-apic-2023-10-29-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 APIC updates from Thomas Gleixner: - Make the quirk for non-maskable MSI interrupts in the affinity setter functional again. It was broken by a MSI core code update, which restructured the code in a way that the quirk flag was not longer set correctly. Trying to restore the core logic caused a deeper inspection and it turned out that the extra quirk flag is not required at all because it's the inverse of the reservation mode bit, which only can be set when the MSI interrupt is maskable. So the trivial fix is to use the reservation mode check in the affinity setter function and remove almost 40 lines of code related to the no-mask quirk flag. - Cure a Kconfig dependency issue which causes compile failures by correcting the conditionals in the affected header files. - Clean up coding style in the UV APIC driver. * tag 'x86-apic-2023-10-29-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/apic/msi: Fix misconfigured non-maskable MSI quirk x86/msi: Fix compile error caused by CONFIG_GENERIC_MSI_IRQ=y && !CONFIG_X86_LOCAL_APIC x86/platform/uv/apic: Clean up inconsistent indenting commit 63a3f11975997e0851b108b49d7b5f4e84a18d08 Merge: c891e98ab32d f4febfdbb45a Author: Linus Torvalds Date: Mon Oct 30 17:25:41 2023 -1000 Merge tag 'timers-core-2023-10-29-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer updates from Thomas Gleixner: "Updates for time, timekeeping and timers: Core: - Avoid superfluous deactivation of the tick in the low resolution tick NOHZ interrupt handler as the deactivation is handled already in the idle loop and on interrupt exit. - Update stale comments in the tick NOHZ code and rename the tick handler functions to be self-explanatory. - Remove an unused function in the tick NOHZ code, which was forgotten when the last user went away. - Handle RTC alarms which exceed the maximum alarm time of the underlying RTC hardware gracefully. Setting RTC alarms which exceed the maximum alarm time of the RTC hardware failed so far and caused suspend operations to abort. Cure this by limiting the alarm to the maximum alarm time of the RTC hardware, which is provided by the driver. This causes early resume wakeups, but that's way better than not suspending at all. Drivers: - Add a proper clocksource/event driver for the ancient Cirrus Logic EP93xx SoC family, which is one of the last non device-tree holdouts in arch/arm. - The usual boring device tree bindings updates and small fixes and enhancements all over the place" * tag 'timers-core-2023-10-29-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource: ep93xx: Add driver for Cirrus Logic EP93xx dt-bindings: timers: Add Cirrus EP93xx clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware clocksource/timer-riscv: ACPI: Add timer_cannot_wakeup_cpu clocksource/drivers/sun5i: Remove surplus dev_err() when using platform_get_irq() drivers/clocksource/timer-ti-dm: Don't call clk_get_rate() in stop function clocksource/drivers/timer-imx-gpt: Fix potential memory leak dt-bindings: timer: renesas,rz-mtu3: Document RZ/{G2UL,Five} SoCs dt-bindings: timer: renesas,rz-mtu3: Improve documentation dt-bindings: timer: renesas,rz-mtu3: Fix overflow/underflow interrupt names alarmtimer: Use maximum alarm time for suspend rtc: Add API function to return alarm time bound by hardware limit tick/nohz: Update comments some more tick/nohz: Remove unused tick_nohz_idle_stop_tick_protected() tick/nohz: Don't shutdown the lowres tick from itself tick/nohz: Update obsolete comments tick/nohz: Rename the tick handlers to more self-explanatory names commit c891e98ab32d55b25d87e380d919c279a8b228e0 Merge: b08eccef9fa0 38685e2a0476 Author: Linus Torvalds Date: Mon Oct 30 17:12:36 2023 -1000 Merge tag 'smp-core-2023-10-29-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull SMP and CPU hotplug updates from Thomas Gleixner: - Switch the smp_call_function*() @csd argument to call_single_data_t type, which is a cache-line aligned typedef of the underlying struct __call_single_data. This ensures that the call data is not crossing a cacheline which avoids bouncing an extra cache-line for the SMP function call - Prevent offlining of the last housekeeping CPU when CPU isolation is active. Offlining the last housekeeping CPU makes no sense in general, but also caused the scheduler to panic due to the empty CPU mask when rebuilding the scheduler domains. - Remove an unused CPU hotplug state * tag 'smp-core-2023-10-29-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: cpu/hotplug: Don't offline the last non-isolated CPU cpu/hotplug: Remove unused cpuhp_state CPUHP_AP_X86_VDSO_VMA_ONLINE smp: Change function signatures to use call_single_data_t commit b08eccef9fa05f8e14fe180d55d603447c76a992 Merge: 9cc6fea175e4 f99b926f6543 Author: Linus Torvalds Date: Mon Oct 30 17:07:19 2023 -1000 Merge tag 'irq-core-2023-10-29-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq updates from Thomas Gleixner: "Core: - Exclude managed interrupts in the calculation of interrupts which are targeted to a CPU which is about to be offlined to ensure that there are enough free vectors on the still online CPUs to migrate them over. Managed interrupts do not need to be accounted because they are either shut down on offline or migrated to an already reserved and guaranteed slot on a still online CPU in the interrupts affinity mask. Including managed interrupts is overaccounting and can result in needlessly aborting hibernation on large server machines. - The usual set of small improvements Drivers: - Make the generic interrupt chip implementation handle interrupt domains correctly and initialize the name pointers correctly - Add interrupt affinity setting support to the Renesas RZG2L chip driver. - Prevent registering syscore operations multiple times in the SiFive PLIC chip driver. - Update device tree handling in the NXP Layerscape MSI chip driver" * tag 'irq-core-2023-10-29-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/sifive-plic: Fix syscore registration for multi-socket systems irqchip/ls-scfg-msi: Use device_get_match_data() genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware genirq/matrix: Exclude managed interrupts in irq_matrix_allocated() PCI/MSI: Provide stubs for IMS functions irqchip/renesas-rzg2l: Enhance driver to support interrupt affinity setting genirq/generic-chip: Fix the irq_chip name for /proc/interrupts irqdomain: Annotate struct irq_domain with __counted_by commit 9cc6fea175e41580000419a90fa744ba46aa4722 Merge: ecb8cd2a9f7a 1aabbc532413 Author: Linus Torvalds Date: Mon Oct 30 17:03:32 2023 -1000 Merge tag 'core-core-2023-10-29-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core updates from Thomas Gleixner: "Two small updates to ptrace_stop(): - Add a comment to explain that the preempt_disable() before unlocking tasklist lock is not a correctness problem and just avoids the tracer to preempt the tracee before the tracee schedules out. - Make that preempt_disable() conditional on PREEMPT_RT=n. RT enabled kernels cannot disable preemption at this point because cgroup_enter_frozen() and sched_submit_work() acquire spinlocks or rwlocks which are substituted by sleeping locks on RT. Acquiring a sleeping lock in a preemption disable region is obviously not possible. This obviously brings back the potential slowdown of ptrace() for RT enabled kernels, but that's a price to be paid for latency guarantees" * tag 'core-core-2023-10-29-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: signal: Don't disable preemption in ptrace_stop() on PREEMPT_RT signal: Add a proper comment about preempt_disable() in ptrace_stop() commit 67797da8a4b82446d42c52b6ee1419a3100d78ff Author: Namjae Jeon Date: Sun Oct 29 20:58:28 2023 +0900 ksmbd: no need to wait for binded connection termination at logoff The connection could be binded to the existing session for Multichannel. session will be destroyed when binded connections are released. So no need to wait for that's connection at logoff. Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/connection.c | 16 ---------------- 1 file changed, 16 deletions(-) commit 631808095a82e6b6f8410a95f8b12b8d0d38b161 Merge: 915b6d034b54 dd3dd9829bf9 Author: Dave Airlie Date: Tue Oct 31 12:36:55 2023 +1000 Merge tag 'amd-drm-next-6.7-2023-10-27' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.7-2023-10-27: amdgpu: - RAS fixes - Seamless boot fixes - NBIO 7.7 fix - SMU 14.0 fixes - GC 11.5 fixes - DML2 fixes - ASPM fixes - VPE fixes - Misc code cleanups - SRIOV fixes - Add some missing copyright notices - DCN 3.5 fixes - FAMS fixes - Backlight fix - S/G display fix - fdinfo cleanups - EXT_COHERENT fixes for APU and NUMA systems amdkfd: - Misc fixes - Misc code cleanups - SVM fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20231027200343.57132-1-alexander.deucher@amd.com commit 20e425d301d673dbd5df0c9d4b186c70b43813bb Author: Kent Overstreet Date: Sun Feb 5 16:18:59 2023 -0500 six locks: Lock contended tracepoints Signed-off-by: Kent Overstreet fs/bcachefs/six.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit ecb8cd2a9f7af7f99a6d4fa0a5a31822f6cfe255 Merge: f0d25b5d0f8e 70c8dc910427 Author: Linus Torvalds Date: Mon Oct 30 16:10:06 2023 -1000 Merge tag 'x86-build-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 build update from Ingo Molnar: "Enable CONFIG_DEBUG_ENTRY=y in the x86 defconfigs" * tag 'x86-build-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/defconfig: Enable CONFIG_DEBUG_ENTRY=y commit ee526b88caaa4b4182144bf2576af2c3b1e9c759 Author: Kent Overstreet Date: Tue Oct 24 14:46:58 2023 -0400 closures: Fix race in closure_sync() As pointed out by Linus, closure_sync() was racy; we could skip blocking immediately after a get() and a put(), but then that would skip any barrier corresponding to the other thread's put() barrier. To fix this, always do the full __closure_sync() sequence whenever any get() has happened and the closure might have been used by other threads. Signed-off-by: Kent Overstreet fs/bcachefs/fs-io-direct.c | 1 + include/linux/closure.h | 10 +++++++++- lib/closure.c | 3 +++ 3 files changed, 13 insertions(+), 1 deletion(-) commit 2bce6368c46b835a133f7f4946eea9c4513828dd Author: Kent Overstreet Date: Tue Oct 24 14:46:58 2023 -0400 closures: Better memory barriers atomic_(dec|sub)_return_release() are a thing now - use them. Also, delete the useless barrier in set_closure_fn(): it's redundant with the memory barrier in closure_put(0. Since closure_put() would now otherwise just have a release barrier, we also need a new barrier when the ref hits 0 - smp_acquire__after_ctrl_dep(). Signed-off-by: Kent Overstreet include/linux/closure.h | 2 -- lib/closure.c | 6 ++++-- 2 files changed, 4 insertions(+), 4 deletions(-) commit f0d25b5d0f8ef0ad35f1beff17da5843279d47a1 Merge: 1641b9b04002 a1e2b8b36820 Author: Linus Torvalds Date: Mon Oct 30 15:40:57 2023 -1000 Merge tag 'x86-mm-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mm handling updates from Ingo Molnar: - Add new NX-stack self-test - Improve NUMA partial-CFMWS handling - Fix #VC handler bugs resulting in SEV-SNP boot failures - Drop the 4MB memory size restriction on minimal NUMA nodes - Reorganize headers a bit, in preparation to header dependency reduction efforts - Misc cleanups & fixes * tag 'x86-mm-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size selftests/x86/lam: Zero out buffer for readlink() x86/sev: Drop unneeded #include x86/sev: Move sev_setup_arch() to mem_encrypt.c x86/tdx: Replace deprecated strncpy() with strtomem_pad() selftests/x86/mm: Add new test that userspace stack is in fact NX x86/sev: Make boot_ghcb_page[] static x86/boot: Move x86_cache_alignment initialization to correct spot x86/sev-es: Set x86_virt_bits to the correct value straight away, instead of a two-phase approach x86/sev-es: Allow copy_from_kernel_nofault() in earlier boot x86_64: Show CR4.PSE on auxiliaries like on BSP x86/iommu/docs: Update AMD IOMMU specification document URL x86/sev/docs: Update document URL in amd-memory-encryption.rst x86/mm: Move arch_memory_failure() and arch_is_platform_page() definitions from to ACPI/NUMA: Apply SRAT proximity domain to entire CFMWS window x86/numa: Introduce numa_fill_memblks() commit 1641b9b04002c22f616a51a164c04b7f679d241f Merge: ed766c26119c f44075ecafb7 Author: Linus Torvalds Date: Mon Oct 30 15:39:38 2023 -1000 Merge tag 'x86-irq-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 irq fix from Ingo Molnar: "Fix out-of-order NMI nesting checks resulting in false positive warnings" * tag 'x86-irq-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/nmi: Fix out-of-order NMI nesting checks & false positive warning commit ed766c26119c4cf9b1f909f045c2eb987180ace3 Merge: 5780e39edbb4 1a09a27153f9 Author: Linus Torvalds Date: Mon Oct 30 15:27:27 2023 -1000 Merge tag 'x86-entry-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 entry updates from Ingo Molnar: - Make IA32_EMULATION boot time configurable with the new ia32_emulation= boot option - Clean up fast syscall return validation code: convert it to C and refactor the code - As part of this, optimize the canonical RIP test code * tag 'x86-entry-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/entry/32: Clean up syscall fast exit tests x86/entry/64: Use TASK_SIZE_MAX for canonical RIP test x86/entry/64: Convert SYSRET validation tests to C x86/entry/32: Remove SEP test for SYSEXIT x86/entry/32: Convert do_fast_syscall_32() to bool return type x86/entry/compat: Combine return value test from syscall handler x86/entry/64: Remove obsolete comment on tracing vs. SYSRET x86: Make IA32_EMULATION boot time configurable x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() x86/elf: Make loading of 32bit processes depend on ia32_enabled() x86/entry: Compile entry_SYSCALL32_ignore() unconditionally x86/entry: Rename ignore_sysret() x86: Introduce ia32_enabled() commit ee785c15b5906a69d4007b4754e8ae40fb41e0b4 Author: Yuezhang Mo Date: Thu Jul 20 14:40:08 2023 +0800 exfat: support create zero-size directory This commit adds mount option 'zero_size_dir'. If this option enabled, don't allocate a cluster to directory when creating it, and set the directory size to 0. On Windows, a cluster is allocated for a directory when it is created, so the mount option is disabled by default. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Signed-off-by: Namjae Jeon fs/exfat/dir.c | 12 ++++++------ fs/exfat/exfat_fs.h | 2 ++ fs/exfat/namei.c | 7 +++++-- fs/exfat/super.c | 7 +++++++ 4 files changed, 20 insertions(+), 8 deletions(-) commit dab48b8f2fe7264d51ec9eed0adea0fe3c78830a Author: Yuezhang Mo Date: Thu Jul 20 14:23:08 2023 +0800 exfat: support handle zero-size directory After repairing a corrupted file system with exfatprogs' fsck.exfat, zero-size directories may result. It is also possible to create zero-size directories in other exFAT implementation, such as Paragon ufsd dirver. As described in the specification, the lower directory size limits is 0 bytes. Without this commit, sub-directories and files cannot be created under a zero-size directory, and it cannot be removed. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Signed-off-by: Namjae Jeon fs/exfat/namei.c | 29 ++++++++++++++++++++++------- 1 file changed, 22 insertions(+), 7 deletions(-) commit 0ab8ba71868594acfc717b8c7d1738b9118118ec Author: Jan Cincera Date: Mon Oct 30 20:53:18 2023 +0900 exfat: add ioctls for accessing attributes Add GET and SET attributes ioctls to enable attribute modification. We already do this in FAT and a few userspace utils made for it would benefit from this also working on exFAT, namely fatattr. Signed-off-by: Jan Cincera Signed-off-by: Namjae Jeon fs/exfat/dir.c | 8 ++--- fs/exfat/exfat_fs.h | 12 +++---- fs/exfat/exfat_raw.h | 19 +++++----- fs/exfat/file.c | 97 +++++++++++++++++++++++++++++++++++++++++++++++++++- fs/exfat/inode.c | 6 ++-- fs/exfat/namei.c | 16 ++++----- fs/exfat/super.c | 4 +-- 7 files changed, 129 insertions(+), 33 deletions(-) commit 915b6d034b54425b42705c8772ddb7a121759eb1 Merge: 5258dfd4a6ad b70438004a14 Author: Dave Airlie Date: Tue Oct 31 10:47:49 2023 +1000 Merge tag 'drm-misc-next-2023-10-27' of git://anongit.freedesktop.org/drm/drm-misc into drm-next drm-misc-next for v6.7-rc1: drm-misc-next-2023-10-19 + following: UAPI Changes: Cross-subsystem Changes: - Convert fbdev drivers to use fbdev i/o mem helpers. Core Changes: - Use cross-references for macros in docs. - Make drm_client_buffer_addb use addfb2. - Add NV20 and NV30 YUV formats. - Documentation updates for create_dumb ioctl. - CI fixes. - Allow variable number of run-queues in scheduler. Driver Changes: - Rename drm/ast constants. - Make ili9882t its own driver. - Assorted fixes in ivpu, vc4, bridge/synopsis, amdgpu. - Add planar formats to rockchip. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/3d92fae8-9b1b-4165-9ca8-5fda11ee146b@linux.intel.com commit 5780e39edbb49bb441f1c8eb9e6cb8be92dee31d Merge: 2b95bb052656 8ae292c66dcb Author: Linus Torvalds Date: Mon Oct 30 14:18:00 2023 -1000 Merge tag 'x86-asm-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 assembly code updates from Ingo Molnar: - Micro-optimize the x86 bitops code - Define target-specific {raw,this}_cpu_try_cmpxchg{64,128}() to improve code generation - Define and use raw_cpu_try_cmpxchg() preempt_count_set() - Do not clobber %rsi in percpu_{try_,}cmpxchg{64,128}_op - Remove the unused __sw_hweight64() implementation on x86-32 - Misc fixes and cleanups * tag 'x86-asm-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/lib: Address kernel-doc warnings x86/entry: Fix typos in comments x86/entry: Remove unused argument %rsi passed to exc_nmi() x86/bitops: Remove unused __sw_hweight64() assembly implementation on x86-32 x86/percpu: Do not clobber %rsi in percpu_{try_,}cmpxchg{64,128}_op x86/percpu: Use raw_cpu_try_cmpxchg() in preempt_count_set() x86/percpu: Define raw_cpu_try_cmpxchg and this_cpu_try_cmpxchg() x86/percpu: Define {raw,this}_cpu_try_cmpxchg{64,128} x86/asm/bitops: Use __builtin_clz{l|ll} to evaluate constant expressions commit 2b95bb052656d46c2073b87f9487a53ef5e79732 Merge: 3b8b4b4fc413 50dcc2e0d62e Author: Linus Torvalds Date: Mon Oct 30 14:11:57 2023 -1000 Merge tag 'x86-boot-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 boot updates from Ingo Molnar: - Rework PE header generation, primarily to generate a modern, 4k aligned kernel image view with narrower W^X permissions. - Further refine init-lifetime annotations - Misc cleanups & fixes * tag 'x86-boot-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits) x86/boot: efistub: Assign global boot_params variable x86/boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr' x86/head/64: Move the __head definition to x86/head/64: Add missing __head annotation to startup_64_load_idt() x86/head/64: Mark 'startup_gdt[]' and 'startup_gdt_descr' as __initdata x86/boot: Harmonize the style of array-type parameter for fixup_pointer() calls x86/boot: Fix incorrect startup_gdt_descr.size x86/boot: Compile boot code with -std=gnu11 too x86/boot: Increase section and file alignment to 4k/512 x86/boot: Split off PE/COFF .data section x86/boot: Drop PE/COFF .reloc section x86/boot: Construct PE/COFF .text section from assembler x86/boot: Derive file size from _edata symbol x86/boot: Define setup size in linker script x86/boot: Set EFI handover offset directly in header asm x86/boot: Grab kernel_info offset from zoffset header directly x86/boot: Drop references to startup_64 x86/boot: Drop redundant code setting the root device x86/boot: Omit compression buffer from PE/COFF image memory footprint x86/boot: Remove the 'bugger off' message ... commit 3b8b4b4fc4135160f295cf308dfe43c721990356 Merge: bceb7accb7b6 8b01de80306c Author: Linus Torvalds Date: Mon Oct 30 14:04:23 2023 -1000 Merge tag 'x86-headers-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 header file cleanup from Ingo Molnar: "Replace uses with and then remove " * tag 'x86-headers-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/headers: Remove x86/headers: Replace #include with #include x86/headers: Remove unnecessary #include commit bceb7accb7b60f9844807c7433af06493ed058b7 Merge: cd063c8b9e1e 744940f1921c Author: Linus Torvalds Date: Mon Oct 30 13:44:35 2023 -1000 Merge tag 'perf-core-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull performance event updates from Ingo Molnar: - Add AMD Unified Memory Controller (UMC) events introduced with Zen 4 - Simplify & clean up the uncore management code - Fall back from RDPMC to RDMSR on certain uncore PMUs - Improve per-package and cstate event reading - Extend the Intel ref-cycles event to GP counters - Fix Intel MTL event constraints - Improve the Intel hybrid CPU handling code - Micro-optimize the RAPL code - Optimize perf_cgroup_switch() - Improve large AUX area error handling - Misc fixes and cleanups * tag 'perf-core-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (26 commits) perf/x86/amd/uncore: Pass through error code for initialization failures, instead of -ENODEV perf/x86/amd/uncore: Fix uninitialized return value in amd_uncore_init() x86/cpu: Fix the AMD Fam 17h, Fam 19h, Zen2 and Zen4 MSR enumerations perf: Optimize perf_cgroup_switch() perf/x86/amd/uncore: Add memory controller support perf/x86/amd/uncore: Add group exclusivity perf/x86/amd/uncore: Use rdmsr if rdpmc is unavailable perf/x86/amd/uncore: Move discovery and registration perf/x86/amd/uncore: Refactor uncore management perf/core: Allow reading package events from perf_event_read_local perf/x86/cstate: Allow reading the package statistics from local CPU perf/x86/intel/pt: Fix kernel-doc comments perf/x86/rapl: Annotate 'struct rapl_pmus' with __counted_by perf/core: Rename perf_proc_update_handler() -> perf_event_max_sample_rate_handler(), for readability perf/x86/rapl: Fix "Using plain integer as NULL pointer" Sparse warning perf/x86/rapl: Use local64_try_cmpxchg in rapl_event_update() perf/x86/rapl: Stop doing cpu_relax() in the local64_cmpxchg() loop in rapl_event_update() perf/core: Bail out early if the request AUX area is out of bound perf/x86/intel: Extend the ref-cycles event to GP counters perf/x86/intel: Fix broken fixed event constraints extension ... commit cd063c8b9e1e95560e90bac7816234d8b2ee2897 Merge: 63ce50fff924 60fd39af33d3 Author: Linus Torvalds Date: Mon Oct 30 13:20:02 2023 -1000 Merge tag 'objtool-core-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool updates from Ingo Molnar: "Misc fixes and cleanups: - Fix potential MAX_NAME_LEN limit related build failures - Fix scripts/faddr2line symbol filtering bug - Fix scripts/faddr2line on LLVM=1 - Fix scripts/faddr2line to accept readelf output with mapping symbols - Minor cleanups" * tag 'objtool-core-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: scripts/faddr2line: Skip over mapping symbols in output from readelf scripts/faddr2line: Use LLVM addr2line and readelf if LLVM=1 scripts/faddr2line: Don't filter out non-function symbols from readelf objtool: Remove max symbol name length limitation objtool: Propagate early errors objtool: Use 'the fallthrough' pseudo-keyword x86/speculation, objtool: Use absolute relocations for annotations x86/unwind/orc: Remove redundant initialization of 'mid' pointer in __orc_find() commit 63ce50fff9240d66cf3b59663f458f55ba6dcfcc Merge: 3cf3fabccb9d 984ffb6a4366 Author: Linus Torvalds Date: Mon Oct 30 13:12:15 2023 -1000 Merge tag 'sched-core-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: "Fair scheduler (SCHED_OTHER) improvements: - Remove the old and now unused SIS_PROP code & option - Scan cluster before LLC in the wake-up path - Use candidate prev/recent_used CPU if scanning failed for cluster wakeup NUMA scheduling improvements: - Improve the VMA access-PID code to better skip/scan VMAs - Extend tracing to cover VMA-skipping decisions - Improve/fix the recently introduced sched_numa_find_nth_cpu() code - Generalize numa_map_to_online_node() Energy scheduling improvements: - Remove the EM_MAX_COMPLEXITY limit - Add tracepoints to track energy computation - Make the behavior of the 'sched_energy_aware' sysctl more consistent - Consolidate and clean up access to a CPU's max compute capacity - Fix uclamp code corner cases RT scheduling improvements: - Drive dl_rq->overloaded with dl_rq->pushable_dl_tasks updates - Drive the ->rto_mask with rt_rq->pushable_tasks updates Scheduler scalability improvements: - Rate-limit updates to tg->load_avg - On x86 disable IBRS when CPU is offline to improve single-threaded performance - Micro-optimize in_task() and in_interrupt() - Micro-optimize the PSI code - Avoid updating PSI triggers and ->rtpoll_total when there are no state changes Core scheduler infrastructure improvements: - Use saved_state to reduce some spurious freezer wakeups - Bring in a handful of fast-headers improvements to scheduler headers - Make the scheduler UAPI headers more widely usable by user-space - Simplify the control flow of scheduler syscalls by using lock guards - Fix sched_setaffinity() vs. CPU hotplug race Scheduler debuggability improvements: - Disallow writing invalid values to sched_rt_period_us - Fix a race in the rq-clock debugging code triggering warnings - Fix a warning in the bandwidth distribution code - Micro-optimize in_atomic_preempt_off() checks - Enforce that the tasklist_lock is held in for_each_thread() - Print the TGID in sched_show_task() - Remove the /proc/sys/kernel/sched_child_runs_first sysctl ... and misc cleanups & fixes" * tag 'sched-core-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (82 commits) sched/fair: Remove SIS_PROP sched/fair: Use candidate prev/recent_used CPU if scanning failed for cluster wakeup sched/fair: Scan cluster before scanning LLC in wake-up path sched: Add cpus_share_resources API sched/core: Fix RQCF_ACT_SKIP leak sched/fair: Remove unused 'curr' argument from pick_next_entity() sched/nohz: Update comments about NEWILB_KICK sched/fair: Remove duplicate #include sched/psi: Update poll => rtpoll in relevant comments sched: Make PELT acronym definition searchable sched: Fix stop_one_cpu_nowait() vs hotplug sched/psi: Bail out early from irq time accounting sched/topology: Rename 'DIE' domain to 'PKG' sched/psi: Delete the 'update_total' function parameter from update_triggers() sched/psi: Avoid updating PSI triggers and ->rtpoll_total when there are no state changes sched/headers: Remove comment referring to rq::cpu_load, since this has been removed sched/numa: Complete scanning of inactive VMAs when there is no alternative sched/numa: Complete scanning of partial VMAs regardless of PID activity sched/numa: Move up the access pid reset logic sched/numa: Trace decisions related to skipping VMAs ... commit f5deddce60b50b55bcafeebaab1408d203b0f204 Author: Ferry Meng Date: Thu Oct 26 10:16:27 2023 +0800 erofs: tidy up redundant includes - Remove unused includes like and ; - Move common includes into "internal.h". Signed-off-by: Ferry Meng Reviewed-by: Gao Xiang Reviewed-by: Yue Hu Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20231026021627.23284-2-mengferry@linux.alibaba.com Signed-off-by: Gao Xiang fs/erofs/data.c | 2 -- fs/erofs/decompressor.c | 1 - fs/erofs/decompressor_deflate.c | 1 - fs/erofs/decompressor_lzma.c | 1 - fs/erofs/internal.h | 2 ++ fs/erofs/super.c | 3 --- 6 files changed, 2 insertions(+), 8 deletions(-) commit 6b8a113cae6cc517579a33ad484355c3e4b3d8e7 Author: Ferry Meng Date: Thu Oct 26 10:16:26 2023 +0800 erofs: get rid of ROOT_NID() Let's open code this helper for simplicity. Signed-off-by: Ferry Meng Reviewed-by: Gao Xiang Reviewed-by: Yue Hu Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20231026021627.23284-1-mengferry@linux.alibaba.com Signed-off-by: Gao Xiang fs/erofs/internal.h | 2 -- fs/erofs/super.c | 6 +++--- 2 files changed, 3 insertions(+), 5 deletions(-) commit efb4fb02cef3ab410b603c8f0e1c67f61d55f542 Author: Gao Xiang Date: Sun Oct 22 21:09:57 2023 +0800 erofs: simplify compression configuration parser Move erofs_load_compr_cfgs() into decompressor.c as well as introduce a callback instead of a hard-coded switch for each algorithm for simplicity. Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20231022130957.11398-1-xiang@kernel.org fs/erofs/compress.h | 6 ++++ fs/erofs/decompressor.c | 62 +++++++++++++++++++++++++++++++++-- fs/erofs/decompressor_deflate.c | 5 +-- fs/erofs/decompressor_lzma.c | 4 +-- fs/erofs/internal.h | 38 +--------------------- fs/erofs/super.c | 72 +++++------------------------------------ 6 files changed, 79 insertions(+), 108 deletions(-) commit 798eecaea0f0366306cbc76986a83041a7e8669f Author: Gao Xiang Date: Sat Oct 21 10:01:37 2023 +0800 erofs: don't warn MicroLZMA format anymore The LZMA algorithm support has been landed for more than one year since Linux 5.16. Besides, the new XZ Utils 5.4 has been available in most Linux distributions. Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20231021020137.1646959-1-hsiangkao@linux.alibaba.com fs/erofs/Kconfig | 7 ++----- fs/erofs/decompressor_lzma.c | 2 -- 2 files changed, 2 insertions(+), 7 deletions(-) commit 3cf3fabccb9dc821ffaec3ad6bf0cd6b278bd012 Merge: 9cda4eb04a68 c73801ae4f22 Author: Linus Torvalds Date: Mon Oct 30 12:38:48 2023 -1000 Merge tag 'locking-core-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Info Molnar: "Futex improvements: - Add the 'futex2' syscall ABI, which is an attempt to get away from the multiplex syscall and adds a little room for extentions, while lifting some limitations. - Fix futex PI recursive rt_mutex waiter state bug - Fix inter-process shared futexes on no-MMU systems - Use folios instead of pages Micro-optimizations of locking primitives: - Improve arch_spin_value_unlocked() on asm-generic ticket spinlock architectures, to improve lockref code generation - Improve the x86-32 lockref_get_not_zero() main loop by adding build-time CMPXCHG8B support detection for the relevant lockref code, and by better interfacing the CMPXCHG8B assembly code with the compiler - Introduce arch_sync_try_cmpxchg() on x86 to improve sync_try_cmpxchg() code generation. Convert some sync_cmpxchg() users to sync_try_cmpxchg(). - Micro-optimize rcuref_put_slowpath() Locking debuggability improvements: - Improve CONFIG_DEBUG_RT_MUTEXES=y to have a fast-path as well - Enforce atomicity of sched_submit_work(), which is de-facto atomic but was un-enforced previously. - Extend 's no_free_ptr() with __must_check semantics - Fix ww_mutex self-tests - Clean up const-propagation in and simplify the API-instantiation macros a bit RT locking improvements: - Provide the rt_mutex_*_schedule() primitives/helpers and use them in the rtmutex code to avoid recursion vs. rtlock on the PI state. - Add nested blocking lockdep asserts to rt_mutex_lock(), rtlock_lock() and rwbase_read_lock() .. plus misc fixes & cleanups" * tag 'locking-core-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (39 commits) futex: Don't include process MM in futex key on no-MMU locking/seqlock: Fix grammar in comment alpha: Fix up new futex syscall numbers locking/seqlock: Propagate 'const' pointers within read-only methods, remove forced type casts locking/lockdep: Fix string sizing bug that triggers a format-truncation compiler-warning locking/seqlock: Change __seqprop() to return the function pointer locking/seqlock: Simplify SEQCOUNT_LOCKNAME() locking/atomics: Use atomic_try_cmpxchg_release() to micro-optimize rcuref_put_slowpath() locking/atomic, xen: Use sync_try_cmpxchg() instead of sync_cmpxchg() locking/atomic/x86: Introduce arch_sync_try_cmpxchg() locking/atomic: Add generic support for sync_try_cmpxchg() and its fallback locking/seqlock: Fix typo in comment futex/requeue: Remove unnecessary ‘NULL’ initialization from futex_proxy_trylock_atomic() locking/local, arch: Rewrite local_add_unless() as a static inline function locking/debug: Fix debugfs API return value checks to use IS_ERR() locking/ww_mutex/test: Make sure we bail out instead of livelock locking/ww_mutex/test: Fix potential workqueue corruption locking/ww_mutex/test: Use prng instead of rng to avoid hangs at bootup futex: Add sys_futex_requeue() futex: Add flags2 argument to futex_requeue() ... commit 9cda4eb04a68aee4d795438917a4e958b2b2aa07 Merge: f155f3b3ed1a 90879f5dfcf6 Author: Linus Torvalds Date: Mon Oct 30 12:36:41 2023 -1000 Merge tag 'x86_fpu_for_6.7_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fpu fixlet from Borislav Petkov: - kernel-doc fix * tag 'x86_fpu_for_6.7_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fpu/xstate: Address kernel-doc warning commit f155f3b3ed1af23884ffaffe8a669722b87ac9d6 Merge: ca2e9c3beec6 2a565258b3f4 Author: Linus Torvalds Date: Mon Oct 30 12:32:48 2023 -1000 Merge tag 'x86_platform_for_6.7_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 platform updates from Borislav Petkov: - Make sure PCI function 4 IDs of AMD family 0x19, models 0x60-0x7f are actually used in the amd_nb.c enumeration - Add support for extracting NUMA information from devicetree for Hyper-V usages - Add PCI device IDs for the new AMD MI300 AI accelerators - Annotate an array in struct uv_rtc_timer_head with the new __counted_by attribute - Rework UV's NMI action parameter handling * tag 'x86_platform_for_6.7_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/amd_nb: Use Family 19h Models 60h-7Fh Function 4 IDs x86/numa: Add Devicetree support x86/of: Move the x86_flattree_get_config() call out of x86_dtb_init() x86/amd_nb: Add AMD Family MI300 PCI IDs x86/platform/uv: Annotate struct uv_rtc_timer_head with __counted_by x86/platform/uv: Rework NMI "action" modparam handling commit 24e16e385f2272b1a9df51337a5c32d28a29c7ad Author: Amir Goldstein Date: Mon Oct 30 20:34:42 2023 +0200 ovl: add support for appending lowerdirs one by one Add new mount options lowerdir+ and datadir+ that can be used to add layers to lower layers stack one by one. Unlike the legacy lowerdir mount option, special characters (i.e. colons and cammas) are not unescaped with these new mount options. The new mount options can be repeated to compose a large stack of lower layers, but they may not be mixed with the lagacy lowerdir mount option, because for displaying lower layers in mountinfo, we do not want to mix escaped with unescaped lower layers path syntax. Similar to data-only layer rules with the lowerdir mount option, the datadir+ option must follow at least one lowerdir+ option and the lowerdir+ option must not follow the datadir+ option. If the legacy lowerdir mount option follows lowerdir+ and datadir+ mount options, it overrides them. Sepcifically, calling: fsconfig(FSCONFIG_SET_STRING, "lowerdir", "", 0); can be used to reset previously setup lower layers. Suggested-by: Miklos Szeredi Link: https://lore.kernel.org/r/CAJfpegt7VC94KkRtb1dfHG8+4OzwPBLYqhtc8=QFUxpFJE+=RQ@mail.gmail.com/ Signed-off-by: Amir Goldstein Documentation/filesystems/overlayfs.rst | 17 +++++-- fs/overlayfs/params.c | 78 ++++++++++++++++++++++++++++++++- 2 files changed, 90 insertions(+), 5 deletions(-) commit 819829f0319a759e8a6ccb7e4f1113f3f9f07aa3 Author: Amir Goldstein Date: Sun Oct 29 14:00:39 2023 +0200 ovl: refactor layer parsing helpers In preparation for new mount options to add lowerdirs one by one, generalize ovl_parse_param_upperdir() into helper ovl_parse_layer() that will be used for parsing a single lower layers. Suggested-by: Miklos Szeredi Link: https://lore.kernel.org/r/CAJfpegt7VC94KkRtb1dfHG8+4OzwPBLYqhtc8=QFUxpFJE+=RQ@mail.gmail.com/ Signed-off-by: Amir Goldstein fs/overlayfs/params.c | 121 ++++++++++++++++++++++++++++---------------------- 1 file changed, 67 insertions(+), 54 deletions(-) commit 0cea4c097d97fdc89de488bd4202d0b087ccec58 Author: Amir Goldstein Date: Sat Oct 28 11:25:30 2023 +0300 ovl: store and show the user provided lowerdir mount option We are about to add new mount options for adding lowerdir one by one, but those mount options will not support escaping. For the existing case, where lowerdir mount option is provided as a colon separated list, store the user provided (possibly escaped) string and display it as is when showing the lowerdir mount option. Signed-off-by: Amir Goldstein fs/overlayfs/params.c | 46 +++++++++++++++++++++++----------------------- fs/overlayfs/params.h | 1 + fs/overlayfs/super.c | 5 ++++- 3 files changed, 28 insertions(+), 24 deletions(-) commit c835110b588a750650988ca5000913c3c60d246b Author: Amir Goldstein Date: Sat Oct 28 12:07:45 2023 +0300 ovl: remove unused code in lowerdir param parsing Commit beae836e9c61 ("ovl: temporarily disable appending lowedirs") removed the ability to append lowerdirs with syntax lowerdir=":". Remove leftover code and comments that are irrelevant with lowerdir append mode disabled. Signed-off-by: Amir Goldstein fs/overlayfs/params.c | 95 +++++++++------------------------------------------ 1 file changed, 16 insertions(+), 79 deletions(-) commit bb7055a7349904623fe489b4461e12803da18ce6 Author: Alexander Larsson Date: Wed Aug 16 12:57:41 2023 +0200 ovl: Add documentation on nesting of overlayfs mounts Signed-off-by: Alexander Larsson Reviewed-by: Amir Goldstein Signed-off-by: Amir Goldstein Documentation/filesystems/overlayfs.rst | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) commit bc8df7a3dc035903426a17ea3027f55817de13a8 Author: Alexander Larsson Date: Wed Aug 23 16:33:42 2023 +0200 ovl: Add an alternative type of whiteout An xattr whiteout (called "xwhiteout" in the code) is a reguar file of zero size with the "overlay.whiteout" xattr set. A file like this in a directory with the "overlay.whiteouts" xattrs set will be treated the same way as a regular whiteout. The "overlay.whiteouts" directory xattr is used in order to efficiently handle overlay checks in readdir(), as we only need to checks xattrs in affected directories. The advantage of this kind of whiteout is that they can be escaped using the standard overlay xattr escaping mechanism. So, a file with a "overlay.overlay.whiteout" xattr would be unescaped to "overlay.whiteout", which could then be consumed by another overlayfs as a whiteout. Overlayfs itself doesn't create whiteouts like this, but a userspace mechanism could use this alternative mechanism to convert images that may contain whiteouts to be used with overlayfs. To work as a whiteout for both regular overlayfs mounts as well as userxattr mounts both the "user.overlay.whiteout*" and the "trusted.overlay.whiteout*" xattrs will need to be created. Signed-off-by: Alexander Larsson Reviewed-by: Amir Goldstein Signed-off-by: Amir Goldstein fs/overlayfs/dir.c | 4 ++-- fs/overlayfs/namei.c | 15 ++++++++++----- fs/overlayfs/overlayfs.h | 15 +++++++++++++++ fs/overlayfs/readdir.c | 27 ++++++++++++++++++++------- fs/overlayfs/super.c | 2 +- fs/overlayfs/util.c | 40 ++++++++++++++++++++++++++++++++++++++++ 6 files changed, 88 insertions(+), 15 deletions(-) commit dad02fad84cbce30f317b69a4f2391f90045f79d Author: Alexander Larsson Date: Tue Aug 15 09:40:50 2023 +0200 ovl: Support escaped overlay.* xattrs There are cases where you want to use an overlayfs mount as a lowerdir for another overlayfs mount. For example, if the system rootfs is on overlayfs due to composefs, or to make it volatile (via tmps), then you cannot currently store a lowerdir on the rootfs. This means you can't e.g. store on the rootfs a prepared container image for use using overlayfs. To work around this, we introduce an escapment mechanism for overlayfs xattrs. Whenever the lower/upper dir has a xattr named "overlay.overlay.XYZ", we list it as "overlay.XYZ" in listxattrs, and when the user calls getxattr or setxattr on "overlay.XYZ", we apply to "overlay.overlay.XYZ" in the backing directories. This allows storing any kind of overlay xattrs in a overlayfs mount that can be used as a lowerdir in another mount. It is possible to stack this mechanism multiple times, such that "overlay.overlay.overlay.XYZ" will survive two levels of overlay mounts, however this is not all that useful in practice because of stack depth limitations of overlayfs mounts. Note: These escaped xattrs are copied to upper during copy-up. Signed-off-by: Alexander Larsson Reviewed-by: Amir Goldstein Signed-off-by: Amir Goldstein fs/overlayfs/overlayfs.h | 7 +++++ fs/overlayfs/xattrs.c | 81 ++++++++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 85 insertions(+), 3 deletions(-) commit d431e652600bf2708f5a5ca3b46fa1b53606d1cf Author: Alexander Larsson Date: Tue Aug 15 09:33:44 2023 +0200 ovl: Add OVL_XATTR_TRUSTED/USER_PREFIX_LEN macros These match the ones for e.g. XATTR_TRUSTED_PREFIX_LEN. Signed-off-by: Alexander Larsson Reviewed-by: Amir Goldstein Signed-off-by: Amir Goldstein fs/overlayfs/overlayfs.h | 2 ++ fs/overlayfs/xattrs.c | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) commit 420a62dde6ebca7bc22e6c57c9cb25d7967ff1ea Author: Amir Goldstein Date: Tue Oct 10 14:17:59 2023 +0300 ovl: Move xattr support to new xattrs.c file This moves the code from super.c and inode.c, and makes ovl_xattr_get/set() static. This is in preparation for doing more work on xattrs support. Signed-off-by: Alexander Larsson Reviewed-by: Amir Goldstein Signed-off-by: Amir Goldstein fs/overlayfs/Makefile | 2 +- fs/overlayfs/inode.c | 122 ----------------------------- fs/overlayfs/overlayfs.h | 18 ++--- fs/overlayfs/super.c | 65 +--------------- fs/overlayfs/xattrs.c | 196 +++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 207 insertions(+), 196 deletions(-) commit 5b02bfc1e7e3811c5bf7f0fa626a0694d0dbbd77 Author: Amir Goldstein Date: Wed Aug 16 16:47:59 2023 +0300 ovl: do not encode lower fh with upper sb_writers held When lower fs is a nested overlayfs, calling encode_fh() on a lower directory dentry may trigger copy up and take sb_writers on the upper fs of the lower nested overlayfs. The lower nested overlayfs may have the same upper fs as this overlayfs, so nested sb_writers lock is illegal. Move all the callers that encode lower fh to before ovl_want_write(). Signed-off-by: Amir Goldstein fs/overlayfs/copy_up.c | 53 ++++++++++++++++++++++++++++++------------------ fs/overlayfs/namei.c | 37 +++++++++++++++++++++++++-------- fs/overlayfs/overlayfs.h | 26 +++++++++++++++++------- fs/overlayfs/super.c | 20 ++++++++++++------ fs/overlayfs/util.c | 11 +++++++++- 5 files changed, 104 insertions(+), 43 deletions(-) commit c63e56a4a6523fcb1358e1878607d77a40b534bb Author: Amir Goldstein Date: Wed Aug 16 12:42:18 2023 +0300 ovl: do not open/llseek lower file with upper sb_writers held overlayfs file open (ovl_maybe_lookup_lowerdata) and overlay file llseek take the ovl_inode_lock, without holding upper sb_writers. In case of nested lower overlay that uses same upper fs as this overlay, lockdep will warn about (possibly false positive) circular lock dependency when doing open/llseek of lower ovl file during copy up with our upper sb_writers held, because the locking ordering seems reverse to the locking order in ovl_copy_up_start(): - lower ovl_inode_lock - upper sb_writers Let the copy up "transaction" keeps an elevated mnt write count on upper mnt, but leaves taking upper sb_writers to lower level helpers only when they actually need it. This allows to avoid holding upper sb_writers during lower file open/llseek and prevents the lockdep warning. Minimizing the scope of upper sb_writers during copy up is also needed for fixing another possible deadlocks by a following patch. Signed-off-by: Amir Goldstein fs/overlayfs/copy_up.c | 76 ++++++++++++++++++++++++++++++++++++-------------- fs/overlayfs/util.c | 8 ++++-- 2 files changed, 61 insertions(+), 23 deletions(-) commit 162d06444070c12827d604a2cb6b6bd98d48cbb0 Author: Amir Goldstein Date: Thu Jul 20 12:51:21 2023 +0300 ovl: reorder ovl_want_write() after ovl_inode_lock() Make the locking order of ovl_inode_lock() strictly between the two vfs stacked layers, i.e.: - ovl vfs locks: sb_writers, inode_lock, ... - ovl_inode_lock - upper vfs locks: sb_writers, inode_lock, ... To that effect, move ovl_want_write() into the helpers ovl_nlink_start() and ovl_copy_up_start which currently take the ovl_inode_lock() after ovl_want_write(). Signed-off-by: Amir Goldstein fs/overlayfs/copy_up.c | 13 +++-------- fs/overlayfs/dir.c | 60 ++++++++++++++++++++++---------------------------- fs/overlayfs/export.c | 7 +----- fs/overlayfs/inode.c | 57 +++++++++++++++++++++++------------------------ fs/overlayfs/util.c | 34 ++++++++++++++++++++++------ 5 files changed, 84 insertions(+), 87 deletions(-) commit d08d3b3c2caf6c482703bbc5efaa7b9ae95dea20 Author: Amir Goldstein Date: Wed Aug 16 12:18:15 2023 +0300 ovl: split ovl_want_write() into two helpers ovl_get_write_access() gets write access to upper mnt without taking freeze protection on upper sb and ovl_start_write() only takes freeze protection on upper sb. These helpers will be used to breakup the large ovl_want_write() scope during copy up into finer grained freeze protection scopes. Signed-off-by: Amir Goldstein fs/overlayfs/overlayfs.h | 4 ++++ fs/overlayfs/util.c | 26 ++++++++++++++++++++++++++ 2 files changed, 30 insertions(+) commit c002728f608183449673818076380124935e6b9b Author: Amir Goldstein Date: Wed Sep 27 13:43:44 2023 +0300 ovl: add helper ovl_file_modified() A simple wrapper for updating ovl inode size/mtime, to conform with ovl_file_accessed(). Signed-off-by: Amir Goldstein fs/overlayfs/file.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) commit f7621b11e8acc8efa208c9420ff3ecb198b20e29 Author: Amir Goldstein Date: Thu Aug 24 14:51:17 2023 +0300 ovl: protect copying of realinode attributes to ovl inode ovl_copyattr() may be called concurrently from aio completion context without any lock and that could lead to overlay inode attributes getting permanently out of sync with real inode attributes. Use ovl inode spinlock to protect ovl_copyattr(). Signed-off-by: Amir Goldstein fs/overlayfs/util.c | 2 ++ 1 file changed, 2 insertions(+) commit 389a4a4a19851211bb9c40d31c664591fb206f69 Author: Amir Goldstein Date: Tue Aug 22 20:50:59 2023 +0300 ovl: punt write aio completion to workqueue We want to protect concurrent updates of ovl inode size and mtime (i.e. ovl_copyattr()) from aio completion context. Punt write aio completion to a workqueue so that we can protect ovl_copyattr() with a spinlock. Export sb_init_dio_done_wq(), so that overlayfs can use its own dio workqueue to punt aio completions. Suggested-by: Jens Axboe Link: https://lore.kernel.org/r/8620dfd3-372d-4ae0-aa3f-2fe97dda1bca@kernel.dk/ Signed-off-by: Amir Goldstein fs/overlayfs/file.c | 42 +++++++++++++++++++++++++++++++++++++++++- fs/super.c | 1 + 2 files changed, 42 insertions(+), 1 deletion(-) commit 5f034d34737e8c440bbbd13e5ef283793d841140 Author: Amir Goldstein Date: Tue Aug 29 16:25:47 2023 +0300 ovl: propagate IOCB_APPEND flag on writes to realfile If ovl file is opened O_APPEND, the underlying realfile is also opened O_APPEND, so it makes sense to propagate the IOCB_APPEND flags on sync writes to realfile, just as we do with aio writes. Effectively, because sync ovl writes are protected by inode lock, this change only makes a difference if the realfile is written to (size extending writes) from underneath overlayfs. The behavior in this case is undefined, so it is ok if we change the behavior (to fail the ovl IOCB_APPEND write). Signed-off-by: Amir Goldstein fs/overlayfs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit db5b5e83eee46ec5e3d685282c9e4f38946cb0ea Author: Amir Goldstein Date: Wed Sep 6 10:52:13 2023 +0300 ovl: use simpler function to convert iocb to rw flags Overlayfs implements its own function to translate iocb flags into rw flags, so that they can be passed into another vfs call. With commit ce71bfea207b4 ("fs: align IOCB_* flags with RWF_* flags") Jens created a 1:1 matching between the iocb flags and rw flags, simplifying the conversion. Signed-off-by: Alessio Balsini Signed-off-by: Amir Goldstein fs/overlayfs/file.c | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-) commit ca2e9c3beec67dc90944f3d2a72f77652fb9cefc Merge: 9ab021a1b570 b5034c63858d Author: Linus Torvalds Date: Mon Oct 30 12:10:24 2023 -1000 Merge tag 'x86_cpu_for_6.7_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpuid updates from Borislav Petkov: - Make sure the "svm" feature flag is cleared from /proc/cpuinfo when virtualization support is disabled in the BIOS on AMD and Hygon platforms - A minor cleanup * tag 'x86_cpu_for_6.7_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpu/amd: Remove redundant 'break' statement x86/cpu: Clear SVM feature if disabled by BIOS commit 9ab021a1b57007a22761f6f41d91eb4aae10d145 Merge: f84a52eef5c3 4cee14bcb148 Author: Linus Torvalds Date: Mon Oct 30 12:07:29 2023 -1000 Merge tag 'x86_cache_for_6.7_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 resource control updates from Borislav Petkov: - Add support for non-contiguous capacity bitmasks being added to Intel's CAT implementation - Other improvements to resctrl code: better configuration, simplifications, debugging support, fixes * tag 'x86_cache_for_6.7_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/resctrl: Display RMID of resource group x86/resctrl: Add support for the files of MON groups only x86/resctrl: Display CLOSID for resource group x86/resctrl: Introduce "-o debug" mount option x86/resctrl: Move default group file creation to mount x86/resctrl: Unwind properly from rdt_enable_ctx() x86/resctrl: Rename rftype flags for consistency x86/resctrl: Simplify rftype flag definitions x86/resctrl: Add multiple tasks to the resctrl group at once Documentation/x86: Document resctrl's new sparse_masks x86/resctrl: Add sparse_masks file in info x86/resctrl: Enable non-contiguous CBMs in Intel CAT x86/resctrl: Rename arch_has_sparse_bitmaps x86/resctrl: Fix remaining kernel-doc warnings commit f84a52eef5c35b49947b132ddd9b79d6767469af Merge: 01ae815c5021 9d9c22cc444a Author: Linus Torvalds Date: Mon Oct 30 11:48:49 2023 -1000 Merge tag 'x86_bugs_for_6.7_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 hw mitigation updates from Borislav Petkov: - A bunch of improvements, cleanups and fixlets to the SRSO mitigation machinery and other, general cleanups to the hw mitigations code, by Josh Poimboeuf - Improve the return thunk detection by objtool as it is absolutely important that the default return thunk is not used after returns have been patched. Future work to detect and report this better is pending - Other misc cleanups and fixes * tag 'x86_bugs_for_6.7_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (21 commits) x86/retpoline: Document some thunk handling aspects x86/retpoline: Make sure there are no unconverted return thunks due to KCSAN x86/callthunks: Delete unused "struct thunk_desc" x86/vdso: Run objtool on vdso32-setup.o objtool: Fix return thunk patching in retpolines x86/srso: Remove unnecessary semicolon x86/pti: Fix kernel warnings for pti= and nopti cmdline options x86/calldepth: Rename __x86_return_skl() to call_depth_return_thunk() x86/nospec: Refactor UNTRAIN_RET[_*] x86/rethunk: Use SYM_CODE_START[_LOCAL]_NOALIGN macros x86/srso: Disentangle rethunk-dependent options x86/srso: Move retbleed IBPB check into existing 'has_microcode' code block x86/bugs: Remove default case for fully switched enums x86/srso: Remove 'pred_cmd' label x86/srso: Unexport untraining functions x86/srso: Improve i-cache locality for alias mitigation x86/srso: Fix unret validation dependencies x86/srso: Fix vulnerability reporting for missing microcode x86/srso: Print mitigation for retbleed IBPB case x86/srso: Print actual mitigation if requested mitigation isn't possible ... commit 01ae815c5021532aecf8c5e280cf50cdaa72a9d6 Merge: 66cc8838c72b 1bae0cfe4a17 Author: Linus Torvalds Date: Mon Oct 30 11:47:03 2023 -1000 Merge tag 'ras_core_for_6.7_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 RAS updates from Borislav Petkov: - Specify what error addresses reported on AMD are actually usable memory error addresses for further decoding * tag 'ras_core_for_6.7_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Cleanup mce_usable_address() x86/mce: Define amd_mce_usable_address() x86/MCE/AMD: Split amd_mce_is_memory_error() commit 66cc8838c72b165048f49f88fc9d1be996abd35b Merge: 9e8770528966 6f15b178cd63 Author: Linus Torvalds Date: Mon Oct 30 11:45:36 2023 -1000 Merge tag 'edac_updates_for_v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: - A new EDAC driver for Xilinx's Versal integrated memory controller * tag 'edac_updates_for_v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/versal: Add a Xilinx Versal memory controller driver dt-bindings: memory-controllers: Add support for Xilinx Versal EDAC for DDRMC commit e0f9f0e0737f47f643a66c6db158af61818336bc Merge: 55c900477f5b eefed7662ff2 Author: Jakub Kicinski Date: Mon Oct 30 14:36:56 2023 -0700 Merge tag 'ipsec-next-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2023-10-28 1) Remove unused function declarations of xfrm4_extract_input and xfrm6_extract_input. From Yue Haibing. 2) Annotate struct xfrm_sec_ctx with __counted_by. From Kees Cook. 3) Support GRO decapsulation for ESP in UDP encapsulation. From Antony Antony et all. 4) Replace the xfrm session decode with flow dissector. From Florian Westphal. 5) Fix a use after free in __xfrm6_udp_encap_rcv. 6) Fix the layer 4 flowi decoding. From Florian Westphal. * tag 'ipsec-next-2023-10-28' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next: xfrm: policy: fix layer 4 flowi decoding xfrm Fix use after free in __xfrm6_udp_encap_rcv. xfrm: policy: replace session decode with flow dissector xfrm: move mark and oif flowi decode into common code xfrm: pass struct net to xfrm_decode_session wrappers xfrm: Support GRO for IPv6 ESP in UDP encapsulation xfrm: Support GRO for IPv4 ESP in UDP encapsulation xfrm: Use the XFRM_GRO to indicate a GRO call on input xfrm: Annotate struct xfrm_sec_ctx with __counted_by xfrm: Remove unused function declarations ==================== Link: https://lore.kernel.org/r/20231028084328.3119236-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit fe612629746cf5cc7040529f780d46929605d0a6 Author: Herve Codina Date: Wed Oct 11 08:14:12 2023 +0200 dt-bindings: soc: fsl: cpm_qe: cpm1-scc-qmc: Add support for QMC HDLC The QMC (QUICC mutichannel controller) is a controller present in some PowerQUICC SoC such as MPC885. The QMC HDLC uses the QMC controller to transfer HDLC data. Additionally, a framer can be connected to the QMC HDLC. If present, this framer is the interface between the TDM bus used by the QMC HDLC and the E1/T1 line. The QMC HDLC can use this framer to get information about the E1/T1 line and configure the E1/T1 line. Signed-off-by: Herve Codina Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20231011061437.64213-9-herve.codina@bootlin.com Signed-off-by: Rob Herring .../bindings/soc/fsl/cpm_qe/fsl,cpm1-scc-qmc.yaml | 30 ++++++++++++++++++++++ 1 file changed, 30 insertions(+) commit 527de94b0fb38502f4f563e9f60c372d37fe0203 Author: Herve Codina Date: Wed Oct 11 08:14:11 2023 +0200 dt-bindings: soc: fsl: cpm_qe: cpm1-scc-qmc: Add 'additionalProperties: false' in child nodes Additional properties in child node should not be allowed. Prevent them adding 'additionalProperties: false' Signed-off-by: Herve Codina Acked-by: Conor Dooley Acked-by: Rob Herring Link: https://lore.kernel.org/r/20231011061437.64213-8-herve.codina@bootlin.com Signed-off-by: Rob Herring Documentation/devicetree/bindings/soc/fsl/cpm_qe/fsl,cpm1-scc-qmc.yaml | 1 + 1 file changed, 1 insertion(+) commit f2147371a83c6de1128093c163dc17bc61096362 Author: Herve Codina Date: Wed Oct 11 08:14:10 2023 +0200 dt-bindings: soc: fsl: cpm_qe: cpm1-scc-qmc: Fix example property name The given example mentions the 'fsl,mode' property whereas the correct property name, the one described, is 'fsl,operational-mode'. Fix the example to use the correct property name. Fixes: a9b121327c93 ("dt-bindings: soc: fsl: cpm_qe: Add QMC controller") Signed-off-by: Herve Codina Acked-by: Conor Dooley Acked-by: Rob Herring Link: https://lore.kernel.org/r/20231011061437.64213-7-herve.codina@bootlin.com Signed-off-by: Rob Herring .../devicetree/bindings/soc/fsl/cpm_qe/fsl,cpm1-scc-qmc.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 0a6d7f8275f255eda823c0f0b61d024f6f5b483d Merge: 720e4a4a6867 7e52b1164a47 Author: Stephen Boyd Date: Mon Oct 30 14:12:53 2023 -0700 Merge branch 'clk-cleanup' into clk-next * clk-cleanup: clk: si521xx: Increase stack based print buffer size in probe clk: Use device_get_match_data() clk: cdce925: Extend match support for OF tables clk: si570: Simplify probe clk: si5351: Simplify probe clk: rs9: Use i2c_get_match_data() instead of device_get_match_data() clk: clk-si544: Simplify probe() and is_valid_frequency() clk: si521xx: Use i2c_get_match_data() instead of device_get_match_data() clk: npcm7xx: Fix incorrect kfree clk: at91: remove unnecessary conditions clk: ti: fix double free in of_ti_divider_clk_setup() clk: keystone: pll: fix a couple NULL vs IS_ERR() checks clk: ralink: mtmips: quiet unused variable warning clk: gate: fix comment typo and grammar clk: asm9620: Remove 'hw' local variable that isn't checked commit 720e4a4a68670dfda638da236d374fc7a4be0a28 Merge: d33050aec3f6 c3f187461f09 75357829cc8e 9e952929dfe2 2790e2a33aa9 Author: Stephen Boyd Date: Mon Oct 30 14:12:20 2023 -0700 Merge branches 'clk-renesas', 'clk-kunit', 'clk-regmap' and 'clk-frac-divider' into clk-next - Make clk kunit tests work with lockdep - Fix clk gate kunit test for big-endian - Convert more than a handful of clk drivers to use regmap maple tree - Consider the CLK_FRAC_DIVIDER_ZERO_BASED in fractional divider clk implementation * clk-renesas: (23 commits) clk: renesas: r9a08g045: Add clock and reset support for SDHI1 and SDHI2 clk: renesas: rzg2l: Use %x format specifier to print CLK_ON_R() clk: renesas: Add minimal boot support for RZ/G3S SoC clk: renesas: rzg2l: Add divider clock for RZ/G3S clk: renesas: rzg2l: Refactor SD mux driver clk: renesas: rzg2l: Remove CPG_SDHI_DSEL from generic header clk: renesas: rzg2l: Add struct clk_hw_data clk: renesas: rzg2l: Add support for RZ/G3S PLL clk: renesas: rzg2l: Remove critical area clk: renesas: rzg2l: Fix computation formula clk: renesas: rzg2l: Trust value returned by hardware clk: renesas: rzg2l: Lock around writes to mux register clk: renesas: rzg2l: Wait for status bit of SD mux before continuing clk: renesas: rcar-gen3: Extend SDnH divider table dt-bindings: clock: renesas,rzg2l-cpg: Document RZ/G3S SoC clk: renesas: r8a7795: Constify r8a7795_*_clks clk: renesas: r9a06g032: Name anonymous structs clk: renesas: r9a06g032: Fix kerneldoc warning clk: renesas: rzg2l: Use u32 for flag and mux_flags clk: renesas: rzg2l: Use FIELD_GET() for PLL register fields ... * clk-kunit: clk: Fix clk gate kunit test on big-endian CPUs clk: Parameterize clk_leaf_mux_set_rate_parent clk: Drive clk_leaf_mux_set_rate_parent test from clk_ops * clk-regmap: clk: versaclock7: Convert to use maple tree register cache clk: versaclock5: Convert to use maple tree register cache clk: versaclock3: Convert to use maple tree register cache clk: versaclock3: Remove redundant _is_writeable() clk: si570: Convert to use maple tree register cache clk: si544: Convert to use maple tree register cache clk: si5351: Convert to use maple tree register cache clk: si5341: Convert to use maple tree register cache clk: si514: Convert to use maple tree register cache clk: cdce925: Convert to use maple tree register cache * clk-frac-divider: clk: fractional-divider: tests: Add test suite for edge cases clk: fractional-divider: Improve approximation when zero based and export commit d33050aec3f6b37294dc318e9cdb969ed5094a2d Merge: 702a582b5cf9 e43d31915cc4 48a8748fd0d1 c8e1d8ae6aba 65f9e1becb55 0dea4e30feda Author: Stephen Boyd Date: Mon Oct 30 14:10:51 2023 -0700 Merge branches 'clk-debugfs', 'clk-spreadtrum', 'clk-sifive', 'clk-counted' and 'clk-qcom' into clk-next - Add consumer info to clk debugfs - Fix various clk drivers that have clk_hw_onecell_data not at the end of an allocation * clk-debugfs: clk: Allow phase adjustment from debugfs clk: Show active consumers of clocks in debugfs * clk-spreadtrum: clk: sprd: Composite driver support offset config * clk-sifive: clk: sifive: Allow building the driver as a module clk: analogbits: Allow building the library as a module * clk-counted: clk: socfpga: agilex: Add bounds-checking coverage for struct stratix10_clock_data clk: socfpga: Fix undefined behavior bug in struct stratix10_clock_data clk: visconti: Add bounds-checking coverage for struct visconti_pll_provider clk: visconti: Fix undefined behavior bug in struct visconti_pll_provider * clk-qcom: (36 commits) clk: qcom: apss-ipq6018: add the GPLL0 clock also as clock provider clk: qcom: ipq5332: drop the CLK_SET_RATE_PARENT flag from GPLL clocks clk: qcom: ipq9574: drop the CLK_SET_RATE_PARENT flag from GPLL clocks clk: qcom: ipq5018: drop the CLK_SET_RATE_PARENT flag from GPLL clocks clk: qcom: ipq6018: drop the CLK_SET_RATE_PARENT flag from PLL clocks clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT flag from PLL clocks clk: qcom: gcc-ipq6018: add QUP6 I2C clock clk: qcom: apss-ipq6018: ipq5332: add safe source switch for a53pll clk: qcom: apss-ipq-pll: Fix 'l' value for ipq5332_pll_config clk: qcom: apss-ipq-pll: Use stromer plus ops for stromer plus pll clk: qcom: clk-alpha-pll: introduce stromer plus ops clk: qcom: config IPQ_APSS_6018 should depend on QCOM_SMEM clk: qcom: videocc-sm8550: switch to clk_lucid_ole_pll_configure clk: qcom: gpucc-sm8550: switch to clk_lucid_ole_pll_configure clk: qcom: Replace of_device.h with explicit includes clk: qcom: smd-rpm: Move CPUSS_GNoC clock to interconnect clk: qcom: cbf-msm8996: Convert to platform remove callback returning void clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src clk: qcom: Add GCC driver support for SM4450 dt-bindings: clock: qcom: Add GCC clocks for SM4450 ... commit 702a582b5cf930211f3cea9e6550bc9de9a145a8 Merge: 790437bbe0ef 84aefafe6b29 b79a08af3234 bd54ccc0f147 4eb15b036367 701d1057654f Author: Stephen Boyd Date: Mon Oct 30 14:10:39 2023 -0700 Merge branches 'clk-doc', 'clk-amlogic', 'clk-mediatek', 'clk-twl' and 'clk-imx' into clk-next - Add clock driver for TWL6032 * clk-doc: clk: linux/clk-provider.h: fix kernel-doc warnings and typos * clk-amlogic: clk: meson: S4: select CONFIG_COMMON_CLK_MESON_CLKC_UTILS clk: meson: S4: add support for Amlogic S4 SoC peripheral clock controller clk: meson: S4: add support for Amlogic S4 SoC PLL clock driver dt-bindings: clock: document Amlogic S4 SoC peripherals clock controller dt-bindings: clock: document Amlogic S4 SoC PLL clock controller * clk-mediatek: clk: mediatek: fix double free in mtk_clk_register_pllfh() clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data * clk-twl: clk: twl: add clock driver for TWL6032 * clk-imx: clk: imx: imx8qm/qxp: add more resources to whitelist clk: imx: scu: ignore clks not owned by Cortex-A partition clk: imx8: remove MLB support clk: imx: imx8qm-rsrc: drop VPU_UART/VPUCORE clk: imx: imx8qxp: correct the enet clocks for i.MX8DXL clk: imx: imx8qxp: Fix elcdif_pll clock clk: imx: imx8dxl-rsrc: keep sorted in the ascending order clk: imx: imx6sx: Allow a different LCDIF1 clock parent clk: imx: imx8mq: correct error handling path clk: imx8mp: Remove non-existent IMX8MP_CLK_AUDIOMIX_PDM_ROOT clk: imx: imx8: Simplify clk_imx_acm_detach_pm_domains() clk: imx: imx8: Add a message in case of devm_clk_hw_register_mux_parent_data_table() error clk: imx: imx8: Fix an error handling path in imx8_acm_clk_probe() clk: imx: imx8: Fix an error handling path if devm_clk_hw_register_mux_parent_data_table() fails clk: imx: imx8: Fix an error handling path in clk_imx_acm_attach_pm_domains() clk: imx: Select MXC_CLK for CLK_IMX8QXP commit 9e87705289667a6c5185c619ea32f3d39314eb1b Merge: d5acbc60fafb b827ac419721 Author: Linus Torvalds Date: Mon Oct 30 11:09:38 2023 -1000 Merge tag 'bcachefs-2023-10-30' of https://evilpiepirate.org/git/bcachefs Pull initial bcachefs updates from Kent Overstreet: "Here's the bcachefs filesystem pull request. One new patch since last week: the exportfs constants ended up conflicting with other filesystems that are also getting added to the global enum, so switched to new constants picked by Amir. The only new non fs/bcachefs/ patch is the objtool patch that adds bcachefs functions to the list of noreturns. The patch that exports osq_lock() has been dropped for now, per Ingo" * tag 'bcachefs-2023-10-30' of https://evilpiepirate.org/git/bcachefs: (2781 commits) exportfs: Change bcachefs fid_type enum to avoid conflicts bcachefs: Refactor memcpy into direct assignment bcachefs: Fix drop_alloc_keys() bcachefs: snapshot_create_lock bcachefs: Fix snapshot skiplists during snapshot deletion bcachefs: bch2_sb_field_get() refactoring bcachefs: KEY_TYPE_error now counts towards i_sectors bcachefs: Fix handling of unknown bkey types bcachefs: Switch to unsafe_memcpy() in a few places bcachefs: Use struct_size() bcachefs: Correctly initialize new buckets on device resize bcachefs: Fix another smatch complaint bcachefs: Use strsep() in split_devs() bcachefs: Add iops fields to bch_member bcachefs: Rename bch_sb_field_members -> bch_sb_field_members_v1 bcachefs: New superblock section members_v2 bcachefs: Add new helper to retrieve bch_member from sb bcachefs: bucket_lock() is now a sleepable lock bcachefs: fix crc32c checksum merge byte order problem bcachefs: Fix bch2_inode_delete_keys() ... commit 70b416afc99863d9f5a5959f6555bbb290d70eee Author: Rob Herring Date: Mon Sep 25 17:05:06 2023 -0500 dt-bindings: arm,coresight-cti: Add missing additionalProperties on child nodes Just as unevaluatedProperties or additionalProperties are required at the top level of schemas, they should (and will) also be required for child node schemas. That ensures only documented properties are present for any node. Adding additionalProperties constraint on 'trig-conns' nodes results in warnings that 'cpu' and 'arm,cs-dev-assoc' are not allowed. These are already defined for the parent node, but need to be duplicated for the child node. Drop the free form description that the properties also apply to the child nodes. Acked-by: Conor Dooley Reviewed-by: Mike Leach Link: https://lore.kernel.org/r/20230925220511.2026514-2-robh@kernel.org Signed-off-by: Rob Herring .../devicetree/bindings/arm/arm,coresight-cti.yaml | 33 ++++++++++++++++------ 1 file changed, 24 insertions(+), 9 deletions(-) commit 5027cf58e402351bf5585d3d22fb8d92056782eb Author: Rob Herring Date: Mon Sep 25 17:05:05 2023 -0500 dt-bindings: arm,coresight-cti: Drop type for 'cpu' property 'cpu' has been added as a single phandle type to dtschema, so drop the type here. Reviewed-by: Mike Leach Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20230925220511.2026514-1-robh@kernel.org Signed-off-by: Rob Herring Documentation/devicetree/bindings/arm/arm,coresight-cti.yaml | 1 - 1 file changed, 1 deletion(-) commit 4d2309224ec25a4997e40a45b5f74f7defd3ecf2 Author: Rob Herring Date: Mon Oct 16 10:55:37 2023 -0500 dt-bindings: soundwire: Add reference to soundwire-controller.yaml schema The soundwire-controller.yaml schema already defines the form for devices in child nodes, so there's no need to do the same in the QCom controller binding. Add a $ref to the soundwire-controller.yaml schema and drop the child node schema. Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231016155537.2973625-1-robh@kernel.org Signed-off-by: Rob Herring .../devicetree/bindings/soundwire/qcom,soundwire.yaml | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) commit b2b67c997bf74453f3469d8b54e4859f190943bd Author: Jason Gunthorpe Date: Mon Oct 30 15:11:20 2023 -0300 iommufd: Organize the mock domain alloc functions closer to Joerg's tree Patches in Joerg's iommu tree to convert the mock driver to use domain_alloc_paging() that clash badly with the way the selftest changes for nesting were structured. Massage the selftest so that it looks closer the code after the domain_alloc_paging() conversion to ease the merge. Change __mock_domain_alloc_paging() into mock_domain_alloc_paging() in the same way as the iommu tree. The merge resolution then trivially takes both and deletes mock_domain_alloc(). Link: https://lore.kernel.org/r/0-v1-90a855762c96+19de-mock_merge_jgg@nvidia.com Reviewed-by: Nicolin Chen Reviewed-by: Kevin Tian Reviewed-by: Yi Liu Signed-off-by: Jason Gunthorpe drivers/iommu/iommufd/selftest.c | 35 ++++++++++++++++------------------- 1 file changed, 16 insertions(+), 19 deletions(-) commit a9f32acf102546b1ce0af03c072bef090f3d84e8 Author: Rob Herring Date: Tue Sep 26 09:42:44 2023 -0500 dt-bindings: input: syna,rmi4: Make "additionalProperties: true" explicit Make it explicit that the not yet documented child nodes have additional properties and the child node schema is not complete. Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20230926144249.4053202-1-robh@kernel.org Signed-off-by: Rob Herring Documentation/devicetree/bindings/input/syna,rmi4.yaml | 2 ++ 1 file changed, 2 insertions(+) commit fed3a1be6433e15833068c701bfde7b422d8b988 Merge: c43c64f8a1c6 4fa008a2db48 Author: Namhyung Kim Date: Mon Oct 30 13:39:28 2023 -0700 Merge tag 'perf-tools-fixes-for-v6.6-2-2023-10-20' into perf-tools-next To get the latest fixes in the perf tools including perf stat output, dlfilter and LLVM feature detection. Signed-off-by: Namhyung Kim commit d5acbc60fafbe0fc94c552ce916dd592cd4c6371 Merge: 8829687a4ac1 c6e8f898f56f Author: Linus Torvalds Date: Mon Oct 30 10:42:06 2023 -1000 Merge tag 'for-6.7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "New features: - raid-stripe-tree New tree for logical file extent mapping where the physical mapping may not match on multiple devices. This is now used in zoned mode to implement RAID0/RAID1* profiles, but can be used in non-zoned mode as well. The support for RAID56 is in development and will eventually fix the problems with the current implementation. This is a backward incompatible feature and has to be enabled at mkfs time. - simple quota accounting (squota) A simplified mode of qgroup that accounts all space on the initial extent owners (a subvolume), the snapshots are then cheap to create and delete. The deletion of snapshots in fully accounting qgroups is a known CPU/IO performance bottleneck. The squota is not suitable for the general use case but works well for containers where the original subvolume exists for the whole time. This is a backward incompatible feature as it needs extending some structures, but can be enabled on an existing filesystem. - temporary filesystem fsid (temp_fsid) The fsid identifies a filesystem and is hard coded in the structures, which disallows mounting the same fsid found on different devices. For a single device filesystem this is not strictly necessary, a new temporary fsid can be generated on mount e.g. after a device is cloned. This will be used by Steam Deck for root partition A/B testing, or can be used for VM root images. Other user visible changes: - filesystems with partially finished metadata_uuid conversion cannot be mounted anymore and the uuid fixup has to be done by btrfs-progs (btrfstune). Performance improvements: - reduce reservations for checksum deletions (with enabled free space tree by factor of 4), on a sample workload on file with many extents the deletion time decreased by 12% - make extent state merges more efficient during insertions, reduce rb-tree iterations (run time of critical functions reduced by 5%) Core changes: - the integrity check functionality has been removed, this was a debugging feature and removal does not affect other integrity checks like checksums or tree-checker - space reservation changes: - more efficient delayed ref reservations, this avoids building up too much work or overusing or exhausting the global block reserve in some situations - move delayed refs reservation to the transaction start time, this prevents some ENOSPC corner cases related to exhaustion of global reserve - improvements in reducing excessive reservations for block group items - adjust overcommit logic in near full situations, account for one more chunk to eventually allocate metadata chunk, this is mostly relevant for small filesystems (<10GiB) - single device filesystems are scanned but not registered (except seed devices), this allows temp_fsid to work - qgroup iterations do not need GFP_ATOMIC allocations anymore - cleanups, refactoring, reduced data structure size, function parameter simplifications, error handling fixes" * tag 'for-6.7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (156 commits) btrfs: open code timespec64 in struct btrfs_inode btrfs: remove redundant log root tree index assignment during log sync btrfs: remove redundant initialization of variable dirty in btrfs_update_time() btrfs: sysfs: show temp_fsid feature btrfs: disable the device add feature for temp-fsid btrfs: disable the seed feature for temp-fsid btrfs: update comment for temp-fsid, fsid, and metadata_uuid btrfs: remove pointless empty log context list check when syncing log btrfs: update comment for struct btrfs_inode::lock btrfs: remove pointless barrier from btrfs_sync_file() btrfs: add and use helpers for reading and writing last_trans_committed btrfs: add and use helpers for reading and writing fs_info->generation btrfs: add and use helpers for reading and writing log_transid btrfs: add and use helpers for reading and writing last_log_commit btrfs: support cloned-device mount capability btrfs: add helper function find_fsid_by_disk btrfs: stop reserving excessive space for block group item insertions btrfs: stop reserving excessive space for block group item updates btrfs: reorder btrfs_inode to fill gaps btrfs: open code btrfs_ordered_inode_tree in btrfs_inode ... commit 123f42f0ad6815014f54d0cc6eb9039c46ee2907 Merge: 53ce49ea7560 62708be351fe Author: Oliver Upton Date: Mon Oct 30 20:24:07 2023 +0000 Merge branch kvm-arm64/pmu_pmcr_n into kvmarm/next * kvm-arm64/pmu_pmcr_n: : User-defined PMC limit, courtesy Raghavendra Rao Ananta : : Certain VMMs may want to reserve some PMCs for host use while running a : KVM guest. This was a bit difficult before, as KVM advertised all : supported counters to the guest. Userspace can now limit the number of : advertised PMCs by writing to PMCR_EL0.N, as KVM's sysreg and PMU : emulation enforce the specified limit for handling guest accesses. KVM: selftests: aarch64: vPMU test for validating user accesses KVM: selftests: aarch64: vPMU register test for unimplemented counters KVM: selftests: aarch64: vPMU register test for implemented counters KVM: selftests: aarch64: Introduce vpmu_counter_access test tools: Import arm_pmuv3.h KVM: arm64: PMU: Allow userspace to limit PMCR_EL0.N for the guest KVM: arm64: Sanitize PM{C,I}NTEN{SET,CLR}, PMOVS{SET,CLR} before first run KVM: arm64: Add {get,set}_user for PM{C,I}NTEN{SET,CLR}, PMOVS{SET,CLR} KVM: arm64: PMU: Set PMCR_EL0.N for vCPU based on the associated PMU KVM: arm64: PMU: Add a helper to read a vCPU's PMCR_EL0 KVM: arm64: Select default PMU in KVM_ARM_VCPU_INIT handler KVM: arm64: PMU: Introduce helpers to set the guest's PMU Signed-off-by: Oliver Upton commit 8829687a4ac1d484639425a691da46f6e361aec1 Merge: 8b16da681eb0 15baf55481de Author: Linus Torvalds Date: Mon Oct 30 10:23:42 2023 -1000 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux Pull fscrypt updates from Eric Biggers: "This update adds support for configuring the crypto data unit size (i.e. the granularity of file contents encryption) to be less than the filesystem block size. This can allow users to use inline encryption hardware in some cases when it wouldn't otherwise be possible. In addition, there are two commits that are prerequisites for the extent-based encryption support that the btrfs folks are working on" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: fscrypt: track master key presence separately from secret fscrypt: rename fscrypt_info => fscrypt_inode_info fscrypt: support crypto data unit size less than filesystem block size fscrypt: replace get_ino_and_lblk_bits with just has_32bit_inodes fscrypt: compute max_lblk_bits from s_maxbytes and block size fscrypt: make the bounce page pool opt-in instead of opt-out fscrypt: make it clearer that key_prefix is deprecated commit 53ce49ea75602b51a1feb3844d535ced42b2d8c2 Merge: a87a36436cb0 e0bb80c62cfd Author: Oliver Upton Date: Mon Oct 30 20:21:19 2023 +0000 Merge branch kvm-arm64/mops into kvmarm/next * kvm-arm64/mops: : KVM support for MOPS, courtesy of Kristina Martsenko : : MOPS adds new instructions for accelerating memcpy(), memset(), and : memmove() operations in hardware. This series brings virtualization : support for KVM guests, and allows VMs to run on asymmetrict systems : that may have different MOPS implementations. KVM: arm64: Expose MOPS instructions to guests KVM: arm64: Add handler for MOPS exceptions Signed-off-by: Oliver Upton commit a87a36436cb0cc6e576731f6a4409841e46d3ed1 Merge: 54b44ad26c42 70c7b704ca72 Author: Oliver Upton Date: Mon Oct 30 20:21:09 2023 +0000 Merge branch kvm-arm64/writable-id-regs into kvmarm/next * kvm-arm64/writable-id-regs: : Writable ID registers, courtesy of Jing Zhang : : This series significantly expands the architectural feature set that : userspace can manipulate via the ID registers. A new ioctl is defined : that makes the mutable fields in the ID registers discoverable to : userspace. KVM: selftests: Avoid using forced target for generating arm64 headers tools headers arm64: Fix references to top srcdir in Makefile KVM: arm64: selftests: Test for setting ID register from usersapce tools headers arm64: Update sysreg.h with kernel sources KVM: selftests: Generate sysreg-defs.h and add to include path perf build: Generate arm64's sysreg-defs.h and add to include path tools: arm64: Add a Makefile for generating sysreg-defs.h KVM: arm64: Document vCPU feature selection UAPIs KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 KVM: arm64: Reject attempts to set invalid debug arch version KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version KVM: arm64: Use guest ID register values for the sake of emulation KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS KVM: arm64: Allow userspace to get the writable masks for feature ID registers Signed-off-by: Oliver Upton commit 70c7b704ca7251b09dd4ce22a31b5bea8c797d24 Author: Oliver Upton Date: Fri Oct 27 00:54:39 2023 +0000 KVM: selftests: Avoid using forced target for generating arm64 headers The 'prepare' target that generates the arm64 sysreg headers had no prerequisites, so it wound up forcing a rebuild of all KVM selftests each invocation. Add a rule for the generated headers and just have dependents use that for a prerequisite. Reported-by: Nina Schoetterl-Glausch Fixes: 9697d84cc3b6 ("KVM: selftests: Generate sysreg-defs.h and add to include path") Tested-by: Nina Schoetterl-Glausch Link: https://lore.kernel.org/r/20231027005439.3142015-3-oliver.upton@linux.dev Signed-off-by: Oliver Upton tools/testing/selftests/kvm/Makefile | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit fbb075c11663a6fb7beb4ef386e069e06594e229 Author: Oliver Upton Date: Fri Oct 27 00:54:38 2023 +0000 tools headers arm64: Fix references to top srcdir in Makefile Aishwarya reports that KVM selftests for arm64 fail with the following error: | make[4]: Entering directory '/tmp/kci/linux/tools/testing/selftests/kvm' | Makefile:270: warning: overriding recipe for target | '/tmp/kci/linux/build/kselftest/kvm/get-reg-list' | Makefile:265: warning: ignoring old recipe for target | '/tmp/kci/linux/build/kselftest/kvm/get-reg-list' | make -C ../../../../tools/arch/arm64/tools/ | make[5]: Entering directory '/tmp/kci/linux/tools/arch/arm64/tools' | Makefile:10: ../tools/scripts/Makefile.include: No such file or directory | make[5]: *** No rule to make target '../tools/scripts/Makefile.include'. | Stop. It would appear that this only affects builds from the top-level Makefile (e.g. make kselftest-all), as $(srctree) is set to ".". Work around the issue by shadowing the kselftest naming scheme for the source tree variable. Reported-by: Aishwarya TCV Fixes: 0359c946b131 ("tools headers arm64: Update sysreg.h with kernel sources") Link: https://lore.kernel.org/r/20231027005439.3142015-2-oliver.upton@linux.dev Signed-off-by: Oliver Upton tools/arch/arm64/tools/Makefile | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 54b44ad26c4296f341a26456ef121d2fd2ac0c59 Merge: df26b77915be f9940416f193 Author: Oliver Upton Date: Mon Oct 30 20:19:13 2023 +0000 Merge branch kvm-arm64/sgi-injection into kvmarm/next * kvm-arm64/sgi-injection: : vSGI injection improvements + fixes, courtesy Marc Zyngier : : Avoid linearly searching for vSGI targets using a compressed MPIDR to : index a cache. While at it, fix some egregious bugs in KVM's mishandling : of vcpuid (user-controlled value) and vcpu_idx. KVM: arm64: Clarify the ordering requirements for vcpu/RD creation KVM: arm64: vgic-v3: Optimize affinity-based SGI injection KVM: arm64: Fast-track kvm_mpidr_to_vcpu() when mpidr_data is available KVM: arm64: Build MPIDR to vcpu index cache at runtime KVM: arm64: Simplify kvm_vcpu_get_mpidr_aff() KVM: arm64: Use vcpu_idx for invalidation tracking KVM: arm64: vgic: Use vcpu_idx for the debug information KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id KVM: arm64: vgic-v3: Refactor GICv3 SGI generation KVM: arm64: vgic-its: Treat the collection target address as a vcpu_id KVM: arm64: vgic: Make kvm_vgic_inject_irq() take a vcpu pointer Signed-off-by: Oliver Upton commit df26b77915be7813a0ca06ddd06f04fb4e13e471 Merge: 51e607961463 fe49fd940e22 Author: Oliver Upton Date: Mon Oct 30 20:18:56 2023 +0000 Merge branch kvm-arm64/stage2-vhe-load into kvmarm/next * kvm-arm64/stage2-vhe-load: : Setup stage-2 MMU from vcpu_load() for VHE : : Unlike nVHE, there is no need to switch the stage-2 MMU around on guest : entry/exit in VHE mode as the host is running at EL2. Despite this KVM : reloads the stage-2 on every guest entry, which is needless. : : This series moves the setup of the stage-2 MMU context to vcpu_load() : when running in VHE mode. This is likely to be a win across the board, : but also allows us to remove an ISB on the guest entry path for systems : with one of the speculative AT errata. KVM: arm64: Move VTCR_EL2 into struct s2_mmu KVM: arm64: Load the stage-2 MMU context in kvm_vcpu_load_vhe() KVM: arm64: Rename helpers for VHE vCPU load/put KVM: arm64: Reload stage-2 for VMID change on VHE KVM: arm64: Restore the stage-2 context in VHE's __tlb_switch_to_host() KVM: arm64: Don't zero VTTBR in __tlb_switch_to_host() Signed-off-by: Oliver Upton commit 51e607961463f45646449a24574163838556d3ea Merge: 25a35c1a3d8f 3f7915ccc902 Author: Oliver Upton Date: Mon Oct 30 20:18:46 2023 +0000 Merge branch kvm-arm64/nv-trap-fixes into kvmarm/next * kvm-arm64/nv-trap-fixes: : NV trap forwarding fixes, courtesy Miguel Luis and Marc Zyngier : : - Explicitly define the effects of HCR_EL2.NV on EL2 sysregs in the : NV trap encoding : : - Make EL2 registers that access AArch32 guest state UNDEF or RAZ/WI : where appropriate for NV guests KVM: arm64: Handle AArch32 SPSR_{irq,abt,und,fiq} as RAZ/WI KVM: arm64: Do not let a L1 hypervisor access the *32_EL2 sysregs KVM: arm64: Refine _EL2 system register list that require trap reinjection arm64: Add missing _EL2 encodings arm64: Add missing _EL12 encodings Signed-off-by: Oliver Upton commit 25a35c1a3d8fd4b10805f05b109a76c9b8b0200c Merge: 7ff7dfe946ab 4202bcac5e65 Author: Oliver Upton Date: Mon Oct 30 20:18:37 2023 +0000 Merge branch kvm-arm64/smccc-filter-cleanups into kvmarm/next * kvm-arm64/smccc-filter-cleanups: : Cleanup the management of KVM's SMCCC maple tree : : Avoid the cost of maintaining the SMCCC filter maple tree if userspace : hasn't writen a rule to the filter. While at it, rip out the now : unnecessary VM flag to indicate whether or not the SMCCC filter was : configured. KVM: arm64: Use mtree_empty() to determine if SMCCC filter configured KVM: arm64: Only insert reserved ranges when SMCCC filter is used KVM: arm64: Add a predicate for testing if SMCCC filter is configured Signed-off-by: Oliver Upton commit 7ff7dfe946ab696a3335a98bdc30210f2b567825 Merge: d47dcb67fcf6 ae8d3522e5b7 Author: Oliver Upton Date: Mon Oct 30 20:18:23 2023 +0000 Merge branch kvm-arm64/pmevtyper-filter into kvmarm/next * kvm-arm64/pmevtyper-filter: : Fixes to KVM's handling of the PMUv3 exception level filtering bits : : - NSH (count at EL2) and M (count at EL3) should be stateful when the : respective EL is advertised in the ID registers but have no effect on : event counting. : : - NSU and NSK modify the event filtering of EL0 and EL1, respectively. : Though the kernel may not use these bits, other KVM guests might. : Implement these bits exactly as written in the pseudocode if EL3 is : advertised. KVM: arm64: Add PMU event filter bits required if EL3 is implemented KVM: arm64: Make PMEVTYPER_EL0.NSH RES0 if EL2 isn't advertised Signed-off-by: Oliver Upton commit d47dcb67fcf619df971f2c6df6ce1a81426917b6 Merge: 054056bf9892 1de10b7d13a9 Author: Oliver Upton Date: Mon Oct 30 20:18:14 2023 +0000 Merge branch kvm-arm64/feature-flag-refactor into kvmarm/next * kvm-arm64/feature-flag-refactor: : vCPU feature flag cleanup : : Clean up KVM's handling of vCPU feature flags to get rid of the : vCPU-scoped bitmaps and remove failure paths from kvm_reset_vcpu(). KVM: arm64: Get rid of vCPU-scoped feature bitmap KVM: arm64: Remove unused return value from kvm_reset_vcpu() KVM: arm64: Hoist NV+SVE check into KVM_ARM_VCPU_INIT ioctl handler KVM: arm64: Prevent NV feature flag on systems w/o nested virt KVM: arm64: Hoist PAuth checks into KVM_ARM_VCPU_INIT ioctl KVM: arm64: Hoist SVE check into KVM_ARM_VCPU_INIT ioctl handler KVM: arm64: Hoist PMUv3 check into KVM_ARM_VCPU_INIT ioctl handler KVM: arm64: Add generic check for system-supported vCPU features Signed-off-by: Oliver Upton commit 054056bf98922767a7df93876ef09f20948b8693 Merge: 6465e260f487 d11974dc5f20 Author: Oliver Upton Date: Mon Oct 30 20:18:00 2023 +0000 Merge branch kvm-arm64/misc into kvmarm/next * kvm-arm64/misc: : Miscellaneous updates : : - Put an upper bound on the number of I-cache invalidations by : cacheline to avoid soft lockups : : - Get rid of bogus refererence count transfer for THP mappings : : - Do a local TLB invalidation on permission fault race : : - Fixes for page_fault_test KVM selftest : : - Add a tracepoint for detecting MMIO instructions unsupported by KVM KVM: arm64: Add tracepoint for MMIO accesses where ISV==0 KVM: arm64: selftest: Perform ISB before reading PAR_EL1 KVM: arm64: selftest: Add the missing .guest_prepare() KVM: arm64: Always invalidate TLB for stage-2 permission faults KVM: arm64: Do not transfer page refcount for THP adjustment KVM: arm64: Avoid soft lockups due to I-cache maintenance arm64: tlbflush: Rename MAX_TLBI_OPS KVM: arm64: Don't use kerneldoc comment for arm64_check_features() Signed-off-by: Oliver Upton commit d11974dc5f208ae1c0fe62a9bcb47c0cdcd7b081 Author: Oliver Upton Date: Thu Oct 26 20:53:06 2023 +0000 KVM: arm64: Add tracepoint for MMIO accesses where ISV==0 It is a pretty well known fact that KVM does not support MMIO emulation without valid instruction syndrome information (ESR_EL2.ISV == 0). The current kvm_pr_unimpl() is pretty useless, as it contains zero context to relate the event to a vCPU. Replace it with a precise tracepoint that dumps the relevant context so the user can make sense of what the guest is doing. Acked-by: Zenghui Yu Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20231026205306.3045075-1-oliver.upton@linux.dev Signed-off-by: Oliver Upton arch/arm64/kvm/mmio.c | 4 +++- arch/arm64/kvm/trace_arm.h | 25 +++++++++++++++++++++++++ 2 files changed, 28 insertions(+), 1 deletion(-) commit 06899aa5dd3d76e888b28d7e8d7304c0a7ec6262 Author: Zenghui Yu Date: Sat Oct 7 20:40:43 2023 +0800 KVM: arm64: selftest: Perform ISB before reading PAR_EL1 It looks like a mistake to issue ISB *after* reading PAR_EL1, we should instead perform it between the AT instruction and the reads of PAR_EL1. As according to DDI0487J.a IJTYVP, "When an address translation instruction is executed, explicit synchronization is required to guarantee the result is visible to subsequent direct reads of PAR_EL1." Otherwise all guest_at testcases fail on my box with ==== Test Assertion Failure ==== aarch64/page_fault_test.c:142: par & 1 == 0 pid=1355864 tid=1355864 errno=4 - Interrupted system call 1 0x0000000000402853: vcpu_run_loop at page_fault_test.c:681 2 0x0000000000402cdb: run_test at page_fault_test.c:730 3 0x0000000000403897: for_each_guest_mode at guest_modes.c:100 4 0x00000000004019f3: for_each_test_and_guest_mode at page_fault_test.c:1105 5 (inlined by) main at page_fault_test.c:1131 6 0x0000ffffb153c03b: ?? ??:0 7 0x0000ffffb153c113: ?? ??:0 8 0x0000000000401aaf: _start at ??:? 0x1 != 0x0 (par & 1 != 0) Signed-off-by: Zenghui Yu Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20231007124043.626-2-yuzenghui@huawei.com Signed-off-by: Oliver Upton tools/testing/selftests/kvm/aarch64/page_fault_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit beaf35b480875d05d7c751d50951a659ce6dff94 Author: Zenghui Yu Date: Sat Oct 7 20:40:42 2023 +0800 KVM: arm64: selftest: Add the missing .guest_prepare() Running page_fault_test on a Cortex A72 fails with Test: ro_memslot_no_syndrome_guest_cas Testing guest mode: PA-bits:40, VA-bits:48, 4K pages Testing memory backing src type: anonymous ==== Test Assertion Failure ==== aarch64/page_fault_test.c:117: guest_check_lse() pid=1944087 tid=1944087 errno=4 - Interrupted system call 1 0x00000000004028b3: vcpu_run_loop at page_fault_test.c:682 2 0x0000000000402d93: run_test at page_fault_test.c:731 3 0x0000000000403957: for_each_guest_mode at guest_modes.c:100 4 0x00000000004019f3: for_each_test_and_guest_mode at page_fault_test.c:1108 5 (inlined by) main at page_fault_test.c:1134 6 0x0000ffff868e503b: ?? ??:0 7 0x0000ffff868e5113: ?? ??:0 8 0x0000000000401aaf: _start at ??:? guest_check_lse() because we don't have a guest_prepare stage to check the presence of FEAT_LSE and skip the related guest_cas testing, and we end-up failing in GUEST_ASSERT(guest_check_lse()). Add the missing .guest_prepare() where it's indeed required. Signed-off-by: Zenghui Yu Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20231007124043.626-1-yuzenghui@huawei.com Signed-off-by: Oliver Upton tools/testing/selftests/kvm/aarch64/page_fault_test.c | 3 +++ 1 file changed, 3 insertions(+) commit be097997a273259f1723baac5463cf19d8564efa Author: Oliver Upton Date: Fri Sep 22 22:32:29 2023 +0000 KVM: arm64: Always invalidate TLB for stage-2 permission faults It is possible for multiple vCPUs to fault on the same IPA and attempt to resolve the fault. One of the page table walks will actually update the PTE and the rest will return -EAGAIN per our race detection scheme. KVM elides the TLB invalidation on the racing threads as the return value is nonzero. Before commit a12ab1378a88 ("KVM: arm64: Use local TLBI on permission relaxation") KVM always used broadcast TLB invalidations when handling permission faults, which had the convenient property of making the stage-2 updates visible to all CPUs in the system. However now we do a local invalidation, and TLBI elision leads to the vCPU thread faulting again on the stale entry. Remember that the architecture permits the TLB to cache translations that precipitate a permission fault. Invalidate the TLB entry responsible for the permission fault if the stage-2 descriptor has been relaxed, regardless of which thread actually did the job. Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20230922223229.1608155-1-oliver.upton@linux.dev Signed-off-by: Oliver Upton arch/arm64/kvm/hyp/pgtable.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8b16da681eb0c9b9cb2f9abd0dade67559cfb48d Merge: 14ab6d425e80 3fd2ca5be07f Author: Linus Torvalds Date: Mon Oct 30 10:12:29 2023 -1000 Merge tag 'nfsd-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: "This release completes the SunRPC thread scheduler work that was begun in v6.6. The scheduler can now find an svc thread to wake in constant time and without a list walk. Thanks again to Neil Brown for this overhaul. Lorenzo Bianconi contributed infrastructure for a netlink-based NFSD control plane. The long-term plan is to provide the same functionality as found in /proc/fs/nfsd, plus some interesting additions, and then migrate the NFSD user space utilities to netlink. A long series to overhaul NFSD's NFSv4 operation encoding was applied in this release. The goals are to bring this family of encoding functions in line with the matching NFSv4 decoding functions and with the NFSv2 and NFSv3 XDR functions, preparing the way for better memory safety and maintainability. A further improvement to NFSD's write delegation support was contributed by Dai Ngo. This adds a CB_GETATTR callback, enabling the server to retrieve cached size and mtime data from clients holding write delegations. If the server can retrieve this information, it does not have to recall the delegation in some cases. The usual panoply of bug fixes and minor improvements round out this release. As always I am grateful to all contributors, reviewers, and testers" * tag 'nfsd-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (127 commits) svcrdma: Fix tracepoint printk format svcrdma: Drop connection after an RDMA Read error NFSD: clean up alloc_init_deleg() NFSD: Fix frame size warning in svc_export_parse() NFSD: Rewrite synopsis of nfsd_percpu_counters_init() nfsd: Clean up errors in nfs3proc.c nfsd: Clean up errors in nfs4state.c NFSD: Clean up errors in stats.c NFSD: simplify error paths in nfsd_svc() NFSD: Clean up nfsd4_encode_seek() NFSD: Clean up nfsd4_encode_offset_status() NFSD: Clean up nfsd4_encode_copy_notify() NFSD: Clean up nfsd4_encode_copy() NFSD: Clean up nfsd4_encode_test_stateid() NFSD: Clean up nfsd4_encode_exchange_id() NFSD: Clean up nfsd4_do_encode_secinfo() NFSD: Clean up nfsd4_encode_access() NFSD: Clean up nfsd4_encode_readdir() NFSD: Clean up nfsd4_encode_entry4() NFSD: Add an nfsd4_encode_nfs_cookie4() helper ... commit ba026ac33694bab2d4383a8f432879dc8a02bf91 Author: Rob Herring Date: Fri Oct 20 12:02:24 2023 -0500 media: dt-bindings: ti,ds90ub960: Add missing type for "i2c-alias" Every DT property needs a type defined, but "i2c-alias" is missing any type definition. It's a "uint32", so add a type reference. Fixes: 313e8b32c616 ("media: dt-bindings: media: add TI DS90UB960 FPD-Link III Deserializer") Reviewed-by: Laurent Pinchart Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20231020170225.3632933-1-robh@kernel.org Signed-off-by: Rob Herring Documentation/devicetree/bindings/media/i2c/ti,ds90ub960.yaml | 1 + 1 file changed, 1 insertion(+) commit 53ed3233e6b5fbfb63abc945d1fc156222f4eb62 Author: Dmitry Baryshkov Date: Thu Sep 28 14:02:34 2023 +0300 dt-bindings: input: qcom,pm8921-keypad: convert to YAML format Convert the bindings for the keypad subdevices of Qualcomm PM8921 and PM8058 PMICs from text to YAML format. While doing the conversion also drop the linux,keypad-no-autorepeat The property was never used by DT files. Both input and DT binding maintainers consider that bindings should switch to assertive (linux,autorepeat) instead of negating (no-autorepeat) property. Cc: Dmitry Torokhov Reviewed-by: Krzysztof Kozlowski Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20230928110309.1212221-2-dmitry.baryshkov@linaro.org Signed-off-by: Rob Herring .../bindings/input/qcom,pm8921-keypad.yaml | 89 +++++++++++++++++++++ .../bindings/input/qcom,pm8xxx-keypad.txt | 90 ---------------------- 2 files changed, 89 insertions(+), 90 deletions(-) commit 14ab6d425e80674b6a0145f05719b11e82e64824 Merge: 7352a6765cf5 12cd44023651 Author: Linus Torvalds Date: Mon Oct 30 09:47:13 2023 -1000 Merge tag 'vfs-6.7.ctime' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs Pull vfs inode time accessor updates from Christian Brauner: "This finishes the conversion of all inode time fields to accessor functions as discussed on list. Changing timestamps manually as we used to do before is error prone. Using accessors function makes this robust. It does not contain the switch of the time fields to discrete 64 bit integers to replace struct timespec and free up space in struct inode. But after this, the switch can be trivially made and the patch should only affect the vfs if we decide to do it" * tag 'vfs-6.7.ctime' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs: (86 commits) fs: rename inode i_atime and i_mtime fields security: convert to new timestamp accessors selinux: convert to new timestamp accessors apparmor: convert to new timestamp accessors sunrpc: convert to new timestamp accessors mm: convert to new timestamp accessors bpf: convert to new timestamp accessors ipc: convert to new timestamp accessors linux: convert to new timestamp accessors zonefs: convert to new timestamp accessors xfs: convert to new timestamp accessors vboxsf: convert to new timestamp accessors ufs: convert to new timestamp accessors udf: convert to new timestamp accessors ubifs: convert to new timestamp accessors tracefs: convert to new timestamp accessors sysv: convert to new timestamp accessors squashfs: convert to new timestamp accessors server: convert to new timestamp accessors client: convert to new timestamp accessors ... commit 7352a6765cf5d95888b3952ac89efbb817b4c3cf Merge: df9c65b5fc7e a640d888953c Author: Linus Torvalds Date: Mon Oct 30 09:29:44 2023 -1000 Merge tag 'vfs-6.7.xattr' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs Pull vfs xattr updates from Christian Brauner: "The 's_xattr' field of 'struct super_block' currently requires a mutable table of 'struct xattr_handler' entries (although each handler itself is const). However, no code in vfs actually modifies the tables. This changes the type of 's_xattr' to allow const tables, and modifies existing file systems to move their tables to .rodata. This is desirable because these tables contain entries with function pointers in them; moving them to .rodata makes it considerably less likely to be modified accidentally or maliciously at runtime" * tag 'vfs-6.7.xattr' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs: (30 commits) const_structs.checkpatch: add xattr_handler net: move sockfs_xattr_handlers to .rodata shmem: move shmem_xattr_handlers to .rodata overlayfs: move xattr tables to .rodata xfs: move xfs_xattr_handlers to .rodata ubifs: move ubifs_xattr_handlers to .rodata squashfs: move squashfs_xattr_handlers to .rodata smb: move cifs_xattr_handlers to .rodata reiserfs: move reiserfs_xattr_handlers to .rodata orangefs: move orangefs_xattr_handlers to .rodata ocfs2: move ocfs2_xattr_handlers and ocfs2_xattr_handler_map to .rodata ntfs3: move ntfs_xattr_handlers to .rodata nfs: move nfs4_xattr_handlers to .rodata kernfs: move kernfs_xattr_handlers to .rodata jfs: move jfs_xattr_handlers to .rodata jffs2: move jffs2_xattr_handlers to .rodata hfsplus: move hfsplus_xattr_handlers to .rodata hfs: move hfs_xattr_handlers to .rodata gfs2: move gfs2_xattr_handlers_max to .rodata fuse: move fuse_xattr_handlers to .rodata ... commit df9c65b5fc7ef1caabdb7a01a2415cbb8a00908d Merge: 3b3f874cc1d0 b5f0e20f444c Author: Linus Torvalds Date: Mon Oct 30 09:24:21 2023 -1000 Merge tag 'vfs-6.7.iov_iter' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs Pull iov_iter updates from Christian Brauner: "This contain's David's iov_iter cleanup work to convert the iov_iter iteration macros to inline functions: - Remove last_offset from iov_iter as it was only used by ITER_PIPE - Add a __user tag on copy_mc_to_user()'s dst argument on x86 to match that on powerpc and get rid of a sparse warning - Convert iter->user_backed to user_backed_iter() in the sound PCM driver - Convert iter->user_backed to user_backed_iter() in a couple of infiniband drivers - Renumber the type enum so that the ITER_* constants match the order in iterate_and_advance*() - Since the preceding patch puts UBUF and IOVEC at 0 and 1, change user_backed_iter() to just use the type value and get rid of the extra flag - Convert the iov_iter iteration macros to always-inline functions to make the code easier to follow. It uses function pointers, but they get optimised away - Move the check for ->copy_mc to _copy_from_iter() and copy_page_from_iter_atomic() rather than in memcpy_from_iter_mc() where it gets repeated for every segment. Instead, we check once and invoke a side function that can use iterate_bvec() rather than iterate_and_advance() and supply a different step function - Move the copy-and-csum code to net/ where it can be in proximity with the code that uses it - Fold memcpy_and_csum() in to its two users - Move csum_and_copy_from_iter_full() out of line and merge in csum_and_copy_from_iter() since the former is the only caller of the latter - Move hash_and_copy_to_iter() to net/ where it can be with its only caller" * tag 'vfs-6.7.iov_iter' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs: iov_iter, net: Move hash_and_copy_to_iter() to net/ iov_iter, net: Merge csum_and_copy_from_iter{,_full}() together iov_iter, net: Fold in csum_and_memcpy() iov_iter, net: Move csum_and_copy_to/from_iter() to net/ iov_iter: Don't deal with iter->copy_mc in memcpy_from_iter_mc() iov_iter: Convert iterate*() to inline funcs iov_iter: Derive user-backedness from the iterator type iov_iter: Renumber ITER_* constants infiniband: Use user_backed_iter() to see if iterator is UBUF/IOVEC sound: Fix snd_pcm_readv()/writev() to use iov access functions iov_iter, x86: Be consistent about the __user tag on copy_mc_to_user() iov_iter: Remove last_offset from iov_iter as it was for ITER_PIPE commit 3b3f874cc1d074bdcffc224d683925fd11808fe7 Merge: 0d63d8b2294b 61d4fb0b349e Author: Linus Torvalds Date: Mon Oct 30 09:14:19 2023 -1000 Merge tag 'vfs-6.7.misc' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs Pull misc vfs updates from Christian Brauner: "This contains the usual miscellaneous features, cleanups, and fixes for vfs and individual fses. Features: - Rename and export helpers that get write access to a mount. They are used in overlayfs to get write access to the upper mount. - Print the pretty name of the root device on boot failure. This helps in scenarios where we would usually only print "unknown-block(1,2)". - Add an internal SB_I_NOUMASK flag. This is another part in the endless POSIX ACL saga in a way. When POSIX ACLs are enabled via SB_POSIXACL the vfs cannot strip the umask because if the relevant inode has POSIX ACLs set it might take the umask from there. But if the inode doesn't have any POSIX ACLs set then we apply the umask in the filesytem itself. So we end up with: (1) no SB_POSIXACL -> strip umask in vfs (2) SB_POSIXACL -> strip umask in filesystem The umask semantics associated with SB_POSIXACL allowed filesystems that don't even support POSIX ACLs at all to raise SB_POSIXACL purely to avoid umask stripping. That specifically means NFS v4 and Overlayfs. NFS v4 does it because it delegates this to the server and Overlayfs because it needs to delegate umask stripping to the upper filesystem, i.e., the filesystem used as the writable layer. This went so far that SB_POSIXACL is raised eve on kernels that don't even have POSIX ACL support at all. Stop this blatant abuse and add SB_I_NOUMASK which is an internal superblock flag that filesystems can raise to opt out of umask handling. That should really only be the two mentioned above. It's not that we want any filesystems to do this. Ideally we have all umask handling always in the vfs. - Make overlayfs use SB_I_NOUMASK too. - Now that we have SB_I_NOUMASK, stop checking for SB_POSIXACL in IS_POSIXACL() if the kernel doesn't have support for it. This is a very old patch but it's only possible to do this now with the wider cleanup that was done. - Follow-up work on fake path handling from last cycle. Citing mostly from Amir: When overlayfs was first merged, overlayfs files of regular files and directories, the ones that are installed in file table, had a "fake" path, namely, f_path is the overlayfs path and f_inode is the "real" inode on the underlying filesystem. In v6.5, we took another small step by introducing of the backing_file container and the file_real_path() helper. This change allowed vfs and filesystem code to get the "real" path of an overlayfs backing file. With this change, we were able to make fsnotify work correctly and report events on the "real" filesystem objects that were accessed via overlayfs. This method works fine, but it still leaves the vfs vulnerable to new code that is not aware of files with fake path. A recent example is commit db1d1e8b9867 ("IMA: use vfs_getattr_nosec to get the i_version"). This commit uses direct referencing to f_path in IMA code that otherwise uses file_inode() and file_dentry() to reference the filesystem objects that it is measuring. This contains work to switch things around: instead of having filesystem code opt-in to get the "real" path, have generic code opt-in for the "fake" path in the few places that it is needed. Is it far more likely that new filesystems code that does not use the file_dentry() and file_real_path() helpers will end up causing crashes or averting LSM/audit rules if we keep the "fake" path exposed by default. This change already makes file_dentry() moot, but for now we did not change this helper just added a WARN_ON() in ovl_d_real() to catch if we have made any wrong assumptions. After the dust settles on this change, we can make file_dentry() a plain accessor and we can drop the inode argument to ->d_real(). - Switch struct file to SLAB_TYPESAFE_BY_RCU. This looks like a small change but it really isn't and I would like to see everyone on their tippie toes for any possible bugs from this work. Essentially we've been doing most of what SLAB_TYPESAFE_BY_RCU for files since a very long time because of the nasty interactions between the SCM_RIGHTS file descriptor garbage collection. So extending it makes a lot of sense but it is a subtle change. There are almost no places that fiddle with file rcu semantics directly and the ones that did mess around with struct file internal under rcu have been made to stop doing that because it really was always dodgy. I forgot to put in the link tag for this change and the discussion in the commit so adding it into the merge message: https://lore.kernel.org/r/20230926162228.68666-1-mjguzik@gmail.com Cleanups: - Various smaller pipe cleanups including the removal of a spin lock that was only used to protect against writes without pipe_lock() from O_NOTIFICATION_PIPE aka watch queues. As that was never implemented remove the additional locking from pipe_write(). - Annotate struct watch_filter with the new __counted_by attribute. - Clarify do_unlinkat() cleanup so that it doesn't look like an extra iput() is done that would cause issues. - Simplify file cleanup when the file has never been opened. - Use module helper instead of open-coding it. - Predict error unlikely for stale retry. - Use WRITE_ONCE() for mount expiry field instead of just commenting that one hopes the compiler doesn't get smart. Fixes: - Fix readahead on block devices. - Fix writeback when layztime is enabled and inodes whose timestamp is the only thing that changed reside on wb->b_dirty_time. This caused excessively large zombie memory cgroup when lazytime was enabled as such inodes weren't handled fast enough. - Convert BUG_ON() to WARN_ON_ONCE() in open_last_lookups()" * tag 'vfs-6.7.misc' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs: (26 commits) file, i915: fix file reference for mmap_singleton() vfs: Convert BUG_ON to WARN_ON_ONCE in open_last_lookups writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs chardev: Simplify usage of try_module_get() ovl: rely on SB_I_NOUMASK fs: fix umask on NFS with CONFIG_FS_POSIX_ACL=n fs: store real path instead of fake path in backing file f_path fs: create helper file_user_path() for user displayed mapped file path fs: get mnt_writers count for an open backing file's real path vfs: stop counting on gcc not messing with mnt_expiry_mark if not asked vfs: predict the error in retry_estale as unlikely backing file: free directly vfs: fix readahead(2) on block devices io_uring: use files_lookup_fd_locked() file: convert to SLAB_TYPESAFE_BY_RCU vfs: shave work on failed file open fs: simplify misleading code to remove ambiguity regarding ihold()/iput() watch_queue: Annotate struct watch_filter with __counted_by fs/pipe: use spinlock in pipe_read() only if there is a watch_queue fs/pipe: remove unnecessary spinlock from pipe_write() ... commit 0d63d8b2294b228147bf58def506dde35e57daef Merge: d4e175f2c460 d3c50061765d Author: Linus Torvalds Date: Mon Oct 30 09:10:21 2023 -1000 Merge tag 'vfs-6.7.autofs' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs Pull autofs mount api updates from Christian Brauner: "This ports autofs to the new mount api. The patchset has existed for quite a while but never made it upstream. Ian picked it back up. This also fixes a bug where fs_param_is_fd() was passed a garbage param->dirfd but it expected it to be set to the fd that was used to set param->file otherwise result->uint_32 contains nonsense. So make sure it's set. One less filesystem using the old mount api. We're getting there, albeit rather slow. The last remaining major filesystem that hasn't converted is btrfs. Patches exist - I even wrote them - but so far they haven't made it upstream" * tag 'vfs-6.7.autofs' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs: autofs: fix add autofs_parse_fd() fsconfig: ensure that dirfd is set to aux autofs: fix protocol sub version setting autofs: convert autofs to use the new mount api autofs: validate protocol version autofs: refactor parse_options() autofs: reformat 0pt enum declaration autofs: refactor super block info init autofs: add autofs_parse_fd() autofs: refactor autofs_prepare_pipe() commit d4e175f2c460fd54011117d835aa017d2d4a8c08 Merge: ffc253263a13 5aa9130acb98 Author: Linus Torvalds Date: Mon Oct 30 08:59:05 2023 -1000 Merge tag 'vfs-6.7.super' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs Pull vfs superblock updates from Christian Brauner: "This contains the work to make block device opening functions return a struct bdev_handle instead of just a struct block_device. The same struct bdev_handle is then also passed to block device closing functions. This allows us to propagate context from opening to closing a block device without having to modify all users everytime. Sidenote, in the future we might even want to try and have block device opening functions return a struct file directly but that's a series on top of this. These are further preparatory changes to be able to count writable opens and blocking writes to mounted block devices. That's a separate piece of work for next cycle and for that we absolutely need the changes to btrfs that have been quietly dropped somehow. Originally the series contained a patch that removed the old blkdev_*() helpers. But since this would've caused needles churn in -next for bcachefs we ended up delaying it. The second piece of work addresses one of the major annoyances about the work last cycle, namely that we required dropping s_umount whenever we used the superblock and fs_holder_ops for a block device. The reason for that requirement had been that in some codepaths s_umount could've been taken under disk->open_mutex (that's always been the case, at least theoretically). For example, on surprise block device removal or media change. And opening and closing block devices required grabbing disk->open_mutex as well. So we did the work and went through the block layer and fixed all those places so that s_umount is never taken under disk->open_mutex. This means no more brittle games where we yield and reacquire s_umount during block device opening and closing and no more requirements where block devices need to be closed. Filesystems don't need to care about this. There's a bunch of other follow-up work such as moving block device freezing and thawing to holder operations which makes it work for all block devices and not just the main block device just as we did for surprise removal. But that is for next cycle. Tested with fstests for all major fses, blktests, LTP" * tag 'vfs-6.7.super' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs: (37 commits) porting: update locking requirements fs: assert that open_mutex isn't held over holder ops block: assert that we're not holding open_mutex over blk_report_disk_dead block: move bdev_mark_dead out of disk_check_media_change block: WARN_ON_ONCE() when we remove active partitions block: simplify bdev_del_partition() fs: Avoid grabbing sb->s_umount under bdev->bd_holder_lock jfs: fix log->bdev_handle null ptr deref in lbmStartIO bcache: Fixup error handling in register_cache() xfs: Convert to bdev_open_by_path() reiserfs: Convert to bdev_open_by_dev/path() ocfs2: Convert to use bdev_open_by_dev() nfs/blocklayout: Convert to use bdev_open_by_dev/path() jfs: Convert to bdev_open_by_dev() f2fs: Convert to bdev_open_by_dev/path() ext4: Convert to bdev_open_by_dev() erofs: Convert to use bdev_open_by_path() btrfs: Convert to bdev_open_by_path() fs: Convert to bdev_open_by_dev() mm/swap: Convert to use bdev_open_by_dev() ... commit 696444a544ecd6d62c1edc89516b376cefb28929 Author: Colin Ian King Date: Thu Jul 27 16:01:17 2023 +0100 rtla: Fix uninitialized variable found Variable found is not being initialized, in the case where the desired mount is not found the variable contains garbage. Fix this by initializing it to zero. Link: https://lore.kernel.org/all/20230727150117.627730-1-colin.i.king@gmail.com/ Fixes: a957cbc02531 ("rtla: Add -C cgroup support") Signed-off-by: Colin Ian King Signed-off-by: Daniel Bristot de Oliveira tools/tracing/rtla/src/utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cba4590036855f4e3110d43c14385d2401080dbb Author: Nathan Chancellor Date: Fri Oct 27 09:54:25 2023 -0700 ASoC: codecs: aw88399: Fix -Wuninitialized in aw_dev_set_vcalb() Clang warns (or errors with CONFIG_WERROR=y): sound/soc/codecs/aw88399.c:441:18: error: variable 'vsense_select' is uninitialized when used here [-Werror,-Wuninitialized] 441 | vsense_select = vsense_select & (~AW88399_VDSEL_MASK); | ^~~~~~~~~~~~~ sound/soc/codecs/aw88399.c:431:28: note: initialize the variable 'vsense_select' to silence this warning 431 | unsigned int vsense_select, vsense_value; | ^ | = 0 1 error generated. This clearly should have been using the value received from regmap_read(). Use the correct variable to resolve the warning. Closes: https://github.com/ClangBuiltLinux/linux/issues/1952 Fixes: 8ade6cc7e261 ("ASoC: codecs: Add aw88399 amplifier driver") Signed-off-by: Nathan Chancellor Reviewed-by: Weidong Wang Link: https://lore.kernel.org/r/20231027-asoc-aw88399-fix-wuninitialized-v1-1-b1044493e4cd@kernel.org Signed-off-by: Mark Brown sound/soc/codecs/aw88399.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cf63348b4c45384d02126f86676d5afc75d661a7 Author: Yujie Liu Date: Mon Oct 30 16:54:04 2023 +0800 scripts/kernel-doc: Fix the regex for matching -Werror flag Swarup reported a "make htmldocs" warning: Variable length lookbehind is experimental in regex; marked by <-- HERE in m/(?<=^|\s)-Werror(?=$|\s) <-- HERE / at ./scripts/kernel-doc line 188. Akira managed to reproduce it by perl v5.34.0. On second thought, it is not necessary to have the complicated "lookahead and lookbehind" things, and the regex can be simplified. Generally, the kernel-doc warnings should be considered as errors only when "-Werror" flag is set in KCFLAGS, but not when "-Werror=" is set, which means there needs to be a space or start of string before "-Werror", and a space or end of string after "-Werror". The following cases have been tested to work as expected: * kernel-doc warnings are considered as errors: $ KCFLAGS="-Werror" make W=1 $ KCFLAGS="-Wcomment -Werror" make W=1 $ KCFLAGS="-Werror -Wundef" make W=1 $ KCFLAGS="-Wcomment -Werror -Wundef" make W=1 * kernel-doc warnings remain as warnings: $ KCFLAGS="-Werror=return-type" make W=1 $ KCFLAGS="-Wcomment -Werror=return-type" make W=1 $ KCFLAGS="-Werror=return-type -Wundef" make W=1 $ KCFLAGS="-Wcomment -Werror=return-type -Wundef" make W=1 The "Variable length lookbehind is experimental in regex" warning is also resolved by this patch. Fixes: 91f950e8b9d8 ("scripts/kernel-doc: match -Werror flag strictly") Reported-by: Swarup Laxman Kotiaklapudi Signed-off-by: Yujie Liu Closes: https://lore.kernel.org/r/20231028182231.123996-1-swarupkotikalapudi@gmail.com/ Reviewed-by: Akira Yokosawa Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20231030085404.3343403-1-yujie.liu@intel.com scripts/kernel-doc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a0c04a3243f1db6cb47b04ba05b65af97f75a278 Author: Alessandro Carminati (Red Hat) Date: Wed Sep 6 15:57:03 2023 +0000 verification/dot2k: Delete duplicate imports The presence of duplicate import lines appears to be a typo. Removing them. Link: https://lore.kernel.org/r/20230906155703.3917918-1-alessandro.carminati@gmail.com Fixes: 24bce201d798 ("tools/rv: Add dot2k") Signed-off-by: Alessandro Carminati (Red Hat) Signed-off-by: Daniel Bristot de Oliveira tools/verification/dot2/dot2k | 2 -- 1 file changed, 2 deletions(-) commit 1a3b7eab8500a6b923f7b62cc8aa4d832c7dfb3e Author: Shuming Fan Date: Mon Oct 30 18:36:44 2023 +0800 ASoC: rt712-sdca: fix speaker route missing issue Sometimes the codec probe would be called earlier than the hardware initialization. Therefore, the speaker route should be added before the the first_hw_init check. Signed-off-by: Shuming Fan Fixes: f3da2ed110e2 ("ASoC: rt1712-sdca: enable pm_runtime in probe, keep status as 'suspended'")? Link: https://lore.kernel.org/r/20231030103644.1787948-1-shumingf@realtek.com Signed-off-by: Mark Brown sound/soc/codecs/rt712-sdca.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit 04f8c76de983a5c1e8913e442e791a9e8d0e0dfd Author: Rob Herring Date: Mon Oct 30 09:23:38 2023 -0500 ASoC: rockchip: Fix unused rockchip_i2s_tdm_match warning for !CONFIG_OF Commit 9958d85968ed ("ASoC: Use device_get_match_data()") dropped the unconditional use of rockchip_i2s_tdm_match resulting in this warning: sound/soc/rockchip/rockchip_i2s_tdm.c:1315:34: warning: 'rockchip_i2s_tdm_match' defined but not used [-Wunused-const-variable=] The fix is to drop of_match_ptr() which is not necessary because DT is always used for this driver. Fixes: 9958d85968ed ("ASoC: Use device_get_match_data()") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202310121802.CDAGVdF2-lkp@intel.com/ Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20231030142337.814907-2-robh@kernel.org Signed-off-by: Mark Brown sound/soc/rockchip/rockchip_i2s_tdm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2e22aac3ea9cfc0ec3209c96644f60c1806a8117 Author: Joao Martins Date: Mon Oct 30 11:34:46 2023 +0000 iommufd/selftest: Fix page-size check in iommufd_test_dirty() iommufd_test_dirty()/IOMMU_TEST_OP_DIRTY sets the dirty bits in the mock domain implementation that the userspace side validates against what it obtains via the UAPI. However in introducing iommufd_test_dirty() it forgot to validate page_size being 0 leading to two possible divide-by-zero problems: one at the beginning when calculating @max and while calculating the IOVA in the XArray PFN tracking list. While at it, validate the length to require non-zero value as well, as we can't be allocating a 0-sized bitmap. Link: https://lore.kernel.org/r/20231030113446.7056-1-joao.m.martins@oracle.com Reported-by: syzbot+25dc7383c30ecdc83c38@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-iommu/00000000000005f6aa0608b9220f@google.com/ Fixes: a9af47e382a4 ("iommufd/selftest: Test IOMMU_HWPT_GET_DIRTY_BITMAP") Signed-off-by: Joao Martins Signed-off-by: Jason Gunthorpe drivers/iommu/iommufd/selftest.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 7588b83066db9b9dc10c1a43b8e52a028ad327d2 Author: Steve French Date: Sun Oct 8 23:04:01 2023 -0500 Add definition for new smb3.1.1 command type Add structs and defines for new SMB3.1.1 command, server to client notification. See MS-SMB2 section 2.2.44 Signed-off-by: Steve French fs/smb/common/smb2pdu.h | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit d5a3c153fd00f5e951c4f20b4c65feb1e1cfbfcb Author: Steve French Date: Sun Oct 8 23:11:38 2023 -0500 SMB3: clarify some of the unused CreateOption flags Update comments to show flags which should be not set (zero). See MS-SMB2 section 2.2.13 Signed-off-by: Steve French fs/smb/common/smb2pdu.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 361d744ddd61de065fbeb042aaed590d32dd92ec Author: Jason Gunthorpe Date: Mon Oct 30 11:26:33 2023 -0300 iommufd: Add iopt_area_alloc() We never initialize the two interval tree nodes, and zero fill is not the same as RB_CLEAR_NODE. This can hide issues where we missed adding the area to the trees. Factor out the allocation and clear the two nodes. Fixes: 51fe6141f0f6 ("iommufd: Data structure to provide IOVA to PFN mapping") Link: https://lore.kernel.org/r/20231030145035.GG691768@ziepe.ca Signed-off-by: Jason Gunthorpe drivers/iommu/iommufd/io_pagetable.c | 18 +++++++++++++++--- drivers/iommu/iommufd/pages.c | 2 ++ 2 files changed, 17 insertions(+), 3 deletions(-) commit e7250ab7ca4998fe026f2149805b03e09dc32498 Author: Koichiro Den Date: Sat Oct 28 01:29:42 2023 +0900 iommufd: Fix missing update of domains_itree after splitting iopt_area In iopt_area_split(), if the original iopt_area has filled a domain and is linked to domains_itree, pages_nodes have to be properly reinserted. Otherwise the domains_itree becomes corrupted and we will UAF. Fixes: 51fe6141f0f6 ("iommufd: Data structure to provide IOVA to PFN mapping") Link: https://lore.kernel.org/r/20231027162941.2864615-2-den@valinux.co.jp Cc: stable@vger.kernel.org Signed-off-by: Koichiro Den Signed-off-by: Jason Gunthorpe drivers/iommu/iommufd/io_pagetable.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 8a32aa17c1cd48df1ddaa78e45abcb8c7a2220d6 Author: Helge Deller Date: Fri Oct 27 13:36:48 2023 +0200 fbdev: stifb: Make the STI next font pointer a 32-bit signed offset The pointer to the next STI font is actually a signed 32-bit offset. With this change the 64-bit kernel will correctly subract the (signed 32-bit) offset instead of adding a (unsigned 32-bit) offset. It has no effect on 32-bit kernels. This fixes the stifb driver with a 64-bit kernel on qemu. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org include/video/sticore.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b63b4f1a79e6ad34e110b547efee9f2256da2bde Author: Helge Deller Date: Mon Oct 23 20:38:08 2023 +0200 parisc: Show default CPU PSW.W setting as reported by PDC The last word shows the default PSW.W setting. Signed-off-by: Helge Deller arch/parisc/kernel/drivers.c | 4 ++-- arch/parisc/kernel/processor.c | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) commit 6240553b52c475d9fc9674de0521b77e692f3764 Author: Helge Deller Date: Sun Oct 22 11:48:11 2023 +0200 parisc/pdc: Add width field to struct pdc_model PDC2.0 specifies the additional PSW-bit field. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org arch/parisc/include/uapi/asm/pdc.h | 1 + 1 file changed, 1 insertion(+) commit ad4aa06e1d92b06ed56c7240252927bd60632efe Author: John David Anglin Date: Fri Oct 20 20:49:07 2023 +0000 parisc: Add nop instructions after TLB inserts An excerpt from the PA8800 ERS states: * The PA8800 violates the seven instruction pipeline rule when performing TLB inserts or PxTLBE instructions with the PSW C bit on. The instruction will take effect by the 12th instruction after the insert or purge. I believe we have a problem with handling TLB misses. We don't fill the pipeline following TLB inserts. As a result, we likely fault again after returning from the interruption. The above statement indicates that we need at least seven instructions after the insert on pre PA8800 processors and we need 12 instructions on PA8800/PA8900 processors. Here we add macros and code to provide the required number instructions after a TLB insert. Signed-off-by: John David Anglin Suggested-by: Helge Deller Cc: stable@vger.kernel.org Signed-off-by: Helge Deller arch/parisc/kernel/entry.S | 81 +++++++++++++++++++++++++++++----------------- 1 file changed, 52 insertions(+), 29 deletions(-) commit 1c7431b39a9ca14f7d3d57fce80838c8550b7db3 Author: Russell King (Oracle) Date: Fri Oct 20 15:45:30 2023 +0100 parisc: simplify smp_prepare_boot_cpu() smp_prepare_boot_cpu() reads the cpuid of the first CPU, printing a message to state which processor booted, and setting it online and present. This cpuid is retrieved from per_cpu(cpu_data, 0).cpuid, which is initialised in arch/parisc/kernel/processor.c:processor_probe() thusly: p = &per_cpu(cpu_data, cpuid); ... p->cpuid = cpuid; /* save CPU id */ Consequently, the cpuid retrieved seems to be guaranteed to also be zero, meaning that the message printed in this boils down to: pr_info("SMP: bootstrap CPU ID is 0\n"); Moreover, since kernel/cpu.c::boot_cpu_init() already sets CPU 0 to be present and online, there is no need to do this again in smp_prepare_boot_cpu(). Remove this code, and simplify the printk(). Signed-off-by: Russell King (Oracle) Signed-off-by: Helge Deller arch/parisc/kernel/smp.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit 86bb854d134f4429feb35d2e05f55c6e036770d2 Author: Helge Deller Date: Wed Oct 18 19:24:14 2023 +0200 parisc/agp: Use 64-bit LE values in SBA IOMMU PDIR table The PDIR table of the System Bus Adapter (SBA) I/O MMU uses 64-bit little-endian pointers. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v6.4+ drivers/char/agp/parisc-agp.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) commit 9f5989d79d3b89246e5e8e5147eeb8c3ae71e6e1 Author: Helge Deller Date: Wed Oct 18 19:52:39 2023 +0200 parisc/firmware: Use PDC constants for narrow/wide firmware PDC uses the PDC_MODEL_OS64 and PDC_MODEL_OS32 constants, so use those constants for the internal WIDE_FIRMWARE/NARROW_FIRMWARE too. Signed-off-by: Helge Deller arch/parisc/kernel/firmware.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit 06a2e4998a0879cb24b0536b26c7a07482ed274e Author: Helge Deller Date: Wed Oct 18 19:47:29 2023 +0200 parisc: Move parisc_narrow_firmware variable to header file Signed-off-by: Helge Deller arch/parisc/include/asm/processor.h | 1 + arch/parisc/kernel/setup.c | 3 --- 2 files changed, 1 insertion(+), 3 deletions(-) commit fe0a9b8b22248eb74983ae37af9347c1c068012c Author: Helge Deller Date: Tue Oct 17 22:33:30 2023 +0200 parisc/power: Trivial whitespace cleanups and license update Signed-off-by: Helge Deller drivers/parisc/power.c | 51 +++++++++++++------------------------------------- 1 file changed, 13 insertions(+), 38 deletions(-) commit d0c219472980d15f5cbc5c8aec736848bda3f235 Author: Helge Deller Date: Tue Oct 17 22:19:53 2023 +0200 parisc/power: Add power soft-off when running on qemu Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v6.0+ drivers/parisc/power.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) commit 01fef8267390ccb6e763a8aa90b6a10385aa3145 Author: Helge Deller Date: Tue Oct 17 21:00:11 2023 +0200 parisc: Allow building uncompressed Linux kernel Add HAVE_KERNEL_UNCOMPRESSED flag and fix build in boot directory. Signed-off-by: Helge Deller arch/parisc/Kconfig | 1 + arch/parisc/boot/Makefile | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) commit b9c515f7e3f52151e33e982f982f369975734e1d Author: Helge Deller Date: Tue Oct 17 20:45:58 2023 +0200 parisc: Add some missing PDC functions and constants Signed-off-by: Helge Deller arch/parisc/include/uapi/asm/pdc.h | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) commit 58ad89e866768b0af962305b6c714ea8f0b5ca51 Author: Helge Deller Date: Tue Oct 17 20:40:45 2023 +0200 parisc: sba-iommu: Fix comment when calculating IOC number Signed-off-by: Helge Deller drivers/parisc/sba_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 63bffc2d3a99eaabc786c513eea71be3f597f175 Author: Rob Herring Date: Mon Oct 9 12:29:13 2023 -0500 pinctrl: Use device_get_match_data() Use preferred device_get_match_data() instead of of_match_device() to get the driver match data. With this, adjust the includes to explicitly include the correct headers. Signed-off-by: Rob Herring Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20231009172923.2457844-18-robh@kernel.org Signed-off-by: Linus Walleij drivers/pinctrl/bcm/pinctrl-ns.c | 8 ++------ drivers/pinctrl/berlin/berlin-bg2.c | 8 +++----- drivers/pinctrl/berlin/berlin-bg2cd.c | 8 +++----- drivers/pinctrl/berlin/berlin-bg2q.c | 8 +++----- drivers/pinctrl/berlin/berlin-bg4ct.c | 9 +++++---- drivers/pinctrl/berlin/pinctrl-as370.c | 9 +++++---- drivers/pinctrl/mvebu/pinctrl-armada-38x.c | 9 ++------- drivers/pinctrl/mvebu/pinctrl-armada-39x.c | 9 ++------- drivers/pinctrl/mvebu/pinctrl-armada-ap806.c | 5 +---- drivers/pinctrl/mvebu/pinctrl-armada-cp110.c | 6 ++---- drivers/pinctrl/mvebu/pinctrl-armada-xp.c | 9 ++------- drivers/pinctrl/mvebu/pinctrl-dove.c | 6 ++---- drivers/pinctrl/mvebu/pinctrl-kirkwood.c | 7 ++----- drivers/pinctrl/mvebu/pinctrl-orion.c | 7 ++----- drivers/pinctrl/nomadik/pinctrl-abx500.c | 9 ++------- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 10 ++++------ drivers/pinctrl/pinctrl-at91.c | 11 +++++------ drivers/pinctrl/pinctrl-xway.c | 11 ++++------- drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 18 ++++++++---------- 19 files changed, 59 insertions(+), 108 deletions(-) commit fbb74e56378d8306f214658e3d525a8b3f000c5a Author: Tony Lindgren Date: Mon Oct 30 07:23:38 2023 +0200 ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings We need to check for an active device as otherwise we get warnings for some mcbsp instances for "Runtime PM usage count underflow!". Reported-by: Andreas Kemnade Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20231030052340.13415-1-tony@atomide.com Signed-off-by: Mark Brown sound/soc/ti/omap-mcbsp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 1b2e883e1af895b62808b044ac96b77e7c9017b1 Merge: 75223bbea840 c3aa5cb264a3 Author: Mark Brown Date: Mon Oct 30 13:20:58 2023 +0000 spi: Merge up fix One small fix that didn't seem worth sending before the merge window. commit 3e0569ff812675e896cbdcbbaec10c99b544b947 Merge: 804bf07a1f72 bc00d9f3813a Author: Mark Brown Date: Mon Oct 30 13:14:27 2023 +0000 regulator: Merge up pending fix One small fix didn't get sent before the merge window. commit 6bbebcc11a69aef269eb2a33212f76992a4cfb1a Merge: 6a2e332c2cbd 0ec7731655de Author: Mark Brown Date: Mon Oct 30 13:05:15 2023 +0000 regmap: Merge up fix for window/paging issue This was too late and could potentially impact too many drivers for me to be comfortable sending it before the merge window. commit 471aa951bf1206d3c10d0daa67005b8e4db4ff83 Author: Harshit Mogalapalli Date: Fri Oct 27 10:28:22 2023 -0700 i915/perf: Fix NULL deref bugs with drm_dbg() calls When i915 perf interface is not available dereferencing it will lead to NULL dereferences. As returning -ENOTSUPP is pretty clear return when perf interface is not available. Fixes: 2fec539112e8 ("i915/perf: Replace DRM_DEBUG with driver specific drm_dbg call") Suggested-by: Tvrtko Ursulin Signed-off-by: Harshit Mogalapalli Reviewed-by: Tvrtko Ursulin Cc: # v6.0+ Signed-off-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20231027172822.2753059-1-harshit.m.mogalapalli@oracle.com [tursulin: added stable tag] (cherry picked from commit 36f27350ff745bd228ab04d7845dfbffc177a889) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_perf.c | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) commit ce4941c2d6459664761c9854701015d8e99414fb Author: Chaitanya Kumar Borah Date: Wed Oct 18 17:06:22 2023 +0530 drm/i915/mtl: Support HBR3 rate with C10 phy and eDP in MTL eDP specification supports HBR3 link rate since v1.4a. Moreover, C10 phy can support HBR3 link rate for both DP and eDP. Therefore, do not clamp the supported rates for eDP at 6.75Gbps. Cc: BSpec: 70073 74224 Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Mika Kahola Signed-off-by: Mika Kahola Link: https://patchwork.freedesktop.org/patch/msgid/20231018113622.2761997-1-chaitanya.kumar.borah@intel.com (cherry picked from commit a3431650f30a94b179d419ef87c21213655c28cd) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/display/intel_dp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7d7a328d0e8d6edefb7b0d665185d468667588d0 Author: Nirmoy Das Date: Wed Oct 18 11:38:15 2023 +0200 drm/i915: Flush WC GGTT only on required platforms gen8_ggtt_invalidate() is only needed for limited set of platforms where GGTT is mapped as WC. This was added as way to fix WC based GGTT in commit 0f9b91c754b7 ("drm/i915: flush system agent TLBs on SNB") and there are no reference in HW docs that forces us to use this on non-WC backed GGTT. This can also cause unwanted side-effects on XE_HP platforms where GFX_FLSH_CNTL_GEN6 is not valid anymore. v2: Add a func to detect wc ggtt detection (Ville) v3: Improve commit log and add reference commit (Daniel) Fixes: d2eae8e98d59 ("drm/i915/dg2: Drop force_probe requirement") Cc: Rodrigo Vivi Cc: Tvrtko Ursulin Cc: Joonas Lahtinen Cc: Jani Nikula Cc: Jonathan Cavitt Cc: John Harrison Cc: Andi Shyti Cc: Ville Syrjälä Cc: Daniel Vetter Cc: # v6.2+ Suggested-by: Matt Roper Signed-off-by: Nirmoy Das Reviewed-by: Matt Roper Reviewed-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20231018093815.1349-1-nirmoy.das@intel.com (cherry picked from commit 81de3e296b10a13e5c9f13172825b0d8d9495c68) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/gt/intel_ggtt.c | 35 ++++++++++++++++++++++++----------- 1 file changed, 24 insertions(+), 11 deletions(-) commit 390001d648ffa027b750b7dceb5d43f4c1d1a39e Author: Arnd Bergmann Date: Mon Oct 16 22:10:04 2023 +0200 drm/i915/mtl: avoid stringop-overflow warning The newly added memset() causes a warning for some reason I could not figure out: In file included from arch/x86/include/asm/string.h:3, from drivers/gpu/drm/i915/gt/intel_rc6.c:6: In function 'rc6_res_reg_init', inlined from 'intel_rc6_init' at drivers/gpu/drm/i915/gt/intel_rc6.c:610:2: arch/x86/include/asm/string_32.h:195:29: error: '__builtin_memset' writing 16 bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=] 195 | #define memset(s, c, count) __builtin_memset(s, c, count) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/i915/gt/intel_rc6.c:584:9: note: in expansion of macro 'memset' 584 | memset(rc6->res_reg, INVALID_MMIO_REG.reg, sizeof(rc6->res_reg)); | ^~~~~~ In function 'intel_rc6_init': Change it to an normal initializer and an added memcpy() that does not have this problem. Fixes: 4bb9ca7ee074 ("drm/i915/mtl: C6 residency and C state type for MTL SAMedia") Signed-off-by: Arnd Bergmann Reviewed-by: Jani Nikula Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20231016201012.1022812-1-arnd@kernel.org (cherry picked from commit 0520b30b219053cd789909bca45b3c486ef3ee09) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/gt/intel_rc6.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) commit 94565e95e247c188fed4d3da1034402f3fb297de Author: Javier Martinez Canillas Date: Sat Oct 21 00:52:57 2023 +0200 drm/ssd130x: Fix possible uninitialized usage of crtc_state variable Avoid a possible uninitialized use of the crtc_state variable in function ssd132x_primary_plane_atomic_check() and avoid the following Smatch warn: drivers/gpu/drm/solomon/ssd130x.c:921 ssd132x_primary_plane_atomic_check() error: uninitialized symbol 'crtc_state'. Fixes: fdd591e00a9c ("drm/ssd130x: Add support for the SSD132x OLED controller family") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/dri-devel/7dd6ca45-8263-44fe-a318-2fd9d761425d@moroto.mountain/ Signed-off-by: Javier Martinez Canillas Acked-by: Jocelyn Falempe Link: https://patchwork.freedesktop.org/patch/msgid/20231020225338.1686974-1-javierm@redhat.com (cherry picked from commit 9e4db199e66d427c50458f4d72734cc4f0b92948) Signed-off-by: Javier Martinez Canillas drivers/gpu/drm/solomon/ssd130x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a49cf37d538c764a687ff4be9d279b878a3e6521 Author: Javier Martinez Canillas Date: Sat Oct 21 00:30:17 2023 +0200 dt-bindings: display: ssd132x: Remove '-' before compatible enum This is a leftover from when the binding schema had the compatible string property enum as a 'oneOf' child and the '-' was not removed when 'oneOf' got dropped during the binding review process. Reported-by: Rob Herring Closes: https://lore.kernel.org/dri-devel/CAL_Jsq+h8DcnpKqhokQOODCc8+Qi3M0PrxRFKz_Y4v37yMJvvA@mail.gmail.com/ Signed-off-by: Javier Martinez Canillas Acked-by: Conor Dooley Reviewed-by: Rob Herring Link: https://patchwork.freedesktop.org/patch/msgid/20231020223029.1667190-1-javierm@redhat.com (cherry picked from commit 171c5f641031c0eee424ba79a3db4736c32e18ca) Signed-off-by: Javier Martinez Canillas Documentation/devicetree/bindings/display/solomon,ssd132x.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit a4000df5300fdbe10d84e3b70e2d6a98686310a9 Author: Greg Kroah-Hartman Date: Mon Oct 30 09:54:14 2023 +0100 Revert "staging: octeon: remove typedef in enum cvmx_spi_mode_t" This reverts commit 7bebd832177670e6cce1783cf144f989cd3cf4b5. The patch series that removed typedefs from the octeon driver was not actually built properly, and broke the build (it's hard to test-build this driver for some reason.) Remove them all at this point in time to make sure the build works properly. Link: https://lore.kernel.org/r/32e9ad3c-191e-4dd1-b1cc-07f7b93c3f28@roeck-us.net Reported-by: Guenter Roeck Cc: Oliver Crumrine Signed-off-by: Greg Kroah-Hartman drivers/staging/octeon/octeon-stubs.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 3db9eb6dee8aacf27903bc84c3a68d05d1d49519 Author: Greg Kroah-Hartman Date: Mon Oct 30 09:54:14 2023 +0100 Revert "staging: octeon: remove typedef in enum cvmx_helper_interface_mode_t" This reverts commit a13f7e45823cd29af716ed6be1f53a344e0b9268. The patch series that removed typedefs from the octeon driver was not actually built properly, and broke the build (it's hard to test-build this driver for some reason.) Remove them all at this point in time to make sure the build works properly. Link: https://lore.kernel.org/r/32e9ad3c-191e-4dd1-b1cc-07f7b93c3f28@roeck-us.net Reported-by: Guenter Roeck Cc: Oliver Crumrine Signed-off-by: Greg Kroah-Hartman drivers/staging/octeon/ethernet.c | 2 +- drivers/staging/octeon/octeon-stubs.h | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) commit d8fecfe8f41edf6762256f9a888e9f906181a641 Author: Greg Kroah-Hartman Date: Mon Oct 30 09:54:13 2023 +0100 Revert "staging: octeon: remove typedef in enum cvmx_pow_wait_t" This reverts commit 28fae776c69bdac005fa77a7e0daa64725d0f4f8. The patch series that removed typedefs from the octeon driver was not actually built properly, and broke the build (it's hard to test-build this driver for some reason.) Remove them all at this point in time to make sure the build works properly. Link: https://lore.kernel.org/r/32e9ad3c-191e-4dd1-b1cc-07f7b93c3f28@roeck-us.net Reported-by: Guenter Roeck Cc: Oliver Crumrine Signed-off-by: Greg Kroah-Hartman drivers/staging/octeon/octeon-stubs.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 4de20132b029c0fd894faf1fcb7c523243dc1cc1 Author: Greg Kroah-Hartman Date: Mon Oct 30 09:54:12 2023 +0100 Revert "staging: octeon: remove typedef in struct cvmx_pko_lock_t" This reverts commit 8d26aa90458f82b952dcaa64e7c4afed9c862d68. The patch series that removed typedefs from the octeon driver was not actually built properly, and broke the build (it's hard to test-build this driver for some reason.) Remove them all at this point in time to make sure the build works properly. Link: https://lore.kernel.org/r/32e9ad3c-191e-4dd1-b1cc-07f7b93c3f28@roeck-us.net Reported-by: Guenter Roeck Cc: Oliver Crumrine Signed-off-by: Greg Kroah-Hartman drivers/staging/octeon/octeon-stubs.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 06bab96a6e5b730dd68f6dfcc3c5152e439876ad Author: Greg Kroah-Hartman Date: Mon Oct 30 09:54:11 2023 +0100 Revert "staging: octeon: remove typedef in enum cvmx_pko_status_t" This reverts commit 4fffe4733cfb08a4c08eca722a8eb819b842c043. The patch series that removed typedefs from the octeon driver was not actually built properly, and broke the build (it's hard to test-build this driver for some reason.) Remove them all at this point in time to make sure the build works properly. Link: https://lore.kernel.org/r/32e9ad3c-191e-4dd1-b1cc-07f7b93c3f28@roeck-us.net Reported-by: Guenter Roeck Cc: Oliver Crumrine Signed-off-by: Greg Kroah-Hartman drivers/staging/octeon/octeon-stubs.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit c312b8b3c1279d3b3d9f71f027d945898173fded Author: Greg Kroah-Hartman Date: Mon Oct 30 09:54:10 2023 +0100 Revert "staging: octeon: remove typedef in structs cvmx_pip_port_status_t and cvmx_pko_port_status_t" This reverts commit b33a296d831189d8a8eedee360e889509b9c81e6. The patch series that removed typedefs from the octeon driver was not actually built properly, and broke the build (it's hard to test-build this driver for some reason.) Remove them all at this point in time to make sure the build works properly. Link: https://lore.kernel.org/r/32e9ad3c-191e-4dd1-b1cc-07f7b93c3f28@roeck-us.net Reported-by: Guenter Roeck Cc: Oliver Crumrine Signed-off-by: Greg Kroah-Hartman drivers/staging/octeon/ethernet.c | 4 ++-- drivers/staging/octeon/octeon-stubs.h | 12 ++++++------ 2 files changed, 8 insertions(+), 8 deletions(-) commit 0f564130e5c76f1e5cf0008924f6a6cd138929d9 Author: Aleksa Savic Date: Mon Oct 16 10:35:57 2023 +0200 hwmon: (aquacomputer_d5next) Check if temp sensors of legacy devices are connected Return -ENODATA if a temp sensor of a legacy device does not contain a reading. Originally-from: Leonard Anderweit Signed-off-by: Aleksa Savic Link: https://lore.kernel.org/r/20231016083559.139341-2-savicaleksa83@gmail.com Signed-off-by: Guenter Roeck drivers/hwmon/aquacomputer_d5next.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit ceaa22402e44e09ab34840a3a83888f93785c772 Author: Aleksa Savic Date: Mon Oct 16 10:35:58 2023 +0200 hwmon: (aquacomputer_d5next) Add support for Aquacomputer High Flow USB and MPS Flow Extend aquacomputer_d5next driver to expose various hardware sensors of the Aquacomputer High Flow USB flow sensor, which communicates through a proprietary USB HID protocol. This commit also adds support for the sensors of the MPS Flow devices, as they have the same USB product ID and sensor layouts. Implemented by Leonard Anderweit [1]. Internal and external temp sensor readings are available, along with the flow sensor. Additionally, serial number and firmware version are exposed through debugfs. [1] https://github.com/aleksamagicka/aquacomputer_d5next-hwmon/pull/90 Originally-from: Leonard Anderweit Signed-off-by: Aleksa Savic Link: https://lore.kernel.org/r/20231016083559.139341-3-savicaleksa83@gmail.com Signed-off-by: Guenter Roeck Documentation/hwmon/aquacomputer_d5next.rst | 7 +++ drivers/hwmon/aquacomputer_d5next.c | 67 +++++++++++++++++++++++++++-- 2 files changed, 70 insertions(+), 4 deletions(-) commit e56a5e3dfd149573e6134b7eb373d56bc81bd0de Author: Tomer Maimon Date: Wed Oct 18 21:19:24 2023 +0300 dt-bindings: hwmon: npcm: Add npcm845 compatible string Add a compatible string for Nuvoton BMC NPCM845 Pulse Width Modulation (PWM) and Fan tach controller. Signed-off-by: Tomer Maimon Acked-by: Rob Herring Link: https://lore.kernel.org/r/20231018181925.1826042-2-tmaimon77@gmail.com Signed-off-by: Guenter Roeck Documentation/devicetree/bindings/hwmon/npcm750-pwm-fan.txt | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 2b9ea4262ae9114b0b86ac893b4d6175d8520001 Author: Antoniu Miclaus Date: Thu Oct 26 13:33:13 2023 +0300 hwmon: Add driver for ltc2991 Add support for LTC2991 Octal I2C Voltage, Current, and Temperature Monitor. The LTC2991 is used to monitor system temperatures, voltages and currents. Through the I2C serial interface, the eight monitors can individually measure supply voltages and can be paired for differential measurements of current sense resistors or temperature sensing transistors. Additional measurements include internal temperature and internal VCC. Signed-off-by: Antoniu Miclaus Link: https://lore.kernel.org/r/20231026103413.27800-2-antoniu.miclaus@analog.com [groeck: Fixed up documentation warning] Signed-off-by: Guenter Roeck Documentation/hwmon/index.rst | 1 + Documentation/hwmon/ltc2991.rst | 43 ++++ MAINTAINERS | 8 + drivers/hwmon/Kconfig | 11 + drivers/hwmon/Makefile | 1 + drivers/hwmon/ltc2991.c | 437 ++++++++++++++++++++++++++++++++++++++++ 6 files changed, 501 insertions(+) commit 10e806d39d304f837ed2921f36499f17a774a220 Author: Jason Yan Date: Tue Apr 28 14:31:38 2020 +0800 i2c: s3c2410: make i2c_s3c_irq_nextbyte() void Fix the following coccicheck warning: drivers/i2c/busses/i2c-s3c2410.c:391:5-8: Unneeded variable: "ret". Return "0" on line 552 Signed-off-by: Jason Yan Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-s3c2410.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit ca562a9cf7178859a9767e72eaa7286f1c79bd3e Author: Shawn Guo Date: Mon Mar 1 15:54:06 2021 +0800 i2c: qcom-geni: add ACPI device id for sc8180x It adds ACPI device id for sc8180x platform, so that the devices can be probed for ACPI boot. Signed-off-by: Shawn Guo Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-qcom-geni.c | 1 + 1 file changed, 1 insertion(+) commit 0161ee9dd38aafad6260ccb47bdc3e1b975eddbf Author: Wolfram Sang Date: Sun Oct 29 20:41:43 2023 +0100 Documentation: i2c: add fault code for not supporting 10 bit addresses Document the specific fault code when 10 bit addresses cannot be supported. It is used for years, only the documentation slipped through the cracks. Signed-off-by: Wolfram Sang Signed-off-by: Wolfram Sang Documentation/i2c/fault-codes.rst | 4 ++++ 1 file changed, 4 insertions(+) commit 5ac61d26b8baff5b2e5a9f3dc1ef63297e4b53e7 Author: Axel Lin Date: Wed Apr 13 08:54:30 2016 +0800 i2c: sun6i-p2wi: Prevent potential division by zero Make sure we don't OOPS in case clock-frequency is set to 0 in a DT. The variable set here is later used as a divisor. Signed-off-by: Axel Lin Acked-by: Boris Brezillon Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 +++++ 1 file changed, 5 insertions(+) commit d9387eda56a49b2cf4487b3c4f12500190e6bb88 Author: ye xingchen Date: Wed Dec 7 10:48:33 2022 +0800 i2c: mux: demux-pinctrl: Convert to use sysfs_emit_at() API Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen Tested-by: Wolfram Sang [wsa: proper subject prefix] Signed-off-by: Wolfram Sang drivers/i2c/muxes/i2c-demux-pinctrl.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 9d08e5909c81188eb1df26ef9d1c8df58ea5a44d Author: Huqiang Qin Date: Fri Oct 27 18:43:56 2023 +0800 dt-bindings: watchdog: Add support for Amlogic C3 and S4 SoCs Update dt-binding document for watchdog of Amlogic C3 and S4 SoCs. Signed-off-by: Huqiang Qin Acked-by: Conor Dooley Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20231027104358.342861-2-huqiang.qin@amlogic.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck .../devicetree/bindings/watchdog/amlogic,meson-gxbb-wdt.yaml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit d4c85a483e348f264f41060259f3372a23ffb84f Author: Michael Shych Date: Thu Oct 26 08:25:58 2023 +0000 watchdog: mlx-wdt: Parameter desctiption warning fix Add parameter desription to fix warning. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202310241044.lvqeOGli-lkp@intel.com Signed-off-by: Michael Shych Signed-off-by: Vadim Pasternak Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20231026082558.12142-1-michaelsh@nvidia.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/mlx_wdt.c | 1 + 1 file changed, 1 insertion(+) commit 6a6c7b006e5cd55cce0fc4e7be0e7bb3a94b064b Author: Zev Weiss Date: Fri Sep 22 03:42:34 2023 -0700 watchdog: aspeed: Add support for aspeed,reset-mask DT property This property allows the device-tree to specify how the Aspeed watchdog timer's reset mask register(s) should be set, so that peripherals can be individually exempted from (or opted in to) being reset when the watchdog timer expires. Signed-off-by: Zev Weiss Reviewed-by: Joel Stanley Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230922104231.1434-6-zev@bewilderbeest.net Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/aspeed_wdt.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 9931be2cfca35be7040f35a272a7b82b31ec1c71 Author: Zev Weiss Date: Fri Sep 22 03:42:33 2023 -0700 dt-bindings: watchdog: aspeed-wdt: Add aspeed,reset-mask property This property configures the Aspeed watchdog timer's reset mask, which controls which peripherals are reset when the watchdog timer expires. Some platforms require that certain devices be left untouched across a reboot; aspeed,reset-mask can now be used to express such constraints. Signed-off-by: Zev Weiss Reviewed-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230922104231.1434-5-zev@bewilderbeest.net Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck .../devicetree/bindings/watchdog/aspeed-wdt.txt | 18 ++++- include/dt-bindings/watchdog/aspeed-wdt.h | 92 ++++++++++++++++++++++ 2 files changed, 109 insertions(+), 1 deletion(-) commit 78ca4d6902f4a9631ab74cc96d485eb1f1e5fac9 Author: Janne Grunau Date: Mon Oct 16 08:58:01 2023 +0200 watchdog: apple: Deactivate on suspend The watchdog remains active after putting the system into suspend. Add PM callbacks to deactivate the watchdog on suspend an re-activate it on resume. Signed-off-by: Janne Grunau Reviewed-by: Eric Curtin Reviewed-by: Neal Gompa Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20231016-apple-watchdog-suspend-v2-1-7ffff8042dbc@jannau.net Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/apple_wdt.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) commit 49bd08b36143d521579929316a1ea5664d86f451 Author: Matti Lehtimäki Date: Wed Oct 11 18:33:13 2023 +0200 dt-bindings: watchdog: qcom-wdt: Add MSM8226 and MSM8974 compatibles Add compatibles for the MSM8226 and MSM8974 platforms to the Qualcomm watchdog binding. Signed-off-by: Matti Lehtimäki Signed-off-by: Luca Weiss Reviewed-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20231011-msm8226-msm8974-watchdog-v1-1-2c472818fbce@z3ntu.xyz Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck Documentation/devicetree/bindings/watchdog/qcom-wdt.yaml | 2 ++ 1 file changed, 2 insertions(+) commit 89c7e70d9c056e98de8f6b974493139c9e38c5b4 Author: Jacky Bai Date: Tue Oct 10 16:19:08 2023 +0800 dt-bindings: watchdog: fsl-imx7ulp-wdt: Add 'fsl,ext-reset-output' The wdog may generate wdog_any external reset if the int_en bit is configured, so add a property for this purpose in dt-binding doc. Signed-off-by: Jacky Bai Reviewed-by: Peng Fan Acked-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20231010081909.2899101-2-ping.bai@nxp.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck Documentation/devicetree/bindings/watchdog/fsl-imx7ulp-wdt.yaml | 5 +++++ 1 file changed, 5 insertions(+) commit 423fc66eb6ce7ad1091091017c47a1ed320c4017 Author: Jacky Bai Date: Tue Oct 10 16:19:07 2023 +0800 wdog: imx7ulp: Enable wdog int_en bit for watchdog any reset The wdog INT_EN bit in CS register should be set to '1' to trigger WDOG_ANY external reset on i.MX93. Signed-off-by: Jacky Bai Reviewed-by: Peng Fan Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20231010081909.2899101-1-ping.bai@nxp.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/imx7ulp_wdt.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 946af15b9614f49f3a28b62d516867031428d561 Author: George Cherian Date: Mon Oct 9 10:10:37 2023 +0530 drivers: watchdog: marvell_gti: Program the max_hw_heartbeat_ms Program the max_hw_heartbeat_ms value so that the watchdog_pretimeout worker is activated. This kernel worker thread makes sure to ping the watchdog in case the userspace is unable to do so. This kernel worker ping will be done only till the full watchdog timeout there by maintaining the watchdog functionality in case of a real hang. Signed-off-by: George Cherian Signed-off-by: Bharat Bhushan Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20231009044037.514570-2-bbhushan2@marvell.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/marvell_gti_wdt.c | 1 + 1 file changed, 1 insertion(+) commit cc5cfc112a62a4e97ed068513928f5cafd0e6285 Author: Bharat Bhushan Date: Mon Oct 9 10:10:36 2023 +0530 drivers: watchdog: marvell_gti: fix zero pretimeout handling When pretimeout is set to 0 then do not reprogram timer with zero timeout, this will reset device immediately. Also disable interrupt to stop pretimeout notification. Signed-off-by: Bharat Bhushan Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20231009044037.514570-1-bbhushan2@marvell.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/marvell_gti_wdt.c | 7 +++++++ 1 file changed, 7 insertions(+) commit cd09da4703775d458fd5d0916ec22694b7f55d02 Author: Rob Herring Date: Tue Oct 10 15:56:36 2023 -0500 watchdog: marvell_gti: Replace of_platform.h with explicit includes The DT of_device.h and of_platform.h date back to the separate of_platform_bus_type before it was merged into the regular platform bus. As part of that merge prepping Arm DT support 13 years ago, they "temporarily" include each other and pull in various other headers. In preparation to fix this, adjust the includes for what is actually needed. of_platform.h isn't needed, but of.h was implicitly included by it (via of_device.h). Signed-off-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20231010205636.1584480-1-robh@kernel.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/marvell_gti_wdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 06fdbf4ddb21b53c2e2fbf7f00df51c1b4e735c4 Author: Jacky Bai Date: Tue Oct 10 15:46:26 2023 +0800 watchdog: imx_sc_wdt: continue if the wdog already enabled if the wdog is already enabled, and try to enabled it again, we should ignore the error and continue, rather than return error. Signed-off-by: Jacky Bai Reviewed-by: Peng Fan Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20231010074626.2787383-1-ping.bai@nxp.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/imx_sc_wdt.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit c7e2f4e672364604193d4592c4c3d276137d04c0 Author: Rob Herring Date: Mon Oct 9 16:13:48 2023 -0500 watchdog: st_lpc: Use device_get_match_data() Use preferred device_get_match_data() instead of of_match_device() to get the driver match data. With this, adjust the includes to explicitly include the correct headers. Signed-off-by: Rob Herring Reviewed-by: Patrice Chotard Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20231009211356.3242037-18-robh@kernel.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/st_lpc_wdt.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) commit 725b6a89ed82e72fdcb5cb2c946c65aaa17910e6 Author: Xing Tong Wu Date: Sat Oct 7 16:21:25 2023 +0800 watchdog: wdat_wdt: Add timeout value as a param in ping method According to the WDAT spec that states about WATCHDOG_ACTION_SET_COUNTDOWN_PERIOD: "This action is required if WATCHDOG_ACTION_RESET does not explicitly write a new countdown value to a register during a reset." And that implies, WATCHDOG_ACTION_RESET may write a countdown value, thus may come with a WATCHDOG_INSTRUCTION_WRITE_COUNTDOWN, thus need the timeout value as parameter or would otherwise write 0. The watchdog for SIONCT6126 need a entry WATCHDOG_INSTRUCTION_WRITE_COUNTDOWN for WATCHDOG_ACTION_RESET action, I send this patch to support it. Signed-off-by: Xing Tong Wu Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20231007082125.4699-1-xingtong_wu@163.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/wdat_wdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7e5bca6e5561c11ac9c541189cce3e6bf420f8b1 Author: Andy Shevchenko Date: Mon Sep 25 15:35:43 2023 +0300 watchdog: gpio_wdt: Make use of device properties Convert the module to be property provider agnostic and allow it to be used on non-OF platforms. Include mod_devicetable.h explicitly to replace the dropped of.h which included mod_devicetable.h indirectly. Signed-off-by: Andy Shevchenko Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230925123543.2945710-1-andriy.shevchenko@linux.intel.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/gpio_wdt.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) commit 5d6aa89bba5bd6af2580f872b57f438dab883738 Author: Darren Hart Date: Thu Sep 21 02:02:36 2023 -0700 sbsa_gwdt: Calculate timeout with 64-bit math Commit abd3ac7902fb ("watchdog: sbsa: Support architecture version 1") introduced new timer math for watchdog revision 1 with the 48 bit offset register. The gwdt->clk and timeout are u32, but the argument being calculated is u64. Without a cast, the compiler performs u32 operations, truncating intermediate steps, resulting in incorrect values. A watchdog revision 1 implementation with a gwdt->clk of 1GHz and a timeout of 600s writes 3647256576 to the one shot watchdog instead of 300000000000, resulting in the watchdog firing in 3.6s instead of 600s. Force u64 math by casting the first argument (gwdt->clk) as a u64. Make the order of operations explicit with parenthesis. Fixes: abd3ac7902fb ("watchdog: sbsa: Support architecture version 1") Reported-by: Vanshidhar Konda Signed-off-by: Darren Hart Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: linux-watchdog@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org Cc: # 5.14.x Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/7d1713c5ffab19b0f3de796d82df19e8b1f340de.1695286124.git.darren@os.amperecomputing.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/sbsa_gwdt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b4075ecfe348a44209534c75ad72392c63a489a6 Author: Linus Walleij Date: Tue Sep 26 11:13:44 2023 +0200 watchdog: ixp4xx: Make sure restart always works The IXP4xx watchdog in early "A0" silicon is unreliable and cannot be registered, however for some systems such as the USRobotics USR8200 the watchdog is the only restart option, so implement a "dummy" watchdog that can only support restart in this case. Fixes: 1aea522809e6 ("watchdog: ixp4xx: Implement restart") Signed-off-by: Linus Walleij Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230926-ixp4xx-wdt-restart-v2-1-15cf4639b423@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/ixp4xx_wdt.c | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) commit e2c520c4022016ccf20ba1c57af9fc2e56a1516f Author: Werner Fischer Date: Mon Sep 25 15:09:46 2023 +0200 watchdog: it87_wdt: add IT8613 ID This patch adds watchdog support for the ITE IT8613 watchdog. IT8613 watchdog works in the same way as the other watchdogs supported by it87_wdt. Before this patch, IT8613 watchdog is not supported. After a modprobe, dmesg reports: it87_wdt: Unknown Chip found, Chip 8613 Revision 000c With this patch, modprobe it87_wdt recognizes the watchdog as the dmesg output shows: it87_wdt: Chip IT8613 revision 12 initialized. timeout=60 sec (nowayout=0 testmode=0) Watchdog tests on a LES v4 have been successful, the watchdog works as expected with this patch [1]. [1] https://www.thomas-krenn.com/en/wiki/Watchdog#LES_v4 Signed-off-by: Werner Fischer Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/3bc0a1c2d768b23a0cd6e9f5fa0c0b5577427668.camel@wefi.net Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/it87_wdt.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 4b2b39f9395bc66c616d8d5a83642950fc3719b1 Author: Dan Carpenter Date: Thu Sep 7 12:53:15 2023 +0300 watchdog: marvell_gti_wdt: Fix error code in probe() This error path accidentally returns success. Return -EINVAL instead. Fixes: ef9e7fe2c890 ("Watchdog: Add marvell GTI watchdog driver") Signed-off-by: Dan Carpenter Reviewed-by: Bharat Bhushan Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/af326fd7-ac71-43a1-b7de-81779b61d242@moroto.mountain Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/marvell_gti_wdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f71e0be5d297b25453fdf4c1757b3e83e94b5f98 Author: Arnd Bergmann Date: Fri Oct 27 17:25:09 2023 +0200 ALSA: hda: cs35l41: mark cs35l41_verify_id() static The newly introduced function is global but only called in this one file and has no extern prototype, so it should probably be static: sound/pci/hda/cs35l41_hda.c:733:5: error: no previous prototype for 'cs35l41_verify_id' [-Werror=missing-prototypes] 733 | int cs35l41_verify_id(struct cs35l41_hda *cs35l41, unsigned int *regid, unsigned int *reg_revid) Fixes: 881b7bce0c25 ("ALSA: hda: cs35l41: Run boot process during resume callbacks") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20231027152515.482411-1-arnd@kernel.org Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 28d3fe32354701decc3e76d89712569c269b5e4f Author: Li Zetao Date: Tue Aug 15 13:13:46 2023 -0700 Input: walkera0701 - use module_parport_driver macro to simplify the code Use the module_parport_driver macro to simplify the code, which is the same as declaring with module_init() and module_exit(). Signed-off-by: Li Zetao Link: https://lore.kernel.org/r/20230815080107.1089401-1-lizetao1@huawei.com Signed-off-by: Dmitry Torokhov drivers/input/joystick/walkera0701.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) commit eb988e46da2e4eae89f5337e047ce372fe33d5b1 Author: Dan Carpenter Date: Sun Oct 29 02:53:36 2023 +0000 Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() The put_device() calls rmi_release_function() which frees "fn" so the dereference on the next line "fn->num_of_irqs" is a use after free. Move the put_device() to the end to fix this. Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/706efd36-7561-42f3-adfa-dd1d0bd4f5a1@moroto.mountain Signed-off-by: Dmitry Torokhov drivers/input/rmi4/rmi_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 290e44badacd8bb62f0f0fddec78381b237b8b83 Author: Fabio Estevam Date: Sun Oct 29 01:44:24 2023 +0000 dt-bindings: input: fsl,scu-key: Document wakeup-source The SCU Key controller can be used as a system wakeup source. Document the 'wakeup-source' property. This fixes the following schema warning: system-controller: keys: 'wakeup-source' does not match any of the regexes: 'pinctrl-[0-9]+' from schema $id: http://devicetree.org/schemas/firmware/fsl,scu.yaml# Signed-off-by: Fabio Estevam Acked-by: Rob Herring Link: https://lore.kernel.org/r/20230926122957.341094-1-festevam@gmail.com Signed-off-by: Dmitry Torokhov Documentation/devicetree/bindings/input/fsl,scu-key.yaml | 2 ++ 1 file changed, 2 insertions(+) commit 75690493591fe283e4c92a3ba7c4420e9858abdb Author: Zhihao Cheng Date: Sat Sep 23 11:28:59 2023 +0800 ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted The length of dentry name is calculated after the raw name is encrypted, except for ubifs_link(), which could make the size of dir underflow. Here is a reproducer: touch $TMP/file mkdir $TMP/dir stat $TMP/dir for i in $(seq 1 8) do ln $TMP/file $TMP/dir/$i unlink $TMP/dir/$i done stat $TMP/dir The size of dir will be underflow(-96). Fix it by calculating dentry name's length after the name is encrypted. Fixes: f4f61d2cc6d8 ("ubifs: Implement encrypted filenames") Reported-by: Roland Ruckerbauer Link: https://lore.kernel.org/linux-mtd/1638777819.2925845.1695222544742.JavaMail.zimbra@robart.cc/T/#u Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/dir.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit d07cec9c238ae8fc6c1a9f3f5d30a2f8ec6cdc71 Author: ZhaoLong Wang Date: Thu Sep 21 10:01:42 2023 +0800 ubi: block: Fix use-after-free in ubiblock_cleanup The following BUG is reported when a ubiblock is removed: ================================================================== BUG: KASAN: slab-use-after-free in ubiblock_cleanup+0x88/0xa0 [ubi] Read of size 4 at addr ffff88810c8f3804 by task ubiblock/1716 CPU: 5 PID: 1716 Comm: ubiblock Not tainted 6.6.0-rc2+ #135 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 Call Trace: dump_stack_lvl+0x37/0x50 print_report+0xd0/0x620 kasan_report+0xb6/0xf0 ubiblock_cleanup+0x88/0xa0 [ubi] ubiblock_remove+0x121/0x190 [ubi] vol_cdev_ioctl+0x355/0x630 [ubi] __x64_sys_ioctl+0xc7/0x100 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 RIP: 0033:0x7f08d7445577 Code: b3 66 90 48 8b 05 11 89 2c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 8 RSP: 002b:00007ffde05a3018 EFLAGS: 00000206 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f08d7445577 RDX: 0000000000000000 RSI: 0000000000004f08 RDI: 0000000000000003 RBP: 0000000000816010 R08: 00000000008163a7 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000206 R12: 0000000000000003 R13: 00007ffde05a3130 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 1715: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x7f/0x90 __alloc_disk_node+0x40/0x2b0 __blk_mq_alloc_disk+0x3e/0xb0 ubiblock_create+0x2ba/0x620 [ubi] vol_cdev_ioctl+0x581/0x630 [ubi] __x64_sys_ioctl+0xc7/0x100 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 0: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x50 __kasan_slab_free+0x10e/0x190 __kmem_cache_free+0x96/0x220 bdev_free_inode+0xa4/0xf0 rcu_core+0x496/0xec0 __do_softirq+0xeb/0x384 The buggy address belongs to the object at ffff88810c8f3800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 4 bytes inside of freed 1024-byte region [ffff88810c8f3800, ffff88810c8f3c00) The buggy address belongs to the physical page: page:00000000d03de848 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c8f0 head:00000000d03de848 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x200000000000840(slab|head|node=0|zone=2) page_type: 0xffffffff() raw: 0200000000000840 ffff888100042dc0 ffffea0004244400 dead000000000002 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88810c8f3700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88810c8f3780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88810c8f3800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88810c8f3880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88810c8f3900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fix it by using a local variable to record the gendisk ID. Fixes: 77567b25ab9f ("ubi: use blk_mq_alloc_disk and blk_cleanup_disk") Signed-off-by: ZhaoLong Wang Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger drivers/mtd/ubi/block.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit d81efd66106c03771ffc8637855a6ec24caa6350 Author: Konstantin Meskhidze Date: Tue Sep 5 18:12:22 2023 +0800 ubifs: fix possible dereference after free 'old_idx' could be dereferenced after free via 'rb_link_node' function call. Fixes: b5fda08ef213 ("ubifs: Fix memleak when insert_old_idx() failed") Co-developed-by: Ivanov Mikhail Signed-off-by: Konstantin Meskhidze Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/tnc.c | 1 + 1 file changed, 1 insertion(+) commit ac085cfe57df2cc1d7a5c4c5e64b8780c8ad452f Author: Zhihao Cheng Date: Mon Aug 28 14:38:45 2023 +0800 ubi: fastmap: Add control in 'UBI_IOCATT' ioctl to reserve PEBs for filling pools This patch imports a new field 'need_resv_pool' in struct 'ubi_attach_req' to control whether or not reserving free PEBs for filling pool/wl_pool. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217787 Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger drivers/mtd/ubi/cdev.c | 2 +- include/uapi/mtd/ubi-user.h | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) commit d4c48e5b58f12835de779f5425ef741c4d0fb53e Author: Zhihao Cheng Date: Mon Aug 28 14:38:44 2023 +0800 ubi: fastmap: Add module parameter to control reserving filling pool PEBs Adding 6th module parameter in 'mtd=xxx' to control whether or not reserving PEBs for filling pool/wl_pool. Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger drivers/mtd/ubi/build.c | 26 ++++++++++++++++++++++---- drivers/mtd/ubi/cdev.c | 3 ++- drivers/mtd/ubi/ubi.h | 2 +- 3 files changed, 25 insertions(+), 6 deletions(-) commit 90e0be56144b064be1a816cbdd184d2a8be7061b Author: Zhihao Cheng Date: Mon Aug 28 14:38:43 2023 +0800 ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs The anchor PEB must be picked from first 64 PEBs, these PEBs could have large erase counter greater than other PEBs especially when free space is nearly running out. The ubi_update_fastmap will be called as long as pool/wl_pool is empty, old anchor PEB is erased when updating fastmap. Given an UBI device with N PEBs, free PEBs is nearly running out and pool will be filled with 1 PEB every time ubi_update_fastmap invoked. So t=N/POOL_SIZE[1]/64 means that in worst case the erase counter of first 64 PEBs is t times greater than other PEBs in theory. After running fsstress for 24h, the erase counter statistics for two UBI devices shown as follow(CONFIG_MTD_UBI_WL_THRESHOLD=128): Device A(1024 PEBs, pool=50, wl_pool=25): ========================================================= from to count min avg max --------------------------------------------------------- 0 .. 9: 0 0 0 0 10 .. 99: 0 0 0 0 100 .. 999: 0 0 0 0 1000 .. 9999: 0 0 0 0 10000 .. 99999: 960 29224 29282 29362 100000 .. inf: 64 117897 117934 117940 --------------------------------------------------------- Total : 1024 29224 34822 117940 Device B(8192 PEBs, pool=256, wl_pool=128): ========================================================= from to count min avg max --------------------------------------------------------- 0 .. 9: 0 0 0 0 10 .. 99: 0 0 0 0 100 .. 999: 0 0 0 0 1000 .. 9999: 8128 2253 2321 2387 10000 .. 99999: 64 35387 35387 35388 100000 .. inf: 0 0 0 0 --------------------------------------------------------- Total : 8192 2253 2579 35388 The key point is reducing fastmap updating frequency by enlarging POOL_SIZE, so let UBI reserve ubi->fm_pool.max_size PEBs during attaching. Then POOL_SIZE will become ubi->fm_pool.max_size/2 even in free space running out case. Given an UBI device with 8192 PEBs(16384\8192\4096 is common large-capacity flash), t=8192/128/64=1. The fastmap updating will happen in either wl_pool or pool is empty, so setting fm_pool_rsv_cnt as ubi->fm_pool.max_size can fill wl_pool in full state. After pool reservation, running fsstress for 24h: Device A(1024 PEBs, pool=50, wl_pool=25): ========================================================= from to count min avg max --------------------------------------------------------- 0 .. 9: 0 0 0 0 10 .. 99: 0 0 0 0 100 .. 999: 0 0 0 0 1000 .. 9999: 0 0 0 0 10000 .. 99999: 1024 33801 33997 34056 100000 .. inf: 0 0 0 0 --------------------------------------------------------- Total : 1024 33801 33997 34056 Device B(8192 PEBs, pool=256, wl_pool=128): ========================================================= from to count min avg max --------------------------------------------------------- 0 .. 9: 0 0 0 0 10 .. 99: 0 0 0 0 100 .. 999: 0 0 0 0 1000 .. 9999: 8192 2205 2397 2460 10000 .. 99999: 0 0 0 0 100000 .. inf: 0 0 0 0 --------------------------------------------------------- Total : 8192 2205 2397 2460 The difference of erase counter between first 64 PEBs and others is under WL_FREE_MAX_DIFF(2*UBI_WL_THRESHOLD=2*128=256). Device A: 34056 - 33801 = 255 Device B: 2460 - 2205 = 255 Next patch will add a switch to control whether UBI needs to reserve PEBs for filling pool. Fixes: dbb7d2a88d2a ("UBI: Add fastmap core") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217787 Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger drivers/mtd/ubi/build.c | 1 + drivers/mtd/ubi/fastmap-wl.c | 2 +- drivers/mtd/ubi/ubi.h | 2 ++ drivers/mtd/ubi/wl.h | 6 ++++-- 4 files changed, 8 insertions(+), 3 deletions(-) commit 761893bd490b039258fda893c2a15fa59334c820 Author: Zhihao Cheng Date: Mon Aug 28 14:38:42 2023 +0800 ubi: fastmap: Get wl PEB even ec beyonds the 'max' if free PEBs are run out This is the part 2 to fix cyclically reusing single fastmap data PEBs. Consider one situation, if there are four free PEBs for fm_anchor, pool, wl_pool and fastmap data PEB with erase counter 100, 100, 100, 5096 (ubi->beb_rsvd_pebs is 0). PEB with erase counter 5096 is always picked for fastmap data according to the realization of find_wl_entry(), since fastmap data PEB is not scheduled for wl, finally there are two PEBs (fm data) with great erase counter than other PEBS. Get wl PEB even its erase counter exceeds the 'max' in find_wl_entry() when free PEBs are run out after filling pools and fm data. Then the PEB with biggest erase conter is taken as wl PEB, it can be scheduled for wl. Fixes: dbb7d2a88d2a ("UBI: Add fastmap core") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217787 Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger drivers/mtd/ubi/fastmap-wl.c | 44 ++++++++++++++++++++++++++++++++++---------- drivers/mtd/ubi/wl.c | 16 ++++++++++------ 2 files changed, 44 insertions(+), 16 deletions(-) commit dcc4e5728eeaeda84878ca0018758cff1abfca21 Author: Kees Cook Date: Fri Oct 27 08:56:38 2023 -0700 seq_buf: Introduce DECLARE_SEQ_BUF and seq_buf_str() Solve two ergonomic issues with struct seq_buf; 1) Too much boilerplate is required to initialize: struct seq_buf s; char buf[32]; seq_buf_init(s, buf, sizeof(buf)); Instead, we can build this directly on the stack. Provide DECLARE_SEQ_BUF() macro to do this: DECLARE_SEQ_BUF(s, 32); 2) %NUL termination is fragile and requires 2 steps to get a valid C String (and is a layering violation exposing the "internals" of seq_buf): seq_buf_terminate(s); do_something(s->buffer); Instead, we can just return s->buffer directly after terminating it in the refactored seq_buf_terminate(), now known as seq_buf_str(): do_something(seq_buf_str(s)); Link: https://lore.kernel.org/linux-trace-kernel/20231027155634.make.260-kees@kernel.org Link: https://lore.kernel.org/linux-trace-kernel/20231026194033.it.702-kees@kernel.org/ Cc: Yosry Ahmed Cc: "Matthew Wilcox (Oracle)" Cc: Christoph Hellwig Cc: Justin Stitt Cc: Kent Overstreet Cc: Petr Mladek Cc: Andy Shevchenko Cc: Rasmus Villemoes Cc: Sergey Senozhatsky Cc: Masami Hiramatsu Cc: Greg Kroah-Hartman Cc: Arnd Bergmann Cc: Jonathan Corbet Cc: Yun Zhou Cc: Jacob Keller Cc: Zhen Lei Signed-off-by: Kees Cook Signed-off-by: Steven Rostedt (Google) include/linux/seq_buf.h | 21 +++++++++++++++++---- kernel/trace/trace.c | 11 +---------- lib/seq_buf.c | 4 +--- 3 files changed, 19 insertions(+), 17 deletions(-) commit eada823e6a6fb856548f6e0c7a343cd5c41bb9d3 Author: Zhihao Cheng Date: Mon Aug 28 14:38:41 2023 +0800 ubi: fastmap: may_reserve_for_fm: Don't reserve PEB if fm_anchor exists This is the part 1 to fix cyclically reusing single fastmap data PEBs. After running fsstress on UBIFS for a while, UBI (16384 blocks, fastmap takes 2 blocks) has an erase block(PEB: 8031) with big erase counter greater than any other pebs: ========================================================= from to count min avg max --------------------------------------------------------- 0 .. 9: 0 0 0 0 10 .. 99: 532 84 92 99 100 .. 999: 15787 100 147 229 1000 .. 9999: 64 4699 4765 4826 10000 .. 99999: 0 0 0 0 100000 .. inf: 1 272935 272935 272935 --------------------------------------------------------- Total : 16384 84 180 272935 Not like fm_anchor, there is no candidate PEBs for fastmap data area, so old fastmap data pebs will be reused after all free pebs are filled into pool/wl_pool: ubi_update_fastmap for (i = 1; i < new_fm->used_blocks; i++) erase_block(ubi, old_fm->e[i]->pnum) new_fm->e[i] = old_fm->e[i] According to wear leveling algorithm, UBI selects one small erase counter PEB from ubi->used and one big erase counter PEB from wl_pool, the reused fastmap data PEB is not in these trees. UBI won't schedule this PEB for wl even it is in ubi->used because wl algorithm expects small erase counter for used PEB. Don't reserve PEB for fastmap in may_reserve_for_fm() if fm_anchor already exists. Otherwise, when UBI is running out of free PEBs, the only one free PEB (pnum < 64) will be skipped and fastmap data will be written on the same old PEB. Fixes: dbb7d2a88d2a ("UBI: Add fastmap core") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217787 Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger drivers/mtd/ubi/fastmap-wl.c | 2 +- drivers/mtd/ubi/wl.c | 9 ++++++--- 2 files changed, 7 insertions(+), 4 deletions(-) commit 415e4723c4325464d489c1ef3335eb6679905471 Author: Zhihao Cheng Date: Mon Aug 28 14:38:40 2023 +0800 ubi: fastmap: Remove unneeded break condition while filling pools Change pool filling stop condition. Commit d09e9a2bddba ("ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty") reserves fastmap data PEBs after filling 1 PEB in wl_pool. Now wait_free_pebs_for_pool() makes enough free PEBs before filling pool, there will still be at least 1 PEB in pool and 1 PEB in wl_pool after doing ubi_refill_pools(). Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger drivers/mtd/ubi/fastmap-wl.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit a2ea69dac674df0fba59c66146a21145108a85ed Author: Zhihao Cheng Date: Mon Aug 28 14:38:39 2023 +0800 ubi: fastmap: Wait until there are enough free PEBs before filling pools Wait until there are enough free PEBs before filling pool/wl_pool, sometimes erase_worker is not scheduled in time, which causes two situations: A. There are few PEBs filled in pool, which makes ubi_update_fastmap is frequently called and leads first 64 PEBs are erased more times than other PEBs. So waiting free PEBs before filling pool reduces fastmap updating frequency and prolongs flash service life. B. In situation that space is nearly running out, ubi_refill_pools() cannot make sure pool and wl_pool are filled with free PEBs, caused by the delay of erase_worker. After this patch applied, there must exist free PEBs in pool after one call of ubi_update_fastmap. Besides, this patch is a preparetion for fixing large erase counter in fastmap data block and fixing lapsed wear leveling for first 64 PEBs. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217787 Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger drivers/mtd/ubi/eba.c | 3 --- drivers/mtd/ubi/fastmap-wl.c | 53 +++++++++++++++++++++++++++++++++++++++++--- drivers/mtd/ubi/fastmap.c | 6 +---- drivers/mtd/ubi/ubi.h | 5 ++++- drivers/mtd/ubi/wl.c | 14 ++++++++---- 5 files changed, 65 insertions(+), 16 deletions(-) commit 8ff4e620ac93a5d332735e4f5a4ff31d80682b9a Author: Zhihao Cheng Date: Mon Aug 28 14:38:38 2023 +0800 ubi: fastmap: Use free pebs reserved for bad block handling If new bad PEBs occur, UBI firstly consumes ubi->beb_rsvd_pebs, and then ubi->avail_pebs, finally UBI becomes read-only if above two items are 0, which means that the amount of PEBs for user volumes is not effected. Besides, UBI reserves count of free PBEs is ubi->beb_rsvd_pebs while filling wl pool or getting free PEBs, but ubi->avail_pebs is not reserved. So ubi->beb_rsvd_pebs and ubi->avail_pebs have nothing to do with the usage of free PEBs, UBI can use all free PEBs. Commit 78d6d497a648 ("UBI: Move fastmap specific functions out of wl.c") has removed beb_rsvd_pebs checking while filling pool. Now, don't reserve ubi->beb_rsvd_pebs while filling wl_pool. This will fill more PEBs in pool and also reduce fastmap updating frequency. Also remove beb_rsvd_pebs checking in ubi_wl_get_fm_peb. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217787 Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger drivers/mtd/ubi/fastmap-wl.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) commit c19286d70aaa361cdb073a68a1f66232c359e2fd Author: Zhihao Cheng Date: Mon Aug 28 14:38:37 2023 +0800 ubi: Replace erase_block() with sync_erase() Since erase_block() has same logic with sync_erase(), just replace it with sync_erase(), also rename 'sync_erase()' to 'ubi_sync_erase()'. Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger drivers/mtd/ubi/fastmap.c | 48 ++--------------------------------------------- drivers/mtd/ubi/ubi.h | 1 + drivers/mtd/ubi/wl.c | 9 ++++----- 3 files changed, 7 insertions(+), 51 deletions(-) commit a033ab4fec5fd9194d1b6c0306efbdc75f70b142 Author: Zhihao Cheng Date: Mon Aug 28 14:38:36 2023 +0800 ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap Function ubi_update_fastmap could be called in IO context, for example: ubifs_writepage do_writepage ubifs_jnl_write_data write_head ubifs_wbuf_write_nolock ubifs_leb_write ubi_leb_write ubi_eba_write_leb try_write_vid_and_data ubi_wl_get_peb ubi_update_fastmap erase_block So it's better to allocate memory with GFP_NOFS mode, in case waiting page writeback(dead loop). Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger drivers/mtd/ubi/fastmap.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 08a4267874164b2e9c8c50831acd466f47208acc Author: Zhihao Cheng Date: Mon Aug 28 14:38:35 2023 +0800 ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash Just like sync_erase() does, getting erase counter from wl_entry is faster than reading from flash. Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger drivers/mtd/ubi/fastmap.c | 27 +++++++++------------------ 1 file changed, 9 insertions(+), 18 deletions(-) commit 4d18b5a57b16c21cf868369ca555068722c32b2d Author: Zhihao Cheng Date: Mon Aug 28 14:38:34 2023 +0800 ubi: fastmap: Fix missed ec updating after erasing old fastmap data block After running fsstress on ubifs for a long time, UBI(16384 blocks, fastmap takes 2 blocks) has an erase block with different erase counters displayed from two views: From ubiscan view: PEB 8031 has erase counter 31581 ========================================================= from to count min avg max --------------------------------------------------------- 0 .. 9: 0 0 0 0 10 .. 99: 0 0 0 0 100 .. 999: 16383 290 315 781 1000 .. 9999: 0 0 0 0 10000 .. 99999: 1 31581 31581 31581 100000 .. inf: 0 0 0 0 --------------------------------------------------------- Total : 16384 290 317 31581 From detailed_erase_block_info view: PEB 8031 has erase counter 7 physical_block_number erase_count 8030 421 8031 7 # mem info is different from disk info 8032 434 8033 425 8034 431 Following process missed updating erase counter in wl_entry(in memory): ubi_update_fastmap for (i = 1; i < new_fm->used_blocks; i++) // update fastmap data if (!tmp_e) if (old_fm && old_fm->e[i]) erase_block(ubi, old_fm->e[i]->pnum) ret = ubi_io_sync_erase(ubi, pnum, 0) ec = be64_to_cpu(ec_hdr->ec) ec += ret ec_hdr->ec = cpu_to_be64(ec) ubi_io_write_ec_hdr(ubi, pnum, ec_hdr) // ec is updated on flash // ec is not updated in old_fm->e[i] (in memory) Fix it by passing wl_enter into erase_block() and updating erase counter in erase_block(). Fixes: dbb7d2a88d2a ("UBI: Add fastmap core") Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger drivers/mtd/ubi/fastmap.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) commit 60f2f4a81d486348587a6901e744ca8f22dd9637 Author: Ferry Meng Date: Fri Aug 18 17:18:48 2023 +0800 ubifs: Fix missing error code err Fix smatch warning: fs/ubifs/journal.c:1610 ubifs_jnl_truncate() warn: missing error code 'err' Signed-off-by: Ferry Meng Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/journal.c | 1 + 1 file changed, 1 insertion(+) commit f4a04c97fb3b7edd7694e725b7dcf0d6901ebcdd Author: Vincent Whitchurch Date: Tue Jul 18 14:41:45 2023 +0200 ubifs: Fix memory leak of bud->log_hash Ensure that the allocated bud->log_hash (if any) is freed in all cases when the bud itself is freed, to fix this leak caught by kmemleak: # keyctl add logon foo:bar data @s # echo clear > /sys/kernel/debug/kmemleak # mount -t ubifs /dev/ubi0_0 mnt -o auth_hash_name=sha256,auth_key=foo:bar # echo a > mnt/x # umount mnt # mount -t ubifs /dev/ubi0_0 mnt -o auth_hash_name=sha256,auth_key=foo:bar # umount mnt # sleep 5 # echo scan > /sys/kernel/debug/kmemleak # echo scan > /sys/kernel/debug/kmemleak # cat /sys/kernel/debug/kmemleak unreferenced object 0xff... (size 128): comm "mount" backtrace: __kmalloc __ubifs_hash_get_desc+0x5d/0xe0 ubifs ubifs_replay_journal ubifs_mount ... Fixes: da8ef65f9573 ("ubifs: Authenticate replayed journal") Signed-off-by: Vincent Whitchurch Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/super.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 48ec6328de6c153a64474d9e5b6ec95f20f4142b Author: Yang Li Date: Wed Jul 12 15:46:37 2023 +0800 ubifs: Fix some kernel-doc comments Add description of @time and @flags in ubifs_update_time(). to silence the warnings: fs/ubifs/file.c:1383: warning: Function parameter or member 'time' not described in 'ubifs_update_time' fs/ubifs/file.c:1383: warning: Function parameter or member 'flags' not described in 'ubifs_update_time' Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=5848 Signed-off-by: Yang Li Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/file.c | 3 +++ 1 file changed, 3 insertions(+) commit 50b3ef14c26b20476e67af582e788b17512023cf Merge: 5897c174028a 0fce6e5c87fa Author: Bjorn Helgaas Date: Sat Oct 28 13:31:05 2023 -0500 Merge branch 'pci/misc' - Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device so dwc3 can claim it instead (Vicki Pfau) - Make pci_assign_unassigned_resources() non-init because sparc uses it after init-time (Randy Dunlap) - Remove logic_outb(), _outw(), outl() duplicate declarations (John Sanpe) - Remove unnecessary UTF-8 in Kconfig help text that confuses menuconfig (Liu Song) - Fix double free in __pci_epc_create() (Dan Carpenter) - Simplify pcie_capability_clear_and_set_word() cases that could be pcie_capability_clear_word() (Ilpo Järvinen) * pci/misc: PCI: Simplify pcie_capability_clear_and_set_word() to ..._clear_word() PCI: endpoint: Fix double free in __pci_epc_create() PCI: Replace unnecessary UTF-8 in Kconfig logic_pio: Remove logic_outb(), _outw(), outl() duplicate declarations PCI: Make pci_assign_unassigned_resources() non-init PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device commit 5897c174028a6a05169b6ecdbcd20fe4d1a8bcda Merge: 65de3fd8f5c8 8a0395578a9b Author: Bjorn Helgaas Date: Sat Oct 28 13:31:05 2023 -0500 Merge branch 'pci/field-get' - Use FIELD_GET()/FIELD_PREP() when possible throughout drivers/pci/ (Ilpo Järvinen, Bjorn Helgaas) - Rework DPC control programming for clarity (Ilpo Järvinen) * pci/field-get: PCI/portdrv: Use FIELD_GET() PCI/VC: Use FIELD_GET() PCI/PTM: Use FIELD_GET() PCI/PME: Use FIELD_GET() PCI/ATS: Use FIELD_GET() PCI/ATS: Show PASID Capability register width in bitmasks PCI: Use FIELD_GET() in Sapphire RX 5600 XT Pulse quirk PCI: Use FIELD_GET() PCI/MSI: Use FIELD_GET/PREP() PCI/DPC: Use defines with DPC reason fields PCI/DPC: Use defined fields with DPC_CTL register PCI/DPC: Use FIELD_GET() PCI: hotplug: Use FIELD_GET/PREP() PCI: dwc: Use FIELD_GET/PREP() PCI: cadence: Use FIELD_GET() PCI: Use FIELD_GET() to extract Link Width PCI: mvebu: Use FIELD_PREP() with Link Width PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields # Conflicts: # drivers/pci/controller/dwc/pcie-tegra194.c commit 65de3fd8f5c8a910e5bebc0607f8790158ad673a Merge: d100de085c1e 875760900b44 Author: Bjorn Helgaas Date: Sat Oct 28 13:31:03 2023 -0500 Merge branch 'pci/config-errs' - Simplify config accessor error checking (Ilpo Järvinen) * pci/config-errs: scsi: ipr: Do PCI error checks on own line PCI: xgene: Do PCI error check on own line & keep return value PCI: Do error check on own line to split long "if" conditions atm: iphase: Do PCI error checks on own line sh: pci: Do PCI error check on own line alpha: Streamline convoluted PCI error handling commit d100de085c1e6577417a66705a083496e4c26306 Merge: fb3d102fc20b 8d786149d78c Author: Bjorn Helgaas Date: Sat Oct 28 13:31:02 2023 -0500 Merge branch 'pci/controller/xilinx-xdma' - Move Xilinx IRQ definitions to a common header shared by pcie-xilinx-cpm and xilinx-xdma (Thippeswamy Havalige) - Add Xilinx XDMA driver and DT schema (Thippeswamy Havalige) * pci/controller/xilinx-xdma: PCI: xilinx-xdma: Add Xilinx XDMA Root Port driver dt-bindings: PCI: xilinx-xdma: Add schemas for Xilinx XDMA PCIe Root Port Bridge PCI: xilinx-cpm: Move IRQ definitions to a common header commit fb3d102fc20b2f150fa9a0ba576cd44af79e3518 Merge: a4179c60a993 2fccd11518f1 Author: Bjorn Helgaas Date: Sat Oct 28 13:31:02 2023 -0500 Merge branch 'pci/controller/xilinx-ecam' - Drop xilinx-nwl updates of bridge bus number fields, since PCI core already does that (Thippeswamy Havalige) - Update xilinx-nwl driver and ECAM size in devicetree example to allow up to 256 buses (Thippeswamy Havalige) * pci/controller/xilinx-ecam: PCI: xilinx-nwl: Modify ECAM size to enable support for 256 buses PCI: xilinx-nwl: Rename the NWL_ECAM_VALUE_DEFAULT macro dt-bindings: PCI: xilinx-nwl: Modify ECAM size in the DT example PCI: xilinx-nwl: Remove redundant code that sets Type 1 header fields commit a4179c60a993671b52b5ff32a783316c6a7a2f9a Merge: d97ab9e5330d 4c64d708f993 Author: Bjorn Helgaas Date: Sat Oct 28 13:31:02 2023 -0500 Merge branch 'pci/controller/vmd' - Fix space/tab whitespace issue (Xinghui Li) * pci/controller/vmd: PCI: vmd: Fix inconsistent indentation in vmd_resume() commit d97ab9e5330dc14cc3692167f26bf664fce4c75a Merge: db20113d702e 85e9eb3e7727 Author: Bjorn Helgaas Date: Sat Oct 28 13:31:02 2023 -0500 Merge branch 'pci/controller/speed' - Use PCIE_SPEED2MBS_ENC() macro in qcom host and endpoint to encode link speed instead of hard-coding the link speed in MBps (Manivannan Sadhasivam) - Use Mbps_to_icc() (not MBps_to_icc()) in tegra194 instead of explicitly doing the bytes-to-bits conversion (Manivannan Sadhasivam) * pci/controller/speed: PCI: tegra194: Use Mbps_to_icc() macro for setting icc speed PCI: qcom-ep: Use PCIE_SPEED2MBS_ENC() macro for encoding link speed PCI: qcom: Use PCIE_SPEED2MBS_ENC() macro for encoding link speed commit db20113d702e4f44d614676a967d0f74013fd25b Merge: eecffeb04573 6c4b39937f4e Author: Bjorn Helgaas Date: Sat Oct 28 13:31:01 2023 -0500 Merge branch 'pci/controller/rcar' - Add generic T_PVPERL macro for the required interval between power being stable and PERST# being inactive (Yoshihiro Shimoda) - Factor out dw_pcie_link_set_max_link_width() (Yoshihiro Shimoda) - Update PCI_EXP_LNKCAP_MLW so Link Capabilities shows the correct max link width (Yoshihiro Shimoda) - Drop tegra194 PCI_EXP_LNKCAP_MLW setting since dw_pcie_setup() already does it (Yoshihiro Shimoda) - Add dwc support for different dbi and dbi2 register offsets, to be used for R-Car Gen4 controllers (Yoshihiro Shimoda) - Add EDMA_UNROLL capability flag for R-Car Gen4 controllers that don't correctly advertise unrolled mapping via their eDMA CTRL register (Yoshihiro Shimoda) - Export dw_pcie_ep_exit() for use by the modular R-Car Gen4 driver (Yoshihiro Shimoda) - Add .pre_init() and .deinit() hooks for use by R-Car Gen4 controllers (Yoshihiro Shimoda) - Increase snps,dw-pcie DT reg and reg-names maxItems for R-Car Gen4 controllers (Yoshihiro Shimoda) - Add rcar-gen4-pci host and endpoint DT bindings and drivers (Yoshihiro Shimoda) - Add Renesas R8A779F0 Device ID to pci_endpoint_test to allow testing on R-Car S4-8 (Yoshihiro Shimoda) * pci/controller/rcar: misc: pci_endpoint_test: Add Device ID for R-Car S4-8 PCIe controller MAINTAINERS: Update PCI DRIVER FOR RENESAS R-CAR for R-Car Gen4 PCI: rcar-gen4: Add endpoint mode support PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode dt-bindings: PCI: renesas: Add R-Car Gen4 PCIe Endpoint dt-bindings: PCI: renesas: Add R-Car Gen4 PCIe Host dt-bindings: PCI: dwc: Update maxItems of reg and reg-names PCI: dwc: endpoint: Introduce .pre_init() and .deinit() PCI: dwc: Expose dw_pcie_write_dbi2() to module PCI: dwc: Expose dw_pcie_ep_exit() to module PCI: dwc: Add EDMA_UNROLL capability flag PCI: dwc: endpoint: Add multiple PFs support for dbi2 PCI: tegra194: Drop PCI_EXP_LNKSTA_NLW setting PCI: dwc: Add missing PCI_EXP_LNKCAP_MLW handling PCI: dwc: Add dw_pcie_link_set_max_link_width() PCI: Add T_PVPERL macro commit eecffeb045738b0214219c3ad44cd0502836efdf Merge: e365a36eaca0 a07d2497ed65 Author: Bjorn Helgaas Date: Sat Oct 28 13:31:01 2023 -0500 Merge branch 'pci/controller/qcom-ep' - Add qcom-ep callback to write DBI2 registers (Manivannan Sadhasivam) * pci/controller/qcom-ep: PCI: qcom-ep: Add dedicated callback for writing to DBI2 registers commit e365a36eaca029520e5cae555849934fde398c82 Merge: 7fa8fe0bd926 81ef01bc5934 Author: Bjorn Helgaas Date: Sat Oct 28 13:31:01 2023 -0500 Merge branch 'pci/controller/layerscape' - Set 64-bit DMA mask for layerscape-ep (Guanhua Gao) * pci/controller/layerscape: PCI: layerscape-ep: Set 64-bit DMA mask commit 7fa8fe0bd926329e5e2383e45c4a6ed71d25120c Merge: c97e5905ab8e f741bcadfe52 Author: Bjorn Helgaas Date: Sat Oct 28 13:31:00 2023 -0500 Merge branch 'pci/controller/hyperv' - Annotate struct hv_dr_state with __counted_by to prepare for array access bounds checking (Kees Cook) * pci/controller/hyperv: PCI: hv: Annotate struct hv_dr_state with __counted_by commit c97e5905ab8ec2a8a5be024ecb28fa85c173a4b3 Merge: 86b812dc491e e111ac7025cb Author: Bjorn Helgaas Date: Sat Oct 28 13:31:00 2023 -0500 Merge branch 'pci/controller/cadence' - Drop unused struct cdns_plat_pcie.is_rc member (Li Chen) * pci/controller/cadence: PCI: cadence: Drop unused member from struct cdns_plat_pcie commit 86b812dc491e1c6a959e74637d8e140a9d66128f Merge: dbf9527ca13d 9f4f3dfad8cf Author: Bjorn Helgaas Date: Sat Oct 28 13:31:00 2023 -0500 Merge branch 'pci/controller/aspm' - Add a dwc .host_post_init() callback for configuration after downstream devices are scanned (Manivannan Sadhasivam) - Enable ASPM for devices below qcom 1.9.0 host controllers (Manivannan Sadhasivam) * pci/controller/aspm: PCI: qcom: Enable ASPM for platforms supporting 1.9.0 ops PCI: dwc: Add host_post_init() callback commit dbf9527ca13da9afa0cabde32fd4fbdc73c0ae9d Merge: 79a8394a909e 94cfada2a9ca Author: Bjorn Helgaas Date: Sat Oct 28 13:31:00 2023 -0500 Merge branch 'pci/vga' - Add pci_is_vga() helper, which checks for both PCI_CLASS_DISPLAY_VGA and PCI_CLASS_NOT_DEFINED_VGA (which catches ancient devices built before Class Codes were defined) (Sui Jingfeng) - Use the new pci_is_vga() to identify devices for the VGA arbiter, the sysfs "boot_vga" attribute, and the virtio and qxl drivers (SUi Jingfeng) * pci/vga: drm/qxl: Use pci_is_vga() to identify VGA devices drm/virtio: Use pci_is_vga() to identify VGA devices PCI/sysfs: Enable 'boot_vga' attribute via pci_is_vga() PCI/VGA: Select VGA devices earlier PCI/VGA: Use pci_is_vga() to identify VGA devices PCI: Add pci_is_vga() helper commit 79a8394a909e43422df68165189a9bb5e25dd23b Merge: 2afbbc65be45 c9260693aa0c Author: Bjorn Helgaas Date: Sat Oct 28 13:30:59 2023 -0500 Merge branch 'pci/reset' - Lengthen reset delay for VideoPropulsion Torrent QN16e card, which seems to require longer delay than spec requires (Lukas Wunner) * pci/reset: PCI: Lengthen reset delay for VideoPropulsion Torrent QN16e card commit 2afbbc65be459f628719f21cb8ca6ce4c852b11c Merge: 209491885f82 7d08f21f8c63 Author: Bjorn Helgaas Date: Sat Oct 28 13:30:59 2023 -0500 Merge branch 'pci/pm' - Protect driver's D3cold preference from being overwritten by user space via sysfs (Lukas Wunner) - Avoid PME from D3hot/D3cold for AMD Rembrandt and Phoenix USB4 to fix wakeup by USB4-attached devices (Mario Limonciello) * pci/pm: x86/PCI: Avoid PME from D3hot/D3cold for AMD Rembrandt and Phoenix USB4 PCI/sysfs: Protect driver's D3cold preference from user space commit 209491885f827f04302c6abad587f45f744e9d90 Merge: adfe8d727dc5 805b196fb3bc Author: Bjorn Helgaas Date: Sat Oct 28 13:30:59 2023 -0500 Merge branch 'pci/p2pdma' - Move struct dev_pagemap (a flexible structure) to end of struct pci_p2pdma_pagemap to avoid overwriting things after dev_pagemap (Gustavo A. R. Silva) * pci/p2pdma: PCI/P2PDMA: Remove redundant goto PCI/P2PDMA: Fix undefined behavior bug in struct pci_p2pdma_pagemap commit adfe8d727dc5720da787725e6cf9a80591e5cd78 Merge: 553b84bf4677 820f59ed9680 Author: Bjorn Helgaas Date: Sat Oct 28 13:30:58 2023 -0500 Merge branch 'pci/hotplug' - Add driver for Ampere Altra Attention Indicators (D Scott Phillips) * pci/hotplug: PCI: hotplug: Add Ampere Altra Attention Indicator extension driver PCI: acpiphp: Allow built-in drivers for Attention Indicators commit 553b84bf467746b95f893f1bb92b143674a1aaf0 Merge: 4eccbed8f48c 7994db905c0f Author: Bjorn Helgaas Date: Sat Oct 28 13:30:58 2023 -0500 Merge branch 'pci/enumeration' - Add and use pci_get_base_class() to search for all PCI_BASE_CLASS_DISPLAY devices (Sui Jingfeng) - Fix a vmd check for multi-function devices (Ilpo Järvinen) - Add PCI_HEADER_TYPE_MFD and use it to replace literals (Ilpo Järvinen) - Use acpi_evaluate_dsm_typed() instead of open-coding it (Andy Shevchenko) - Keep .remove() and .probe() callbacks (previously marked __init) in case they're used via sysfs (Uwe Kleine-König) * pci/enumeration: PCI: keystone: Don't discard .probe() callback PCI: keystone: Don't discard .remove() callback PCI: kirin: Don't discard .remove() callback PCI: exynos: Don't discard .remove() callback PCI/ACPI: Use acpi_evaluate_dsm_typed() PCI: Use PCI_HEADER_TYPE_* instead of literals PCI: Add PCI_HEADER_TYPE_MFD definition PCI: vmd: Correct PCI Header Type Register's multi-function check drm/radeon: Use pci_get_base_class() to reduce duplicated code drm/amdgpu: Use pci_get_base_class() to reduce duplicated code drm/nouveau: Use pci_get_base_class() to reduce duplicated code ALSA: hda: Use pci_get_base_class() to reduce duplicated code PCI: Add pci_get_base_class() helper commit 4eccbed8f48c6cdcfe97b76be2b36d69e8f0845a Merge: 3c14a0507299 63a0b7dc1537 Author: Bjorn Helgaas Date: Sat Oct 28 13:30:58 2023 -0500 Merge branch 'pci/endpoint' - Use IS_ERR_OR_NULL() helper function instead of open-coding it (Ruan Jinjie) * pci/endpoint: PCI: endpoint: Use IS_ERR_OR_NULL() helper function commit 3c14a0507299d4275f983cc8c339f7087ebcf61a Merge: b63c6dfe4144 a18615b1cfc0 Author: Bjorn Helgaas Date: Sat Oct 28 13:30:57 2023 -0500 Merge branch 'pci/ats' - Disable ATS for Intel IPU E2000 A- and B-stepping devices to avoid invalidation message endianness erratum (Bartosz Pawlowski) * pci/ats: PCI: Disable ATS for specific Intel IPU E2000 devices PCI: Extract ATS disabling to a helper function commit b63c6dfe41446c0711f76608c49b4900f795bf39 Merge: b3fabba9a486 8e37372ad0be Author: Bjorn Helgaas Date: Sat Oct 28 13:30:57 2023 -0500 Merge branch 'pci/aspm' * pci/aspm: PCI/ASPM: Fix L1 substate handling in aspm_attr_store_common() Revert "PCI/ASPM: Disable only ASPM_STATE_L1 when driver, disables L1" PCI/ASPM: Convert printk() to pr_*() and add include PCI/ASPM: Remove unnecessary includes PCI/ASPM: Use FIELD_MAX() instead of literals PCI/ASPM: Use time constants PCI/ASPM: Return U32_MAX instead of bit magic construct PCI/ASPM: Use FIELD_GET/PREP() to access PCIe capability fields PCI: Add PCI_L1SS_CTL2 fields commit b3fabba9a4866af5537516d3f584fd065d049efb Merge: 0bb80ecc33a8 13cf36c648df Author: Bjorn Helgaas Date: Sat Oct 28 13:30:57 2023 -0500 Merge branch 'pci/aer' - Factor out AER interrupt enable/disable (Kai-Heng Feng) * pci/aer: PCI/AER: Factor out interrupt toggling into helpers commit 4bac088e2b12d40c49ad96c77be470eb2be7bae0 Author: Antoniu Miclaus Date: Thu Oct 26 13:33:12 2023 +0300 dt-bindings: hwmon: ltc2991: add bindings Add dt-bindings for ltc2991 octal i2c voltage, current and temperature monitor. Signed-off-by: Antoniu Miclaus Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20231026103413.27800-1-antoniu.miclaus@analog.com Signed-off-by: Guenter Roeck .../devicetree/bindings/hwmon/adi,ltc2991.yaml | 128 +++++++++++++++++++++ 1 file changed, 128 insertions(+) commit 205e0c0577faec05f5a9b92349cfd3454f2b00ec Author: Lakshmi Yadlapati Date: Thu Oct 26 23:43:46 2023 -0500 hwmon: (pmbus/max31785) Add delay between bus accesses The MAX31785 has shown erratic behaviour across multiple system designs, unexpectedly clock stretching and NAKing transactions. Experimentation shows that this seems to be triggered by a register access directly back to back with a previous register write. Experimentation also shows that inserting a small delay after register writes makes the issue go away. Use a similar solution to what the max15301 driver does to solve the same problem. Create a custom set of bus read and write functions that make sure that the delay is added. Signed-off-by: Lakshmi Yadlapati Link: https://lore.kernel.org/r/20231027044346.2167548-1-lakshmiy@us.ibm.com Signed-off-by: Guenter Roeck drivers/hwmon/pmbus/max31785.c | 188 ++++++++++++++++++++++++++++++++++++----- 1 file changed, 167 insertions(+), 21 deletions(-) commit 2358151bfb304aedda44348384557c161151bf57 Author: Richard Leitner Date: Thu Oct 26 09:08:49 2023 +0200 hwmon: (ina238) add ina237 support The INA237 "85-V, 16-Bit, Precision Power Monitor With I2C Interface" is basically the same as INA328. Therefore add a corresponding compatible to the driver. According to the datasheet the main difference is the current and power monitoring accuracy: +------------------------+---------------+---------------+ | | INA238 | INA237 | +------------------------+---------------+---------------+ | Offset voltage | +/- 5µV | +/- 50µV | | Offset drift | +/- 0.02µV/°C | +/- 0.02µV/°C | | Gain error | +/- 0.1% | +/- 0.3% | | Gain error drift | +/- 25ppm/°C | +/- 50ppm/°C | | Common mode rejection | 140dB | 120dB | | Power accuracy | 0.7% | 1.6% | +------------------------+---------------+---------------+ As well as the missing DEVICE_ID register at 0x3F, which is currently not in use by the driver. Signed-off-by: Richard Leitner Link: https://lore.kernel.org/r/20231026-ina237-v2-1-dec44811a3c9@linux.dev Signed-off-by: Guenter Roeck drivers/hwmon/ina238.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit b1f05cb4b310a8b8a48a1fac50fd76aeed30aa54 Author: Richard Leitner Date: Thu Oct 26 09:08:50 2023 +0200 dt-bindings: hwmon: ti,ina2xx: add ti,ina237 Add ti,ina237 binding to ti,ina2xx as they are very similar and may share the same properties. Signed-off-by: Richard Leitner Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20231026-ina237-v2-2-dec44811a3c9@linux.dev Signed-off-by: Guenter Roeck Documentation/devicetree/bindings/hwmon/ti,ina2xx.yaml | 1 + 1 file changed, 1 insertion(+) commit f7ac3020036b500cc474f9173481fdaed964b381 Author: Ellie Hermaszewska Date: Thu Oct 26 18:43:22 2023 +0800 hwmon: (asus-ec-sensors) add ROG Crosshair X670E Gene. Only the temp sensors that I can verify are present. T_Sensor is the temperature reading of a 10kΩ β=3435K NTC thermistor optionally connected to the T_SENSOR header. The other sensors are as found on the X670E Hero. Signed-off-by: Ellie Hermaszewska Link: https://lore.kernel.org/r/20231026104332.906357-1-kernel@monoid.al Signed-off-by: Guenter Roeck Documentation/hwmon/asus_ec_sensors.rst | 1 + drivers/hwmon/asus-ec-sensors.c | 12 ++++++++++++ 2 files changed, 13 insertions(+) commit 6dbd3e041d4b19c9654a630ca8c2933a1f85a7e1 Author: Antoniu Miclaus Date: Mon Sep 25 15:29:28 2023 +0300 hwmon: (max31827) handle vref regulator Add missing implementation for the max31827 supply regulator. This is a hardware required property that is not handled. Signed-off-by: Antoniu Miclaus Link: https://lore.kernel.org/r/20230925122929.10610-1-antoniu.miclaus@analog.com Signed-off-by: Guenter Roeck drivers/hwmon/max31827.c | 4 ++++ 1 file changed, 4 insertions(+) commit 7b64906c98fe503338066b97d3ff2dad65debf2b Author: Ninad Malwade Date: Fri Sep 29 11:36:49 2023 +0100 hwmon: (ina3221) Add support for channel summation disable The INA3221 allows the Critical alert pin to be controlled by the summation control function. This function adds the single shunt-voltage conversions for the desired channels in order to compare the combined sum to the programmed limit. The Shunt-Voltage Sum Limit register contains the programmed value that is compared to the value in the Shunt-Voltage Sum register in order to determine if the total summed limit is exceeded. If the shunt-voltage sum limit value is exceeded, the Critical alert pin pulls low. For the summation limit to have a meaningful value, we have to use the same shunt-resistor value on all included channels. Unless equal shunt-resistor values are used for each channel, the summation control function cannot be used and it is not enabled by the driver. To address this, add support to disable the summation of specific channels via device tree property "ti,summation-disable". The channel which has this property would be excluded from the calculation of summation control function. For example, summation control function calculates Shunt-Voltage Sum as: - input_shunt_voltage_summation = input_shunt_voltage_channel1 + input_shunt_voltage_channel2 + input_shunt_voltage_channel3 If we want the summation to only use channel1 and channel3, we can add 'ti,summation-disable' property in device tree node for channel2. Then the calculation will skip channel2. - input_shunt_voltage_summation = input_shunt_voltage_channel1 + input_shunt_voltage_channel3 Note that we only want the channel to be skipped for summation control function rather than completely disabled. Therefore, even if we add the property 'ti,summation-disable', the channel is still enabled and functional. Finally, create debugfs entries that display if summation is disabled for each of the channels. Signed-off-by: Rajkumar Kasirajan Signed-off-by: Ninad Malwade Co-developed-by: Jon Hunter Signed-off-by: Jon Hunter Link: https://lore.kernel.org/r/20230929103650.86074-4-jonathanh@nvidia.com Signed-off-by: Guenter Roeck drivers/hwmon/ina3221.c | 33 ++++++++++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 3 deletions(-) commit 13ab5fdc2cc60b24016546a8f402acd239280b68 Author: Jon Hunter Date: Fri Sep 29 11:36:48 2023 +0100 dt-bindings: hwmon: ina3221: Add ti,summation-disable The INA3221 has a critical alert pin that can be controlled by the summation control function. This function adds the single shunt-voltage conversions for the desired channels in order to compare the combined sum to the programmed limit. The Shunt-Voltage Sum Limit register contains the programmed value that is compared to the value in the Shunt-Voltage Sum register in order to determine if the total summed limit is exceeded. If the shunt-voltage sum limit value is exceeded, the critical alert pin pulls low. For the summation limit to have a meaningful value, it is necessary to use the same shunt-resistor value on all included channels. Add a new vendor specific property, 'ti,summation-disable', to allow specific channels to be excluded from the summation control function if the shunt resistor is different to other channels or the channel should not be considered for triggering the critical alert pin. Note that the ina3221 has always supported summing the various input channels and summation is enabled by default if the shunt-resistor values are the same. This change simply provides a way to exclude inputs from the summation. If this property is not populated, then the functionality of the driver does not change. Signed-off-by: Jon Hunter Signed-off-by: Ninad Malwade Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20230929103650.86074-3-jonathanh@nvidia.com Signed-off-by: Guenter Roeck .../devicetree/bindings/hwmon/ti,ina3221.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) commit 81b75e336c139be9ad4b3dce56d24e722850d2b4 Author: Ninad Malwade Date: Fri Sep 29 11:36:47 2023 +0100 dt-bindings: hwmon: ina3221: Convert to json-schema Convert the TI INA3221 bindings from the free-form text format to json-schema. Note that the INA3221 input channels default to enabled in the chip. Unless channels are explicitly disabled in device-tree, input channels will be enabled. Signed-off-by: Thierry Reding Signed-off-by: Ninad Malwade Signed-off-by: Jon Hunter Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20230929103650.86074-2-jonathanh@nvidia.com Signed-off-by: Guenter Roeck .../devicetree/bindings/hwmon/ina3221.txt | 54 ----------- .../devicetree/bindings/hwmon/ti,ina3221.yaml | 102 +++++++++++++++++++++ 2 files changed, 102 insertions(+), 54 deletions(-) commit fe0eba175e96820ae6b8ff2d6407ca5ab40a1d31 Author: Saravanan Sekar Date: Wed Oct 11 22:17:54 2023 +0530 hwmon: (pmbus/mpq7932) Add a support for mpq2286 Power Management IC The MPQ2286 is a programmable, high frequency synchronous buck regulator designed to power a variety of Automotive system peripherals. Single buck converters with hardware monitoring capability is configurable over PMBus interface. Signed-off-by: Saravanan Sekar Link: https://lore.kernel.org/r/20231011164754.449399-5-saravanan@linumiz.com [groeck: Updated subject (mpq2286 -> mpq7932)] Signed-off-by: Guenter Roeck drivers/hwmon/pmbus/mpq7932.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) commit 88b5970e92d0d3f6df67fb80f441a84b2c36b23f Author: Saravanan Sekar Date: Wed Oct 11 22:17:53 2023 +0530 hwmon: (pmbus/core) Add helper macro to define single pmbus regulator The bindings for single instance regulator should be named with no instance (e.g., buck not buck0). Introduce a new helper macro to define the single pmbus regulator. Signed-off-by: Saravanan Sekar Link: https://lore.kernel.org/r/20231011164754.449399-4-saravanan@linumiz.com Signed-off-by: Guenter Roeck drivers/hwmon/pmbus/pmbus.h | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit 90a801d5657a4b28d2c45023ee3a789463db2d64 Author: Saravanan Sekar Date: Wed Oct 11 22:17:52 2023 +0530 regulator: dt-bindings: Add mps,mpq2286 power-management IC Document mpq2286 power-management IC. Signed-off-by: Saravanan Sekar Acked-by: Mark Brown Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231011164754.449399-3-saravanan@linumiz.com Signed-off-by: Guenter Roeck .../devicetree/bindings/regulator/mps,mpq2286.yaml | 59 ++++++++++++++++++++++ 1 file changed, 59 insertions(+) commit b1a55c0af684fdab2229770a40e708b4138c6389 Author: Saravanan Sekar Date: Wed Oct 11 22:17:51 2023 +0530 hwmon: (pmbus/mpq7932) Get page count based on chip info Get page count using compatible match to support the series of chipsets which differs in number of regualator/page. Signed-off-by: Saravanan Sekar Link: https://lore.kernel.org/r/20231011164754.449399-2-saravanan@linumiz.com Signed-off-by: Guenter Roeck drivers/hwmon/pmbus/mpq7932.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 6632b45606bdcf14a9ee576c21f0d8331a99df9f Author: Daniel Matyas Date: Tue Sep 19 12:34:51 2023 +0300 dt-bindings: hwmon: Add possible new properties to max31827 bindings These modify the corresponding bits in the configuration register. adi,comp-int is a hardware property, because it affects the behavior of the interrupt signal and whatever it is connected to. adi,timeout-enable is a hardware property, because it affects i2c bus operation. Signed-off-by: Daniel Matyas Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230919093456.10592-3-daniel.matyas@analog.com Signed-off-by: Guenter Roeck .../devicetree/bindings/hwmon/adi,max31827.yaml | 66 ++++++++++++++++++++++ 1 file changed, 66 insertions(+) commit 8824557037d50f7819cef07b32ca9974965bd7ba Author: Daniel Matyas Date: Tue Sep 19 12:34:50 2023 +0300 hwmon: (max31827) Modify conversion wait time There is nothing in the datasheet indicating that the 1ms error is needed and I didn't encounter any error during testing with 140ms wait time. Signed-off-by: Daniel Matyas Link: https://lore.kernel.org/r/20230919093456.10592-2-daniel.matyas@analog.com Signed-off-by: Guenter Roeck Documentation/hwmon/max31827.rst | 4 ++-- drivers/hwmon/max31827.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) commit 9ca6696718cc3f8ca94172d834567f35500f21bf Author: Daniel Matyas Date: Tue Sep 19 12:34:49 2023 +0300 hwmon: (max31827) Make code cleaner Used enums and while loops to replace switch for selecting and getting update interval from conversion rate bits. Divided the write_alarm_val function into 2 functions. The new function is more generic: it can be used not only for alarm writes, but for any kind of writes which require the device to be in shutdown mode. Signed-off-by: Daniel Matyas Link: https://lore.kernel.org/r/20230919093456.10592-1-daniel.matyas@analog.com [groeck: Reverted error return value change (EOPNOTSUPP -> EINVAL)] Signed-off-by: Guenter Roeck drivers/hwmon/max31827.c | 123 +++++++++++++++++++++-------------------------- 1 file changed, 54 insertions(+), 69 deletions(-) commit b344041db783c4cb1e1944a1d5eae6651af72483 Author: Hal Feng Date: Thu Sep 28 15:52:49 2023 +0800 MAINTAINERS: Add Hal as one of the maintainers of SFCTEMP HWMON DRIVER As he is the submitter of this driver, add his mail so he can maintain the driver and easily reply in the mailing list. Acked-by: Emil Renner Berthing Signed-off-by: Hal Feng Link: https://lore.kernel.org/r/20230928075249.109459-1-hal.feng@starfivetech.com Signed-off-by: Guenter Roeck MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit 05b68e18ec64663be11119dd48de52fec927dfde Author: Alexander Koskovich Date: Mon Oct 23 18:24:59 2023 +0000 hwmon: (nct6683) Add another customer ID for ASRock X670E Taichi This value was found on an ASRock X670E Taichi with an NCT6686D chip. Signed-off-by: Alexander Koskovich Link: https://lore.kernel.org/r/20231023182442.21943-1-akoskovich@pm.me Signed-off-by: Guenter Roeck Documentation/hwmon/nct6683.rst | 1 + drivers/hwmon/nct6683.c | 3 +++ 2 files changed, 4 insertions(+) commit 10b02902048737f376104bc69e5212466e65a542 Author: Antoniu Miclaus Date: Wed Oct 11 16:57:53 2023 +0300 hwmon: (ltc2992) Avoid division by zero Do not allow setting shunt resistor to 0. This results in a division by zero when performing current value computations based on input voltages and connected resistor values. Signed-off-by: Antoniu Miclaus Link: https://lore.kernel.org/r/20231011135754.13508-1-antoniu.miclaus@analog.com Signed-off-by: Guenter Roeck drivers/hwmon/ltc2992.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit b92b2984a5b62099ab7731bc3a30a0d7c83a01d4 Author: Su Hui Date: Fri Oct 20 16:55:19 2023 +0800 hwmon: (npcm750-pwm) Add an error code check in npcm7xx_en_pwm_fan npcm7xx_pwm_config_set() can return '-ENODEV' for failed. So check the value of 'ret' after calling npcm7xx_pwm_config_set(). Signed-off-by: Su Hui Link: https://lore.kernel.org/r/20231020085518.198477-1-suhui@nfschina.com Signed-off-by: Guenter Roeck drivers/hwmon/npcm750-pwm-fan.c | 2 ++ 1 file changed, 2 insertions(+) commit 748465a53eedbc2c440ac07f6b2328de6263dbfd Author: Colin Ian King Date: Mon Oct 23 14:58:28 2023 +0100 hwmon: (hs3001) remove redundant store on division Currently the local variable hum is being divided by a constant and the results is being re-assigned back to hum before the value is being returned to the caller. The assignment to hum is redundant and can be removed. Cleans up clang scan build warning: drivers/hwmon/hs3001.c:65:9: warning: Although the value stored to 'hum' is used in the enclosing expression, the value is never actually read from 'hum' [deadcode.DeadStores] Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20231023135828.667297-1-colin.i.king@gmail.com Signed-off-by: Guenter Roeck drivers/hwmon/hs3001.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1b515cfee17810e74cda9cf020e302747821d46c Author: Raag Jadav Date: Tue Oct 24 11:50:17 2023 +0530 hwmon: (nct6775) use acpi_dev_hid_uid_match() for matching _HID and _UID Convert manual _UID references to use the standard ACPI helper. Signed-off-by: Raag Jadav Link: https://lore.kernel.org/r/20231024062018.23839-6-raag.jadav@intel.com Signed-off-by: Guenter Roeck drivers/hwmon/nct6775-platform.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit d9e5d9221d7f82a2736f091bbc5b54ab8d6ef701 Author: Amir Goldstein Date: Thu Oct 26 23:45:40 2023 +0300 fs: fix build error with CONFIG_EXPORTFS=m or not defined Many of the filesystems that call the generic exportfs helpers do not select the EXPORTFS config. Move generic_encode_ino32_fh() to libfs.c, same as generic_fh_to_*() to avoid having to fix all those config dependencies. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202310262151.renqMvme-lkp@intel.com/ Fixes: dfaf653dc415 ("exportfs: make ->encode_fh() a mandatory method for NFS export") Suggested-by: Arnd Bergmann Signed-off-by: Amir Goldstein Link: https://lore.kernel.org/r/20231026204540.143217-1-amir73il@gmail.com Tested-by: Arnd Bergmann Signed-off-by: Christian Brauner fs/exportfs/expfs.c | 41 ----------------------------------------- fs/libfs.c | 41 +++++++++++++++++++++++++++++++++++++++++ include/linux/exportfs.h | 9 ++------- 3 files changed, 43 insertions(+), 48 deletions(-) commit ceb33880431c8284b58de5602b15dfb7ac0a4aa5 Author: Amir Goldstein Date: Tue Oct 24 15:14:57 2023 +0300 freevxfs: derive f_fsid from bdev->bd_dev The majority of blockdev filesystems, which do not have a UUID in their on-disk format, derive f_fsid of statfs(2) from bdev->bd_dev. Use the same practice for freevxfs. This will allow reporting fanotify events with fanotify_event_info_fid. Signed-off-by: Amir Goldstein Link: https://lore.kernel.org/r/20231024121457.3014063-1-amir73il@gmail.com Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner fs/freevxfs/vxfs_super.c | 2 ++ 1 file changed, 2 insertions(+) commit ae62bcb5e7e5a1ab6f85518949f3f759c6e9a8e0 Author: Amir Goldstein Date: Mon Oct 23 17:30:49 2023 +0300 fs: report f_fsid from s_dev for "simple" filesystems There are many "simple" filesystems (*) that report null f_fsid in statfs(2). Those "simple" filesystems report sb->s_dev as the st_dev field of the stat syscalls for all inodes of the filesystem (**). In order to enable fanotify reporting of events with fsid on those "simple" filesystems, report the sb->s_dev number in f_fsid field of statfs(2). (*) For most of the "simple" filesystem refered to in this commit, the ->statfs() operation is simple_statfs(). Some of those fs assign the simple_statfs() method directly in their ->s_op struct and some assign it indirectly via a call to simple_fill_super() or to pseudo_fs_fill_super() with either custom or "simple" s_op. We also make the same change to efivarfs and hugetlbfs, although they do not use simple_statfs(), because they use the simple_* inode opreations (e.g. simple_lookup()). (**) For most of the "simple" filesystems, the ->getattr() method is not assigned, so stat() is implemented by generic_fillattr(). A few "simple" filesystem use the simple_getattr() method which also calls generic_fillattr() to fill most of the stat struct. The two exceptions are procfs and 9p. procfs implements several different ->getattr() methods, but they all end up calling generic_fillattr() to fill the st_dev field from sb->s_dev. 9p has more complicated ->getattr() methods, but they too, end up calling generic_fillattr() to fill the st_dev field from sb->s_dev. Note that 9p and kernfs also call simple_statfs() from custom ->statfs() methods which already fill the f_fsid field, but v9fs_statfs() calls simple_statfs() only in case f_fsid was not filled and kenrfs_statfs() overwrites f_fsid after calling simple_statfs(). Link: https://lore.kernel.org/r/20230919094820.g5bwharbmy2dq46w@quack3/ Signed-off-by: Amir Goldstein Link: https://lore.kernel.org/r/20231023143049.2944970-1-amir73il@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner fs/efivarfs/super.c | 2 ++ fs/hugetlbfs/inode.c | 2 ++ fs/libfs.c | 3 +++ 3 files changed, 7 insertions(+) commit 64343119d7b80b4ee9ba7703390681608a17f2c5 Author: Amir Goldstein Date: Mon Oct 23 21:08:01 2023 +0300 exportfs: support encoding non-decodeable file handles by default AT_HANDLE_FID was added as an API for name_to_handle_at() that request the encoding of a file id, which is not intended to be decoded. This file id is used by fanotify to describe objects in events. So far, overlayfs is the only filesystem that supports encoding non-decodeable file ids, by providing export_operations with an ->encode_fh() method and without a ->decode_fh() method. Add support for encoding non-decodeable file ids to all the filesystems that do not provide export_operations, by encoding a file id of type FILEID_INO64_GEN from { i_ino, i_generation }. A filesystem may that does not support NFS export, can opt-out of encoding non-decodeable file ids for fanotify by defining an empty export_operations struct (i.e. with a NULL ->encode_fh() method). This allows the use of fanotify events with file ids on filesystems like 9p which do not support NFS export to bring fanotify in feature parity with inotify on those filesystems. Note that fanotify also requires that the filesystems report a non-null fsid. Currently, many simple filesystems that have support for inotify (e.g. debugfs, tracefs, sysfs) report a null fsid, so can still not be used with fanotify in file id reporting mode. Reviewed-by: Jan Kara Reviewed-by: Jeff Layton Signed-off-by: Amir Goldstein Link: https://lore.kernel.org/r/20231023180801.2953446-5-amir73il@gmail.com Signed-off-by: Christian Brauner fs/exportfs/expfs.c | 32 +++++++++++++++++++++++++++++--- include/linux/exportfs.h | 10 +++++++--- 2 files changed, 36 insertions(+), 6 deletions(-) commit 41d1ddd2717c758b8606a66d57d2cc63b41373c0 Author: Amir Goldstein Date: Mon Oct 23 21:08:00 2023 +0300 exportfs: define FILEID_INO64_GEN* file handle types Similar to the common FILEID_INO32* file handle types, define common FILEID_INO64* file handle types. The type values of FILEID_INO64_GEN and FILEID_INO64_GEN_PARENT are the values returned by fuse and xfs for 64bit ino encoded file handle types. Note that these type value are filesystem specific and they do not define a universal file handle format, for example: fuse encodes FILEID_INO64_GEN as [ino-hi32,ino-lo32,gen] and xfs encodes FILEID_INO64_GEN as [hostr-order-ino64,gen] (a.k.a xfs_fid64). The FILEID_INO64_GEN fhandle type is going to be used for file ids for fanotify from filesystems that do not support NFS export. Reviewed-by: Jan Kara Reviewed-by: Jeff Layton Signed-off-by: Amir Goldstein Link: https://lore.kernel.org/r/20231023180801.2953446-4-amir73il@gmail.com Signed-off-by: Christian Brauner fs/fuse/inode.c | 7 ++++--- include/linux/exportfs.h | 11 +++++++++++ 2 files changed, 15 insertions(+), 3 deletions(-) commit e21fc2038c1b978b89bbc3d45a4c5c6ef598e178 Author: Amir Goldstein Date: Mon Oct 23 21:07:59 2023 +0300 exportfs: make ->encode_fh() a mandatory method for NFS export Rename the default helper for encoding FILEID_INO32_GEN* file handles to generic_encode_ino32_fh() and convert the filesystems that used the default implementation to use the generic helper explicitly. After this change, exportfs_encode_inode_fh() no longer has a default implementation to encode FILEID_INO32_GEN* file handles. This is a step towards allowing filesystems to encode non-decodeable file handles for fanotify without having to implement any export_operations. Reviewed-by: Jan Kara Reviewed-by: Jeff Layton Acked-by: Chuck Lever Signed-off-by: Amir Goldstein Link: https://lore.kernel.org/r/20231023180801.2953446-3-amir73il@gmail.com Acked-by: Dave Kleikamp Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner Documentation/filesystems/nfs/exporting.rst | 7 ++----- Documentation/filesystems/porting.rst | 9 +++++++++ fs/affs/namei.c | 1 + fs/befs/linuxvfs.c | 1 + fs/efs/super.c | 1 + fs/erofs/super.c | 1 + fs/exportfs/expfs.c | 16 +++++++++------- fs/ext2/super.c | 1 + fs/ext4/super.c | 1 + fs/f2fs/super.c | 1 + fs/fat/nfs.c | 1 + fs/jffs2/super.c | 1 + fs/jfs/super.c | 1 + fs/ntfs/namei.c | 1 + fs/ntfs3/super.c | 1 + fs/smb/client/export.c | 11 +++++------ fs/squashfs/export.c | 1 + fs/ufs/super.c | 1 + include/linux/exportfs.h | 9 ++++++++- 19 files changed, 47 insertions(+), 19 deletions(-) commit d8d9919f4579a04d250b754e15597bfcf9379c14 Author: Heiner Kallweit Date: Sun Oct 15 23:36:17 2023 +0200 i2c: i801: Use new helper acpi_use_parent_companion Use new helper acpi_use_parent_companion to simplify the code. Signed-off-by: Heiner Kallweit Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-i801.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 29166faac5486cbc34228431cd049e1c1be451ac Author: Heiner Kallweit Date: Sun Oct 15 23:34:25 2023 +0200 ACPI: Add helper acpi_use_parent_companion In several drivers devices use the ACPI companion of the parent. Add a helper for this use case to avoid code duplication. Signed-off-by: Heiner Kallweit Acked-by: Rafael J. Wysocki Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang include/linux/acpi.h | 5 +++++ 1 file changed, 5 insertions(+) commit 3d6cd1af37cb937bb8b65e6047dffc2fb5be7d1c Author: Wolfram Sang Date: Sat Oct 28 14:23:08 2023 +0200 MAINTAINERS: add YAML file for i2c-demux-pinctrl Signed-off-by: Wolfram Sang Signed-off-by: Wolfram Sang MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit 53801d2e762a611d972e91d151df56c3412ca5cf Author: Daniel Mack Date: Wed Oct 18 11:46:13 2023 +0200 i2c: core: fix lockdep warning for sparsely nested adapter chain When adapters are chained in a sparse manner (with intermediate MFD devices, for instance) the code currently fails to use the correct subclass for the adapter's bus_lock which leads to false-positive lockdep warnings. Fix this by walking the entire pedigree of the device and count all adapters along the way instead of just checking the immediate parent. Signed-off-by: Daniel Mack Signed-off-by: Wolfram Sang drivers/i2c/i2c-core-base.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 702c0dd7bcf169c44cb4a67447532861877c2744 Author: Randy Dunlap Date: Wed Oct 25 22:39:18 2023 -0700 i2c: axxia: eliminate kernel-doc warnings Add kernel-doc for 'slave' and 'irq' in struct axxia_i2c_dev. Drop kernel-doc notation ("/**") for static functions since they are not usually documented with kernel-doc. Prevents these kernel-doc warnings: i2c-axxia.c:150: warning: Function parameter or member 'slave' not described in 'axxia_i2c_dev' i2c-axxia.c:150: warning: Function parameter or member 'irq' not described in 'axxia_i2c_dev' i2c-axxia.c:172: warning: Function parameter or member 'ns' not described in 'ns_to_clk' i2c-axxia.c:172: warning: Function parameter or member 'clk_mhz' not described in 'ns_to_clk' i2c-axxia.c:172: warning: No description found for return value of 'ns_to_clk' i2c-axxia.c:271: warning: Function parameter or member 'idev' not described in 'axxia_i2c_empty_rx_fifo' i2c-axxia.c:271: warning: No description found for return value of 'axxia_i2c_empty_rx_fifo' i2c-axxia.c:303: warning: Function parameter or member 'idev' not described in 'axxia_i2c_fill_tx_fifo' Signed-off-by: Randy Dunlap Reported-by: kernel test robot Closes: https://lore.kernel.org/all/202310181049.Vo62moV1-lkp@intel.com/ Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-axxia.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 766b7007a1cc2a4bb687311d9cec6681cbe0d5e2 Author: Simon Glass Date: Thu Oct 26 20:26:23 2023 +1300 kbuild: Correct missing architecture-specific hyphens These should add a hyphen to indicate that it makes a adjective. Fix them. Signed-off-by: Simon Glass Signed-off-by: Masahiro Yamada Makefile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 34fcf231dcf94d7dea29c070228c4b93849f4850 Author: Masahiro Yamada Date: Mon Oct 23 02:06:13 2023 +0900 modpost: squash ALL_{INIT,EXIT}_TEXT_SECTIONS to ALL_TEXT_SECTIONS ALL_INIT_TEXT_SECTIONS and ALL_EXIT_TEXT_SECTIONS are only used in the macro definition of ALL_TEXT_SECTIONS. Signed-off-by: Masahiro Yamada scripts/mod/modpost.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit b3d4f446fc0f6bf6d50abfc403eb375d9b9f6378 Author: Masahiro Yamada Date: Mon Oct 23 02:06:12 2023 +0900 modpost: merge sectioncheck table entries regarding init/exit sections Check symbol references from normal sections to init/exit sections in a single entry. Signed-off-by: Masahiro Yamada scripts/mod/modpost.c | 18 +++--------------- 1 file changed, 3 insertions(+), 15 deletions(-) commit e578e4e3110635b20786e442baa3aeff9bb65f95 Author: Masahiro Yamada Date: Mon Oct 23 02:06:11 2023 +0900 modpost: use ALL_INIT_SECTIONS for the section check from DATA_SECTIONS ALL_INIT_SECTIONS is defined as follows: #define ALL_INIT_SECTIONS INIT_SECTIONS, ALL_XXXINIT_SECTIONS Signed-off-by: Masahiro Yamada scripts/mod/modpost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a3df1526da480c089c20868b7f4d486b9f266001 Author: Masahiro Yamada Date: Mon Oct 23 02:06:10 2023 +0900 modpost: disallow the combination of EXPORT_SYMBOL and __meminit* Theoretically, we could export conditionally-discarded code sections, such as .meminit*, if all the users can become modular under a certain condition. However, that would be difficult to control and such a tricky case has never occurred. Signed-off-by: Masahiro Yamada scripts/mod/modpost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 48cd8df7afd1eef22cf7b125697a6d7c3d168c5c Author: Masahiro Yamada Date: Mon Oct 23 02:06:09 2023 +0900 modpost: remove EXIT_SECTIONS macro ALL_EXIT_SECTIONS and EXIT_SECTIONS are the same. Remove the latter. Signed-off-by: Masahiro Yamada scripts/mod/modpost.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit 473a45bb35f080e31cb4fe45e905bfe3bd407fdf Author: Masahiro Yamada Date: Mon Oct 23 02:06:08 2023 +0900 modpost: remove MEM_INIT_SECTIONS macro ALL_XXXINIT_SECTIONS and MEM_INIT_SECTIONS are the same. Remove the latter. Signed-off-by: Masahiro Yamada scripts/mod/modpost.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit e1dc1bfe5b27842c9e43a1f2d42c34decb0660c3 Author: Masahiro Yamada Date: Mon Oct 23 02:06:07 2023 +0900 modpost: remove more symbol patterns from the section check whitelist These symbol patterns were whitelisted to allow them to reference to functions with the old __devinit and __devexit annotations. We stopped doing this a long time ago, for example, commit 6f039790510f ("Drivers: scsi: remove __dev* attributes.") remove those annotations from the scsi drivers. Keep *_ops, *_probe, and *_console, otherwise they will really cause section mismatch warnings. Signed-off-by: Masahiro Yamada scripts/mod/modpost.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit 50cccec15c48814765895891ca0d95d989b6a419 Author: Masahiro Yamada Date: Mon Oct 23 02:06:06 2023 +0900 modpost: disallow *driver to reference .meminit* sections Drivers must not reference .meminit* sections, which are discarded when CONFIG_MEMORY_HOTPLUG=n. The reason for whitelisting "*driver" in the section mismatch check was to allow drivers to reference symbols annotated as __devinit or __devexit that existed in the past. Those annotations were removed by the following commits: - 54b956b90360 ("Remove __dev* markings from init.h") - 92e9e6d1f984 ("modpost.c: Stop checking __dev* section mismatches") Remove the stale whitelist. Signed-off-by: Masahiro Yamada scripts/mod/modpost.c | 6 ------ 1 file changed, 6 deletions(-) commit 6a4e59eeedc3018cb57722eecfcbb49431aeb05f Author: Masahiro Yamada Date: Mon Oct 23 02:06:05 2023 +0900 linux/init: remove __memexit* annotations We have never used __memexit, __memexitdata, or __memexitconst. These were unneeded. Signed-off-by: Masahiro Yamada Acked-by: Arnd Bergmann include/asm-generic/vmlinux.lds.h | 6 ------ include/linux/init.h | 3 --- scripts/mod/modpost.c | 15 +++------------ 3 files changed, 3 insertions(+), 21 deletions(-) commit 3ada34b0f6559b2388f1983366614fbe8027b6fd Author: Masahiro Yamada Date: Mon Oct 23 02:06:04 2023 +0900 modpost: remove ALL_EXIT_DATA_SECTIONS macro This is unused. Signed-off-by: Masahiro Yamada scripts/mod/modpost.c | 2 -- 1 file changed, 2 deletions(-) commit 4411a2ccbaf6ef7b6efe487ea97079961dfa8b18 Author: Geert Uytterhoeven Date: Mon Oct 23 15:53:00 2023 +0200 dt-bindings: i2c: i2c-demux-pinctrl: Convert to json-schema Convert the pinctrl-based I2C bus demultiplexer Device Tree binding documentation to json-schema. Update the example to match reality. Signed-off-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Reviewed-by: Conor Dooley Signed-off-by: Wolfram Sang .../devicetree/bindings/i2c/i2c-demux-pinctrl.txt | 135 ---------------- .../devicetree/bindings/i2c/i2c-demux-pinctrl.yaml | 172 +++++++++++++++++++++ 2 files changed, 172 insertions(+), 135 deletions(-) commit 1b1595cd04bb1eff448e68ef2789d37f1268b879 Author: Masahiro Yamada Date: Mon Oct 23 01:30:14 2023 +0900 kbuild: simplify cmd_ld_multi_m $(patsubst %.o,%.mod,$@) can be replaced with $<. Signed-off-by: Masahiro Yamada scripts/Makefile.build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 72d091846de935e0942a8a0f1fe24ff739d85d76 Author: Masahiro Yamada Date: Thu Oct 19 00:19:48 2023 +0900 kbuild: avoid too many execution of scripts/pahole-flags.sh scripts/pahole-flags.sh is executed so many times. You can confirm it, as follows: $ cat <> scripts/pahole-flags.sh > echo "scripts/pahole-flags.sh was executed" >&2 > EOF $ make -s scripts/pahole-flags.sh was executed scripts/pahole-flags.sh was executed scripts/pahole-flags.sh was executed scripts/pahole-flags.sh was executed scripts/pahole-flags.sh was executed [ lots of repeated lines... ] This scripts is executed more than 20 times during the kernel build because PAHOLE_FLAGS is a recursively expanded variable and exported to sub-processes. With GNU Make >= 4.4, it is executed more than 60 times because exported variables are also passed to other $(shell ) invocations. Without careful coding, it is known to cause an exponential fork explosion. [1] The use of $(shell ) in an exported recursive variable is likely wrong because $(shell ) is always evaluated due to the 'export' keyword, and the evaluation can occur multiple times by the nature of recursive variables. Convert the shell script to a Makefile, which is included only when CONFIG_DEBUG_INFO_BTF=y. [1]: https://savannah.gnu.org/bugs/index.php?64746 Signed-off-by: Masahiro Yamada Reviewed-by: Alan Maguire Tested-by: Alan Maguire Reviewed-by: Nicolas Schier Tested-by: Miguel Ojeda Acked-by: Miguel Ojeda Acked-by: Jiri Olsa Reviewed-by: Martin Rodriguez Reboredo MAINTAINERS | 2 +- Makefile | 4 +--- scripts/Makefile.btf | 19 +++++++++++++++++++ scripts/pahole-flags.sh | 30 ------------------------------ 4 files changed, 21 insertions(+), 34 deletions(-) commit 7f6d8f7e43fb516f060cf71672a922031aa5faa9 Author: Masahiro Yamada Date: Thu Oct 19 00:19:47 2023 +0900 kbuild: remove ARCH_POSTLINK from module builds The '%.ko' rule in arch/*/Makefile.postlink does nothing but call the 'true' command. Remove the unneeded code. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier arch/mips/Makefile.postlink | 3 --- arch/powerpc/Makefile.postlink | 3 --- arch/riscv/Makefile.postlink | 3 --- arch/x86/Makefile.postlink | 3 --- scripts/Makefile.modfinal | 5 +---- 5 files changed, 1 insertion(+), 16 deletions(-) commit 9d361173edc4f8c25440f6db3ab46f5ab7c107cf Author: Masahiro Yamada Date: Sat Oct 14 19:54:36 2023 +0900 kbuild: unify no-compiler-targets and no-sync-config-targets Now that vdso_install does not depend on any in-tree build artifact, it no longer needs a compiler, making no-compiler-targets the same as no-sync-config-targets. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier Makefile | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) commit 56769ba4b297a629148eb24d554aef72d1ddfd9e Author: Masahiro Yamada Date: Sat Oct 14 19:54:35 2023 +0900 kbuild: unify vdso_install rules Currently, there is no standard implementation for vdso_install, leading to various issues: 1. Code duplication Many architectures duplicate similar code just for copying files to the install destination. Some architectures (arm, sparc, x86) create build-id symlinks, introducing more code duplication. 2. Unintended updates of in-tree build artifacts The vdso_install rule depends on the vdso files to install. It may update in-tree build artifacts. This can be problematic, as explained in commit 19514fc665ff ("arm, kbuild: make "make install" not depend on vmlinux"). 3. Broken code in some architectures Makefile code is often copied from one architecture to another without proper adaptation. 'make vdso_install' for parisc does not work. 'make vdso_install' for s390 installs vdso64, but not vdso32. To address these problems, this commit introduces a generic vdso_install rule. Architectures that support vdso_install need to define vdso-install-y in arch/*/Makefile. vdso-install-y lists the files to install. For example, arch/x86/Makefile looks like this: vdso-install-$(CONFIG_X86_64) += arch/x86/entry/vdso/vdso64.so.dbg vdso-install-$(CONFIG_X86_X32_ABI) += arch/x86/entry/vdso/vdsox32.so.dbg vdso-install-$(CONFIG_X86_32) += arch/x86/entry/vdso/vdso32.so.dbg vdso-install-$(CONFIG_IA32_EMULATION) += arch/x86/entry/vdso/vdso32.so.dbg These files will be installed to $(MODLIB)/vdso/ with the .dbg suffix, if exists, stripped away. vdso-install-y can optionally take the second field after the colon separator. This is needed because some architectures install a vdso file as a different base name. The following is a snippet from arch/arm64/Makefile. vdso-install-$(CONFIG_COMPAT_VDSO) += arch/arm64/kernel/vdso32/vdso.so.dbg:vdso32.so This will rename vdso.so.dbg to vdso32.so during installation. If such architectures change their implementation so that the base names match, this workaround will go away. Signed-off-by: Masahiro Yamada Acked-by: Sven Schnelle # s390 Reviewed-by: Nicolas Schier Reviewed-by: Guo Ren Acked-by: Helge Deller # parisc Acked-by: Catalin Marinas Acked-by: Russell King (Oracle) Makefile | 9 +++++++ arch/arm/Makefile | 7 +----- arch/arm/vdso/Makefile | 25 ------------------- arch/arm64/Makefile | 9 +++---- arch/arm64/kernel/vdso/Makefile | 10 -------- arch/arm64/kernel/vdso32/Makefile | 10 -------- arch/loongarch/Makefile | 4 +-- arch/loongarch/vdso/Makefile | 10 -------- arch/parisc/Makefile | 8 ++---- arch/riscv/Makefile | 9 +++---- arch/riscv/kernel/compat_vdso/Makefile | 10 -------- arch/riscv/kernel/vdso/Makefile | 10 -------- arch/s390/Makefile | 6 ++--- arch/s390/kernel/vdso32/Makefile | 10 -------- arch/s390/kernel/vdso64/Makefile | 10 -------- arch/sparc/Makefile | 5 ++-- arch/sparc/vdso/Makefile | 27 -------------------- arch/x86/Makefile | 7 +++--- arch/x86/entry/vdso/Makefile | 27 -------------------- scripts/Makefile.vdsoinst | 45 ++++++++++++++++++++++++++++++++++ 20 files changed, 73 insertions(+), 185 deletions(-) commit 5aa9130acb98bacacc8bd9f1489a9269430d0eb8 Author: Christian Brauner Date: Wed Oct 18 12:26:20 2023 +0200 porting: update locking requirements Now that s_umount is never taken under open_mutex update the documentation to say so. Link: https://lore.kernel.org/r/20231017184823.1383356-1-hch@lst.de Signed-off-by: Christian Brauner Documentation/filesystems/porting.rst | 7 +++++++ 1 file changed, 7 insertions(+) commit 3b224e1df650df22541724c4bd5f1622b40d4ba4 Author: Christian Brauner Date: Tue Oct 17 20:48:23 2023 +0200 fs: assert that open_mutex isn't held over holder ops With recent block level changes we should never be in a situation where we hold disk->open_mutex when calling into these helpers. So assert that in the code. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20231017184823.1383356-6-hch@lst.de Reviewed-by: Ming Lei Reviewed-by: Jan Kara Reviewed-by: Jens Axboe Signed-off-by: Christian Brauner fs/super.c | 1 + 1 file changed, 1 insertion(+) commit f61033390bc34cd22ad4b4c12619a1e7a8a75600 Author: Christian Brauner Date: Tue Oct 17 20:48:22 2023 +0200 block: assert that we're not holding open_mutex over blk_report_disk_dead blk_report_disk_dead() has the following major callers: (1) del_gendisk() (2) blk_mark_disk_dead() Since del_gendisk() acquires disk->open_mutex it's clear that all callers are assumed to be called without disk->open_mutex held. In turn, blk_report_disk_dead() is called without disk->open_mutex held in del_gendisk(). All callers of blk_mark_disk_dead() call it without disk->open_mutex as well. Ensure that it is clear that blk_report_disk_dead() is called without disk->open_mutex on purpose by asserting it and a comment in the code. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20231017184823.1383356-5-hch@lst.de Reviewed-by: Ming Lei Reviewed-by: Jan Kara Reviewed-by: Jens Axboe Signed-off-by: Christian Brauner block/genhd.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 6e57236ed6e070607868da70fac3d52ae24e5417 Author: Christoph Hellwig Date: Tue Oct 17 20:48:21 2023 +0200 block: move bdev_mark_dead out of disk_check_media_change disk_check_media_change is mostly called from ->open where it makes little sense to mark the file system on the device as dead, as we are just opening it. So instead of calling bdev_mark_dead from disk_check_media_change move it into the few callers that are not in an open instance. This avoid calling into bdev_mark_dead and thus taking s_umount with open_mutex held. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20231017184823.1383356-4-hch@lst.de Reviewed-by: Ming Lei Reviewed-by: Christian Brauner Reviewed-by: Jan Kara Reviewed-by: Jens Axboe Signed-off-by: Christian Brauner block/bdev.c | 9 ++++----- block/disk-events.c | 18 +++++++----------- drivers/block/ataflop.c | 4 +++- drivers/block/floppy.c | 4 +++- 4 files changed, 17 insertions(+), 18 deletions(-) commit 51b4cb4f3e2265cf8303ffd9a4f239ee3805d3ca Author: Christian Brauner Date: Tue Oct 17 20:48:20 2023 +0200 block: WARN_ON_ONCE() when we remove active partitions The logic for disk->open_partitions is: blkdev_get_by_*() -> bdev_is_partition() -> blkdev_get_part() -> blkdev_get_whole() // bdev_whole->bd_openers++ -> if (part->bd_openers == 0) disk->open_partitions++ part->bd_openers In other words, when we first claim/open a partition we increment disk->open_partitions and only when all part->bd_openers are closed will disk->open_partitions be zero. That should mean that disk->open_partitions is always > 0 as long as there's anyone that has an open partition. So the check for disk->open_partitions should mean that we can never remove an active partition that has a holder and holder ops set. Assert that in the code. The main disk isn't removed so that check doesn't work for disk->part0 which is what we want. After all we only care about partition not about the main disk. Link: https://lore.kernel.org/r/20231017184823.1383356-3-hch@lst.de Reviewed-by: Ming Lei Reviewed-by: Jan Kara Reviewed-by: Jens Axboe Signed-off-by: Christian Brauner block/partitions/core.c | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-) commit c30b9787a48118d2ed0283b6c8f2abee873a1d19 Author: Christian Brauner Date: Tue Oct 17 20:48:19 2023 +0200 block: simplify bdev_del_partition() BLKPG_DEL_PARTITION refuses to delete partitions that still have openers, i.e., that has an elevated @bdev->bd_openers count. If a device is claimed by setting @bdev->bd_holder and @bdev->bd_holder_ops @bdev->bd_openers and @bdev->bd_holders are incremented. @bdev->bd_openers is effectively guaranteed to be >= @bdev->bd_holders. So as long as @bdev->bd_openers isn't zero we know that this partition is still in active use and that there might still be @bdev->bd_holder and @bdev->bd_holder_ops set. The only current example is @fs_holder_ops for filesystems. But that means bdev_mark_dead() which calls into bdev->bd_holder_ops->mark_dead::fs_bdev_mark_dead() is a nop. As long as there's an elevated @bdev->bd_openers count we can't delete the partition and if there isn't an elevated @bdev->bd_openers count then there's no @bdev->bd_holder or @bdev->bd_holder_ops. So simply open-code what we need to do. This gets rid of one more instance where we acquire s_umount under @disk->open_mutex. Link: https://lore.kernel.org/r/20231016-fototermin-umriss-59f1ea6c1fe6@brauner Reviewed-by: Christoph Hellwig Reviewed-by: Jan Kara Reviewed-by: Jens Axboe Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20231017184823.1383356-2-hch@lst.de Reviewed-by: Ming Lei Signed-off-by: Christian Brauner block/partitions/core.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) commit fd1464105cb37a3b50a72c1d2902e97a71950af8 Author: Jan Kara Date: Wed Oct 18 17:29:24 2023 +0200 fs: Avoid grabbing sb->s_umount under bdev->bd_holder_lock The implementation of bdev holder operations such as fs_bdev_mark_dead() and fs_bdev_sync() grab sb->s_umount semaphore under bdev->bd_holder_lock. This is problematic because it leads to disk->open_mutex -> sb->s_umount lock ordering which is counterintuitive (usually we grab higher level (e.g. filesystem) locks first and lower level (e.g. block layer) locks later) and indeed makes lockdep complain about possible locking cycles whenever we open a block device while holding sb->s_umount semaphore. Implement a function bdev_super_lock_shared() which safely transitions from holding bdev->bd_holder_lock to holding sb->s_umount on alive superblock without introducing the problematic lock dependency. We use this function fs_bdev_sync() and fs_bdev_mark_dead(). Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20231018152924.3858-1-jack@suse.cz Link: https://lore.kernel.org/r/20231017184823.1383356-1-hch@lst.de Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner block/bdev.c | 5 +++-- block/ioctl.c | 5 +++-- fs/super.c | 50 ++++++++++++++++++++++++++++++++------------------ 3 files changed, 38 insertions(+), 22 deletions(-) commit 6306ff39a7fcb7e9c59a00e6860b933b71a2ed3e Author: Lizhi Xu Date: Mon Oct 9 17:45:57 2023 +0800 jfs: fix log->bdev_handle null ptr deref in lbmStartIO When sbi->flag is JFS_NOINTEGRITY in lmLogOpen(), log->bdev_handle can't be inited, so it value will be NULL. Therefore, add the "log ->no_integrity=1" judgment in lbmStartIO() to avoid such problems. Reported-and-tested-by: syzbot+23bc20037854bb335d59@syzkaller.appspotmail.com Signed-off-by: Lizhi Xu Link: https://lore.kernel.org/r/20231009094557.1398920-1-lizhi.xu@windriver.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner fs/jfs/jfs_logmgr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit b3856da7906257a80a764d3dfc6b25e876a4403c Author: Jan Kara Date: Wed Oct 4 11:37:57 2023 +0200 bcache: Fixup error handling in register_cache() Coverity has noticed that the printing of error message in register_cache() uses already freed bdev_handle to get to bdev. In fact the problem has been there even before commit "bcache: Convert to bdev_open_by_path()" just a bit more subtle one - cache object itself could have been freed by the time we looked at ca->bdev and we don't hold any reference to bdev either so even that could in principle go away (due to device unplug or similar). Fix all these problems by printing the error message before closing the bdev. Fixes: dc893f51d24a ("bcache: Convert to bdev_open_by_path()") Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20231004093757.11560-1-jack@suse.cz Asked-by: Coly Li Signed-off-by: Christian Brauner drivers/md/bcache/super.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) commit e340dd63f6a11402424b3d77e51149bce8fcba7d Author: Jan Kara Date: Wed Sep 27 11:34:34 2023 +0200 xfs: Convert to bdev_open_by_path() Convert xfs to use bdev_open_by_path() and pass the handle around. CC: "Darrick J. Wong" CC: linux-xfs@vger.kernel.org Acked-by: Christoph Hellwig Reviewed-by: Dave Chinner Reviewed-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-28-jack@suse.cz Acked-by: "Darrick J. Wong" Reviewed-by: "Darrick J. Wong" Signed-off-by: Christian Brauner fs/xfs/xfs_buf.c | 22 ++++++++++------------ fs/xfs/xfs_buf.h | 3 ++- fs/xfs/xfs_super.c | 42 ++++++++++++++++++++++++------------------ 3 files changed, 36 insertions(+), 31 deletions(-) commit ba1787a5edd90731e8ccd317012deb55bcd4cb9d Author: Jan Kara Date: Wed Sep 27 11:34:33 2023 +0200 reiserfs: Convert to bdev_open_by_dev/path() Convert reiserfs to use bdev_open_by_dev/path() and pass the handle around. CC: reiserfs-devel@vger.kernel.org Acked-by: Christoph Hellwig Reviewed-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-27-jack@suse.cz Signed-off-by: Christian Brauner fs/reiserfs/journal.c | 56 ++++++++++++++++++++++---------------------------- fs/reiserfs/procfs.c | 2 +- fs/reiserfs/reiserfs.h | 11 ++++++---- 3 files changed, 33 insertions(+), 36 deletions(-) commit ebc4185497eac671e428f09bbaafb036d02323bd Author: Jan Kara Date: Wed Sep 27 11:34:32 2023 +0200 ocfs2: Convert to use bdev_open_by_dev() Convert ocfs2 heartbeat code to use bdev_open_by_dev() and pass the handle around. CC: Joseph Qi CC: ocfs2-devel@oss.oracle.com Acked-by: Christoph Hellwig Reviewed-by: Joseph Qi Reviewed-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-26-jack@suse.cz Signed-off-by: Christian Brauner fs/ocfs2/cluster/heartbeat.c | 81 ++++++++++++++++++++++++-------------------- 1 file changed, 45 insertions(+), 36 deletions(-) commit 3fe5d9fb0b31075dc85ccd2d142474c18af76f93 Author: Jan Kara Date: Wed Sep 27 11:34:31 2023 +0200 nfs/blocklayout: Convert to use bdev_open_by_dev/path() Convert block device handling to use bdev_open_by_dev/path() and pass the handle around. CC: linux-nfs@vger.kernel.org CC: Trond Myklebust CC: Anna Schumaker Acked-by: Christoph Hellwig Reviewed-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-25-jack@suse.cz Signed-off-by: Christian Brauner fs/nfs/blocklayout/blocklayout.h | 2 +- fs/nfs/blocklayout/dev.c | 76 +++++++++++++++++++--------------------- 2 files changed, 38 insertions(+), 40 deletions(-) commit 898c57f456b537e90493a9e9222226aa3ea66267 Author: Jan Kara Date: Wed Sep 27 11:34:30 2023 +0200 jfs: Convert to bdev_open_by_dev() Convert jfs to use bdev_open_by_dev() and pass the handle around. CC: Dave Kleikamp CC: jfs-discussion@lists.sourceforge.net Acked-by: Christoph Hellwig Acked-by: Dave Kleikamp Reviewed-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-24-jack@suse.cz Signed-off-by: Christian Brauner fs/jfs/jfs_logmgr.c | 29 +++++++++++++++-------------- fs/jfs/jfs_logmgr.h | 2 +- fs/jfs/jfs_mount.c | 3 ++- 3 files changed, 18 insertions(+), 16 deletions(-) commit 2b107946f80ae29032dd88482b6a3a561d1b35b0 Author: Jan Kara Date: Wed Sep 27 11:34:29 2023 +0200 f2fs: Convert to bdev_open_by_dev/path() Convert f2fs to use bdev_open_by_dev/path() and pass the handle around. CC: Jaegeuk Kim CC: Chao Yu CC: linux-f2fs-devel@lists.sourceforge.net Acked-by: Christoph Hellwig Reviewed-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-23-jack@suse.cz Signed-off-by: Christian Brauner fs/f2fs/f2fs.h | 1 + fs/f2fs/super.c | 13 +++++++------ 2 files changed, 8 insertions(+), 6 deletions(-) commit d577c8aaed2035fb7bcc970058a9d8c46c26fcaa Author: Jan Kara Date: Wed Sep 27 11:34:28 2023 +0200 ext4: Convert to bdev_open_by_dev() Convert ext4 to use bdev_open_by_dev() and pass the handle around. CC: linux-ext4@vger.kernel.org CC: Ted Tso Acked-by: Christoph Hellwig Reviewed-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-22-jack@suse.cz Signed-off-by: Christian Brauner fs/ext4/ext4.h | 2 +- fs/ext4/fsmap.c | 9 +++++---- fs/ext4/super.c | 52 +++++++++++++++++++++++++++------------------------- 3 files changed, 33 insertions(+), 30 deletions(-) commit 49845720080dff0afd5813eaebf0758b01b6312c Author: Jan Kara Date: Wed Sep 27 11:34:27 2023 +0200 erofs: Convert to use bdev_open_by_path() Convert erofs to use bdev_open_by_path() and pass the handle around. CC: Gao Xiang CC: Chao Yu CC: linux-erofs@lists.ozlabs.org Acked-by: Christoph Hellwig Acked-by: Gao Xiang Reviewed-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-21-jack@suse.cz Signed-off-by: Christian Brauner fs/erofs/data.c | 4 ++-- fs/erofs/internal.h | 2 +- fs/erofs/super.c | 20 ++++++++++---------- 3 files changed, 13 insertions(+), 13 deletions(-) commit 86ec15d00bf85801bda57b5d181a2978f828a8cf Author: Jan Kara Date: Wed Sep 27 11:34:26 2023 +0200 btrfs: Convert to bdev_open_by_path() Convert btrfs to use bdev_open_by_path() and pass the handle around. We also drop the holder from struct btrfs_device as it is now not needed anymore. CC: David Sterba CC: linux-btrfs@vger.kernel.org Acked-by: Christoph Hellwig Reviewed-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-20-jack@suse.cz Signed-off-by: Christian Brauner fs/btrfs/dev-replace.c | 14 ++++--- fs/btrfs/ioctl.c | 18 ++++----- fs/btrfs/volumes.c | 107 +++++++++++++++++++++++++------------------------ fs/btrfs/volumes.h | 6 +-- 4 files changed, 73 insertions(+), 72 deletions(-) commit f4a48bc36cdfae7c603e8e3f2a51e2a283f3f365 Author: Jan Kara Date: Wed Sep 27 11:34:25 2023 +0200 fs: Convert to bdev_open_by_dev() Convert mount code to use bdev_open_by_dev() and propagate the handle around to bdev_release(). Acked-by: Christoph Hellwig Reviewed-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-19-jack@suse.cz Signed-off-by: Christian Brauner fs/cramfs/inode.c | 2 +- fs/romfs/super.c | 2 +- fs/super.c | 15 +++++++++------ include/linux/fs.h | 1 + 4 files changed, 12 insertions(+), 8 deletions(-) commit 4c6bca43c547fe9bc1d7d1519b1d6430fee2cae2 Author: Jan Kara Date: Wed Sep 27 11:34:24 2023 +0200 mm/swap: Convert to use bdev_open_by_dev() Convert swapping code to use bdev_open_by_dev() and pass the handle around. CC: linux-mm@kvack.org CC: Andrew Morton Acked-by: Christoph Hellwig Acked-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-18-jack@suse.cz Signed-off-by: Christian Brauner include/linux/swap.h | 1 + mm/swapfile.c | 23 ++++++++++++----------- 2 files changed, 13 insertions(+), 11 deletions(-) commit 93745df18e52157778a8a74cb888ac785844a7fe Author: Jan Kara Date: Wed Sep 27 11:34:23 2023 +0200 PM: hibernate: Drop unused snapshot_test argument snapshot_test argument is now unused in swsusp_close() and load_image_and_restore(). Drop it CC: linux-pm@vger.kernel.org Acked-by: Christoph Hellwig Acked-by: "Rafael J. Wysocki" Acked-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-17-jack@suse.cz Signed-off-by: Christian Brauner kernel/power/hibernate.c | 14 +++++++------- kernel/power/power.h | 2 +- kernel/power/swap.c | 6 +++--- 3 files changed, 11 insertions(+), 11 deletions(-) commit e017d304c74079c5169265c8ee9ac8abc8079145 Author: Jan Kara Date: Wed Sep 27 11:34:22 2023 +0200 PM: hibernate: Convert to bdev_open_by_dev() Convert hibernation code to use bdev_open_by_dev(). CC: linux-pm@vger.kernel.org Acked-by: Christoph Hellwig Acked-by: "Rafael J. Wysocki" Acked-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-16-jack@suse.cz Signed-off-by: Christian Brauner kernel/power/swap.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) commit e6aafdc8a76bd70ccc9ca8724d09fefba089c3e7 Author: Jan Kara Date: Wed Sep 27 11:34:21 2023 +0200 scsi: target: Convert to bdev_open_by_path() Convert iblock and pscsi drivers to use bdev_open_by_path() and pass the handle around. CC: target-devel@vger.kernel.org CC: linux-scsi@vger.kernel.org Acked-by: Christoph Hellwig Acked-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-15-jack@suse.cz Reviewed-by: "Martin K. Petersen" Signed-off-by: Christian Brauner drivers/target/target_core_iblock.c | 19 +++++++++++-------- drivers/target/target_core_iblock.h | 1 + drivers/target/target_core_pscsi.c | 26 +++++++++++++------------- drivers/target/target_core_pscsi.h | 2 +- 4 files changed, 26 insertions(+), 22 deletions(-) commit a8ab90ff47bf2a2c9b1353592e14e46f87551b82 Author: Jan Kara Date: Wed Sep 27 11:34:20 2023 +0200 s390/dasd: Convert to bdev_open_by_path() Convert dasd to use bdev_open_by_path() and pass the handle around. CC: linux-s390@vger.kernel.org CC: Christian Borntraeger CC: Sven Schnelle Acked-by: Christoph Hellwig Acked-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-14-jack@suse.cz Signed-off-by: Christian Brauner drivers/s390/block/dasd.c | 12 ++++++----- drivers/s390/block/dasd_genhd.c | 45 ++++++++++++++++++++--------------------- drivers/s390/block/dasd_int.h | 2 +- drivers/s390/block/dasd_ioctl.c | 2 +- 4 files changed, 31 insertions(+), 30 deletions(-) commit 2a4936e933e369387294a9073a0e9f630fc7f350 Author: Jan Kara Date: Wed Sep 27 11:34:19 2023 +0200 nvmet: Convert to bdev_open_by_path() Convert nvmet to use bdev_open_by_path() and pass the handle around. CC: linux-nvme@lists.infradead.org Acked-by: Christoph Hellwig Acked-by: Christian Brauner Reviewed-by: Chaitanya Kulkarni Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-13-jack@suse.cz Signed-off-by: Christian Brauner drivers/nvme/target/io-cmd-bdev.c | 20 +++++++++++--------- drivers/nvme/target/nvmet.h | 1 + 2 files changed, 12 insertions(+), 9 deletions(-) commit 3817d4b11212ca9d49d6e7141d41524aa48791c5 Author: Jan Kara Date: Wed Sep 27 11:34:18 2023 +0200 mtd: block2mtd: Convert to bdev_open_by_dev/path() Convert block2mtd to use bdev_open_by_dev() and bdev_open_by_path() and pass the handle around. CC: Joern Engel CC: linux-mtd@lists.infradead.org Acked-by: Christoph Hellwig Acked-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-12-jack@suse.cz Signed-off-by: Christian Brauner drivers/mtd/devices/block2mtd.c | 51 +++++++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 22 deletions(-) commit 9f0f5a30d34cb92257e94a042b8e86d9a680e416 Author: Jan Kara Date: Wed Sep 27 11:34:17 2023 +0200 md: Convert to bdev_open_by_dev() Convert md to use bdev_open_by_dev() and pass the handle around. We also don't need the 'Holder' flag anymore so remove it. CC: linux-raid@vger.kernel.org CC: Song Liu Acked-by: Song Liu Acked-by: Christoph Hellwig Acked-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-11-jack@suse.cz Signed-off-by: Christian Brauner drivers/md/md.c | 23 ++++++++--------------- drivers/md/md.h | 4 +--- 2 files changed, 9 insertions(+), 18 deletions(-) commit c2fce61fb22e3235d29512558c4e93e184e2f68b Author: Jan Kara Date: Wed Sep 27 11:34:16 2023 +0200 dm: Convert to bdev_open_by_dev() Convert device mapper to use bdev_open_by_dev() and pass the handle around. CC: Alasdair Kergon CC: Mike Snitzer CC: dm-devel@redhat.com Acked-by: Christoph Hellwig Acked-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-10-jack@suse.cz Signed-off-by: Christian Brauner drivers/md/dm.c | 20 +++++++++++--------- include/linux/device-mapper.h | 1 + 2 files changed, 12 insertions(+), 9 deletions(-) commit 631b001fd6bccb2438a6252dbb62d09cbba3350b Author: Jan Kara Date: Wed Sep 27 11:34:15 2023 +0200 bcache: Convert to bdev_open_by_path() Convert bcache to use bdev_open_by_path() and pass the handle around. CC: linux-bcache@vger.kernel.org CC: Coly Li CC: Kent Overstreet Acked-by: Christoph Hellwig Acked-by: Christian Brauner Acked-by: Coly Li Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-9-jack@suse.cz Signed-off-by: Christian Brauner drivers/md/bcache/bcache.h | 2 ++ drivers/md/bcache/super.c | 78 ++++++++++++++++++++++++---------------------- 2 files changed, 43 insertions(+), 37 deletions(-) commit eed993a0910338fa751191264d5caa2c386c3f8f Author: Jan Kara Date: Wed Sep 27 11:34:14 2023 +0200 zram: Convert to use bdev_open_by_dev() Convert zram to use bdev_open_by_dev() and pass the handle around. CC: Minchan Kim CC: Sergey Senozhatsky Acked-by: Christoph Hellwig Acked-by: Christian Brauner Reviewed-by: Sergey Senozhatsky Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-8-jack@suse.cz Signed-off-by: Christian Brauner drivers/block/zram/zram_drv.c | 31 ++++++++++++++----------------- drivers/block/zram/zram_drv.h | 2 +- 2 files changed, 15 insertions(+), 18 deletions(-) commit 436d3705bfee5dc748cdf4ffdb40ac17183307c2 Author: Jan Kara Date: Wed Sep 27 11:34:13 2023 +0200 xen/blkback: Convert to bdev_open_by_dev() Convert xen/blkback to use bdev_open_by_dev() and pass the handle around. CC: xen-devel@lists.xenproject.org Acked-by: Christoph Hellwig Acked-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-7-jack@suse.cz Signed-off-by: Christian Brauner drivers/block/xen-blkback/blkback.c | 4 ++-- drivers/block/xen-blkback/common.h | 4 ++-- drivers/block/xen-blkback/xenbus.c | 40 +++++++++++++++++++------------------ 3 files changed, 25 insertions(+), 23 deletions(-) commit c2114f11a30ede1d1dbab09dab6e6f4024bb2fbb Author: Jan Kara Date: Wed Sep 27 11:34:12 2023 +0200 rnbd-srv: Convert to use bdev_open_by_path() Convert rnbd-srv to use bdev_open_by_path() and pass the handle around. CC: Jack Wang CC: "Md. Haris Iqbal" Acked-by: "Md. Haris Iqbal" Acked-by: Christoph Hellwig Acked-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-6-jack@suse.cz Signed-off-by: Christian Brauner drivers/block/rnbd/rnbd-srv.c | 27 ++++++++++++++------------- drivers/block/rnbd/rnbd-srv.h | 2 +- 2 files changed, 15 insertions(+), 14 deletions(-) commit 7ac86df899f0025cfd554c057efb30e5a4ef95b0 Author: Jan Kara Date: Wed Sep 27 11:34:11 2023 +0200 pktcdvd: Convert to bdev_open_by_dev() Convert pktcdvd to use bdev_open_by_dev(). Acked-by: Christoph Hellwig Acked-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-5-jack@suse.cz Signed-off-by: Christian Brauner drivers/block/pktcdvd.c | 76 ++++++++++++++++++++++++++----------------------- include/linux/pktcdvd.h | 4 ++- 2 files changed, 44 insertions(+), 36 deletions(-) commit 75e27d373425c349954c3770bee659a1bbdb3cc0 Author: Jan Kara Date: Wed Sep 27 11:34:10 2023 +0200 drdb: Convert to use bdev_open_by_path() Convert drdb to use bdev_open_by_path(). CC: drbd-dev@lists.linbit.com Acked-by: Christoph Hellwig Acked-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-4-jack@suse.cz Signed-off-by: Christian Brauner drivers/block/drbd/drbd_int.h | 2 ++ drivers/block/drbd/drbd_nl.c | 65 +++++++++++++++++++++---------------------- 2 files changed, 34 insertions(+), 33 deletions(-) commit acb083b55597872dcaebe9e0352da7fdf1684def Author: Jan Kara Date: Wed Sep 27 11:34:09 2023 +0200 block: Use bdev_open_by_dev() in disk_scan_partitions() and blkdev_bszset() Convert disk_scan_partitions() and blkdev_bszset() to use bdev_open_by_dev(). Acked-by: Christoph Hellwig Reviewed-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-3-jack@suse.cz Signed-off-by: Christian Brauner block/genhd.c | 12 ++++++------ block/ioctl.c | 6 ++++-- 2 files changed, 10 insertions(+), 8 deletions(-) commit 841dd789b8625eb9288aaa2be9f10872e6622033 Author: Jan Kara Date: Wed Sep 27 11:34:08 2023 +0200 block: Use bdev_open_by_dev() in blkdev_open() Convert blkdev_open() to use bdev_open_by_dev(). To be able to propagate handle from blkdev_open() to blkdev_release() we need to stop using existence of file->private_data to determine exclusive block device opens. Use bdev_handle->mode for this purpose since file->f_flags isn't usable for this (O_EXCL is cleared from the flags during open). Acked-by: Christoph Hellwig Reviewed-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-2-jack@suse.cz Signed-off-by: Christian Brauner block/bdev.c | 3 +++ block/fops.c | 44 ++++++++++++++++++++++++++++---------------- include/linux/blkdev.h | 1 + 3 files changed, 32 insertions(+), 16 deletions(-) commit e719b4d156749f02eafed31a3c515f2aa9dcc72a Author: Jan Kara Date: Wed Sep 27 11:34:07 2023 +0200 block: Provide bdev_open_* functions Create struct bdev_handle that contains all parameters that need to be passed to blkdev_put() and provide bdev_open_* functions that return this structure instead of plain bdev pointer. This will eventually allow us to pass one more argument to blkdev_put() (renamed to bdev_release()) without too much hassle. Acked-by: Christoph Hellwig Reviewed-by: Christian Brauner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230927093442.25915-1-jack@suse.cz Signed-off-by: Christian Brauner block/bdev.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ include/linux/blkdev.h | 10 ++++++++++ 2 files changed, 58 insertions(+) commit 55c900477f5b3897d9038446f72a281cae0efd86 Author: Jakub Kicinski Date: Fri Oct 27 14:13:11 2023 -0700 net: fill in MODULE_DESCRIPTION()s under drivers/net/ W=1 builds now warn if module is built without a MODULE_DESCRIPTION(). Acked-by: Willem de Bruijn Acked-by: Jamal Hadi Salim Acked-by: Arnd Bergmann Acked-by: Jason Wang Acked-by: Taehee Yoo Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller drivers/net/amt.c | 1 + drivers/net/dummy.c | 1 + drivers/net/eql.c | 1 + drivers/net/ifb.c | 1 + drivers/net/macvtap.c | 1 + drivers/net/sungem_phy.c | 1 + drivers/net/tap.c | 1 + 7 files changed, 7 insertions(+) commit ce1afe280419911b29bc7228f28d4ae85d7e7a2b Author: Jakub Kicinski Date: Fri Oct 27 14:13:10 2023 -0700 net: fill in MODULE_DESCRIPTION()s under net/802* W=1 builds now warn if module is built without a MODULE_DESCRIPTION(). Reviewed-by: Greg Kroah-Hartman Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller net/802/fddi.c | 1 + net/802/garp.c | 1 + net/802/mrp.c | 1 + net/802/p8022.c | 1 + net/802/psnap.c | 1 + net/802/stp.c | 1 + net/8021q/vlan.c | 1 + 7 files changed, 7 insertions(+) commit beb5eed32a73e13f29c4b640a53d004f3faf019e Author: Jakub Kicinski Date: Fri Oct 27 14:13:09 2023 -0700 net: fill in MODULE_DESCRIPTION()s under net/core W=1 builds now warn if module is built without a MODULE_DESCRIPTION(). Reviewed-by: Oleksij Rempel Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller net/core/dev_addr_lists_test.c | 1 + net/core/selftests.c | 1 + 2 files changed, 2 insertions(+) commit 1fff1f799038a99cd1f2ae3999661ad9d506bb8c Author: Jakub Kicinski Date: Fri Oct 27 14:13:08 2023 -0700 net: fill in MODULE_DESCRIPTION()s in kuba@'s modules W=1 builds now warn if module is built without a MODULE_DESCRIPTION(). Fill it in for the modules I maintain. Acked-by: Kalle Valo Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller drivers/net/netdevsim/netdev.c | 1 + drivers/net/wireless/mediatek/mt7601u/usb.c | 1 + 2 files changed, 2 insertions(+) commit c70793fb7632a153862ee9060e6d48131469a29c Author: Shuzhen Wang Date: Fri Oct 27 11:34:40 2023 -0700 usb: gadget: uvc: Add missing initialization of ssp config descriptor In case the uvc gadget is super speed plus, the corresponding config descriptor wasn't initialized. As a result, the host will not recognize the devices when using super speed plus connection. This patch initializes them to super speed descriptors. Reviewed-by: Laurent Pinchart Signed-off-by: Shuzhen Wang Link: https://lore.kernel.org/r/20231027183440.1994315-1-shuzhenwang@google.com Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/function/f_uvc.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit 0e3139e6543b241b3e65956a55c712333bef48ac Author: LihaSika Date: Fri Oct 27 20:28:04 2023 +0300 usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility Change lower bcdDevice value for "Super Top USB 2.0 SATA BRIDGE" to match 1.50. I have such an older device with bcdDevice=1.50 and it will not work otherwise. Cc: stable@vger.kernel.org Signed-off-by: Liha Sikanen Link: https://lore.kernel.org/r/ccf7d12a-8362-4916-b3e0-f4150f54affd@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/usb/storage/unusual_cypress.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c43c64f8a1c68da370bf8d458ba52e24183a5264 Author: Ian Rogers Date: Wed Oct 25 17:31:49 2023 -0700 perf vendor events intel: Update tsx_cycles_per_elision metrics Update tsx_cycles_per_elision as per: https://github.com/intel/perfmon/pull/116 Prefer the el-start event rather than cycles-t for detecting whether the metric will work as HLE may be disabled. Remove the metric from sapphirerapids that has no el-start event. Signed-off-by: Ian Rogers Reviewed-by: Kan Liang Cc: Alexandre Torgue Cc: Maxime Coquelin Cc: Edward Baker Cc: Zhengjun Xing Link: https://lore.kernel.org/r/20231026003149.3287633-9-irogers@google.com Signed-off-by: Namhyung Kim tools/perf/pmu-events/arch/x86/cascadelakex/clx-metrics.json | 2 +- tools/perf/pmu-events/arch/x86/icelake/icl-metrics.json | 2 +- tools/perf/pmu-events/arch/x86/icelakex/icx-metrics.json | 2 +- tools/perf/pmu-events/arch/x86/rocketlake/rkl-metrics.json | 2 +- tools/perf/pmu-events/arch/x86/sapphirerapids/spr-metrics.json | 7 ------- tools/perf/pmu-events/arch/x86/skylake/skl-metrics.json | 2 +- tools/perf/pmu-events/arch/x86/skylakex/skx-metrics.json | 2 +- tools/perf/pmu-events/arch/x86/tigerlake/tgl-metrics.json | 2 +- 8 files changed, 7 insertions(+), 14 deletions(-) commit c44c31185923637e672c10e60142e1e1106d1600 Author: Ian Rogers Date: Wed Oct 25 17:31:48 2023 -0700 perf vendor events intel: Update bonnell version number to v5 Spelling fixes were already incorporated in the Linux perf tree, update the version number to reflect this. Signed-off-by: Ian Rogers Reviewed-by: Kan Liang Cc: Alexandre Torgue Cc: Maxime Coquelin Cc: Edward Baker Cc: Zhengjun Xing Link: https://lore.kernel.org/r/20231026003149.3287633-8-irogers@google.com Signed-off-by: Namhyung Kim tools/perf/pmu-events/arch/x86/mapfile.csv | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b6292081615bda443842d34108adcdfe20822695 Author: Ian Rogers Date: Wed Oct 25 17:31:47 2023 -0700 perf vendor events intel: Update westmereex events to v4 Update westmereex events from v3 to v4 fixing a spelling issue. Signed-off-by: Ian Rogers Reviewed-by: Kan Liang Cc: Alexandre Torgue Cc: Maxime Coquelin Cc: Edward Baker Cc: Zhengjun Xing Link: https://lore.kernel.org/r/20231026003149.3287633-7-irogers@google.com Signed-off-by: Namhyung Kim tools/perf/pmu-events/arch/x86/mapfile.csv | 2 +- tools/perf/pmu-events/arch/x86/westmereex/pipeline.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 247730767c63b06a07272e8a3f06796f2df32d9c Author: Ian Rogers Date: Wed Oct 25 17:31:46 2023 -0700 perf vendor events intel: Update meteorlake events to v1.06 Update meteorlake from v1.04 to v1.06 adding the changes from: https://github.com/intel/perfmon/commit/bc84df043091ec7c98c0629f3d074d9d7a108194 https://github.com/intel/perfmon/commit/405d3ee987d756b5b5d9a64d8a8fa77559822ecf Signed-off-by: Ian Rogers Reviewed-by: Kan Liang Cc: Alexandre Torgue Cc: Maxime Coquelin Cc: Edward Baker Cc: Zhengjun Xing Link: https://lore.kernel.org/r/20231026003149.3287633-6-irogers@google.com Signed-off-by: Namhyung Kim tools/perf/pmu-events/arch/x86/mapfile.csv | 2 +- .../perf/pmu-events/arch/x86/meteorlake/cache.json | 30 ++++++++++ .../pmu-events/arch/x86/meteorlake/frontend.json | 29 +++++++-- .../pmu-events/arch/x86/meteorlake/memory.json | 37 ++++++++++++ .../perf/pmu-events/arch/x86/meteorlake/other.json | 40 +++++++++++++ .../pmu-events/arch/x86/meteorlake/pipeline.json | 68 +++++++++++++++++++++- .../arch/x86/meteorlake/uncore-other.json | 9 +++ 7 files changed, 209 insertions(+), 6 deletions(-) commit f9418b524d14f20c57444f5609f5603b45fffa09 Author: Ian Rogers Date: Wed Oct 25 17:31:45 2023 -0700 perf vendor events intel: Update knightslanding events to v16 Update knightslanding from v10 to v16 adding the changes from: https://github.com/intel/perfmon/commit/6c1f169f6ed63ee1fd75ebb303d0fd06d71196f5 https://github.com/intel/perfmon/commit/b22ca587ec8b5ac20471ea2f14924f63e63afe9d https://github.com/intel/perfmon/commit/e685286f083ee81cb7dafd0cd8546c79ee433187 Signed-off-by: Ian Rogers Reviewed-by: Kan Liang Cc: Alexandre Torgue Cc: Maxime Coquelin Cc: Edward Baker Cc: Zhengjun Xing Link: https://lore.kernel.org/r/20231026003149.3287633-5-irogers@google.com Signed-off-by: Namhyung Kim .../pmu-events/arch/x86/knightslanding/cache.json | 39 +++++++++------ .../arch/x86/knightslanding/floating-point.json | 8 ++-- .../arch/x86/knightslanding/pipeline.json | 55 +++++++++++++--------- .../arch/x86/knightslanding/uncore-cache.json | 26 +++++----- .../arch/x86/knightslanding/virtual-memory.json | 2 +- tools/perf/pmu-events/arch/x86/mapfile.csv | 2 +- 6 files changed, 75 insertions(+), 57 deletions(-) commit 20e6a51f61bc061f8944b62288057098117b5dfb Author: Ian Rogers Date: Wed Oct 25 17:31:44 2023 -0700 perf vendor events intel: Add typo fix for ivybridge FP Add a missed space. Signed-off-by: Ian Rogers Reviewed-by: Kan Liang Cc: Alexandre Torgue Cc: Maxime Coquelin Cc: Edward Baker Cc: Zhengjun Xing Link: https://lore.kernel.org/r/20231026003149.3287633-4-irogers@google.com Signed-off-by: Namhyung Kim tools/perf/pmu-events/arch/x86/ivybridge/floating-point.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 99a8a4c990f5a16c9971f10bc44e4894e0045d2a Author: Ian Rogers Date: Wed Oct 25 17:31:43 2023 -0700 perf vendor events intel: Update a spelling in haswell/haswellx The spelling of "in-flight" was switched to "inflight". Signed-off-by: Ian Rogers Reviewed-by: Kan Liang Cc: Alexandre Torgue Cc: Maxime Coquelin Cc: Edward Baker Cc: Zhengjun Xing Link: https://lore.kernel.org/r/20231026003149.3287633-3-irogers@google.com Signed-off-by: Namhyung Kim tools/perf/pmu-events/arch/x86/haswell/memory.json | 2 +- tools/perf/pmu-events/arch/x86/haswellx/memory.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 8a94d3bfaf45e7995ef12be1a51ec47684c7cb64 Author: Ian Rogers Date: Wed Oct 25 17:31:42 2023 -0700 perf vendor events intel: Update emeraldrapids to v1.01 Update emeraldrapids to v1.01 from v1.00 adding the changes from: https://github.com/intel/perfmon/commit/3993b600e032a9fd443ffd828aab73de7cb167e5 Signed-off-by: Ian Rogers Reviewed-by: Kan Liang Cc: Alexandre Torgue Cc: Maxime Coquelin Cc: Edward Baker Cc: Zhengjun Xing Link: https://lore.kernel.org/r/20231026003149.3287633-2-irogers@google.com Signed-off-by: Namhyung Kim .../arch/x86/emeraldrapids/uncore-cache.json | 36 ++++++++++++++++++++++ tools/perf/pmu-events/arch/x86/mapfile.csv | 2 +- 2 files changed, 37 insertions(+), 1 deletion(-) commit a28a0f6773747a8759140578f1ce23d81c6ee0d9 Author: Ian Rogers Date: Wed Oct 25 17:31:41 2023 -0700 perf vendor events intel: Update alderlake/alderlake events to v1.23 Update alderlake and alderlaken events from v1.21 to v1.23 adding the changes from: https://github.com/intel/perfmon/commit/8df4db9433a2aab59dbbac1a70281032d1af7734 https://github.com/intel/perfmon/commit/846bd247c6e04acc572ca56c992e9e65852bbe63 The tsx_cycles_per_elision metric is updated from PR: https://github.com/intel/perfmon/pull/116 Signed-off-by: Ian Rogers Reviewed-by: Kan Liang Cc: Alexandre Torgue Cc: Maxime Coquelin Cc: Edward Baker Cc: Zhengjun Xing Link: https://lore.kernel.org/r/20231026003149.3287633-1-irogers@google.com Signed-off-by: Namhyung Kim .../pmu-events/arch/x86/alderlake/adl-metrics.json | 2 +- .../pmu-events/arch/x86/alderlake/frontend.json | 42 ++++++++++++-- .../perf/pmu-events/arch/x86/alderlake/memory.json | 4 +- .../pmu-events/arch/x86/alderlake/pipeline.json | 20 ++++++- .../arch/x86/alderlake/uncore-interconnect.json | 2 + .../pmu-events/arch/x86/alderlaken/memory.json | 4 +- .../pmu-events/arch/x86/alderlaken/pipeline.json | 16 ++++++ .../arch/x86/alderlaken/uncore-interconnect.json | 66 ++++++++++++++++++++++ tools/perf/pmu-events/arch/x86/mapfile.csv | 4 +- 9 files changed, 146 insertions(+), 14 deletions(-) commit a103f46633fdcddc2aaca506420f177e8803a2bd Author: Dave Jiang Date: Thu Oct 12 11:53:54 2023 -0700 acpi: Move common tables helper functions to common lib Some of the routines in ACPI driver/acpi/tables.c can be shared with parsing CDAT. CDAT is a device-provided data structure that is formatted similar to a platform provided ACPI table. CDAT is used by CXL and can exist on platforms that do not use ACPI. Split out the common routine from ACPI to accommodate platforms that do not support ACPI and move that to /lib. The common routines can be built outside of ACPI if FIRMWARE_TABLES is selected. Link: https://lore.kernel.org/linux-cxl/CAJZ5v0jipbtTNnsA0-o5ozOk8ZgWnOg34m34a9pPenTyRLj=6A@mail.gmail.com/ Suggested-by: "Rafael J. Wysocki" Reviewed-by: Hanjun Guo Reviewed-by: Jonathan Cameron Signed-off-by: Dave Jiang Acked-by: "Rafael J. Wysocki" Link: https://lore.kernel.org/r/169713683430.2205276.17899451119920103445.stgit@djiang5-mobl3 Signed-off-by: Dan Williams MAINTAINERS | 2 + drivers/acpi/Kconfig | 1 + drivers/acpi/tables.c | 173 ------------------------------------------- include/linux/acpi.h | 42 +++-------- include/linux/fw_table.h | 43 +++++++++++ lib/Kconfig | 3 + lib/Makefile | 2 + lib/fw_table.c | 189 +++++++++++++++++++++++++++++++++++++++++++++++ 8 files changed, 251 insertions(+), 204 deletions(-) commit 8358e8f1596b0b23d3bbc4cf5df5e5e55afc0122 Author: Dave Jiang Date: Thu Oct 12 11:53:48 2023 -0700 cxl: Add support for reading CXL switch CDAT table Add read_cdat_data() call in cxl_switch_port_probe() to allow reading of CDAT data for CXL switches. read_cdat_data() needs to be adjusted for the retrieving of the PCIe device depending on if the passed in port is endpoint or switch. Reviewed-by: Davidlohr Bueso Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/169713682855.2205276.6418370379144967443.stgit@djiang5-mobl3 Signed-off-by: Dan Williams drivers/cxl/core/pci.c | 22 +++++++++++++++++----- drivers/cxl/port.c | 3 +++ 2 files changed, 20 insertions(+), 5 deletions(-) commit 670e4e88f3b1a88a5a089be329b95c51592973ee Author: Dave Jiang Date: Thu Oct 12 11:53:42 2023 -0700 cxl: Add checksum verification to CDAT from CXL A CDAT table is available from a CXL device. The table is read by the driver and cached in software. With the CXL subsystem needing to parse the CDAT table, the checksum should be verified. Add checksum verification after the CDAT table is read from device. Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Reviewed-by: Davidlohr Bueso Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/169713682277.2205276.2687265961314933628.stgit@djiang5-mobl3 Signed-off-by: Dan Williams drivers/cxl/core/pci.c | 30 +++++++++++++++++++++++------- 1 file changed, 23 insertions(+), 7 deletions(-) commit 529c0a44045e59c3c067f1f2c5887759644c50ae Author: Dave Jiang Date: Thu Oct 12 11:53:37 2023 -0700 cxl: Export QTG ids from CFMWS to sysfs as qos_class attribute Export the QoS Throttling Group ID from the CXL Fixed Memory Window Structure (CFMWS) under the root decoder sysfs attributes as qos_class. CXL rev3.0 9.17.1.3 CXL Fixed Memory Window Structure (CFMWS) cxl cli will use this id to match with the _DSM retrieved id for a hot-plugged CXL memory device DPA memory range to make sure that the DPA range is under the right CFMWS window. Reviewed-by: Davidlohr Bueso Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/169713681699.2205276.14475306324720093079.stgit@djiang5-mobl3 Signed-off-by: Dan Williams Documentation/ABI/testing/sysfs-bus-cxl | 15 +++++++++++++++ drivers/cxl/acpi.c | 3 +++ drivers/cxl/core/port.c | 11 +++++++++++ drivers/cxl/cxl.h | 3 +++ 4 files changed, 32 insertions(+) commit 05e37b2138a6deb1f23daf1282dc86b29968a1ab Author: Dave Jiang Date: Mon Oct 16 10:57:54 2023 -0700 cxl: Add decoders_committed sysfs attribute to cxl_port This attribute allows cxl-cli to determine whether there are decoders committed to a memdev. This is only a snapshot of the state, and doesn't offer any protection or serialization against a concurrent disable-region operation. Reviewed-by: Jim Harris Suggested-by: Dan Williams Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/169747907439.272156.10261062080830155662.stgit@djiang5-mobl3 Signed-off-by: Dan Williams Documentation/ABI/testing/sysfs-bus-cxl | 15 +++++++++++++++ drivers/cxl/core/port.c | 25 +++++++++++++++++++++++++ 2 files changed, 40 insertions(+) commit 458ba8189cb4380aa6a6cc4d52ab067f80a64829 Author: Dave Jiang Date: Mon Oct 16 10:57:48 2023 -0700 cxl: Add cxl_decoders_committed() helper Add a helper to retrieve the number of decoders committed for the port. Replace all the open coding of the calculation with the helper. Link: https://lore.kernel.org/linux-cxl/651c98472dfed_ae7e729495@dwillia2-xfh.jf.intel.com.notmuch/ Suggested-by: Dan Williams Signed-off-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Jim Harris Reviewed-by: Alison Schofield Link: https://lore.kernel.org/r/169747906849.272156.1729290904857372335.stgit@djiang5-mobl3 Signed-off-by: Dan Williams drivers/cxl/core/hdm.c | 7 ++++--- drivers/cxl/core/mbox.c | 2 +- drivers/cxl/core/memdev.c | 4 ++-- drivers/cxl/core/port.c | 7 +++++++ drivers/cxl/cxl.h | 1 + 5 files changed, 15 insertions(+), 6 deletions(-) commit e8db0701605bccbeb8d7907ecd2e50f346a725bd Author: Robert Richter Date: Wed Oct 18 19:17:13 2023 +0200 cxl/core/regs: Rework cxl_map_pmu_regs() to use map->dev for devm struct cxl_register_map carries a @dev parameter for devm operations. Simplify the function interface to use that instead of a separate @dev argument. Signed-off-by: Terry Bowman Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20231018171713.1883517-21-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/core/regs.c | 5 ++--- drivers/cxl/cxl.h | 3 +-- drivers/cxl/pci.c | 2 +- 3 files changed, 4 insertions(+), 6 deletions(-) commit d3970f006f084e5aab5091a865203899259e4d70 Author: Robert Richter Date: Wed Oct 18 19:17:12 2023 +0200 cxl/core/regs: Rename phys_addr in cxl_map_component_regs() Trivial change that renames variable phys_addr in cxl_map_component_regs() to shorten its length to keep the 80 char size limit for the line and also for consistency between the different paths. Signed-off-by: Terry Bowman Signed-off-by: Robert Richter Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20231018171713.1883517-20-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/core/regs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit b7e9392d5d46a67fb5b66dbb2c257dd0d48eec70 Author: Robert Richter Date: Wed Oct 18 19:17:11 2023 +0200 PCI/AER: Unmask RCEC internal errors to enable RCH downstream port error handling AER corrected and uncorrectable internal errors (CIE/UIE) are masked in their corresponding mask registers per default once in power-up state. [1][2] Enable internal errors for RCECs to receive CXL downstream port errors of Restricted CXL Hosts (RCHs). [1] CXL 3.0 Spec, 12.2.1.1 - RCH Downstream Port Detected Errors [2] PCIe Base Spec r6.0, 7.8.4.3 Uncorrectable Error Mask Register, 7.8.4.6 Correctable Error Mask Register Co-developed-by: Terry Bowman Signed-off-by: Terry Bowman Signed-off-by: Robert Richter Acked-by: Bjorn Helgaas Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20231018171713.1883517-19-rrichter@amd.com Signed-off-by: Dan Williams drivers/pci/pcie/aer.c | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) commit 0a867568bb0d203ca3d28634a611a1367d7c892d Author: Robert Richter Date: Wed Oct 18 19:17:10 2023 +0200 PCI/AER: Forward RCH downstream port-detected errors to the CXL.mem dev handler In Restricted CXL Device (RCD) mode a CXL device is exposed as an RCiEP, but CXL downstream and upstream ports are not enumerated and not visible in the PCIe hierarchy. [1] Protocol and link errors from these non-enumerated ports are signaled as internal AER errors, either Uncorrectable Internal Error (UIE) or Corrected Internal Errors (CIE) via an RCEC. Restricted CXL host (RCH) downstream port-detected errors have the Requester ID of the RCEC set in the RCEC's AER Error Source ID register. A CXL handler must then inspect the error status in various CXL registers residing in the dport's component register space (CXL RAS capability) or the dport's RCRB (PCIe AER extended capability). [2] Errors showing up in the RCEC's error handler must be handled and connected to the CXL subsystem. Implement this by forwarding the error to all CXL devices below the RCEC. Since the entire CXL device is controlled only using PCIe Configuration Space of device 0, function 0, only pass it there [3]. The error handling is limited to currently supported devices with the Memory Device class code set (CXL Type 3 Device, PCI_CLASS_MEMORY_CXL, 502h), handle downstream port errors in the device's cxl_pci driver. Support for other CXL Device Types (e.g. a CXL.cache Device) can be added later. To handle downstream port errors in addition to errors directed to the CXL endpoint device, a handler must also inspect the CXL RAS and PCIe AER capabilities of the CXL downstream port the device is connected to. Since CXL downstream port errors are signaled using internal errors, the handler requires those errors to be unmasked. This is subject of a follow-on patch. The reason for choosing this implementation is that the AER service driver claims the RCEC device, but does not allow it to register a custom specific handler to support CXL. Connecting the RCEC hard-wired with a CXL handler does not work, as the CXL subsystem might not be present all the time. The alternative to add an implementation to the portdrv to allow the registration of a custom RCEC error handler isn't worth doing it as CXL would be its only user. Instead, just check for an CXL RCEC and pass it down to the connected CXL device's error handler. With this approach the code can entirely be implemented in the PCIe AER driver and is independent of the CXL subsystem. The CXL driver only provides the handler. [1] CXL 3.0 spec: 9.11.8 CXL Devices Attached to an RCH [2] CXL 3.0 spec, 12.2.1.1 RCH Downstream Port-detected Errors [3] CXL 3.0 spec, 8.1.3 PCIe DVSEC for CXL Devices Co-developed-by: Terry Bowman Signed-off-by: Terry Bowman Signed-off-by: Robert Richter Cc: Oliver O'Halloran Cc: Bjorn Helgaas Cc: linuxppc-dev@lists.ozlabs.org Cc: linux-pci@vger.kernel.org Acked-by: Bjorn Helgaas Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20231018171713.1883517-18-rrichter@amd.com Signed-off-by: Dan Williams drivers/pci/pcie/Kconfig | 9 +++++ drivers/pci/pcie/aer.c | 93 ++++++++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 100 insertions(+), 2 deletions(-) commit d1a9def33d7043df7445114cb89c0aa65818ae91 Author: Terry Bowman Date: Wed Oct 18 19:17:09 2023 +0200 cxl/pci: Disable root port interrupts in RCH mode The RCH root port contains root command AER registers that should not be enabled.[1] Disable these to prevent root port interrupts. [1] CXL 3.0 - 12.2.1.1 RCH Downstream Port-detected Errors Signed-off-by: Terry Bowman Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20231018171713.1883517-17-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/core/pci.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) commit 6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab Author: Terry Bowman Date: Wed Oct 18 19:17:08 2023 +0200 cxl/pci: Add RCH downstream port error logging RCH downstream port error logging is missing in the current CXL driver. The missing AER and RAS error logging is needed for communicating driver error details to userspace. Update the driver to include PCIe AER and CXL RAS error logging. Add RCH downstream port error handling into the existing RCiEP handler. The downstream port error handler is added to the RCiEP error handler because the downstream port is implemented in a RCRB, is not PCI enumerable, and as a result is not directly accessible to the PCI AER root port driver. The AER root port driver calls the RCiEP handler for handling RCD errors and RCH downstream port protocol errors. Update existing RCiEP correctable and uncorrectable handlers to also call the RCH handler. The RCH handler will read the RCH AER registers, check for error severity, and if an error exists will log using an existing kernel AER trace routine. The RCH handler will also log downstream port RAS errors if they exist. Co-developed-by: Robert Richter Signed-off-by: Terry Bowman Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20231018171713.1883517-16-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/core/pci.c | 96 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 96 insertions(+) commit 6c5f3aacb2963d49a11d4f8accb1188db6a6404b Author: Terry Bowman Date: Wed Oct 18 19:17:07 2023 +0200 cxl/pci: Map RCH downstream AER registers for logging protocol errors The restricted CXL host (RCH) error handler will log protocol errors using AER and RAS status registers. The AER and RAS registers need to be virtually memory mapped before enabling interrupts. Create the initializer function devm_cxl_setup_parent_dport() for this when the endpoint is connected with the dport. The initialization sets up the RCH RAS and AER mappings. Add 'struct cxl_regs' to 'struct cxl_dport' for saving a pointer to the RCH downstream port's AER and RAS registers. Signed-off-by: Terry Bowman Co-developed-by: Robert Richter Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20231018171713.1883517-15-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/core/pci.c | 36 ++++++++++++++++++++++++++++++++++++ drivers/cxl/cxl.h | 10 ++++++++++ 2 files changed, 46 insertions(+) commit bf6c9fa846e2a0f7db2a2eabd52ad4f8d4335bcb Author: Terry Bowman Date: Wed Oct 18 19:17:06 2023 +0200 cxl/pci: Update CXL error logging to use RAS register address The CXL error handler currently only logs endpoint RAS status. The CXL topology includes several components providing RAS details to be logged during error handling.[1] Update the current handler's RAS logging to use a RAS register address. Also, update the error handler function names to be consistent with correctable and uncorrectable RAS. This will allow for adding support to log other CXL component's RAS details in the future. [1] CXL3.0 Table 8-22 CXL_Capability_ID Assignment Co-developed-by: Robert Richter Signed-off-by: Terry Bowman Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20231018171713.1883517-14-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/core/pci.c | 44 +++++++++++++++++++++++++++++++------------- 1 file changed, 31 insertions(+), 13 deletions(-) commit 6777877eb7a3290cf0a8a6b621e46f72f9d94b6b Author: Terry Bowman Date: Wed Oct 18 19:17:05 2023 +0200 PCI/AER: Refactor cper_print_aer() for use by CXL driver module The CXL driver plans to use cper_print_aer() for logging restricted CXL host (RCH) AER errors. cper_print_aer() is not currently exported and therefore not usable by the CXL drivers built as loadable modules. Export the cper_print_aer() function. Use the EXPORT_SYMBOL_NS_GPL() variant to restrict the export to CXL drivers. The CONFIG_ACPI_APEI_PCIEAER kernel config is currently used to enable cper_print_aer(). cper_print_aer() logs the AER registers and is useful in PCIE AER logging outside of APEI. Remove the CONFIG_ACPI_APEI_PCIEAER dependency to enable cper_print_aer(). The cper_print_aer() function name implies CPER specific use but is useful in non-CPER cases as well. Rename cper_print_aer() to pci_print_aer(). Also, update cxl_core to import CXL namespace imports. Co-developed-by: Robert Richter Signed-off-by: Terry Bowman Signed-off-by: Robert Richter Cc: Mahesh J Salgaonkar Cc: Oliver O'Halloran Cc: Bjorn Helgaas Cc: linux-pci@vger.kernel.org Reviewed-by: Jonathan Cameron Acked-by: Bjorn Helgaas Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20231018171713.1883517-13-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/core/port.c | 1 + drivers/pci/pcie/aer.c | 9 +++++---- include/linux/aer.h | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) commit f05fd10d138d8ba795fcd72ace99e9c8eb7e777e Author: Robert Richter Date: Fri Oct 27 15:08:06 2023 -0700 cxl/pci: Add RCH downstream port AER register discovery Restricted CXL host (RCH) downstream port AER information is not currently logged while in the error state. One problem preventing the error logging is the AER and RAS registers are not accessible. The CXL driver requires changes to find RCH downstream port AER and RAS registers for purpose of error logging. RCH downstream ports are not enumerated during a PCI bus scan and are instead discovered using system firmware, ACPI in this case.[1] The downstream port is implemented as a Root Complex Register Block (RCRB). The RCRB is a 4k memory block containing PCIe registers based on the PCIe root port.[2] The RCRB includes AER extended capability registers used for reporting errors. Note, the RCH's AER Capability is located in the RCRB memory space instead of PCI configuration space, thus its register access is different. Existing kernel PCIe AER functions can not be used to manage the downstream port AER capabilities and RAS registers because the port was not enumerated during PCI scan and the registers are not PCI config accessible. Discover RCH downstream port AER extended capability registers. Use MMIO accesses to search for extended AER capability in RCRB register space. [1] CXL 3.0 Spec, 9.11.2 - System Firmware View of CXL 1.1 Hierarchy [2] CXL 3.0 Spec, 8.2.1.1 - RCH Downstream Port RCRB Co-developed-by: Robert Richter Signed-off-by: Terry Bowman Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20231018171713.1883517-12-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/core/core.h | 1 + drivers/cxl/core/pci.c | 15 +++++++++++++++ drivers/cxl/core/regs.c | 36 ++++++++++++++++++++++++++++++++++++ drivers/cxl/cxl.h | 7 +++++++ drivers/cxl/mem.c | 2 ++ 5 files changed, 61 insertions(+) commit a2fcb84a1978e4e855d632a07412030e99819cb8 Author: Robert Richter Date: Wed Oct 18 19:17:02 2023 +0200 cxl/port: Remove Component Register base address from struct cxl_port The Component Register base address @component_reg_phys is no longer used after the rework of the Component Register setup which now uses struct member @reg_map instead. Remove the base address. Signed-off-by: Terry Bowman Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20231018171713.1883517-10-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/core/port.c | 4 +--- drivers/cxl/cxl.h | 2 -- 2 files changed, 1 insertion(+), 5 deletions(-) commit f611d98a003644f76ad8fea7c3ca786a8ca69aff Author: Robert Richter Date: Wed Oct 18 19:17:01 2023 +0200 cxl/pci: Remove Component Register base address from struct cxl_dev_state The Component Register base address @component_reg_phys is no longer used after the rework of the Component Register setup which now uses struct member @reg_map instead. Remove the base address. Signed-off-by: Terry Bowman Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20231018171713.1883517-9-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/cxlmem.h | 2 -- drivers/cxl/pci.c | 3 --- tools/testing/cxl/test/mem.c | 4 +--- 3 files changed, 1 insertion(+), 8 deletions(-) commit 8ce520fdea245c9e17ebc0659973984362bc1fde Author: Robert Richter Date: Wed Oct 18 19:17:00 2023 +0200 cxl/hdm: Use stored Component Register mappings to map HDM decoder capability Now, that the Component Register mappings are stored, use them to enable and map the HDM decoder capabilities. The Component Registers do not need to be probed again for this, remove probing code. The HDM capability applies to Endpoints, USPs and VH Host Bridges. The Endpoint's component register mappings are located in the cxlds and else in the port's structure. Duplicate the cxlds->reg_map in port->reg_map for endpoint ports. Signed-off-by: Terry Bowman Signed-off-by: Robert Richter Reviewed-by: Dave Jiang [rework to drop cxl_port_get_comp_map()] Link: https://lore.kernel.org/r/20231018171713.1883517-8-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/core/hdm.c | 48 +++++++++++++++++++----------------------------- drivers/cxl/core/port.c | 29 ++++++++++++++++++++++------- drivers/cxl/mem.c | 5 ++--- 3 files changed, 43 insertions(+), 39 deletions(-) commit 2dd18279202f6247904e6e23738c1ec6a86b24b1 Author: Robert Richter Date: Wed Oct 18 19:16:59 2023 +0200 cxl/pci: Store the endpoint's Component Register mappings in struct cxl_dev_state Same as for ports and dports, also store the endpoint's Component Register mappings, use struct cxl_dev_state for that. Keep the Component Register base address @component_reg_phys a bit to not break functionality. It will be removed after the transition in a later patch. Signed-off-by: Terry Bowman Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20231018171713.1883517-7-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/core/mbox.c | 2 ++ drivers/cxl/cxlmem.h | 2 ++ drivers/cxl/pci.c | 9 +++++---- 3 files changed, 9 insertions(+), 4 deletions(-) commit 4d758764e7f9db83806135f3bfcff1ab64f16e60 Author: Robert Richter Date: Wed Oct 18 19:16:58 2023 +0200 cxl/port: Pre-initialize component register mappings The component registers of a component may not exist and cxl_setup_comp_regs() will fail for that reason. In another case, Software may not use and set those registers up. cxl_setup_comp_regs() is then called with a base address of CXL_RESOURCE_NONE. Both are valid cases, but the function returns without initializing the register map. Now, a missing component register block is not necessarily a reason to fail (feature is optional or its existence checked later). Change cxl_setup_comp_regs() to also use components with the component register block missing. Thus, always initialize struct cxl_register_map with valid values, set @dev and make @resource CXL_RESOURCE_NONE. The change is in preparation of follow-on patches. Signed-off-by: Terry Bowman Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20231018171713.1883517-6-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/core/port.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit d8add49263a98d766e5758dc2ec9f83c3b685c12 Author: Robert Richter Date: Wed Oct 18 19:16:57 2023 +0200 cxl/port: Rename @comp_map to @reg_map in struct cxl_register_map Name the field @reg_map, because @reg_map->host will be used for mapping operations beyond component registers (i.e. AER registers). This is valid for all occurrences of @comp_map. Change them all. Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20231018171713.1883517-5-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/core/port.c | 6 +++--- drivers/cxl/cxl.h | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) commit 33d9c987bf8fb68a9292aba7cc4b1711fcb1be4d Author: Dan Williams Date: Wed Oct 18 19:16:56 2023 +0200 cxl/port: Fix @host confusion in cxl_dport_setup_regs() commit 5d2ffbe4b81a ("cxl/port: Store the downstream port's Component Register mappings in struct cxl_dport") ...moved the dport component registers from a raw component_reg_phys passed in at dport instantiation time to a 'struct cxl_register_map' populated with both the component register data *and* the "host" device for mapping operations. While typical CXL switch dports are mapped by their associated 'struct cxl_port', an RCH host bridge dport registered by cxl_acpi needs to wait until the cxl_mem driver makes the attachment to map the registers. This is because there are no intervening 'struct cxl_port' instances between the root cxl_port and the endpoint port in an RCH topology. For now just mark the host as NULL in the RCH dport case until code that needs to map the dport registers arrives. This patch is not flagged for -stable since nothing in the current driver uses the dport->comp_map. Now, I am slightly uneasy that cxl_setup_comp_regs() sets map->host to a wrong value and then cxl_dport_setup_regs() fixes it up, but the alternatives I came up with are more messy. For example, adding an @logdev to 'struct cxl_register_map' that the dev_printk()s can fall back to when @host is NULL. I settled on "post-fixup+comment" since it is only RCH dports that have this special case where register probing is split between a host-bridge RCRB lookup and when cxl_mem_probe() does the association of the cxl_memdev and endpoint port. [moved rename of @comp_map to @reg_map into next patch] Fixes: 5d2ffbe4b81a ("cxl/port: Store the downstream port's Component Register mappings in struct cxl_dport") Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20231018171713.1883517-4-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/core/port.c | 43 +++++++++++++++++++++++++++++++------------ 1 file changed, 31 insertions(+), 12 deletions(-) commit dd22581f89537163f065e8ef7c125ce0fddf62cc Author: Robert Richter Date: Wed Oct 18 19:16:55 2023 +0200 cxl/core/regs: Rename @dev to @host in struct cxl_register_map The primary role of @dev is to host the mappings for devm operations. @dev is too ambiguous as a name. I.e. when does @dev refer to the 'struct device *' instance that the registers belong, and when does @dev refer to the 'struct device *' instance hosting the mapping for devm operations? Clarify the role of @dev in cxl_register_map by renaming it to @host. Also, rename local variables to 'host' where map->host is used. Signed-off-by: Terry Bowman Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20231018171713.1883517-3-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/core/hdm.c | 2 +- drivers/cxl/core/port.c | 4 ++-- drivers/cxl/core/regs.c | 28 ++++++++++++++-------------- drivers/cxl/cxl.h | 4 ++-- drivers/cxl/pci.c | 2 +- 5 files changed, 20 insertions(+), 20 deletions(-) commit 47ea0ddb1f5604ba3496baa19110aec6a3151f2e Author: Lalith Rajendran Date: Fri Oct 27 16:02:22 2023 -0500 platform/chrome: cros_ec_lpc: Separate host command and irq disable Both cros host command and irq disable were moved to suspend prepare stage from late suspend recently. This is causing EC to report MKBP event timeouts during suspend stress testing. When the MKBP event timeouts happen during suspend, subsequent wakeup of AP by EC using MKBP doesn't happen properly. Move the irq disabling part back to late suspend stage which is a general suggestion from the suspend kernel documentaiton to do irq disable as late as possible. Fixes: 4b9abbc132b8 ("platform/chrome: cros_ec_lpc: Move host command to prepare/complete") Signed-off-by: Lalith Rajendran Link: https://lore.kernel.org/r/20231027160221.v4.1.I1725c3ed27eb7cd9836904e49e8bfa9fb0200a97@changeid Signed-off-by: Tzung-Bi Shih drivers/platform/chrome/cros_ec.c | 116 +++++++++++++++++++++++++++------- drivers/platform/chrome/cros_ec.h | 4 ++ drivers/platform/chrome/cros_ec_lpc.c | 22 +++++-- 3 files changed, 116 insertions(+), 26 deletions(-) commit 8d2ad999ca3c64cb08cf6a58d227b9d9e746d708 Author: Dan Williams Date: Fri Oct 27 20:13:23 2023 -0700 cxl/port: Fix delete_endpoint() vs parent unregistration race The CXL subsystem, at cxl_mem ->probe() time, establishes a lineage of ports (struct cxl_port objects) between an endpoint and the root of a CXL topology. Each port including the endpoint port is attached to the cxl_port driver. Given that setup, it follows that when either any port in that lineage goes through a cxl_port ->remove() event, or the memdev goes through a cxl_mem ->remove() event. The hierarchy below the removed port, or the entire hierarchy if the memdev is removed needs to come down. The delete_endpoint() callback is careful to check whether it is being called to tear down the hierarchy, or if it is only being called to teardown the memdev because an ancestor port is going through ->remove(). That care needs to take the device_lock() of the endpoint's parent. Which requires 2 bugs to be fixed: 1/ A reference on the parent is needed to prevent use-after-free scenarios like this signature: BUG: spinlock bad magic on CPU#0, kworker/u56:0/11 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc38 05/24/2023 Workqueue: cxl_port detach_memdev [cxl_core] RIP: 0010:spin_bug+0x65/0xa0 Call Trace: do_raw_spin_lock+0x69/0xa0 __mutex_lock+0x695/0xb80 delete_endpoint+0xad/0x150 [cxl_core] devres_release_all+0xb8/0x110 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1d2/0x210 detach_memdev+0x15/0x20 [cxl_core] process_one_work+0x1e3/0x4c0 worker_thread+0x1dd/0x3d0 2/ In the case of RCH topologies, the parent device that needs to be locked is not always @port->dev as returned by cxl_mem_find_port(), use endpoint->dev.parent instead. Fixes: 8dd2bc0f8e02 ("cxl/mem: Add the cxl_mem driver") Cc: Reported-by: Robert Richter Closes: http://lore.kernel.org/r/20231018171713.1883517-2-rrichter@amd.com Signed-off-by: Dan Williams drivers/cxl/core/port.c | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) commit 1768d3a0144c7aae55b9cee66dabf94946eec01e Author: Arnaldo Carvalho de Melo Date: Fri Oct 27 11:18:47 2023 -0300 perf build: Disable BPF skeletons if clang version is < 12.0.1 While building on a wide range of distros and clang versions it was noticed that at least version 12.0.1 (noticed on Alpine 3.15 with "Alpine clang version 12.0.1") is needed to not fail with BTF generation errors such as: Debian:10 Debian clang version 11.0.1-2~deb10u1: CLANG /tmp/build/perf/util/bpf_skel/.tmp/sample_filter.bpf.o GENSKEL /tmp/build/perf/util/bpf_skel/sample_filter.skel.h libbpf: failed to find BTF for extern 'bpf_cast_to_kern_ctx' [21] section: -2 Error: failed to open BPF object file: No such file or directory make[2]: *** [Makefile.perf:1121: /tmp/build/perf/util/bpf_skel/sample_filter.skel.h] Error 254 make[2]: *** Deleting file '/tmp/build/perf/util/bpf_skel/sample_filter.skel.h' Amazon Linux 2: clang version 11.1.0 (Amazon Linux 2 11.1.0-1.amzn2.0.2) GENSKEL /tmp/build/perf/util/bpf_skel/sample_filter.skel.h libbpf: elf: skipping unrecognized data section(18) .eh_frame libbpf: elf: skipping relo section(19) .rel.eh_frame for section(18) .eh_frame libbpf: failed to find BTF for extern 'bpf_cast_to_kern_ctx' [21] section: -2 Error: failed to open BPF object file: No such file or directory make[2]: *** [/tmp/build/perf/util/bpf_skel/sample_filter.skel.h] Error 254 make[2]: *** Deleting file `/tmp/build/perf/util/bpf_skel/sample_filter.skel.h' Ubuntu 20.04: clang version 10.0.0-4ubuntu1 CLANG /tmp/build/perf/util/bpf_skel/.tmp/augmented_raw_syscalls.bpf.o GENSKEL /tmp/build/perf/util/bpf_skel/bench_uprobe.skel.h GENSKEL /tmp/build/perf/util/bpf_skel/bperf_leader.skel.h libbpf: sec '.reluprobe': corrupted symbol #27 pointing to invalid section #65522 for relo #0 GENSKEL /tmp/build/perf/util/bpf_skel/bperf_follower.skel.h Error: failed to open BPF object file: BPF object format invalid make[2]: *** [Makefile.perf:1121: /tmp/build/perf/util/bpf_skel/bench_uprobe.skel.h] Error 95 make[2]: *** Deleting file '/tmp/build/perf/util/bpf_skel/bench_uprobe.skel.h' So check if the version is at least 12.0.1 otherwise disable building BPF skels and provide a message about it, continuing the build. The message, when running on amazonlinux:2: Makefile.config:698: Warning: Disabled BPF skeletons as reliable BTF generation needs at least clang version 12.0.1 Signed-off-by: Arnaldo Carvalho de Melo Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/ZTvGx/Ou6BVnYBqi@kernel.org Signed-off-by: Namhyung Kim tools/perf/Makefile.config | 7 +++++++ 1 file changed, 7 insertions(+) commit ee40490dd7cdcda38ece6d081f63ecddd3fdbe25 Author: Colin Ian King Date: Fri Oct 27 09:46:33 2023 +0100 perf callchain: Fix spelling mistake "statisitcs" -> "statistics" There are a couple of spelling mistakes in perror messages. Fix them. Signed-off-by: Colin Ian King Cc: kernel-janitors@vger.kernel.org Link: https://lore.kernel.org/r/20231027084633.1167530-1-colin.i.king@gmail.com Signed-off-by: Namhyung Kim tools/perf/util/callchain.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 0e0f03d7fc933ffe22c67feeec4b49bdd4cbfbd1 Author: Colin Ian King Date: Fri Oct 27 09:40:11 2023 +0100 perf report: Fix spelling mistake "heirachy" -> "hierarchy" There is a spelling mistake in a ui error message. Fix it. Signed-off-by: Colin Ian King Cc: kernel-janitors@vger.kernel.org Link: https://lore.kernel.org/r/20231027084011.1167091-1-colin.i.king@gmail.com Signed-off-by: Namhyung Kim tools/perf/builtin-report.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 93c65d61433bcec4070fc61b7c737c79fc25f09a Author: Arnaldo Carvalho de Melo Date: Fri Oct 27 10:33:30 2023 -0300 perf python: Fix binding linkage due to rename and move of evsel__increase_rlimit() The changes in ("perf evsel: Rename evsel__increase_rlimit to rlimit__increase_nofile") ended up breaking the python binding that now references the rlimit__increase_nofile function, add the util/rlimit.o to the tools/perf/util/python-ext-sources to cure that. This was detected by the 'perf test python' regression test: $ perf test python 14: 'import perf' in python : FAILED! $ perf test -v python Couldn't bump rlimit(MEMLOCK), failures may take place when creating BPF maps, etc 14: 'import perf' in python : --- start --- test child forked, pid 2912462 python usage test: "echo "import sys ; sys.path.insert(0, '/tmp/build/perf-tools-next/python'); import perf" | '/usr/bin/python3' " Traceback (most recent call last): File "", line 1, in ImportError: /tmp/build/perf-tools-next/python/perf.cpython-311-x86_64-linux-gnu.so: undefined symbol: rlimit__increase_nofile test child finished with -1 ---- end ---- 'import perf' in python: FAILED! $ Fixes: e093a222d7cba1eb ("perf evsel: Rename evsel__increase_rlimit to rlimit__increase_nofile") Acked-by: Namhyung Kim Acked-by: Yang Jihong Link: https://lore.kernel.org/lkml/ZTrCS5Z3PZAmfPdV@kernel.org Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim tools/perf/util/python-ext-sources | 1 + 1 file changed, 1 insertion(+) commit 75357829cc8ef20808f38b6256fa167f36267c9f Author: Stephen Boyd Date: Fri Oct 27 15:58:21 2023 -0700 clk: Fix clk gate kunit test on big-endian CPUs The clk gate kunit test checks that the implementation of the basic clk gate reads and writes the proper bits in an MMIO register. The implementation of the basic clk gate type uses writel() and readl() which operate on little-endian registers. This test fails on big-endian CPUs because the clk gate implementation writes to 'fake_reg' with writel(), which converts the value to be written to little-endian before storing the value in the fake register. When the test checks the bits in the fake register on a big-endian machine it falsely assumes the format of the register is also big-endian, when it is really always little-endian. Suffice to say things don't work very well. Mark 'fake_reg' as __le32 and push through endian accessor fixes wherever the value is inspected to make this test endian agnostic. There's a CLK_GATE_BIG_ENDIAN flag for big-endian MMIO devices, which this test isn't using. A follow-up patch will test with and without that flag. Reported-by: Boqun Feng Closes: https://lore.kernel.org/r/ZTLH5o0GlFBYsAHq@boqun-archlinux Tested-by: Boqun Feng Signed-off-by: Stephen Boyd Link: https://lore.kernel.org/r/20231027225821.95833-1-sboyd@kernel.org drivers/clk/clk-gate_test.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) commit 2f06996d72df779a47852bcf059fc04a555fe342 Author: Lin, Meng-Bo Date: Fri Oct 27 15:56:33 2023 -0700 Input: cyttsp5 - add handling for vddio regulator The Cypress touchscreen controllers are often used with external pull-up for the interrupt line and the I2C lines, so we might need to enable a regulator to bring the lines into usable state. Otherwise, this might cause spurious interrupts and reading from I2C will fail. Implement support for a "vddio-supply" that is enabled by the cyttsp5 driver so that the regulator gets enabled when needed. Signed-off-by: Lin, Meng-Bo Acked-by: Alistair Francis Link: https://lore.kernel.org/r/20221117190507.87535-3-linmengbo0689@protonmail.com Signed-off-by: Dmitry Torokhov drivers/input/touchscreen/cyttsp5.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) commit fade5a92931c241be5b7e185d946205cfdfcb26f Author: Lin, Meng-Bo Date: Fri Oct 27 15:53:59 2023 -0700 dt-bindings: input: cyttsp5: document vddio-supply The Samsung touchscreen controllers are often used with external pull-up for the interrupt line and the I2C lines, so we might need to enable a regulator to bring the lines into usable state. Otherwise, this might cause spurious interrupts and reading from I2C will fail. Document support for a "vddio-supply" that is enabled by the cyttsp5 driver so that the regulator gets enabled when needed. Signed-off-by: Lin, Meng-Bo Acked-by: Krzysztof Kozlowski Reviewed-by: Alistair Francis Link: https://lore.kernel.org/r/20221117190507.87535-2-linmengbo0689@protonmail.com Signed-off-by: Dmitry Torokhov .../devicetree/bindings/input/touchscreen/cypress,tt21000.yaml | 3 +++ 1 file changed, 3 insertions(+) commit f1c73396133cb3d913e2075298005644ee8dfade Author: Raju Lakkaraju Date: Fri Oct 27 10:13:06 2023 +0530 net: pcs: xpcs: Add 2500BASE-X case in get state for XPCS drivers Add DW_2500BASEX case in xpcs_get_state( ) to update speed, duplex and pause Signed-off-by: Raju Lakkaraju Reviewed-by: Serge Semin Link: https://lore.kernel.org/r/20231027044306.291250-1-Raju.Lakkaraju@microchip.com Signed-off-by: Jakub Kicinski drivers/net/pcs/pcs-xpcs.c | 29 +++++++++++++++++++++++++++++ drivers/net/pcs/pcs-xpcs.h | 2 ++ 2 files changed, 31 insertions(+) commit 06497763c8f15d08c0e356e651a61f2930a8987c Author: Yonghong Song Date: Fri Oct 27 11:24:24 2023 -0700 net: bpf: Use sockopt_lock_sock() in ip_sock_set_tos() With latest sync from net-next tree, bpf-next has a bpf selftest failure: [root@arch-fb-vm1 bpf]# ./test_progs -t setget_sockopt ... [ 76.194349] ============================================ [ 76.194682] WARNING: possible recursive locking detected [ 76.195039] 6.6.0-rc7-g37884503df08-dirty #67 Tainted: G W OE [ 76.195518] -------------------------------------------- [ 76.195852] new_name/154 is trying to acquire lock: [ 76.196159] ffff8c3e06ad8d30 (sk_lock-AF_INET){+.+.}-{0:0}, at: ip_sock_set_tos+0x19/0x30 [ 76.196669] [ 76.196669] but task is already holding lock: [ 76.197028] ffff8c3e06ad8d30 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_listen+0x21/0x70 [ 76.197517] [ 76.197517] other info that might help us debug this: [ 76.197919] Possible unsafe locking scenario: [ 76.197919] [ 76.198287] CPU0 [ 76.198444] ---- [ 76.198600] lock(sk_lock-AF_INET); [ 76.198831] lock(sk_lock-AF_INET); [ 76.199062] [ 76.199062] *** DEADLOCK *** [ 76.199062] [ 76.199420] May be due to missing lock nesting notation [ 76.199420] [ 76.199879] 2 locks held by new_name/154: [ 76.200131] #0: ffff8c3e06ad8d30 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_listen+0x21/0x70 [ 76.200644] #1: ffffffff90f96a40 (rcu_read_lock){....}-{1:2}, at: __cgroup_bpf_run_filter_sock_ops+0x55/0x290 [ 76.201268] [ 76.201268] stack backtrace: [ 76.201538] CPU: 4 PID: 154 Comm: new_name Tainted: G W OE 6.6.0-rc7-g37884503df08-dirty #67 [ 76.202134] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 76.202699] Call Trace: [ 76.202858] [ 76.203002] dump_stack_lvl+0x4b/0x80 [ 76.203239] __lock_acquire+0x740/0x1ec0 [ 76.203503] lock_acquire+0xc1/0x2a0 [ 76.203766] ? ip_sock_set_tos+0x19/0x30 [ 76.204050] ? sk_stream_write_space+0x12a/0x230 [ 76.204389] ? lock_release+0xbe/0x260 [ 76.204661] lock_sock_nested+0x32/0x80 [ 76.204942] ? ip_sock_set_tos+0x19/0x30 [ 76.205208] ip_sock_set_tos+0x19/0x30 [ 76.205452] do_ip_setsockopt+0x4b3/0x1580 [ 76.205719] __bpf_setsockopt+0x62/0xa0 [ 76.205963] bpf_sock_ops_setsockopt+0x11/0x20 [ 76.206247] bpf_prog_630217292049c96e_bpf_test_sockopt_int+0xbc/0x123 [ 76.206660] bpf_prog_493685a3bae00bbd_bpf_test_ip_sockopt+0x49/0x4b [ 76.207055] bpf_prog_b0bcd27f269aeea0_skops_sockopt+0x44c/0xec7 [ 76.207437] __cgroup_bpf_run_filter_sock_ops+0xda/0x290 [ 76.207829] __inet_listen_sk+0x108/0x1b0 [ 76.208122] inet_listen+0x48/0x70 [ 76.208373] __sys_listen+0x74/0xb0 [ 76.208630] __x64_sys_listen+0x16/0x20 [ 76.208911] do_syscall_64+0x3f/0x90 [ 76.209174] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 ... Both ip_sock_set_tos() and inet_listen() calls lock_sock(sk) which caused a dead lock. To fix the issue, use sockopt_lock_sock() in ip_sock_set_tos() instead. sockopt_lock_sock() will avoid lock_sock() if it is in bpf context. Fixes: 878d951c6712 ("inet: lock the socket in ip_sock_set_tos()") Suggested-by: Martin KaFai Lau Signed-off-by: Yonghong Song Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20231027182424.1444845-1-yonghong.song@linux.dev Signed-off-by: Jakub Kicinski net/ipv4/ip_sockglue.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f5247a6ed5b5bbaa609f97049de868974eb7a7c2 Author: Konstantin Taranov Date: Fri Oct 27 11:06:51 2023 -0700 net: mana: Use xdp_set_features_flag instead of direct assignment This patch uses a helper function for assignment of xdp_features. This change simplifies backports. Signed-off-by: Konstantin Taranov Signed-off-by: Haiyang Zhang Link: https://lore.kernel.org/r/1698430011-21562-1-git-send-email-haiyangz@microsoft.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/microsoft/mana/mana_en.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 6d90b64256f39511d0083111e167321dc6a6add2 Author: Benjamin Poirier Date: Fri Oct 27 14:44:10 2023 -0400 vxlan: Cleanup IFLA_VXLAN_PORT_RANGE entry in vxlan_get_size() This patch is basically a followup to commit 4e4b1798cc90 ("vxlan: Add missing entries to vxlan_get_size()"). All of the attributes in vxlan_get_size() appear in the same order that they are filled in vxlan_fill_info() except for IFLA_VXLAN_PORT_RANGE. For consistency, move that entry to match its order and add a comment, like for all other entries. Signed-off-by: Benjamin Poirier Link: https://lore.kernel.org/r/20231027184410.236671-1-bpoirier@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/vxlan/vxlan_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a4213705b88e61cadb5df41e3bc7aae4f4b7f3ec Merge: 6479c975b20a 36d0395b30f8 Author: Jakub Kicinski Date: Fri Oct 27 15:35:51 2023 -0700 Merge branch 'intel-wired-lan-driver-updates-for-2023-10-23-iavf' Jacob Keller says: ==================== Intel Wired LAN Driver Updates for 2023-10-23 (iavf) This series includes iAVF driver cleanups from Michal Schmidt. Michal removes and updates stale comments, fixes some locking anti-patterns, improves handling of resets when the PF is slow, avoids unnecessary duplication of netdev state, refactors away some duplicate code, and finally removes the never-actually-used client interface. Changes since v1: * Dropped patch ("iavf: in iavf_down, disable queues when removing the driver") which was applied directly to net. * Fixed a merge conflict due to 7db311104388 ("iavf: initialize waitqueues before starting watchdog_task"). V1 was originally posted at: https://lore.kernel.org/netdev/20231027104109.4f536f51@kernel.org/T/#mfadbdb39313eeccc616fdee80a4fdd6bda7e2822 ==================== Link: https://lore.kernel.org/r/20231027175941.1340255-1-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski commit 36d0395b30f822ab4910cdac5438ab0185a6723f Author: Michal Schmidt Date: Fri Oct 27 10:59:41 2023 -0700 iavf: delete the iavf client interface The iavf client interface was added in 2017 by commit ed0e894de7c1 ("i40evf: add client interface"), but there have never been any in-tree callers. It's not useful for future development either. The Intel out-of-tree iavf and irdma drivers instead use an auxiliary bus, which is a better solution. Remove the iavf client interface code. Also gone are the client_task work and the client_lock mutex. Signed-off-by: Michal Schmidt Reviewed-by: Jacob Keller Signed-off-by: Jacob Keller Link: https://lore.kernel.org/r/20231027175941.1340255-9-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/iavf/Makefile | 2 +- drivers/net/ethernet/intel/iavf/iavf.h | 27 -- drivers/net/ethernet/intel/iavf/iavf_client.c | 578 ------------------------ drivers/net/ethernet/intel/iavf/iavf_client.h | 169 ------- drivers/net/ethernet/intel/iavf/iavf_main.c | 82 ---- drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 14 - 6 files changed, 1 insertion(+), 871 deletions(-) commit b5b219a1fa5faeb69b356e0ed3e14136887a905c Author: Michal Schmidt Date: Fri Oct 27 10:59:40 2023 -0700 iavf: add a common function for undoing the interrupt scheme Add a new function iavf_free_interrupt_scheme that does the inverse of iavf_init_interrupt_scheme. Symmetry is nice. And there will be three callers already. Signed-off-by: Michal Schmidt Reviewed-by: Wojciech Drewek Reviewed-by: Jacob Keller Signed-off-by: Jacob Keller Link: https://lore.kernel.org/r/20231027175941.1340255-8-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/iavf/iavf_main.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) commit 5c4e1d187442c07b8bcbb7097a70e65e8b187598 Author: Michal Schmidt Date: Fri Oct 27 10:59:39 2023 -0700 iavf: use unregister_netdev Use unregister_netdev, which takes rtnl_lock for us. We don't have to check the reg_state under rtnl_lock. There's nothing to race with. We have just cancelled the finish_config work. Signed-off-by: Michal Schmidt Reviewed-by: Wojciech Drewek Reviewed-by: Jacob Keller Signed-off-by: Jacob Keller Link: https://lore.kernel.org/r/20231027175941.1340255-7-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/iavf/iavf_main.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 34ad34bf06cae3cf2f7b8361aebc28b7d51fb7dc Author: Michal Schmidt Date: Fri Oct 27 10:59:38 2023 -0700 iavf: rely on netdev's own registered state The information whether a netdev has been registered is already present in the netdev itself. There's no need for a driver flag with the same meaning. Signed-off-by: Michal Schmidt Reviewed-by: Wojciech Drewek Reviewed-by: Jacob Keller Signed-off-by: Jacob Keller Link: https://lore.kernel.org/r/20231027175941.1340255-6-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/iavf/iavf.h | 1 - drivers/net/ethernet/intel/iavf/iavf_main.c | 9 +++------ 2 files changed, 3 insertions(+), 7 deletions(-) commit 54584b17880632085906faa49284bc13f7dca06f Author: Michal Schmidt Date: Fri Oct 27 10:59:37 2023 -0700 iavf: fix the waiting time for initial reset Every time I create VFs on ice, I receive at least one "Device is still in reset (-16), retrying" message per VF. It recovers fine, but typical usecases should not trigger scary-looking messages. The waiting for reset is too short. It makes no sense to check every 10 microseconds. Typical reset waiting times are at least tens of milliseconds and can be several seconds. I suspect the polling interval was meant to be 10 milliseconds all along. IAVF_RESET_WAIT_COMPLETE_COUNT is defined as 2000, so the total waiting time could be over 20 seconds. I have seen resets take 5 seconds (with 128 VFs on ice). The added benefit of not triggering the "Device is still in reset" path is that we avoid going through the __IAVF_INIT_FAILED state, which would take a full second before retrying. Signed-off-by: Michal Schmidt Reviewed-by: Wojciech Drewek Tested-by: Rafal Romanowski Signed-off-by: Jacob Keller Link: https://lore.kernel.org/r/20231027175941.1340255-5-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/iavf/iavf_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6a0d989d3cdb1b7653ca264ff41f4a4517a79500 Author: Michal Schmidt Date: Fri Oct 27 10:59:36 2023 -0700 iavf: in iavf_down, don't queue watchdog_task if comms failed The reason for queueing watchdog_task is to have it process the aq_required flags that are being set here. If comms failed, there's nothing to do, so return early. Signed-off-by: Michal Schmidt Reviewed-by: Wojciech Drewek Tested-by: Rafal Romanowski Signed-off-by: Jacob Keller Link: https://lore.kernel.org/r/20231027175941.1340255-4-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/iavf/iavf_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 5902ee6dc651f4bb536fbc19e654edc7b6d711d2 Author: Michal Schmidt Date: Fri Oct 27 10:59:35 2023 -0700 iavf: simplify mutex_trylock+sleep loops This pattern appears in two places in the iavf source code: while (!mutex_trylock(...)) usleep_range(...); That's just mutex_lock with extra steps. The pattern is a leftover from when iavf used bit flags instead of mutexes for locking. Commit 5ac49f3c2702 ("iavf: use mutexes for locking of critical sections") replaced test_and_set_bit with !mutex_trylock, preserving the pattern. Simplify it to mutex_lock. Signed-off-by: Michal Schmidt Reviewed-by: Wojciech Drewek Tested-by: Rafal Romanowski Signed-off-by: Jacob Keller Link: https://lore.kernel.org/r/20231027175941.1340255-3-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/iavf/iavf_main.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 77361cb9c1d6587d460215f096590e9d1f75f9f3 Author: Michal Schmidt Date: Fri Oct 27 10:59:34 2023 -0700 iavf: fix comments about old bit locks Bit lock __IAVF_IN_CRITICAL_TASK does not exist anymore since commit 5ac49f3c2702 ("iavf: use mutexes for locking of critical sections"). Adjust the comments accordingly. Signed-off-by: Michal Schmidt Reviewed-by: Wojciech Drewek Tested-by: Rafal Romanowski Signed-off-by: Jacob Keller Link: https://lore.kernel.org/r/20231027175941.1340255-2-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/iavf/iavf_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6479c975b20a7fe6ecacec3a60dc6f838ecee9d6 Author: Davide Caratti Date: Fri Oct 27 16:04:54 2023 +0200 doc/netlink: Update schema to support cmd-cnt-name and cmd-max-name allow specifying cmd-cnt-name and cmd-max-name in netlink specs, in accordance with Documentation/userspace-api/netlink/c-code-gen.rst. Use cmd-cnt-name and attr-cnt-name in the mptcp yaml spec and in the corresponding uAPI headers, to preserve the #defines we had in the past and avoid adding new ones. v2: - squash modification in mptcp.yaml and MPTCP uAPI headers Suggested-by: Jakub Kicinski Signed-off-by: Davide Caratti Link: https://lore.kernel.org/r/12d4ed0116d8883cf4b533b856f3125a34e56749.1698415310.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski Documentation/netlink/genetlink-c.yaml | 6 ++++++ Documentation/netlink/genetlink-legacy.yaml | 6 ++++++ Documentation/netlink/netlink-raw.yaml | 6 ++++++ Documentation/netlink/specs/mptcp.yaml | 2 ++ include/uapi/linux/mptcp.h | 4 ---- include/uapi/linux/mptcp_pm.h | 8 ++++---- 6 files changed, 24 insertions(+), 8 deletions(-) commit d96e48a3d55db7ee62e607ad2d89eee1a8585028 Author: Jiri Pirko Date: Fri Oct 27 11:25:25 2023 +0200 tools: ynl: introduce option to process unknown attributes or types In case the kernel sends message back containing attribute not defined in family spec, following exception is raised to the user: $ sudo ./tools/net/ynl/cli.py --spec Documentation/netlink/specs/devlink.yaml --do trap-get --json '{"bus-name": "netdevsim", "dev-name": "netdevsim1", "trap-name": "source_mac_is_multicast"}' Traceback (most recent call last): File "/home/jiri/work/linux/tools/net/ynl/lib/ynl.py", line 521, in _decode attr_spec = attr_space.attrs_by_val[attr.type] ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^ KeyError: 132 During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/home/jiri/work/linux/./tools/net/ynl/cli.py", line 61, in main() File "/home/jiri/work/linux/./tools/net/ynl/cli.py", line 49, in main reply = ynl.do(args.do, attrs, args.flags) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/jiri/work/linux/tools/net/ynl/lib/ynl.py", line 731, in do return self._op(method, vals, flags) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/jiri/work/linux/tools/net/ynl/lib/ynl.py", line 719, in _op rsp_msg = self._decode(decoded.raw_attrs, op.attr_set.name) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/jiri/work/linux/tools/net/ynl/lib/ynl.py", line 525, in _decode raise Exception(f"Space '{space}' has no attribute with value '{attr.type}'") Exception: Space 'devlink' has no attribute with value '132' Introduce a command line option "process-unknown" and pass it down to YnlFamily class constructor to allow user to process unknown attributes and types and print them as binaries. $ sudo ./tools/net/ynl/cli.py --spec Documentation/netlink/specs/devlink.yaml --do trap-get --json '{"bus-name": "netdevsim", "dev-name": "netdevsim1", "trap-name": "source_mac_is_multicast"}' --process-unknown {'UnknownAttr(129)': {'UnknownAttr(0)': b'\x00\x00\x00\x00\x00\x00\x00\x00', 'UnknownAttr(1)': b'\x00\x00\x00\x00\x00\x00\x00\x00', 'UnknownAttr(2)': b'\x0e\x00\x00\x00\x00\x00\x00\x00'}, 'UnknownAttr(132)': b'\x00', 'UnknownAttr(133)': b'', 'UnknownAttr(134)': {'UnknownAttr(0)': b''}, 'bus-name': 'netdevsim', 'dev-name': 'netdevsim1', 'trap-action': 'drop', 'trap-group-name': 'l2_drops', 'trap-name': 'source_mac_is_multicast'} Signed-off-by: Jiri Pirko Link: https://lore.kernel.org/r/20231027092525.956172-1-jiri@resnulli.us Signed-off-by: Jakub Kicinski tools/net/ynl/cli.py | 3 ++- tools/net/ynl/lib/ynl.py | 48 +++++++++++++++++++++++++++++++++++++----------- 2 files changed, 39 insertions(+), 12 deletions(-) commit ff672b9ffeb3f82135488ac16c5c5eb4b992999b Author: Eric Dumazet Date: Thu Oct 26 13:14:46 2023 +0000 ipvlan: properly track tx_errors Both ipvlan_process_v4_outbound() and ipvlan_process_v6_outbound() increment dev->stats.tx_errors in case of errors. Unfortunately there are two issues : 1) ipvlan_get_stats64() does not propagate dev->stats.tx_errors to user. 2) Increments are not atomic. KCSAN would complain eventually. Use DEV_STATS_INC() to not miss an update, and change ipvlan_get_stats64() to copy the value back to user. Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") Signed-off-by: Eric Dumazet Cc: Mahesh Bandewar Link: https://lore.kernel.org/r/20231026131446.3933175-1-edumazet@google.com Signed-off-by: Jakub Kicinski drivers/net/ipvlan/ipvlan_core.c | 8 ++++---- drivers/net/ipvlan/ipvlan_main.c | 1 + 2 files changed, 5 insertions(+), 4 deletions(-) commit 6aff7cbfe7bfafbed86a6948e660e280848c4d97 Author: Ido Schimmel Date: Thu Oct 26 11:33:43 2023 +0300 netdevsim: Block until all devices are released Like other buses, devices on the netdevsim bus have a release callback that is invoked when the reference count of the device drops to zero. However, unlike other buses such as PCI, the release callback is not necessarily built into the kernel, as netdevsim can be built as a module. The above is problematic as nothing prevents the module from being unloaded before the release callback has been invoked, which can happen asynchronously. One such example can be found in commit a380687200e0 ("devlink: take device reference for devlink object") where devlink calls put_device() from an RCU callback. The issue is not theoretical and the reproducer in [1] can reliably crash the kernel. The conclusion of this discussion was that the issue should be solved in netdevsim, which is what this patch is trying to do. Add a reference count that is increased when a device is added to the bus and decreased when a device is released. Signal a completion when the reference count drops to zero and wait for the completion when unloading the module so that the module will not be unloaded before all the devices were released. The reference count is initialized to one so that completion is only signaled when unloading the module. With this patch, the reproducer in [1] no longer crashes the kernel. [1] https://lore.kernel.org/netdev/20230619125015.1541143-2-idosch@nvidia.com/ Fixes: a380687200e0 ("devlink: take device reference for devlink object") Signed-off-by: Ido Schimmel Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/20231026083343.890689-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/netdevsim/bus.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 1a86a77a2328ad7405bd25b8f4c470445e966622 Author: Fei Qin Date: Thu Oct 26 10:00:58 2023 +0200 nfp: using napi_build_skb() to replace build_skb() The napi_build_skb() can reuse the skb in skb cache per CPU or can allocate skbs in bulk, which helps improve the performance. Signed-off-by: Fei Qin Signed-off-by: Louis Peens Reviewed-by: Wojciech Drewek Link: https://lore.kernel.org/r/20231026080058.22810-1-louis.peens@corigine.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/netronome/nfp/nfd3/dp.c | 2 +- drivers/net/ethernet/netronome/nfp/nfdk/dp.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 796dc3c79d6e9295771100fbaa24faf14896cf01 Author: Colin Ian King Date: Thu Oct 26 07:54:08 2023 +0100 net: dsa: microchip: ksz9477: Fix spelling mistake "Enery" -> "Energy" There is a spelling mistake in a dev_dbg message. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Simon Horman Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/all/20231026065408.1087824-1-colin.i.king@gmail.com/ Signed-off-by: Jakub Kicinski drivers/net/dsa/microchip/ksz9477.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit dfaed0e9f1e7c0a261ece2242294e4f7891dbadb Merge: 3a04927f8d4b 8afb91acc4a3 Author: Jakub Kicinski Date: Fri Oct 27 14:43:55 2023 -0700 Merge branch 'net-dsa-microchip-provide-wake-on-lan-support-part-2' Oleksij Rempel says: ==================== net: dsa: microchip: provide Wake on LAN support (part 2) This patch series introduces extensive Wake on LAN (WoL) support for the Microchip KSZ9477 family of switches, coupled with some code refactoring and error handling enhancements. The principal aim is to enable and manage Wake on Magic Packet and other PHY event triggers for waking up the system, whilst ensuring that the switch isn't reset during a shutdown if WoL is active. The Wake on LAN functionality is optional and is particularly beneficial if the PME pins are connected to the SoC as a wake source or to a PMIC that can enable or wake the SoC. ==================== Link: https://lore.kernel.org/r/20231026051051.2316937-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 8afb91acc4a3ea25ce15160df1fcab93b155b75e Author: Oleksij Rempel Date: Thu Oct 26 07:10:51 2023 +0200 net: dsa: microchip: Ensure Stable PME Pin State for Wake-on-LAN Ensures a stable PME (Power Management Event) pin state by disabling PME on system start and enabling it on shutdown only if WoL (Wake-on-LAN) is configured. This is needed to avoid issues with some PMICs (Power Management ICs). Signed-off-by: Oleksij Rempel Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20231026051051.2316937-6-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski drivers/net/dsa/microchip/ksz9477.c | 46 ++++++++++++++++++++++++++++++++++ drivers/net/dsa/microchip/ksz9477.h | 1 + drivers/net/dsa/microchip/ksz_common.c | 8 +++++- drivers/net/dsa/microchip/ksz_common.h | 1 + 4 files changed, 55 insertions(+), 1 deletion(-) commit 77c819cb493acf04bcbb52411debc4ef044429b2 Author: Oleksij Rempel Date: Thu Oct 26 07:10:50 2023 +0200 net: dsa: microchip: Refactor switch shutdown routine for WoL preparation Centralize the switch shutdown routine in a dedicated function, ksz_switch_shutdown(), to enhance code maintainability and reduce redundancy. This change abstracts the common shutdown operations previously duplicated in ksz9477_i2c_shutdown() and ksz_spi_shutdown(). This refactoring is a preparatory step for an upcoming patch to avoid reset on shutdown if Wake-on-LAN (WoL) is enabled. Signed-off-by: Oleksij Rempel Reviewed-by: Florian Fainelli Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20231026051051.2316937-5-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski drivers/net/dsa/microchip/ksz9477_i2c.c | 5 +---- drivers/net/dsa/microchip/ksz_common.c | 19 +++++++++++++++++++ drivers/net/dsa/microchip/ksz_common.h | 1 + drivers/net/dsa/microchip/ksz_spi.c | 5 +---- 4 files changed, 22 insertions(+), 8 deletions(-) commit 818cdb0f4b3834b342a32040ba0ee12fefb548e0 Author: Oleksij Rempel Date: Thu Oct 26 07:10:49 2023 +0200 net: dsa: microchip: Add error handling for ksz_switch_macaddr_get() Enhance the ksz_switch_macaddr_get() function to handle errors that may occur during the call to ksz_write8(). Specifically, this update checks the return value of ksz_write8(), which may fail if regmap ranges validation is not passed and returns the error code. Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20231026051051.2316937-4-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski drivers/net/dsa/microchip/ksz_common.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) commit 78c21fca0b391792cb105e4a505bcba88ea737e1 Author: Oleksij Rempel Date: Thu Oct 26 07:10:48 2023 +0200 net: dsa: microchip: Refactor comment for ksz_switch_macaddr_get() function Update the comment to follow kernel-doc format. Signed-off-by: Oleksij Rempel Reviewed-by: Florian Fainelli Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20231026051051.2316937-3-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski drivers/net/dsa/microchip/ksz_common.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) commit 3b454b6390c32d5a6a31ee67f510095b138264d1 Author: Oleksij Rempel Date: Thu Oct 26 07:10:47 2023 +0200 net: dsa: microchip: ksz9477: Add Wake on Magic Packet support Introduce Wake on Magic Packet (WoL) functionality to the ksz9477 driver. Major changes include: 1. Extending the `ksz9477_handle_wake_reason` function to identify Magic Packet wake events alongside existing wake reasons. 2. Updating the `ksz9477_get_wol` and `ksz9477_set_wol` functions to handle WAKE_MAGIC alongside the existing WAKE_PHY option, and to program the switch's MAC address register accordingly when Magic Packet wake-up is enabled. This change will prevent WAKE_MAGIC activation if the related port has a different MAC address compared to a MAC address already used by HSR or an already active WAKE_MAGIC on another port. 3. Adding a restriction in `ksz_port_set_mac_address` to prevent MAC address changes on ports with active Wake on Magic Packet, as the switch's MAC address register is utilized for this feature. Signed-off-by: Oleksij Rempel Reviewed-by: Florian Fainelli Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20231026051051.2316937-2-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski drivers/net/dsa/microchip/ksz9477.c | 57 +++++++++++++++++++++++++++++++--- drivers/net/dsa/microchip/ksz_common.c | 43 +++++++++++++++++++++++-- drivers/net/dsa/microchip/ksz_common.h | 4 +++ 3 files changed, 97 insertions(+), 7 deletions(-) commit 245561ba6d5de42bf73d501f910b181bc7fa5601 Author: Sami Tolvanen Date: Wed Sep 27 22:48:04 2023 +0000 lkdtm: Fix CFI_BACKWARD on RISC-V On RISC-V, the return address is before the current frame pointer, unlike on most other architectures. Use the correct offset on RISC-V to fix the CFI_BACKWARD test. Signed-off-by: Sami Tolvanen Acked-by: Kees Cook Tested-by: Nathan Chancellor Link: https://lore.kernel.org/r/20230927224757.1154247-14-samitolvanen@google.com Signed-off-by: Palmer Dabbelt drivers/misc/lkdtm/cfi.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit c40fef858d002fb027033c572ac8bdf8756a2c6b Author: Sami Tolvanen Date: Wed Sep 27 22:48:03 2023 +0000 riscv: Use separate IRQ shadow call stacks When both CONFIG_IRQ_STACKS and SCS are enabled, also use a separate per-CPU shadow call stack. Signed-off-by: Sami Tolvanen Tested-by: Nathan Chancellor Link: https://lore.kernel.org/r/20230927224757.1154247-13-samitolvanen@google.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/scs.h | 7 +++++++ arch/riscv/kernel/entry.S | 7 +++++++ arch/riscv/kernel/irq.c | 21 +++++++++++++++++++++ 3 files changed, 35 insertions(+) commit d1584d791a297aa8ed93503382a682a6ecfc4218 Author: Sami Tolvanen Date: Wed Sep 27 22:48:02 2023 +0000 riscv: Implement Shadow Call Stack Implement CONFIG_SHADOW_CALL_STACK for RISC-V. When enabled, the compiler injects instructions to all non-leaf C functions to store the return address to the shadow stack and unconditionally load it again before returning, which makes it harder to corrupt the return address through a stack overflow, for example. The active shadow call stack pointer is stored in the gp register, which makes SCS incompatible with gp relaxation. Use --no-relax-gp to ensure gp relaxation is disabled and disable global pointer loading. Add SCS pointers to struct thread_info, implement SCS initialization, and task switching Signed-off-by: Sami Tolvanen Tested-by: Nathan Chancellor Link: https://lore.kernel.org/r/20230927224757.1154247-12-samitolvanen@google.com Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 6 +++++ arch/riscv/Makefile | 4 +++ arch/riscv/include/asm/asm.h | 6 +++++ arch/riscv/include/asm/scs.h | 47 ++++++++++++++++++++++++++++++++++++ arch/riscv/include/asm/thread_info.h | 13 ++++++++++ arch/riscv/kernel/asm-offsets.c | 3 +++ arch/riscv/kernel/entry.S | 11 +++++++++ arch/riscv/kernel/head.S | 4 +++ arch/riscv/kernel/vdso/Makefile | 2 +- arch/riscv/purgatory/Makefile | 4 +++ 10 files changed, 99 insertions(+), 1 deletion(-) commit e609b4f4252a2ad2454736078693571b9fbff019 Author: Sami Tolvanen Date: Wed Sep 27 22:48:01 2023 +0000 riscv: Move global pointer loading to a macro In Clang 17, -fsanitize=shadow-call-stack uses the newly declared platform register gp for storing shadow call stack pointers. As this is obviously incompatible with gp relaxation, in preparation for CONFIG_SHADOW_CALL_STACK support, move global pointer loading to a single macro, which we can cleanly disable when SCS is used instead. Link: https://reviews.llvm.org/rGaa1d2693c256 Link: https://github.com/riscv-non-isa/riscv-elf-psabi-doc/commit/a484e843e6eeb51f0cb7b8819e50da6d2444d769 Signed-off-by: Sami Tolvanen Tested-by: Nathan Chancellor Link: https://lore.kernel.org/r/20230927224757.1154247-11-samitolvanen@google.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/asm.h | 8 ++++++++ arch/riscv/kernel/entry.S | 6 ++---- arch/riscv/kernel/head.S | 15 +++------------ arch/riscv/kernel/suspend_entry.S | 5 +---- 4 files changed, 14 insertions(+), 20 deletions(-) commit 82982fdd5133fa7e0b2dfaf746d18d6f29922b82 Author: Sami Tolvanen Date: Wed Sep 27 22:48:00 2023 +0000 riscv: Deduplicate IRQ stack switching With CONFIG_IRQ_STACKS, we switch to a separate per-CPU IRQ stack before calling handle_riscv_irq or __do_softirq. We currently have duplicate inline assembly snippets for stack switching in both code paths. Now that we can access per-CPU variables in assembly, implement call_on_irq_stack in assembly, and use that instead of redundant inline assembly. Signed-off-by: Sami Tolvanen Tested-by: Nathan Chancellor Reviewed-by: Guo Ren Link: https://lore.kernel.org/r/20230927224757.1154247-10-samitolvanen@google.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/asm.h | 5 +++++ arch/riscv/include/asm/irq_stack.h | 3 +++ arch/riscv/kernel/asm-offsets.c | 5 +++++ arch/riscv/kernel/entry.S | 30 ++++++++++++++++++++++++++++++ arch/riscv/kernel/irq.c | 35 ++++++++--------------------------- arch/riscv/kernel/traps.c | 32 ++++---------------------------- 6 files changed, 55 insertions(+), 55 deletions(-) commit be97d0db5f44c0674480cb79ac6f5b0529b84c76 Author: Deepak Gupta Date: Wed Sep 27 22:47:59 2023 +0000 riscv: VMAP_STACK overflow detection thread-safe commit 31da94c25aea ("riscv: add VMAP_STACK overflow detection") added support for CONFIG_VMAP_STACK. If overflow is detected, CPU switches to `shadow_stack` temporarily before switching finally to per-cpu `overflow_stack`. If two CPUs/harts are racing and end up in over flowing kernel stack, one or both will end up corrupting each other state because `shadow_stack` is not per-cpu. This patch optimizes per-cpu overflow stack switch by directly picking per-cpu `overflow_stack` and gets rid of `shadow_stack`. Following are the changes in this patch - Defines an asm macro to obtain per-cpu symbols in destination register. - In entry.S, when overflow is detected, per-cpu overflow stack is located using per-cpu asm macro. Computing per-cpu symbol requires a temporary register. x31 is saved away into CSR_SCRATCH (CSR_SCRATCH is anyways zero since we're in kernel). Please see Links for additional relevant disccussion and alternative solution. Tested by `echo EXHAUST_STACK > /sys/kernel/debug/provoke-crash/DIRECT` Kernel crash log below Insufficient stack space to handle exception!/debug/provoke-crash/DIRECT Task stack: [0xff20000010a98000..0xff20000010a9c000] Overflow stack: [0xff600001f7d98370..0xff600001f7d99370] CPU: 1 PID: 205 Comm: bash Not tainted 6.1.0-rc2-00001-g328a1f96f7b9 #34 Hardware name: riscv-virtio,qemu (DT) epc : __memset+0x60/0xfc ra : recursive_loop+0x48/0xc6 [lkdtm] epc : ffffffff808de0e4 ra : ffffffff0163a752 sp : ff20000010a97e80 gp : ffffffff815c0330 tp : ff600000820ea280 t0 : ff20000010a97e88 t1 : 000000000000002e t2 : 3233206874706564 s0 : ff20000010a982b0 s1 : 0000000000000012 a0 : ff20000010a97e88 a1 : 0000000000000000 a2 : 0000000000000400 a3 : ff20000010a98288 a4 : 0000000000000000 a5 : 0000000000000000 a6 : fffffffffffe43f0 a7 : 00007fffffffffff s2 : ff20000010a97e88 s3 : ffffffff01644680 s4 : ff20000010a9be90 s5 : ff600000842ba6c0 s6 : 00aaaaaac29e42b0 s7 : 00fffffff0aa3684 s8 : 00aaaaaac2978040 s9 : 0000000000000065 s10: 00ffffff8a7cad10 s11: 00ffffff8a76a4e0 t3 : ffffffff815dbaf4 t4 : ffffffff815dbaf4 t5 : ffffffff815dbab8 t6 : ff20000010a9bb48 status: 0000000200000120 badaddr: ff20000010a97e88 cause: 000000000000000f Kernel panic - not syncing: Kernel stack overflow CPU: 1 PID: 205 Comm: bash Not tainted 6.1.0-rc2-00001-g328a1f96f7b9 #34 Hardware name: riscv-virtio,qemu (DT) Call Trace: [] dump_backtrace+0x30/0x38 [] show_stack+0x40/0x4c [] dump_stack_lvl+0x44/0x5c [] dump_stack+0x18/0x20 [] panic+0x126/0x2fe [] walk_stackframe+0x0/0xf0 [] recursive_loop+0x48/0xc6 [lkdtm] SMP: stopping secondary CPUs ---[ end Kernel panic - not syncing: Kernel stack overflow ]--- Cc: Guo Ren Cc: Jisheng Zhang Link: https://lore.kernel.org/linux-riscv/Y347B0x4VUNOd6V7@xhacker/T/#t Link: https://lore.kernel.org/lkml/20221124094845.1907443-1-debug@rivosinc.com/ Signed-off-by: Deepak Gupta Co-developed-by: Sami Tolvanen Signed-off-by: Sami Tolvanen Acked-by: Guo Ren Tested-by: Nathan Chancellor Link: https://lore.kernel.org/r/20230927224757.1154247-9-samitolvanen@google.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/asm-prototypes.h | 1 - arch/riscv/include/asm/asm.h | 22 +++++++++++ arch/riscv/include/asm/thread_info.h | 3 -- arch/riscv/kernel/asm-offsets.c | 1 + arch/riscv/kernel/entry.S | 70 +++++---------------------------- arch/riscv/kernel/traps.c | 36 +---------------- 6 files changed, 34 insertions(+), 99 deletions(-) commit 88862247ce8090da001d310152899644ec6597d9 Author: Geert Uytterhoeven Date: Wed Oct 25 12:05:21 2023 +0200 of: overlay: unittest: overlay_bad_unresolved: Spelling s/ok/okay/ While "ok" is recognized, the proper status value for an operational device is "okay". Fixes: eb38b9529aefa344 ("of: overlay: unittest: Add test for unresolved symbol") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/923f4f605b86f23d001c6efc9c2237ab449d447d.1698228277.git.geert+renesas@glider.be Signed-off-by: Rob Herring drivers/of/unittest-data/overlay_bad_unresolved.dtso | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 73ae308801a89f273cd888b4f5be5726a747c842 Author: Rob Herring Date: Thu Oct 26 08:53:59 2023 -0500 of: address: Consolidate bus .map() functions The bus .map() functions vary only by checking the flag cells values and skipping over any flag cells to read the addresses. Otherwise they all do the same reading 'ranges' address and size and returning the address's offset if it is within the 'ranges' entry. Refactor all the .map() functions to pass in the flag cell size so that each bus can check the bus specific flags and then call a common function to do everything else. Acked-by: Herve Codina Link: https://lore.kernel.org/r/20231026135358.3564307-3-robh@kernel.org Signed-off-by: Rob Herring drivers/of/address.c | 54 +++++++++++----------------------------------------- 1 file changed, 11 insertions(+), 43 deletions(-) commit 88696db08b7efa3b6bb722014ea7429e78f6be32 Author: Rob Herring Date: Thu Oct 26 08:53:58 2023 -0500 of: address: Store number of bus flag cells rather than bool It is more useful to know how many flags cells a bus has rather than whether a bus has flags or not as ultimately the number of cells is the information used. Replace 'has_flags' boolean with 'flag_cells' count. Acked-by: Herve Codina Link: https://lore.kernel.org/r/20231026135358.3564307-2-robh@kernel.org Signed-off-by: Rob Herring drivers/of/address.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) commit 4d9ec5f04bad67abdbbd036801edba37e642f87d Author: Herve Codina Date: Tue Oct 17 13:02:18 2023 +0200 of: unittest: Add tests for address translations Add tests to exercise address translations based on ranges properties. Tests added cover "default" (2cell) address translations, "default flags" (3cell) address translations and PCI address translations. They also cover PCI BAR translations introduced in commit 407d1a51921e ("PCI: Create device tree node for bridge"). Signed-off-by: Herve Codina Link: https://lore.kernel.org/r/20231017110221.189299-4-herve.codina@bootlin.com Signed-off-by: Rob Herring drivers/of/unittest-data/tests-address.dtsi | 101 ++++++++++++++++++++++++++++ drivers/of/unittest.c | 77 +++++++++++++++++++++ 2 files changed, 178 insertions(+) commit bdb7e1922052b1e7fcce63e2cfa195958ff97e05 Merge: 0262a8a07989 805ce81826c8 Author: Mark Brown Date: Fri Oct 27 22:33:15 2023 +0100 ASoC: Merge up workaround for CODECs that play noise on stopped stream This was sent too late to actually make it for v6.6 but was sent against v6.6 so merge it up here. commit fc62d5e214df2dd64f5d675f01b609d86a422a2b Author: Andy Shevchenko Date: Tue Oct 10 17:11:23 2023 +0300 hte: Use kasprintf() instead of fixed buffer formatting Improve readability and maintainability by replacing a hardcoded string allocation and formatting by the use of the kasprintf() helper. Signed-off-by: Andy Shevchenko Reviewed-by: Dipen Patel Signed-off-by: Dipen Patel drivers/hte/hte.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) commit b7c3ca3553d1de5e86c85636828e186d30cd0628 Author: Harshit Mogalapalli Date: Thu Oct 26 00:53:28 2023 -0700 hte: tegra: Fix missing error code in tegra_hte_test_probe() The value of 'ret' is zero when of_hte_req_count() fails to get number of entitties to timestamp. And returning success(zero) on this failure path is incorrect. Fixes: 9a75a7cd03c9 ("hte: Add Tegra HTE test driver") Signed-off-by: Harshit Mogalapalli Reviewed-by: Dipen Patel Signed-off-by: Dipen Patel drivers/hte/hte-tegra194-test.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit fad505b2cb838fb52cb72fa22830824c80330f2f Author: Mingwei Zhang Date: Mon Oct 2 04:08:39 2023 +0000 KVM: x86: Service NMI requests after PMI requests in VM-Enter path Service NMI and SMI requests after PMI requests in vcpu_enter_guest() so that KVM does not need to cancel and redo the VM-Enter if the guest configures its PMIs to be delivered as NMIs (likely) or SMIs (unlikely). Because APIC emulation "injects" NMIs via KVM_REQ_NMI, handling PMI requests after NMI requests (the likely case) means KVM won't detect the pending NMI request until the final check for outstanding requests. Detecting requests at the final stage is costly as KVM has already loaded guest state, potentially queued events for injection, disabled IRQs, dropped SRCU, etc., most of which needs to be unwound. Note that changing the order of request processing doesn't change the end result, as KVM's final check for outstanding requests prevents entering the guest until all requests are serviced. I.e. KVM will ultimately coalesce events (or not) regardless of the ordering. Using SPEC2017 benchmark programs running along with Intel vtune in a VM demonstrates that the following code change reduces 800~1500 canceled VM-Enters per second. Some glory details: Probe the invocation to vmx_cancel_injection(): $ perf probe -a vmx_cancel_injection $ perf stat -a -e probe:vmx_cancel_injection -I 10000 # per 10 seconds Partial results when SPEC2017 with Intel vtune are running in the VM: On kernel without the change: 10.010018010 14254 probe:vmx_cancel_injection 20.037646388 15207 probe:vmx_cancel_injection 30.078739816 15261 probe:vmx_cancel_injection 40.114033258 15085 probe:vmx_cancel_injection 50.149297460 15112 probe:vmx_cancel_injection 60.185103088 15104 probe:vmx_cancel_injection On kernel with the change: 10.003595390 40 probe:vmx_cancel_injection 20.017855682 31 probe:vmx_cancel_injection 30.028355883 34 probe:vmx_cancel_injection 40.038686298 31 probe:vmx_cancel_injection 50.048795162 20 probe:vmx_cancel_injection 60.069057747 19 probe:vmx_cancel_injection Suggested-by: Sean Christopherson Signed-off-by: Mingwei Zhang Link: https://lore.kernel.org/r/20231002040839.2630027-1-mizhang@google.com [sean: hoist PMU/PMI above SMI too, massage changelog] Signed-off-by: Sean Christopherson arch/x86/kvm/x86.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 0262a8a079896440fab98844124a951d85b63166 Merge: bd0f7498bc90 d933333694a7 Author: Mark Brown Date: Fri Oct 27 21:07:18 2023 +0100 ASoC: Intel: avs: Add support for rt5514 codec Merge series from Amadeusz Sławiński : There are machines which use codec rt5514 as DMIC, add support for them. commit 8f61d48c83f6e3525a770e44692604595693f787 Author: Vishal Verma Date: Thu Oct 26 11:32:41 2023 -0600 tools/testing/cxl: Slow down the mock firmware transfer The cxl-cli unit test for firmware update does operations like starting an asynchronous firmware update, making sure it is in progress, and attempting to cancel it. In some cases, such as with no or minimal dynamic debugging turned on, the firmware update completes too quickly, not allowing the test to have a chance to verify it was in progress. This caused a failure of the signature: expected fw_update_in_progress:true test/cxl-update-firmware.sh: failed at line 88 Fix this by adding a delay (~1.5 - 2 ms) to each firmware transfer request handled by the mocked interface. Reported-by: Dan Williams Tested-by: Dan Williams Signed-off-by: Vishal Verma Link: https://lore.kernel.org/r/20231026-vv-fw_upd_test_fix-v2-1-5282fd193883@intel.com Signed-off-by: Dan Williams tools/testing/cxl/test/mem.c | 1 + 1 file changed, 1 insertion(+) commit 98a04c7aced2b43b3ac4befe216c4eecc7257d4b Author: Jim Harris Date: Thu Oct 26 10:09:06 2023 -0700 cxl/region: Fix x1 root-decoder granularity calculations Root decoder granularity must match value from CFWMS, which may not be the region's granularity for non-interleaved root decoders. So when calculating granularities for host bridge decoders, use the region's granularity instead of the root decoder's granularity to ensure the correct granularities are set for the host bridge decoders and any downstream switch decoders. Test configuration is 1 host bridge * 2 switches * 2 endpoints per switch. Region created with 2048 granularity using following command line: cxl create-region -m -d decoder0.0 -w 4 mem0 mem2 mem1 mem3 \ -g 2048 -s 2048M Use "cxl list -PDE | grep granularity" to get a view of the granularity set at each level of the topology. Before this patch: "interleave_granularity":2048, "interleave_granularity":2048, "interleave_granularity":512, "interleave_granularity":2048, "interleave_granularity":2048, "interleave_granularity":512, "interleave_granularity":256, After: "interleave_granularity":2048, "interleave_granularity":2048, "interleave_granularity":4096, "interleave_granularity":2048, "interleave_granularity":2048, "interleave_granularity":4096, "interleave_granularity":2048, Fixes: 27b3f8d13830 ("cxl/region: Program target lists") Cc: Signed-off-by: Jim Harris Link: https://lore.kernel.org/r/169824893473.1403938.16110924262989774582.stgit@bgt-140510-bm03.eng.stellus.in [djbw: fixup the prebuilt cxl_test region] Signed-off-by: Dan Williams drivers/cxl/core/region.c | 9 ++++++++- tools/testing/cxl/test/cxl.c | 2 +- 2 files changed, 9 insertions(+), 2 deletions(-) commit 3531b27f1f04a6bc9c95cf00d40efe618d57aa93 Author: Li Zhijian Date: Wed Oct 25 16:54:50 2023 +0800 cxl/region: Fix cxl_region_rwsem lock held when returning to user space Fix a missed "goto out" to unlock on error to cleanup this splat: WARNING: lock held when returning to user space! 6.6.0-rc3-lizhijian+ #213 Not tainted ------------------------------------------------ cxl/673 is leaving the kernel with locks still held! 1 lock held by cxl/673: #0: ffffffffa013b9d0 (cxl_region_rwsem){++++}-{3:3}, at: commit_store+0x7d/0x3e0 [cxl_core] In terms of user visible impact of this bug for backports: cxl_region_invalidate_memregion() on x86 invokes wbinvd which is a problematic instruction for virtualized environments. So, on virtualized x86, cxl_region_invalidate_memregion() returns an error. This failure case got missed because CXL memory-expander device passthrough is not a production use case, and emulation of CXL devices is typically limited to kernel development builds with CONFIG_CXL_REGION_INVALIDATION_TEST=y, that makes cxl_region_invalidate_memregion() succeed. In other words, the expected exposure of this bug is limited to CXL subsystem development environments using QEMU that neglected CONFIG_CXL_REGION_INVALIDATION_TEST=y. Fixes: d1257d098a5a ("cxl/region: Move cache invalidation before region teardown, and before setup") Signed-off-by: Li Zhijian Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/20231025085450.2514906-1-lizhijian@fujitsu.com Signed-off-by: Dan Williams drivers/cxl/core/region.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0cf36a85c1408f86a967fb1db721de1b89b9e675 Author: Alison Schofield Date: Wed Oct 25 13:01:34 2023 -0700 cxl/region: Use cxl_calc_interleave_pos() for auto-discovery For auto-discovered regions the driver must assign each target to a valid position in the region interleave set based on the decoder topology. The current implementation fails to parse valid decode topologies, as it does not consider the child offset into a parent port. The sort put all targets of one port ahead of another port when an interleave was expected, causing the region assembly to fail. Replace the existing relative sort with cxl_calc_interleave_pos() that finds the exact position in a region interleave for an endpoint based on a walk up the ancestral tree from endpoint to root decoder. cxl_calc_interleave_pos() was introduced in a prior patch, so the work here is to use it in cxl_region_sort_targets(). Remove the obsoleted helper functions from the prior sort. Testing passes on pre-production hardware with BIOS defined regions that natively trigger this autodiscovery path of the region driver. Testing passes a CXL unit test using the dev_dbg() calculation test (see cxl_region_attach()) across an expanded set of region configs: 1, 1, 1+1, 1+1+1, 2, 2+2, 2+2+2, 2+2+2+2, 4, 4+4, where each number represents the count of endpoints per host bridge. Fixes: a32320b71f08 ("cxl/region: Add region autodiscovery") Reported-by: Dmytro Adamenko Signed-off-by: Alison Schofield Reviewed-by: Dave Jiang Reviewed-by: Jim Harris Link: https://lore.kernel.org/r/3946cc55ddc19678733eddc9de2c317749f43f3b.1698263080.git.alison.schofield@intel.com Signed-off-by: Dan Williams drivers/cxl/core/region.c | 127 ++++++---------------------------------------- 1 file changed, 15 insertions(+), 112 deletions(-) commit a3e00c964fb943934af916f48f0dd43b5110c866 Author: Alison Schofield Date: Fri Oct 27 13:04:48 2023 -0700 cxl/region: Calculate a target position in a region interleave Introduce a calculation to find a target's position in a region interleave. Perform a self-test of the calculation on user-defined regions. The region driver uses the kernel sort() function to put region targets in relative order. Positions are assigned based on each target's index in that sorted list. That relative sort doesn't consider the offset of a port into its parent port which causes some auto-discovered regions to fail creation. In one failure case, a 2 + 2 config (2 host bridges each with 2 endpoints), the sort puts all the targets of one port ahead of another port when they were expected to be interleaved. In preparation for repairing the autodiscovery region assembly, introduce a new method for discovering a target position in the region interleave. cxl_calc_interleave_pos() adds a method to find the target position by ascending from an endpoint to a root decoder. The calculation starts with the endpoint's local position and position in the parent port. It traverses towards the root decoder and examines both position and ways in order to allow the position to be refined all the way to the root decoder. This calculation: position = position * parent_ways + parent_pos; applied iteratively yields the correct position. Include a self-test that exercises this new position calculation against every successfully configured user-defined region. Signed-off-by: Alison Schofield Link: https://lore.kernel.org/r/0ac32c75cf81dd8b86bf07d70ff139d33c2300bc.1698263080.git.alison.schofield@intel.com Signed-off-by: Dan Williams drivers/cxl/core/region.c | 127 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 127 insertions(+) commit 0dea4e30fedad73ce3223b4d3d546fafc1aa77a6 Merge: 0bb80ecc33a8 e0e6373d653b Author: Stephen Boyd Date: Fri Oct 27 12:21:17 2023 -0700 Merge tag 'qcom-clk-for-6.7' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clk driver updates from Bjorn Andersson: - Initial support for the SM4450 Global Clock Controller and RPMh clock controllers - Drop CLK_SET_RATE_PARENT for clocks with fixed-rate GPLLs across a variety of IPQ platforms - Add missing parent of APCS PLL on IPQ6018 - Add I2C QUP6 clk on IPQ6018 but mark it critical to avoid problems with RPM - Implement safe source switching for a53pll and use on IPQ5332 - Add support for Stromer Plus PLLs - Switch SM8550 Video and GPU clock controllers to use OLE PLL configure method - Non critical fixes to halt bit checks - Add SMMU GDSC for MSM8998 - Fix possible integer overflow in RCG frequency calculation code - Remove RPM managed clks from MSM8996 GCC driver - Add Camera Clock Controller on SM8550 - Add HFPLL configuration for the three HFPLLs in MSM8976 - Switch MSM8996 CBF clock driver's remove function to return void * tag 'qcom-clk-for-6.7' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (36 commits) clk: qcom: apss-ipq6018: add the GPLL0 clock also as clock provider clk: qcom: ipq5332: drop the CLK_SET_RATE_PARENT flag from GPLL clocks clk: qcom: ipq9574: drop the CLK_SET_RATE_PARENT flag from GPLL clocks clk: qcom: ipq5018: drop the CLK_SET_RATE_PARENT flag from GPLL clocks clk: qcom: ipq6018: drop the CLK_SET_RATE_PARENT flag from PLL clocks clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT flag from PLL clocks clk: qcom: gcc-ipq6018: add QUP6 I2C clock clk: qcom: apss-ipq6018: ipq5332: add safe source switch for a53pll clk: qcom: apss-ipq-pll: Fix 'l' value for ipq5332_pll_config clk: qcom: apss-ipq-pll: Use stromer plus ops for stromer plus pll clk: qcom: clk-alpha-pll: introduce stromer plus ops clk: qcom: config IPQ_APSS_6018 should depend on QCOM_SMEM clk: qcom: videocc-sm8550: switch to clk_lucid_ole_pll_configure clk: qcom: gpucc-sm8550: switch to clk_lucid_ole_pll_configure clk: qcom: Replace of_device.h with explicit includes clk: qcom: smd-rpm: Move CPUSS_GNoC clock to interconnect clk: qcom: cbf-msm8996: Convert to platform remove callback returning void clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src clk: qcom: Add GCC driver support for SM4450 dt-bindings: clock: qcom: Add GCC clocks for SM4450 ... commit 7e52b1164a474dc7b90f68fbb40e35ccd7f7e2e2 Author: Marek Vasut Date: Fri Oct 27 10:58:24 2023 +0200 clk: si521xx: Increase stack based print buffer size in probe Increase the size of temporary print buffer on stack to fix the following warnings reported by LKP. Since all the input parameters of snprintf() are under control of this driver, it is not possible to trigger and overflow here, but since the print buffer is on stack and discarded once driver probe() finishes, it is not an issue to increase it by 10 bytes and fix the warning in the process. Make it so. " drivers/clk/clk-si521xx.c: In function 'si521xx_probe': >> drivers/clk/clk-si521xx.c:318:26: warning: '%d' directive output may be truncated writing between 1 and 10 bytes into a region of size 2 [-Wformat-truncation=] snprintf(name, 6, "DIFF%d", i); ^~ drivers/clk/clk-si521xx.c:318:21: note: directive argument in the range [0, 2147483647] snprintf(name, 6, "DIFF%d", i); ^~~~~~~~ drivers/clk/clk-si521xx.c:318:3: note: 'snprintf' output between 6 and 15 bytes into a destination of size 6 snprintf(name, 6, "DIFF%d", i); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ " Fixes: edc12763a3a2 ("clk: si521xx: Clock driver for Skyworks Si521xx I2C PCIe clock generators") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202310260412.AGASjFN4-lkp@intel.com/ Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20231027085840.30098-1-marex@denx.de Signed-off-by: Stephen Boyd drivers/clk/clk-si521xx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit dd3dd9829bf9a4ecd55482050745efdd9f7f97fc Author: Umio Yasuno Date: Thu Oct 26 22:05:57 2023 +0000 drm/amdgpu: Remove unused variables from amdgpu_show_fdinfo Remove unused variables from amdgpu_show_fdinfo Reviewed-by: Christian König Signed-off-by: Umio Yasuno Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_fdinfo.c | 6 ------ 1 file changed, 6 deletions(-) commit e8e696c307c36ef2d5addb65fc3ba42d54ca2dbb Author: Rob Clark Date: Thu Oct 26 22:05:49 2023 +0000 drm/amdgpu: Remove duplicate fdinfo fields Some of the fields that are handled by drm_show_fdinfo() crept back in when rebasing the patch. Remove them again. Fixes: 376c25f8ca47 ("drm/amdgpu: Switch to fdinfo helper") Reviewed-by: Christian König Signed-off-by: Rob Clark Reviewed-by: Co-developed-by: Umio Yasuno Signed-off-by: Umio Yasuno Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_fdinfo.c | 3 --- 1 file changed, 3 deletions(-) commit f4febfdbb45ad2322a508d3d650b3af7c8286cb2 Merge: 8ceea12d183c c28ca80ba3b5 Author: Thomas Gleixner Date: Fri Oct 27 20:18:34 2023 +0200 Merge tag 'timers-v6.7-rc1' of https://git.linaro.org/people/daniel.lezcano/linux into timers/core Pull timer driver updates from Daniel Lezcano: - Fix DT bindings typos, readability and wrong information about underflow and overflow interrupts for the RZ/G2L MTU3a driver (Biju Das) - Fix a memory leak in the error path when probing the i.MX GPT timer (Jacky Bai) - Don't use clk_get_rate() in atomic context as the function might sleep. Store the clock and use notifiers to receive a clocke rate change notification (Ivaylo Dimitrov) - Remove superfluous error message when platform_get_irq() fails because the underlying function already prints one (Yang Li) - Add wakeup capability flag for the risc-V ACPI timer (Sunil V L) - Fix initialization of the TCB timers which are in cascade as the second timer is reset after the first wraps up leading to inconsistent scheduler behavior (Ronald Wahl) - Add DT bindings and driver for Cirrus Logic EP93xx (Nikita Shubin) commit 3ea8dd3758ba551f0e3999faefd5b0bb80cbf2f1 Author: Kenneth Feng Date: Tue Oct 24 11:20:27 2023 +0800 drm/amd/amdgpu: avoid to disable gfxhub interrupt when driver is unloaded avoid to disable gfxhub interrupt when driver is unloaded on gmc 11 Signed-off-by: Kenneth Feng Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 142262a1c02ad4d334ca1152dc4a0f6db3ef3bfc Author: David Francis Date: Thu Oct 12 10:35:20 2023 -0400 drm/amdgpu: Add EXT_COHERENT support for APU and NUMA systems On gfx943 APU, EXT_COHERENT should give MTYPE_CC for local and MTYPE_UC for nonlocal memory. On NUMA systems, local memory gets the local mtype, set by an override callback. If EXT_COHERENT is set, memory will be set as MTYPE_UC by default, with local memory MTYPE_CC. Add an option in the override function for this case, and add a check to ensure it is not used on UNCACHED memory. V2: Combined APU and NUMA code into one patch V3: Fixed a potential nullptr in amdgpu_vm_bo_update Signed-off-by: David Francis Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 17 ++++++++++------ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 8 +++++++- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 2 +- drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 33 ++++++++++++++++++++----------- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 8 ++++---- 5 files changed, 45 insertions(+), 23 deletions(-) commit a395f7ffcebe59477d80f049889cb652d80db040 Author: Candice Li Date: Thu Oct 26 12:28:15 2023 +0800 drm/amdgpu: Retrieve CE count from ce_count_lo_chip in EccInfo table Retrieve correctable error count from ce_count_lo_chip instead of mca_umc_status. Signed-off-by: Candice Li Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/umc_v8_10.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) commit d59fcfb0848b49d5efc62079d3aad4bbaf760aa1 Author: Candice Li Date: Wed Oct 25 17:27:16 2023 +0800 drm/amdgpu: Identify data parity error corrected in replay mode Use ErrorCodeExt field to identify data parity error in replay mode. Signed-off-by: Candice Li Reviewed-by: Tao Zhou Reviewed-by: Yang Wang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/umc_v12_0.c | 32 +++++++++++++++++++++++--------- 1 file changed, 23 insertions(+), 9 deletions(-) commit f7a17b2b36043a4cc9e2d0b0eea7647133f78b13 Author: Mukul Joshi Date: Thu Oct 26 13:52:23 2023 -0400 drm/amdgpu: Fix typo in IP discovery parsing Fix a typo in parsing of the GC info table header when reading the IP discovery table. Fixes: 0e64c9aad031 ("drm/amdgpu: add type conversion for gc info") Signed-off-by: Mukul Joshi Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1efdd37cc015ed1cade8c1c12227ad25ebb17c77 Author: Hamza Mahfooz Date: Thu Oct 26 11:50:45 2023 -0400 drm/amd/display: fix S/G display enablement An assignment statement was reversed during a refactor which effectively disabled S/G display outright. Since, we use adev->mode_info.gpu_vm_support to indicate to the rest of the driver that S/G display should be enabled and currently it is always set to false. So, to fix this set adev->mode_info.gpu_vm_support's value to that of init_data.flags.gpu_vm_support (and not vice versa). Fixes: 098c13079c6f ("drm/amd/display: enable S/G display for for recent APUs by default") Reported-by: Mark Broadworth Tested-by: Mark Broadworth Acked-by: Alex Deucher Reviewed-by: Harry Wentland Reviewed-by: Yifan Zhang Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 565fe150624ee77dc63a735cc1b3bff5101f38a3 Author: Linus Walleij Date: Fri Oct 20 22:30:29 2023 +0200 mtd: cfi_cmdset_0001: Byte swap OTP info Currently the offset into the device when looking for OTP bits can go outside of the address of the MTD NOR devices, and if that memory isn't readable, bad things happen on the IXP4xx (added prints that illustrate the problem before the crash): cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x00000100 ixp4xx_copy_from copy from 0x00000100 to 0xc880dd78 cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x12000000 ixp4xx_copy_from copy from 0x12000000 to 0xc880dd78 8<--- cut here --- Unable to handle kernel paging request at virtual address db000000 [db000000] *pgd=00000000 (...) This happens in this case because the IXP4xx is big endian and the 32- and 16-bit fields in the struct cfi_intelext_otpinfo are not properly byteswapped. Compare to how the code in read_pri_intelext() byteswaps the fields in struct cfi_pri_intelext. Adding a small byte swapping loop for the OTP in read_pri_intelext() and the crash goes away. The problem went unnoticed for many years until I enabled CONFIG_MTD_OTP on the IXP4xx as well, triggering the bug. Cc: stable@vger.kernel.org Reviewed-by: Nicolas Pitre Signed-off-by: Linus Walleij Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20231020-mtd-otp-byteswap-v4-1-0d132c06aa9d@linaro.org drivers/mtd/chips/cfi_cmdset_0001.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) commit 5a985960a4dd041c21dbe9956958c1633d2da706 Author: Yi Yang Date: Thu Oct 19 06:55:48 2023 +0000 mtd: rawnand: meson: check return value of devm_kasprintf() devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Fixes: 1e4d3ba66888 ("mtd: rawnand: meson: fix the clock") Signed-off-by: Yi Yang Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20231019065548.318443-1-yiyang13@huawei.com drivers/mtd/nand/raw/meson_nand.c | 3 +++ 1 file changed, 3 insertions(+) commit 74ac5b5e2375f1e8ef797ac7770887e9969f2516 Author: Yi Yang Date: Thu Oct 19 06:55:37 2023 +0000 mtd: rawnand: intel: check return value of devm_kasprintf() devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Fixes: 0b1039f016e8 ("mtd: rawnand: Add NAND controller support on Intel LGM SoC") Signed-off-by: Yi Yang Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20231019065537.318391-1-yiyang13@huawei.com drivers/mtd/nand/raw/intel-nand-controller.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 60ec53ace2cb8a6f5678af1ea614f8582e32c081 Author: Uwe Kleine-König Date: Mon Oct 16 12:35:41 2023 +0200 mtd: rawnand: sh_flctl: Convert to module_platform_driver() The driver doesn't benefit from the advantages that module_platform_driver_probe() allows (i.e. putting the probe function in .init.text and the .remove function into .exit.text). So use module_platform_driver() instead which allows to bind the driver also after booting (or module loading) and unbinding via sysfs. Signed-off-by: Uwe Kleine-König Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20231016103540.1566865-2-u.kleine-koenig@pengutronix.de drivers/mtd/nand/raw/sh_flctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 8388cba9d1eb5c54385ea624d2979983f356a596 Author: Mike Snitzer Date: Thu Oct 26 13:02:31 2023 -0400 MAINTAINERS: add Mikulas Patocka as a DM maintainer Mikulas is a long-time contributor to the DM subsystem and has effectively been a shadow DM maintainer. It is time to formally name Mikulas as a DM maintainer. In practice this doesn't imply any process changes for DM maintenance (Mikulas can still just feed changes and contribute review like normal). This change does allow the possibility for Mikulas to take on more responsibility in actually sending DM changes upstream. Signed-off-by: Mike Snitzer MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit 6f25dd1c57b8ba92d899eae4eda16573a2f78ffc Author: Mike Snitzer Date: Wed Oct 25 19:29:03 2023 -0400 dm: respect REQ_NOWAIT flag in normal bios issued to DM Update DM core's normal IO submission to allocate required memory using GFP_NOWAIT if REQ_NOWAIT is set. Tested with simple test provided in commit a9ce385344f916 ("dm: don't attempt to queue IO under RCU protection") that was enhanced to check error codes. Also tested using fio's pvsync2 with nowait=1. But testing with induced GFP_NOWAIT allocation failures wasn't performed (yet). Signed-off-by: Mike Snitzer drivers/md/dm.c | 40 +++++++++++++++++++++++++++++----------- 1 file changed, 29 insertions(+), 11 deletions(-) commit 4a2fe2960891f1ccd7805d0973284fd44c2f12b4 Author: Mike Snitzer Date: Fri Oct 27 11:29:36 2023 -0400 dm: enhance alloc_multiple_bios() to be more versatile alloc_multiple_bios() has the useful ability to try allocating bios with GFP_NOWAIT but will fallback to using GFP_NOIO. The callers service both empty flush bios and abnormal bios (e.g. discard). alloc_multiple_bios() enhancements offered in this commit: - don't require table_devices_lock if num_bios = 1 - allow caller to pass GFP_NOWAIT to do usual GFP_NOWAIT with GFP_NOIO fallback - allow caller to pass GFP_NOIO to _only_ allocate using GFP_NOIO Flush bios with data may be issued to DM with REQ_NOWAIT, as such it makes sense to attempt servicing them with GFP_NOWAIT allocations. But abnormal IO should never be issued using REQ_NOWAIT (if that changes in the future that's fine, but no sense supporting it now). While at it, rename __send_changing_extent_only() to __send_abnormal_io(). [Thanks to both Ming and Mikulas for help with translating known possible IO scenarios to requirements.] Suggested-by: Ming Lei Suggested-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm.c | 68 ++++++++++++++++++++++++++++----------------------------- 1 file changed, 34 insertions(+), 34 deletions(-) commit 805ce81826c896dd3c351a32814b28557f9edf54 Author: Srinivas Kandagatla Date: Fri Oct 27 11:57:47 2023 +0100 ASoC: codecs: wsa883x: make use of new mute_unmute_on_trigger flag In the current setup the PA is left unmuted even when the Soundwire ports are not started streaming. This can lead to click and pop sounds during start. There is a same issue in the reverse order where in the PA is left unmute even after the data stream is stopped, the time between data stream stopping and port closing is long enough to accumulate DC on the line resulting in Click/Pop noise during end of stream. making use of new mute_unmute_on_trigger flag is helping a lot with this Click/Pop issues reported on this Codec Signed-off-by: Srinivas Kandagatla Tested-by: Johan Hovold Link: https://lore.kernel.org/r/20231027105747.32450-3-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/wsa883x.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit f0220575e65abe09c09cd17826a3cdea76e8d58f Author: Srinivas Kandagatla Date: Fri Oct 27 11:57:46 2023 +0100 ASoC: soc-dai: add flag to mute and unmute stream during trigger In some setups like Speaker amps which are very sensitive, ex: keeping them unmute without actual data stream for very short duration results in a static charge and results in pop and clicks. To minimize this, provide a way to mute and unmute such codecs during trigger callbacks. Signed-off-by: Srinivas Kandagatla Tested-by: Johan Hovold Link: https://lore.kernel.org/r/20231027105747.32450-2-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown include/sound/soc-dai.h | 1 + sound/soc/soc-dai.c | 7 +++++++ sound/soc/soc-pcm.c | 12 ++++++++---- 3 files changed, 16 insertions(+), 4 deletions(-) commit 804bf07a1f726d4fe391d21b24a68ffc2381ba89 Author: Naresh Solanki Date: Fri Oct 27 15:28:29 2023 +0000 regulator (max5970): Remove duplicate line Remove redundant/duplicate line. Signed-off-by: Naresh Solanki Link: https://lore.kernel.org/r/20231027152830.1269895-2-naresh.solanki@9elements.com Signed-off-by: Mark Brown drivers/regulator/max5970-regulator.c | 1 - 1 file changed, 1 deletion(-) commit f5afdd13ed6c643c7243e685fe3cf5484b3fdfae Author: Naresh Solanki Date: Fri Oct 27 15:28:28 2023 +0000 regulator (max5970): Add hwmon support Utilize the integrated 10-bit ADC in Max5970/Max5978 to enable voltage and current monitoring. This feature is seamlessly integrated through the hwmon subsystem. Signed-off-by: Naresh Solanki Acked-by: Guenter Roeck Link: https://lore.kernel.org/r/20231027152830.1269895-1-naresh.solanki@9elements.com Signed-off-by: Mark Brown drivers/regulator/max5970-regulator.c | 144 +++++++++++++++++++++++++++++++++- 1 file changed, 143 insertions(+), 1 deletion(-) commit bd0f7498bc9084d8cccc5484cd004b40f314b763 Author: Kuninori Morimoto Date: Fri Oct 27 00:09:56 2023 +0000 ASoC: ams-delta.c: use component after check static void cx81801_close() { ... (A) struct snd_soc_dapm_context *dapm = &component->card->dapm; ... (B) if (!component) return; } (A) uses component before NULL check (B). This patch moves it after (B). Fixes: d0fdfe34080c ("ASoC: cx20442: replace codec to component") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/3e608474-e99a-4866-ae98-3054a4221f09@moroto.mountain Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87ttqdq623.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown sound/soc/ti/ams-delta.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit a65cdffbef7bfdb9f55a3acb07ccf18d4f97b3a5 Author: Arnd Bergmann Date: Fri Oct 27 17:23:54 2023 +0200 ASoC: amd: acp: select SND_SOC_AMD_ACP_LEGACY_COMMON for ACP63 Without this dependency, acp63 fails to link: x86_64-linux-ld: sound/soc/amd/acp/acp63.o: in function `acp63_audio_remove': acp63.c:(.text+0x22): undefined reference to `acp_disable_interrupts' x86_64-linux-ld: sound/soc/amd/acp/acp63.o: in function `acp63_i2s_master_clock_generate.isra.0': acp63.c:(.text+0x6f): undefined reference to `smn_read' x86_64-linux-ld: acp63.c:(.text+0x81): undefined reference to `smn_write' x86_64-linux-ld: acp63.c:(.text+0x8e): undefined reference to `smn_read' x86_64-linux-ld: sound/soc/amd/acp/acp63.o: in function `acp63_pcm_resume': acp63.c:(.text+0x230): undefined reference to `restore_acp_i2s_params' x86_64-linux-ld: acp63.c:(.text+0x23d): undefined reference to `restore_acp_pdm_params' x86_64-linux-ld: sound/soc/amd/acp/acp63.o: in function `acp63_audio_probe': acp63.c:(.text+0x474): undefined reference to `acp_enable_interrupts' Fixes: d4c2d5391d7e ("ASoC: amd: acp: add Kconfig options for acp6.3 based platform driver") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20231027152403.386257-3-arnd@kernel.org Signed-off-by: Mark Brown sound/soc/amd/acp/Kconfig | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) commit cf046ecbcd1cd0ef1d762b3365b9918175e121ab Author: Arnd Bergmann Date: Fri Oct 27 17:23:53 2023 +0200 ASoC: codecs: aw88399: fix typo in Kconfig select The aw88395_lib module is shared by all the aw883* drivers that need to select the corresponding Kconfig symbol. The newly added aw88399 incorrectly selects SND_SOC_AW88399_LIB instead, which is not defined anywhere in the kernel, causing a link failure when the actual one is missing: arm-linux-gnueabi-ld: sound/soc/codecs/aw88399.o: in function `aw88399_codec_probe': aw88399.c:(.text+0xbc6): undefined reference to `aw88395_dev_load_acf_check' arm-linux-gnueabi-ld: aw88399.c:(.text+0xbea): undefined reference to `aw88395_dev_cfg_load' Fixes: 8ade6cc7e261 ("ASoC: codecs: Add aw88399 amplifier driver") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20231027152403.386257-2-arnd@kernel.org Signed-off-by: Mark Brown sound/soc/codecs/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0b38362018c79bc6cf9d8ba4ee9a2a3827ba6328 Author: Arnd Bergmann Date: Fri Oct 27 17:23:52 2023 +0200 ASoC: amd: acp: add ACPI dependency A newly added function requires CONFIG_ACPI to avoid a build error: sound/soc/amd/acp/acp-legacy-common.c: In function 'check_acp_pdm': sound/soc/amd/acp/acp-legacy-common.c:401:19: error: implicit declaration of function 'acpi_find_child_device'; did you mean 'acpi_match_device'? [-Werror=implicit-function-declaration] 401 | pdm_dev = acpi_find_child_device(ACPI_COMPANION(&pci->dev), pdm_addr, 0); | ^~~~~~~~~~~~~~~~~~~~~~ | acpi_match_device The acp drivers really only work when ACPI is enabled already, so just avoid the build failure with hard dependency in everything that enables the acp-legacy-common portion. Fixes: 3a94c8ad0aae ("ASoC: amd: acp: add code for scanning acp pdm controller") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20231027152403.386257-1-arnd@kernel.org Signed-off-by: Mark Brown sound/soc/amd/acp/Kconfig | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit d933333694a7e63b0893d23f65b104430a1d6cf6 Author: Amadeusz Sławiński Date: Fri Oct 27 13:05:37 2023 +0200 ASoC: Intel: avs: Add rt5514 machine board In order to support Eve chromebooks add rt5514 configuration to board lookup table. rt5514 is used for capture in DMIC configuration on SSP 0 and TDM 1. Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20231027110537.2103712-3-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown sound/soc/intel/avs/board_selection.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 8b78fbf7bffac4f7b1b747fbce45ac32f530c96e Author: Amadeusz Sławiński Date: Fri Oct 27 13:05:36 2023 +0200 ASoC: Intel: avs: Add rt5514 machine board To support AVS-rt5514 configuration add machine board connecting AVS platform component driver with rt5514 codec one. Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20231027110537.2103712-2-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown sound/soc/intel/avs/boards/Kconfig | 10 ++ sound/soc/intel/avs/boards/Makefile | 2 + sound/soc/intel/avs/boards/rt5514.c | 187 ++++++++++++++++++++++++++++++++++++ 3 files changed, 199 insertions(+) commit 3a04927f8d4b7a4f008f04af41e31173002eb1ea Author: Kuniyuki Iwashima Date: Thu Oct 26 14:23:05 2023 -0700 af_unix: Remove module remnants. Since commit 97154bcf4d1b ("af_unix: Kconfig: make CONFIG_UNIX bool"), af_unix.c is no longer built as module. Let's remove unnecessary #if condition, exitcall, and module macros. Signed-off-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20231026212305.45545-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski net/unix/af_unix.c | 23 ++++------------------- 1 file changed, 4 insertions(+), 19 deletions(-) commit f12f8f84509a084399444c4422661345a15cc713 Author: Mickaël Salaün Date: Fri Oct 27 17:46:15 2023 +0200 selftests/landlock: Add tests for FS topology changes with network rules Add 2 tests to the layout1 fixture: * topology_changes_with_net_only: Checks that FS topology changes are not denied by network-only restrictions. * topology_changes_with_net_and_fs: Make sure that FS topology changes are still denied with FS and network restrictions. This specifically test commit d7220364039f ("landlock: Allow FS topology changes for domains without such rule type"). Cc: Konstantin Meskhidze Link: https://lore.kernel.org/r/20231027154615.815134-1-mic@digikod.net Signed-off-by: Mickaël Salaün tools/testing/selftests/landlock/fs_test.c | 59 ++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) commit 14da0d2570eb08e9ab9d2162ddb6f70127e4491c Merge: 79fa29570bd3 629b35a225b0 Author: Jakub Kicinski Date: Fri Oct 27 08:47:30 2023 -0700 Merge branch 'mptcp-fixes-and-cleanup-for-v6-7' Mat Martineau says: ==================== mptcp: Fixes and cleanup for v6.7 This series includes three initial patches that we had queued in our mptcp-net branch, but given the likely timing of net/net-next syncs this week, the need to avoid introducing branch conflicts, and another batch of net-next patches pending in the mptcp tree, the most practical route is to send everything for net-next. Patches 1 & 2 fix some intermittent selftest failures by adjusting timing. Patch 3 removes an unneccessary userspace path manager restriction on the removal of subflows with subflow ID 0. The remainder of the patches are all cleanup or selftest changes: Patches 4-8 clean up kernel code by removing unused parameters, making more consistent use of existing helper functions, and reducing extra casting of socket pointers. Patch 9 removes an unused variable in a selftest script. Patch 10 adds a little more detail to some mptcp_join test output. ==================== Link: https://lore.kernel.org/r/20231025-send-net-next-20231025-v1-0-db8f25f798eb@kernel.org Signed-off-by: Jakub Kicinski commit 629b35a225b0d49fbcff3b5c22e3b983c7c7b36f Author: Geliang Tang Date: Wed Oct 25 16:37:11 2023 -0700 selftests: mptcp: display simult in extra_msg Just like displaying "invert" after "Info: ", "simult" should be displayed too when rm_subflow_nr doesn't match the expect value in chk_rm_nr(): syn [ ok ] synack [ ok ] ack [ ok ] add [ ok ] echo [ ok ] rm [ ok ] rmsf [ ok ] 3 in [2:4] Info: invert simult syn [ ok ] synack [ ok ] ack [ ok ] add [ ok ] echo [ ok ] rm [ ok ] rmsf [ ok ] Info: invert Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20231025-send-net-next-20231025-v1-10-db8f25f798eb@kernel.org Signed-off-by: Jakub Kicinski tools/testing/selftests/net/mptcp/mptcp_join.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit e71aab6777a4f906149d0b5f12507fad5e164b3b Author: Geliang Tang Date: Wed Oct 25 16:37:10 2023 -0700 selftests: mptcp: sockopt: drop mptcp_connect var Global var mptcp_connect defined at the front of mptcp_sockopt.sh is duplicate with local var mptcp_connect defined in do_transfer(), drop this useless global one. Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20231025-send-net-next-20231025-v1-9-db8f25f798eb@kernel.org Signed-off-by: Jakub Kicinski tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 1 - 1 file changed, 1 deletion(-) commit 14cb0e0bf39bd10429ba14e9e2f905f1144226fc Author: Geliang Tang Date: Wed Oct 25 16:37:09 2023 -0700 mptcp: define more local variables sk '(struct sock *)msk' is used several times in mptcp_nl_cmd_announce(), mptcp_nl_cmd_remove() or mptcp_userspace_pm_set_flags() in pm_userspace.c, it's worth adding a local variable sk to point it. Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20231025-send-net-next-20231025-v1-8-db8f25f798eb@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm_userspace.c | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-) commit a6c85fc61c088c7ef43ba81e80b48c263a80602a Author: Geliang Tang Date: Wed Oct 25 16:37:08 2023 -0700 mptcp: move sk assignment statement ahead If we move the sk assignment statement ahead in mptcp_nl_cmd_sf_create() or mptcp_nl_cmd_sf_destroy(), right after the msk null-check statements, sk can be used after the create_err or destroy_err labels instead of open-coding it again. Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20231025-send-net-next-20231025-v1-7-db8f25f798eb@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm_userspace.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit a16c054b527bbaed611fef03e8b19e111a1769ef Author: Geliang Tang Date: Wed Oct 25 16:37:07 2023 -0700 mptcp: use mptcp_get_ext helper Use mptcp_get_ext() helper defined in protocol.h instead of open-coding it in mptcp_sendmsg_frag(). Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20231025-send-net-next-20231025-v1-6-db8f25f798eb@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/protocol.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 83d580ddbe1b3297c346b24070c23fcf6698393c Author: Geliang Tang Date: Wed Oct 25 16:37:06 2023 -0700 mptcp: use mptcp_check_fallback helper Use __mptcp_check_fallback() helper defined in net/mptcp/protocol.h, instead of open-coding it in both __mptcp_do_fallback() and mptcp_diag_fill_info(). Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20231025-send-net-next-20231025-v1-5-db8f25f798eb@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/protocol.h | 2 +- net/mptcp/sockopt.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 74cbb0c65b2963c1f1b51e2426cf0774ed828bc0 Author: Geliang Tang Date: Wed Oct 25 16:37:05 2023 -0700 mptcp: drop useless ssk in pm_subflow_check_next The code using 'ssk' parameter of mptcp_pm_subflow_check_next() has been dropped in commit "95d686517884 (mptcp: fix subflow accounting on close)". So drop this useless parameter ssk. Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20231025-send-net-next-20231025-v1-4-db8f25f798eb@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm.c | 2 +- net/mptcp/protocol.c | 2 +- net/mptcp/protocol.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit 84c531f54ad9a124a924c9505d74e33d16965146 Author: Geliang Tang Date: Wed Oct 25 16:37:04 2023 -0700 mptcp: userspace pm send RM_ADDR for ID 0 This patch adds the ability to send RM_ADDR for local ID 0. Check whether id 0 address is removed, if not, put id 0 into a removing list, pass it to mptcp_pm_remove_addr() to remove id 0 address. There is no reason not to allow the userspace to remove the initial address (ID 0). This special case was not taken into account not letting the userspace to delete all addresses as announced. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/379 Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20231025-send-net-next-20231025-v1-3-db8f25f798eb@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm_userspace.c | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) commit 9168ea02b898d3dde98b51e4bd3fb082bd438dab Author: Geliang Tang Date: Wed Oct 25 16:37:03 2023 -0700 selftests: mptcp: fix wait_rm_addr/sf parameters The second input parameter of 'wait_rm_addr/sf $1 1' is misused. If it's 1, wait_rm_addr/sf will never break, and will loop ten times, then 'wait_rm_addr/sf' equals to 'sleep 1'. This delay time is too long, which can sometimes make the tests fail. A better way to use wait_rm_addr/sf is to use rm_addr/sf_count to obtain the current value, and then pass into wait_rm_addr/sf. Fixes: 4369c198e599 ("selftests: mptcp: test userspace pm out of transfer") Cc: stable@vger.kernel.org Suggested-by: Matthieu Baerts Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20231025-send-net-next-20231025-v1-2-db8f25f798eb@kernel.org Signed-off-by: Jakub Kicinski tools/testing/selftests/net/mptcp/mptcp_join.sh | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) commit f4a75e9d11001481dca005541b6dc861e1472f03 Author: Geliang Tang Date: Wed Oct 25 16:37:02 2023 -0700 selftests: mptcp: run userspace pm tests slower Some userspace pm tests failed are reported by CI: 112 userspace pm add & remove address syn [ ok ] synack [ ok ] ack [ ok ] add [ ok ] echo [ ok ] mptcp_info subflows=1:1 [ ok ] subflows_total 2:2 [ ok ] mptcp_info add_addr_signal=1:1 [ ok ] rm [ ok ] rmsf [ ok ] Info: invert mptcp_info subflows=0:0 [ ok ] subflows_total 1:1 [fail] got subflows 0:0 expected 1:1 Server ns stats TcpPassiveOpens 2 0.0 TcpInSegs 118 0.0 This patch fixes them by changing 'speed' to 5 to run the tests much more slowly. Fixes: 4369c198e599 ("selftests: mptcp: test userspace pm out of transfer") Cc: stable@vger.kernel.org Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20231025-send-net-next-20231025-v1-1-db8f25f798eb@kernel.org Signed-off-by: Jakub Kicinski tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 216da5ebb83a13caece8032ee443acfd6a6083b6 Merge: 56185e024952 f9010eb938be Author: Arnd Bergmann Date: Fri Oct 27 17:28:10 2023 +0200 Merge tag 'ti-k3-config-for-v6.7' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/defconfig TI K3 defconfig updates Enable TPS6593 PMIC driver as module to support PMIC on AM62A SK board * tag 'ti-k3-config-for-v6.7' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: arm64: defconfig: Enable TPS6593 PMIC for SK-AM62A Link: https://lore.kernel.org/r/9c820e96-21e4-451e-b0ab-a6400d68bdf7@ti.com Signed-off-by: Arnd Bergmann commit 79fa29570bd340d5cb6229f047f2b9127dbff32c Author: Jakub Kicinski Date: Wed Oct 25 19:29:16 2023 -0700 net: selftests: use ethtool_sprintf() During a W=1 build GCC 13.2 says: net/core/selftests.c: In function ‘net_selftest_get_strings’: net/core/selftests.c:404:52: error: ‘%s’ directive output may be truncated writing up to 279 bytes into a region of size 28 [-Werror=format-truncation=] 404 | snprintf(p, ETH_GSTRING_LEN, "%2d. %s", i + 1, | ^~ net/core/selftests.c:404:17: note: ‘snprintf’ output between 5 and 284 bytes into a destination of size 32 404 | snprintf(p, ETH_GSTRING_LEN, "%2d. %s", i + 1, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 405 | net_selftests[i].name); | ~~~~~~~~~~~~~~~~~~~~~~ avoid it by using ethtool_sprintf(). Reviewed-by: Oleksij Rempel Tested-by: Oleksij Rempel Link: https://lore.kernel.org/r/20231026022916.566661-1-kuba@kernel.org Signed-off-by: Jakub Kicinski net/core/selftests.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit 62c11e461c7b669e8d42c0e49c8193a5e14d002a Author: Timothy Pearson Date: Thu Sep 14 17:39:47 2023 -0500 hwmon: (adt7475) Add support for Imon readout on ADT7490 Add support for the ADT7490's Imon voltage readout. It is handled largely the same way as the existing Vtt readout. Signed-off-by: Timothy Pearson Co-developed-by: Shawn Anastasio Signed-off-by: Shawn Anastasio Link: https://lore.kernel.org/r/20230914223947.829025-1-tpearson@raptorengineering.com Signed-off-by: Guenter Roeck Documentation/hwmon/adt7475.rst | 3 +- drivers/hwmon/adt7475.c | 68 +++++++++++++++++++++++++++++++++++++---- 2 files changed, 64 insertions(+), 7 deletions(-) commit 2232f10d714f2198d037b8047f482c09f7ad3b9a Author: Thomas Weißschuh Date: Mon Sep 11 07:44:42 2023 +0200 hwmon: (powerz) add support for ChargerLAB KM002C The KM002C is similar to the KM003C and seems to use the same protocol and firmware. Reported-by: Douglas Gilbert Closes: https://lore.kernel.org/lkml/290ebce4-54f0-8ac1-2a13-cbc806d80d64@interlog.com/ Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20230911-powerz-km002c-v1-1-898bd79b9bae@weissschuh.net Signed-off-by: Guenter Roeck drivers/hwmon/powerz.c | 1 + 1 file changed, 1 insertion(+) commit 9ab6fe910b1a00b51e6f9396950092e658211474 Author: Uwe Kleine-König Date: Mon Sep 18 10:59:51 2023 +0200 hwmon: (xgene-hwmon) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-25-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/xgene-hwmon.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit bc70de33250e1b9b8ae6909140943fe251b81571 Author: Uwe Kleine-König Date: Mon Sep 18 10:59:50 2023 +0200 hwmon: (w83781d) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-24-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/w83781d.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit eaac830a7e736bf493e9096453d620d29f39c695 Author: Uwe Kleine-König Date: Mon Sep 18 10:59:49 2023 +0200 hwmon: (w83627hf) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-23-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/w83627hf.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 5b4000065cde815dbe3475f24a1a7fe527a68d9b Author: Uwe Kleine-König Date: Mon Sep 18 10:59:48 2023 +0200 hwmon: (vt8231) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-22-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/vt8231.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 6e4c7bafcd0cc7e221a6d06605f645616529fb2a Author: Uwe Kleine-König Date: Mon Sep 18 10:59:47 2023 +0200 hwmon: (vt1211) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-21-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/vt1211.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 680a1b08096c97727819d5b257c85e5a8b46be04 Author: Uwe Kleine-König Date: Mon Sep 18 10:59:46 2023 +0200 hwmon: (via686a) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-20-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/via686a.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 88ac8226a34fa82f82d8a12a8d99b2436a35e2ff Author: Uwe Kleine-König Date: Mon Sep 18 10:59:45 2023 +0200 hwmon: (via-cputemp) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-19-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/via-cputemp.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit b875359995fad1ca20ed198e7969e2d1d308c202 Author: Uwe Kleine-König Date: Mon Sep 18 10:59:44 2023 +0200 hwmon: (ultra45_env) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-18-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/ultra45_env.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 39797753fdc208ea5771acbcf338a1649086afa9 Author: Uwe Kleine-König Date: Mon Sep 18 10:59:43 2023 +0200 hwmon: (sis5595) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-17-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/sis5595.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit a93a2c415486fbe9304543a943de789f0a89727a Author: Uwe Kleine-König Date: Mon Sep 18 10:59:42 2023 +0200 hwmon: (sht15) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-16-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/sht15.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit e44e19945ca10d9a260916b414d3345dfb671735 Author: Uwe Kleine-König Date: Mon Sep 18 10:59:41 2023 +0200 hwmon: (sch5636) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-15-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/sch5636.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit d29041681aa69c15dc0ac4688cb6e6f5b1a7d7f8 Author: Uwe Kleine-König Date: Mon Sep 18 10:59:40 2023 +0200 hwmon: (pc87427) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-14-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/pc87427.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit c45af5d2f3161910d86819741e64b9d801ae99ed Author: Uwe Kleine-König Date: Mon Sep 18 10:59:39 2023 +0200 hwmon: (pc87360) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-13-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/pc87360.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit ade539199bdade09382a1fa2a8a5a68474507f61 Author: Uwe Kleine-König Date: Mon Sep 18 10:59:38 2023 +0200 hwmon: (occ/p9_sbe) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-12-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/occ/p9_sbe.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 13af7eeeb6be5895c3ca9752c6ff8d719b2228c9 Author: Uwe Kleine-König Date: Mon Sep 18 10:59:37 2023 +0200 hwmon: (mc13783-adc) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-11-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/mc13783-adc.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 19eae13a8980eb71e789e676ce94869b3b76ed50 Author: Uwe Kleine-König Date: Mon Sep 18 10:59:36 2023 +0200 hwmon: (max197) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-10-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/max197.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 62f5e95d409c20a946942f65455e17c9c59b75fd Author: Uwe Kleine-König Date: Mon Sep 18 10:59:35 2023 +0200 hwmon: (i5k_amb) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-9-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/i5k_amb.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit a8f208d2a4c8fc20109d217d05490d23fcd1109f Author: Uwe Kleine-König Date: Mon Sep 18 10:59:34 2023 +0200 hwmon: (f71882fg) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-8-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/f71882fg.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit f79fe155cb7c326cf9ba58b5c4c289a994bd3e98 Author: Uwe Kleine-König Date: Mon Sep 18 10:59:33 2023 +0200 hwmon: (f71805f) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-7-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/f71805f.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 63d35e96e0c01cbdc5ecd76cb231b0678f5602fd Author: Uwe Kleine-König Date: Mon Sep 18 10:59:32 2023 +0200 hwmon: (dme1737) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-6-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/dme1737.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit f5681a839c03a71c485228eb28430d58e7a5d3f7 Author: Uwe Kleine-König Date: Mon Sep 18 10:59:31 2023 +0200 hwmon: (da9052-hwmon) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-5-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/da9052-hwmon.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit f23e759737e643255e04ce5d52dfda0a466c8c95 Author: Uwe Kleine-König Date: Mon Sep 18 10:59:30 2023 +0200 hwmon: (abituguru3) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230918085951.1234172-4-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/abituguru3.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 68d66551eb5ead02a826cd0c235f0f94f384ac09 Author: Uwe Kleine-König Date: Mon Sep 18 10:59:29 2023 +0200 hwmon: (abituguru) Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20230918085951.1234172-3-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/abituguru.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit a7dee82af86c190570b04f202b1ef04d29249a2f Author: Uwe Kleine-König Date: Mon Sep 18 10:59:28 2023 +0200 hwmon: (abitguru{,3}) Enable build testing on !X86 The two drivers compile fine on arm64, powerpc, m68k and s390. So make it possible to enable the drivers in the presence of COMPILE_TEST. Signed-off-by: Uwe Kleine-König Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20230918085951.1234172-2-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck drivers/hwmon/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e09b750526210775287c52d57b5ee2494847f5ed Author: Armin Wolf Date: Thu Sep 7 07:26:39 2023 +0200 hwmon: (sch5627) Document behaviour of limit registers The values of the limit registers affect the fan speed in a particular way. Document this behaviour so that future users can exploit it if required. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20230907052639.16491-6-W_Armin@gmx.de Signed-off-by: Guenter Roeck Documentation/hwmon/sch5627.rst | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 10655bb6df25514e0ae8406637c3b4acbc812fe5 Author: Armin Wolf Date: Thu Sep 7 07:26:38 2023 +0200 hwmon: (sch5627) Add support for writing limit registers After some testing on a Fujitsu Esprimo P720, it turned out that the limit registers are indeed writable and affect the fan control algorithm. This is supported by the datasheet, which says that the fan control functions are based on the limit and parameter registers. Since accessing those registers is very inefficient, the existing regmap cache is used to cache those registers values. Tested on a Fujitsu Esprimo P720. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20230907052639.16491-5-W_Armin@gmx.de Signed-off-by: Guenter Roeck drivers/hwmon/sch5627.c | 174 ++++++++++++++++++++++++++++------------- drivers/hwmon/sch56xx-common.c | 31 ++++++++ drivers/hwmon/sch56xx-common.h | 3 + 3 files changed, 153 insertions(+), 55 deletions(-) commit a54fe61639d9f3b6765fee32edda7cfceb6d705a Author: Armin Wolf Date: Thu Sep 7 07:26:37 2023 +0200 hwmon: (sch5627) Use regmap for pwm map register caching Accessing virtual registers is very inefficient, so pwm map values should be cached when possible, else userspace could effectively do a DOS attack by reading pwm map values in a while loop. Use the regmap cache to cache those values. Tested on a Fujitsu Esprimo P720. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20230907052639.16491-4-W_Armin@gmx.de Signed-off-by: Guenter Roeck drivers/hwmon/Kconfig | 1 + drivers/hwmon/sch5627.c | 72 +++++++++++++++++++++++++++++++-------- drivers/hwmon/sch56xx-common.c | 76 ++++++++++++++++++++++++++++++++++++++++++ drivers/hwmon/sch56xx-common.h | 3 ++ 4 files changed, 138 insertions(+), 14 deletions(-) commit 7da8a635436029957c5350da3acf51d78ed64071 Author: Armin Wolf Date: Thu Sep 7 07:26:36 2023 +0200 hwmon: (sch5627) Disallow write access if virtual registers are locked When the lock bit inside SCH5627_REG_CTRL is set, then the virtual registers become read-only until the next power cycle. Disallow write access to those registers in such a case. Tested on a Fujitsu Esprimo P720. Fixes: aa9f833dfc12 ("hwmon: (sch5627) Add pwmX_auto_channels_temp support") Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20230907052639.16491-3-W_Armin@gmx.de Signed-off-by: Guenter Roeck drivers/hwmon/sch5627.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 7f0b28e0653f36b51542d25dd54ed312c397ecfc Author: Armin Wolf Date: Thu Sep 7 07:26:35 2023 +0200 hwmon: (sch5627) Use bit macros when accessing the control register Use bit macros then accessing SCH5627_REG_CTRL, so that people do not need to look at the datasheet to find out what each bit does. Tested on a Fujitsu Esprimo P720. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20230907052639.16491-2-W_Armin@gmx.de Signed-off-by: Guenter Roeck drivers/hwmon/sch5627.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 27887b06597bbfef8924985d1ed21db3ab01c417 Author: Biju Das Date: Thu Sep 7 08:14:04 2023 +0100 hwmon: tmp513: Simplify tmp51x_read_properties() Simplify tmp51x_read_properties() by replacing 'nfactor' ->'data->nfactor' in device_property_read_u32_array() and drop the local variable as it is unused. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230907071404.24334-3-biju.das.jz@bp.renesas.com Signed-off-by: Guenter Roeck drivers/hwmon/tmp513.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit fb99e07a9e396402f643a138c2aef4699671b44a Author: Biju Das Date: Thu Sep 7 08:14:03 2023 +0100 hwmon: tmp513: Add max_channels variable to struct tmp51x_data The tmp512 chip has 3 channels whereas tmp513 has 4 channels. Avoid using tmp51x_ids for this HW difference by replacing OF/ID table data with maximum channels supported by the device. Replace id->max_channels variable from struct tmp51x_data and drop the macros TMP51{2,3}_TEMP_CONFIG_DEFAULT as it can be derived from the macro TMP51X_TEMP_CONFIG_DEFAULT and update the logic in tmp51x_is_visible(), tmp51x_read_properties() and tmp51x_init() using max_channels. While at it, drop enum tmp51x_ids as there is no user and remove trailing comma in the terminator entry for OF table. Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230907071404.24334-2-biju.das.jz@bp.renesas.com Signed-off-by: Guenter Roeck drivers/hwmon/tmp513.c | 49 +++++++++++++++++++++++-------------------------- 1 file changed, 23 insertions(+), 26 deletions(-) commit 923774d759c9f83d13b900bda9d146a918f65a45 Author: Patrick Rudolph Date: Thu Aug 31 21:07:29 2023 +0200 hwmon: (pmbus/tda38640) Add workaround for SVID mode TDA38640 can operate in either PMBus mode or SVID mode. In SVID mode, by design ENABLE pin is the only option for controlling the output rail i.e., ENABLE pin is chained to power good of another reglator & FPGA. In cases where the chip is configured for SVID mode, and the ENABLE pin is set at a fixed level or is left unconnected (with an internal pull-down), while requiring software control, the following workaround is necessary. The workaround utilizes ENABLE pin polarity flipping to control output rail. If property 'infineon,en-pin-fixed-level' is specified then determine if chip is in SVID mode by checking BIT15 of MTP memory offset 0x44 as described in the datasheet. If chip is in SVID mode then apply the workaround by 1. Determine EN pin level 2. Maps BIT7 of OPERATION(01h) to EN_PIN_POLARITY(BIT1) of PB_ON_OFF_CONFIG. Signed-off-by: Patrick Rudolph Signed-off-by: Naresh Solanki Link: https://lore.kernel.org/r/20230831190731.265099-3-Naresh.Solanki@9elements.com [groeck: Dropped unnecessary line continuation] Signed-off-by: Guenter Roeck drivers/hwmon/pmbus/tda38640.c | 154 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 152 insertions(+), 2 deletions(-) commit 05010fcf58e818cf71e2b4df338d84916644b749 Author: Patrick Rudolph Date: Thu Aug 31 21:07:28 2023 +0200 hwmon: (pmbus) Add ON_OFF_CONFIG register bits Add bits found in the ON_OFF_CONFIG register. Signed-off-by: Patrick Rudolph Signed-off-by: Naresh Solanki Link: https://lore.kernel.org/r/20230831190731.265099-2-Naresh.Solanki@9elements.com Signed-off-by: Guenter Roeck drivers/hwmon/pmbus/pmbus.h | 9 +++++++++ 1 file changed, 9 insertions(+) commit 30eea19c67d546bde1fbbc61e434b3a446a313dc Author: Patrick Rudolph Date: Thu Aug 31 21:07:27 2023 +0200 dt-bindings: hwmon: Add Infineon TDA38640 Add the DT property 'infineon,en-pin-fixed-level' to indicated that the chip EN pin is at fixed level or left unconnected(has internal pull-down). Signed-off-by: Patrick Rudolph Signed-off-by: Naresh Solanki Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230831190731.265099-1-Naresh.Solanki@9elements.com [groeck: Dropped empty line at end] Signed-off-by: Guenter Roeck .../bindings/hwmon/pmbus/infineon,tda38640.yaml | 49 ++++++++++++++++++++++ .../devicetree/bindings/trivial-devices.yaml | 2 - 2 files changed, 49 insertions(+), 2 deletions(-) commit 4381a36abdf1c5c0323c1c51f869dc000115eb20 Author: Thomas Weißschuh Date: Sat Sep 2 09:47:01 2023 +0200 hwmon: add POWER-Z driver POWER-Z is a series of devices to monitor power characteristics of USB-C connections and display those on a on-device display. Some of the devices, notably KM002C and KM003C, contain an additional port which exposes the measurements via USB. This is a driver for this monitor port. It was developed and tested with the KM003C. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20230902-powerz-v4-1-7ec2c1440687@weissschuh.net [groeck: Release urb after hwmon registration error; Move priv->status initialization to correct place before reinit_completion ] Signed-off-by: Guenter Roeck Documentation/hwmon/index.rst | 1 + Documentation/hwmon/powerz.rst | 30 +++++ MAINTAINERS | 7 ++ drivers/hwmon/Kconfig | 10 ++ drivers/hwmon/Makefile | 1 + drivers/hwmon/powerz.c | 274 +++++++++++++++++++++++++++++++++++++++++ 6 files changed, 323 insertions(+) commit 9da2901c47332b030ea4d2a2302bc7c0b83fc67c Author: Naresh Solanki Date: Fri Oct 27 10:33:52 2023 +0000 hwmon: (pmbus/mp2975) Move PGOOD fix The PGOOD fix was intended for MP2973 & MP2971 & not for MP2975. Fixes: acda945afb46 ("hwmon: (pmbus/mp2975) Fix PGOOD in READ_STATUS_WORD") Signed-off-by: Naresh Solanki Link: https://lore.kernel.org/r/20231027103352.918895-1-naresh.solanki@9elements.com Signed-off-by: Guenter Roeck drivers/hwmon/pmbus/mp2975.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 62cc9c3cb3ec1bf31cc116146185ed97b450836a Author: Jiri Kosina Date: Fri Oct 27 15:32:09 2023 +0200 HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W This device needs ALWAYS_POLL quirk, otherwise it keeps reconnecting indefinitely. Reported-by: Robert Ayrapetyan Signed-off-by: Jiri Kosina drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+) commit 94ace9eda88229c73698b8dd8d3c06dd0831319c Author: Ai Chao Date: Fri Oct 20 10:40:07 2023 +0800 platform/x86: inspur-platform-profile: Add platform profile support Add support for Inspur platforms to used the platform profile feature. This will allow users to determine and control the platform modes between low-power, balanced and performance modes. Signed-off-by: Ai Chao Reviewed-by: Thomas Weißschuh Reviewed-by: Armin Wolf Link: https://lore.kernel.org/r/20231020024007.1677962-1-aichao@kylinos.cn [ij: Removed kerneldoc markers from non-kerneldoc comments.] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/Kconfig | 11 ++ drivers/platform/x86/Makefile | 3 + drivers/platform/x86/inspur_platform_profile.c | 216 +++++++++++++++++++++++++ 3 files changed, 230 insertions(+) commit 916646758aea81a143ce89103910f715ed923346 Author: Olli Asikainen Date: Tue Oct 24 22:09:21 2023 +0300 platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e Thinkpad X120e also needs this battery quirk. Signed-off-by: Olli Asikainen Link: https://lore.kernel.org/r/20231024190922.2742-1-olli.asikainen@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/thinkpad_acpi.c | 1 + 1 file changed, 1 insertion(+) commit effd7c70eaa0440688b60b9d419243695ede3c45 Author: Mukesh Ojha Date: Thu Oct 26 19:57:39 2023 +0530 firmware_loader: Abort all upcoming firmware load request once reboot triggered There could be following scenario where there is a ongoing reboot is going from processA which tries to call all the reboot notifier callback and one of them is firmware reboot call which tries to abort all the ongoing firmware userspace request under fw_lock but there could be another processB which tries to do request firmware, which came just after abort done from ProcessA and ask for userspace to load the firmware and this can stop the ongoing reboot ProcessA to stall for next 60s(default timeout) which may not be expected behaviour everyone like to see, instead we should abort any firmware load request which came once firmware knows about the reboot through notification. ProcessA ProcessB kernel_restart_prepare blocking_notifier_call_chain fw_shutdown_notify kill_pending_fw_fallback_reqs __fw_load_abort fw_state_aborted request_firmware __fw_state_set firmware_fallback_sysfs ... fw_load_from_user_helper .. ... . .. usermodehelper_read_trylock fw_load_sysfs_fallback fw_sysfs_wait_timeout usermodehelper_disable __usermodehelper_disable down_write() Signed-off-by: Mukesh Ojha Acked-by: Luis Chamberlain Link: https://lore.kernel.org/r/1698330459-31776-2-git-send-email-quic_mojha@quicinc.com Signed-off-by: Greg Kroah-Hartman drivers/base/firmware_loader/fallback.c | 6 +++++- drivers/base/firmware_loader/firmware.h | 1 + drivers/base/firmware_loader/main.c | 1 + 3 files changed, 7 insertions(+), 1 deletion(-) commit 87ffa98eeee8d62a56afdad80ea697e7a6e5c354 Author: Mukesh Ojha Date: Thu Oct 26 19:57:38 2023 +0530 firmware_loader: Refactor kill_pending_fw_fallback_reqs() Rename 'only_kill_custom' and refactor logic related to it to be more meaningful. Signed-off-by: Mukesh Ojha Acked-by: Luis Chamberlain Link: https://lore.kernel.org/r/1698330459-31776-1-git-send-email-quic_mojha@quicinc.com Signed-off-by: Greg Kroah-Hartman drivers/base/firmware_loader/fallback.c | 4 ++-- drivers/base/firmware_loader/fallback.h | 4 ++-- drivers/base/firmware_loader/main.c | 8 ++++---- 3 files changed, 8 insertions(+), 8 deletions(-) commit fa10f413091a43f801f82b3cf484f15d6fc9266f Author: Abhijit Gangurde Date: Tue Oct 17 21:35:05 2023 +0530 cdx: add sysfs for subsystem, class and revision CDX controller provides subsystem vendor, subsystem device, class and revision info of the device along with vendor and device ID in native endian format. CDX Bus system uses this information to bind the cdx device to the cdx device driver. Co-developed-by: Puneet Gupta Signed-off-by: Puneet Gupta Co-developed-by: Nipun Gupta Signed-off-by: Nipun Gupta Signed-off-by: Abhijit Gangurde Reviewed-by: Pieter Jansen van Vuuren Tested-by: Nikhil Agarwal Link: https://lore.kernel.org/r/20231017160505.10640-8-abhijit.gangurde@amd.com Signed-off-by: Greg Kroah-Hartman Documentation/ABI/testing/sysfs-bus-cdx | 45 +++++++++++++++++++++++++++++++++ drivers/cdx/cdx.c | 29 ++++++++++++++++++++- drivers/cdx/cdx.h | 8 ++++++ drivers/cdx/controller/mcdi_functions.c | 7 +++++ include/linux/cdx/cdx_bus.h | 27 ++++++++++++++++++-- include/linux/mod_devicetable.h | 10 ++++++++ scripts/mod/devicetable-offsets.c | 4 +++ scripts/mod/file2alias.c | 8 ++++++ 8 files changed, 135 insertions(+), 3 deletions(-) commit 0174f5810401ae6390bfe15354346b5ea660d40c Author: Abhijit Gangurde Date: Tue Oct 17 21:35:04 2023 +0530 cdx: add sysfs for bus reset Add sysfs interface reset to reset all the devices on the CDX bus. Signed-off-by: Abhijit Gangurde Link: https://lore.kernel.org/r/20231017160505.10640-7-abhijit.gangurde@amd.com Signed-off-by: Greg Kroah-Hartman Documentation/ABI/testing/sysfs-bus-cdx | 8 ++++---- drivers/cdx/cdx.c | 26 ++++++++++++++++++++++---- 2 files changed, 26 insertions(+), 8 deletions(-) commit e3cfd49cb9491ac1cc233a4b9e098688b4ab281d Author: Abhijit Gangurde Date: Tue Oct 17 21:35:03 2023 +0530 cdx: add support for bus enable and disable CDX bus needs to be disabled before updating/writing devices in the FPGA. Once the devices are written, the bus shall be rescanned. This change provides sysfs entry to enable/disable the CDX bus. Co-developed-by: Nipun Gupta Signed-off-by: Nipun Gupta Signed-off-by: Abhijit Gangurde Link: https://lore.kernel.org/r/20231017160505.10640-6-abhijit.gangurde@amd.com Signed-off-by: Greg Kroah-Hartman Documentation/ABI/testing/sysfs-bus-cdx | 13 ++++++ drivers/cdx/cdx.c | 72 +++++++++++++++++++++++++++++++++ drivers/cdx/controller/cdx_controller.c | 12 ++++++ drivers/cdx/controller/mc_cdx_pcol.h | 54 +++++++++++++++++++++++++ drivers/cdx/controller/mcdi_functions.c | 24 +++++++++++ drivers/cdx/controller/mcdi_functions.h | 18 +++++++++ include/linux/cdx/cdx_bus.h | 10 +++++ 7 files changed, 203 insertions(+) commit ce558a391d80b9f47a462107977e8e81fe2f2962 Author: Abhijit Gangurde Date: Tue Oct 17 21:35:02 2023 +0530 cdx: Register cdx bus as a device on cdx subsystem While scanning for CDX devices, register newly discovered bus as a cdx device. CDX device attributes are visible based on device type. Signed-off-by: Abhijit Gangurde Link: https://lore.kernel.org/r/20231017160505.10640-5-abhijit.gangurde@amd.com Signed-off-by: Greg Kroah-Hartman drivers/cdx/cdx.c | 77 ++++++++++++++++++++++++++++++--- drivers/cdx/cdx.h | 14 +++++- drivers/cdx/controller/cdx_controller.c | 7 +++ include/linux/cdx/cdx_bus.h | 2 + 4 files changed, 93 insertions(+), 7 deletions(-) commit e3ed12f37e261a0b35cf0b4ae505adf7ea0f48ec Author: Abhijit Gangurde Date: Tue Oct 17 21:35:01 2023 +0530 cdx: Create symbol namespaces for cdx subsystem Create CDX_BUS and CDX_BUS_CONTROLLER symbol namespace for cdx bus subsystem. CDX controller modules are required to import symbols from CDX_BUS_CONTROLLER namespace and other than controller modules to import from CDX_BUS namespace. Signed-off-by: Abhijit Gangurde Link: https://lore.kernel.org/r/20231017160505.10640-4-abhijit.gangurde@amd.com Signed-off-by: Greg Kroah-Hartman drivers/cdx/Makefile | 2 ++ drivers/cdx/cdx.c | 6 +++--- drivers/cdx/controller/cdx_controller.c | 1 + drivers/vfio/cdx/main.c | 1 + 4 files changed, 7 insertions(+), 3 deletions(-) commit f0af816834667b626dc5a3aa09cced82c46f0e62 Author: Abhijit Gangurde Date: Tue Oct 17 21:35:00 2023 +0530 cdx: Introduce lock to protect controller ops Add a mutex lock to prevent race between controller ops initiated by the bus subsystem and the controller registration/unregistration. Signed-off-by: Abhijit Gangurde Link: https://lore.kernel.org/r/20231017160505.10640-3-abhijit.gangurde@amd.com Signed-off-by: Greg Kroah-Hartman drivers/cdx/cdx.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 54b406e10f0334ee0245d5129c8def444a49cd9b Author: Abhijit Gangurde Date: Tue Oct 17 21:34:59 2023 +0530 cdx: Remove cdx controller list from cdx bus system Remove xarray list of cdx controller. Instead, use platform bus to locate the cdx controller using compat string used by cdx controller platform driver. Also, use ida to allocate a unique id for the controller. Signed-off-by: Abhijit Gangurde Link: https://lore.kernel.org/r/20231017160505.10640-2-abhijit.gangurde@amd.com Signed-off-by: Greg Kroah-Hartman drivers/cdx/cdx.c | 42 ++++++++++++++++++++++++++++-------------- include/linux/cdx/cdx_bus.h | 2 ++ 2 files changed, 30 insertions(+), 14 deletions(-) commit c40e66539051158e1c9fdc4cf18babe3a7b34e8e Author: Ayush Singh Date: Tue Oct 17 15:41:14 2023 +0530 dts: ti: k3-am625-beagleplay: Add beaglecc1352 The BeaglePlay board by BeagleBoard.org has a CC1352P7 co-processor connected to the main AM62 (running Linux) over UART. In the BeagleConnect Technology, CC1352 is responsible for handling 6LoWPAN communication with beagleconnect freedom nodes as well as their discovery. This mcu is used by gb-beagleplay, a Greybus driver for BeaglePlay. Signed-off-by: Ayush Singh Link: https://lore.kernel.org/r/20231017101116.178041-4-ayushdevel1325@gmail.com Signed-off-by: Greg Kroah-Hartman arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts | 6 ++++++ 1 file changed, 6 insertions(+) commit ec558bbfea671ac020a6dc6be8bf8f0ee556cce0 Author: Ayush Singh Date: Tue Oct 17 15:41:13 2023 +0530 greybus: Add BeaglePlay Linux Driver Add the Greybus host driver for BeaglePlay board by BeagleBoard.org. The current greybus setup involves running SVC in a user-space application (GBridge) and using netlink to communicate with kernel space. GBridge itself uses wpanusb kernel driver, so the greybus messages travel from kernel space (gb_netlink) to user-space (GBridge) and then back to kernel space (wpanusb) before reaching CC1352. This driver directly communicates with CC1352 (running SVC Zephyr application). Thus, it simplifies the complete greybus setup eliminating user-space GBridge. This driver is responsible for the following: - Start SVC (CC1352) on driver load. - Send/Receive Greybus messages to/from CC1352 using HDLC over UART. - Print Logs from CC1352. - Stop SVC (CC1352) on driver load. Signed-off-by: Ayush Singh Link: https://lore.kernel.org/r/20231017101116.178041-3-ayushdevel1325@gmail.com Signed-off-by: Greg Kroah-Hartman MAINTAINERS | 1 + drivers/greybus/Kconfig | 10 + drivers/greybus/Makefile | 2 + drivers/greybus/gb-beagleplay.c | 501 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 514 insertions(+) commit c966c715c77717bd8bdda32a46b33868acb7a4e2 Author: Ayush Singh Date: Tue Oct 17 15:41:12 2023 +0530 dt-bindings: net: Add ti,cc1352p7 Add DT bindings for Texas Instruments Simplelink CC1352P7 wireless MCU BeaglePlay has CC1352P7 co-processor connected to the main AM62 (running Linux) over UART. In the BeagleConnect Technology, CC1352 is responsible for handling 6LoWPAN communication with beagleconnect freedom nodes as well as their discovery. Signed-off-by: Ayush Singh Reviewed-by: Krzysztof Kozlowski Reviewed-by: Nishanth Menon Link: https://lore.kernel.org/r/20231017101116.178041-2-ayushdevel1325@gmail.com Signed-off-by: Greg Kroah-Hartman .../devicetree/bindings/net/ti,cc1352p7.yaml | 51 ++++++++++++++++++++++ MAINTAINERS | 6 +++ 2 files changed, 57 insertions(+) commit 2b107158f8095d0de9773080b68b1df38a6017bd Author: Rafał Miłecki Date: Tue Oct 24 19:12:53 2023 +0200 dt-bindings: eeprom: at24: allow NVMEM cells based on old syntax This binding supported NVMEM cells as subnodes and that syntax is used by few in-kenel DTS files. Modify binding to allow it. Reported-by: Rob Herring Fixes: c5330723d5a0 ("dt-bindings: nvmem: move deprecated cells binding to its own file") Signed-off-by: Rafał Miłecki Reviewed-by: Rob Herring Acked-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20231024171253.19976-2-zajec5@gmail.com Signed-off-by: Greg Kroah-Hartman Documentation/devicetree/bindings/eeprom/at24.yaml | 1 + 1 file changed, 1 insertion(+) commit ed758ca69c0c0fe5820403e98c4fe427a302d553 Author: Rafał Miłecki Date: Tue Oct 24 19:12:52 2023 +0200 dt-bindings: nvmem: SID: allow NVMEM cells based on old syntax This binding supported NVMEM cells as subnodes and that syntax is used by few in-kenel DTS files. Modify binding to allow it. Reported-by: Rob Herring Fixes: c5330723d5a0 ("dt-bindings: nvmem: move deprecated cells binding to its own file") Signed-off-by: Rafał Miłecki Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20231024171253.19976-1-zajec5@gmail.com Signed-off-by: Greg Kroah-Hartman Documentation/devicetree/bindings/nvmem/allwinner,sun4i-a10-sid.yaml | 1 + 1 file changed, 1 insertion(+) commit f4cf4e5db331a5ce69e3f0b21d322cac0f4e4b5d Author: Rafał Miłecki Date: Mon Oct 23 12:27:59 2023 +0200 Revert "nvmem: add new config option" This reverts commit 517f14d9cf3533d5ab4fded195ab6f80a92e378f. Config option "no_of_node" is no longer needed since adding a more explicit and targeted option "add_legacy_fixed_of_cells". That "no_of_node" config option was needed *earlier* to help mtd's case. DT nodes of MTD partitions (that are also NVMEM devices) may contain subnodes. Those SHOULD NOT be treated as NVMEM fixed cells. To prevent NVMEM core code from parsing subnodes a "no_of_node" option was added (and set to true in mtd) to make for_each_child_of_node() in NVMEM a no-op. That was a bit hacky because it was messing with "of_node" pointer to achieve some side-effect. With the introduction of "add_legacy_fixed_of_cells" config option things got more explicit. MTD subsystem simply tells NVMEM when to look for fixed cells and there is no need to hack "of_node" pointer anymore. Signed-off-by: Rafał Miłecki Reviewed-by: Miquel Raynal Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20231023102759.31529-1-zajec5@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/mtd/mtdcore.c | 1 - drivers/nvmem/core.c | 2 +- include/linux/nvmem-provider.h | 2 -- 3 files changed, 1 insertion(+), 4 deletions(-) commit a07d2497ed657eb2efeb967af47e22f573dcd1d6 Author: Manivannan Sadhasivam Date: Wed Oct 25 18:30:29 2023 +0530 PCI: qcom-ep: Add dedicated callback for writing to DBI2 registers The DWC core driver exposes the write_dbi2() callback for writing to the DBI2 registers in a vendor-specific way. On the Qcom EP platforms, the DBI_CS2 bit in the ELBI region needs to be asserted before writing to any DBI2 registers and deasserted once done. So, let's implement the callback for the Qcom PCIe EP driver so that the DBI2 writes are correctly handled in the hardware. Without this callback, the DBI2 register writes like BAR size won't go through and as a result, the default BAR size is set for all BARs. [kwilczynski: commit log, renamed function to match the DWC convention] Fixes: f55fee56a631 ("PCI: qcom-ep: Add Qualcomm PCIe Endpoint controller driver") Suggested-by: Serge Semin Link: https://lore.kernel.org/linux-pci/20231025130029.74693-2-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Krzysztof Wilczyński Reviewed-by: Serge Semin Cc: stable@vger.kernel.org # 5.16+ drivers/pci/controller/dwc/pcie-qcom-ep.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) commit 61e54dea807d202d5bfd563d926b163b43b7fecd Author: James Clark Date: Fri Oct 20 16:41:03 2023 +0100 MAINTAINERS: coresight: Add missing Coresight files There are a few files missing from the list like test_arm_coresight.sh and arm-coresight.txt so add the missing entries. Signed-off-by: James Clark Link: https://lore.kernel.org/r/20231020154103.55936-1-james.clark@arm.com Signed-off-by: Greg Kroah-Hartman MAINTAINERS | 4 ++++ 1 file changed, 4 insertions(+) commit 8293703a492ae97c86af27c75b76e6239ec86483 Author: Siddharth Vadapalli Date: Fri Oct 20 17:32:48 2023 +0530 misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support Add DEVICE_ID for J721S2 and enable support for endpoints configured with this DEVICE_ID in the pci_endpoint_test driver. Signed-off-by: Siddharth Vadapalli Cc: stable Reviewed-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20231020120248.3168406-1-s-vadapalli@ti.com Signed-off-by: Greg Kroah-Hartman drivers/misc/pci_endpoint_test.c | 4 ++++ 1 file changed, 4 insertions(+) commit 79614953e815b8c3b063fe68efa3cf508260ac0d Author: Rajan Vaja Date: Fri Oct 27 00:53:58 2023 +0530 firmware: xilinx: Move EXPORT_SYMBOL_GPL next to zynqmp_pm_feature definition As mentioned in Documentation/process/coding-style.rst: In source files, separate functions with one blank line. If the function is exported, the **EXPORT** macro for it should follow immediately after the closing function brace line. So inline with guideline move zynqmp_pm_feature export symbol after its definition. Signed-off-by: Rajan Vaja Signed-off-by: Radhey Shyam Pandey Link: https://lore.kernel.org/r/1698348238-2320426-1-git-send-email-radhey.shyam.pandey@amd.com Signed-off-by: Greg Kroah-Hartman drivers/firmware/xilinx/zynqmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 41196b0bbe8a1ce663b85aca2141800214c186f1 Author: Pavan Bobba Date: Fri Oct 27 14:21:59 2023 +0530 staging: vt6655: Type encoding info dropped from variable name "byRxRate" variable name "byRxRate" updated like below: a.type encoding info dropped from name b.camelcase name replaced by snakecase Issue found by checkpatch Signed-off-by: Pavan Bobba Link: https://lore.kernel.org/r/16d6e4f4fbf643b45a9e2e5b4c48c93450543ecc.1698396278.git.opensource206@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/vt6655/card.c | 12 ++++++------ drivers/staging/vt6655/card.h | 4 ++-- 2 files changed, 8 insertions(+), 8 deletions(-) commit 3b9325d8aa05222070f25ce73e7494a97f8c86f2 Author: Pavan Bobba Date: Fri Oct 27 14:21:58 2023 +0530 staging: vt6655: Type encoding info dropped from function name "CARDbUpdateTSF" function name "CARDbUpdateTSF" updated like below: a.type encoding info dropped from name b.camelcase name replaced by snakecase Issue found by checkpatch Signed-off-by: Pavan Bobba Link: https://lore.kernel.org/r/926ec04bbfc69926cd1af92684fef392f2d6e04a.1698396278.git.opensource206@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/vt6655/card.c | 2 +- drivers/staging/vt6655/card.h | 2 +- drivers/staging/vt6655/device_main.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit c97dbf1dcd7533282e1e5bacc0f88b494e671d44 Author: Pavan Bobba Date: Fri Oct 27 14:21:57 2023 +0530 staging: vt6655: Type encoding info dropped from function name "CARDvSetRSPINF" function name "CARDvSetRSPINF" updated like below: a.type encoding info dropped from name b.camelcase name replaced by snakecase Issue found by checkpatch Signed-off-by: Pavan Bobba Link: https://lore.kernel.org/r/63ab11bce827d20cf30eafd874d96128a6e969f8.1698396278.git.opensource206@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/vt6655/card.c | 6 +++--- drivers/staging/vt6655/card.h | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) commit 1904b721541c7b03039eb9b21999a8b9de40b76f Author: Pavan Bobba Date: Fri Oct 27 14:21:56 2023 +0530 staging: vt6655: Type encoding info dropped from function name "CARDbyGetPktType" function name "CARDbyGetPktType" updated like below: a.type encoding info dropped from name b.camelcase name replaced by snakecase Issue found by checkpatch Signed-off-by: Pavan Bobba Link: https://lore.kernel.org/r/387aa7f3e3c21cab541442d772cec0048f3463ba.1698396278.git.opensource206@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/vt6655/card.c | 4 ++-- drivers/staging/vt6655/card.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) commit 956ab42b8e4f2e0ead19a7dd68e14a83e71e6d19 Author: Pavan Bobba Date: Fri Oct 27 14:21:55 2023 +0530 staging: vt6655: Type encoding info dropped from variable name "byPacketType" variable name "byPacketType" updated like below: a.type encoding info dropped from name b.camelcase name replaced by snakecase Issue found by checkpatch Signed-off-by: Pavan Bobba Link: https://lore.kernel.org/r/308813545f9364da18dfc3cdb051ed59eca18f7f.1698396278.git.opensource206@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/vt6655/card.c | 2 +- drivers/staging/vt6655/device.h | 2 +- drivers/staging/vt6655/device_main.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit 4922f5d1e54cecbd6d0acf57983ea62c3eb94c6c Author: Pavan Bobba Date: Fri Oct 27 14:21:54 2023 +0530 staging: vt6655: Type encoding info dropped from function name "CARDbSetPhyParameter" function name "CARDbSetPhyParameter" updated like below: a.type encoding info dropped from name b.camelcase name replaced by snakecase Issue found by checkpatch Signed-off-by: Pavan Bobba Link: https://lore.kernel.org/r/66beb307ac7983b2aa82fa81f6f2362353209859.1698396278.git.opensource206@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/vt6655/card.c | 2 +- drivers/staging/vt6655/card.h | 2 +- drivers/staging/vt6655/device_main.c | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) commit cb1fe713eca14c92ac950d0ec1d1ea4353fcc8c5 Author: Pavan Bobba Date: Fri Oct 27 14:21:53 2023 +0530 staging: vt6655: Type encoding info dropped from variable name "pbyRsvTime" variable name "pbyRsvTime" updated like below: a.type encoding info dropped from name b.camelcase name replaced by snakecase Issue found by checkpatch Signed-off-by: Pavan Bobba Link: https://lore.kernel.org/r/137b6c433e2d11b6ce99043f1fedf208789e380c.1698396278.git.opensource206@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/vt6655/card.c | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) commit eb88265fa551f04cb200357995aacc91537e3a6b Author: Pavan Bobba Date: Fri Oct 27 14:21:52 2023 +0530 staging: vt6655: Type encoding info dropped from variable name "pbyTxRate" variable name "pbyTxRate" updated like below: a.type encoding info dropped from name b.camelcase name replaced by snakecase Issue found by checkpatch Signed-off-by: Pavan Bobba Link: https://lore.kernel.org/r/409a80898ccbb398c31f222dc29cea4725a0cfb3.1698396278.git.opensource206@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/vt6655/card.c | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) commit 8b46d9ff8af01a2c4df9bc8227dcd09628f64aa2 Author: Pavan Bobba Date: Fri Oct 27 14:21:51 2023 +0530 staging: vt6655: Type encoding info dropped from function name "s_vCalculateOFDMRParameter" function name "s_vCalculateOFDMRParameter" updated like below: a.type encoding info dropped from name b.camelcase name replaced by snakecase Issue found by checkpatch Signed-off-by: Pavan Bobba Link: https://lore.kernel.org/r/de4817b8c29a1cf5e50afb553e3e30bc0fc44572.1698396278.git.opensource206@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/vt6655/card.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit 6c149083e7b955f6340e6a5f2514d937b5968bbe Author: Pavan Bobba Date: Fri Oct 27 14:21:50 2023 +0530 staging: vt6655: Type encoding info dropped from array name "cwRXBCNTSFOff" array name "cwRXBCNTSFOff" updated like below: a.type encoding info dropped from name b.camelcase name replaced by snakecase Issue found by checkpatch Signed-off-by: Pavan Bobba Link: https://lore.kernel.org/r/b66d2cfebc199c20ff05143185400b6afd351f5a.1698396278.git.opensource206@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/vt6655/card.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b83b7368258aeb5104c2ff7331326bfeefea9370 Author: Uwe Kleine-König Date: Thu Oct 26 23:44:08 2023 +0200 staging: fbtft: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. The function fbtft_driver_remove_pdev() (that exists several times as it's part of a macro expansion) returns zero unconditionally, so it can be trivially converted to return void without semantic changes. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20231026214407.2508590-2-u.kleine-koenig@pengutronix.de Signed-off-by: Greg Kroah-Hartman drivers/staging/fbtft/fbtft.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 0210a684cdb277714380553f8d8d8964b2f744fc Author: Heiner Kallweit Date: Thu Oct 26 22:49:21 2023 +0200 staging: olpc_dcon: Remove I2C_CLASS_DDC support olpc_dcon is the only remaining i2c client device driver declaring I2C_CLASS_DDC support after the legacy eeprom driver has been removed. olpc_dcon is only used on olpc devices, connected to an i2c adapter driven by scx200_acb. This adapter driver declares support for I2C_CLASS_HWMON and I2C_CLASS_SPD. Therefore we can safely drop I2C_CLASS_DDC support in olpc_dcon. That's the last step before I2C_CLASS_DDC can be removed in general. This patch is solely based on documentation, and I don't have an olpc device for testing. Therefore some testing would be appreciated before patch is applied. Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/da3070d9-e016-4167-843f-a08d5b2dc1fe@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/olpc_dcon/olpc_dcon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3d69b023a9f520366425b2403119bb1689969129 Author: Ricardo B. Marliere Date: Wed Oct 25 09:26:34 2023 -0300 staging: vc04_services: use snprintf instead of sprintf All the occurrences of sprintf usage under vc04_services can be safely replaced by snprintf, so as to avoid any possible overflow. Suggested-by: Dan Carpenter Suggested-by: Umang Jain Signed-off-by: "Ricardo B. Marliere" Reviewed-by: Umang Jain Link: https://lore.kernel.org/r/20231025122632.307385-4-ricardo@marliere.net Signed-off-by: Greg Kroah-Hartman .../vc04_services/bcm2835-camera/bcm2835-camera.c | 2 +- .../vc04_services/interface/vchiq_arm/vchiq_arm.c | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-) commit 75c1e5968f5c549c148c253ab331130aa3a74f33 Author: Philipp Hortmann Date: Thu Oct 26 20:18:21 2023 +0200 staging: rtl8192e: Fix line break issue at priv->rx_buf[priv->rx_idx] Fix line break at priv->rx_buf[priv->rx_idx] to increase readability. Suggested-by: Dan Carpenter Signed-off-by: Philipp Hortmann Link: https://lore.kernel.org/r/20231026181821.GA21819@matrix-ESPRIMO-P710 Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 60b46910c8c647c621cbf5fdc91f475e04f8c9f3 Author: Philipp Hortmann Date: Thu Oct 26 07:44:30 2023 +0200 staging: rtl8192e: Remove unused constants starting with MAX_RX_QUEUE Remove unused constants. Signed-off-by: Philipp Hortmann Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/0809e3380ce76354d689edd80b82adada5a18d4e.1698295861.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192e/rtl8192e/r8190P_def.h | 2 - drivers/staging/rtl8192e/rtl8192e/r8192E_phyreg.h | 62 +---------------------- drivers/staging/rtl8192e/rtl8192e/rtl_core.h | 2 - drivers/staging/rtl8192e/rtl819x_Qos.h | 1 - drivers/staging/rtl8192e/rtl819x_TS.h | 1 - drivers/staging/rtl8192e/rtllib.h | 1 - 6 files changed, 1 insertion(+), 68 deletions(-) commit 6d03b437c66a3bf073fdab103461931e91ada770 Author: Philipp Hortmann Date: Thu Oct 26 07:44:24 2023 +0200 staging: rtl8192e: Convert array rx_idx[] to variable rx_idx Convert array rx_idx[] to variable rx_idx as index is always 0. Remove unused rx_queue_idx as well. This increases readability. Signed-off-by: Philipp Hortmann Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/f9e3ee95cdc2de810687a9c71f1a9f8d8fdbeac1.1698295861.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 18 +++++++----------- drivers/staging/rtl8192e/rtl8192e/rtl_core.h | 2 +- 2 files changed, 8 insertions(+), 12 deletions(-) commit 336023659882924cb5921438f1f52d5a741d4a24 Author: Philipp Hortmann Date: Thu Oct 26 07:44:18 2023 +0200 staging: rtl8192e: Convert array rx_ring_dma[] to variable rx_ring_dma Convert array rx_ring_dma[] to variable rx_ring_dma as index is always 0. This increases readability. Signed-off-by: Philipp Hortmann Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/51d3be0a715452cefe5ac6dd29a86fbe65b824fa.1698295861.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 2 +- drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 4 ++-- drivers/staging/rtl8192e/rtl8192e/rtl_core.h | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) commit 81c412cb8ca76fefced52f2188579e8226f45f00 Author: Philipp Hortmann Date: Thu Oct 26 07:44:11 2023 +0200 staging: rtl8192e: Convert array rx_buf[][] to array rx_buf[] Convert array rx_buf[][] to array rx_buf[] as index is always 0. This increases readability. Signed-off-by: Philipp Hortmann Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/967337963336cf09383003050b12c43c779e1562.1698295861.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 8 ++++---- drivers/staging/rtl8192e/rtl8192e/rtl_core.h | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) commit 8e842c479ac8c8be54f79b1b01ac12d79139d438 Author: Philipp Hortmann Date: Thu Oct 26 07:44:05 2023 +0200 staging: rtl8192e: Convert array rx_ring[] to variable rx_ring Convert array rx_ring[] to variable rx_ring as index is always 0. This increases readability. Signed-off-by: Philipp Hortmann Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/c53ff4251eba0adae6d8279a918c8ab4914b4780.1698295861.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 25 ++++++++++++------------- drivers/staging/rtl8192e/rtl8192e/rtl_core.h | 2 +- 2 files changed, 13 insertions(+), 14 deletions(-) commit 510c8f18c1fa989f727186e8eb7b0746ede8c525 Author: Philipp Hortmann Date: Thu Oct 26 07:43:59 2023 +0200 staging: rtl8192e: Remove loops with constant MAX_RX_QUEUE MAX_RX_QUEUE is set to 1. All loops with MAX_RX_QUEUE run only one cycle. Remove loops. Signed-off-by: Philipp Hortmann Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/8bc9d3c15fba082a928ea2c0916a6aef5f76f456.1698295861.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 120 +++++++++++++-------------- 1 file changed, 58 insertions(+), 62 deletions(-) commit ac32633f231fd43691f9cc0970c8223ac916a1a9 Author: Philipp Hortmann Date: Thu Oct 26 07:43:52 2023 +0200 staging: rtl8192e: Remove HTIOTActIsDisableEDCATurbo() Remove HTIOTActIsDisableEDCATurbo() as it always returns false which leads to one evaluation that is always false. Remove dead code. Signed-off-by: Philipp Hortmann Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/904ca224c6a0a1968012e131c0197a71e5b67f81.1698295861.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192e/rtl819x_HTProc.c | 10 ---------- 1 file changed, 10 deletions(-) commit da8e981c735e56b1f5e81d177d484136fbb58708 Author: Philipp Hortmann Date: Thu Oct 26 07:43:46 2023 +0200 staging: rtl8192e: Remove HTIOTActIsDisableMCSTwoSpatialStream() Remove HTIOTActIsDisableMCSTwoSpatialStream() as it always returns false which leads to one evaluation that is always false. Remove dead code. Signed-off-by: Philipp Hortmann Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/a446837ff1107c81f52d3cf9e727d6ef4e2678af.1698295861.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192e/rtl819x_HTProc.c | 9 --------- 1 file changed, 9 deletions(-) commit 7db86bafb531e626401f291bde5fbb276094cd30 Author: Philipp Hortmann Date: Thu Oct 26 07:43:39 2023 +0200 staging: rtl8192e: Remove HTIOTActIsDisableMCS15() Remove HTIOTActIsDisableMCS15() as it always returns false which leads to one evaluation that is always false. Remove dead code. Signed-off-by: Philipp Hortmann Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/004b43b098f14f82e9614578ea9f04ca95b48b4c.1698295861.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192e/rtl819x_HTProc.c | 9 --------- 1 file changed, 9 deletions(-) commit 4c0be6c26dcd263ede434fc83ae86e3d55cb7379 Author: Philipp Hortmann Date: Thu Oct 26 07:43:33 2023 +0200 staging: rtl8192e: Remove HTIOTActIsDisableMCS14() Remove HTIOTActIsDisableMCS14() as it always returns zero which leads to one evaluation that is always false. Remove dead code. Signed-off-by: Philipp Hortmann Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/7ff3c7f8daf9bccb004129fdc1128ca0b0cb4e70.1698295861.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192e/rtl819x_HTProc.c | 9 --------- 1 file changed, 9 deletions(-) commit 64ebf8797249e792af2143eb9e4bd404d10a022e Author: Andy Shevchenko Date: Tue Oct 24 15:41:15 2023 +0300 serdev: Replace custom code with device_match_acpi_handle() Since driver core provides a generic device_match_acpi_handle() we may replace the custom code with it. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231024124115.3598090-4-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman drivers/tty/serdev/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ddab72ea7e5be7d1ae0433fa3d399e05837008d1 Author: Andy Shevchenko Date: Tue Oct 24 15:41:14 2023 +0300 serdev: Simplify devm_serdev_device_open() function Use devm_add_action_or_reset() instead of devres_alloc() and devres_add(), which works the same. This will simplify the code. There is no functional changes. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231024124115.3598090-3-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman drivers/tty/serdev/core.c | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-) commit aef0f5a1841e76fe13621edc7123076b38d458b0 Author: Andy Shevchenko Date: Tue Oct 24 15:41:13 2023 +0300 serdev: Make use of device_set_node() Use device_set_node() instead of assigning ctrl->dev.of_node directly because it also sets the firmware node. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20231024124115.3598090-2-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman drivers/tty/serdev/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit c3a383d8d382e066038ab245c8d2b6d02f4bf8a2 Author: Andrey Konovalov Date: Thu Oct 26 22:01:14 2023 +0200 usb: raw-gadget: report suspend, resume, reset, and disconnect events Update USB_RAW_IOCTL_EVENT_FETCH to also report suspend, resume, reset, and disconnect events. This allows the code that emulates a USB device via Raw Gadget to handle these events. For example, the device can restart enumeration when it gets reset. Also do not print a WARNING when the event queue overflows. With these new events being queued, the queue might overflow if the device emulation code stops fetching events. Also print debug messages when a non-control event is received. Signed-off-by: Andrey Konovalov Link: https://lore.kernel.org/r/d610b629a5f32fb76c24012180743f7f0f1872c0.1698350424.git.andreyknvl@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/legacy/raw_gadget.c | 52 ++++++++++++++++++++++++++++------ include/uapi/linux/usb/raw_gadget.h | 14 +++++++-- 2 files changed, 56 insertions(+), 10 deletions(-) commit 1f97e3f429cff941b5f7adc9fcbb1b5138cd6125 Author: Andrey Konovalov Date: Thu Oct 26 22:01:13 2023 +0200 usb: raw-gadget: don't disable device if usb_ep_queue fails During device operation, the host might decide to reset a device emulated via Raw Gadget. In this case, if the device emulation code has endpoint requests queued, usb_ep_queue will fail with -ESHUTDOWN. Currently, this disables the Raw Gadget device and makes the emulation code unable to proceed. Do not disable the Raw Gadget device if usb_ep_queue fails. Signed-off-by: Andrey Konovalov Link: https://lore.kernel.org/r/3c5df3dddb67623b4aeb11c5546370363e65d8e2.1698350424.git.andreyknvl@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/legacy/raw_gadget.c | 2 -- 1 file changed, 2 deletions(-) commit e8033bde451eddfb9b1bbd6e2d848c1b5c277222 Author: Andrey Konovalov Date: Thu Oct 26 22:01:12 2023 +0200 usb: raw-gadget: properly handle interrupted requests Currently, if a USB request that was queued by Raw Gadget is interrupted (via a signal), wait_for_completion_interruptible returns -ERESTARTSYS. Raw Gadget then attempts to propagate this value to userspace as a return value from its ioctls. However, when -ERESTARTSYS is returned by a syscall handler, the kernel internally restarts the syscall. This doesn't allow userspace applications to interrupt requests queued by Raw Gadget (which is required when the emulated device is asked to switch altsettings). It also violates the implied interface of Raw Gadget that a single ioctl must only queue a single USB request. Instead, make Raw Gadget do what GadgetFS does: check whether the request was interrupted (dequeued with status == -ECONNRESET) and report -EINTR to userspace. Fixes: f2c2e717642c ("usb: gadget: add raw-gadget interface") Cc: stable Signed-off-by: Andrey Konovalov Link: https://lore.kernel.org/r/0db45b1d7cc466e3d4d1ab353f61d63c977fbbc5.1698350424.git.andreyknvl@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/legacy/raw_gadget.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) commit 2998874736bca1031ca84b0a3235a2cd09dfa426 Author: Pawel Laszczak Date: Thu Oct 26 09:37:37 2023 +0200 usb:cdnsp: remove TRB_FLUSH_ENDPOINT command Patch removes TRB_FLUSH_ENDPOINT command from driver. This command is not supported by controller and USBSSP returns TRB Error completion code for it. Signed-off-by: Pawel Laszczak Acked-by: Peter Chen Link: https://lore.kernel.org/r/20231026073737.165450-1-pawell@cadence.com Signed-off-by: Greg Kroah-Hartman drivers/usb/cdns3/cdnsp-debug.h | 3 --- drivers/usb/cdns3/cdnsp-gadget.c | 6 +----- drivers/usb/cdns3/cdnsp-gadget.h | 5 ----- drivers/usb/cdns3/cdnsp-ring.c | 24 ------------------------ 4 files changed, 1 insertion(+), 37 deletions(-) commit 3d56e5aa6727f5055d1ad879342ad1a8acec2134 Author: Uwe Kleine-König Date: Fri Oct 27 00:17:02 2023 +0200 usb: gadget: aspeed_udc: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). ast_udc_remove() is one of these functions that return an error code after doing only a partial cleanup. Replace the core's error message by a more drastic one and still convert the driver to .remove_new(). Note the only semantic change here is the changed error message. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20231026221701.2521483-2-u.kleine-koenig@pengutronix.de Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/udc/aspeed_udc.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) commit c3097719e438ab6d07b8b20b5575f985ab07b5a5 Author: Luca Weiss Date: Fri Oct 20 11:33:20 2023 +0200 dt-bindings: usb: fsa4480: Add compatible for OCP96011 The Orient-Chip OCP96011 is generally compatible with the FSA4480, add a compatible for it with the fallback on fsa4480. However the AUX/SBU connections are expected to be swapped compared to FSA4480, so document this in the data-lanes description. Signed-off-by: Luca Weiss Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20231020-fsa4480-swap-v2-3-9a7f9bb59873@fairphone.com Signed-off-by: Greg Kroah-Hartman Documentation/devicetree/bindings/usb/fcs,fsa4480.yaml | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) commit cf07c55f992228465da7eb0e300351206de6171f Author: Luca Weiss Date: Fri Oct 20 11:33:19 2023 +0200 usb: typec: fsa4480: Add support to swap SBU orientation On some hardware designs the AUX+/- lanes are connected reversed to SBU1/2 compared to the expected design by FSA4480. Made more complicated, the otherwise compatible Orient-Chip OCP96011 expects the lanes to be connected reversed compared to FSA4480. * FSA4480 block diagram shows AUX+ connected to SBU2 and AUX- to SBU1. * OCP96011 block diagram shows AUX+ connected to SBU1 and AUX- to SBU2. So if OCP96011 is used as drop-in for FSA4480 then the orientation handling in the driver needs to be reversed to match the expectation of the OCP96011 hardware. Support parsing the data-lanes parameter in the endpoint node to swap this in the driver. The parse_data_lanes_mapping function is mostly taken from nb7vpq904m.c. Reviewed-by: Neil Armstrong Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20231020-fsa4480-swap-v2-2-9a7f9bb59873@fairphone.com Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/mux/fsa4480.c | 71 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) commit fad89aa14c35f469ea7d3bf49ee1d5840eea0375 Author: Luca Weiss Date: Fri Oct 20 11:33:18 2023 +0200 dt-bindings: usb: fsa4480: Add data-lanes property to endpoint Allow specifying data-lanes to reverse the muxing orientation between AUX+/- and SBU1/2 where necessary by the hardware design. In the mux there's a switch that needs to be controlled from the OS, and it either connects AUX+ -> SBU1 and AUX- -> SBU2, or the reverse: AUX+ -> SBU2 and AUX- -> SBU1, depending on the orientation of how the USB-C connector is plugged in. With this data-lanes property we can now specify that AUX+ and AUX- connections are swapped between the SoC and the mux, therefore the OS needs to consider this and reverse the direction of this switch in the mux. _______ _______ | | | |-- HP --| | |-- MIC --| |or SoC | | MUX |-- SBU1 ---> To the USB-C Codec |-- AUX+ --| |-- SBU2 ---> connected |-- AUX- --| | ______| |_____| (thanks to Neil Armstrong for this ASCII art) Signed-off-by: Luca Weiss Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20231020-fsa4480-swap-v2-1-9a7f9bb59873@fairphone.com Signed-off-by: Greg Kroah-Hartman .../devicetree/bindings/usb/fcs,fsa4480.yaml | 29 +++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) commit 4987daf86c152ff882d51572d154ad12e4ff3a4b Author: Jimmy Hu Date: Fri Oct 20 01:21:32 2023 +0000 usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() It is possible that typec_register_partner() returns ERR_PTR on failure. When port->partner is an error, a NULL pointer dereference may occur as shown below. [91222.095236][ T319] typec port0: failed to register partner (-17) ... [91225.061491][ T319] Unable to handle kernel NULL pointer dereference at virtual address 000000000000039f [91225.274642][ T319] pc : tcpm_pd_data_request+0x310/0x13fc [91225.274646][ T319] lr : tcpm_pd_data_request+0x298/0x13fc [91225.308067][ T319] Call trace: [91225.308070][ T319] tcpm_pd_data_request+0x310/0x13fc [91225.308073][ T319] tcpm_pd_rx_handler+0x100/0x9e8 [91225.355900][ T319] kthread_worker_fn+0x178/0x58c [91225.355902][ T319] kthread+0x150/0x200 [91225.355905][ T319] ret_from_fork+0x10/0x30 Add a check for port->partner to avoid dereferencing a NULL pointer. Fixes: 5e1d4c49fbc8 ("usb: typec: tcpm: Determine common SVDM Version") Cc: stable@vger.kernel.org Signed-off-by: Jimmy Hu Link: https://lore.kernel.org/r/20231020012132.100960-1-hhhuuu@google.com Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/tcpm/tcpm.c | 3 +++ 1 file changed, 3 insertions(+) commit a5901f27dcf13203e5b342b7e9439314a775bf32 Author: Geoffrey D. Bennett Date: Fri Oct 27 20:31:21 2023 +1030 ALSA: scarlett2: Add missing check with firmware version control scarlett2_add_firmware_version_ctl() may return an error, but the return value was not being checked. Add the missing check. Signed-off-by: Geoffrey D. Bennett Fixes: 701949cc0128 ("ALSA: scarlett2: Add support for reading firmware version") Link: https://lore.kernel.org/r/ZTuKcXajVnuelBEb@m.b4.vu Signed-off-by: Takashi Iwai sound/usb/mixer_scarlett2.c | 2 ++ 1 file changed, 2 insertions(+) commit 6808918343a8b4b6970ba52ba2d1d511a0976748 Author: Nikolay Aleksandrov Date: Fri Oct 27 13:05:49 2023 +0300 net: bridge: fill in MODULE_DESCRIPTION() Fill in bridge's module description. Suggested-by: Jakub Kicinski Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/bridge/br.c | 1 + 1 file changed, 1 insertion(+) commit f2b88bab69c86d4dab2bfd25a0e741d7df411f7a Author: Dimitri John Ledkov Date: Sun Oct 22 19:22:08 2023 +0100 Documentation/module-signing.txt: bring up to date Update the documentation to mention that ECC NIST P-384 automatic keypair generation is available to use ECDSA signature type, in addition to the RSA. Drop mentions of the now removed SHA-1 and SHA-224 options. Add the just added FIPS 202 SHA-3 module signature hashes. Signed-off-by: Dimitri John Ledkov Signed-off-by: Herbert Xu Documentation/admin-guide/module-signing.rst | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) commit 446b1e0b7b39e2bf2187c58ba2a1cc60fb01de8b Author: Dimitri John Ledkov Date: Sun Oct 22 19:22:07 2023 +0100 module: enable automatic module signing with FIPS 202 SHA-3 Add Kconfig options to use SHA-3 for kernel module signing. 256 size for RSA only, and higher sizes for RSA and NIST P-384. Signed-off-by: Dimitri John Ledkov Signed-off-by: Herbert Xu certs/Kconfig | 2 +- kernel/module/Kconfig | 15 +++++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) commit fdb4f66c9545f29742be5a8d325798e6016c3c4e Author: Dimitri John Ledkov Date: Sun Oct 22 19:22:06 2023 +0100 crypto: asymmetric_keys - allow FIPS 202 SHA-3 signatures Add FIPS 202 SHA-3 hash signature support in x509 certificates, pkcs7 signatures, and authenticode signatures. Supports hashes of size 256 and up, as 224 is too weak for any practical purposes. Signed-off-by: Dimitri John Ledkov Signed-off-by: Herbert Xu crypto/asymmetric_keys/mscode_parser.c | 9 +++++++++ crypto/asymmetric_keys/pkcs7_parser.c | 12 ++++++++++++ crypto/asymmetric_keys/public_key.c | 5 ++++- crypto/asymmetric_keys/x509_cert_parser.c | 24 ++++++++++++++++++++++++ 4 files changed, 49 insertions(+), 1 deletion(-) commit ee62afb9d02dd279a7b73245614f13f8fe777a6d Author: Dimitri John Ledkov Date: Sun Oct 22 19:22:05 2023 +0100 crypto: rsa-pkcs1pad - Add FIPS 202 SHA-3 support Add support in rsa-pkcs1pad for FIPS 202 SHA-3 hashes, sizes 256 and up. As 224 is too weak for any practical purposes. Signed-off-by: Dimitri John Ledkov Signed-off-by: Herbert Xu crypto/rsa-pkcs1pad.c | 25 ++++++++++++++++++++++++- crypto/testmgr.c | 12 ++++++++++++ 2 files changed, 36 insertions(+), 1 deletion(-) commit 4b057654ebc3e071e2a95ea2edfd15b5682cedba Author: Dimitri John Ledkov Date: Sun Oct 22 19:22:04 2023 +0100 crypto: FIPS 202 SHA-3 register in hash info for IMA Register FIPS 202 SHA-3 hashes in hash info for IMA and other users. Sizes 256 and up, as 224 is too weak for any practical purposes. Signed-off-by: Dimitri John Ledkov Signed-off-by: Herbert Xu crypto/hash_info.c | 6 ++++++ include/crypto/hash_info.h | 1 + include/uapi/linux/hash_info.h | 3 +++ 3 files changed, 10 insertions(+) commit 2ee7c1bcf3d1c91ede9d914c52fa2f56c449b75a Author: Dimitri John Ledkov Date: Sun Oct 22 19:22:03 2023 +0100 x509: Add OIDs for FIPS 202 SHA-3 hash and signatures Add OID for FIPS 202 SHA-3 family of hash functions, RSA & ECDSA signatures using those. Limit to 256 or larger sizes, for interoperability reasons. 224 is too weak for any practical uses. Signed-off-by: Dimitri John Ledkov Signed-off-by: Herbert Xu include/linux/oid_registry.h | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 2f1f34c1bf7b309b296bc04321a09e6b5dba0673 Author: Eric Biggers Date: Sun Oct 22 01:11:00 2023 -0700 crypto: ahash - optimize performance when wrapping shash The "ahash" API provides access to both CPU-based and hardware offload- based implementations of hash algorithms. Typically the former are implemented as "shash" algorithms under the hood, while the latter are implemented as "ahash" algorithms. The "ahash" API provides access to both. Various kernel subsystems use the ahash API because they want to support hashing hardware offload without using a separate API for it. Yet, the common case is that a crypto accelerator is not actually being used, and ahash is just wrapping a CPU-based shash algorithm. This patch optimizes the ahash API for that common case by eliminating the extra indirect call for each ahash operation on top of shash. It also fixes the double-counting of crypto stats in this scenario (though CONFIG_CRYPTO_STATS should *not* be enabled by anyone interested in performance anyway...), and it eliminates redundant checking of CRYPTO_TFM_NEED_KEY. As a bonus, it also shrinks struct crypto_ahash. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/ahash.c | 285 +++++++++++++++++++++++++------------------------- crypto/hash.h | 10 ++ crypto/shash.c | 8 +- include/crypto/hash.h | 68 +----------- 4 files changed, 167 insertions(+), 204 deletions(-) commit 85b84327b3f0df32be19e01257fb375972be115c Author: Eric Biggers Date: Sun Oct 22 01:10:59 2023 -0700 crypto: ahash - check for shash type instead of not ahash type Since the previous patch made crypto_shash_type visible to ahash.c, change checks for '->cra_type != &crypto_ahash_type' to '->cra_type == &crypto_shash_type'. This makes more sense and avoids having to forward-declare crypto_ahash_type. The result is still the same, since the type is either shash or ahash here. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/ahash.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit ecf889b70b6c0a174965a902a381f967bfd06914 Author: Eric Biggers Date: Sun Oct 22 01:10:58 2023 -0700 crypto: hash - move "ahash wrapping shash" functions to ahash.c The functions that are involved in implementing the ahash API on top of an shash algorithm belong better in ahash.c, not in shash.c where they currently are. Move them. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/ahash.c | 186 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ crypto/hash.h | 4 +- crypto/shash.c | 189 +-------------------------------------------------------- 3 files changed, 188 insertions(+), 191 deletions(-) commit 9826d1d6ed5f86cb3d61610b3b1fe31e96a40418 Author: Eric Biggers Date: Sun Oct 22 01:10:57 2023 -0700 crypto: talitos - stop using crypto_ahash::init The function pointer crypto_ahash::init is an internal implementation detail of the ahash API that exists to help it support both ahash and shash algorithms. With an upcoming refactoring of how the ahash API supports shash algorithms, this field will be removed. Some drivers are invoking crypto_ahash::init to call into their own code, which is unnecessary and inefficient. The talitos driver is one of those drivers. Make it just call its own code directly. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu drivers/crypto/talitos.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) commit 9416210fb0b4b63ee7b812856ab6f989cfa7acbe Author: Eric Biggers Date: Sun Oct 22 01:10:56 2023 -0700 crypto: chelsio - stop using crypto_ahash::init The function pointer crypto_ahash::init is an internal implementation detail of the ahash API that exists to help it support both ahash and shash algorithms. With an upcoming refactoring of how the ahash API supports shash algorithms, this field will be removed. Some drivers are invoking crypto_ahash::init to call into their own code, which is unnecessary and inefficient. The chelsio driver is one of those drivers. Make it just call its own code directly. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu drivers/crypto/chelsio/chcr_algo.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 4d707a47517674434a7adb3a11ca9e1c9d4a1adf Author: Eric Biggers Date: Sun Oct 22 01:10:55 2023 -0700 crypto: ahash - improve file comment Improve the file comment for crypto/ahash.c. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/ahash.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit c2435e81a6930fed5aeb0aecc219b467a3045f5d Author: Eric Biggers Date: Sun Oct 22 01:10:54 2023 -0700 crypto: ahash - remove struct ahash_request_priv struct ahash_request_priv is unused, so remove it. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/ahash.c | 8 -------- 1 file changed, 8 deletions(-) commit 0f8660c82b79af595b056f6b9f4f227edeb88574 Author: Eric Biggers Date: Sun Oct 22 01:10:53 2023 -0700 crypto: ahash - remove crypto_ahash_alignmask crypto_ahash_alignmask() no longer has any callers, and it always returns 0 now that neither ahash nor shash algorithms support nonzero alignmasks anymore. Therefore, remove it. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu include/crypto/hash.h | 6 ------ 1 file changed, 6 deletions(-) commit 33fe2fb763a84152a297e97b144bbda19fde67e4 Author: Eric Biggers Date: Sun Oct 22 01:10:52 2023 -0700 crypto: gcm - stop using alignmask of ahash Now that the alignmask for ahash and shash algorithms is always 0, simplify crypto_gcm_create_common() accordingly. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/gcm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 381a796a187a3c1ab477e7d1e5ea0c6aea1e9404 Author: Eric Biggers Date: Sun Oct 22 01:10:51 2023 -0700 crypto: chacha20poly1305 - stop using alignmask of ahash Now that the alignmask for ahash and shash algorithms is always 0, simplify chachapoly_create() accordingly. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/chacha20poly1305.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 36cfc05715a7ca0c989a355f173cbe6ec469c1f9 Author: Eric Biggers Date: Sun Oct 22 01:10:50 2023 -0700 crypto: ccm - stop using alignmask of ahash Now that the alignmask for ahash and shash algorithms is always 0, simplify crypto_ccm_create_common() accordingly. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/ccm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 0a6bfaa0e695facb072f2fedfb55df37c4483b50 Author: Eric Biggers Date: Sun Oct 22 01:10:49 2023 -0700 net: ipv6: stop checking crypto_ahash_alignmask Now that the alignmask for ahash and shash algorithms is always 0, crypto_ahash_alignmask() always returns 0 and will be removed. In preparation for this, stop checking crypto_ahash_alignmask() in ah6.c. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu net/ipv6/ah6.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) commit e77f5dd701381cef35b9ea8b6dea6e62c8a7f9f3 Author: Eric Biggers Date: Sun Oct 22 01:10:48 2023 -0700 net: ipv4: stop checking crypto_ahash_alignmask Now that the alignmask for ahash and shash algorithms is always 0, crypto_ahash_alignmask() always returns 0 and will be removed. In preparation for this, stop checking crypto_ahash_alignmask() in ah4.c. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu net/ipv4/ah4.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) commit 93f367a9a41ab539e905b1ea91254868e4cf8faa Author: Eric Biggers Date: Sun Oct 22 01:10:47 2023 -0700 crypto: testmgr - stop checking crypto_ahash_alignmask Now that the alignmask for ahash and shash algorithms is always 0, crypto_ahash_alignmask() always returns 0 and will be removed. In preparation for this, stop checking crypto_ahash_alignmask() in testmgr. As a result of this change, test_sg_division::offset_relative_to_alignmask and testvec_config::key_offset_relative_to_alignmask no longer have any effect on ahash (or shash) algorithms. Therefore, also stop setting these flags in default_hash_testvec_configs[]. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/testmgr.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit 03be4e45074e2a9cb5e06bf527141716262574e6 Author: Eric Biggers Date: Sun Oct 22 01:10:46 2023 -0700 crypto: authencesn - stop using alignmask of ahash Now that the alignmask for ahash and shash algorithms is always 0, simplify the code in authenc accordingly. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/authencesn.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) commit 58e4bb5f16e7b643f7ee5d30cd355cefb44b2da9 Author: Eric Biggers Date: Sun Oct 22 01:10:45 2023 -0700 crypto: authenc - stop using alignmask of ahash Now that the alignmask for ahash and shash algorithms is always 0, simplify the code in authenc accordingly. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/authenc.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) commit c626910f3f1bbce6ad18bc613d895d2a089ed95e Author: Eric Biggers Date: Sun Oct 22 01:10:44 2023 -0700 crypto: ahash - remove support for nonzero alignmask Currently, the ahash API checks the alignment of all key and result buffers against the algorithm's declared alignmask, and for any unaligned buffers it falls back to manually aligned temporary buffers. This is virtually useless, however. First, since it does not apply to the message, its effect is much more limited than e.g. is the case for the alignmask for "skcipher". Second, the key and result buffers are given as virtual addresses and cannot (in general) be DMA'ed into, so drivers end up having to copy to/from them in software anyway. As a result it's easy to use memcpy() or the unaligned access helpers. The crypto_hash_walk_*() helper functions do use the alignmask to align the message. But with one exception those are only used for shash algorithms being exposed via the ahash API, not for native ahashes, and aligning the message is not required in this case, especially now that alignmask support has been removed from shash. The exception is the n2_core driver, which doesn't set an alignmask. In any case, no ahash algorithms actually set a nonzero alignmask anymore. Therefore, remove support for it from ahash. The benefit is that all the code to handle "misaligned" buffers in the ahash API goes away, reducing the overhead of the ahash API. This follows the same change that was made to shash. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu Documentation/crypto/devel-algos.rst | 4 +- crypto/ahash.c | 117 +++-------------------------------- crypto/shash.c | 8 +-- include/crypto/internal/hash.h | 4 +- include/linux/crypto.h | 27 ++++---- 5 files changed, 28 insertions(+), 132 deletions(-) commit 54eea8e29026c6cceeb52151f46e3b994de5513a Author: Eric Biggers Date: Sun Oct 22 01:10:43 2023 -0700 crypto: stm32 - remove unnecessary alignmask for ahashes The crypto API's support for alignmasks for ahash algorithms is nearly useless, as its only effect is to cause the API to align the key and result buffers. The drivers that happen to be specifying an alignmask for ahash rarely actually need it. When they do, it's easily fixable, especially considering that these buffers cannot be used for DMA. In preparation for removing alignmask support from ahash, this patch makes the stm32 driver no longer use it. This driver didn't actually rely on it; it only writes to the result buffer in stm32_hash_finish(), simply using memcpy(). And stm32_hash_setkey() does not assume any alignment for the key buffer. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu drivers/crypto/stm32/stm32-hash.c | 20 -------------------- 1 file changed, 20 deletions(-) commit 8c87553e2db672254d858991c42964030ad7da45 Author: Eric Biggers Date: Sun Oct 22 01:10:42 2023 -0700 crypto: starfive - remove unnecessary alignmask for ahashes The crypto API's support for alignmasks for ahash algorithms is nearly useless, as its only effect is to cause the API to align the key and result buffers. The drivers that happen to be specifying an alignmask for ahash rarely actually need it. When they do, it's easily fixable, especially considering that these buffers cannot be used for DMA. In preparation for removing alignmask support from ahash, this patch makes the starfive driver no longer use it. This driver did actually rely on it, but only for storing to the result buffer using int stores in starfive_hash_copy_hash(). This patch makes starfive_hash_copy_hash() use put_unaligned() instead. (It really should use a specific endianness, but that's an existing bug.) Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu drivers/crypto/starfive/jh7110-hash.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) commit 2d91a839f5da3836e3b3f27452fe38a84fc403c6 Author: Eric Biggers Date: Sun Oct 22 01:10:41 2023 -0700 crypto: rockchip - remove unnecessary alignmask for ahashes The crypto API's support for alignmasks for ahash algorithms is nearly useless, as its only effect is to cause the API to align the key and result buffers. The drivers that happen to be specifying an alignmask for ahash rarely actually need it. When they do, it's easily fixable, especially considering that these buffers cannot be used for DMA. In preparation for removing alignmask support from ahash, this patch makes the rockchip driver no longer use it. This driver didn't actually rely on it; it only writes to the result buffer in rk_hash_run(), already using put_unaligned_le32(). And this driver only supports unkeyed hash algorithms, so the key buffer need not be considered. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu drivers/crypto/rockchip/rk3288_crypto_ahash.c | 3 --- 1 file changed, 3 deletions(-) commit f35a4e237f4ecfac0cbf51fc840fe70955431fa9 Author: Eric Biggers Date: Sun Oct 22 01:10:40 2023 -0700 crypto: omap-sham - stop setting alignmask for ahashes The crypto API's support for alignmasks for ahash algorithms is nearly useless, as its only effect is to cause the API to align the key and result buffers. The drivers that happen to be specifying an alignmask for ahash rarely actually need it. When they do, it's easily fixable, especially considering that these buffers cannot be used for DMA. In preparation for removing alignmask support from ahash, this patch makes the omap-sham driver no longer use it. This driver did actually rely on it, but only for storing to the result buffer using __u32 stores in omap_sham_copy_ready_hash(). This patch makes omap_sham_copy_ready_hash() use put_unaligned() instead. (It really should use a specific endianness, but that's an existing bug.) Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu drivers/crypto/omap-sham.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) commit 492444c3ed8fee48dda3ade814b5592374897c29 Author: Eric Biggers Date: Sun Oct 22 01:10:39 2023 -0700 crypto: talitos - remove unnecessary alignmask for ahashes The crypto API's support for alignmasks for ahash algorithms is nearly useless, as its only effect is to cause the API to align the key and result buffers. The drivers that happen to be specifying an alignmask for ahash rarely actually need it. When they do, it's easily fixable, especially considering that these buffers cannot be used for DMA. In preparation for removing alignmask support from ahash, this patch makes the talitos driver no longer use it. This driver didn't actually rely on it; it only writes to the result buffer in common_nonsnoop_hash_unmap(), simply using memcpy(). And this driver's "ahash_setkey()" function does not assume any alignment for the key buffer. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu drivers/crypto/talitos.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 13d13bba26a0930a4c9527bf2e589d79074b45e5 Author: Eric Biggers Date: Sun Oct 22 01:10:38 2023 -0700 crypto: s5p-sss - remove unnecessary alignmask for ahashes The crypto API's support for alignmasks for ahash algorithms is nearly useless, as its only effect is to cause the API to align the key and result buffers. The drivers that happen to be specifying an alignmask for ahash rarely actually need it. When they do, it's easily fixable, especially considering that these buffers cannot be used for DMA. In preparation for removing alignmask support from ahash, this patch makes the s5p-sss driver no longer use it. This driver didn't actually rely on it; it only writes to the result buffer in s5p_hash_copy_result(), simply using memcpy(). And this driver only supports unkeyed hash algorithms, so the key buffer need not be considered. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu drivers/crypto/s5p-sss.c | 6 ------ 1 file changed, 6 deletions(-) commit d39caf81248703164dee256611dc801102653830 Author: Eric Biggers Date: Sun Oct 22 01:10:37 2023 -0700 crypto: mxs-dcp - remove unnecessary alignmask for ahashes The crypto API's support for alignmasks for ahash algorithms is nearly useless, as its only effect is to cause the API to align the key and result buffers. The drivers that happen to be specifying an alignmask for ahash rarely actually need it. When they do, it's easily fixable, especially considering that these buffers cannot be used for DMA. In preparation for removing alignmask support from ahash, this patch makes the mxs-dcp driver no longer use it. This driver didn't actually rely on it; it only writes to the result buffer in dcp_sha_req_to_buf(), using a bytewise copy. And this driver only supports unkeyed hash algorithms, so the key buffer need not be considered. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu drivers/crypto/mxs-dcp.c | 2 -- 1 file changed, 2 deletions(-) commit a06f7a8a8397ca05cee3805a5850fbb84e585fb0 Author: Eric Biggers Date: Sun Oct 22 01:10:36 2023 -0700 crypto: artpec6 - stop setting alignmask for ahashes The crypto API's support for alignmasks for ahash algorithms is nearly useless, as its only effect is to cause the API to align the key and result buffers. The drivers that happen to be specifying an alignmask for ahash rarely actually need it. When they do, it's easily fixable, especially considering that these buffers cannot be used for DMA. In preparation for removing alignmask support from ahash, this patch makes the artpec6 driver no longer use it. This driver is unusual in that it DMAs the digest directly to the result buffer. This is broken because the crypto API provides the result buffer as an arbitrary virtual address, which might not be valid for DMA, even after the crypto API applies the alignmask. Maybe the alignmask (which this driver set only to 3) made this code work in a few more cases than it otherwise would have. But even if so, it doesn't make sense for this single driver that is broken anyway to block removal of the alignmask support. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu drivers/crypto/axis/artpec6_crypto.c | 3 --- 1 file changed, 3 deletions(-) commit a5e12d04e5226cd7afecd020a4f66d7ac73fd90e Author: Eric Biggers Date: Sun Oct 22 01:10:35 2023 -0700 crypto: atmel - remove unnecessary alignmask for ahashes The crypto API's support for alignmasks for ahash algorithms is nearly useless, as its only effect is to cause the API to align the key and result buffers. The drivers that happen to be specifying an alignmask for ahash rarely actually need it. When they do, it's easily fixable, especially considering that these buffers cannot be used for DMA. In preparation for removing alignmask support from ahash, this patch makes the atmel driver no longer use it. This driver didn't actually rely on it; it only writes to the result buffer in atmel_sha_copy_ready_hash(), simply using memcpy(). And this driver didn't set an alignmask for any keyed hash algorithms, so the key buffer need not be considered. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu drivers/crypto/atmel-sha.c | 2 -- 1 file changed, 2 deletions(-) commit 028a14470e0f937f037d2193d836148af8dc2d5c Author: Eric Biggers Date: Sun Oct 22 01:10:34 2023 -0700 crypto: sun8i-ss - remove unnecessary alignmask for ahashes The crypto API's support for alignmasks for ahash algorithms is nearly useless, as its only effect is to cause the API to align the key and result buffers. The drivers that happen to be specifying an alignmask for ahash rarely actually need it. When they do, it's easily fixable, especially considering that these buffers cannot be used for DMA. In preparation for removing alignmask support from ahash, this patch makes the sun8i-ss driver no longer use it. This driver didn't actually rely on it; it only writes to the result buffer in sun8i_ss_hash_run(), simply using memcpy(). And sun8i_ss_hmac_setkey() does not assume any alignment for the key buffer. Signed-off-by: Eric Biggers Acked-by: Corentin Labbe Signed-off-by: Herbert Xu drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 5 ----- 1 file changed, 5 deletions(-) commit 12e06ca3b98326e6320b74c18d344db294f2e5ae Author: Eric Biggers Date: Sun Oct 22 01:10:33 2023 -0700 crypto: sun8i-ce - remove unnecessary alignmask for ahashes The crypto API's support for alignmasks for ahash algorithms is nearly useless, as its only effect is to cause the API to align the key and result buffers. The drivers that happen to be specifying an alignmask for ahash rarely actually need it. When they do, it's easily fixable, especially considering that these buffers cannot be used for DMA. In preparation for removing alignmask support from ahash, this patch makes the sun8i-ce driver no longer use it. This driver didn't actually rely on it; it only writes to the result buffer in sun8i_ce_hash_run(), simply using memcpy(). And this driver only supports unkeyed hash algorithms, so the key buffer need not be considered. Signed-off-by: Eric Biggers Acked-by: Corentin Labbe Signed-off-by: Herbert Xu drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 6 ------ 1 file changed, 6 deletions(-) commit 977755579d3f7f6ad6b719b0f50c924c89ea8c1e Author: Eric Biggers Date: Sun Oct 22 01:10:32 2023 -0700 crypto: sun4i-ss - remove unnecessary alignmask for ahashes The crypto API's support for alignmasks for ahash algorithms is nearly useless, as its only effect is to cause the API to align the key and result buffers. The drivers that happen to be specifying an alignmask for ahash rarely actually need it. When they do, it's easily fixable, especially considering that these buffers cannot be used for DMA. In preparation for removing alignmask support from ahash, this patch makes the sun4i-ss driver no longer use it. This driver didn't actually rely on it; it only writes to the result buffer in sun4i_hash(), already using the unaligned access helpers. And this driver only supports unkeyed hash algorithms, so the key buffer need not be considered. Signed-off-by: Eric Biggers Acked-by: Corentin Labbe Signed-off-by: Herbert Xu drivers/crypto/allwinner/sun4i-ss/sun4i-ss-core.c | 2 -- 1 file changed, 2 deletions(-) commit acd7799574e57f1e494a5b85741eee78d1e93aca Author: Eric Biggers Date: Sun Oct 22 01:10:31 2023 -0700 crypto: shash - remove crypto_shash_ctx_aligned() crypto_shash_ctx_aligned() is no longer used, and it is useless now that shash algorithms don't support nonzero alignmasks, so remove it. Also remove crypto_tfm_ctx_aligned() which was only called by crypto_shash_ctx_aligned(). It's unlikely to be useful again, since it seems inappropriate to use cra_alignmask to represent alignment for the tfm context when it already means alignment for inputs/outputs. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu include/crypto/algapi.h | 5 ----- include/crypto/internal/hash.h | 5 ----- 2 files changed, 10 deletions(-) commit 201c0da4d0298cfcd06a4548f94b90e3817b2e1b Author: Lukas Wunner Date: Sat Oct 21 13:23:44 2023 +0200 treewide: Add SPDX identifier to IETF ASN.1 modules Per section 4.c. of the IETF Trust Legal Provisions, "Code Components" in IETF Documents are licensed on the terms of the BSD-3-Clause license: https://trustee.ietf.org/documents/trust-legal-provisions/tlp-5/ The term "Code Components" specifically includes ASN.1 modules: https://trustee.ietf.org/documents/trust-legal-provisions/code-components-list-3/ Add an SPDX identifier as well as a copyright notice pursuant to section 6.d. of the Trust Legal Provisions to all ASN.1 modules in the tree which are derived from IETF Documents. Section 4.d. of the Trust Legal Provisions requests that each Code Component identify the RFC from which it is taken, so link that RFC in every ASN.1 module. Signed-off-by: Lukas Wunner Signed-off-by: Herbert Xu crypto/asymmetric_keys/pkcs7.asn1 | 7 +++++++ crypto/asymmetric_keys/pkcs8.asn1 | 6 ++++++ crypto/asymmetric_keys/x509.asn1 | 7 +++++++ crypto/asymmetric_keys/x509_akid.asn1 | 5 +++++ crypto/rsaprivkey.asn1 | 7 +++++++ crypto/rsapubkey.asn1 | 7 +++++++ fs/smb/server/ksmbd_spnego_negtokeninit.asn1 | 8 ++++++++ fs/smb/server/ksmbd_spnego_negtokentarg.asn1 | 7 +++++++ net/ipv4/netfilter/nf_nat_snmp_basic.asn1 | 8 ++++++++ 9 files changed, 62 insertions(+) commit 45b40f9cf10d9ad33828f00e952e9942adf1e114 Author: Ashish Kalra Date: Fri Oct 20 21:22:34 2023 +0000 MAINTAINERS: update AMD CRYPTOGRAPHIC COPROCESSOR (CCP) DRIVER - SEV SUPPORT Brijesh is no longer with AMD. Signed-off-by: Ashish Kalra Reviewed-by: Michael Roth Acked-by: Tom Lendacky Signed-off-by: Herbert Xu MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 203b01001c4d741205b9c329acddc5193ed56fbd Author: Giovanni Cabiddu Date: Fri Oct 20 16:33:21 2023 +0100 crypto: qat - fix deadlock in backlog processing If a request has the flag CRYPTO_TFM_REQ_MAY_BACKLOG set, the function qat_alg_send_message_maybacklog(), enqueues it in a backlog list if either (1) there is already at least one request in the backlog list, or (2) the HW ring is nearly full or (3) the enqueue to the HW ring fails. If an interrupt occurs right before the lock in qat_alg_backlog_req() is taken and the backlog queue is being emptied, then there is no request in the HW queues that can trigger a subsequent interrupt that can clear the backlog queue. In addition subsequent requests are enqueued to the backlog list and not sent to the hardware. Fix it by holding the lock while taking the decision if the request needs to be included in the backlog queue or not. This synchronizes the flow with the interrupt handler that drains the backlog queue. For performance reasons, the logic has been changed to try to enqueue first without holding the lock. Fixes: 386823839732 ("crypto: qat - add backlog mechanism") Reported-by: Mikulas Patocka Closes: https://lore.kernel.org/all/af9581e2-58f9-cc19-428f-6f18f1f83d54@redhat.com/T/ Signed-off-by: Giovanni Cabiddu Reviewed-by: Mikulas Patocka Signed-off-by: Herbert Xu .../crypto/intel/qat/qat_common/qat_algs_send.c | 46 ++++++++++++---------- 1 file changed, 25 insertions(+), 21 deletions(-) commit 03c76e8e7a8d0d465838b8eaffcc07bdcc364f4d Author: Giovanni Cabiddu Date: Fri Oct 20 15:52:51 2023 +0100 crypto: qat - move adf_cfg_services The file adf_cfg_services.h cannot be included in header files since it instantiates the structure adf_cfg_services. Move that structure to its own file and export the symbol. This does not introduce any functional change. Signed-off-by: Giovanni Cabiddu Reviewed-by: Damian Muszynski Signed-off-by: Herbert Xu drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 2 +- drivers/crypto/intel/qat/qat_common/Makefile | 1 + .../crypto/intel/qat/qat_common/adf_cfg_services.c | 20 ++++++++++++++++++++ .../crypto/intel/qat/qat_common/adf_cfg_services.h | 14 ++------------ 4 files changed, 24 insertions(+), 13 deletions(-) commit 71fed09b49c168435fc28d57870007495475d946 Author: Ciunas Bennett Date: Fri Oct 20 15:49:31 2023 +0200 crypto: qat - add num_rps sysfs attribute Add the attribute `num_rps` to the `qat` attribute group. This returns the number of ring pairs that a single device has. This allows to know the maximum value that can be set to the attribute `rp2svc`. Signed-off-by: Ciunas Bennett Reviewed-by: Giovanni Cabiddu Reviewed-by: Damian Muszynski Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu Documentation/ABI/testing/sysfs-driver-qat | 14 ++++++++++++++ drivers/crypto/intel/qat/qat_common/adf_sysfs.c | 14 ++++++++++++++ 2 files changed, 28 insertions(+) commit dbc8876dd873a6ac5e3191b419d2de5ca613165f Author: Ciunas Bennett Date: Fri Oct 20 15:49:30 2023 +0200 crypto: qat - add rp2svc sysfs attribute Add the attribute `rp2svc` to the `qat` attribute group. This provides a way for a user to query a specific ring pair for the type of service that is currently configured for. When read, the service will be returned for the defined ring pair. When written to this value will be stored as the ring pair to return the service of. Signed-off-by: Ciunas Bennett Reviewed-by: Giovanni Cabiddu Reviewed-by: Damian Muszynski Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu Documentation/ABI/testing/sysfs-driver-qat | 32 +++++++++++ .../intel/qat/qat_common/adf_accel_devices.h | 6 ++ drivers/crypto/intel/qat/qat_common/adf_sysfs.c | 66 ++++++++++++++++++++++ 3 files changed, 104 insertions(+) commit db74e16258198094701f18ab4da3410c44ffdb2e Author: Ciunas Bennett Date: Fri Oct 20 15:49:29 2023 +0200 crypto: qat - add rate limiting sysfs interface Add an interface for the rate limiting feature which allows to add, remove and modify a QAT SLA (Service Level Agreement). This adds a new sysfs attribute group, `qat_rl`, which can be accessed from /sys/bus/pci/devices/ with the following hierarchy: |-+ qat_rl |---- id (RW) # SLA identifier |---- cir (RW) # Committed Information Rate |---- pir (RW) # Peak Information Rate |---- srv (RW) # Service to be rate limited |---- rp (RW) (HEX) # Ring pairs to be rate limited |---- cap_rem (RW) # Remaining capability for a service |---- sla_op (WO) # Allows to perform an operation on an SLA The API works by setting the appropriate RW attributes and then issuing a command through the `sla_op`. For example, to create an SLA, a user needs to input the necessary data into the attributes cir, pir, srv and rp and then write into `sla_op` the command `add` to execute the operation. The API also provides `cap_rem` attribute to get information about the remaining device capability within a certain service which is required when setting an SLA. Signed-off-by: Ciunas Bennett Reviewed-by: Giovanni Cabiddu Reviewed-by: Damian Muszynski Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu Documentation/ABI/testing/sysfs-driver-qat_rl | 226 +++++++++++ drivers/crypto/intel/qat/qat_common/Makefile | 1 + drivers/crypto/intel/qat/qat_common/adf_rl.c | 10 + drivers/crypto/intel/qat/qat_common/adf_rl.h | 7 + drivers/crypto/intel/qat/qat_common/adf_sysfs_rl.c | 451 +++++++++++++++++++++ drivers/crypto/intel/qat/qat_common/adf_sysfs_rl.h | 11 + 6 files changed, 706 insertions(+) commit d9fb8408376e70a903d06ac86e42e0d0f44a5785 Author: Damian Muszynski Date: Fri Oct 20 15:49:28 2023 +0200 crypto: qat - add rate limiting feature to qat_4xxx The Rate Limiting (RL) feature allows to control the rate of requests that can be submitted on a ring pair (RP). This allows sharing a QAT device among multiple users while ensuring a guaranteed throughput. The driver provides a mechanism that allows users to set policies, that are programmed to the device. The device is then enforcing those policies. Configuration of RL is accomplished through entities called SLAs (Service Level Agreement). Each SLA object gets a unique identifier and defines the limitations for a single service across up to four ring pairs (RPs count allocated to a single VF). The rate is determined using two fields: * CIR (Committed Information Rate), i.e., the guaranteed rate. * PIR (Peak Information Rate), i.e., the maximum rate achievable when the device has available resources. The rate values are expressed in permille scale i.e. 0-1000. Ring pair selection is achieved by providing a 64-bit mask, where each bit corresponds to one of the ring pairs. This adds an interface and logic that allow to add, update, retrieve and remove an SLA. Signed-off-by: Damian Muszynski Reviewed-by: Giovanni Cabiddu Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu .../crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 20 + .../crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.h | 13 +- drivers/crypto/intel/qat/qat_common/Makefile | 2 + .../intel/qat/qat_common/adf_accel_devices.h | 3 + drivers/crypto/intel/qat/qat_common/adf_admin.c | 47 + drivers/crypto/intel/qat/qat_common/adf_admin.h | 8 + .../crypto/intel/qat/qat_common/adf_gen4_hw_data.h | 7 + drivers/crypto/intel/qat/qat_common/adf_init.c | 10 + drivers/crypto/intel/qat/qat_common/adf_rl.c | 1159 ++++++++++++++++++++ drivers/crypto/intel/qat/qat_common/adf_rl.h | 169 +++ drivers/crypto/intel/qat/qat_common/adf_rl_admin.c | 97 ++ drivers/crypto/intel/qat/qat_common/adf_rl_admin.h | 18 + .../intel/qat/qat_common/icp_qat_fw_init_admin.h | 38 + 13 files changed, 1590 insertions(+), 1 deletion(-) commit c7fd53796dbd09c3ef55032925bc7f8f238f9405 Author: Damian Muszynski Date: Fri Oct 20 15:49:27 2023 +0200 crypto: qat - add retrieval of fw capabilities The QAT firmware provides a mechanism to retrieve its capabilities through the init admin interface. Add logic to retrieve the firmware capability mask from the firmware through the init/admin channel. This mask reports if the power management, telemetry and rate limiting features are supported. The fw capabilities are stored in the accel_dev structure and are used to detect if a certain feature is supported by the firmware loaded in the device. This is supported only by devices which have an admin AE. Signed-off-by: Damian Muszynski Reviewed-by: Giovanni Cabiddu Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu .../intel/qat/qat_common/adf_accel_devices.h | 1 + drivers/crypto/intel/qat/qat_common/adf_admin.c | 23 ++++++++++++++++++++++ .../intel/qat/qat_common/icp_qat_fw_init_admin.h | 3 +++ 3 files changed, 27 insertions(+) commit 02e7f67c47269135f41650ac1b693034e3e8f507 Author: Damian Muszynski Date: Fri Oct 20 15:49:26 2023 +0200 crypto: qat - add bits.h to icp_qat_hw.h Some enums use the macro BIT. Include bits.h as it is missing. Signed-off-by: Damian Muszynski Reviewed-by: Giovanni Cabiddu Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu drivers/crypto/intel/qat/qat_common/icp_qat_hw.h | 2 ++ 1 file changed, 2 insertions(+) commit e8eed5f7366f1f5decb694168bd06fb59ef6b12c Author: Damian Muszynski Date: Fri Oct 20 15:49:25 2023 +0200 units: Add BYTES_PER_*BIT There is going to be a new user of the BYTES_PER_[K/M/G]BIT definition besides possibly existing ones. Add them to the header. Signed-off-by: Damian Muszynski Reviewed-by: Giovanni Cabiddu Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu include/linux/units.h | 4 ++++ 1 file changed, 4 insertions(+) commit 8e6857f76dafba874593107f9e5c20030c5956ed Author: Giovanni Cabiddu Date: Fri Oct 20 15:49:24 2023 +0200 crypto: qat - move admin api The admin API is growing and deserves its own include. Move it from adf_common_drv.h to adf_admin.h. Signed-off-by: Giovanni Cabiddu Reviewed-by: Damian Muszynski Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 1 + .../crypto/intel/qat/qat_c3xxx/adf_c3xxx_hw_data.c | 1 + drivers/crypto/intel/qat/qat_c62x/adf_c62x_hw_data.c | 1 + drivers/crypto/intel/qat/qat_common/adf_admin.c | 1 + drivers/crypto/intel/qat/qat_common/adf_admin.h | 19 +++++++++++++++++++ drivers/crypto/intel/qat/qat_common/adf_clock.c | 1 + drivers/crypto/intel/qat/qat_common/adf_cnv_dbgfs.c | 1 + drivers/crypto/intel/qat/qat_common/adf_common_drv.h | 10 ---------- drivers/crypto/intel/qat/qat_common/adf_fw_counters.c | 1 + drivers/crypto/intel/qat/qat_common/adf_gen4_pm.c | 1 + .../crypto/intel/qat/qat_common/adf_gen4_pm_debugfs.c | 1 + drivers/crypto/intel/qat/qat_common/adf_gen4_timer.c | 1 + drivers/crypto/intel/qat/qat_common/adf_heartbeat.c | 1 + .../crypto/intel/qat/qat_common/adf_heartbeat_dbgfs.c | 1 + .../intel/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c | 1 + 15 files changed, 32 insertions(+), 10 deletions(-) commit a238487f7965d102794ed9f8aff0b667cd2ae886 Author: Giovanni Cabiddu Date: Fri Oct 20 15:49:23 2023 +0200 crypto: qat - fix ring to service map for QAT GEN4 The 4xxx drivers hardcode the ring to service mapping. However, when additional configurations where added to the driver, the mappings were not updated. This implies that an incorrect mapping might be reported through pfvf for certain configurations. Add an algorithm that computes the correct ring to service mapping based on the firmware loaded on the device. Fixes: 0cec19c761e5 ("crypto: qat - add support for compression for 4xxx") Signed-off-by: Giovanni Cabiddu Reviewed-by: Damian Muszynski Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu .../crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 54 ++++++++++++++++++++++ .../intel/qat/qat_common/adf_accel_devices.h | 1 + drivers/crypto/intel/qat/qat_common/adf_init.c | 3 ++ 3 files changed, 58 insertions(+) commit f7df2329eec1729a606bba8ed1566a1b3c248bad Author: Giovanni Cabiddu Date: Fri Oct 20 15:49:22 2023 +0200 crypto: qat - use masks for AE groups The adf_fw_config structures hardcode a bit mask that represents the acceleration engines (AEs) where a certain firmware image will have to be loaded to. Remove the hardcoded masks and replace them with defines. This does not introduce any functional change. Signed-off-by: Giovanni Cabiddu Reviewed-by: Damian Muszynski Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu .../crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 46 ++++++++++++---------- 1 file changed, 25 insertions(+), 21 deletions(-) commit 2990d2edac6061c6f0f646a46e40957244be2268 Author: Giovanni Cabiddu Date: Fri Oct 20 15:49:21 2023 +0200 crypto: qat - refactor fw config related functions The logic that selects the correct adf_fw_config structure based on the configured service is replicated twice in the uof_get_name() and uof_get_ae_mask() functions. Refactor the code so that there is no replication. This does not introduce any functional change. Signed-off-by: Giovanni Cabiddu Reviewed-by: Damian Muszynski Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu .../crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 69 +++++++++------------- 1 file changed, 28 insertions(+), 41 deletions(-) commit 99b1c9826e481c3ebe6e7d905b7a0edf853639fd Author: Shashank Gupta Date: Fri Oct 20 11:32:53 2023 +0100 crypto: qat - count QAT GEN4 errors Add logic to count correctable, non fatal and fatal error for QAT GEN4 devices. These counters are reported through sysfs attributes in the group qat_ras. Signed-off-by: Shashank Gupta Reviewed-by: Giovanni Cabiddu Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c | 182 +++++++++++++++++++-- 1 file changed, 166 insertions(+), 16 deletions(-) commit 532d7f6bc458042571752168bcb5e1fdc576b8c4 Author: Shashank Gupta Date: Fri Oct 20 11:32:52 2023 +0100 crypto: qat - add error counters Introduce ras counters interface for counting QAT specific device errors and expose them through the newly created qat_ras sysfs group attribute. This adds the following attributes: - errors_correctable: number of correctable errors - errors_nonfatal: number of uncorrectable non fatal errors - errors_fatal: number of uncorrectable fatal errors - reset_error_counters: resets all counters These counters are initialized during device bring up and cleared during device shutdown and are applicable only to QAT GEN4 devices. Signed-off-by: Shashank Gupta Reviewed-by: Giovanni Cabiddu Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu Documentation/ABI/testing/sysfs-driver-qat_ras | 41 ++++++++ drivers/crypto/intel/qat/qat_4xxx/adf_drv.c | 1 + drivers/crypto/intel/qat/qat_common/Makefile | 1 + .../intel/qat/qat_common/adf_accel_devices.h | 14 +++ drivers/crypto/intel/qat/qat_common/adf_init.c | 3 + .../intel/qat/qat_common/adf_sysfs_ras_counters.c | 112 +++++++++++++++++++++ .../intel/qat/qat_common/adf_sysfs_ras_counters.h | 27 +++++ 7 files changed, 199 insertions(+) commit 22289dc95833c6584aea1f4e8ab9f4f1641bb076 Author: Shashank Gupta Date: Fri Oct 20 11:32:51 2023 +0100 crypto: qat - add handling of errors from ERRSOU3 for QAT GEN4 Add logic to detect, report and handle uncorrectable errors reported through the ERRSOU3 register in QAT GEN4 devices. Signed-off-by: Shashank Gupta Reviewed-by: Giovanni Cabiddu Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c | 256 +++++++++++++++++++++ drivers/crypto/intel/qat/qat_common/adf_gen4_ras.h | 218 ++++++++++++++++++ 2 files changed, 474 insertions(+) commit 86df79c3a40a0085555aaa475b4b16c8728ef952 Author: Shashank Gupta Date: Fri Oct 20 11:32:50 2023 +0100 crypto: qat - add adf_get_aram_base() helper function Add the function adf_get_aram_base() which allows to return the base address of the aram bar. Signed-off-by: Shashank Gupta Reviewed-by: Giovanni Cabiddu Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu drivers/crypto/intel/qat/qat_common/adf_common_drv.h | 10 ++++++++++ 1 file changed, 10 insertions(+) commit b67bf7babe36c6c15623ec22ed13ec9069a6cf37 Author: Shashank Gupta Date: Fri Oct 20 11:32:49 2023 +0100 crypto: qat - add handling of compression related errors for QAT GEN4 Add logic to detect, report and handle correctable and uncorrectable errors related to the compression hardware. These are detected through the EXPRPSSMXLT, EXPRPSSMCPR and EXPRPSSMDCPR registers. Signed-off-by: Shashank Gupta Reviewed-by: Giovanni Cabiddu Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c | 76 +++++++++++++++++++++- drivers/crypto/intel/qat/qat_common/adf_gen4_ras.h | 76 ++++++++++++++++++++++ 2 files changed, 151 insertions(+), 1 deletion(-) commit 895f7d532c843f49e0b6dc8341bb911b26da4731 Author: Shashank Gupta Date: Fri Oct 20 11:32:48 2023 +0100 crypto: qat - add handling of errors from ERRSOU2 for QAT GEN4 Add logic to detect, report and handle uncorrectable errors reported through the ERRSOU2 register in QAT GEN4 devices. Signed-off-by: Shashank Gupta Reviewed-by: Giovanni Cabiddu Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu .../crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 5 + .../crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.h | 15 + .../intel/qat/qat_common/adf_accel_devices.h | 6 + drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c | 709 +++++++++++++++++++++ drivers/crypto/intel/qat/qat_common/adf_gen4_ras.h | 320 ++++++++++ 5 files changed, 1055 insertions(+) commit 4926e89d19b0631d8f5f5f292c4caf0f0de08f4f Author: Shashank Gupta Date: Fri Oct 20 11:32:47 2023 +0100 crypto: qat - add reporting of errors from ERRSOU1 for QAT GEN4 Add logic to detect and report uncorrectable errors reported through the ERRSOU1 register in QAT GEN4 devices. This also introduces the adf_dev_err_mask structure as part of adf_hw_device_data which will allow to provide different error masks per device generation. Signed-off-by: Shashank Gupta Reviewed-by: Giovanni Cabiddu Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu .../crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 6 + .../crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.h | 2 + .../intel/qat/qat_common/adf_accel_devices.h | 6 + drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c | 289 +++++++++++++++++++++ drivers/crypto/intel/qat/qat_common/adf_gen4_ras.h | 190 ++++++++++++++ 5 files changed, 493 insertions(+) commit df8c184b77a9c6d52e6c7627bbcb902cdc4d2171 Author: Shashank Gupta Date: Fri Oct 20 11:32:46 2023 +0100 crypto: qat - add reporting of correctable errors for QAT GEN4 Add logic to detect and report correctable errors in QAT GEN4 devices. This includes (1) enabling, disabling and handling error reported through the ERRSOU0 register and (2) logic to log the errors in the system log. Signed-off-by: Shashank Gupta Reviewed-by: Giovanni Cabiddu Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c | 64 +++++++++++++++++++++- drivers/crypto/intel/qat/qat_common/adf_gen4_ras.h | 11 ++++ 2 files changed, 74 insertions(+), 1 deletion(-) commit 93b2f7de7db598b0fe429948c739c212f8316330 Author: Shashank Gupta Date: Fri Oct 20 11:32:45 2023 +0100 crypto: qat - add infrastructure for error reporting Add infrastructure for enabling, disabling and reporting errors in the QAT driver. This adds a new structure, adf_ras_ops, to adf_hw_device_data that contains the following methods: - enable_ras_errors(): allows to enable RAS errors at device initialization. - disable_ras_errors(): allows to disable RAS errors at device shutdown. - handle_interrupt(): allows to detect if there is an error and report if a reset is required. This is executed immediately after the error is reported, in the context of an ISR. An initial, empty, implementation of the methods above is provided for QAT GEN4. Signed-off-by: Shashank Gupta Reviewed-by: Giovanni Cabiddu Reviewed-by: Tero Kristo Signed-off-by: Herbert Xu .../crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 2 ++ drivers/crypto/intel/qat/qat_common/Makefile | 1 + .../intel/qat/qat_common/adf_accel_devices.h | 8 +++++++ drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c | 26 ++++++++++++++++++++++ drivers/crypto/intel/qat/qat_common/adf_gen4_ras.h | 10 +++++++++ drivers/crypto/intel/qat/qat_common/adf_init.c | 6 +++++ drivers/crypto/intel/qat/qat_common/adf_isr.c | 18 +++++++++++++++ 7 files changed, 71 insertions(+) commit 33fc506d2ac514be1072499a263c3bff8c7c95a0 Author: Longfang Liu Date: Fri Oct 20 17:35:58 2023 +0800 crypto: hisilicon/qm - prevent soft lockup in receive loop In the scenario where the accelerator business is fully loaded. When the workqueue receiving messages and performing callback processing, there are a large number of messages that need to be received, and there are continuously messages that have been processed and need to be received. This will cause the receive loop here to be locked for a long time. This scenario will cause watchdog timeout problems on OS with kernel preemption turned off. The error logs: watchdog: BUG: soft lockup - CPU#23 stuck for 23s! [kworker/u262:1:1407] [ 1461.978428][ C23] Call trace: [ 1461.981890][ C23] complete+0x8c/0xf0 [ 1461.986031][ C23] kcryptd_async_done+0x154/0x1f4 [dm_crypt] [ 1461.992154][ C23] sec_skcipher_callback+0x7c/0xf4 [hisi_sec2] [ 1461.998446][ C23] sec_req_cb+0x104/0x1f4 [hisi_sec2] [ 1462.003950][ C23] qm_poll_req_cb+0xcc/0x150 [hisi_qm] [ 1462.009531][ C23] qm_work_process+0x60/0xc0 [hisi_qm] [ 1462.015101][ C23] process_one_work+0x1c4/0x470 [ 1462.020052][ C23] worker_thread+0x150/0x3c4 [ 1462.024735][ C23] kthread+0x108/0x13c [ 1462.028889][ C23] ret_from_fork+0x10/0x18 Therefore, it is necessary to add an actively scheduled operation in the while loop to prevent this problem. After adding it, no matter whether the OS turns on or off the kernel preemption function. Neither will cause watchdog timeout issues. Signed-off-by: Longfang Liu Signed-off-by: Herbert Xu drivers/crypto/hisilicon/qm.c | 2 ++ 1 file changed, 2 insertions(+) commit bc456c7e24a2f3645117621926178c7ed20040e7 Author: Uwe Kleine-König Date: Fri Oct 20 09:56:04 2023 +0200 crypto: xilinx/zynqmp-sha - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Michal Simek Signed-off-by: Herbert Xu drivers/crypto/xilinx/zynqmp-sha.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 02f393c1dcadfc10d07f916ef314e9947a871609 Author: Uwe Kleine-König Date: Fri Oct 20 09:56:03 2023 +0200 crypto: xilinx/zynqmp-aes-gcm - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Michal Simek Signed-off-by: Herbert Xu drivers/crypto/xilinx/zynqmp-aes-gcm.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit ce52705e6d1fbb00e43195063ba79c6be7873c95 Author: Uwe Kleine-König Date: Fri Oct 20 09:56:02 2023 +0200 crypto: talitos - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/talitos.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 88b01c8abfc40b473665343ec2b8a353ad9444a4 Author: Uwe Kleine-König Date: Fri Oct 20 09:56:01 2023 +0200 crypto: stm32/cryp - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. The driver adapted here suffered from this wrong assumption and had several error paths resulting in resource leaks. The check for cryp being non-NULL is harmless. This can never happen as .remove() is only called after .probe() completed successfully and in that case drvdata was set to a non-NULL value. So this check can just be dropped. If pm_runtime_get() fails, the other resources held by the device must still be freed. Only clk_disable_unprepare() should be skipped as the pm_runtime_get() failed to call clk_prepare_enable(). After these changes the remove function returns zero unconditionally and can trivially be converted to the prototype required for .remove_new(). Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/stm32/stm32-cryp.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) commit afa39e6e2b8569ec280fd3e91d519537ef747d9a Author: Uwe Kleine-König Date: Fri Oct 20 09:56:00 2023 +0200 crypto: stm32/crc32 - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. The driver adapted here suffered from this wrong assumption and had an error paths resulting in resource leaks. If pm_runtime_get() fails, the other resources held by the device must still be freed. Only clk_disable() should be skipped as the pm_runtime_get() failed to call clk_enable(). After this change the remove function returns zero unconditionally and can trivially be converted to the prototype required for .remove_new(). Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/stm32/stm32-crc32.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) commit a48c68aa298ccee2512c8bd2081350d465e95bc3 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:59 2023 +0200 crypto: sahara - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/sahara.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit b1010711c029cb3b21e1f8407b91434158327446 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:58 2023 +0200 crypto: sa2ul - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/sa2ul.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 09f8f67ff1c6e13db1d47e0d027e80d51e231875 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:57 2023 +0200 crypto: s5p-sss - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu drivers/crypto/s5p-sss.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 0a5cb2615e042012c4985fcf909c8aefef0a3444 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:56 2023 +0200 crypto: rockchip/rk3288 - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Heiko Stuebner Acked-by: Corentin Labbe Signed-off-by: Herbert Xu drivers/crypto/rockchip/rk3288_crypto.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 37548f1dd35de924bb9a1b1dafdb4d4bffd42ddd Author: Uwe Kleine-König Date: Fri Oct 20 09:55:55 2023 +0200 crypto: qcom-rng - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Konrad Dybcio Signed-off-by: Herbert Xu drivers/crypto/qcom-rng.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit a37049f3532b97b597b2f4a228a5b5cc4ab29c9d Author: Uwe Kleine-König Date: Fri Oct 20 09:55:54 2023 +0200 crypto: qce - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/qce/core.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit cf5334f09972941fc1513e73ae852be972577ae7 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:53 2023 +0200 crypto: omap-sham - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/omap-sham.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit edfb5a04a103d77794f4ee68bb822c9c8207ad80 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:52 2023 +0200 crypto: omap-des - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/omap-des.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit e0dffa0ea94269d660f521ac74018b8f7ed4be37 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:51 2023 +0200 crypto: omap-aes - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/omap-aes.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit a0061b93c6e38024ba002f6a678401b9a66b3876 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:50 2023 +0200 crypto: n2_core - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/n2_core.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) commit fdfe6c3248748b0ba21e9f4b94d4abc75deedfae Author: Uwe Kleine-König Date: Fri Oct 20 09:55:49 2023 +0200 crypto: mxs-dcp - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/mxs-dcp.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit e79de44e9d7b4b319990508c3c8a585a7c709bf2 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:48 2023 +0200 crypto: marvell/cesa - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/marvell/cesa/cesa.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit b28e9179dc5fd28db2205c35fedf733f705fde33 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:47 2023 +0200 crypto: intel/keembay-ocs-hcu - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit b6b73a24fbdb1cb6753635b0b36eb61f1a3799ec Author: Uwe Kleine-König Date: Fri Oct 20 09:55:46 2023 +0200 crypto: intel/keembay-ocs-ecc - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/intel/keembay/keembay-ocs-ecc.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 98272bf6388dff93dde26e782d5485793d9790f5 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:45 2023 +0200 crypto: intel/keembay-ocs-aes - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/intel/keembay/keembay-ocs-aes-core.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 2fd7c206317beb185ac6dcb0aa420862da29c370 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:44 2023 +0200 crypto: intel/ixp4xx-crypto - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Acked-by: Corentin Labbe Signed-off-by: Herbert Xu drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 4f7f841f0922863aede9588b767fda080d924f79 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:43 2023 +0200 crypto: inside-secure/safexcel - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/inside-secure/safexcel.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 5c5d9715c693b6be52a609892e1d3a6415defabe Author: Uwe Kleine-König Date: Fri Oct 20 09:55:42 2023 +0200 crypto: img-hash - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/img-hash.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 151356ceb974b93106159f0368b6ab1f1699031a Author: Uwe Kleine-König Date: Fri Oct 20 09:55:41 2023 +0200 crypto: hisilicon/trng - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Weili Qian Signed-off-by: Herbert Xu drivers/crypto/hisilicon/trng/trng.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 31ce0b0676ef22baf8719f4dffd73fb33bae0d10 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:40 2023 +0200 crypto: hisilicon/sec - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/hisilicon/sec/sec_drv.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit aa2f8e9a3f74f6e808da5a91c716679cc797a3ef Author: Uwe Kleine-König Date: Fri Oct 20 09:55:39 2023 +0200 crypto: gemini/sl3516-ce - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Acked-by: Corentin Labbe Signed-off-by: Herbert Xu drivers/crypto/gemini/sl3516-ce-core.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit b0d49b30ef64ac879b491080bf80ef7bcb293ef6 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:38 2023 +0200 crypto: exynos-rng - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Krzysztof Kozlowski Reviewed-by: Andi Shyti Signed-off-by: Herbert Xu drivers/crypto/exynos-rng.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit e7edfb41718a40b8a95785f376d41d876cc360a8 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:37 2023 +0200 crypto: ccree/cc - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/ccree/cc_driver.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 11575ef99fe1f8d2c7a77f5f3fbe6c54134f613d Author: Uwe Kleine-König Date: Fri Oct 20 09:55:36 2023 +0200 crypto: ccp/sp - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Acked-by: Tom Lendacky Signed-off-by: Herbert Xu drivers/crypto/ccp/sp-platform.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 304a2efe9d55875c6805f3c2957bc39ceebbc5c0 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:35 2023 +0200 crypto: caam/jr - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. The driver adapted here suffers from this wrong assumption. Returning -EBUSY if there are still users results in resource leaks and probably a crash. Also further down passing the error code of caam_jr_shutdown() to the caller only results in another error message and has no further consequences compared to returning zero. Still convert the driver to return no value in the remove callback. This also allows to drop caam_jr_platform_shutdown() as the only function called by it now has the same prototype. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/caam/jr.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) commit 580399bbc43bce232b46251e175e600407b08f5b Author: Uwe Kleine-König Date: Fri Oct 20 09:55:34 2023 +0200 crypto: bcm/cipher - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/bcm/cipher.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit a63e2236dd46503b8617255b9da88ef2f102e523 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:33 2023 +0200 crypto: axis/artpec6 - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Acked-by: Jesper Nilsson Signed-off-by: Herbert Xu drivers/crypto/axis/artpec6_crypto.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 5cc3e7bca8854c09429989317457e421de017a5a Author: Uwe Kleine-König Date: Fri Oct 20 09:55:32 2023 +0200 crypto: atmel-tdes - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/atmel-tdes.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 413f850d022db401a99d85886d42f965e447253f Author: Uwe Kleine-König Date: Fri Oct 20 09:55:31 2023 +0200 crypto: atmel-sha - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/atmel-sha.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 5d966381bf7a2cdb4ce5830d06035cf94de9264d Author: Uwe Kleine-König Date: Fri Oct 20 09:55:30 2023 +0200 crypto: atmel-aes - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Hari Prasath Gujulan Elango Signed-off-by: Herbert Xu drivers/crypto/atmel-aes.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 7866701cd27403a57b046caa4773862574b92f0b Author: Uwe Kleine-König Date: Fri Oct 20 09:55:29 2023 +0200 crypto: aspeed-hace - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Andrew Jeffery Signed-off-by: Herbert Xu drivers/crypto/aspeed/aspeed-hace.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 8819da7e685008de2c1926c067a388b1ecaeb8aa Author: Uwe Kleine-König Date: Fri Oct 20 09:55:28 2023 +0200 crypto: aspeed-acry - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Andrew Jeffery Signed-off-by: Herbert Xu drivers/crypto/aspeed/aspeed-acry.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 015e07aa043d50985787f51f230f486851fd2401 Author: Uwe Kleine-König Date: Fri Oct 20 09:55:27 2023 +0200 crypto: amlogic-gxl-core - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Acked-by: Corentin Labbe Signed-off-by: Herbert Xu drivers/crypto/amlogic/amlogic-gxl-core.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 49f49d64348985d893eb919f48f77311ba2678fe Author: Uwe Kleine-König Date: Fri Oct 20 09:55:26 2023 +0200 crypto: amcc/crypto4xx - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Herbert Xu drivers/crypto/amcc/crypto4xx_core.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit a345d0a956673191f2263565570b1f11ac951f0f Author: Uwe Kleine-König Date: Fri Oct 20 09:55:25 2023 +0200 crypto: sun8i-ss - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Andre Przywara Reviewed-by: Jernej Skrabec Acked-by: Corentin Labbe Signed-off-by: Herbert Xu drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 57e5d4de0713fbc10b4b7f821413a2475cadf04a Author: Uwe Kleine-König Date: Fri Oct 20 09:55:24 2023 +0200 crypto: sun8i-ce - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Andre Przywara Reviewed-by: Jernej Skrabec Acked-by: Corentin Labbe Signed-off-by: Herbert Xu drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 4f5e6c9921112a8eebbaca344d36054418ac6e3a Author: Uwe Kleine-König Date: Fri Oct 20 09:55:23 2023 +0200 crypto: sun4i-ss - Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Andre Przywara Reviewed-by: Jernej Skrabec Acked-by: Corentin Labbe Signed-off-by: Herbert Xu drivers/crypto/allwinner/sun4i-ss/sun4i-ss-core.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit cf27d9475f37fb69b5bc293e6e6d6c1d03cf7cc6 Author: Stephan Müller Date: Thu Oct 19 09:40:42 2023 +0200 crypto: jitter - use permanent health test storage The health test result in the current code is only given for the currently processed raw time stamp. This implies to react on the health test error, the result must be checked after each raw time stamp being processed. To avoid this constant checking requirement, any health test error is recorded and stored to be analyzed at a later time, if needed. This change ensures that the power-up test catches any health test error. Without that patch, the power-up health test result is not enforced. The introduced changes are already in use with the user space version of the Jitter RNG. Fixes: 04597c8dd6c4 ("jitter - add RCT/APT support for different OSRs") Reported-by: Joachim Vandersmissen Signed-off-by: Stephan Mueller Signed-off-by: Herbert Xu crypto/jitterentropy.c | 125 +++++++++++++++++++++++++++++-------------------- 1 file changed, 74 insertions(+), 51 deletions(-) commit 3dca18fcfebf33f2a73876f9314f7621c2e2fb0b Author: Eric Biggers Date: Wed Oct 18 22:53:43 2023 -0700 crypto: shash - remove crypto_shash_alignmask crypto_shash_alignmask() no longer has any callers, and it always returns 0 now that the shash algorithm type no longer supports nonzero alignmasks. Therefore, remove it. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu include/crypto/hash.h | 6 ------ 1 file changed, 6 deletions(-) commit f6f1514cf72e5d9c2b7c2bc53c43f482b6183d29 Author: Eric Biggers Date: Wed Oct 18 22:53:42 2023 -0700 crypto: hctr2 - stop using alignmask of shash_alg Now that the shash algorithm type does not support nonzero alignmasks, shash_alg::base.cra_alignmask is always 0, so OR-ing it into another value is a no-op. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/hctr2.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 321dfe9777a88cdafe676bb03bab07af26c6cfd8 Author: Eric Biggers Date: Wed Oct 18 22:53:41 2023 -0700 crypto: adiantum - stop using alignmask of shash_alg Now that the shash algorithm type does not support nonzero alignmasks, shash_alg::base.cra_alignmask is always 0, so OR-ing it into another value is a no-op. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/adiantum.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 2125c11efd83a5aeb9bf04bcbc83b49e8d7e2afb Author: Eric Biggers Date: Wed Oct 18 22:53:40 2023 -0700 crypto: testmgr - stop checking crypto_shash_alignmask Now that the shash algorithm type does not support nonzero alignmasks, crypto_shash_alignmask() always returns 0 and will be removed. In preparation for this, stop checking crypto_shash_alignmask() in testmgr. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/testmgr.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit eed577b9a9220dc9f3968b54d055a3884d219897 Author: Eric Biggers Date: Wed Oct 18 22:53:39 2023 -0700 crypto: drbg - stop checking crypto_shash_alignmask Now that the shash algorithm type does not support nonzero alignmasks, crypto_shash_alignmask() always returns 0 and will be removed. In preparation for this, stop checking crypto_shash_alignmask() in drbg. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/drbg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 69dde0a1fa9a45faf2d863cfc0deb1e82ba5c7a9 Author: Eric Biggers Date: Wed Oct 18 22:53:38 2023 -0700 libceph: stop checking crypto_shash_alignmask Now that the shash algorithm type does not support nonzero alignmasks, crypto_shash_alignmask() always returns 0 and will be removed. In preparation for this, stop checking crypto_shash_alignmask() in net/ceph/messenger_v2.c. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu net/ceph/messenger_v2.c | 4 ---- 1 file changed, 4 deletions(-) commit 345bfa3c10ced43281877ce68ae7b3bf360afc76 Author: Eric Biggers Date: Wed Oct 18 22:53:37 2023 -0700 crypto: shash - remove support for nonzero alignmask Currently, the shash API checks the alignment of all message, key, and digest buffers against the algorithm's declared alignmask, and for any unaligned buffers it falls back to manually aligned temporary buffers. This is virtually useless, however. In the case of the message buffer, cryptographic hash functions internally operate on fixed-size blocks, so implementations end up needing to deal with byte-aligned data anyway because the length(s) passed to ->update might not be divisible by the block size. Word-alignment of the message can theoretically be helpful for CRCs, like what was being done in crc32c-sparc64. But in practice it's better for the algorithms to use unaligned accesses or align the message themselves. A similar argument applies to the key and digest. In any case, no shash algorithms actually set a nonzero alignmask anymore. Therefore, remove support for it from shash. The benefit is that all the code to handle "misaligned" buffers in the shash API goes away, reducing the overhead of the shash API. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/shash.c | 128 ++++----------------------------------------------------- 1 file changed, 8 insertions(+), 120 deletions(-) commit a2b1118052c41ca92cbc2366e77b2f0ff3b054ba Author: Eric Biggers Date: Wed Oct 18 22:53:36 2023 -0700 crypto: xcbc - remove unnecessary alignment logic The xcbc template is setting its alignmask to that of its underlying 'cipher'. Yet, it doesn't care itself about how its inputs and outputs are aligned, which is ostensibly the point of the alignmask. Instead, xcbc actually just uses its alignmask itself to runtime-align certain fields in its tfm and desc contexts appropriately for its underlying cipher. That is almost entirely pointless too, though, since xcbc is already using the cipher API functions that handle alignment themselves, and few ciphers set a nonzero alignmask anyway. Also, even without runtime alignment, an alignment of at least 4 bytes can be guaranteed. Thus, at best this code is optimizing for the rare case of ciphers that set an alignmask >= 7, at the cost of hurting the common cases. Therefore, this patch removes the manual alignment code from xcbc and makes it stop setting an alignmask. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/xcbc.c | 32 ++++++++++---------------------- 1 file changed, 10 insertions(+), 22 deletions(-) commit 1fb90689bc7ced529152fec406faddd0bcbf99f1 Author: Eric Biggers Date: Wed Oct 18 22:53:35 2023 -0700 crypto: vmac - don't set alignmask The vmac template is setting its alignmask to that of its underlying 'cipher'. This doesn't actually accomplish anything useful, though, so stop doing it. (vmac_update() does have an alignment bug, where it assumes u64 alignment when it shouldn't, but that bug exists both before and after this patch.) This is a prerequisite for removing support for nonzero alignmasks from shash. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/vmac.c | 1 - 1 file changed, 1 deletion(-) commit 25c74a39e0f637a44982c3820a583755aedc9811 Author: Eric Biggers Date: Wed Oct 18 22:53:34 2023 -0700 crypto: hmac - remove unnecessary alignment logic The hmac template is setting its alignmask to that of its underlying unkeyed hash algorithm, and it is aligning the ipad and opad fields in its tfm context to that alignment. However, hmac does not actually need any sort of alignment itself, which makes this pointless except to keep the pads aligned to what the underlying algorithm prefers. But very few shash algorithms actually set an alignmask, and it is being removed from those remaining ones; also, after setkey, the pads are only passed to crypto_shash_import and crypto_shash_export which ignore the alignmask. Therefore, make the hmac template stop setting an alignmask and simply use natural alignment for ipad and opad. Note, this change also moves the pads from the beginning of the tfm context to the end, which makes much more sense; the variable-length fields should be at the end. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/hmac.c | 56 ++++++++++++++++++++++---------------------------------- 1 file changed, 22 insertions(+), 34 deletions(-) commit f9dc9f2e4072de356614d95940c9d7f448a4e334 Author: Eric Biggers Date: Wed Oct 18 22:53:33 2023 -0700 crypto: cmac - remove unnecessary alignment logic The cmac template is setting its alignmask to that of its underlying 'cipher'. Yet, it doesn't care itself about how its inputs and outputs are aligned, which is ostensibly the point of the alignmask. Instead, cmac actually just uses its alignmask itself to runtime-align certain fields in its tfm and desc contexts appropriately for its underlying cipher. That is almost entirely pointless too, though, since cmac is already using the cipher API functions that handle alignment themselves, and few ciphers set a nonzero alignmask anyway. Also, even without runtime alignment, an alignment of at least 4 bytes can be guaranteed. Thus, at best this code is optimizing for the rare case of ciphers that set an alignmask >= 7, at the cost of hurting the common cases. Therefore, this patch removes the manual alignment code from cmac and makes it stop setting an alignmask. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/cmac.c | 39 +++++++++++---------------------------- 1 file changed, 11 insertions(+), 28 deletions(-) commit 21415bfe8b5543c41b64b19674e5fcc2c942623e Author: Eric Biggers Date: Wed Oct 18 22:53:32 2023 -0700 crypto: cbcmac - remove unnecessary alignment logic The cbcmac template is aligning a field in its desc context to the alignmask of its underlying 'cipher', at runtime. This is almost entirely pointless, since cbcmac is already using the cipher API functions that handle alignment themselves, and few ciphers set a nonzero alignmask anyway. Also, even without runtime alignment, an alignment of at least 4 bytes can be guaranteed. Thus, at best this code is optimizing for the rare case of ciphers that set an alignmask >= 7, at the cost of hurting the common cases. Therefore, remove the manual alignment code from cbcmac. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/ccm.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) commit d72c46f7985a22ceb39a69a3bfe05606ec891504 Author: Eric Biggers Date: Wed Oct 18 22:53:31 2023 -0700 crypto: loongarch/crc32 - remove redundant setting of alignmask to 0 This unnecessary explicit setting of cra_alignmask to 0 shows up when grepping for shash algorithms that set an alignmask. Remove it. No change in behavior. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu arch/loongarch/crypto/crc32-loongarch.c | 2 -- 1 file changed, 2 deletions(-) commit 9cf52f7b083d11a1c404c76baf601e71bfc3fb6b Author: Eric Biggers Date: Wed Oct 18 22:53:30 2023 -0700 crypto: mips/crc32 - remove redundant setting of alignmask to 0 This unnecessary explicit setting of cra_alignmask to 0 shows up when grepping for shash algorithms that set an alignmask. Remove it. No change in behavior. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu arch/mips/crypto/crc32-mips.c | 2 -- 1 file changed, 2 deletions(-) commit 71e8c241b22618484137255f39fcb67efa5ef962 Author: Eric Biggers Date: Wed Oct 18 22:53:29 2023 -0700 crypto: xilinx/zynqmp-sha - remove unnecessary alignmask The zynqmp-sha3-384 algorithm sets a nonzero alignmask, but it doesn't appear to actually need it. Therefore, stop setting it. This will allow this algorithm to keep being registered after alignmask support is removed from shash. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu drivers/crypto/xilinx/zynqmp-sha.c | 1 - 1 file changed, 1 deletion(-) commit 0174275a08e1ed72b3a4ddee462ee3d75c13cc65 Author: Eric Biggers Date: Wed Oct 18 22:53:28 2023 -0700 crypto: stm32 - remove unnecessary alignmask The stm32 crc32 algorithms set a nonzero alignmask, but they don't seem to actually need it. Their ->update function already has code that handles aligning the data to the same alignment that the alignmask specifies, their ->setkey function already uses get_unaligned_le32(), and their ->final function already uses put_unaligned_le32(). Therefore, stop setting the alignmask. This will allow these algorithms to keep being registered after alignmask support is removed from shash. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu drivers/crypto/stm32/stm32-crc32.c | 2 -- 1 file changed, 2 deletions(-) commit 9924003807a9738b3f5295174b6c623f5a85eb97 Author: Eric Biggers Date: Wed Oct 18 22:53:27 2023 -0700 crypto: sparc/crc32c - stop using the shash alignmask As far as I can tell, "crc32c-sparc64" is the only "shash" algorithm in the kernel that sets a nonzero alignmask and actually relies on it to get the crypto API to align the inputs and outputs. This capability is not really useful, though. To unblock removing the support for alignmask from shash_alg, this patch updates crc32c-sparc64 to no longer use the alignmask. This means doing 8-byte alignment of the data when doing an update, using get_unaligned_le32() when setting a non-default initial CRC, and using put_unaligned_le32() to output the final CRC. Partially tested with: export ARCH=sparc64 CROSS_COMPILE=sparc64-linux-gnu- make sparc64_defconfig echo CONFIG_CRYPTO_CRC32C_SPARC64=y >> .config echo '# CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set' >> .config echo CONFIG_DEBUG_KERNEL=y >> .config echo CONFIG_CRYPTO_MANAGER_EXTRA_TESTS=y >> .config make olddefconfig make -j$(getconf _NPROCESSORS_ONLN) qemu-system-sparc64 -kernel arch/sparc/boot/image -nographic However, qemu doesn't actually support the sparc CRC32C instructions, so for the test I temporarily replaced crc32c_sparc64() with __crc32c_le() and made sparc64_has_crc32c_opcode() always return true. So essentially I tested the glue code, not the actual SPARC part which is unchanged. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu arch/sparc/crypto/crc32c_glue.c | 45 ++++++++++++++++++++++------------------- 1 file changed, 24 insertions(+), 21 deletions(-) commit 08debaa5cb31da50725a8cb2f06d3f617a9caa98 Author: Eric Biggers Date: Wed Oct 18 15:34:55 2023 -0700 crypto: shash - eliminate indirect call for default import and export Most shash algorithms don't have custom ->import and ->export functions, resulting in the memcpy() based default being used. Yet, crypto_shash_import() and crypto_shash_export() still make an indirect call, which is expensive. Therefore, change how the default import and export are called to make it so that crypto_shash_import() and crypto_shash_export() don't do an indirect call in this case. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/shash.c | 41 +++++++++++++++++++++++++++++++++-------- include/crypto/hash.h | 15 ++------------- 2 files changed, 35 insertions(+), 21 deletions(-) commit a411f6debeb33e2ec8f5825f0c41497317c0504e Author: Om Prakash Singh Date: Mon Oct 16 20:04:28 2023 +0530 dt-bindings: crypto: qcom,prng: document SA8775P and SC7280 Document SA8775P and SC7280 compatible for the True Random Number Generator. Signed-off-by: Om Prakash Singh Reviewed-by: Krzysztof Kozlowski Reviewed-by: Bjorn Andersson Signed-off-by: Herbert Xu Documentation/devicetree/bindings/crypto/qcom,prng.yaml | 2 ++ 1 file changed, 2 insertions(+) commit f5fb88e5301ba7b8cb85063d6b6b3bd378907e25 Author: Herbert Xu Date: Mon Oct 16 13:57:30 2023 +0800 crypto: rsa - Add module alias for pkcs1pad Add a module alias for pkcs1pas so that it can be auto-loaded by modprobe. Signed-off-by: Herbert Xu crypto/rsa-pkcs1pad.c | 2 ++ 1 file changed, 2 insertions(+) commit 04a93202ed7c3b451bf22d3ff4bcd379df27f299 Author: Herbert Xu Date: Mon Oct 16 13:21:44 2023 +0800 certs: Break circular dependency when selftest is modular The modular build fails because the self-test code depends on pkcs7 which in turn depends on x509 which contains the self-test. Split the self-test out into its own module to break the cycle. Fixes: 3cde3174eb91 ("certs: Add FIPS selftests") Signed-off-by: Herbert Xu Reviewed-by: Jarkko Sakkinen Signed-off-by: Herbert Xu crypto/asymmetric_keys/Kconfig | 3 ++- crypto/asymmetric_keys/Makefile | 3 ++- crypto/asymmetric_keys/selftest.c | 13 ++++++++++--- crypto/asymmetric_keys/x509_parser.h | 9 --------- crypto/asymmetric_keys/x509_public_key.c | 8 +------- 5 files changed, 15 insertions(+), 21 deletions(-) commit 7ddc21e317b360c3444de3023bcc83b85fabae2f Author: WangJinchao Date: Mon Oct 16 09:15:21 2023 +0800 padata: Fix refcnt handling in padata_free_shell() In a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead to system UAF (Use-After-Free) issues. Due to the lengthy analysis of the pcrypt_aead01 function call, I'll describe the problem scenario using a simplified model: Suppose there's a user of padata named `user_function` that adheres to the padata requirement of calling `padata_free_shell` after `serial()` has been invoked, as demonstrated in the following code: ```c struct request { struct padata_priv padata; struct completion *done; }; void parallel(struct padata_priv *padata) { do_something(); } void serial(struct padata_priv *padata) { struct request *request = container_of(padata, struct request, padata); complete(request->done); } void user_function() { DECLARE_COMPLETION(done) padata->parallel = parallel; padata->serial = serial; padata_do_parallel(); wait_for_completion(&done); padata_free_shell(); } ``` In the corresponding padata.c file, there's the following code: ```c static void padata_serial_worker(struct work_struct *serial_work) { ... cnt = 0; while (!list_empty(&local_list)) { ... padata->serial(padata); cnt++; } local_bh_enable(); if (refcount_sub_and_test(cnt, &pd->refcnt)) padata_free_pd(pd); } ``` Because of the high system load and the accumulation of unexecuted softirq at this moment, `local_bh_enable()` in padata takes longer to execute than usual. Subsequently, when accessing `pd->refcnt`, `pd` has already been released by `padata_free_shell()`, resulting in a UAF issue with `pd->refcnt`. The fix is straightforward: add `refcount_dec_and_test` before calling `padata_free_pd` in `padata_free_shell`. Fixes: 07928d9bfc81 ("padata: Remove broken queue flushing") Signed-off-by: WangJinchao Acked-by: Daniel Jordan Acked-by: Daniel Jordan Signed-off-by: Herbert Xu kernel/padata.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 5428a40a308f220dbbffda66cb01b212f88e9a06 Merge: 5eb8323803a8 57925e16c9f7 Author: Ulf Hansson Date: Fri Oct 27 12:00:35 2023 +0200 mmc: Merge branch fixes into next Merge the mmc fixes for v6.6-rc[n] into the next branch, to allow them to get tested together with the new mmc changes that are targeted for v6.7. Signed-off-by: Ulf Hansson commit 5eb8323803a8cc6dc260a29b350b90ebdafa0da7 Author: Neil Armstrong Date: Wed Oct 25 10:28:30 2023 +0200 dt-bindings: mmc: sdhci-msm: document the SM8650 SDHCI Controller Document the SDHCI Controller on the SM8650 Platform. Signed-off-by: Neil Armstrong Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231025-topic-sm8650-upstream-bindings-sdhci-v2-1-0406fca99033@linaro.org Signed-off-by: Ulf Hansson Documentation/devicetree/bindings/mmc/sdhci-msm.yaml | 1 + 1 file changed, 1 insertion(+) commit 57925e16c9f7d18012bcf45bfa658f92c087981a Author: Rong Chen Date: Thu Oct 26 15:31:56 2023 +0800 mmc: meson-gx: Remove setting of CMD_CFG_ERROR For the t7 and older SoC families, the CMD_CFG_ERROR has no effect. Starting from SoC family C3, setting this bit without SG LINK data address will cause the controller to generate an IRQ and stop working. To fix it, don't set the bit CMD_CFG_ERROR anymore. Fixes: 18f92bc02f17 ("mmc: meson-gx: make sure the descriptor is stopped on errors") Signed-off-by: Rong Chen Reviewed-by: Jerome Brunet Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20231026073156.2868310-1-rong.chen@amlogic.com Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 1 - 1 file changed, 1 deletion(-) commit 61217d8f6360437329af1b16b8bbd9143167718d Author: Eric Dumazet Date: Thu Oct 26 17:18:40 2023 +0000 virtio_net: use u64_stats_t infra to avoid data-races syzbot reported a data-race in virtnet_poll / virtnet_stats [1] u64_stats_t infra has very nice accessors that must be used to avoid potential load-store tearing. [1] BUG: KCSAN: data-race in virtnet_poll / virtnet_stats read-write to 0xffff88810271b1a0 of 8 bytes by interrupt on cpu 0: virtnet_receive drivers/net/virtio_net.c:2102 [inline] virtnet_poll+0x6c8/0xb40 drivers/net/virtio_net.c:2148 __napi_poll+0x60/0x3b0 net/core/dev.c:6527 napi_poll net/core/dev.c:6594 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6727 __do_softirq+0xc1/0x265 kernel/softirq.c:553 invoke_softirq kernel/softirq.c:427 [inline] __irq_exit_rcu kernel/softirq.c:632 [inline] irq_exit_rcu+0x3b/0x90 kernel/softirq.c:644 common_interrupt+0x7f/0x90 arch/x86/kernel/irq.c:247 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:636 __sanitizer_cov_trace_const_cmp8+0x0/0x80 kernel/kcov.c:306 jbd2_write_access_granted fs/jbd2/transaction.c:1174 [inline] jbd2_journal_get_write_access+0x94/0x1c0 fs/jbd2/transaction.c:1239 __ext4_journal_get_write_access+0x154/0x3f0 fs/ext4/ext4_jbd2.c:241 ext4_reserve_inode_write+0x14e/0x200 fs/ext4/inode.c:5745 __ext4_mark_inode_dirty+0x8e/0x440 fs/ext4/inode.c:5919 ext4_evict_inode+0xaf0/0xdc0 fs/ext4/inode.c:299 evict+0x1aa/0x410 fs/inode.c:664 iput_final fs/inode.c:1775 [inline] iput+0x42c/0x5b0 fs/inode.c:1801 do_unlinkat+0x2b9/0x4f0 fs/namei.c:4405 __do_sys_unlink fs/namei.c:4446 [inline] __se_sys_unlink fs/namei.c:4444 [inline] __x64_sys_unlink+0x30/0x40 fs/namei.c:4444 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff88810271b1a0 of 8 bytes by task 2814 on cpu 1: virtnet_stats+0x1b3/0x340 drivers/net/virtio_net.c:2564 dev_get_stats+0x6d/0x860 net/core/dev.c:10511 rtnl_fill_stats+0x45/0x320 net/core/rtnetlink.c:1261 rtnl_fill_ifinfo+0xd0e/0x1120 net/core/rtnetlink.c:1867 rtnl_dump_ifinfo+0x7f9/0xc20 net/core/rtnetlink.c:2240 netlink_dump+0x390/0x720 net/netlink/af_netlink.c:2266 netlink_recvmsg+0x425/0x780 net/netlink/af_netlink.c:1992 sock_recvmsg_nosec net/socket.c:1027 [inline] sock_recvmsg net/socket.c:1049 [inline] ____sys_recvmsg+0x156/0x310 net/socket.c:2760 ___sys_recvmsg net/socket.c:2802 [inline] __sys_recvmsg+0x1ea/0x270 net/socket.c:2832 __do_sys_recvmsg net/socket.c:2842 [inline] __se_sys_recvmsg net/socket.c:2839 [inline] __x64_sys_recvmsg+0x46/0x50 net/socket.c:2839 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x000000000045c334 -> 0x000000000045c376 Fixes: 3fa2a1df9094 ("virtio-net: per cpu 64 bit stats (v2)") Signed-off-by: Eric Dumazet Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller drivers/net/virtio_net.c | 124 +++++++++++++++++++++++++---------------------- 1 file changed, 65 insertions(+), 59 deletions(-) commit 303d77a6e1707498f09c9d8ee91b1dc07ca315a5 Merge: 36e826b568e4 b7bce570430e Author: Michael Ellerman Date: Fri Oct 27 20:58:03 2023 +1100 Merge branch 'topic/ppc-kvm' into next Merge our KVM topic branch, this has been independently included in linux-next for most of the development cycle. commit c73801ae4f22b390228ebf471d55668e824198b6 Author: Ben Wolsieffer Date: Thu Oct 19 16:45:49 2023 -0400 futex: Don't include process MM in futex key on no-MMU On no-MMU, all futexes are treated as private because there is no need to map a virtual address to physical to match the futex across processes. This doesn't quite work though, because private futexes include the current process's mm_struct as part of their key. This makes it impossible for one process to wake up a shared futex being waited on in another process. Fix this bug by excluding the mm_struct from the key. With a single address space, the futex address is already a unique key. Fixes: 784bdf3bb694 ("futex: Assume all mappings are private on !MMU systems") Signed-off-by: Ben Wolsieffer Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Thomas Gleixner Cc: Darren Hart Cc: Davidlohr Bueso Cc: André Almeida Link: https://lore.kernel.org/r/20231019204548.1236437-2-ben.wolsieffer@hefring.com kernel/futex/core.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) commit bc4c48e74312d0c96d02f7e7cf75b01f3ba19543 Merge: eff8313be8b0 0514dd05939a Author: David S. Miller Date: Fri Oct 27 10:51:42 2023 +0100 Merge branch 'mdb-get' Ido Schimmel says: ==================== Add MDB get support This patchset adds MDB get support, allowing user space to request a single MDB entry to be retrieved instead of dumping the entire MDB. Support is added in both the bridge and VXLAN drivers. Patches #1-#6 are small preparations in both drivers. Patches #7-#8 add the required uAPI attributes for the new functionality and the MDB get net device operation (NDO), respectively. Patches #9-#10 implement the MDB get NDO in both drivers. Patch #11 registers a handler for RTM_GETMDB messages in rtnetlink core. The handler derives the net device from the ifindex specified in the ancillary header and invokes its MDB get NDO. Patches #12-#13 add selftests by converting tests that use MDB dump with grep to the new MDB get functionality. iproute2 changes can be found here [1]. v2: * Patch #7: Add a comment to describe attributes structure. * Patch #9: Add a comment above spin_lock_bh(). [1] https://github.com/idosch/iproute2/tree/submit/mdb_get_v1 ==================== Signed-off-by: David S. Miller commit 0514dd05939a998abcd2f03f69cc15908072a198 Author: Ido Schimmel Date: Wed Oct 25 15:30:20 2023 +0300 selftests: vxlan_mdb: Use MDB get instead of dump Test the new MDB get functionality by converting dump and grep to MDB get. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller tools/testing/selftests/net/test_vxlan_mdb.sh | 108 +++++++++++++------------- 1 file changed, 54 insertions(+), 54 deletions(-) commit e8bba9e83c88ea951dafd3319c97c55a52b3637d Author: Ido Schimmel Date: Wed Oct 25 15:30:19 2023 +0300 selftests: bridge_mdb: Use MDB get instead of dump Test the new MDB get functionality by converting dump and grep to MDB get. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller .../testing/selftests/net/forwarding/bridge_mdb.sh | 184 ++++++++------------- 1 file changed, 71 insertions(+), 113 deletions(-) commit ddd17a54e692bef1b646febf5242db10982e1965 Author: Ido Schimmel Date: Wed Oct 25 15:30:18 2023 +0300 rtnetlink: Add MDB get support Now that both the bridge and VXLAN drivers implement the MDB get net device operation, expose the functionality to user space by registering a handler for RTM_GETMDB messages. Derive the net device from the ifindex specified in the ancillary header and invoke its MDB get NDO. Note that unlike other get handlers, the allocation of the skb containing the response is not performed in the common rtnetlink code as the size is variable and needs to be determined by the respective driver. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/core/rtnetlink.c | 89 +++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 88 insertions(+), 1 deletion(-) commit 32d9673e96dc636cbfca2381b2c93b7a15dc3369 Author: Ido Schimmel Date: Wed Oct 25 15:30:17 2023 +0300 vxlan: mdb: Add MDB get support Implement support for MDB get operation by looking up a matching MDB entry, allocating the skb according to the entry's size and then filling in the response. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller drivers/net/vxlan/vxlan_core.c | 1 + drivers/net/vxlan/vxlan_mdb.c | 150 ++++++++++++++++++++++++++++++++++++++ drivers/net/vxlan/vxlan_private.h | 2 + 3 files changed, 153 insertions(+) commit 68b380a395a72ace8b77463f6cd2d7fd6dcb5a1b Author: Ido Schimmel Date: Wed Oct 25 15:30:16 2023 +0300 bridge: mcast: Add MDB get support Implement support for MDB get operation by looking up a matching MDB entry, allocating the skb according to the entry's size and then filling in the response. The operation is performed under the bridge multicast lock to ensure that the entry does not change between the time the reply size is determined and when the reply is filled in. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/bridge/br_device.c | 1 + net/bridge/br_mdb.c | 158 ++++++++++++++++++++++++++++++++++++++++++++++++ net/bridge/br_private.h | 9 +++ 3 files changed, 168 insertions(+) commit 62f47bf9e2c00eea457cad8fa43c24ed0282b37a Author: Ido Schimmel Date: Wed Oct 25 15:30:15 2023 +0300 net: Add MDB get device operation Add MDB net device operation that will be invoked by rtnetlink code in response to received RTM_GETMDB messages. Subsequent patches will implement the operation in the bridge and VXLAN drivers. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller include/linux/netdevice.h | 4 ++++ 1 file changed, 4 insertions(+) commit 83c1bbeb864f2a197603b91b3e0f748cca64543d Author: Ido Schimmel Date: Wed Oct 25 15:30:14 2023 +0300 bridge: add MDB get uAPI attributes Add MDB get attributes that correspond to the MDB set attributes used in RTM_NEWMDB messages. Specifically, add 'MDBA_GET_ENTRY' which will hold a 'struct br_mdb_entry' and 'MDBA_GET_ENTRY_ATTRS' which will hold 'MDBE_ATTR_*' attributes that are used as indexes (source IP and source VNI). An example request will look as follows: [ struct nlmsghdr ] [ struct br_port_msg ] [ MDBA_GET_ENTRY ] struct br_mdb_entry [ MDBA_GET_ENTRY_ATTRS ] [ MDBE_ATTR_SOURCE ] struct in_addr / struct in6_addr [ MDBE_ATTR_SRC_VNI ] u32 Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller include/uapi/linux/if_bridge.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) commit 14c32a46d992412bc276b3365a0c3e5b8b1af9f2 Author: Ido Schimmel Date: Wed Oct 25 15:30:13 2023 +0300 vxlan: mdb: Factor out a helper for remote entry size calculation Currently, netlink notifications are sent for individual remote entries and not for the entire MDB entry itself. Subsequent patches are going to add MDB get support which will require the VXLAN driver to reply with an entire MDB entry. Therefore, as a preparation, factor out a helper to calculate the size of an individual remote entry. When determining the size of the reply this helper will be invoked for each remote entry in the MDB entry. No functional changes intended. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller drivers/net/vxlan/vxlan_mdb.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) commit ff97d2a956a142bc0383f52560dd46e003c216dd Author: Ido Schimmel Date: Wed Oct 25 15:30:12 2023 +0300 vxlan: mdb: Adjust function arguments Adjust the function's arguments and rename it to allow it to be reused by future call sites that only have access to 'struct vxlan_mdb_entry_key', but not to 'struct vxlan_mdb_config'. No functional changes intended. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller drivers/net/vxlan/vxlan_mdb.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit 6d0259dd6c533e4ccc41b40075c1bdfd0f1efbd7 Author: Ido Schimmel Date: Wed Oct 25 15:30:11 2023 +0300 bridge: mcast: Rename MDB entry get function The current name is going to conflict with the upcoming net device operation for the MDB get operation. Rename the function to br_mdb_entry_skb_get(). No functional changes intended. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/bridge/br_device.c | 2 +- net/bridge/br_input.c | 2 +- net/bridge/br_multicast.c | 5 +++-- net/bridge/br_private.h | 10 ++++++---- 4 files changed, 11 insertions(+), 8 deletions(-) commit 62ef9cba98a2e401b1e8b5dedcc56b735031e744 Author: Ido Schimmel Date: Wed Oct 25 15:30:10 2023 +0300 bridge: mcast: Factor out a helper for PG entry size calculation Currently, netlink notifications are sent for individual port group entries and not for the entire MDB entry itself. Subsequent patches are going to add MDB get support which will require the bridge driver to reply with an entire MDB entry. Therefore, as a preparation, factor out an helper to calculate the size of an individual port group entry. When determining the size of the reply this helper will be invoked for each port group entry in the MDB entry. No functional changes intended. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/bridge/br_mdb.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) commit 1b6d993509c13d180b2a9fbfe0ebc48e344348df Author: Ido Schimmel Date: Wed Oct 25 15:30:09 2023 +0300 bridge: mcast: Account for missing attributes The 'MDBA_MDB' and 'MDBA_MDB_ENTRY' nest attributes are not accounted for when calculating the size of MDB notifications. Add them along with comments for existing attributes. Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/bridge/br_mdb.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit b9109b5b77f0cb437fe9fd5575e29e944c0b2580 Author: Ido Schimmel Date: Wed Oct 25 15:30:08 2023 +0300 bridge: mcast: Dump MDB entries even when snooping is disabled Currently, the bridge driver does not dump MDB entries when multicast snooping is disabled although the entries are present in the kernel: # bridge mdb add dev br0 port swp1 grp 239.1.1.1 permanent # bridge mdb show dev br0 dev br0 port swp1 grp 239.1.1.1 permanent dev br0 port br0 grp ff02::6a temp dev br0 port br0 grp ff02::1:ff9d:e61b temp # ip link set dev br0 type bridge mcast_snooping 0 # bridge mdb show dev br0 # ip link set dev br0 type bridge mcast_snooping 1 # bridge mdb show dev br0 dev br0 port swp1 grp 239.1.1.1 permanent dev br0 port br0 grp ff02::6a temp dev br0 port br0 grp ff02::1:ff9d:e61b temp This behavior differs from other netlink dump interfaces that dump entries regardless if they are used or not. For example, VLANs are dumped even when VLAN filtering is disabled: # ip link set dev br0 type bridge vlan_filtering 0 # bridge vlan show dev swp1 port vlan-id swp1 1 PVID Egress Untagged Remove the check and always dump MDB entries: # bridge mdb add dev br0 port swp1 grp 239.1.1.1 permanent # bridge mdb show dev br0 dev br0 port swp1 grp 239.1.1.1 permanent dev br0 port br0 grp ff02::6a temp dev br0 port br0 grp ff02::1:ffeb:1a4d temp # ip link set dev br0 type bridge mcast_snooping 0 # bridge mdb show dev br0 dev br0 port swp1 grp 239.1.1.1 permanent dev br0 port br0 grp ff02::6a temp dev br0 port br0 grp ff02::1:ffeb:1a4d temp # ip link set dev br0 type bridge mcast_snooping 1 # bridge mdb show dev br0 dev br0 port swp1 grp 239.1.1.1 permanent dev br0 port br0 grp ff02::6a temp dev br0 port br0 grp ff02::1:ffeb:1a4d temp Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/bridge/br_mdb.c | 3 --- 1 file changed, 3 deletions(-) commit 3e238417254bfdcc23fe207780b59cbb08656762 Author: Geert Uytterhoeven Date: Wed Oct 25 10:37:11 2023 +0200 media: nuvoton: VIDEO_NPCM_VCD_ECE should depend on ARCH_NPCM The Nuvoton NPCM Video Capture/Differentiation Engine (VCD) and Encoding Compression Engine (ECE) are only present on Nuvoton NPCM SoCs. Hence add a dependency on ARCH_NPCM, to prevent asking the user about these drivers when configuring a kernel without Nuvoton NPCM Architecture support. Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine") Signed-off-by: Geert Uytterhoeven Signed-off-by: Hans Verkuil drivers/media/platform/nuvoton/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9b6db9a3a675fc2f33b587a9909dcef20c4b3794 Merge: ec0989703642 a558892b3456 Author: Greg Kroah-Hartman Date: Fri Oct 27 11:41:07 2023 +0200 Merge tag 'thunderbolt-for-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-next Mika writes: thunderbolt: Changes for v6.7 merge window This includes following USB4/Thunderbolt changes for the v6.7 merge window: - Configure asymmetric link if the DisplayPort bandwidth requires so - Enable path power management packet support for USB4 v2 routers - Make the bandwidth reservations to follow the USB4 v2 connection manager guide suggestions - DisplayPort tunneling improvements - Small cleanups and improvements around the driver. All these have been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: (25 commits) thunderbolt: Fix one kernel-doc comment thunderbolt: Configure asymmetric link if needed and bandwidth allows thunderbolt: Add support for asymmetric link thunderbolt: Introduce tb_switch_depth() thunderbolt: Introduce tb_for_each_upstream_port_on_path() thunderbolt: Introduce tb_port_path_direction_downstream() thunderbolt: Set path power management packet support bit for USB4 v2 routers thunderbolt: Change bandwidth reservations to comply USB4 v2 thunderbolt: Make is_gen4_link() available to the rest of the driver thunderbolt: Use weight constants in tb_usb3_consumed_bandwidth() thunderbolt: Use constants for path weight and priority thunderbolt: Add DP IN added last in the head of the list of DP resources thunderbolt: Create multiple DisplayPort tunnels if there are more DP IN/OUT pairs thunderbolt: Log NVM version of routers and retimers thunderbolt: Use tb_tunnel_xxx() log macros in tb.c thunderbolt: Expose tb_tunnel_xxx() log macros to the rest of the driver thunderbolt: Use tb_tunnel_dbg() where possible to make logging more consistent thunderbolt: Fix typo of HPD bit for Hot Plug Detect thunderbolt: Fix typo in enum tb_link_width kernel-doc thunderbolt: Fix debug log when DisplayPort adapter not available for pairing ... commit 5ab1a0474ce4ec5359f4514468371bcd9ccdcacd Merge: 800dce42777c b3edc3463d64 Author: Greg Kroah-Hartman Date: Fri Oct 27 11:37:12 2023 +0200 Merge tag 'extcon-next-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon into char-misc-next Chanwoo writes: Update extcon next for v6.7 Detailed description for this pull request: - Add new Realtek DHC(Digital Home Hub) RTD SoC external connector driver : Detect USB Type C cable detection for USB and USB_HOST cable and support USB Type-C connector class. The extcon-rtk-type-c.c driver supports the following Realtek RTD SoC: - realtek,rtd1295-type-c - realtek,rtd1312c-type-c - realtek,rtd1315e-type-c - realtek,rtd1319-type-c - realtek,rtd1319d-type-c - realtek,rtd1395-type-c - realtek,rtd1619-type-c - realtek,rtd1619b-type-c - Add device-tree compatible string for extcon-max77693 and extcon-77843.c. * tag 'extcon-next-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon: extcon: realtek: add the error handler for nvmem_cell_read extcon: max77843: add device-tree compatible string extcon: max77693: add device-tree compatible string dt-bindings: usb: Add Realtek DHC RTD SoC Type-C extcon: add Realtek DHC RTD SoC Type-C driver commit eff8313be8b0e9e5d9bd03b7bfc3b915339deab0 Merge: cc54d2e2c58a 7fe0e38bb669 Author: David S. Miller Date: Fri Oct 27 10:35:47 2023 +0100 Merge branch 'tcp-ao' Dmitry Safonov says: ==================== net/tcp: Add TCP-AO support This is version 16 of TCP-AO support. It addresses the build warning in the middle of patch set, reported by kernel test robot. There's one Sparse warning introduced by tcp_sigpool_start(): __cond_acquires() seems to currently being broken. I've described the reasoning for it on v9 cover letter. Also, checkpatch.pl warnings were addressed, but yet I've left the ones that are more personal preferences (i.e. 80 columns limit). Please, ping me if you have a strong feeling about one of them. ==================== Signed-off-by: David S. Miller commit 7fe0e38bb669aff739c95846b59b63925570d7ef Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:22:15 2023 +0100 Documentation/tcp: Add TCP-AO documentation It has Frequently Asked Questions (FAQ) on RFC 5925 - I found it very useful answering those before writing the actual code. It provides answers to common questions that arise on a quick read of the RFC, as well as how they were answered. There's also comparison to TCP-MD5 option, evaluation of per-socket vs in-kernel-DB approaches and description of uAPI provided. Hopefully, it will be as useful for reviewing the code as it was for writing. Cc: Jonathan Corbet Cc: linux-doc@vger.kernel.org Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller Documentation/networking/index.rst | 1 + Documentation/networking/tcp_ao.rst | 444 ++++++++++++++++++++++++++++++++++++ 2 files changed, 445 insertions(+) commit faadfaba5e018ca0f9595f17115ff48416b7b85e Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:22:14 2023 +0100 net/tcp: Add TCP_AO_REPAIR Add TCP_AO_REPAIR setsockopt(), getsockopt(). They let a user to repair TCP-AO ISNs/SNEs. Also let the user hack around when (tp->repair) is on and add ao_info on a socket in any supported state. As SNEs now can be read/written at any moment, use WRITE_ONCE()/READ_ONCE() to set/read them. Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/net/tcp_ao.h | 14 ++++++++ include/uapi/linux/tcp.h | 8 +++++ net/ipv4/tcp.c | 24 +++++++++---- net/ipv4/tcp_ao.c | 90 +++++++++++++++++++++++++++++++++++++++++++++--- 4 files changed, 125 insertions(+), 11 deletions(-) commit 248411b8cb8974a1e1c8e43123c1e682fbd64969 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:22:13 2023 +0100 net/tcp: Wire up l3index to TCP-AO Similarly how TCP_MD5SIG_FLAG_IFINDEX works for TCP-MD5, TCP_AO_KEYF_IFINDEX is an AO-key flag that binds that MKT to a specified by L3 ifinndex. Similarly, without this flag the key will work in the default VRF l3index = 0 for connections. To prevent AO-keys from overlapping, it's restricted to add key B for a socket that has key A, which have the same sndid/rcvid and one of the following is true: - !(A.keyflags & TCP_AO_KEYF_IFINDEX) or !(B.keyflags & TCP_AO_KEYF_IFINDEX) so that any key is non-bound to a VRF - A.l3index == B.l3index both want to work for the same VRF Additionally, it's restricted to match TCP-MD5 keys for the same peer the following way: |--------------|--------------------|----------------|---------------| | | MD5 key without | MD5 key | MD5 key | | | l3index | l3index=0 | l3index=N | |--------------|--------------------|----------------|---------------| | TCP-AO key | | | | | without | reject | reject | reject | | l3index | | | | |--------------|--------------------|----------------|---------------| | TCP-AO key | | | | | l3index=0 | reject | reject | allow | |--------------|--------------------|----------------|---------------| | TCP-AO key | | | | | l3index=N | reject | allow | reject | |--------------|--------------------|----------------|---------------| This is done with the help of tcp_md5_do_lookup_any_l3index() to reject adding AO key without TCP_AO_KEYF_IFINDEX if there's TCP-MD5 in any VRF. This is important for case where sysctl_tcp_l3mdev_accept = 1 Similarly, for TCP-AO lookups tcp_ao_do_lookup() may be used with l3index < 0, so that __tcp_ao_key_cmp() will match TCP-AO key in any VRF. Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/net/tcp.h | 11 ++-- include/net/tcp_ao.h | 18 +++--- net/ipv4/syncookies.c | 6 +- net/ipv4/tcp_ao.c | 170 +++++++++++++++++++++++++++++++++++++------------- net/ipv4/tcp_ipv4.c | 10 ++- net/ipv6/syncookies.c | 5 +- net/ipv6/tcp_ao.c | 21 +++---- net/ipv6/tcp_ipv6.c | 15 +++-- 8 files changed, 177 insertions(+), 79 deletions(-) commit 67fa83f7c86a86913ab9cd5a13b4bebd8d2ebb43 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:22:12 2023 +0100 net/tcp: Add static_key for TCP-AO Similarly to TCP-MD5, add a static key to TCP-AO that is patched out when there are no keys on a machine and dynamically enabled with the first setsockopt(TCP_AO) adds a key on any socket. The static key is as well dynamically disabled later when the socket is destructed. The lifetime of enabled static key here is the same as ao_info: it is enabled on allocation, passed over from full socket to twsk and destructed when ao_info is scheduled for destruction. Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/net/tcp.h | 24 ++++++++++++++++-------- include/net/tcp_ao.h | 2 ++ net/ipv4/tcp_ao.c | 22 ++++++++++++++++++++++ net/ipv4/tcp_input.c | 42 ++++++++++++++++++++++++++++-------------- net/ipv4/tcp_ipv4.c | 25 ++++++++++++++----------- net/ipv6/tcp_ipv6.c | 25 ++++++++++++++----------- 6 files changed, 96 insertions(+), 44 deletions(-) commit d6732b95b6fbbc6d5bb9d2f809e275763640c4a2 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:22:11 2023 +0100 net/tcp: Allow asynchronous delete for TCP-AO keys (MKTs) Delete becomes very, very fast - almost free, but after setsockopt() syscall returns, the key is still alive until next RCU grace period. Which is fine for listen sockets as userspace needs to be aware of setsockopt(TCP_AO) and accept() race and resolve it with verification by getsockopt() after TCP connection was accepted. The benchmark results (on non-loaded box, worse with more RCU work pending): > ok 33 Worst case delete 16384 keys: min=5ms max=10ms mean=6.93904ms stddev=0.263421 > ok 34 Add a new key 16384 keys: min=1ms max=4ms mean=2.17751ms stddev=0.147564 > ok 35 Remove random-search 16384 keys: min=5ms max=10ms mean=6.50243ms stddev=0.254999 > ok 36 Remove async 16384 keys: min=0ms max=0ms mean=0.0296107ms stddev=0.0172078 Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/uapi/linux/tcp.h | 3 ++- net/ipv4/tcp_ao.c | 21 ++++++++++++++++++--- 2 files changed, 20 insertions(+), 4 deletions(-) commit ef84703a911f4ee52ca585e8308b7084093941f4 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:22:10 2023 +0100 net/tcp: Add TCP-AO getsockopt()s Introduce getsockopt(TCP_AO_GET_KEYS) that lets a user get TCP-AO keys and their properties from a socket. The user can provide a filter to match the specific key to be dumped or ::get_all = 1 may be used to dump all keys in one syscall. Add another getsockopt(TCP_AO_INFO) for providing per-socket/per-ao_info stats: packet counters, Current_key/RNext_key and flags like ::ao_required and ::accept_icmps. Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/net/tcp_ao.h | 12 ++ include/uapi/linux/tcp.h | 63 +++++++--- net/ipv4/tcp.c | 13 +++ net/ipv4/tcp_ao.c | 295 +++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 369 insertions(+), 14 deletions(-) commit 7753c2f0a857bfa6501e67deee03988dd0bcaae7 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:22:09 2023 +0100 net/tcp: Add option for TCP-AO to (not) hash header Provide setsockopt() key flag that makes TCP-AO exclude hashing TCP header for peers that match the key. This is needed for interraction with middleboxes that may change TCP options, see RFC5925 (9.2). Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/uapi/linux/tcp.h | 5 +++++ net/ipv4/tcp_ao.c | 8 +++++--- 2 files changed, 10 insertions(+), 3 deletions(-) commit 953af8e3acb68d2db11937cec3bc5da31de5c12e Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:22:08 2023 +0100 net/tcp: Ignore specific ICMPs for TCP-AO connections Similarly to IPsec, RFC5925 prescribes: ">> A TCP-AO implementation MUST default to ignore incoming ICMPv4 messages of Type 3 (destination unreachable), Codes 2-4 (protocol unreachable, port unreachable, and fragmentation needed -- ’hard errors’), and ICMPv6 Type 1 (destination unreachable), Code 1 (administratively prohibited) and Code 4 (port unreachable) intended for connections in synchronized states (ESTABLISHED, FIN-WAIT-1, FIN- WAIT-2, CLOSE-WAIT, CLOSING, LAST-ACK, TIME-WAIT) that match MKTs." A selftest (later in patch series) verifies that this attack is not possible in this TCP-AO implementation. Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/net/tcp_ao.h | 11 ++++++++- include/uapi/linux/snmp.h | 1 + include/uapi/linux/tcp.h | 4 +++- net/ipv4/proc.c | 1 + net/ipv4/tcp_ao.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++ net/ipv4/tcp_ipv4.c | 7 ++++++ net/ipv6/tcp_ipv6.c | 7 ++++++ 7 files changed, 87 insertions(+), 2 deletions(-) commit 2717b5adea9e2558798c30eb0e93c01722edbb0a Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:22:07 2023 +0100 net/tcp: Add tcp_hash_fail() ratelimited logs Add a helper for logging connection-detailed messages for failed TCP hash verification (both MD5 and AO). Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/net/tcp.h | 14 ++++++++++++-- include/net/tcp_ao.h | 29 +++++++++++++++++++++++++++++ net/ipv4/tcp.c | 23 +++++++++++++---------- net/ipv4/tcp_ao.c | 7 +++++++ 4 files changed, 61 insertions(+), 12 deletions(-) commit 64382c71a5575741933dfdb0cf7162c6e9b8854e Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:22:06 2023 +0100 net/tcp: Add TCP-AO SNE support Add Sequence Number Extension (SNE) for TCP-AO. This is needed to protect long-living TCP-AO connections from replaying attacks after sequence number roll-over, see RFC5925 (6.2). Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/net/tcp_ao.h | 22 +++++++++++++++++++++- net/ipv4/tcp_ao.c | 46 +++++++++++++++++++++++++++++++++++++--------- net/ipv4/tcp_input.c | 28 ++++++++++++++++++++++++++++ net/ipv4/tcp_ipv4.c | 3 ++- net/ipv4/tcp_minisocks.c | 15 ++++++++++++++- net/ipv6/tcp_ipv6.c | 3 ++- 6 files changed, 104 insertions(+), 13 deletions(-) commit af09a341dcf63b34ce742295ad1ce876246c5de2 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:22:05 2023 +0100 net/tcp: Add TCP-AO segments counters Introduce segment counters that are useful for troubleshooting/debugging as well as for writing tests. Now there are global snmp counters as well as per-socket and per-key. Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/net/dropreason-core.h | 15 +++++++++++---- include/net/tcp.h | 15 +++++++++++---- include/net/tcp_ao.h | 10 ++++++++++ include/uapi/linux/snmp.h | 4 ++++ include/uapi/linux/tcp.h | 8 +++++++- net/ipv4/proc.c | 4 ++++ net/ipv4/tcp_ao.c | 30 +++++++++++++++++++++++++++--- net/ipv4/tcp_ipv4.c | 2 +- net/ipv6/tcp_ipv6.c | 4 ++-- 9 files changed, 77 insertions(+), 15 deletions(-) commit 0a3a809089eb1d4a0a2fd0c16b520d603988c859 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:22:04 2023 +0100 net/tcp: Verify inbound TCP-AO signed segments Now there is a common function to verify signature on TCP segments: tcp_inbound_hash(). It has checks for all possible cross-interactions with MD5 signs as well as with unsigned segments. The rules from RFC5925 are: (1) Any TCP segment can have at max only one signature. (2) TCP connections can't switch between using TCP-MD5 and TCP-AO. (3) TCP-AO connections can't stop using AO, as well as unsigned connections can't suddenly start using AO. Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/net/dropreason-core.h | 17 +++++ include/net/tcp.h | 53 +++++++++++++++- include/net/tcp_ao.h | 14 +++++ net/ipv4/tcp.c | 39 +++--------- net/ipv4/tcp_ao.c | 142 ++++++++++++++++++++++++++++++++++++++++++ net/ipv4/tcp_ipv4.c | 10 +-- net/ipv6/tcp_ao.c | 9 +-- net/ipv6/tcp_ipv6.c | 11 ++-- 8 files changed, 248 insertions(+), 47 deletions(-) commit 9427c6aa3ec92f66b3d38f5d5f7af6b94b648a66 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:22:03 2023 +0100 net/tcp: Sign SYN-ACK segments with TCP-AO Similarly to RST segments, wire SYN-ACKs to TCP-AO. tcp_rsk_used_ao() is handy here to check if the request socket used AO and needs a signature on the outgoing segments. Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/net/tcp.h | 3 +++ include/net/tcp_ao.h | 6 +++++ net/ipv4/tcp_ao.c | 22 ++++++++++++++++ net/ipv4/tcp_ipv4.c | 1 + net/ipv4/tcp_output.c | 72 +++++++++++++++++++++++++++++++++++++++------------ net/ipv6/tcp_ao.c | 22 ++++++++++++++++ net/ipv6/tcp_ipv6.c | 1 + 7 files changed, 111 insertions(+), 16 deletions(-) commit 06b22ef29591f625ef877ae00d82192938e29e60 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:22:02 2023 +0100 net/tcp: Wire TCP-AO to request sockets Now when the new request socket is created from the listening socket, it's recorded what MKT was used by the peer. tcp_rsk_used_ao() is a new helper for checking if TCP-AO option was used to create the request socket. tcp_ao_copy_all_matching() will copy all keys that match the peer on the request socket, as well as preparing them for the usage (creating traffic keys). Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/linux/tcp.h | 18 ++++ include/net/tcp.h | 6 ++ include/net/tcp_ao.h | 24 +++++ net/ipv4/syncookies.c | 2 + net/ipv4/tcp_ao.c | 264 ++++++++++++++++++++++++++++++++++++++++++++--- net/ipv4/tcp_input.c | 15 +++ net/ipv4/tcp_ipv4.c | 66 ++++++++++-- net/ipv4/tcp_minisocks.c | 10 ++ net/ipv4/tcp_output.c | 37 ++++--- net/ipv6/syncookies.c | 2 + net/ipv6/tcp_ao.c | 38 ++++++- net/ipv6/tcp_ipv6.c | 75 +++++++++++--- 12 files changed, 506 insertions(+), 51 deletions(-) commit decde2586b34b99684faff1eab41e5c496c27fb6 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:22:01 2023 +0100 net/tcp: Add TCP-AO sign to twsk Add support for sockets in time-wait state. ao_info as well as all keys are inherited on transition to time-wait socket. The lifetime of ao_info is now protected by ref counter, so that tcp_ao_destroy_sock() will destruct it only when the last user is gone. Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/linux/tcp.h | 3 ++ include/net/tcp_ao.h | 11 ++++-- net/ipv4/tcp_ao.c | 49 +++++++++++++++++++++----- net/ipv4/tcp_ipv4.c | 92 ++++++++++++++++++++++++++++++++++++++---------- net/ipv4/tcp_minisocks.c | 4 ++- net/ipv4/tcp_output.c | 2 +- net/ipv6/tcp_ipv6.c | 72 +++++++++++++++++++++++++++---------- 7 files changed, 183 insertions(+), 50 deletions(-) commit ba7783ad45c8f0fb7a70640f6b6fcdc54ed48412 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:22:00 2023 +0100 net/tcp: Add AO sign to RST packets Wire up sending resets to TCP-AO hashing. Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/net/tcp.h | 7 +++- include/net/tcp_ao.h | 12 ++++++ net/ipv4/tcp_ao.c | 102 ++++++++++++++++++++++++++++++++++++++++++++++++++- net/ipv4/tcp_ipv4.c | 69 +++++++++++++++++++++++++++------- net/ipv6/tcp_ipv6.c | 98 +++++++++++++++++++++++++++++++++++-------------- 5 files changed, 245 insertions(+), 43 deletions(-) commit f7dca36fc54afa2eb76bff8d0589a2ef18caea91 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:21:59 2023 +0100 net/tcp: Add tcp_parse_auth_options() Introduce a helper that: (1) shares the common code with TCP-MD5 header options parsing (2) looks for hash signature only once for both TCP-MD5 and TCP-AO (3) fails with -EEXIST if any TCP sign option is present twice, see RFC5925 (2.2): ">> A single TCP segment MUST NOT have more than one TCP-AO in its options sequence. When multiple TCP-AOs appear, TCP MUST discard the segment." Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/net/dropreason-core.h | 6 ++++++ include/net/tcp.h | 24 +++++++++++++++++++++++- include/net/tcp_ao.h | 17 ++++++++++++++++- net/ipv4/tcp.c | 3 ++- net/ipv4/tcp_input.c | 39 +++++++++++++++++++++++++++++---------- net/ipv4/tcp_ipv4.c | 15 ++++++++++----- net/ipv6/tcp_ipv6.c | 11 +++++++---- 7 files changed, 93 insertions(+), 22 deletions(-) commit 1e03d32bea8e782b7d31769c25a5fae8a5044488 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:21:58 2023 +0100 net/tcp: Add TCP-AO sign to outgoing packets Using precalculated traffic keys, sign TCP segments as prescribed by RFC5925. Per RFC, TCP header options are included in sign calculation: "The TCP header, by default including options, and where the TCP checksum and TCP-AO MAC fields are set to zero, all in network- byte order." (5.1.3) tcp_ao_hash_header() has exclude_options parameter to optionally exclude TCP header from hash calculation, as described in RFC5925 (9.1), this is needed for interaction with middleboxes that may change "some TCP options". This is wired up to AO key flags and setsockopt() later. Similarly to TCP-MD5 hash TCP segment fragments. From this moment a user can start sending TCP-AO signed segments with one of crypto ahash algorithms from supported by Linux kernel. It can have a user-specified MAC length, to either save TCP option header space or provide higher protection using a longer signature. The inbound segments are not yet verified, TCP-AO option is ignored and they are accepted. Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/net/tcp.h | 64 ++++++++++++++++ include/net/tcp_ao.h | 23 ++++++ net/ipv4/tcp_ao.c | 199 ++++++++++++++++++++++++++++++++++++++++++++++++++ net/ipv4/tcp_ipv4.c | 1 + net/ipv4/tcp_output.c | 112 ++++++++++++++++++---------- net/ipv6/tcp_ao.c | 28 +++++++ net/ipv6/tcp_ipv6.c | 2 + 7 files changed, 391 insertions(+), 38 deletions(-) commit 7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:21:57 2023 +0100 net/tcp: Calculate TCP-AO traffic keys Add traffic key calculation the way it's described in RFC5926. Wire it up to tcp_finish_connect() and cache the new keys straight away on already established TCP connections. Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/net/tcp.h | 3 + include/net/tcp_ao.h | 51 ++++++++++++- net/ipv4/tcp_ao.c | 206 ++++++++++++++++++++++++++++++++++++++++++++++++++ net/ipv4/tcp_input.c | 2 + net/ipv4/tcp_ipv4.c | 1 + net/ipv4/tcp_output.c | 2 + net/ipv6/tcp_ao.c | 50 ++++++++++++ net/ipv6/tcp_ipv6.c | 1 + 8 files changed, 314 insertions(+), 2 deletions(-) commit 0aadc73995d08f6b0dc061c14a564ffa46f5914e Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:21:56 2023 +0100 net/tcp: Prevent TCP-MD5 with TCP-AO being set Be as conservative as possible: if there is TCP-MD5 key for a given peer regardless of L3 interface - don't allow setting TCP-AO key for the same peer. According to RFC5925, TCP-AO is supposed to replace TCP-MD5 and there can't be any switch between both on any connected tuple. Later it can be relaxed, if there's a use, but in the beginning restrict any intersection. Note: it's still should be possible to set both TCP-MD5 and TCP-AO keys on a listening socket for *different* peers. Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/net/tcp.h | 43 +++++++++++++++++++++++++++++++++++++++++-- include/net/tcp_ao.h | 13 +++++++++++++ net/ipv4/tcp_ao.c | 47 +++++++++++++++++++++++++++++++++++++++++++++++ net/ipv4/tcp_ipv4.c | 14 +++++++++++--- net/ipv4/tcp_output.c | 47 +++++++++++++++++++++++++++++++++++++++++++++++ net/ipv6/tcp_ao.c | 17 +++++++++++++++++ net/ipv6/tcp_ipv6.c | 26 ++++++++++++++++++++++---- 7 files changed, 198 insertions(+), 9 deletions(-) commit 4954f17ddefc51d218625dcdfaf422a253dad3fa Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:21:55 2023 +0100 net/tcp: Introduce TCP_AO setsockopt()s Add 3 setsockopt()s: 1. TCP_AO_ADD_KEY to add a new Master Key Tuple (MKT) on a socket 2. TCP_AO_DEL_KEY to delete present MKT from a socket 3. TCP_AO_INFO to change flags, Current_key/RNext_key on a TCP-AO sk Userspace has to introduce keys on every socket it wants to use TCP-AO option on, similarly to TCP_MD5SIG/TCP_MD5SIG_EXT. RFC5925 prohibits definition of MKTs that would match the same peer, so do sanity checks on the data provided by userspace. Be as conservative as possible, including refusal of defining MKT on an established connection with no AO, removing the key in-use and etc. (1) and (2) are to be used by userspace key manager to add/remove keys. (3) main purpose is to set RNext_key, which (as prescribed by RFC5925) is the KeyID that will be requested in TCP-AO header from the peer to sign their segments with. At this moment the life of ao_info ends in tcp_v4_destroy_sock(). Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/linux/sockptr.h | 23 ++ include/net/tcp.h | 3 + include/net/tcp_ao.h | 17 +- include/uapi/linux/tcp.h | 46 +++ net/ipv4/Makefile | 1 + net/ipv4/tcp.c | 17 + net/ipv4/tcp_ao.c | 794 +++++++++++++++++++++++++++++++++++++++++++++++ net/ipv4/tcp_ipv4.c | 10 +- net/ipv6/Makefile | 1 + net/ipv6/tcp_ao.c | 19 ++ net/ipv6/tcp_ipv6.c | 39 ++- 11 files changed, 952 insertions(+), 18 deletions(-) commit c845f5f3590ef4669fe5464f8a42be6442cd174b Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:21:54 2023 +0100 net/tcp: Add TCP-AO config and structures Introduce new kernel config option and common structures as well as helpers to be used by TCP-AO code. Co-developed-by: Francesco Ruggeri Signed-off-by: Francesco Ruggeri Co-developed-by: Salam Noureddine Signed-off-by: Salam Noureddine Signed-off-by: Dmitry Safonov Acked-by: David Ahern Signed-off-by: David S. Miller include/linux/tcp.h | 9 +++-- include/net/tcp.h | 8 ++--- include/net/tcp_ao.h | 90 ++++++++++++++++++++++++++++++++++++++++++++++++ include/uapi/linux/tcp.h | 2 ++ net/ipv4/Kconfig | 13 +++++++ 5 files changed, 114 insertions(+), 8 deletions(-) commit 8c73b26315aadb82218360d0a9a05e515f6e4118 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Oct 23 20:21:53 2023 +0100 net/tcp: Prepare tcp_md5sig_pool for TCP-AO TCP-AO, similarly to TCP-MD5, needs to allocate tfms on a slow-path, which is setsockopt() and use crypto ahash requests on fast paths, which are RX/TX softirqs. Also, it needs a temporary/scratch buffer for preparing the hash. Rework tcp_md5sig_pool in order to support other hashing algorithms than MD5. It will make it possible to share pre-allocated crypto_ahash descriptors and scratch area between all TCP hash users. Internally tcp_sigpool calls crypto_clone_ahash() API over pre-allocated crypto ahash tfm. Kudos to Herbert, who provided this new crypto API. I was a little concerned over GFP_ATOMIC allocations of ahash and crypto_request in RX/TX (see tcp_sigpool_start()), so I benchmarked both "backends" with different algorithms, using patched version of iperf3[2]. On my laptop with i7-7600U @ 2.80GHz: clone-tfm per-CPU-requests TCP-MD5 2.25 Gbits/sec 2.30 Gbits/sec TCP-AO(hmac(sha1)) 2.53 Gbits/sec 2.54 Gbits/sec TCP-AO(hmac(sha512)) 1.67 Gbits/sec 1.64 Gbits/sec TCP-AO(hmac(sha384)) 1.77 Gbits/sec 1.80 Gbits/sec TCP-AO(hmac(sha224)) 1.29 Gbits/sec 1.30 Gbits/sec TCP-AO(hmac(sha3-512)) 481 Mbits/sec 480 Mbits/sec TCP-AO(hmac(md5)) 2.07 Gbits/sec 2.12 Gbits/sec TCP-AO(hmac(rmd160)) 1.01 Gbits/sec 995 Mbits/sec TCP-AO(cmac(aes128)) [not supporetd yet] 2.11 Gbits/sec So, it seems that my concerns don't have strong grounds and per-CPU crypto_request allocation can be dropped/removed from tcp_sigpool once ciphers get crypto_clone_ahash() support. [1]: https://lore.kernel.org/all/ZDefxOq6Ax0JeTRH@gondor.apana.org.au/T/#u [2]: https://github.com/0x7f454c46/iperf/tree/tcp-md5-ao Signed-off-by: Dmitry Safonov Reviewed-by: Steen Hegelund Acked-by: David Ahern Signed-off-by: David S. Miller include/net/tcp.h | 50 +++++-- net/ipv4/Kconfig | 4 + net/ipv4/Makefile | 1 + net/ipv4/tcp.c | 145 ++++--------------- net/ipv4/tcp_ipv4.c | 97 +++++++------ net/ipv4/tcp_minisocks.c | 21 ++- net/ipv4/tcp_sigpool.c | 358 +++++++++++++++++++++++++++++++++++++++++++++++ net/ipv6/tcp_ipv6.c | 60 ++++---- 8 files changed, 525 insertions(+), 211 deletions(-) commit 800dce42777cb720fbfb731a8efc36892a1d84ad Merge: 40ea89fb19fd d4c720a19e9a Author: Greg Kroah-Hartman Date: Fri Oct 27 11:35:06 2023 +0200 Merge tag 'icc-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next Georgi writes: interconnect changes for 6.7 This pull request contains the interconnect changes for the 6.7-rc1 merge window which contains just driver changes with the following highlights: Driver changes: - New interconnect driver for the SDX75 platform. - Support for coefficients to allow node-specific rate adjustments. - Update DT bindings according to the recent changes of how we represent the SMD and RPM bus clocks on Qualcomm platforms. - Misc fixes and cleanups. Signed-off-by: Georgi Djakov * tag 'icc-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc: (36 commits) interconnect: qcom: Convert to platform remove callback returning void dt-bindings: interconnect: qcom,rpmh: do not require reg on SDX65 MC virt interconnect: imx: Replace inclusion of kernel.h in the header interconnect: fix error handling in qnoc_probe() interconnect: qcom: osm-l3: Replace custom implementation of COUNT_ARGS() interconnect: msm8974: Replace custom implementation of COUNT_ARGS() interconnect: imx: Replace custom implementation of COUNT_ARGS() interconnect: qcom: Add SDX75 interconnect provider driver dt-bindings: interconnect: Add compatibles for SDX75 interconnect: qcom: sm8350: Set ACV enable_mask interconnect: qcom: sm8250: Set ACV enable_mask interconnect: qcom: sm8150: Set ACV enable_mask interconnect: qcom: sm6350: Set ACV enable_mask interconnect: qcom: sdm845: Set ACV enable_mask interconnect: qcom: sdm670: Set ACV enable_mask interconnect: qcom: sc8280xp: Set ACV enable_mask interconnect: qcom: sc8180x: Set ACV enable_mask interconnect: qcom: sc7280: Set ACV enable_mask interconnect: qcom: sc7180: Set ACV enable_mask interconnect: qcom: qdu1000: Set ACV enable_mask ... commit fe981e67568c41de6caae25d70b5f203b94452cc Author: Matias Ezequiel Vara Larsen Date: Wed Oct 25 11:49:19 2023 +0200 ALSA: virtio: use ack callback This commit uses the ack() callback to determine when a buffer has been updated, then exposes it to guest. The current mechanism splits a dma buffer into descriptors that are exposed to the device. This dma buffer is shared with the user application. When the device consumes a buffer, the driver moves the request from the used ring to available ring. The driver exposes the buffer to the device without knowing if the content has been updated from the user. The section 2.8.21.1 of the virtio spec states that: "The device MAY access the descriptor chains the driver created and the memory they refer to immediately". If the device picks up buffers from the available ring just after it is notified, it happens that the content may be old. When the ack() callback is invoked, the driver exposes only the buffers that have already been updated, i.e., enqueued in the available ring. Thus, the device always picks up a buffer that is updated. For capturing, the driver starts by exposing all the available buffers to device. After device updates the content of a buffer, it enqueues it in the used ring. It is only after the ack() for capturing is issued that the driver re-enqueues the buffer in the available ring. Co-developed-by: Anton Yakovlev Signed-off-by: Anton Yakovlev Signed-off-by: Matias Ezequiel Vara Larsen Link: https://lore.kernel.org/r/ZTjkn1YAFz67yfqx@fedora Signed-off-by: Takashi Iwai sound/virtio/virtio_pcm.c | 6 +- sound/virtio/virtio_pcm.h | 9 ++- sound/virtio/virtio_pcm_msg.c | 79 +++++++++++++++----------- sound/virtio/virtio_pcm_ops.c | 125 ++++++++++++++++++++++++++++++++++-------- 4 files changed, 158 insertions(+), 61 deletions(-) commit 3473185f31df29ac572be94fdb87ad8267108bec Author: Geoffrey D. Bennett Date: Fri Oct 27 04:38:26 2023 +1030 ALSA: scarlett2: Remap Level Meter values The values previously returned by the Level Meter control were passed through from the interface without interpretation, but it has been discovered that the order of the values matches the mux assignment order (which is not presented to userspace). In addition, the values for disabled mux outputs, and mux outputs which share a source are invalid. This patch adds a per-device meter_map[], and a dynamic meter_level_map[] which is updated on routing changes. The meter level map gets used by scarlett2_meter_ctl_get() to both present the values in a standard order, and to fix up the invalid values by zeroing them (for disabled outputs) and copying them (for mux outputs which share a source). Signed-off-by: Geoffrey D. Bennett Link: https://lore.kernel.org/r/d437ace603eff685d2e0c3d0960589d7a09dd647.1698342632.git.g@b4.vu Signed-off-by: Takashi Iwai sound/usb/mixer_scarlett2.c | 188 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 186 insertions(+), 2 deletions(-) commit 2190b9aea4eb92ccf3176e35c17c959e40f1a81b Author: Geoffrey D. Bennett Date: Fri Oct 27 04:36:16 2023 +1030 ALSA: scarlett2: Allow passing any output to line_out_remap() Line outputs 3 & 4 on the Gen 3 18i8 are internally the analogue 7 and 8 outputs, and this renumbering is hidden from the user by line_out_remap(). By allowing higher values (representing non-analogue outputs) to be passed to line_out_remap(), repeated code from scarlett2_mux_src_enum_ctl_get() and scarlett2_mux_src_enum_ctl_put() can be removed. Signed-off-by: Geoffrey D. Bennett Link: https://lore.kernel.org/r/3b70267931f5994628ab27306c73cddd17b93c8f.1698342632.git.g@b4.vu Signed-off-by: Takashi Iwai sound/usb/mixer_scarlett2.c | 25 +++++++++---------------- 1 file changed, 9 insertions(+), 16 deletions(-) commit 701949cc01283675054636f741f505f2627454b7 Author: Geoffrey D. Bennett Date: Fri Oct 27 04:35:46 2023 +1030 ALSA: scarlett2: Add support for reading firmware version The 84 bytes read during initialisation step 2 were previously ignored. This patch retrieves the firmware version from bytes 8-11, stores it in the scarlett2_data struct, and makes it available through a new control "Firmware Version". Signed-off-by: Geoffrey D. Bennett Link: https://lore.kernel.org/r/e76cd80c3445769e60c95df12c4635fc8abfe5c7.1698342632.git.g@b4.vu Signed-off-by: Takashi Iwai sound/usb/mixer_scarlett2.c | 62 ++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 59 insertions(+), 3 deletions(-) commit f3c42a2da45f87d84bd046e83d1e964d7c41dbb5 Author: Geoffrey D. Bennett Date: Fri Oct 27 04:32:39 2023 +1030 ALSA: scarlett2: Rename Gen 3 config sets The config sets are named NO_MIXER, GEN_2, GEN_3, and CLARETT currently. Rename NO_MIXER and GEN_3 to GEN_3A and GEN_3B respectively as NO_MIXER is only for the smaller Gen 3 devices. Signed-off-by: Geoffrey D. Bennett Link: https://lore.kernel.org/r/19ae5eea7fc499945efa8eeda7fcd8afe73f62d9.1698342632.git.g@b4.vu Signed-off-by: Takashi Iwai sound/usb/mixer_scarlett2.c | 74 ++++++++++++++++++++++----------------------- 1 file changed, 37 insertions(+), 37 deletions(-) commit efc3d7d20361cc59325a9f0525e079333b4459c0 Author: Geoffrey D. Bennett Date: Fri Oct 27 04:31:28 2023 +1030 ALSA: scarlett2: Rename scarlett_gen2 to scarlett2 This driver was originally developed for the Focusrite Scarlett Gen 2 series. Since then Focusrite have used a similar protocol for their Gen 3, Gen 4, Clarett USB, Clarett+, and Vocaster series. Let's call this common protocol the "Scarlett 2 Protocol" and rename the driver to scarlett2 to not imply that it is restricted to Gen 2 series devices. Signed-off-by: Geoffrey D. Bennett Link: https://lore.kernel.org/r/e1ad7f69a1e20cdb39094164504389160c1a0a0b.1698342632.git.g@b4.vu Signed-off-by: Takashi Iwai MAINTAINERS | 2 +- sound/usb/Makefile | 2 +- sound/usb/mixer_quirks.c | 4 ++-- sound/usb/{mixer_scarlett_gen2.c => mixer_scarlett2.c} | 12 +++++++----- sound/usb/mixer_scarlett2.h | 7 +++++++ sound/usb/mixer_scarlett_gen2.h | 7 ------- 6 files changed, 18 insertions(+), 16 deletions(-) commit 9e0cceadb7a5099c637e787191a9adbf9ec424cd Merge: 2050c9bc4f7b b131329b9bfb Author: Ulf Hansson Date: Fri Oct 27 11:02:11 2023 +0200 pmdomain: Merge branch fixes into next Merge the pmdomain fixes for v6.6-rc[n] into the next branch, to allow them to get tested together with the new pmdomain changes that are targeted for v6.7. Signed-off-by: Ulf Hansson commit b131329b9bfbd1b4c0c5e088cb0c6ec03a12930f Author: Tomeu Vizoso Date: Mon Oct 16 10:02:04 2023 +0200 pmdomain: amlogic: Fix mask for the second NNA mem PD domain Without this change, the NPU hangs when the 8th NN core is used. It matches what the out-of-tree driver does. Signed-off-by: Tomeu Vizoso Fixes: 9a217b7e8953 ("soc: amlogic: meson-pwrc: Add NNA power domain for A311D") Acked-by: Neil Armstrong Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20231016080205.41982-2-tomeu@tomeuvizoso.net Signed-off-by: Ulf Hansson drivers/pmdomain/amlogic/meson-ee-pwrc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit eefed7662ff223f70ba8b1af07f1a096a5ece588 Author: Florian Westphal Date: Thu Oct 26 16:45:42 2023 +0200 xfrm: policy: fix layer 4 flowi decoding The commit shipped with two bugs: fl4->fl4_icmp_type = flkeys->icmp.type; fl4->fl4_icmp_type = flkeys->icmp.code; ~~~~ should have been "code". But the more severe bug is that I got fooled by flowi member defines: fl4_icmp_type, fl4_gre_key and fl4_dport share the same union/address. Fix typo and make gre/icmp key setting depend on the l4 protocol. Fixes: 7a0207094f1b ("xfrm: policy: replace session decode with flow dissector") Reported-and-tested-by: Antony Antony Signed-off-by: Florian Westphal Signed-off-by: Steffen Klassert net/xfrm/xfrm_policy.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) commit f99b926f6543faeadba1b4524d8dc9c102489135 Author: Anup Patel Date: Wed Oct 25 19:58:20 2023 +0530 irqchip/sifive-plic: Fix syscore registration for multi-socket systems Multi-socket systems have a separate PLIC in each socket, so __plic_init() is invoked for each PLIC. __plic_init() registers syscore operations, which obviously fails on the second invocation. Move it into the already existing condition for installing the CPU hotplug state so it is only invoked once when the first PLIC is initialized. [ tglx: Massaged changelog ] Fixes: e80f0b6a2cf3 ("irqchip/irq-sifive-plic: Add syscore callbacks for hibernation") Signed-off-by: Anup Patel Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20231025142820.390238-4-apatel@ventanamicro.com drivers/irqchip/irq-sifive-plic.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit e6b3d55b67d00c084a2b98c594330411fb4ebeac Author: Daniel Starke Date: Fri Oct 27 07:39:03 2023 +0200 tty: n_gsm: add copyright Siemens Mobility GmbH More than 1/3 of the n_gsm code has been contributed by us in the last 1.5 years, completing conformance with the standard and stabilizing the driver: - added UI (unnumbered information) frame support - added PN (parameter negotiation) message handling and function support - added optional keep-alive control link supervision via test messages - added TIOCM_OUT1 and TIOCM_OUT2 to allow responder to operate as modem - added TIOCMIWAIT support on virtual ttys - added additional ioctls and parameters to configure the new functions - added overall locking mechanism to avoid data race conditions - added outgoing data flow to decouple physical from virtual tty handling for better performance and to avoid dead-locks - fixed advanced option mode implementation - fixed convergence layer type 2 implementation - fixed handling of CLD (multiplexer close down) messages - fixed broken muxer close down procedure - and many more bug fixes With this most of our initial RFC has been implemented. It gives the driver a quality boost unseen in the decade before. Add a copyright notice to the n_gsm files to highlight this contribution. Link: https://lore.kernel.org/all/20220225080758.2869-1-daniel.starke@siemens.com/ Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20231027053903.1886-1-daniel.starke@siemens.com Signed-off-by: Greg Kroah-Hartman drivers/tty/n_gsm.c | 1 + include/uapi/linux/gsmmux.h | 1 + 2 files changed, 2 insertions(+) commit 08d4c174828d868d314d2475fbcaa1393f0bbba9 Author: Rob Herring Date: Fri Oct 20 08:02:56 2023 -0500 irqchip/ls-scfg-msi: Use device_get_match_data() Use preferred device_get_match_data() instead of of_match_device() to get the driver match data in a single step without the unnecessary intermediate match pointer. With this, adjust the includes to explicitly include the correct headers. That also serves as preparation to remove implicit includes within the DT headers. of_platform.h currently includes platform_device.h among others. Signed-off-by: Rob Herring Signed-off-by: Thomas Gleixner Tested-by: Vladimir Oltean Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20231020130255.2954415-3-robh@kernel.org drivers/irqchip/irq-ls-scfg-msi.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) commit 5e7afb2eb7b2a7c81e9f608cbdf74a07606fd1b5 Author: Herve Codina Date: Tue Oct 24 17:03:35 2023 +0200 genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware irq_remove_generic_chip() calculates the Linux interrupt number for removing the handler and interrupt chip based on gc::irq_base as a linear function of the bit positions of set bits in the @msk argument. When the generic chip is present in an irq domain, i.e. created with a call to irq_alloc_domain_generic_chips(), gc::irq_base contains not the base Linux interrupt number. It contains the base hardware interrupt for this chip. It is set to 0 for the first chip in the domain, 0 + N for the next chip, where $N is the number of hardware interrupts per chip. That means the Linux interrupt number cannot be calculated based on gc::irq_base for irqdomain based chips without a domain map lookup, which is currently missing. Rework the code to take the irqdomain case into account and calculate the Linux interrupt number by a irqdomain lookup of the domain specific hardware interrupt number. [ tglx: Massage changelog. Reshuffle the logic and add a proper comment. ] Fixes: cfefd21e693d ("genirq: Add chip suspend and resume callbacks") Signed-off-by: Herve Codina Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20231024150335.322282-1-herve.codina@bootlin.com kernel/irq/generic-chip.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) commit e8cca466a84a75f8ff2a7a31173c99ee6d1c59d2 Merge: 6e6c6d6bc6c9 f7da9c081517 aa5cabc4ce8e 9e13ec61de2a e82c175e6322 cedc811c7677 3613047280ec 92bce97f0c34 Author: Joerg Roedel Date: Fri Oct 27 09:13:40 2023 +0200 Merge branches 'iommu/fixes', 'arm/tegra', 'arm/smmu', 'virtio', 'x86/vt-d', 'x86/amd', 'core' and 's390' into next commit 40ea89fb19fdb73472f63a4b00c728ebb55af1b5 Author: Greg Kroah-Hartman Date: Tue Oct 24 13:49:59 2023 +0200 uacce: make uacce_class constant Now that the driver core allows for struct class to be in read-only memory, we should make all 'class' structures declared at build time placing them into read-only memory, instead of having to be dynamically allocated at runtime. Cc: Zhou Wang Cc: Arnd Bergmann Cc: linux-accelerators@lists.ozlabs.org Tested-by: Zhangfei Gao Link: https://lore.kernel.org/r/2023102458-designate-vicinity-4c86@gregkh Signed-off-by: Greg Kroah-Hartman drivers/misc/uacce/uacce.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) commit cc54d2e2c58a40a82dfd39afa95d3d27f3d6509d Author: Bagas Sanjaya Date: Wed Oct 25 20:03:32 2023 +0700 MAINTAINERS: Remove linuxwwan@intel.com mailing list Messages submitted to the ML bounce (address not found error). In fact, the ML was mistagged as person maintainer instead of mailing list. Remove the ML to keep Cc: lists a bit shorter and not to spam everyone's inbox with postmaster notifications. Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20231025130332.67995-2-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski MAINTAINERS | 3 --- 1 file changed, 3 deletions(-) commit ce07087964208eee2ca2f9ee4a98f8b5d9027fe6 Author: Hangyu Hua Date: Fri Oct 27 11:03:02 2023 +0800 9p/net: fix possible memory leak in p9_check_errors() When p9pdu_readf() is called with "s?d" attribute, it allocates a pointer that will store a string. But when p9pdu_readf() fails while handling "d" then this pointer will not be freed in p9_check_errors(). Fixes: 51a87c552dfd ("9p: rework client code to use new protocol support functions") Reviewed-by: Christian Schoenebeck Signed-off-by: Hangyu Hua Message-ID: <20231027030302.11927-1-hbh25y@gmail.com> Signed-off-by: Dominique Martinet net/9p/client.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit e02be6390d6fddae6b4b9053caea9fc5ca011f32 Author: Dominique Martinet Date: Thu Oct 26 07:27:52 2023 +0900 9p/fs: add MODULE_DESCIPTION Fix modpost warning that MODULE_DESCRIPTION is missing in fs/9p/9p.o Signed-off-by: Dominique Martinet Message-ID: <20231025223107.1274963-1-asmadeus@codewreck.org> Reviewed-by: Christian Schoenebeck fs/9p/v9fs.c | 1 + 1 file changed, 1 insertion(+) commit 39763480dd19fae66c0051a5f42d1ee4dfdc18cb Author: Dominique Martinet Date: Wed Oct 25 19:34:45 2023 +0900 9p/net: xen: fix false positive printf format overflow warning Use the constant to make the compiler happy about this warning: net/9p/trans_xen.c: In function ‘xen_9pfs_front_changed’: net/9p/trans_xen.c:444:39: warning: ‘%d’ directive writing between 1 and 11 bytes into a region of size 8 [-Wformat-overflow=] 444 | sprintf(str, "ring-ref%d", i); | ^~ In function ‘xen_9pfs_front_init’, inlined from ‘xen_9pfs_front_changed’ at net/9p/trans_xen.c:516:8, inlined from ‘xen_9pfs_front_changed’ at net/9p/trans_xen.c:504:13: net/9p/trans_xen.c:444:30: note: directive argument in the range [-2147483644, 2147483646] 444 | sprintf(str, "ring-ref%d", i); | ^~~~~~~~~~~~ net/9p/trans_xen.c:444:17: note: ‘sprintf’ output between 10 and 20 bytes into a destination of size 16 444 | sprintf(str, "ring-ref%d", i); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ net/9p/trans_xen.c: In function ‘xen_9pfs_front_changed’: net/9p/trans_xen.c:450:45: warning: ‘%d’ directive writing between 1 and 11 bytes into a region of size 2 [-Wformat-overflow=] 450 | sprintf(str, "event-channel-%d", i); | ^~ In function ‘xen_9pfs_front_init’, inlined from ‘xen_9pfs_front_changed’ at net/9p/trans_xen.c:516:8, inlined from ‘xen_9pfs_front_changed’ at net/9p/trans_xen.c:504:13: net/9p/trans_xen.c:450:30: note: directive argument in the range [-2147483644, 2147483646] 450 | sprintf(str, "event-channel-%d", i); | ^~~~~~~~~~~~~~~~~~ net/9p/trans_xen.c:450:17: note: ‘sprintf’ output between 16 and 26 bytes into a destination of size 16 450 | sprintf(str, "event-channel-%d", i); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ There is no change in logic: there only are a constant number of rings, and there also already is a BUILD_BUG_ON that checks if that constant goes over 9 as anything bigger would no longer fit the event-channel-%d destination size. In theory having that size as part of the struct means it could be modified by another thread and makes the compiler lose track of possible values for 'i' here, using the constant directly here makes it work. Signed-off-by: Dominique Martinet Message-ID: <20231025103445.1248103-3-asmadeus@codewreck.org> Reviewed-by: Christian Schoenebeck net/9p/trans_xen.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit dbc0fd481cd05bc5000136245ba49501d568936e Merge: edd68156bccf ba20ecb1d1bb Author: Jakub Kicinski Date: Thu Oct 26 20:34:25 2023 -0700 Merge branch 'intel-wired-lan-driver-updates-for-2023-10-25-ice' Jacob Keller says: ==================== Intel Wired LAN Driver Updates for 2023-10-25 (ice) This series extends the ice driver with basic support for the E830 device line. It does not include support for all device features, but enables basic functionality to load and pass traffic. Alice adds the 200G speed and PHY types supported by E830 hardware. Dan extends the DDP package logic to support the E830 package segment. Paul adds the basic registers and macros used by E830 hardware, and adds support for handling variable length link status information from firmware. Pawel removes some redundant zeroing of the PCI IDs list, and extends the list to include the E830 device IDs. ==================== Link: https://lore.kernel.org/r/20231025214157.1222758-1-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski commit ba20ecb1d1bb52173d8599c9c613c73adadd5225 Author: Pawel Chmielewski Date: Wed Oct 25 14:41:57 2023 -0700 ice: Hook up 4 E830 devices by adding their IDs As the previous patches provide support for E830 hardware, add E830 specific IDs to the PCI device ID table, so these devices can now be probed by the kernel. Reviewed-by: Jesse Brandeburg Signed-off-by: Pawel Chmielewski Reviewed-by: Simon Horman Signed-off-by: Paul Greenwalt Tested-by: Tony Brelinski Signed-off-by: Jacob Keller Link: https://lore.kernel.org/r/20231025214157.1222758-7-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/ice/ice_main.c | 4 ++++ 1 file changed, 4 insertions(+) commit f8ab08c0b769e69a8f6773ab6ffcb44a8d5e57a2 Author: Pawel Chmielewski Date: Wed Oct 25 14:41:56 2023 -0700 ice: Remove redundant zeroing of the fields. Remove zeroing of the fields, as all the fields are in fact initialized with zeros automatically Reviewed-by: Jesse Brandeburg Signed-off-by: Pawel Chmielewski Reviewed-by: Simon Horman Signed-off-by: Paul Greenwalt Tested-by: Tony Brelinski Signed-off-by: Jacob Keller Link: https://lore.kernel.org/r/20231025214157.1222758-6-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/ice/ice_main.c | 54 +++++++++++++++---------------- 1 file changed, 27 insertions(+), 27 deletions(-) commit 3cbdb0343022a2ca672cd8913e745cede24b365c Author: Dan Nowlin Date: Wed Oct 25 14:41:55 2023 -0700 ice: Add support for E830 DDP package segment Add support for E830 DDP package segment. For the E830 package, signature buffers will not be included inline in the configuration buffers. Instead, the signature buffers will be located in a signature segment. Reviewed-by: Jesse Brandeburg Signed-off-by: Dan Nowlin Co-developed-by: Paul Greenwalt Signed-off-by: Paul Greenwalt Reviewed-by: Simon Horman Tested-by: Tony Brelinski Signed-off-by: Jacob Keller Link: https://lore.kernel.org/r/20231025214157.1222758-5-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/ice/ice_ddp.c | 426 +++++++++++++++++++++++++----- drivers/net/ethernet/intel/ice/ice_ddp.h | 27 +- drivers/net/ethernet/intel/ice/ice_type.h | 3 + 3 files changed, 382 insertions(+), 74 deletions(-) commit 2777d24ec6d1c0b1bbebb5142465b29c116094e6 Author: Paul Greenwalt Date: Wed Oct 25 14:41:54 2023 -0700 ice: Add ice_get_link_status_datalen The Get Link Status data length can vary with different versions of ice_aqc_get_link_status_data. Add ice_get_link_status_datalen() to return datalen for the specific ice_aqc_get_link_status_data version. Add new link partner fields to ice_aqc_get_link_status_data; PHY type, FEC, and flow control. Reviewed-by: Jesse Brandeburg Co-developed-by: Pawel Chmielewski Signed-off-by: Pawel Chmielewski Reviewed-by: Simon Horman Signed-off-by: Paul Greenwalt Tested-by: Tony Brelinski Signed-off-by: Jacob Keller Link: https://lore.kernel.org/r/20231025214157.1222758-4-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 37 ++++++++++++++++++++++--- drivers/net/ethernet/intel/ice/ice_common.c | 22 +++++++++++++-- 2 files changed, 53 insertions(+), 6 deletions(-) commit 24407a01e57c07aa919279ce85495ad38680cc39 Author: Alice Michael Date: Wed Oct 25 14:41:53 2023 -0700 ice: Add 200G speed/phy type use Add the support for 200G phy speeds and the mapping for their advertisement in link. Add the new PHY type bits for AQ command, as needed for 200G E830 controllers. Signed-off-by: Alice Michael Co-developed-by: Pawel Chmielewski Signed-off-by: Pawel Chmielewski Reviewed-by: Simon Horman Signed-off-by: Paul Greenwalt Tested-by: Tony Brelinski Signed-off-by: Jacob Keller Link: https://lore.kernel.org/r/20231025214157.1222758-3-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 11 ++++++++++- drivers/net/ethernet/intel/ice/ice_common.c | 1 + drivers/net/ethernet/intel/ice/ice_ethtool.c | 26 +++++++++++++++++++++++-- drivers/net/ethernet/intel/ice/ice_ethtool.h | 8 ++++++++ 4 files changed, 43 insertions(+), 3 deletions(-) commit ba1124f58afd37d9ff155d4ab7c9f209346aaed9 Author: Paul Greenwalt Date: Wed Oct 25 14:41:52 2023 -0700 ice: Add E830 device IDs, MAC type and registers E830 is the 200G NIC family which uses the ice driver. Add specific E830 registers. Embed macros to use proper register based on (hw)->mac_type & name those macros to [ORIGINAL]_BY_MAC(hw). Registers only available on one of the macs will need to be explicitly referred to as E800_NAME instead of just NAME. PTP is not yet supported. Co-developed-by: Milena Olech Signed-off-by: Milena Olech Co-developed-by: Dan Nowlin Signed-off-by: Dan Nowlin Co-developed-by: Scott Taylor Signed-off-by: Scott Taylor Co-developed-by: Pawel Chmielewski Signed-off-by: Pawel Chmielewski Reviewed-by: Simon Horman Signed-off-by: Paul Greenwalt Tested-by: Tony Brelinski Signed-off-by: Jacob Keller Link: https://lore.kernel.org/r/20231025214157.1222758-2-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/ice/ice_common.c | 71 ++++++++++++++-------- drivers/net/ethernet/intel/ice/ice_devids.h | 10 ++- drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c | 24 +++++--- drivers/net/ethernet/intel/ice/ice_hw_autogen.h | 52 ++++++++++++---- drivers/net/ethernet/intel/ice/ice_main.c | 13 ++-- drivers/net/ethernet/intel/ice/ice_type.h | 3 +- drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c | 29 ++++++--- 7 files changed, 141 insertions(+), 61 deletions(-) commit edd68156bccf1af233576ad847f4b138e8b88040 Merge: c6f9b7138bf5 1002f8171d96 Author: Jakub Kicinski Date: Thu Oct 26 20:27:57 2023 -0700 Merge tag 'wireless-next-2023-10-26' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Kalle Valo says: ==================== wireless-next patches for v6.7 The third, and most likely the last, features pull request for v6.7. Fixes all over and only few small new features. Major changes: iwlwifi - more Multi-Link Operation (MLO) work ath12k - QCN9274: mesh support ath11k - firmware-2.bin container file format support * tag 'wireless-next-2023-10-26' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (155 commits) wifi: ray_cs: Remove unnecessary (void*) conversions Revert "wifi: ath11k: call ath11k_mac_fils_discovery() without condition" wifi: ath12k: Introduce and use ath12k_sta_to_arsta() wifi: ath12k: fix htt mlo-offset event locking wifi: ath12k: fix dfs-radar and temperature event locking wifi: ath11k: fix gtk offload status event locking wifi: ath11k: fix htt pktlog locking wifi: ath11k: fix dfs radar event locking wifi: ath11k: fix temperature event locking wifi: ath12k: rename the sc naming convention to ab wifi: ath12k: rename the wmi_sc naming convention to wmi_ab wifi: ath11k: add firmware-2.bin support wifi: ath11k: qmi: refactor ath11k_qmi_m3_load() wifi: rtw89: cleanup firmware elements parsing wifi: rt2x00: rework MT7620 PA/LNA RF calibration wifi: rt2x00: rework MT7620 channel config function wifi: rt2x00: improve MT7620 register initialization MAINTAINERS: wifi: rt2x00: drop Helmut Schaa wifi: wlcore: main: replace deprecated strncpy with strscpy wifi: wlcore: boot: replace deprecated strncpy with strscpy ... ==================== Link: https://lore.kernel.org/r/20231026090411.B2426C433CB@smtp.kernel.org Signed-off-by: Jakub Kicinski commit c6f9b7138bf5c6b826175c9e0ad5f5dbfff4fa36 Merge: cc33a80b8164 ea41b880cc85 Author: Jakub Kicinski Date: Thu Oct 26 20:02:40 2023 -0700 Merge tag 'for-netdev' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Daniel Borkmann says: ==================== pull-request: bpf-next 2023-10-26 We've added 51 non-merge commits during the last 10 day(s) which contain a total of 75 files changed, 5037 insertions(+), 200 deletions(-). The main changes are: 1) Add open-coded task, css_task and css iterator support. One of the use cases is customizable OOM victim selection via BPF, from Chuyi Zhou. 2) Fix BPF verifier's iterator convergence logic to use exact states comparison for convergence checks, from Eduard Zingerman, Andrii Nakryiko and Alexei Starovoitov. 3) Add BPF programmable net device where bpf_mprog defines the logic of its xmit routine. It can operate in L3 and L2 mode, from Daniel Borkmann and Nikolay Aleksandrov. 4) Batch of fixes for BPF per-CPU kptr and re-enable unit_size checking for global per-CPU allocator, from Hou Tao. 5) Fix libbpf which eagerly assumed that SHT_GNU_verdef ELF section was going to be present whenever a binary has SHT_GNU_versym section, from Andrii Nakryiko. 6) Fix BPF ringbuf correctness to fold smp_mb__before_atomic() into atomic_set_release(), from Paul E. McKenney. 7) Add a warning if NAPI callback missed xdp_do_flush() under CONFIG_DEBUG_NET which helps checking if drivers were missing the former, from Sebastian Andrzej Siewior. 8) Fix missed RCU read-lock in bpf_task_under_cgroup() which was throwing a warning under sleepable programs, from Yafang Shao. 9) Avoid unnecessary -EBUSY from htab_lock_bucket by disabling IRQ before checking map_locked, from Song Liu. 10) Make BPF CI linked_list failure test more robust, from Kumar Kartikeya Dwivedi. 11) Enable samples/bpf to be built as PIE in Fedora, from Viktor Malik. 12) Fix xsk starving when multiple xsk sockets were associated with a single xsk_buff_pool, from Albert Huang. 13) Clarify the signed modulo implementation for the BPF ISA standardization document that it uses truncated division, from Dave Thaler. 14) Improve BPF verifier's JEQ/JNE branch taken logic to also consider signed bounds knowledge, from Andrii Nakryiko. 15) Add an option to XDP selftests to use multi-buffer AF_XDP xdp_hw_metadata and mark used XDP programs as capable to use frags, from Larysa Zaremba. 16) Fix bpftool's BTF dumper wrt printing a pointer value and another one to fix struct_ops dump in an array, from Manu Bretelle. * tag 'for-netdev' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (51 commits) netkit: Remove explicit active/peer ptr initialization selftests/bpf: Fix selftests broken by mitigations=off samples/bpf: Allow building with custom bpftool samples/bpf: Fix passing LDFLAGS to libbpf samples/bpf: Allow building with custom CFLAGS/LDFLAGS bpf: Add more WARN_ON_ONCE checks for mismatched alloc and free selftests/bpf: Add selftests for netkit selftests/bpf: Add netlink helper library bpftool: Extend net dump with netkit progs bpftool: Implement link show support for netkit libbpf: Add link-based API for netkit tools: Sync if_link uapi header netkit, bpf: Add bpf programmable net device bpf: Improve JEQ/JNE branch taken logic bpf: Fold smp_mb__before_atomic() into atomic_set_release() bpf: Fix unnecessary -EBUSY from htab_lock_bucket xsk: Avoid starving the xsk further down the list bpf: print full verifier states on infinite loop detection selftests/bpf: test if state loops are detected in a tricky case bpf: correct loop detection for iterators convergence ... ==================== Link: https://lore.kernel.org/r/20231026150509.2824-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit cc33a80b816406f900a53c7f98a50f6eacdd2e31 Author: Alexey Makhalov Date: Wed Oct 25 16:19:31 2023 -0700 MAINTAINERS: Maintainer change for ptp_vmw driver Deep has decided to transfer the maintainership of the VMware virtual PTP clock driver (ptp_vmw) to Jeff. Update the MAINTAINERS file to reflect this change. Signed-off-by: Alexey Makhalov Acked-by: Deep Shah Acked-by: Jeff Sipek Link: https://lore.kernel.org/r/20231025231931.76842-1-amakhalov@vmware.com Signed-off-by: Jakub Kicinski MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9cfe8cf5027bf4354e752d40c784219225f74004 Author: Michael Chan Date: Wed Oct 25 18:32:31 2023 -0700 bnxt_en: Fix 2 stray ethtool -S counters The recent firmware interface change has added 2 counters in struct rx_port_stats_ext. This caused 2 stray ethtool counters to be displayed. Since new counters are added from time to time, fix it so that the ethtool logic will only display up to the maximum known counters. These 2 counters are not used by production firmware yet. Fixes: 754fbf604ff6 ("bnxt_en: Update firmware interface to 1.10.2.171") Reviewed-by: Ajit Khaparde Signed-off-by: Michael Chan Link: https://lore.kernel.org/r/20231026013231.53271-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 28 ++++++++++++++++++----- 1 file changed, 22 insertions(+), 6 deletions(-) commit eb9df668381d350e462fdf840907388e0a9b80fe Author: Jakub Kicinski Date: Wed Oct 25 11:27:39 2023 -0700 tools: ynl-gen: respect attr-cnt-name at the attr set level Davide reports that we look for the attr-cnt-name in the wrong object. We try to read it from the family, but the schema only allows for it to exist at attr-set level. Reported-by: Davide Caratti Link: https://lore.kernel.org/all/CAKa-r6vCj+gPEUKpv7AsXqM77N6pB0evuh7myHq=585RA3oD5g@mail.gmail.com/ Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/20231025182739.184706-1-kuba@kernel.org Signed-off-by: Jakub Kicinski tools/net/ynl/ynl-gen-c.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit bc30bb88ff3153fba7693557d15733179adf7492 Author: Jakub Kicinski Date: Wed Oct 25 09:22:53 2023 -0700 netlink: specs: support conditional operations Page pool code is compiled conditionally, but the operations are part of the shared netlink family. We can handle this by reporting empty list of pools or -EOPNOTSUPP / -ENOSYS but the cleanest way seems to be removing the ops completely at compilation time. That way user can see that the page pool ops are not present using genetlink introspection. Same way they'd check if the kernel is "new enough" to support the ops. Extend the specs with the ability to specify the config condition under which op (and its policies, etc.) should be hidden. Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/20231025162253.133159-1-kuba@kernel.org Signed-off-by: Jakub Kicinski Documentation/netlink/genetlink-c.yaml | 5 +++++ Documentation/netlink/genetlink-legacy.yaml | 5 +++++ Documentation/netlink/genetlink.yaml | 5 +++++ tools/net/ynl/ynl-gen-c.py | 22 ++++++++++++++++++++++ 4 files changed, 37 insertions(+) commit ea23fbd2a8f7dadfa9cd9b9d73f3b8a69eec0671 Author: Jakub Kicinski Date: Wed Oct 25 09:22:04 2023 -0700 netlink: make range pointers in policies const struct nla_policy is usually constant itself, but unless we make the ranges inside constant we won't be able to make range structs const. The ranges are not modified by the core. Reviewed-by: Johannes Berg Reviewed-by: David Ahern Reviewed-by: Nikolay Aleksandrov Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/20231025162204.132528-1-kuba@kernel.org Signed-off-by: Jakub Kicinski drivers/net/bonding/bond_netlink.c | 2 +- drivers/net/vxlan/vxlan_mdb.c | 2 +- include/net/netlink.h | 4 ++-- net/ipv6/ioam6_iptunnel.c | 2 +- net/sched/sch_fq.c | 2 +- net/sched/sch_fq_pie.c | 2 +- net/sched/sch_qfq.c | 2 +- net/sched/sch_taprio.c | 2 +- net/wireless/nl80211.c | 2 +- tools/net/ynl/ynl-gen-c.py | 2 +- 10 files changed, 11 insertions(+), 11 deletions(-) commit e2ae32d8c2a303af58d22ee61b3b7aa7021e54c9 Author: James Zhu Date: Thu Sep 7 10:41:00 2023 -0400 drm/amdxcp: fix amdxcp unloads incompletely amdxcp unloads incompletely, and below error will be seen during load/unload, sysfs: cannot create duplicate filename '/devices/platform/amdgpu_xcp.0' devres_release_group will free xcp device at first, platform device will be unregistered later in platform_device_unregister. Signed-off-by: James Zhu Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit f0b8f65b482548c9d1d87c20fa4850c61305ff47 Author: Li Ma Date: Tue Oct 24 18:28:24 2023 +0800 drm/amd/amdgpu: fix the GPU power print error in pm info Modify the print format of the fractional part to avoid display error. Signed-off-by: Li Ma Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/amdgpu_pm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d055714a21cc0287c7e1b15c355795c42fb3a5cf Author: Lijo Lazar Date: Thu Oct 19 12:49:57 2023 +0530 drm/amdgpu: Use pcie domain of xcc acpi objects PCI domain/segment information of xccs is available through ACPI DSM methods. Consider that also while looking for devices. Signed-off-by: Lijo Lazar Reviewed-by: Rajneesh Bhardwaj Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 40 ++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 18 deletions(-) commit 406e8845356d18bdf3d3a23b347faf67706472ec Author: Lin.Cao Date: Wed Oct 25 11:32:41 2023 +0800 drm/amd: check num of link levels when update pcie param In SR-IOV environment, the value of pcie_table->num_of_link_levels will be 0, and num_of_levels - 1 will cause array index out of bounds Signed-off-by: Lin.Cao Acked-by: Jingwen Chen Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 3 +++ 1 file changed, 3 insertions(+) commit 3f69d5860f5beeb7714922b0c4a653db7d667190 Author: Lijo Lazar Date: Fri Oct 20 12:23:37 2023 +0530 drm/amdgpu: Add a read to GFX v9.4.3 ring test Issue a read to confirm the register write before ringing doorbell. With multiple XCCs there is chance for race condition. Signed-off-by: Lijo Lazar Acked-by: Hawking Zhang Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 1 + 1 file changed, 1 insertion(+) commit 5bd8e05fe203aa33721cf301a6883b28493f73ab Author: Yifan Zhang Date: Tue Oct 24 21:16:26 2023 +0800 drm/amd/pm: call smu_cmn_get_smc_version in is_mode1_reset_supported. is_mode1_reset_supported may be called before smu init, when smu_context is unitialized in driver load/unload test. Call smu_cmn_get_smc_version explicitly in is_mode1_reset_supported. v2: apply to aldebaran in case is_mode1_reset_supported will be uncommented (Candice Li) Fixes: 710d9caec70c ("drm/amd/pm: drop most smu_cmn_get_smc_version in smu") Signed-off-by: Yifan Zhang Reviewed-by: Candice Li Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 8 +++++++- drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 10 +++++++++- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 8 +++++++- 3 files changed, 23 insertions(+), 3 deletions(-) commit 2cea7bb9110d3c52e55977824f79875777b574b4 Author: Tao Zhou Date: Mon Sep 11 18:05:22 2023 +0800 drm/amdgpu: get RAS poison status from DF v4_6_2 Add DF block and RAS poison mode query for DF v4_6_2. Signed-off-by: Tao Zhou Reviewed-by: Stanley.Yang Acked-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/Makefile | 3 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 4 ++++ drivers/gpu/drm/amd/amdgpu/df_v4_6_2.c | 34 +++++++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/df_v4_6_2.h | 31 ++++++++++++++++++++++++ 4 files changed, 71 insertions(+), 1 deletion(-) commit dd2687f5d9b2cf950fbe17fbc7c4f64489b19cd6 Author: Lijo Lazar Date: Thu Oct 12 15:09:38 2023 +0530 drm/amdgpu: Use discovery table's subrevision Use subrevision of IP version in discovery table to identify SOC revision id for NBIO v7.9 SOCs. Only newer bootloaders update subrevision field. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Reviewed-by: Le Ma Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit ae8cffe353b510d0bbb12488f7ed0ea01ace4823 Author: Aric Cyr Date: Mon Oct 9 13:11:32 2023 -0400 drm/amd/display: 3.2.256 DC v3.2.256 Summary: * Fixes null-deref regression after "drm/amd/display: Update OPP counter from new interface" * Fixes display flashing when VSR and HDR enabled on dcn32 * Fixes dcn3x intermittent hangs due to FPO * Fixes MST Multi-Stream light up on dcn35 * Fixes green screen on DCN31x when DVI and HDMI monitors attached * Adds DML2 improvements * Adds idle power optimization improvements * Accommodates panels with lower nit backlight * Updates SDP VSC colorimetry from DP test automation request * Reverts "drm/amd/display: allow edp updates for virtual signal" Acked-by: Roman Li Signed-off-by: Aric Cyr Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 670da29faf5ff160043a1f02e6ac2ed8345b5d7e Author: Aurabindo Pillai Date: Tue Oct 10 16:32:23 2023 -0400 drm/amd/display: add interface to query SubVP status [Why&How] To enable automated testing through IGT, expose an API that is accessible through debugfs to query current status of SubVP feature. Reviewed-by: Alvin Lee Acked-by: Roman Li Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 4 ++++ drivers/gpu/drm/amd/display/dc/dc.h | 1 + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c | 3 ++- drivers/gpu/drm/amd/display/dc/dcn321/dcn321_resource.c | 3 ++- 4 files changed, 9 insertions(+), 2 deletions(-) commit b231933da7d6be53d08139f8adf2560a90b47ca9 Author: Iswara Nagulendran Date: Fri Sep 29 11:20:46 2023 -0400 drm/amd/display: Read before writing Backlight Mode Set Register [HOW&WHY] Reading the value from DP_EDP_BACKLIGHT_MODE_SET_REGISTER, DPCD 0x721 before setting the BP_EDP_PANEL_LUMINANC_CONTROL_ENABLE bit to ensure there are no accidental overwrites. Reviewed-by: Sreeja Golui Reviewed-by: Harry Vanzylldejong Acked-by: Roman Li Signed-off-by: Iswara Nagulendran Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher .../gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 1b9ec7cb424441de67d09c3abad46467f82ff161 Author: Michael Strauss Date: Tue Oct 10 10:47:55 2023 -0400 drm/amd/display: Disable SYMCLK32_SE RCO on DCN314 [WHY] Currently causes some DP link layer failures, backing out until the failures are root caused. Reviewed-by: Nicholas Kazlauskas Acked-by: Roman Li Signed-off-by: Michael Strauss Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 85ca6e85303c10019710f31d4abedafab7994d68 Author: Ilya Bakoulin Date: Fri Oct 6 15:57:28 2023 -0400 drm/amd/display: Fix shaper using bad LUT params [Why] LUT params are not cleared after setting blend TF, which can lead to same params being used for the shaper, if the shaper func is bypassed. [How] Set lut_params to NULL after program_1dlut. Reviewed-by: Krunoslav Kovac Acked-by: Roman Li Signed-off-by: Ilya Bakoulin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 1 + 1 file changed, 1 insertion(+) commit 8d0f4cd2ae44ebe50ff85a49fb248e64f28b6d66 Author: Samson Tam Date: Fri Oct 6 17:36:16 2023 -0400 drm/amd/display: add null check for invalid opps [Why] In cases where number of pipes available is less than num_opp, there will opp instances that are null [How] Add null check to skip over these opp instances Fixes: 40de8403b998 ("drm/amd/display: Update OPP counter from new interface") Reviewed-by: Alvin Lee Acked-by: Roman Li Signed-off-by: Samson Tam Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit f583db812bc9a97384303761932768e44d1d92a3 Author: Alvin Lee Date: Fri Oct 6 18:01:24 2023 -0400 drm/amd/display: Update FAMS sequence for DCN30 & DCN32 Provide DCN32 specific sequence and update DCN30 sequence Reviewed-by: Samson Tam Acked-by: Roman Li Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn32/dcn32_init.c | 2 +- .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 21 +++------------ .../drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 31 ++++++++++++++++++++++ .../drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.h | 3 +++ 4 files changed, 38 insertions(+), 19 deletions(-) commit 79f3f1b66753b3a3a269d73676bf50987921f267 Author: Samson Tam Date: Thu Oct 5 01:31:12 2023 -0400 drm/amd/display: fix num_ways overflow error [Why] Helper function calculates num_ways using 32-bit. But is returned as 8-bit. If num_ways exceeds 8-bit, then it reports back the incorrect num_ways and erroneously uses MALL when it should not [How] Make returned value 32-bit and convert after it checks against caps.cache_num_ways, which is under 8-bit Reviewed-by: Alvin Lee Acked-by: Roman Li Signed-off-by: Samson Tam Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit c4066d8be4d8c7c01d74ba1872cab2bc589d4912 Author: Rodrigo Siqueira Date: Thu Oct 5 10:41:33 2023 -0600 drm/amd/display: Add prefix for plane functions This commit adds the amdgpu_dm_plane_ prefix for all functions in the amdgpu_dm_plane.c. This change enables an easy way to filter code paths via ftrace. Reviewed-by: Aurabindo Pillai Acked-by: Roman Li Signed-off-by: Rodrigo Siqueira Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 542 +++++++++++---------- .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.h | 2 +- 3 files changed, 275 insertions(+), 271 deletions(-) commit 6ce4f9ee25ffc1f6be693a103c37d6d47edb0f0d Author: Rodrigo Siqueira Date: Thu Oct 5 08:27:45 2023 -0600 drm/amd/display: Add prefix to amdgpu crtc functions The ftrace debug feature allows filtering functions based on a prefix, which can be helpful in some complex debug scenarios. The driver can benefit more from this feature if the function name follows some patterns; for this reason, this commit adds the prefix amdgpu_dm_crtc_ to all the functions that do not have it in the amdgpu_dm_crtc.c file. Reviewed-by: Aurabindo Pillai Acked-by: Roman Li Signed-off-by: Rodrigo Siqueira Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 48 +++++++++++----------- 1 file changed, 24 insertions(+), 24 deletions(-) commit 0d93f39516b0608384317923f9feda6d1ae210fb Author: Rodrigo Siqueira Date: Thu Oct 5 10:58:51 2023 -0600 drm/amd/display: Correct enum typo This commit just replaces dc_interrupt_po*r*larity with its correct name, which is dc_interrupt_polarity. Reviewed-by: Aurabindo Pillai Acked-by: Roman Li Signed-off-by: Rodrigo Siqueira Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/irq_types.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit fc0479ac5dd9ac48673ade462622a4efbda30223 Author: Alex Hung Date: Tue Oct 3 15:25:30 2023 -0600 drm/amd/display: Set emulated sink type to HDMI accordingly. [WHY & HOW] Virtual sink is not audio-capable and this causes kms_hdmi_inject's inject-audio to fail. Set it to HDMI according to EDID. Reviewed-by: Chao-kai Wang Acked-by: Roman Li Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +++ 1 file changed, 3 insertions(+) commit 0604ffead6e5927d2e70698df6bcb1c68690ad0e Author: Alex Hung Date: Tue Oct 3 09:48:11 2023 -0600 drm/amd/display: Revert "drm/amd/display: allow edp updates for virtual signal" This reverts commit 4ad3ee5ccc77aa3f9d702f7b9ad4d9cfeca6c443. [WHY & HOW] Virtual signal is not supported as audio capable by DC. Reviewed-by: Chao-kai Wang Acked-by: Roman Li Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/include/signal_types.h | 1 - 1 file changed, 1 deletion(-) commit 2a6a491dfc0073b2bd28a69d1270c5bb8d3fc33a Author: Sung Joon Kim Date: Thu Oct 5 14:56:24 2023 -0400 drm/amd/display: Fix HDMI framepack 3D test issue [why] Bandwidth validation failure on framepack tests. Need to double pixel clock when 3D format is framepack. Also for HDMI displays, we need to keep the ITC flag to 1 by default. [how] Double the pixel clock when using framepack 3D format. Set hdmi ITC bit to 1. Reviewed-by: Charlene Liu Acked-by: Roman Li Signed-off-by: Sung Joon Kim Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +- drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) commit da2d16fcdda344b18ec9a4a55dff9805d5d781d2 Author: Nicholas Kazlauskas Date: Thu Oct 5 11:48:44 2023 -0400 drm/amd/display: Fix IPS handshake for idle optimizations [Why] Intermittent reboot hangs are observed introduced by "Improve x86 and dmub ips handshake". [How] Bring back the commit but fix the polling. Avoid hanging in place forever by bounding the delay and ensure that we still message DMCUB on IPS2 exit to notify driver idle has been cleared. Reviewed-by: Duncan Ma Reviewed-by: Jun Lei Acked-by: Roman Li Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 37 +++++++++++ .../drm/amd/display/dc/clk_mgr/dcn35/dcn35_smu.c | 14 ++++- .../drm/amd/display/dc/clk_mgr/dcn35/dcn35_smu.h | 4 +- drivers/gpu/drm/amd/display/dc/dc.h | 2 + drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 73 ++++++++++++++++++---- drivers/gpu/drm/amd/display/dc/dcn35/dcn35_init.c | 2 + .../gpu/drm/amd/display/dc/dcn35/dcn35_resource.c | 2 + .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 30 +++++---- .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h | 3 + drivers/gpu/drm/amd/display/dc/hwss/hw_sequencer.h | 1 - 10 files changed, 141 insertions(+), 27 deletions(-) commit 488bb99d42e607a40524ee1514b0b1246b1f69c8 Author: Wenjing Liu Date: Wed Oct 4 14:30:30 2023 -0400 drm/amd/display: implement map dc pipe with callback in DML2 [why] Unify pipe resource management logic in dc resource layer. V2: Add default case for switch. CC: Hamza Mahfooz Reviewed-by: Chaitanya Dhere Signed-off-by: Wenjing Liu Reviewed-by: Rodrigo Siqueira Reviewed-by: Jun Lei Acked-by: Roman Li Signed-off-by: Qingqing Zhuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher .../gpu/drm/amd/display/dc/dcn32/dcn32_resource.c | 1 + .../amd/display/dc/dml2/dml2_dc_resource_mgmt.c | 146 +++++++++++++++++++++ drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.h | 1 + 3 files changed, 148 insertions(+) commit 2c071cae6bb0f942136a530039faaa707c48893c Author: Wenjing Liu Date: Wed Oct 4 12:12:57 2023 -0400 drm/amd/display: add pipe resource management callbacks to DML2 [why] Need DML2 to support new pipe resource management APIs. Reviewed-by: Chaitanya Dhere Acked-by: Roman Li Signed-off-by: Wenjing Liu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c | 5 +++++ drivers/gpu/drm/amd/display/dc/dcn321/dcn321_resource.c | 5 +++++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_resource.c | 5 +++++ drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.h | 15 +++++++++++++++ 4 files changed, 30 insertions(+) commit 5edb7cdff85af8f8c5fda5b88310535ab823f663 Author: Swapnil Patel Date: Wed Oct 4 15:58:57 2023 -0400 drm/amd/display: Reduce default backlight min from 5 nits to 1 nits [Why & How] Currently set_default_brightness_aux function uses 5 nits as lower limit to check for valid default_backlight setting. However some newer panels can support even lower default settings Reviewed-by: Agustin Gutierrez Acked-by: Roman Li Signed-off-by: Swapnil Patel Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher .../gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a67f7a0b18c09d5b62eafb6d5c2f54e6f6ea6cf1 Author: George Shen Date: Mon Oct 2 15:31:16 2023 -0400 drm/amd/display: Update SDP VSC colorimetry from DP test automation request [Why] Certain test equipment vendors check the SDP VSC for colorimetry against the value from the test request during certain DP link layer tests for YCbCr test cases. [How] Update SDP VSC with colorimetry from test automation request. Reviewed-by: Wenjing Liu Acked-by: Roman Li Signed-off-by: George Shen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c | 6 ++++++ 1 file changed, 6 insertions(+) commit d591284288c29f04e52ae4f3d605e2f39c3e316c Author: Sung Joon Kim Date: Fri Sep 29 12:12:47 2023 -0400 drm/amd/display: Add a check for idle power optimization [why] Need a helper function to check idle power is allowed so that dc doesn't access any registers that are power-gated. [how] Implement helper function to check idle power optimization. Enable a hook to check if detection is allowed. V2: Add function hooks for set and get idle states. Check if function hook was properly initialized. Reviewed-by: Aric Cyr Reviewed-by: Nicholas Choi Acked-by: Roman Li Signed-off-by: Sung Joon Kim Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc.c | 23 ++++++++++++++++++++++ drivers/gpu/drm/amd/display/dc/dc.h | 1 + .../drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c | 4 +++- .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 8 ++------ drivers/gpu/drm/amd/display/dc/hwss/hw_sequencer.h | 2 ++ drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr.h | 2 ++ drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c | 1 + 7 files changed, 34 insertions(+), 7 deletions(-) commit d5f9a92bd1e234b8a7cf6f350b5bc0169221ae59 Author: Nicholas Kazlauskas Date: Tue Oct 3 12:18:44 2023 -0400 drm/amd/display: Revert "Improve x86 and dmub ips handshake" This reverts commit 1288d702080949f87688d49dfeeacc99f40adc9b. Causes intermittent hangs during reboot stress testing. Reviewed-by: Duncan Ma Acked-by: Roman Li Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 37 -------------- .../drm/amd/display/dc/clk_mgr/dcn35/dcn35_smu.c | 14 +----- .../drm/amd/display/dc/clk_mgr/dcn35/dcn35_smu.h | 4 +- drivers/gpu/drm/amd/display/dc/dc.h | 2 - drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 57 +++++----------------- drivers/gpu/drm/amd/display/dc/dcn35/dcn35_init.c | 2 - .../gpu/drm/amd/display/dc/dcn35/dcn35_resource.c | 2 - .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 30 +++++------- .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h | 3 -- drivers/gpu/drm/amd/display/dc/hwss/hw_sequencer.h | 3 +- drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr.h | 2 - 11 files changed, 27 insertions(+), 129 deletions(-) commit 543068f0e3721e1cbd6cee48c17f277950f59670 Author: Fangzhi Zuo Date: Mon Oct 2 16:38:02 2023 -0400 drm/amd/display: Fix MST Multi-Stream Not Lighting Up on dcn35 dcn35 misses .enable_symclk_se hook that makes MST DSC not functional when having multiple FE clk to be enabled. Reviewed-by: Rodrigo Siqueira Acked-by: Roman Li Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 5af8d8ce643478d754ef72fc239466f6ad0e2562 Author: Przemek Kitszel Date: Wed Oct 25 16:50:50 2023 +0200 net/mlx5: fix uninit value use Avoid use of uninitialized state variable. In case of mlx5e_tx_reporter_build_diagnose_output_sq_common() it's better to still collect other data than bail out entirely. Reported-by: Dan Carpenter Link: https://lore.kernel.org/netdev/8bd30131-c9f2-4075-a575-7fa2793a1760@moroto.mountain Fixes: d17f98bf7cc9 ("net/mlx5: devlink health: use retained error fmsg API") Signed-off-by: Przemek Kitszel Reviewed-by: Michal Swiatkowski Link: https://lore.kernel.org/r/20231025145050.36114-1-przemyslaw.kitszel@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c | 6 +++++- drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c | 8 ++++++-- 2 files changed, 11 insertions(+), 3 deletions(-) commit 2757a848cb0f184850d3e0a33b4a69e8014fdc5d Author: Mario Limonciello Date: Mon Oct 23 15:50:05 2023 -0500 drm/amd: Explicitly disable ASPM when dynamic switching disabled Currently there are separate but related checks: * amdgpu_device_should_use_aspm() * amdgpu_device_aspm_support_quirk() * amdgpu_device_pcie_dynamic_switching_supported() Simplify into checking whether DPM was enabled or not in the auto case. This works because amdgpu_device_pcie_dynamic_switching_supported() populates that value. Signed-off-by: Mario Limonciello Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 -- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 21 ++++++--------------- drivers/gpu/drm/amd/amdgpu/nv.c | 7 +++---- drivers/gpu/drm/amd/amdgpu/vi.c | 2 +- 4 files changed, 10 insertions(+), 22 deletions(-) commit 1a6513de493d13f8d7501611fcc5bbaea4c799b3 Author: Mario Limonciello Date: Mon Oct 23 15:47:43 2023 -0500 drm/amd: Move AMD_IS_APU check for ASPM into top level function There is no need for every ASIC driver to perform the same check. Move the duplicated code into amdgpu_device_should_use_aspm(). Signed-off-by: Mario Limonciello Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 ++ drivers/gpu/drm/amd/amdgpu/cik.c | 4 ---- drivers/gpu/drm/amd/amdgpu/nv.c | 3 +-- drivers/gpu/drm/amd/amdgpu/si.c | 2 -- drivers/gpu/drm/amd/amdgpu/soc15.c | 3 +-- drivers/gpu/drm/amd/amdgpu/soc21.c | 3 +-- drivers/gpu/drm/amd/amdgpu/vi.c | 3 +-- 7 files changed, 6 insertions(+), 14 deletions(-) commit fbf1035b033a51eee48d5f42e781b02fff272ca0 Author: Mario Limonciello Date: Mon Oct 23 15:42:00 2023 -0500 drm/amd: Disable PP_PCIE_DPM_MASK when dynamic speed switching not supported Rather than individual ASICs checking for the quirk, set the quirk at the driver level. Signed-off-by: Mario Limonciello Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 ++ drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 4 +--- drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) commit 541c341d2ee351f8deabef467dab4ba68bfb024f Author: Philip Yang Date: Mon Oct 23 16:08:34 2023 -0400 Revert "drm/amdkfd: Use partial migrations in GPU page faults" This reverts commit dc427a473e5d119232ddb27530920d9796cdea70. The change prevents migrating the entire range to VRAM because retry fault restore_pages map the remaining system memory range to GPUs. It will work correctly to submit together with partial mapping to GPU patch later. Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 150 +++++++++++++------------------ drivers/gpu/drm/amd/amdkfd/kfd_migrate.h | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 83 ++++------------- drivers/gpu/drm/amd/amdkfd/kfd_svm.h | 6 +- 4 files changed, 85 insertions(+), 160 deletions(-) commit afaec204d2912305d907abeac14c640f1cad2592 Author: Philip Yang Date: Mon Oct 23 16:05:24 2023 -0400 Revert "drm/amdkfd:remove unused code" This reverts commit f9caf6cdd5cc1f4006fd7b6b113658c0b0159f23. Needed for the next revert patch. Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 60 ++++++++++++++++++++++++++++++++++++ drivers/gpu/drm/amd/amdkfd/kfd_svm.h | 3 ++ 2 files changed, 63 insertions(+) commit 78964fcac47fc1525ecb4c37cd5fbc873c28320b Author: Stylon Wang Date: Thu Oct 19 22:49:15 2023 +0800 drm/amd/display: Fix copyright notice in DC code [Why & How] Fix incomplete copyright notice in DC code. Reviewed-by: Harry Wentland Signed-off-by: Stylon Wang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn303/dcn303_dccg.h | 18 ++++++++++++++++++ drivers/gpu/drm/amd/display/dc/dcn303/dcn303_init.c | 18 ++++++++++++++++++ drivers/gpu/drm/amd/display/dc/dcn303/dcn303_init.h | 18 ++++++++++++++++++ .../gpu/drm/amd/display/dc/dcn303/dcn303_resource.c | 18 ++++++++++++++++++ .../gpu/drm/amd/display/dc/dcn303/dcn303_resource.h | 18 ++++++++++++++++++ drivers/gpu/drm/amd/display/dc/dcn31/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dpp.c | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dpp.h | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dsc.c | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dsc.h | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dwb.h | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_hubbub.c | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_hubbub.h | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_hubp.c | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_hubp.h | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_init.c | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_init.h | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_mmhubbub.c | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_mmhubbub.h | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_opp.c | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_opp.h | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.c | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_optc.h | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_pg_cntl.c | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_pg_cntl.h | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_resource.c | 2 ++ drivers/gpu/drm/amd/display/dc/dcn35/dcn35_resource.h | 2 ++ drivers/gpu/drm/amd/display/dc/hdcp/Makefile | 2 +- .../gpu/drm/amd/display/dc/hwss/dcn303/dcn303_hwseq.c | 19 +++++++++++++++++++ .../gpu/drm/amd/display/dc/hwss/dcn303/dcn303_hwseq.h | 19 +++++++++++++++++++ .../gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 2 ++ .../gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h | 2 ++ .../amd/display/dc/irq/dcn201/irq_service_dcn201.c | 2 +- .../amd/display/dc/irq/dcn303/irq_service_dcn303.c | 19 +++++++++++++++++++ .../amd/display/dc/irq/dcn303/irq_service_dcn303.h | 19 +++++++++++++++++++ 35 files changed, 215 insertions(+), 3 deletions(-) commit d30a584cd70ebc5a8be3bd38ea1f184018bff151 Author: Stylon Wang Date: Thu Oct 19 22:46:51 2023 +0800 drm/amd/display: Fix copyright notice in DML2 code [Why & How] Fix incomplete copyright notice in DML2 code. Reviewed-by: Harry Wentland Signed-off-by: Stylon Wang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dml2/Makefile | 4 +++- drivers/gpu/drm/amd/display/dc/dml2/cmntypes.h | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/display_mode_core_structs.h | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/display_mode_lib_defines.h | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/display_mode_util.c | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/display_mode_util.h | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.h | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_types.h | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/dml2_internal_types.h | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/dml2_mall_phantom.c | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/dml2_mall_phantom.h | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/dml2_policy.c | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.h | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/dml2_utils.c | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.h | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/dml_assert.h | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/dml_depedencies.h | 2 ++ drivers/gpu/drm/amd/display/dc/dml2/dml_logging.h | 2 ++ 22 files changed, 45 insertions(+), 1 deletion(-) commit b258a4d5b383f0c087dd231dee2662126f3d0d83 Author: Stylon Wang Date: Thu Oct 19 22:43:05 2023 +0800 drm/amd/display: Add missing copyright notice in DMUB [Why & How] Add missing/incomplete copyright notice in DMUB files Reviewed-by: Harry Wentland Signed-off-by: Stylon Wang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dmub/src/dmub_dcn303.c | 19 +++++++++++++++++++ drivers/gpu/drm/amd/display/dmub/src/dmub_dcn303.h | 19 +++++++++++++++++++ 2 files changed, 38 insertions(+) commit 9ee819285c2c13fb9283c4cf8b1b9b69fbba986f Author: Lin.Cao Date: Wed Oct 18 10:15:06 2023 +0800 drm/amdgpu remove restriction of sriov max_pfn on Vega10 Remove restriction of sriov max_pfn so that TBA and TMA can move to high 47 bits address. Regression test: change range alloc flag of libdrm as AMDGPU_VA_RANGE_HIGH and there is no flr occur when testing amdgpu_test of drm. Signed-off-by: Lin.Cao Acked-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit 0300882ed6238bfd6343bbd06eb776eb65dedece Author: Srinivasan Shanmugam Date: Mon Oct 23 21:35:30 2023 +0530 drm/amdkfd: Address 'remap_list' not described in 'svm_range_add' Fixes the below: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_svm.c:2073: warning: Function parameter or member 'remap_list' not described in 'svm_range_add' Cc: Felix Kuehling Cc: Christian König Cc: Alex Deucher Cc: "Pan, Xinhui" Signed-off-by: Srinivasan Shanmugam Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 1 + 1 file changed, 1 insertion(+) commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad Author: Qu Huang Date: Mon Oct 23 12:56:37 2023 +0000 drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer access when the smc_rreg pointer is NULL. Below are the steps to reproduce this issue and the corresponding exception log: 1. Navigate to the directory: /sys/kernel/debug/dri/0 2. Execute command: cat amdgpu_regs_smc 3. Exception Log:: [4005007.702554] BUG: kernel NULL pointer dereference, address: 0000000000000000 [4005007.702562] #PF: supervisor instruction fetch in kernel mode [4005007.702567] #PF: error_code(0x0010) - not-present page [4005007.702570] PGD 0 P4D 0 [4005007.702576] Oops: 0010 [#1] SMP NOPTI [4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G OE 5.15.0-43-generic #46-Ubunt u [4005007.702590] RIP: 0010:0x0 [4005007.702598] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. [4005007.702600] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206 [4005007.702605] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68 [4005007.702609] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000 [4005007.702612] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980 [4005007.702615] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000 [4005007.702618] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000 [4005007.702622] FS: 00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000 [4005007.702626] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [4005007.702629] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0 [4005007.702633] Call Trace: [4005007.702636] [4005007.702640] amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu] [4005007.703002] full_proxy_read+0x5c/0x80 [4005007.703011] vfs_read+0x9f/0x1a0 [4005007.703019] ksys_read+0x67/0xe0 [4005007.703023] __x64_sys_read+0x19/0x20 [4005007.703028] do_syscall_64+0x5c/0xc0 [4005007.703034] ? do_user_addr_fault+0x1e3/0x670 [4005007.703040] ? exit_to_user_mode_prepare+0x37/0xb0 [4005007.703047] ? irqentry_exit_to_user_mode+0x9/0x20 [4005007.703052] ? irqentry_exit+0x19/0x30 [4005007.703057] ? exc_page_fault+0x89/0x160 [4005007.703062] ? asm_exc_page_fault+0x8/0x30 [4005007.703068] entry_SYSCALL_64_after_hwframe+0x44/0xae [4005007.703075] RIP: 0033:0x7f5e07672992 [4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e c 28 48 89 54 24 [4005007.703083] RSP: 002b:00007ffe03097898 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [4005007.703088] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5e07672992 [4005007.703091] RDX: 0000000000020000 RSI: 00007f5e06753000 RDI: 0000000000000003 [4005007.703094] RBP: 00007f5e06753000 R08: 00007f5e06752010 R09: 00007f5e06752010 [4005007.703096] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000022000 [4005007.703099] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 [4005007.703105] [4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash af_alg binfmt_misc nls_ iso8859_1 ipmi_ssif ast intel_rapl_msr intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t tm edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl sch_fq_codel ipmi_devintf ipm i_msghandler msr parport_pc ppdev lp parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo mon ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) amdttm(OE) iommu_v 2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec rc_core drm igb ahci xhci_pci libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca [4005007.703184] CR2: 0000000000000000 [4005007.703188] ---[ end trace ac65a538d240da39 ]--- [4005007.800865] RIP: 0010:0x0 [4005007.800871] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. [4005007.800874] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206 [4005007.800878] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68 [4005007.800881] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000 [4005007.800883] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980 [4005007.800886] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000 [4005007.800888] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000 [4005007.800891] FS: 00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000 [4005007.800895] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [4005007.800898] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0 Signed-off-by: Qu Huang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 73582be11ac8f6d6765e185bf48f22efb9d28c3b Author: Tao Zhou Date: Thu Oct 12 14:33:37 2023 +0800 drm/amdgpu: bypass RAS error reset in some conditions PMFW is responsible for RAS error reset in some conditions, driver can skip the operation. v2: add check for ras->in_recovery, it's set earlier than amdgpu_in_reset. v3: fix error in gpu reset check. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit f3a3bbf1566c7b6b0f9ac36e8e597c73dc0afdf8 Author: Tao Zhou Date: Fri Oct 20 17:21:58 2023 +0800 drm/amdgpu: enable RAS poison mode for APU Enable it by default on APU platform. Signed-off-by: Tao Zhou Reviewed-by: Stanley.Yang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit fc4981b69c59b8c8ddedf0df47520cb592894c03 Author: Lang Yu Date: Mon Oct 23 17:04:19 2023 +0800 drm/amdgpu/vpe: correct queue stop programing Otherwise IB test would fail during GPU reset. Signed-off-by: Lang Yu Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/vpe_v6_1.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) commit 210aa6650c10ee4aae60e7533303b7b28947c684 Author: Rodrigo Siqueira Date: Fri Oct 20 10:06:50 2023 -0600 drm/amd/display: Fix DMUB errors introduced by DML2 When DML 2 was introduced, it changed part of the generic sequence of DC, which caused issues on previous DCNs with DMUB support. This commit ensures the new sequence only works for new DCNs from 3.5 and above. Changes since V1: - Harry: Use the attribute using_dml2 instead of check the DCN version. Cc: Vitaly Prosyak Cc: Roman Li Cc: Qingqing Zhuo Cc: Daniel Wheeler Cc: Alex Deucher Tested-by: Daniel Wheeler Reviewed-by: Harry Wentland Fixes: 7966f319c66d ("drm/amd/display: Introduce DML2") Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit e5f52a84bf0a817016ecd13e320fe3c3c807a83c Author: Mario Limonciello Date: Fri Oct 20 10:26:29 2023 -0500 drm/amd: Disable ASPM for VI w/ all Intel systems Originally we were quirking ASPM disabled specifically for VI when used with Alder Lake, but it appears to have problems with Rocket Lake as well. Like we've done in the case of dpm for newer platforms, disable ASPM for all Intel systems. Cc: stable@vger.kernel.org # 5.15+ Fixes: 0064b0ce85bb ("drm/amd/pm: enable ASPM by default") Reported-and-tested-by: Paolo Gentili Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742 Signed-off-by: Mario Limonciello Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/vi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b0399e22ada096435de3e3e73899aa8bc026820d Author: Agustin Gutierrez Date: Mon Oct 2 10:21:08 2023 -0400 drm/amd/display: Remove power sequencing check [Why] Some ASICs keep backlight powered on after dpms off command has been issued. [How] The check for no edp power sequencing was never going to pass. The value is never changed from what it is set by design. Cc: stable@vger.kernel.org # 6.1+ Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2765 Reviewed-by: Swapnil Patel Acked-by: Roman Li Signed-off-by: Agustin Gutierrez Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 79de4d9ade7411ffdddf0b69c87020311731d155 Author: Rodrigo Siqueira Date: Fri Oct 20 15:17:09 2023 -0600 drm/amd/display: Set the DML2 attribute to false in all DCNs older than version 3.5 When DML2 was introduced, it targeted only new DCN versions. For controlling which ASIC should use this new version of DML, it was introduced the using_dml2 attribute. To avoid ambiguities, this commit explicitly sets using_dml2 to false in all ASICs that do not support DML2. Cc: Vitaly Prosyak Cc: Roman Li Cc: Qingqing Zhuo Cc: Daniel Wheeler Cc: Alex Deucher Reviewed-by: Harry Wentland Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c | 1 + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 1 + drivers/gpu/drm/amd/display/dc/dcn201/dcn201_resource.c | 1 + drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 1 + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c | 1 + drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c | 3 ++- drivers/gpu/drm/amd/display/dc/dcn302/dcn302_resource.c | 1 + drivers/gpu/drm/amd/display/dc/dcn303/dcn303_resource.c | 1 + drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 1 + drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c | 3 ++- drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c | 1 + drivers/gpu/drm/amd/display/dc/dcn316/dcn316_resource.c | 1 + drivers/gpu/drm/amd/display/dc/dcn321/dcn321_resource.c | 1 + 13 files changed, 15 insertions(+), 2 deletions(-) commit d8da213478bcd0b2dde7a4591a0a6924a97592c7 Author: Ma Jun Date: Wed Oct 18 15:17:40 2023 +0800 drm/amd/pm: Fix the return value in default case Fix the return value in default case and drop redundant 'break'. Signed-off-by: Ma Jun Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 8eece69acee335580449ced3356f150610916fba Author: Lijo Lazar Date: Thu Oct 12 15:07:41 2023 +0530 drm/amdgpu: Add API to get full IP version Fetch the full version of IP including variant and subrevision. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Reviewed-by: Le Ma Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu.h | 7 +++++++ 1 file changed, 7 insertions(+) commit 037fb9c600240fd4e7e525c7e08e42645a44b2f7 Author: Jiadong Zhu Date: Wed Sep 6 08:58:02 2023 +0800 drm/amdgpu: add tmz support for GC IP v11.5.0 Add tmz support for GC 11.5.0. Signed-off-by: Jiadong Zhu Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 1 + 1 file changed, 1 insertion(+) commit af0b7df70b4738f89061a8084015f7f93078bb71 Author: Jiadong Zhu Date: Wed Aug 30 16:36:37 2023 +0800 drm/amd/pm: drop unneeded dpm features disablement for SMU 14.0.0 PMFW will handle the features disablement properly for gpu reset case, driver involvement may cause some unexpected issues. Signed-off-by: Jiadong Zhu Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 493c75bbe3a89b5b178e61ef80f185a9614cbfaf Author: Li Ma Date: Wed Oct 18 13:34:29 2023 +0800 drm/amdgpu: modify if condition in nbio_v7_7.c remove unnecessary "enable" in if condition. Signed-off-by: Li Ma Reviewed-by: Tim Huang Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/nbio_v7_7.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 282c1d793076c2edac6c3db51b7e8ed2b41d60a5 Author: Jesse Zhang Date: Fri Oct 20 09:43:51 2023 +0800 drm/amdkfd: Fix shift out-of-bounds issue [ 567.613292] shift exponent 255 is too large for 64-bit type 'long unsigned int' [ 567.614498] CPU: 5 PID: 238 Comm: kworker/5:1 Tainted: G OE 6.2.0-34-generic #34~22.04.1-Ubuntu [ 567.614502] Hardware name: AMD Splinter/Splinter-RPL, BIOS WS43927N_871 09/25/2023 [ 567.614504] Workqueue: events send_exception_work_handler [amdgpu] [ 567.614748] Call Trace: [ 567.614750] [ 567.614753] dump_stack_lvl+0x48/0x70 [ 567.614761] dump_stack+0x10/0x20 [ 567.614763] __ubsan_handle_shift_out_of_bounds+0x156/0x310 [ 567.614769] ? srso_alias_return_thunk+0x5/0x7f [ 567.614773] ? update_sd_lb_stats.constprop.0+0xf2/0x3c0 [ 567.614780] svm_range_split_by_granularity.cold+0x2b/0x34 [amdgpu] [ 567.615047] ? srso_alias_return_thunk+0x5/0x7f [ 567.615052] svm_migrate_to_ram+0x185/0x4d0 [amdgpu] [ 567.615286] do_swap_page+0x7b6/0xa30 [ 567.615291] ? srso_alias_return_thunk+0x5/0x7f [ 567.615294] ? __free_pages+0x119/0x130 [ 567.615299] handle_pte_fault+0x227/0x280 [ 567.615303] __handle_mm_fault+0x3c0/0x720 [ 567.615311] handle_mm_fault+0x119/0x330 [ 567.615314] ? lock_mm_and_find_vma+0x44/0x250 [ 567.615318] do_user_addr_fault+0x1a9/0x640 [ 567.615323] exc_page_fault+0x81/0x1b0 [ 567.615328] asm_exc_page_fault+0x27/0x30 [ 567.615332] RIP: 0010:__get_user_8+0x1c/0x30 Signed-off-by: Jesse Zhang Suggested-by: Philip Yang Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ec3e0a9167e2cc97a9b12d9f2a619afd78b77223 Author: Yang Wang Date: Thu Oct 19 18:16:14 2023 +0800 drm/amdgpu: refine ras error kernel log print refine ras error kernel log to avoid user-ridden ambiguity. Signed-off-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 116 ++++++++++++++++++++++---------- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h | 5 +- 2 files changed, 82 insertions(+), 39 deletions(-) commit 53d4d7792757d195979a630a6402f272d3fd2a47 Author: Yang Wang Date: Fri Oct 20 10:12:07 2023 +0800 drm/amdgpu: fix find ras error node error the origin function might return the wrong node. Fixes: 5b1270beb380 ("drm/amdgpu: add ras_err_info to identify RAS error source") Signed-off-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit bf795156105150a7a242389c56fca382ddc984c5 Author: Hugo Hu Date: Tue Aug 22 17:01:39 2023 +0800 drm/amd/display: reprogram det size while seamless boot [Why] During system boot in second screen only mode on a seamless boot system, there is a chance that the pipe's det size might not be reset. [How] Reset the det size while resetting the pipe during seamless boot. Reviewed-by: Dmytro Laktyushkin Acked-by: Roman Li Signed-off-by: Hugo Hu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher .../gpu/drm/amd/display/dc/dcn31/dcn31_hubbub.c | 23 ++++++++++++++++++++++ .../drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c | 9 +++++++++ drivers/gpu/drm/amd/display/dc/inc/hw/dchubbub.h | 1 + 3 files changed, 33 insertions(+) commit 4dd9f5404c7180f573b911f034df1a144abb78be Author: Tao Zhou Date: Thu Oct 12 11:24:10 2023 +0800 drm/amd/pm: record mca debug mode in RAS Call amdgpu_ras_set_mca_debug_mode when we set mca debug mode in smu v13_0_6. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 1 + 1 file changed, 1 insertion(+) commit 5258dfd4a6adb5f45f046b0dd2e73c680f880d9d Author: Dave Airlie Date: Fri Oct 27 07:53:50 2023 +1000 usb: typec: altmodes/displayport: fixup drm internal api change vs new user. usb: typec: altmodes/displayport: Signal hpd low when exiting mode and drm: Add HPD state to drm_connector_oob_hotplug_event() sideswiped each other. Signal disconnected always. Signed-off-by: Dave Airlie drivers/usb/typec/altmodes/displayport.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit ec4c20ca09831ddba8fac10a7d82a9902e96e717 Merge: ef113733c288 c17cda15cc86 Author: Jakub Kicinski Date: Thu Oct 26 13:42:19 2023 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR. Conflicts: net/mac80211/rx.c 91535613b609 ("wifi: mac80211: don't drop all unprotected public action frames") 6c02fab72429 ("wifi: mac80211: split ieee80211_drop_unencrypted_mgmt() return value") Adjacent changes: drivers/net/ethernet/apm/xgene/xgene_enet_main.c 61471264c018 ("net: ethernet: apm: Convert to platform remove callback returning void") d2ca43f30611 ("net: xgene: Fix unused xgene_enet_of_match warning for !CONFIG_OF") net/vmw_vsock/virtio_transport.c 64c99d2d6ada ("vsock/virtio: support to send non-linear skb") 53b08c498515 ("vsock/virtio: initialize the_virtio_vsock before using VQs") Signed-off-by: Jakub Kicinski commit b827ac419721a106ae2fccaa40576b0594edad92 Author: Kent Overstreet Date: Thu Oct 26 16:37:58 2023 -0400 exportfs: Change bcachefs fid_type enum to avoid conflicts Per Amir Goldstein, the fid types that bcachefs picked conflicted with xfs and fuse, which previously were in use but not deviced in the master enum. Since bcachefs is still out of tree, we can move. https://lore.kernel.org/linux-next/20231026203733.fx65mjyic4pka3e5@moria.home.lan/T/#ma59f65ba61f605b593e69f4690dbd317526d83ba Signed-off-by: Kent Overstreet include/linux/exportfs.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit b70438004a14f4d0f9890b3297cd66248728546c Author: Alex Deucher Date: Wed Oct 25 13:19:28 2023 -0400 drm/amdgpu: move buffer funcs setting up a level Rather than doing this in the IP code for the SDMA paging engine, move it up to the core device level init level. This should fix the scheduler init ordering. v2: drop extra parens v3: drop SDMA helpers v4: Added a Fixes tag because amdgpu dereferences an uninitialized scheduler without this patch, and this patch fixes this. (Luben) Tested-by: Luben Tuikov Signed-off-by: Alex Deucher Link: https://lore.kernel.org/r/20231025171928.3318505-1-alexander.deucher@amd.com Acked-by: Christian König Fixes: 56e449603f0ac5 ("drm/sched: Convert the GPU scheduler to variable number of run-queues") Signed-off-by: Luben Tuikov drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 15 +++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c | 21 --------------------- drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.h | 1 - drivers/gpu/drm/amd/amdgpu/cik_sdma.c | 5 ----- drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c | 5 ----- drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c | 5 ----- drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 16 +--------------- drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 10 +--------- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 10 +--------- drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 10 +--------- drivers/gpu/drm/amd/amdgpu/si_dma.c | 5 ----- 11 files changed, 19 insertions(+), 84 deletions(-) commit c07bf1636f0005f9eb7956404490672286ea59d3 Author: Luben Tuikov Date: Thu Oct 26 12:37:30 2023 -0400 MAINTAINERS: Update the GPU Scheduler email Update the GPU Scheduler maintainer email. Cc: Alex Deucher Cc: Christian König Cc: Daniel Vetter Cc: Dave Airlie Cc: AMD Graphics Cc: Direct Rendering Infrastructure - Development Signed-off-by: Luben Tuikov Acked-by: Alex Deucher Link: https://lore.kernel.org/r/20231026174438.18427-2-ltuikov89@gmail.com MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 101c9f637efa1655f55876644d4439e552267527 Author: Erik Kurzinger Date: Wed Aug 16 09:26:05 2023 -0700 drm/syncobj: fix DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE If DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT is invoked with the DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE flag set but no fence has yet been submitted for the given timeline point the call will fail immediately with EINVAL. This does not match the intended behavior where the call should wait until the fence has been submitted (or the timeout expires). The following small example program illustrates the issue. It should wait for 5 seconds and then print ETIME, but instead it terminates right away after printing EINVAL. #include #include #include #include #include int main(void) { int fd = open("/dev/dri/card0", O_RDWR); uint32_t syncobj; drmSyncobjCreate(fd, 0, &syncobj); struct timespec ts; clock_gettime(CLOCK_MONOTONIC, &ts); uint64_t point = 1; if (drmSyncobjTimelineWait(fd, &syncobj, &point, 1, ts.tv_sec * 1000000000 + ts.tv_nsec + 5000000000, // 5s DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE, NULL)) { printf("drmSyncobjTimelineWait failed %d\n", errno); } } Fixes: 01d6c3578379 ("drm/syncobj: add support for timeline point wait v8") Signed-off-by: Erik Kurzinger Reviewed by: Simon Ser Signed-off-by: Simon Ser Link: https://patchwork.freedesktop.org/patch/msgid/1fac96f1-2f3f-f9f9-4eb0-340f27a8f6c0@nvidia.com drivers/gpu/drm/drm_syncobj.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 51442e8d64bcb7ac92d0cde5dccda0cfa94630fa Author: Konstantin Meskhidze Date: Thu Oct 26 09:47:51 2023 +0800 landlock: Document network support Describe network access rules for TCP sockets. Add network access example in the tutorial. Add kernel configuration support for network. Signed-off-by: Konstantin Meskhidze Link: https://lore.kernel.org/r/20231026014751.414649-13-konstantin.meskhidze@huawei.com [mic: Update date, and do light cosmetic changes] Signed-off-by: Mickaël Salaün Documentation/userspace-api/landlock.rst | 93 ++++++++++++++++++++++++-------- 1 file changed, 71 insertions(+), 22 deletions(-) commit 5e990dcef12eebf683d209bac5e14591308dc216 Author: Konstantin Meskhidze Date: Thu Oct 26 09:47:50 2023 +0800 samples/landlock: Support TCP restrictions Add TCP restrictions to the sandboxer demo. It's possible to allow a sandboxer to bind/connect to a list of specified ports restricting network actions to the rest of them. This is controlled with the new LL_TCP_BIND and LL_TCP_CONNECT environment variables. Rename ENV_PATH_TOKEN to ENV_DELIMITER. Signed-off-by: Konstantin Meskhidze Link: https://lore.kernel.org/r/20231026014751.414649-12-konstantin.meskhidze@huawei.com [mic: Extend commit message] Signed-off-by: Mickaël Salaün samples/landlock/sandboxer.c | 115 +++++++++++++++++++++++++++++++++++++------ 1 file changed, 100 insertions(+), 15 deletions(-) commit a549d055a22e4fc5559ef642b30721899fa07b75 Author: Konstantin Meskhidze Date: Thu Oct 26 09:47:49 2023 +0800 selftests/landlock: Add network tests Add 82 test suites to check edge cases related to bind() and connect() actions. They are defined with 6 fixtures and their variants: The "protocol" fixture is extended with 12 variants defined as a matrix of: sandboxed/not-sandboxed, IPv4/IPv6/unix network domain, and stream/datagram socket. 4 related tests suites are defined: * bind: Tests bind action. * connect: Tests connect action. * bind_unspec: Tests bind action with the AF_UNSPEC socket family. * connect_unspec: Tests connect action with the AF_UNSPEC socket family. The "ipv4" fixture is extended with 4 variants defined as a matrix of: sandboxed/not-sandboxed, and stream/datagram socket. 1 related test suite is defined: * from_unix_to_inet: Tests to make sure unix sockets' actions are not restricted by Landlock rules applied to TCP ones. The "tcp_layers" fixture is extended with 8 variants defined as a matrix of: IPv4/IPv6 network domain, and different number of landlock rule layers. 2 related tests suites are defined: * ruleset_overlap: Tests nested layers with less constraints. * ruleset_expand: Tests nested layers with more constraints. In the "mini" fixture 4 tests suites are defined: * network_access_rights: Tests handling of known access rights. * unknown_access_rights: Tests handling of unknown access rights. * inval: Tests unhandled allowed access and zero access value. * tcp_port_overflow: Tests with port values greater than 65535. The "ipv4_tcp" fixture supports IPv4 network domain with stream socket. 2 tests suites are defined: * port_endianness: Tests with big/little endian port formats. * with_fs: Tests a ruleset with both filesystem and network restrictions. The "port_specific" fixture is extended with 4 variants defined as a matrix of: sandboxed/not-sandboxed, IPv4/IPv6 network domain, and stream socket. 2 related tests suites are defined: * bind_connect_zero: Tests with port 0. * bind_connect_1023: Tests with port 1023. Test coverage for security/landlock is 92.4% of 710 lines according to gcc/gcov-13. Signed-off-by: Konstantin Meskhidze Link: https://lore.kernel.org/r/20231026014751.414649-11-konstantin.meskhidze@huawei.com [mic: Extend commit message, update test coverage, clean up capability use, fix useless TEST_F_FORK, and improve ipv4_tcp.with_fs] Co-developed-by: Mickaël Salaün Signed-off-by: Mickaël Salaün tools/testing/selftests/landlock/common.h | 3 + tools/testing/selftests/landlock/config | 4 + tools/testing/selftests/landlock/net_test.c | 1738 +++++++++++++++++++++++++++ 3 files changed, 1745 insertions(+) commit 1fa335209f6ad9d554655bb802c5b49b855d6237 Author: Konstantin Meskhidze Date: Thu Oct 26 09:47:48 2023 +0800 selftests/landlock: Share enforce_ruleset() helper Move enforce_ruleset() helper function to common.h so that it can be used both by filesystem tests and network ones. Signed-off-by: Konstantin Meskhidze Link: https://lore.kernel.org/r/20231026014751.414649-10-konstantin.meskhidze@huawei.com Signed-off-by: Mickaël Salaün tools/testing/selftests/landlock/common.h | 10 ++++++++++ tools/testing/selftests/landlock/fs_test.c | 10 ---------- 2 files changed, 10 insertions(+), 10 deletions(-) commit fff69fb03dde1dfa348cfdb74b13287dabe42c25 Author: Konstantin Meskhidze Date: Thu Oct 26 09:47:47 2023 +0800 landlock: Support network rules with TCP bind and connect Add network rules support in the ruleset management helpers and the landlock_create_ruleset() syscall. Extend user space API to support network actions: * Add new network access rights: LANDLOCK_ACCESS_NET_BIND_TCP and LANDLOCK_ACCESS_NET_CONNECT_TCP. * Add a new network rule type: LANDLOCK_RULE_NET_PORT tied to struct landlock_net_port_attr. The allowed_access field contains the network access rights, and the port field contains the port value according to the controlled protocol. This field can take up to a 64-bit value but the maximum value depends on the related protocol (e.g. 16-bit value for TCP). Network port is in host endianness [1]. * Add a new handled_access_net field to struct landlock_ruleset_attr that contains network access rights. * Increment the Landlock ABI version to 4. Implement socket_bind() and socket_connect() LSM hooks, which enable to control TCP socket binding and connection to specific ports. Expand access_masks_t from u16 to u32 to be able to store network access rights alongside filesystem access rights for rulesets' handled access rights. Access rights are not tied to socket file descriptors but checked at bind() or connect() call time against the caller's Landlock domain. For the filesystem, a file descriptor is a direct access to a file/data. However, for network sockets, we cannot identify for which data or peer a newly created socket will give access to. Indeed, we need to wait for a connect or bind request to identify the use case for this socket. Likewise a directory file descriptor may enable to open another file (i.e. a new data item), but this opening is also restricted by the caller's domain, not the file descriptor's access rights [2]. [1] https://lore.kernel.org/r/278ab07f-7583-a4e0-3d37-1bacd091531d@digikod.net [2] https://lore.kernel.org/r/263c1eb3-602f-57fe-8450-3f138581bee7@digikod.net Signed-off-by: Konstantin Meskhidze Link: https://lore.kernel.org/r/20231026014751.414649-9-konstantin.meskhidze@huawei.com [mic: Extend commit message, fix typo in comments, and specify endianness in the documentation] Co-developed-by: Mickaël Salaün Signed-off-by: Mickaël Salaün include/uapi/linux/landlock.h | 55 ++++++++ security/landlock/Kconfig | 1 + security/landlock/Makefile | 2 + security/landlock/limits.h | 5 + security/landlock/net.c | 200 +++++++++++++++++++++++++++ security/landlock/net.h | 33 +++++ security/landlock/ruleset.c | 61 +++++++- security/landlock/ruleset.h | 62 +++++++-- security/landlock/setup.c | 2 + security/landlock/syscalls.c | 72 ++++++++-- tools/testing/selftests/landlock/base_test.c | 2 +- 11 files changed, 470 insertions(+), 25 deletions(-) commit 0e0fc7e8eb4a11bd9f89a9c74bc7c0e144c56203 Author: Konstantin Meskhidze Date: Thu Oct 26 09:47:46 2023 +0800 landlock: Refactor landlock_add_rule() syscall Change the landlock_add_rule() syscall to support new rule types with next commits. Add the add_rule_path_beneath() helper to support current filesystem rules. Signed-off-by: Konstantin Meskhidze Link: https://lore.kernel.org/r/20231026014751.414649-8-konstantin.meskhidze@huawei.com Signed-off-by: Mickaël Salaün security/landlock/syscalls.c | 89 ++++++++++++++++++++++---------------------- 1 file changed, 45 insertions(+), 44 deletions(-) commit 7a11275c378753fbdf00f2cfc80bc86a119ca67d Author: Konstantin Meskhidze Date: Thu Oct 26 09:47:45 2023 +0800 landlock: Refactor layer helpers Add a new key_type argument to the landlock_init_layer_masks() helper. Add a masks_array_size argument to the landlock_unmask_layers() helper. These modifications support implementing new rule types in the next Landlock versions. Signed-off-by: Konstantin Meskhidze Link: https://lore.kernel.org/r/20231026014751.414649-7-konstantin.meskhidze@huawei.com Signed-off-by: Mickaël Salaün security/landlock/fs.c | 43 ++++++++++++++++++++++------------------ security/landlock/ruleset.c | 48 +++++++++++++++++++++++++++++++-------------- security/landlock/ruleset.h | 17 ++++++++-------- 3 files changed, 66 insertions(+), 42 deletions(-) commit 0e7410112964168a65578002269ae3b80b207936 Author: Konstantin Meskhidze Date: Thu Oct 26 09:47:44 2023 +0800 landlock: Move and rename layer helpers Move and rename landlock_unmask_layers() and landlock_init_layer_masks() helpers to ruleset.c to share them with Landlock network implementation in following commits. Signed-off-by: Konstantin Meskhidze Link: https://lore.kernel.org/r/20231026014751.414649-6-konstantin.meskhidze@huawei.com Signed-off-by: Mickaël Salaün security/landlock/fs.c | 136 +++++++------------------------------------- security/landlock/ruleset.c | 98 +++++++++++++++++++++++++++++++ security/landlock/ruleset.h | 10 ++++ 3 files changed, 129 insertions(+), 115 deletions(-) commit 6146b6141770206792d0e1155794cc48697c7985 Author: Konstantin Meskhidze Date: Thu Oct 26 09:47:43 2023 +0800 landlock: Refactor merge/inherit_ruleset helpers Refactor merge_ruleset() and inherit_ruleset() functions to support new rule types. Add merge_tree() and inherit_tree() helpers. They use a specific ruleset's red-black tree according to a key type argument. Signed-off-by: Konstantin Meskhidze Link: https://lore.kernel.org/r/20231026014751.414649-5-konstantin.meskhidze@huawei.com Signed-off-by: Mickaël Salaün security/landlock/ruleset.c | 116 ++++++++++++++++++++++++++++---------------- 1 file changed, 74 insertions(+), 42 deletions(-) commit a4ac404b3032562ed6a34232b5266d0f446dd799 Author: Konstantin Meskhidze Date: Thu Oct 26 09:47:42 2023 +0800 landlock: Refactor landlock_find_rule/insert_rule helpers Add a new landlock_key union and landlock_id structure to support a socket port rule type. A struct landlock_id identifies a unique entry in a ruleset: either a kernel object (e.g. inode) or typed data (e.g. TCP port). There is one red-black tree per key type. Add is_object_pointer() and get_root() helpers. is_object_pointer() returns true if key type is LANDLOCK_KEY_INODE. get_root() helper returns a red-black tree root pointer according to a key type. Refactor landlock_insert_rule() and landlock_find_rule() to support coming network modifications. Adding or searching a rule in ruleset can now be done thanks to a Landlock ID argument passed to these helpers. Signed-off-by: Konstantin Meskhidze Link: https://lore.kernel.org/r/20231026014751.414649-4-konstantin.meskhidze@huawei.com [mic: Fix commit message typo] Co-developed-by: Mickaël Salaün Signed-off-by: Mickaël Salaün security/landlock/fs.c | 21 ++++--- security/landlock/ruleset.c | 133 ++++++++++++++++++++++++++++++++------------ security/landlock/ruleset.h | 65 ++++++++++++++++++---- 3 files changed, 165 insertions(+), 54 deletions(-) commit d7220364039f6beb76f311c05f74cad89da5fad5 Author: Mickaël Salaün Date: Thu Oct 26 09:47:41 2023 +0800 landlock: Allow FS topology changes for domains without such rule type Allow mount point and root directory changes when there is no filesystem rule tied to the current Landlock domain. This doesn't change anything for now because a domain must have at least a (filesystem) rule, but this will change when other rule types will come. For instance, a domain only restricting the network should have no impact on filesystem restrictions. Add a new get_current_fs_domain() helper to quickly check filesystem rule existence for all filesystem LSM hooks. Remove unnecessary inlining. Link: https://lore.kernel.org/r/20231026014751.414649-3-konstantin.meskhidze@huawei.com Signed-off-by: Mickaël Salaün Documentation/userspace-api/landlock.rst | 6 +-- security/landlock/fs.c | 74 ++++++++++++++++---------------- security/landlock/ruleset.h | 24 ++++++++++- security/landlock/syscalls.c | 2 +- 4 files changed, 63 insertions(+), 43 deletions(-) commit 13fc6455fa19b0859e1b9640bf09903bec8df4f4 Author: Konstantin Meskhidze Date: Thu Oct 26 09:47:40 2023 +0800 landlock: Make ruleset's access masks more generic Rename ruleset's access masks and modify it's type to access_masks_t to support network type rules in following commits. Add filesystem helper functions to add and get filesystem mask. Signed-off-by: Konstantin Meskhidze Link: https://lore.kernel.org/r/20231026014751.414649-2-konstantin.meskhidze@huawei.com Signed-off-by: Mickaël Salaün security/landlock/fs.c | 10 +++++----- security/landlock/limits.h | 1 + security/landlock/ruleset.c | 17 +++++++++-------- security/landlock/ruleset.h | 35 +++++++++++++++++++++++++++++++---- security/landlock/syscalls.c | 7 ++++--- 5 files changed, 50 insertions(+), 20 deletions(-) commit 0b783d2e82d827af73c779e8e8f95d07e992b451 Author: James Clark Date: Mon Oct 23 14:15:49 2023 +0100 perf tests: test_arm_coresight: Simplify source iteration There are two reasons to do this, firstly there is a shellcheck warning in cs_etm_dev_name(), which can be completely deleted. And secondly the current iteration method doesn't support systems with both ETE and ETM because it picks one or the other. There isn't a known system with this configuration, but it could happen in the future. Iterating over all the sources for each CPU can be done by going through /sys/bus/event_source/devices/cs_etm/cpu* and following the symlink back to the Coresight device in /sys/bus/coresight/devices. This will work whether the device is ETE, ETM or any future name, and is much simpler and doesn't require any hard coded version numbers Suggested-by: Suzuki K Poulose Signed-off-by: James Clark Acked-by: Ian Rogers Tested-by: Leo Yan Cc: tianruidong@linux.alibaba.com Cc: Kajol Jain Cc: Anushree Mathur Cc: Tiezhu Yang Cc: atrajeev@linux.vnet.ibm.com Cc: coresight@lists.linaro.org Link: https://lore.kernel.org/r/20231023131550.487760-1-james.clark@arm.com Signed-off-by: Namhyung Kim tools/perf/tests/shell/test_arm_coresight.sh | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) commit e7abea958b7f0d65baafb20af60bdf2073fb2b28 Author: Vegard Nossum Date: Mon Oct 23 15:57:22 2023 +0200 docs: backporting: address feedback This addresses a few comments/issues in my v2 submission: - repeated word: 'run' from kernel test robot - emacs/ediff mode from Jon Corbet - various comments from Willy Tarreau - more backporting advice from Ben Hutchings - a couple more cherry-pick tips from Harshit Mogalapalli - add a bit about stable submissions Signed-off-by: Vegard Nossum Link: https://lore.kernel.org/r/20231023135722.949510-1-vegard.nossum@oracle.com Signed-off-by: Jonathan Corbet Documentation/process/backporting.rst | 152 +++++++++++++++++++++++++++------- 1 file changed, 121 insertions(+), 31 deletions(-) commit fae6389f912eb0b6aea1366814b5501077b5dbac Author: Vishal Verma Date: Thu Oct 26 11:43:20 2023 -0600 MAINTAINERS: Add tools/testing/cxl files to CXL tools/testing/cxl contains the unit test infrastructure for mocking CXL hierarchies. These are under the purview of the CXL subsystem maintainers. Add the 'F:' entry for this to MAINTAINERS so that get_maintainer.pl works as expected for patches to this area. Signed-off-by: Vishal Verma Link: https://lore.kernel.org/r/20231026-vv-mainteners-fix-v1-1-0a0f25634073@intel.com Signed-off-by: Dan Williams MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit 55ed837d7cf11a9c506f83da79d39f9ada597740 Author: Pandith N Date: Mon Oct 16 15:49:53 2023 +0530 Documentation: driver-api: pps: Update PPS generator documentation PPS documentation has a generalized section for generators. Update the section so any new generator documentation can be appended. Signed-off-by: Pandith N Signed-off-by: Lakshmi Sowjanya D Reviewed-by: Andy Shevchenko Acked-by: Rodolfo Giometti Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20231016101953.27308-1-lakshmi.sowjanya.d@intel.com Documentation/driver-api/pps.rst | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) commit 07d87ceaecdde1835866d6acd0e1c1e08500ec82 Author: Samuel Thibault Date: Fri Oct 20 20:10:59 2023 +0200 speakup: Document USB support Speakup has been supporting USB for a while already. Signed-off-by: Samuel Thibault Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20231020181059.7rtj2csi7t6vorrm@begin Documentation/admin-guide/spkguide.txt | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit c1081a7b16abc80af7048672dcae1d3b57b6f257 Author: Tang Yizhou Date: Thu Oct 12 10:42:28 2023 +0800 doc: blk-ioprio: Bring the doc in line with the implementation Our system administrator have noted that the names 'rt-to-be' and 'all-to-idle' in the I/O priority policies table appeared without explanations, leading to confusion. Let's bring these names in line with the naming in the 'attribute' section. Additionally, 1. Correct the interface name to 'io.prio.class'. 2. Add a table entry of 'promote-to-rt' for consistency. 3. Fix a typo of 'priority'. Suggested-by: Yingfu Zhou Reviewed-by: Hou Tao Signed-off-by: Tang Yizhou Reviewed-by: Bart Van Assche Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20231012024228.2161283-1-yizhou.tang@shopee.com Documentation/admin-guide/cgroup-v2.rst | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 4ece2a7e88e1624f52c56d44394e4af1a13b1137 Author: Ian Rogers Date: Tue Sep 26 13:59:48 2023 -0700 perf vendor events intel: Add tigerlake two metrics Add tma_info_system_socket_clks and uncore_freq metrics. The associated converter script fix is in: https://github.com/intel/perfmon/pull/112 Signed-off-by: Ian Rogers Reviewed-by: Kan Liang Cc: Caleb Biggers Cc: Perry Taylor Link: https://lore.kernel.org/r/20230926205948.1399594-3-irogers@google.com Signed-off-by: Namhyung Kim tools/perf/pmu-events/arch/x86/tigerlake/tgl-metrics.json | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 19a214bffdf7abb8d472895bb944d9c269ab1699 Author: Ian Rogers Date: Tue Sep 26 13:59:47 2023 -0700 perf vendor events intel: Add broadwellde two metrics Add tma_info_system_socket_clks and uncore_freq metrics that require a broadwellx style uncore event for UNC_CLOCK. The associated converter script fix is in: https://github.com/intel/perfmon/pull/112 Fixes: 7d124303d620 ("perf vendor events intel: Update broadwell variant events/metrics") Signed-off-by: Ian Rogers Reviewed-by: Kan Liang Cc: Caleb Biggers Cc: Perry Taylor Link: https://lore.kernel.org/r/20230926205948.1399594-2-irogers@google.com Signed-off-by: Namhyung Kim .../perf/pmu-events/arch/x86/broadwellde/bdwde-metrics.json | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 2960f371f1653f6d8bc2321120eba2a14c861d4c Author: Sunil V L Date: Wed Oct 18 18:10:07 2023 +0530 RISC-V: cacheflush: Initialize CBO variables on ACPI systems Initialize the CBO variables on ACPI based systems using information in RHCT. Signed-off-by: Sunil V L Reviewed-by: Andrew Jones Reviewed-by: Samuel Holland Link: https://lore.kernel.org/r/20231018124007.1306159-5-sunilvl@ventanamicro.com Signed-off-by: Palmer Dabbelt arch/riscv/mm/cacheflush.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) commit 9ca87564190cf0e5bb72695fb0db9947fcc47843 Author: Sunil V L Date: Wed Oct 18 18:10:06 2023 +0530 RISC-V: ACPI: RHCT: Add function to get CBO block sizes Cache Block Operation (CBO) related block size in ACPI is provided by RHCT. Add support to read the CMO node in RHCT to get this information. Signed-off-by: Sunil V L Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20231018124007.1306159-4-sunilvl@ventanamicro.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/acpi.h | 6 +++ drivers/acpi/riscv/rhct.c | 87 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 93 insertions(+) commit a06835227280436c1aae021a3f43d3abfcba3835 Author: Sunil V L Date: Wed Oct 18 18:10:05 2023 +0530 RISC-V: ACPI: Update the return value of acpi_get_rhct() acpi_get_rhct() currently returns pointer to acpi_table_header structure. But since this is specific to RHCT, return pointer to acpi_table_rhct structure itself. Suggested-by: Andrew Jones Signed-off-by: Sunil V L Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20231018124007.1306159-3-sunilvl@ventanamicro.com Signed-off-by: Palmer Dabbelt drivers/acpi/riscv/rhct.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit e8065df5b0c46086ad539beb7745ea26b26a7623 Author: Sunil V L Date: Wed Oct 18 18:10:04 2023 +0530 RISC-V: ACPI: Enhance acpi_os_ioremap with MMIO remapping Enhance the acpi_os_ioremap() to support opregions in MMIO space. Also, have strict checks using EFI memory map to allow remapping the RAM similar to arm64. Signed-off-by: Sunil V L Reviewed-by: Andrew Jones Reviewed-by: Alexandre Ghiti Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20231018124007.1306159-2-sunilvl@ventanamicro.com Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 1 + arch/riscv/kernel/acpi.c | 87 ++++++++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 86 insertions(+), 2 deletions(-) commit 0fce6e5c87faec2c8bf28d2abc8cb595f4e244b6 Author: Ilpo Järvinen Date: Thu Oct 26 15:19:23 2023 +0300 PCI: Simplify pcie_capability_clear_and_set_word() to ..._clear_word() When using pcie_capability_clear_and_set_word() but not actually *setting* anything, use pcie_capability_clear_word() instead. Link: https://lore.kernel.org/r/20231026121924.2164-1-ilpo.jarvinen@linux.intel.com Link: https://lore.kernel.org/r/20231026121924.2164-2-ilpo.jarvinen@linux.intel.com Signed-off-by: Ilpo Järvinen [bhelgaas: squash] Signed-off-by: Bjorn Helgaas drivers/pci/pcie/aspm.c | 8 ++++---- drivers/pci/quirks.c | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) commit c9501d268944d6c0475ecb3e740a084a7da9cbfe Author: Dan Carpenter Date: Wed Oct 25 14:57:23 2023 +0300 PCI: endpoint: Fix double free in __pci_epc_create() The pci_epc_release() function frees "epc" so the kfree() on the next line is a double free. Drop the redundant free. Fixes: 7711cbb4862a ("PCI: endpoint: Fix WARN() when an endpoint driver is removed") Link: https://lore.kernel.org/r/2ce68694-87a7-4c06-b8a4-9870c891b580@moroto.mountain Signed-off-by: Dan Carpenter Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam drivers/pci/endpoint/pci-epc-core.c | 1 - 1 file changed, 1 deletion(-) commit 14dcf78a6c042dd9421b11485b394c6273568bca Merge: 2baca17e6a54 e8d4006dc24e Author: Catalin Marinas Date: Thu Oct 26 17:10:18 2023 +0100 Merge branch 'for-next/cpus_have_const_cap' into for-next/core * for-next/cpus_have_const_cap: (38 commits) : cpus_have_const_cap() removal arm64: Remove cpus_have_const_cap() arm64: Avoid cpus_have_const_cap() for ARM64_WORKAROUND_REPEAT_TLBI arm64: Avoid cpus_have_const_cap() for ARM64_WORKAROUND_NVIDIA_CARMEL_CNP arm64: Avoid cpus_have_const_cap() for ARM64_WORKAROUND_CAVIUM_23154 arm64: Avoid cpus_have_const_cap() for ARM64_WORKAROUND_2645198 arm64: Avoid cpus_have_const_cap() for ARM64_WORKAROUND_1742098 arm64: Avoid cpus_have_const_cap() for ARM64_WORKAROUND_1542419 arm64: Avoid cpus_have_const_cap() for ARM64_WORKAROUND_843419 arm64: Avoid cpus_have_const_cap() for ARM64_UNMAP_KERNEL_AT_EL0 arm64: Avoid cpus_have_const_cap() for ARM64_{SVE,SME,SME2,FA64} arm64: Avoid cpus_have_const_cap() for ARM64_SPECTRE_V2 arm64: Avoid cpus_have_const_cap() for ARM64_SSBS arm64: Avoid cpus_have_const_cap() for ARM64_MTE arm64: Avoid cpus_have_const_cap() for ARM64_HAS_TLB_RANGE arm64: Avoid cpus_have_const_cap() for ARM64_HAS_WFXT arm64: Avoid cpus_have_const_cap() for ARM64_HAS_RNG arm64: Avoid cpus_have_const_cap() for ARM64_HAS_EPAN arm64: Avoid cpus_have_const_cap() for ARM64_HAS_PAN arm64: Avoid cpus_have_const_cap() for ARM64_HAS_GIC_PRIO_MASKING arm64: Avoid cpus_have_const_cap() for ARM64_HAS_DIT ... commit 2baca17e6a54b70e3b6d1b50f98ab71f770e4b95 Merge: 023113fe66b4 72e301956dbb Author: Catalin Marinas Date: Thu Oct 26 17:10:07 2023 +0100 Merge branch 'for-next/feat_lse128' into for-next/core * for-next/feat_lse128: : HWCAP for FEAT_LSE128 kselftest/arm64: add FEAT_LSE128 to hwcap test arm64: add FEAT_LSE128 HWCAP commit 023113fe66b4866b0d211b705e8bd287728f2e98 Merge: 2a3f8ce3bb2f 80652cc0c048 Author: Catalin Marinas Date: Thu Oct 26 17:10:05 2023 +0100 Merge branch 'for-next/feat_lrcpc3' into for-next/core * for-next/feat_lrcpc3: : HWCAP for FEAT_LRCPC3 selftests/arm64: add HWCAP2_LRCPC3 test arm64: add FEAT_LRCPC3 HWCAP commit 2a3f8ce3bb2fca943e6b3225f796ce06c29621fd Merge: 1519018ccb42 3accaef1f61e Author: Catalin Marinas Date: Thu Oct 26 17:10:01 2023 +0100 Merge branch 'for-next/feat_sve_b16b16' into for-next/core * for-next/feat_sve_b16b16: : Add support for FEAT_SVE_B16B16 (BFloat16) kselftest/arm64: Verify HWCAP2_SVE_B16B16 arm64/sve: Report FEAT_SVE_B16B16 to userspace commit 1519018ccb421349db5426b97f836f79e6e9f4c7 Merge: b805cafc604b 391208485c3a ef31b8ce313e 11a7a42ea76e 146a15b87335 04d402a453c3 Author: Catalin Marinas Date: Thu Oct 26 17:09:52 2023 +0100 Merge branches 'for-next/sve-remove-pseudo-regs', 'for-next/backtrace-ipi', 'for-next/kselftest', 'for-next/misc' and 'for-next/cpufeat-display-cores', remote-tracking branch 'arm64/for-next/perf' into for-next/core * arm64/for-next/perf: perf: hisi: Fix use-after-free when register pmu fails drivers/perf: hisi_pcie: Initialize event->cpu only on success drivers/perf: hisi_pcie: Check the type first in pmu::event_init() perf/arm-cmn: Enable per-DTC counter allocation perf/arm-cmn: Rework DTC counters (again) perf/arm-cmn: Fix DTC domain detection drivers: perf: arm_pmuv3: Drop some unused arguments from armv8_pmu_init() drivers: perf: arm_pmuv3: Read PMMIR_EL1 unconditionally drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process drivers/perf: xgene: Use device_get_match_data() perf/amlogic: add missing MODULE_DEVICE_TABLE docs/perf: Add ampere_cspmu to toctree to fix a build warning perf: arm_cspmu: ampere_cspmu: Add support for Ampere SoC PMU perf: arm_cspmu: Support implementation specific validation perf: arm_cspmu: Support implementation specific filters perf: arm_cspmu: Split 64-bit write to 32-bit writes perf: arm_cspmu: Separate Arm and vendor module * for-next/sve-remove-pseudo-regs: : arm64/fpsimd: Remove the vector length pseudo registers arm64/sve: Remove SMCR pseudo register from cpufeature code arm64/sve: Remove ZCR pseudo register from cpufeature code * for-next/backtrace-ipi: : Add IPI for backtraces/kgdb, use NMI arm64: smp: Don't directly call arch_smp_send_reschedule() for wakeup arm64: smp: avoid NMI IPIs with broken MediaTek FW arm64: smp: Mark IPI globals as __ro_after_init arm64: kgdb: Implement kgdb_roundup_cpus() to enable pseudo-NMI roundup arm64: smp: IPI_CPU_STOP and IPI_CPU_CRASH_STOP should try for NMI arm64: smp: Add arch support for backtrace using pseudo-NMI arm64: smp: Remove dedicated wakeup IPI arm64: idle: Tag the arm64 idle functions as __cpuidle irqchip/gic-v3: Enable support for SGIs to act as NMIs * for-next/kselftest: : Various arm64 kselftest updates kselftest/arm64: Validate SVCR in streaming SVE stress test * for-next/misc: : Miscellaneous patches arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer arm64: module: Fix PLT counting when CONFIG_RANDOMIZE_BASE=n arm64, irqchip/gic-v3, ACPI: Move MADT GICC enabled check into a helper clocksource/drivers/arm_arch_timer: limit XGene-1 workaround arm64: Remove system_uses_lse_atomics() arm64: Mark the 'addr' argument to set_ptes() and __set_pte_at() as unused arm64/mm: Hoist synchronization out of set_ptes() loop arm64: swiotlb: Reduce the default size if no ZONE_DMA bouncing needed * for-next/cpufeat-display-cores: : arm64 cpufeature display enabled cores arm64: cpufeature: Change DBM to display enabled cores arm64: cpufeature: Display the set of cores with a feature commit 56e449603f0ac580700621a356d35d5716a62ce5 Author: Luben Tuikov Date: Sat Oct 14 21:15:35 2023 -0400 drm/sched: Convert the GPU scheduler to variable number of run-queues The GPU scheduler has now a variable number of run-queues, which are set up at drm_sched_init() time. This way, each driver announces how many run-queues it requires (supports) per each GPU scheduler it creates. Note, that run-queues correspond to scheduler "priorities", thus if the number of run-queues is set to 1 at drm_sched_init(), then that scheduler supports a single run-queue, i.e. single "priority". If a driver further sets a single entity per run-queue, then this creates a 1-to-1 correspondence between a scheduler and a scheduled entity. Cc: Lucas Stach Cc: Russell King Cc: Qiang Yu Cc: Rob Clark Cc: Abhinav Kumar Cc: Dmitry Baryshkov Cc: Danilo Krummrich Cc: Matthew Brost Cc: Boris Brezillon Cc: Alex Deucher Cc: Christian König Cc: Emma Anholt Cc: etnaviv@lists.freedesktop.org Cc: lima@lists.freedesktop.org Cc: linux-arm-msm@vger.kernel.org Cc: freedreno@lists.freedesktop.org Cc: nouveau@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Luben Tuikov Acked-by: Christian König Link: https://lore.kernel.org/r/20231023032251.164775-1-luben.tuikov@amd.com drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 4 +- drivers/gpu/drm/etnaviv/etnaviv_sched.c | 1 + drivers/gpu/drm/lima/lima_sched.c | 4 +- drivers/gpu/drm/msm/msm_ringbuffer.c | 5 +- drivers/gpu/drm/nouveau/nouveau_sched.c | 1 + drivers/gpu/drm/panfrost/panfrost_job.c | 1 + drivers/gpu/drm/scheduler/sched_entity.c | 18 ++++++-- drivers/gpu/drm/scheduler/sched_main.c | 74 ++++++++++++++++++++++++------ drivers/gpu/drm/v3d/v3d_sched.c | 5 ++ include/drm/gpu_scheduler.h | 9 ++-- 11 files changed, 98 insertions(+), 25 deletions(-) commit 60781d2d5899d6fc5fd173c1bcffaaec39643e17 Merge: 246f388ec12b 8619fd0e9026 Author: Mark Brown Date: Thu Oct 26 17:03:01 2023 +0100 ASoC: Intel: bytcr_wm5102: add various quirks Merge series from Hans de Goede : Hi Mark, As requested here is a v2 of my series to add various quirks to the bytcr_wm5102 Intel board driver to make it more flexible. Changes in v2: - Dropped 2 already merged patches - Rebased on top of broonie/sound/for-6.7 Regards, Hans Hans de Goede (4): ASoC: Intel: bytcr_wm5102: Add BYT_WM5102_SSP2 quirk ASoC: Intel: bytcr_wm5102: Add BYT_WM5102_MCLK_19_2MHZ quirk ASoC: Intel: bytcr_wm5102: Add BYT_WM5102_OUT_MAP quirk ASoC: Intel: bytcr_wm5102: Add BYT_WM5102_IN_MAP quirk sound/soc/intel/boards/bytcr_wm5102.c | 229 +++++++++++++++++++++++--- 1 file changed, 202 insertions(+), 27 deletions(-) -- 2.41.0 commit 246f388ec12b2e6659fd002a1049f5a34203d423 Merge: 11817547b7a2 4531f512e3ef Author: Mark Brown Date: Thu Oct 26 17:02:53 2023 +0100 sc7180: Add qdsp based soundcard Merge series from Nikita Travkin : Some devices, such as Acer Aspire 1, can't use lpass dirrectly, but instead must use adsp core to play sound. Since otherwise the hardware is, usually, very similar across the devices on the same platform, it makes sense to reuse the same boardfile. This series refactors the sc7180.c slightly and adds the functions to control clocks via adsp instead of controlling the hardware directly. commit 11817547b7a2cfad46e17e772a9002dc3e60f747 Merge: 926f192f005f f82eb06a40c8 Author: Mark Brown Date: Thu Oct 26 17:02:46 2023 +0100 ASoC: fix widget name comparisons (consider DAI name Merge series from Krzysztof Kozlowski : Some codec drivers compare widget names with strcmp, ignoring the component name prefix. If prefix is used, the comparisons start failing. Except Qualcomm lpass-rx-macro, none of the patches were tested on hardware. commit 926f192f005fe957ea1bfe4635af10219ba363a2 Merge: b97f4dac40ee 8ade6cc7e261 Author: Mark Brown Date: Thu Oct 26 17:02:39 2023 +0100 ASoC: codecs: Add aw88399 amplifier driver Merge series from wangweidong.a@awinic.com: Add the awinic,aw88399 property to the awinic,aw88395.yaml file. Add i2c and amplifier registration for aw88399 and their associated operation functions. commit 76c121821a3128eb9d0183a525cf334beb9ccc47 Author: Stefan Binding Date: Thu Oct 26 16:05:58 2023 +0100 ASoC: cs35l41: Detect CSPL errors when sending CSPL commands The existing code checks for the correct state transition after sending a command. However, it is possible for the message box to return -1, which indicates an error, if an error has occurred in the firmware. We can detect if the error has occurred, and return a different error. In addition, there is no recovering from a CSPL error, so the retry mechanism is not needed in this case, and we can return immediately. Signed-off-by: Stefan Binding Acked-by: Mark Brown Link: https://lore.kernel.org/r/20231026150558.2105827-9-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai include/sound/cs35l41.h | 2 ++ sound/soc/codecs/cs35l41-lib.c | 5 +++++ 2 files changed, 7 insertions(+) commit a51d8ba03a4fc92940d5e349f0325f36e85a89cb Author: Stefan Binding Date: Thu Oct 26 16:05:57 2023 +0100 ALSA: hda: cs35l41: Check CSPL state after loading firmware CSPL firmware should be in RUNNING or PAUSED state after loading. If not, the firmware has not been loaded correctly, and we can unload it and pass the error up. Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231026150558.2105827-8-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) commit 33790d1f039114a829433b89fc55a0d781d38d62 Author: Stefan Binding Date: Thu Oct 26 16:05:56 2023 +0100 ALSA: hda: cs35l41: Do not unload firmware before reset in system suspend Given the part is about to reset due to system suspend, and we are already in hibernate, there is no need to wake up the amp, just to get it ready to be reset. We just need to ensure cs_dsp is ready for reset by resetting the states. Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231026150558.2105827-7-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda.c | 33 ++++----------------------------- 1 file changed, 4 insertions(+), 29 deletions(-) commit 2ee06ff5d7cf5f68bab2bf65a946bb2ffe9982dd Author: Stefan Binding Date: Thu Oct 26 16:05:55 2023 +0100 ALSA: hda: cs35l41: Force a software reset after hardware reset To ensure the chip has correctly reset during probe and system suspend, we need to force a software reset, in case of systems where the hardware reset is not available. The software reset register was labelled as volatile but not readable, however, it is readable, (just returns 0x0). Adding it to readable registers means it will be correctly treated as volatile, and thus will not be cached. Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231026150558.2105827-6-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai include/sound/cs35l41.h | 1 + sound/pci/hda/cs35l41_hda.c | 5 +++++ sound/soc/codecs/cs35l41-lib.c | 1 + 3 files changed, 7 insertions(+) commit 881b7bce0c250386680b49b637455d31238a4b30 Author: Stefan Binding Date: Thu Oct 26 16:05:54 2023 +0100 ALSA: hda: cs35l41: Run boot process during resume callbacks During initial probe, after reset is asserted for the first time, the driver goes through a boot process to ensure the amp is ready to be used. This involves verifying a boot flag, as well as verifying the chip ids. This is necessary since it is possible for the amp to have been fully reset by the system suspend calls. Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231026150558.2105827-5-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda.c | 105 ++++++++++++++++++++++++++++++-------------- 1 file changed, 72 insertions(+), 33 deletions(-) commit fff393db71c1d53a13f9eb2f8da77c1f5e4e30bc Author: Stefan Binding Date: Thu Oct 26 16:05:53 2023 +0100 ALSA: hda: cs35l41: Assert Reset prior to de-asserting in probe and system resume To ensure we are in a known state, exiting from reset at the point of probe or in system resume, assert reset before we de-assert it. Since the BIOS may enter into a pre-boot environment to control the amps (for example for boot beep), we need to ensure we start from a known, reset state prior to probe or system resume. Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231026150558.2105827-4-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda.c | 2 ++ 1 file changed, 2 insertions(+) commit a7423e9019a9a595919da44104725eef8a518652 Author: Stefan Binding Date: Thu Oct 26 16:05:52 2023 +0100 ALSA: hda: cs35l41: Assert reset before system suspend Some system suspend modes may remove power supplies. To ensure we are not running during this time, we should assert reset. Note: since the amps use a shared reset, asserting reset prior to system suspend only works if the amps are suspended in the reverse order to probe. Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231026150558.2105827-3-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit f01b371b0794f43586d4f0b7dd0d9226c25553e5 Author: Stefan Binding Date: Thu Oct 26 16:05:51 2023 +0100 ALSA: hda: cs35l41: Use reset label to get GPIO for HP Zbook Fury 17 G9 This laptop has an incorrect setting in its _DSD for boost type, but the rest of the _DSD is correct, and we can still use the reset label to obtain the reset gpio. Also fix channel map so that amp 0 is right, and amp 1 is left. Fixes: 581523ee3652 ("ALSA: hda: cs35l41: Override the _DSD for HP Zbook Fury 17 G9 to correct boost type") Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20231026150558.2105827-2-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda_property.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit 0ec7731655de196bc1e4af99e495b38778109d22 Author: Mark Brown Date: Thu Oct 26 16:49:19 2023 +0100 regmap: Ensure range selector registers are updated after cache sync When we sync the register cache we do so with the cache bypassed in order to avoid overhead from writing the synced values back into the cache. If the regmap has ranges and the selector register for those ranges is in a register which is cached this has the unfortunate side effect of meaning that the physical and cached copies of the selector register can be out of sync after a cache sync. The cache will have whatever the selector was when the sync started and the hardware will have the selector for the register that was synced last. Fix this by rewriting all cached selector registers after every sync, ensuring that the hardware and cache have the same content. This will result in extra writes that wouldn't otherwise be needed but is simple so hopefully robust. We don't read from the hardware since not all devices have physical read support. Given that nobody noticed this until now it is likely that we are rarely if ever hitting this case. Reported-by: Hector Martin Cc: stable@vger.kernel.org Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20231026-regmap-fix-selector-sync-v1-1-633ded82770d@kernel.org Signed-off-by: Mark Brown drivers/base/regmap/regcache.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) commit 1110581412c7a223439bb3ecdcdd9f4432e08231 Author: Alison Schofield Date: Thu Oct 26 08:46:54 2023 -0700 cxl/region: Prepare the decoder match range helper for reuse match_decoder_by_range() and decoder_match_range() both determine if an HPA range matches a decoder. The first does it for root decoders and the second one operates on switch decoders. Tidy these up with clear naming and make the switch helper more like the root decoder helper in style and functionality. Make it take the actual range, rather than an endpoint decoder from which it extracts the range. Require an exact match on switch decoders, because unlike a root decoder that maps an entire region, Linux only supports 1:1 mapping of switch to endpoint decoders. Note that root-decoders are a super-set of switch-decoders and the range they cover is a super-set of a region, hence the use of range_contains() for that case. Aside from aesthetics and maintainability, this is in preparation for reuse. Signed-off-by: Alison Schofield Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Jim Harris Link: https://lore.kernel.org/r/011b1f498e1758bb8df17c5951be00bd8d489e3b.1698263080.git.alison.schofield@intel.com [djbw: fixup root decoder vs switch decoder range checks] Signed-off-by: Dan Williams drivers/cxl/core/region.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) commit 146a15b873353f8ac28dc281c139ff611a3c4848 Author: Nathan Chancellor Date: Wed Oct 25 10:21:28 2023 -0700 arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer Prior to LLVM 15.0.0, LLVM's integrated assembler would incorrectly byte-swap NOP when compiling for big-endian, and the resulting series of bytes happened to match the encoding of FNMADD S21, S30, S0, S0. This went unnoticed until commit: 34f66c4c4d5518c1 ("arm64: Use a positive cpucap for FP/SIMD") Prior to that commit, the kernel would always enable the use of FPSIMD early in boot when __cpu_setup() initialized CPACR_EL1, and so usage of FNMADD within the kernel was not detected, but could result in the corruption of user or kernel FPSIMD state. After that commit, the instructions happen to trap during boot prior to FPSIMD being detected and enabled, e.g. | Unhandled 64-bit el1h sync exception on CPU0, ESR 0x000000001fe00000 -- ASIMD | CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.0-rc3-00013-g34f66c4c4d55 #1 | Hardware name: linux,dummy-virt (DT) | pstate: 400000c9 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : __pi_strcmp+0x1c/0x150 | lr : populate_properties+0xe4/0x254 | sp : ffffd014173d3ad0 | x29: ffffd014173d3af0 x28: fffffbfffddffcb8 x27: 0000000000000000 | x26: 0000000000000058 x25: fffffbfffddfe054 x24: 0000000000000008 | x23: fffffbfffddfe000 x22: fffffbfffddfe000 x21: fffffbfffddfe044 | x20: ffffd014173d3b70 x19: 0000000000000001 x18: 0000000000000005 | x17: 0000000000000010 x16: 0000000000000000 x15: 00000000413e7000 | x14: 0000000000000000 x13: 0000000000001bcc x12: 0000000000000000 | x11: 00000000d00dfeed x10: ffffd414193f2cd0 x9 : 0000000000000000 | x8 : 0101010101010101 x7 : ffffffffffffffc0 x6 : 0000000000000000 | x5 : 0000000000000000 x4 : 0101010101010101 x3 : 000000000000002a | x2 : 0000000000000001 x1 : ffffd014171f2988 x0 : fffffbfffddffcb8 | Kernel panic - not syncing: Unhandled exception | CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.0-rc3-00013-g34f66c4c4d55 #1 | Hardware name: linux,dummy-virt (DT) | Call trace: | dump_backtrace+0xec/0x108 | show_stack+0x18/0x2c | dump_stack_lvl+0x50/0x68 | dump_stack+0x18/0x24 | panic+0x13c/0x340 | el1t_64_irq_handler+0x0/0x1c | el1_abort+0x0/0x5c | el1h_64_sync+0x64/0x68 | __pi_strcmp+0x1c/0x150 | unflatten_dt_nodes+0x1e8/0x2d8 | __unflatten_device_tree+0x5c/0x15c | unflatten_device_tree+0x38/0x50 | setup_arch+0x164/0x1e0 | start_kernel+0x64/0x38c | __primary_switched+0xbc/0xc4 Restrict CONFIG_CPU_BIG_ENDIAN to a known good assembler, which is either GNU as or LLVM's IAS 15.0.0 and newer, which contains the linked commit. Closes: https://github.com/ClangBuiltLinux/linux/issues/1948 Link: https://github.com/llvm/llvm-project/commit/1379b150991f70a5782e9a143c2ba5308da1161c Signed-off-by: Nathan Chancellor Cc: stable@vger.kernel.org Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20231025-disable-arm64-be-ias-b4-llvm-15-v1-1-b25263ed8b23@kernel.org Signed-off-by: Catalin Marinas arch/arm64/Kconfig | 2 ++ 1 file changed, 2 insertions(+) commit 3ddba96b0d7e714dee4db5aed4f7d413be43b4ba Author: Helen Koike Date: Tue Sep 19 15:22:49 2023 -0300 MAINTAINERS: drm/ci: add entries for xfail files DRM CI keeps track of which tests are failing, flaking or being skipped by the ci in the expectations files. Add entries for those files to the corresponding driver maintainer, so they can be notified when they change. Signed-off-by: Helen Koike Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20230919182249.153499-1-helen.koike@collabora.com Signed-off-by: Maxime Ripard MAINTAINERS | 7 +++++++ 1 file changed, 7 insertions(+) commit 56185e0249525e2fff70cf19baf223c3aba5af40 Merge: 40fa0489a294 f93b8a5705c6 Author: Arnd Bergmann Date: Thu Oct 26 17:26:35 2023 +0200 Merge tag 'qcom-arm64-defconfig-for-6.7-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/defconfig Few more ARM64 defconfig updates for v6.7 This enables the Qualcomm PMIC-based USB Type-C port manager, found in e.g. SM8250, and hence RB5, as well as the Type-C DisplayPort altmode support to get display working on the same. * tag 'qcom-arm64-defconfig-for-6.7-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: enable DisplayPort altmode support arm64: defconfig: enable CONFIG_TYPEC_QCOM_PMIC Link: https://lore.kernel.org/r/20231025191841.1015192-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit a9838799e2fa9fedd77867942e661b657d5591a0 Author: Lukas Bulwahn Date: Wed Oct 25 13:21:36 2023 +0200 arm: debug: reuse the config DEBUG_OMAP2UART{1,2} for OMAP{3,4,5} Commit d2b310b0234c ("ARM: debug: Use generic 8250 debug_ll for omap2 and omap3/4/5 common uarts") adds address definitions of DEBUG_UART_PHYS for OMAP2, OMAP3, OMAP4 and OMAP5 in ./arch/arm/Kconfig.debug. These definitions depend on DEBUG_OMAP{2,3,4,5}UART{1,2}; however, only DEBUG_OMAP2UART{1,2} are defined in ./arch/arm/Kconfig.debug, and DEBUG_OMAP{3,4,5}UART{1,2} are not defined. Hence, the script ./scripts/checkkconfigsymbols.py warns here on non-existing symbols. Simply reuse the config DEBUG_OMAP2UART{1,2}; there is no need to define separate config symbols for OMAP{3,4,5}. So, just delete the dead references to DEBUG_OMAP{3,4,5}UART{1,2}. Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20231025112136.3445-1-lukas.bulwahn@gmail.com Signed-off-by: Arnd Bergmann arch/arm/Kconfig.debug | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) commit 3613047280ec42a4e1350fdc1a6dd161ff4008cc Merge: bbc70e0aec28 05d3ef8bba77 Author: Joerg Roedel Date: Thu Oct 26 17:05:58 2023 +0200 Merge tag 'v6.6-rc7' into core Linux 6.6-rc7 commit 8d786149d78c7784144c7179e25134b6530b714b Author: Thippeswamy Havalige Date: Tue Oct 3 23:04:53 2023 +0530 PCI: xilinx-xdma: Add Xilinx XDMA Root Port driver Add support for Xilinx XDMA Soft IP core as Root Port. The Zynq UltraScale+ MPSoCs devices support XDMA soft IP module in programmable logic. The integrated XDMA Soft IP block has integrated bridge function that can act as PCIe Root Port. [kwilczynski: correct indentation and whitespaces, Kconfig help update] Link: https://lore.kernel.org/linux-pci/20231003173453.938190-4-thippeswamy.havalige@amd.com Signed-off-by: Thippeswamy Havalige Signed-off-by: Bharat Kumar Gogada Signed-off-by: Krzysztof Wilczyński drivers/pci/controller/Kconfig | 11 + drivers/pci/controller/Makefile | 1 + drivers/pci/controller/pcie-xilinx-common.h | 1 + drivers/pci/controller/pcie-xilinx-dma-pl.c | 814 ++++++++++++++++++++++++++++ 4 files changed, 827 insertions(+) commit bbc70e0aec287e164344b1a071bd46466a4f29b3 Author: Jason Gunthorpe Date: Wed Sep 27 20:47:39 2023 -0300 iommu/dart: Remove the force_bypass variable This flag just caches if the IO page size is larger than the CPU PAGE_SIZE. This only needs to be checked in two places so remove the confusingly named cache. dart would like to not support paging domains at all if the IO page size is larger than the CPU page size. In this case we should ideally fail domain_alloc_paging(), as there is no point in creating a domain that can never be attached. Move the test into apple_dart_finalize_domain(). The check in apple_dart_mod_streams() will prevent the domain from being attached to the wrong dart There is no HW limitation that prevents BLOCKED domains from working, remove that test. The check in apple_dart_of_xlate() is redundant since immediately after the pgsize is checked. Remove it. Remove the variable. Suggested-by: Janne Grunau Signed-off-by: Jason Gunthorpe Reviewed-by: Janne Grunau Acked-by: Sven Peter Link: https://lore.kernel.org/r/9-v2-bff223cf6409+282-dart_paging_jgg@nvidia.com Signed-off-by: Joerg Roedel drivers/iommu/apple-dart.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) commit 482feb5c649261cd2a7ad02e4ca63c159d6ec795 Author: Jason Gunthorpe Date: Wed Sep 27 20:47:38 2023 -0300 iommu/dart: Call apple_dart_finalize_domain() as part of alloc_paging() In many cases the dev argument will now be !NULL so we should use it to finalize the domain at allocation. Make apple_dart_finalize_domain() accept the correct type. Reviewed-by: Janne Grunau Signed-off-by: Jason Gunthorpe Acked-by: Sven Peter Link: https://lore.kernel.org/r/8-v2-bff223cf6409+282-dart_paging_jgg@nvidia.com Signed-off-by: Joerg Roedel drivers/iommu/apple-dart.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) commit 9c3ef90c4ccbee0a000b0f6b1b28c38773de87c7 Author: Jason Gunthorpe Date: Wed Sep 27 20:47:37 2023 -0300 iommu/dart: Convert to domain_alloc_paging() Since the IDENTITY and BLOCKED behaviors were moved to global statics all that remains is the paging domain. Rename to apple_dart_attach_dev_paging() and remove the left over type check. Reviewed-by: Janne Grunau Signed-off-by: Jason Gunthorpe Acked-by: Sven Peter Link: https://lore.kernel.org/r/7-v2-bff223cf6409+282-dart_paging_jgg@nvidia.com Signed-off-by: Joerg Roedel drivers/iommu/apple-dart.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) commit 17ef8d6876e01165836790d83d908eb21da3f08e Author: Jason Gunthorpe Date: Wed Sep 27 20:47:36 2023 -0300 iommu/dart: Move the blocked domain support to a global static Move to the new static global for blocked domains. Move the blocked specific code to apple_dart_attach_dev_blocked(). Reviewed-by: Janne Grunau Signed-off-by: Jason Gunthorpe Acked-by: Sven Peter Link: https://lore.kernel.org/r/6-v2-bff223cf6409+282-dart_paging_jgg@nvidia.com Signed-off-by: Joerg Roedel drivers/iommu/apple-dart.c | 54 +++++++++++++++++++++++++++------------------- 1 file changed, 32 insertions(+), 22 deletions(-) commit 7993085d8d5d271a83045c5c7d01982a7e89a52e Author: Jason Gunthorpe Date: Wed Sep 27 20:47:35 2023 -0300 iommu/dart: Use static global identity domains Move to the new static global for identity domains. Move the identity specific code to apple_dart_attach_dev_identity(). Reviewed-by: Janne Grunau Signed-off-by: Jason Gunthorpe Acked-by: Sven Peter Link: https://lore.kernel.org/r/5-v2-bff223cf6409+282-dart_paging_jgg@nvidia.com Signed-off-by: Joerg Roedel drivers/iommu/apple-dart.c | 39 ++++++++++++++++++++++++++++----------- 1 file changed, 28 insertions(+), 11 deletions(-) commit 13fbceb1b8e9d1101d9dcd5ceec483cb6d203a3c Author: Jason Gunthorpe Date: Wed Sep 27 20:47:34 2023 -0300 iommufd: Convert to alloc_domain_paging() Move the global static blocked domain to the ops and convert the unmanaged domain to domain_alloc_paging. Signed-off-by: Jason Gunthorpe Reviewed-by: Kevin Tian Acked-by: Sven Peter Link: https://lore.kernel.org/r/4-v2-bff223cf6409+282-dart_paging_jgg@nvidia.com Signed-off-by: Joerg Roedel drivers/iommu/iommufd/selftest.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) commit 7d12eb2d2f59e348b74fd36add42a3208a1eaeaa Author: Jason Gunthorpe Date: Wed Sep 27 20:47:33 2023 -0300 iommu/vt-d: Use ops->blocked_domain Trivially migrate to the ops->blocked_domain for the existing global static. Reviewed-by: Lu Baolu Signed-off-by: Jason Gunthorpe Reviewed-by: Kevin Tian Acked-by: Sven Peter Link: https://lore.kernel.org/r/3-v2-bff223cf6409+282-dart_paging_jgg@nvidia.com Signed-off-by: Joerg Roedel drivers/iommu/intel/iommu.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 7b6dd84e703147f5c71f163b84b0cb729a320541 Author: Jason Gunthorpe Date: Wed Sep 27 20:47:32 2023 -0300 iommu/vt-d: Update the definition of the blocking domain The global static should pre-define the type and the NOP free function can be now left as NULL. Reviewed-by: Lu Baolu Signed-off-by: Jason Gunthorpe Reviewed-by: Kevin Tian Acked-by: Sven Peter Link: https://lore.kernel.org/r/2-v2-bff223cf6409+282-dart_paging_jgg@nvidia.com Signed-off-by: Joerg Roedel drivers/iommu/intel/iommu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e5d8be7406ca7b6b251c09b786f08176337c0999 Author: Jason Gunthorpe Date: Wed Sep 27 20:47:31 2023 -0300 iommu: Move IOMMU_DOMAIN_BLOCKED global statics to ops->blocked_domain Following the pattern of identity domains, just assign the BLOCKED domain global statics to a value in ops. Update the core code to use the global static directly. Update powerpc to use the new scheme and remove its empty domain_alloc callback. Reviewed-by: Lu Baolu Signed-off-by: Jason Gunthorpe Reviewed-by: Kevin Tian Acked-by: Sven Peter Link: https://lore.kernel.org/r/1-v2-bff223cf6409+282-dart_paging_jgg@nvidia.com Signed-off-by: Joerg Roedel arch/powerpc/kernel/iommu.c | 9 +-------- drivers/iommu/iommu.c | 2 ++ include/linux/iommu.h | 3 +++ 3 files changed, 6 insertions(+), 8 deletions(-) commit 4ae1cd7d4be2d1388bcfcd8371eb001a4cec88e2 Author: Thippeswamy Havalige Date: Tue Oct 3 23:04:52 2023 +0530 dt-bindings: PCI: xilinx-xdma: Add schemas for Xilinx XDMA PCIe Root Port Bridge Add YAML devicetree schemas for Xilinx XDMA Soft IP PCIe Root Port Bridge. [kwilczynski: commit log] Link: https://lore.kernel.org/linux-pci/20231003173453.938190-3-thippeswamy.havalige@amd.com Signed-off-by: Thippeswamy Havalige Signed-off-by: Bharat Kumar Gogada Signed-off-by: Krzysztof Wilczyński Reviewed-by: Krzysztof Kozlowski Acked-by: Rob Herring .../devicetree/bindings/pci/xlnx,xdma-host.yaml | 114 +++++++++++++++++++++ 1 file changed, 114 insertions(+) commit 2050c9bc4f7bbdd7d1dc0b6bf7749ec4f7b6f407 Author: Abel Vesa Date: Wed Oct 25 19:29:43 2023 +0530 pmdomain: qcom: rpmhpd: Add SC8380XP power domains Add the power domains exposed by RPMH in the Qualcomm SC8380XP platform. Signed-off-by: Abel Vesa Signed-off-by: Rajendra Nayak Co-developed-by: Sibi Sankar Signed-off-by: Sibi Sankar Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20231025135943.13854-4-quic_sibis@quicinc.com Signed-off-by: Ulf Hansson drivers/pmdomain/qcom/rpmhpd.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) commit 9c82c9005cb0ca14ed8885bab27d81894ba184d9 Author: Neil Armstrong Date: Wed Oct 25 09:32:03 2023 +0200 pmdomain: qcom: rpmhpd: Add SM8650 RPMh Power Domains Add RPMh Power Domains support for the SM8650 platform. Signed-off-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20231025-topic-sm8650-upstream-rpmpd-v1-2-f25d313104c6@linaro.org Signed-off-by: Ulf Hansson drivers/pmdomain/qcom/rpmhpd.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) commit 11cc498cf875c1242006f5b8028800c11673b8d5 Merge: 1df91d85f29f c638b9516abd Author: Ulf Hansson Date: Thu Oct 26 16:21:46 2023 +0200 pmdomain: Merge branch genpd_dt into next Merge the immutable branch genpd_dt into next, to allow the DT bindings to be tested together with new pmdomain changes that are targeted for v6.7. Signed-off-by: Ulf Hansson commit c638b9516abd60aebccdbded5041a3e9d1c519f3 Author: Abel Vesa Date: Wed Oct 25 19:29:42 2023 +0530 dt-bindings: power: rpmpd: Add SC8380XP support Add compatible and constants for the power domains exposed by the RPMH in the Qualcomm SC8380XP platform. Signed-off-by: Abel Vesa Signed-off-by: Rajendra Nayak Signed-off-by: Sibi Sankar Link: https://lore.kernel.org/r/20231025135943.13854-3-quic_sibis@quicinc.com Signed-off-by: Ulf Hansson Documentation/devicetree/bindings/power/qcom,rpmpd.yaml | 1 + 1 file changed, 1 insertion(+) commit 7eb31ec5e1cdb4705450e4d728407767cae2b919 Author: Sibi Sankar Date: Wed Oct 25 19:29:41 2023 +0530 dt-bindings: power: qcom,rpmhpd: Add GMXC PD index Document GMXC (Graphics MXC) power domain index which will be used on SC8380XP SoCs. Signed-off-by: Sibi Sankar Link: https://lore.kernel.org/r/20231025135943.13854-2-quic_sibis@quicinc.com [Ulf: Re-based to step up the index number] Signed-off-by: Ulf Hansson include/dt-bindings/power/qcom,rpmhpd.h | 1 + 1 file changed, 1 insertion(+) commit d4d56c079ddd19293b11de1f2309add0b8972af2 Author: Neil Armstrong Date: Wed Oct 25 09:32:02 2023 +0200 dt-bindings: power: qcom,rpmpd: document the SM8650 RPMh Power Domains Document the RPMh Power Domains on the SM8650 Platform. Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20231025-topic-sm8650-upstream-rpmpd-v1-1-f25d313104c6@linaro.org Signed-off-by: Ulf Hansson Documentation/devicetree/bindings/power/qcom,rpmpd.yaml | 1 + include/dt-bindings/power/qcom,rpmhpd.h | 1 + 2 files changed, 2 insertions(+) commit 03476e687eb07b94f7cdb07cd3c7c4304b6c58b3 Author: Lu Baolu Date: Wed Oct 25 21:42:16 2023 -0700 iommu/vt-d: Disallow read-only mappings to nest parent domain When remapping hardware is configured by system software in scalable mode as Nested (PGTT=011b) and with PWSNP field Set in the PASID-table-entry, it may Set Accessed bit and Dirty bit (and Extended Access bit if enabled) in first-stage page-table entries even when second-stage mappings indicate that corresponding first-stage page-table is Read-Only. As the result, contents of pages designated by VMM as Read-Only can be modified by IOMMU via PML5E (PML4E for 4-level tables) access as part of address translation process due to DMAs issued by Guest. This disallows read-only mappings in the domain that is supposed to be used as nested parent. Reference from Sapphire Rapids Specification Update [1], errata details, SPR17. Userspace should know this limitation by checking the IOMMU_HW_INFO_VTD_ERRATA_772415_SPR17 flag reported in the IOMMU_GET_HW_INFO ioctl. [1] https://www.intel.com/content/www/us/en/content-details/772415/content-details.html Link: https://lore.kernel.org/r/20231026044216.64964-9-yi.l.liu@intel.com Reviewed-by: Kevin Tian Signed-off-by: Lu Baolu Signed-off-by: Yi Liu Signed-off-by: Jason Gunthorpe drivers/iommu/intel/iommu.c | 6 ++++++ include/uapi/linux/iommufd.h | 12 +++++++++++- 2 files changed, 17 insertions(+), 1 deletion(-) commit b41e38e225398191aaa0f1115d6234f57ffd0741 Author: Lu Baolu Date: Wed Oct 25 21:42:15 2023 -0700 iommu/vt-d: Add nested domain allocation This adds the support for IOMMU_HWPT_DATA_VTD_S1 type. And 'nested_parent' is added to mark the nested parent domain to sanitize the input parent domain. Link: https://lore.kernel.org/r/20231026044216.64964-8-yi.l.liu@intel.com Signed-off-by: Lu Baolu Signed-off-by: Yi Liu Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe drivers/iommu/intel/iommu.c | 39 ++++++++++++++++++++------------------- drivers/iommu/intel/iommu.h | 1 + drivers/iommu/intel/nested.c | 3 ++- 3 files changed, 23 insertions(+), 20 deletions(-) commit 9838f2bb6b6be1e648b9377fc97ee7b18d9f2fbf Author: Yi Liu Date: Wed Oct 25 21:42:14 2023 -0700 iommu/vt-d: Set the nested domain to a device This adds the helper for setting the nested domain to a device hence enable nested domain usage on Intel VT-d. Link: https://lore.kernel.org/r/20231026044216.64964-7-yi.l.liu@intel.com Signed-off-by: Jacob Pan Signed-off-by: Lu Baolu Signed-off-by: Yi Liu Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe drivers/iommu/intel/nested.c | 54 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) commit d86724d4dc45ba2ed80eebb704e12bb71c35d901 Author: Yi Liu Date: Wed Oct 25 21:42:13 2023 -0700 iommu/vt-d: Make domain attach helpers to be extern This makes the helpers visible to nested.c. Link: https://lore.kernel.org/r/20231026044216.64964-6-yi.l.liu@intel.com Suggested-by: Lu Baolu Reviewed-by: Kevin Tian Reviewed-by: Lu Baolu Signed-off-by: Yi Liu Signed-off-by: Jason Gunthorpe drivers/iommu/intel/iommu.c | 15 ++++++--------- drivers/iommu/intel/iommu.h | 7 +++++++ 2 files changed, 13 insertions(+), 9 deletions(-) commit 111bf85c68f6edb2d06c6705faab9d1649348bdb Author: Lu Baolu Date: Wed Oct 25 21:42:12 2023 -0700 iommu/vt-d: Add helper to setup pasid nested translation The configurations are passed in from the user when the user domain is allocated. This helper interprets these configurations according to the data structure defined in uapi/linux/iommufd.h. The EINVAL error will be returned if any of configurations are not compatible with the hardware capabilities. The caller can retry with another compatible user domain. The encoding of fields of each pasid entry is defined in section 9.6 of the VT-d spec. Link: https://lore.kernel.org/r/20231026044216.64964-5-yi.l.liu@intel.com Signed-off-by: Jacob Pan Signed-off-by: Lu Baolu Signed-off-by: Yi Liu Signed-off-by: Jason Gunthorpe drivers/iommu/intel/pasid.c | 112 ++++++++++++++++++++++++++++++++++++++++++++ drivers/iommu/intel/pasid.h | 2 + 2 files changed, 114 insertions(+) commit 79ae1eccd3f7fb010064c0f6242da8f8944c21fd Author: Lu Baolu Date: Wed Oct 25 21:42:11 2023 -0700 iommu/vt-d: Add helper for nested domain allocation This adds helper for accepting user parameters and allocate a nested domain. Link: https://lore.kernel.org/r/20231026044216.64964-4-yi.l.liu@intel.com Reviewed-by: Kevin Tian Signed-off-by: Jacob Pan Signed-off-by: Lu Baolu Signed-off-by: Yi Liu Signed-off-by: Jason Gunthorpe drivers/iommu/intel/Makefile | 2 +- drivers/iommu/intel/iommu.h | 2 ++ drivers/iommu/intel/nested.c | 62 ++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 65 insertions(+), 1 deletion(-) commit 04f261ac2356ee8962fbd67e38a35e86cbe3c5d8 Author: Lu Baolu Date: Wed Oct 25 21:42:10 2023 -0700 iommu/vt-d: Extend dmar_domain to support nested domain The nested domain fields are exclusive to those that used for a DMA remapping domain. Use union to avoid memory waste. Link: https://lore.kernel.org/r/20231026044216.64964-3-yi.l.liu@intel.com Reviewed-by: Kevin Tian Signed-off-by: Lu Baolu Signed-off-by: Yi Liu Signed-off-by: Jason Gunthorpe drivers/iommu/intel/iommu.h | 36 ++++++++++++++++++++++++++++++------ 1 file changed, 30 insertions(+), 6 deletions(-) commit 82b6661c9c35e60946dee536545b4848f25eafab Author: Yi Liu Date: Wed Oct 25 21:42:09 2023 -0700 iommufd: Add data structure for Intel VT-d stage-1 domain allocation This adds IOMMU_HWPT_DATA_VTD_S1 for stage-1 hw_pagetable of Intel VT-d and the corressponding data structure for userspace specified parameter for the domain allocation. Link: https://lore.kernel.org/r/20231026044216.64964-2-yi.l.liu@intel.com Reviewed-by: Kevin Tian Signed-off-by: Yi Liu Signed-off-by: Jason Gunthorpe include/uapi/linux/iommufd.h | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) commit a2cdecdf9d234455fdfc8f539bbf5818711bc29d Author: Yi Liu Date: Tue Oct 24 08:00:11 2023 -0700 iommu/vt-d: Enhance capability check for nested parent domain allocation This adds the scalable mode check before allocating the nested parent domain as checking nested capability is not enough. User may turn off scalable mode which also means no nested support even if the hardware supports it. Fixes: c97d1b20d383 ("iommu/vt-d: Add domain_alloc_user op") Link: https://lore.kernel.org/r/20231024150011.44642-1-yi.l.liu@intel.com Signed-off-by: Yi Liu Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe drivers/iommu/intel/iommu.c | 2 +- drivers/iommu/intel/iommu.h | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) commit 55a01657cbee07d772b1d3cb144f867a326e4673 Author: Nicolin Chen Date: Wed Oct 25 21:39:38 2023 -0700 iommufd/selftest: Add coverage for IOMMU_HWPT_ALLOC with nested HWPTs The IOMMU_HWPT_ALLOC ioctl now supports passing user_data to allocate a user-managed domain for nested HWPTs. Add its coverage for that. Also, update _test_cmd_hwpt_alloc() and add test_cmd/err_hwpt_alloc_nested(). Link: https://lore.kernel.org/r/20231026043938.63898-11-yi.l.liu@intel.com Signed-off-by: Nicolin Chen Signed-off-by: Yi Liu Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe tools/testing/selftests/iommu/iommufd.c | 115 +++++++++++++++++++++++ tools/testing/selftests/iommu/iommufd_fail_nth.c | 3 +- tools/testing/selftests/iommu/iommufd_utils.h | 30 ++++-- 3 files changed, 140 insertions(+), 8 deletions(-) commit 65fe32f7a4472e19331a524b9c980b3444dd20a2 Author: Nicolin Chen Date: Wed Oct 25 21:39:37 2023 -0700 iommufd/selftest: Add nested domain allocation for mock domain Add nested domain support in the ->domain_alloc_user op with some proper sanity checks. Then, add a domain_nested_ops for all nested domains and split the get_md_pagetable helper into paging and nested helpers. Also, add an iotlb as a testing property of a nested domain. Link: https://lore.kernel.org/r/20231026043938.63898-10-yi.l.liu@intel.com Signed-off-by: Nicolin Chen Signed-off-by: Yi Liu Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe drivers/iommu/iommufd/iommufd_test.h | 18 +++++ drivers/iommu/iommufd/selftest.c | 152 ++++++++++++++++++++++++++++------- 2 files changed, 140 insertions(+), 30 deletions(-) commit e9d36c07bb787840e4813fb09a929a17d522a69f Author: Nicolin Chen Date: Wed Oct 25 21:39:36 2023 -0700 iommu: Add iommu_copy_struct_from_user helper Wrap up the data type/pointer/len sanity and a copy_struct_from_user call for iommu drivers to copy driver specific data via struct iommu_user_data. And expect it to be used in the domain_alloc_user op for example. Link: https://lore.kernel.org/r/20231026043938.63898-9-yi.l.liu@intel.com Signed-off-by: Nicolin Chen Co-developed-by: Yi Liu Signed-off-by: Yi Liu Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe include/linux/iommu.h | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) commit bd529dbb661d62bd9f03e44c9fc837d98a190499 Author: Nicolin Chen Date: Wed Oct 25 21:39:35 2023 -0700 iommufd: Add a nested HW pagetable object IOMMU_HWPT_ALLOC already supports iommu_domain allocation for usersapce. But it can only allocate a hw_pagetable that associates to a given IOAS, i.e. only a kernel-managed hw_pagetable of IOMMUFD_OBJ_HWPT_PAGING type. IOMMU drivers can now support user-managed hw_pagetables, for two-stage translation use cases that require user data input from the user space. Add a new IOMMUFD_OBJ_HWPT_NESTED type with its abort/destroy(). Pair it with a new iommufd_hwpt_nested structure and its to_hwpt_nested() helper. Update the to_hwpt_paging() helper, so a NESTED-type hw_pagetable can be handled in the callers, for example iommufd_hw_pagetable_enforce_rr(). Screen the inputs including the parent PAGING-type hw_pagetable that has a need of a new nest_parent flag in the iommufd_hwpt_paging structure. Extend the IOMMU_HWPT_ALLOC ioctl to accept an IOMMU driver specific data input which is tagged by the enum iommu_hwpt_data_type. Also, update the @pt_id to accept hwpt_id too besides an ioas_id. Then, use them to allocate a hw_pagetable of IOMMUFD_OBJ_HWPT_NESTED type using the iommufd_hw_pagetable_alloc_nested() allocator. Link: https://lore.kernel.org/r/20231026043938.63898-8-yi.l.liu@intel.com Signed-off-by: Nicolin Chen Co-developed-by: Yi Liu Signed-off-by: Yi Liu Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe drivers/iommu/iommufd/device.c | 3 +- drivers/iommu/iommufd/hw_pagetable.c | 109 ++++++++++++++++++++++++++++++-- drivers/iommu/iommufd/iommufd_private.h | 28 ++++++-- drivers/iommu/iommufd/main.c | 4 ++ include/uapi/linux/iommufd.h | 31 ++++++++- 5 files changed, 159 insertions(+), 16 deletions(-) commit 2bdabb8e82f564d19eeeb7c83e6b2467af0707cb Author: Yi Liu Date: Wed Oct 25 21:39:34 2023 -0700 iommu: Pass in parent domain with user_data to domain_alloc_user op domain_alloc_user op already accepts user flags for domain allocation, add a parent domain pointer and a driver specific user data support as well. The user data would be tagged with a type for iommu drivers to add their own driver specific user data per hw_pagetable. Add a struct iommu_user_data as a bundle of data_ptr/data_len/type from an iommufd core uAPI structure. Make the user data opaque to the core, since a userspace driver must match the kernel driver. In the future, if drivers share some common parameter, there would be a generic parameter as well. Link: https://lore.kernel.org/r/20231026043938.63898-7-yi.l.liu@intel.com Signed-off-by: Lu Baolu Co-developed-by: Nicolin Chen Signed-off-by: Nicolin Chen Signed-off-by: Yi Liu Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe drivers/iommu/amd/iommu.c | 9 ++++++--- drivers/iommu/intel/iommu.c | 7 ++++++- drivers/iommu/iommufd/hw_pagetable.c | 3 ++- drivers/iommu/iommufd/selftest.c | 7 ++++++- include/linux/iommu.h | 27 ++++++++++++++++++++++++--- 5 files changed, 44 insertions(+), 9 deletions(-) commit b5021cb264e67baf051569a41debe277c279952b Author: Nicolin Chen Date: Wed Oct 25 21:39:33 2023 -0700 iommufd: Share iommufd_hwpt_alloc with IOMMUFD_OBJ_HWPT_NESTED Allow iommufd_hwpt_alloc() to have a common routine but jump to different allocators corresponding to different user input pt_obj types, either an IOMMUFD_OBJ_IOAS for a PAGING hwpt or an IOMMUFD_OBJ_HWPT_PAGING as the parent for a NESTED hwpt. Also, move the "flags" validation to the hwpt allocator (paging), so that later the hwpt_nested allocator can do its own separate flags validation. Link: https://lore.kernel.org/r/20231026043938.63898-6-yi.l.liu@intel.com Signed-off-by: Nicolin Chen Signed-off-by: Yi Liu Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe drivers/iommu/iommufd/hw_pagetable.c | 46 +++++++++++++++++++++++------------- 1 file changed, 29 insertions(+), 17 deletions(-) commit 89db31635c87a7856e205c7ebf9f562e4bb206fe Author: Nicolin Chen Date: Wed Oct 25 21:39:32 2023 -0700 iommufd: Derive iommufd_hwpt_paging from iommufd_hw_pagetable To prepare for IOMMUFD_OBJ_HWPT_NESTED, derive struct iommufd_hwpt_paging from struct iommufd_hw_pagetable, by leaving the common members in struct iommufd_hw_pagetable. Add a __iommufd_object_alloc and to_hwpt_paging() helpers for the new structure. Then, update "hwpt" to "hwpt_paging" throughout the files, accordingly. Link: https://lore.kernel.org/r/20231026043938.63898-5-yi.l.liu@intel.com Suggested-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Yi Liu Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe drivers/iommu/iommufd/device.c | 76 +++++++++++-------- drivers/iommu/iommufd/hw_pagetable.c | 129 +++++++++++++++++--------------- drivers/iommu/iommufd/iommufd_private.h | 41 ++++++---- drivers/iommu/iommufd/main.c | 4 +- drivers/iommu/iommufd/vfio_compat.c | 6 +- 5 files changed, 148 insertions(+), 108 deletions(-) commit 58d84f430dc7f737d21c60906de0f39104c89e9d Author: Jason Gunthorpe Date: Wed Oct 25 21:39:31 2023 -0700 iommufd/device: Wrap IOMMUFD_OBJ_HWPT_PAGING-only configurations Some of the configurations during the attach/replace() should only apply to IOMMUFD_OBJ_HWPT_PAGING. Once IOMMUFD_OBJ_HWPT_NESTED gets introduced in a following patch, keeping them unconditionally in the common routine will not work. Wrap all of those PAGING-only configurations together into helpers. Do a hwpt_is_paging check whenever calling them or their fallback routines. Link: https://lore.kernel.org/r/20231026043938.63898-4-yi.l.liu@intel.com Signed-off-by: Nicolin Chen Signed-off-by: Yi Liu Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe drivers/iommu/iommufd/device.c | 111 +++++++++++++++++++++++--------- drivers/iommu/iommufd/iommufd_private.h | 5 ++ 2 files changed, 86 insertions(+), 30 deletions(-) commit 9744a7ab62cc7354096aaff788c08b947f86ba60 Author: Jason Gunthorpe Date: Wed Oct 25 21:39:30 2023 -0700 iommufd: Rename IOMMUFD_OBJ_HW_PAGETABLE to IOMMUFD_OBJ_HWPT_PAGING To add a new IOMMUFD_OBJ_HWPT_NESTED, rename the HWPT object to confine it to PAGING hwpts/domains. The following patch will separate the hwpt structure as well. Link: https://lore.kernel.org/r/20231026043938.63898-3-yi.l.liu@intel.com Signed-off-by: Nicolin Chen Signed-off-by: Yi Liu Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe drivers/iommu/iommufd/device.c | 10 +++++----- drivers/iommu/iommufd/hw_pagetable.c | 2 +- drivers/iommu/iommufd/iommufd_private.h | 4 ++-- drivers/iommu/iommufd/main.c | 2 +- drivers/iommu/iommufd/selftest.c | 2 +- 5 files changed, 10 insertions(+), 10 deletions(-) commit 54d606816b32401de5431f6776a78b1de135bfa2 Author: Lu Baolu Date: Wed Oct 25 21:39:29 2023 -0700 iommu: Add IOMMU_DOMAIN_NESTED Introduce a new domain type for a user I/O page table, which is nested on top of another user space address represented by a PAGING domain. This new domain can be allocated by the domain_alloc_user op, and attached to a device through the existing iommu_attach_device/group() interfaces. The mappings of a nested domain are managed by user space software, so it is not necessary to have map/unmap callbacks. Link: https://lore.kernel.org/r/20231026043938.63898-2-yi.l.liu@intel.com Signed-off-by: Lu Baolu Signed-off-by: Nicolin Chen Signed-off-by: Yi Liu Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe include/linux/iommu.h | 4 ++++ 1 file changed, 4 insertions(+) commit a977ee945e9490fabd33dcc33399e992252598cf Author: Thippeswamy Havalige Date: Tue Oct 3 23:04:51 2023 +0530 PCI: xilinx-cpm: Move IRQ definitions to a common header Move the interrupt bit definitions to the pcie-xilinx-common.h file, which then can be shared between pcie-xilinx-cpm and the new xilinx-xdma drivers. While at it, also rename them so these definitions are not CPM-specific. No functional change intended. [kwilczynski: commit log] Link: https://lore.kernel.org/linux-pci/20231003173453.938190-2-thippeswamy.havalige@amd.com Signed-off-by: Thippeswamy Havalige Signed-off-by: Bharat Kumar Gogada Signed-off-by: Krzysztof Wilczyński drivers/pci/controller/pcie-xilinx-common.h | 30 +++++++++++++++++++++++ drivers/pci/controller/pcie-xilinx-cpm.c | 38 ++++++----------------------- 2 files changed, 37 insertions(+), 31 deletions(-) commit 3eb030c60835668997d5763b1a0c7938faf169f6 Author: Herve Codina Date: Tue Oct 17 13:02:17 2023 +0200 of: address: Remove duplicated functions The recently added of_bus_default_flags_translate() performs the exact same operation as of_bus_pci_translate() and of_bus_isa_translate(). Avoid duplicated code replacing both of_bus_pci_translate() and of_bus_isa_translate() with of_bus_default_flags_translate(). Signed-off-by: Herve Codina Link: https://lore.kernel.org/r/20231017110221.189299-3-herve.codina@bootlin.com Signed-off-by: Rob Herring drivers/of/address.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) commit 42604f8eb7ba04b589375049cc76282dad4677d2 Author: Herve Codina Date: Tue Oct 17 13:02:16 2023 +0200 of: address: Fix address translation when address-size is greater than 2 With the recent addition of of_pci_prop_ranges() in commit 407d1a51921e ("PCI: Create device tree node for bridge"), the ranges property can have a 3 cells child address, a 3 cells parent address and a 2 cells child size. A range item property for a PCI device is filled as follow: 0 0 <-- Child --> <-- Parent (PCI definition) --> <- BAR size (64bit) --> This allow to translate BAR addresses from the DT. For instance: pci@0,0 { #address-cells = <0x03>; #size-cells = <0x02>; device_type = "pci"; compatible = "pci11ab,100", "pciclass,060400", "pciclass,0604"; ranges = <0x82000000 0x00 0xe8000000 0x82000000 0x00 0xe8000000 0x00 0x4400000>; ... dev@0,0 { #address-cells = <0x03>; #size-cells = <0x02>; compatible = "pci1055,9660", "pciclass,020000", "pciclass,0200"; /* Translations for BAR0 to BAR5 */ ranges = <0x00 0x00 0x00 0x82010000 0x00 0xe8000000 0x00 0x2000000 0x01 0x00 0x00 0x82010000 0x00 0xea000000 0x00 0x1000000 0x02 0x00 0x00 0x82010000 0x00 0xeb000000 0x00 0x800000 0x03 0x00 0x00 0x82010000 0x00 0xeb800000 0x00 0x800000 0x04 0x00 0x00 0x82010000 0x00 0xec000000 0x00 0x20000 0x05 0x00 0x00 0x82010000 0x00 0xec020000 0x00 0x2000>; ... pci-ep-bus@0 { #address-cells = <0x01>; #size-cells = <0x01>; compatible = "simple-bus"; /* Translate 0xe2000000 to BAR0 and 0xe0000000 to BAR1 */ ranges = <0xe2000000 0x00 0x00 0x00 0x2000000 0xe0000000 0x01 0x00 0x00 0x1000000>; ... }; }; }; During the translation process, the "default-flags" map() function is used to select the matching item in the ranges table and determine the address offset from this matching item. This map() function simply calls of_read_number() and when address-size is greater than 2, the map() function skips the extra high address part (ie part over 64bit). This lead to a wrong matching item and a wrong offset computation. Also during the translation itself, the extra high part related to the parent address is not present in the translated address. Fix the "default-flags" map() and translate() in order to take into account the child extra high address part in map() and the parent extra high address part in translate() and so having a correct address translation for ranges patterns such as the one given in the example above. Signed-off-by: Herve Codina Link: https://lore.kernel.org/r/20231017110221.189299-2-herve.codina@bootlin.com Signed-off-by: Rob Herring drivers/of/address.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) commit 1df91d85f29f4f1bf34b74e63a5df4f5943f18c1 Merge: fad5bf2e2c90 374de39d38f9 Author: Ulf Hansson Date: Thu Oct 26 16:01:03 2023 +0200 pmdomain: Merge branch fixes into next Merge the pmdomain fixes for v6.6-rc[n] into the next branch, to allow them to get tested together with the new pmdomain changes that are targeted for v6.7. Signed-off-by: Ulf Hansson commit ea41b880cc85f0a992571f66e4554a69f7806246 Author: Nikolay Aleksandrov Date: Thu Oct 26 12:41:05 2023 +0300 netkit: Remove explicit active/peer ptr initialization Remove the explicit NULLing of active/peer pointers and rely on the implicit one done at net device allocation. Suggested-by: Jiri Pirko Signed-off-by: Nikolay Aleksandrov Signed-off-by: Daniel Borkmann Reviewed-by: Jiri Pirko Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20231026094106.1505892-2-razor@blackwall.org drivers/net/netkit.c | 4 ---- 1 file changed, 4 deletions(-) commit 374de39d38f97b0e58cfee88da590b2d056ccf7f Author: Pengfei Li Date: Sat Oct 21 02:59:49 2023 +0800 pmdomain: imx: Make imx pgc power domain also set the fwnode Currently, The imx pgc power domain doesn't set the fwnode pointer, which results in supply regulator device can't get consumer imx pgc power domain device from fwnode when creating a link. This causes the driver core to instead try to create a link between the parent gpc device of imx pgc power domain device and supply regulator device. However, at this point, the gpc device has already been bound, and the link creation will fail. So adding the fwnode pointer to the imx pgc power domain device will fix this issue. Signed-off-by: Pengfei Li Tested-by: Emil Kronborg Fixes: 3fb16866b51d ("driver core: fw_devlink: Make cycle detection more robust") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20231020185949.537083-1-pengfei.li_1@nxp.com Signed-off-by: Ulf Hansson drivers/pmdomain/imx/gpc.c | 1 + 1 file changed, 1 insertion(+) commit e2b0bac1aae44d603817b55d62553f3d3557d5a7 Author: Krzysztof Kozlowski Date: Wed Oct 18 16:57:50 2023 +0200 dt-bindings: pinctrl: qcom,sa8775p-tlmm: add missing wakeup-parent Add missing wakeup-parent property, already used by DTS to indicate that pins are wakeup capable: sa8775p-ride.dtb: pinctrl@f000000: 'wakeup-parent' does not match any of the regexes: '-state$', 'pinctrl-[0-9]+' Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Reviewed-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20231018145750.429385-1-krzysztof.kozlowski@linaro.org Signed-off-by: Linus Walleij Documentation/devicetree/bindings/pinctrl/qcom,sa8775p-tlmm.yaml | 1 + 1 file changed, 1 insertion(+) commit 399f6185a1c02f39bcadb8749bc2d9d48685816f Author: Yafang Shao Date: Wed Oct 25 03:11:44 2023 +0000 selftests/bpf: Fix selftests broken by mitigations=off When we configure the kernel command line with 'mitigations=off' and set the sysctl knob 'kernel.unprivileged_bpf_disabled' to 0, the commit bc5bc309db45 ("bpf: Inherit system settings for CPU security mitigations") causes issues in the execution of `test_progs -t verifier`. This is because 'mitigations=off' bypasses Spectre v1 and Spectre v4 protections. Currently, when a program requests to run in unprivileged mode (kernel.unprivileged_bpf_disabled = 0), the BPF verifier may prevent it from running due to the following conditions not being enabled: - bypass_spec_v1 - bypass_spec_v4 - allow_ptr_leaks - allow_uninit_stack While 'mitigations=off' enables the first two conditions, it does not enable the latter two. As a result, some test cases in 'test_progs -t verifier' that were expected to fail to run may run successfully, while others still fail but with different error messages. This makes it challenging to address them comprehensively. Moreover, in the future, we may introduce more fine-grained control over CPU mitigations, such as enabling only bypass_spec_v1 or bypass_spec_v4. Given the complexity of the situation, rather than fixing each broken test case individually, it's preferable to skip them when 'mitigations=off' is in effect and introduce specific test cases for the new 'mitigations=off' scenario. For instance, we can introduce new BTF declaration tags like '__failure__nospec', '__failure_nospecv1' and '__failure_nospecv4'. In this patch, the approach is to simply skip the broken test cases when 'mitigations=off' is enabled. The result of `test_progs -t verifier` as follows after this commit, Before this commit ================== - without 'mitigations=off' - kernel.unprivileged_bpf_disabled = 2 Summary: 74/948 PASSED, 388 SKIPPED, 0 FAILED - kernel.unprivileged_bpf_disabled = 0 Summary: 74/1336 PASSED, 0 SKIPPED, 0 FAILED <<<< - with 'mitigations=off' - kernel.unprivileged_bpf_disabled = 2 Summary: 74/948 PASSED, 388 SKIPPED, 0 FAILED - kernel.unprivileged_bpf_disabled = 0 Summary: 63/1276 PASSED, 0 SKIPPED, 11 FAILED <<<< 11 FAILED After this commit ================= - without 'mitigations=off' - kernel.unprivileged_bpf_disabled = 2 Summary: 74/948 PASSED, 388 SKIPPED, 0 FAILED - kernel.unprivileged_bpf_disabled = 0 Summary: 74/1336 PASSED, 0 SKIPPED, 0 FAILED <<<< - with this patch, with 'mitigations=off' - kernel.unprivileged_bpf_disabled = 2 Summary: 74/948 PASSED, 388 SKIPPED, 0 FAILED - kernel.unprivileged_bpf_disabled = 0 Summary: 74/948 PASSED, 388 SKIPPED, 0 FAILED <<<< SKIPPED Fixes: bc5bc309db45 ("bpf: Inherit system settings for CPU security mitigations") Reported-by: Alexei Starovoitov Signed-off-by: Yafang Shao Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Closes: https://lore.kernel.org/bpf/CAADnVQKUBJqg+hHtbLeeC2jhoJAWqnmRAzXW3hmUCNSV9kx4sQ@mail.gmail.com Link: https://lore.kernel.org/bpf/20231025031144.5508-1-laoar.shao@gmail.com tools/testing/selftests/bpf/unpriv_helpers.c | 33 +++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) commit 37db10bc247d5d0b448babd7ff386f092246e732 Author: Viktor Malik Date: Wed Oct 25 08:19:14 2023 +0200 samples/bpf: Allow building with custom bpftool samples/bpf build its own bpftool boostrap to generate vmlinux.h as well as some BPF objects. This is a redundant step if bpftool has been already built, so update samples/bpf/Makefile such that it accepts a path to bpftool passed via the BPFTOOL variable. The approach is practically the same as tools/testing/selftests/bpf/Makefile uses. Signed-off-by: Viktor Malik Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/bd746954ac271b02468d8d951ff9f11e655d485b.1698213811.git.vmalik@redhat.com samples/bpf/Makefile | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit f56bcfadf7d6d56b099726df4fc262b76486b0e0 Author: Viktor Malik Date: Wed Oct 25 08:19:13 2023 +0200 samples/bpf: Fix passing LDFLAGS to libbpf samples/bpf/Makefile passes LDFLAGS=$(TPROGS_LDFLAGS) to libbpf build without surrounding quotes, which may cause compilation errors when passing custom TPROGS_USER_LDFLAGS. For example: $ make -C samples/bpf/ TPROGS_USER_LDFLAGS="-Wl,--as-needed -specs=/usr/lib/gcc/x86_64-redhat-linux/13/libsanitizer.spec" make: Entering directory './samples/bpf' make -C ../../ M=./samples/bpf BPF_SAMPLES_PATH=./samples/bpf make[1]: Entering directory '.' make -C ./samples/bpf/../../tools/lib/bpf RM='rm -rf' EXTRA_CFLAGS="-Wall -O2 -Wmissing-prototypes -Wstrict-prototypes -I./usr/include -I./tools/testing/selftests/bpf/ -I./samples/bpf/libbpf/include -I./tools/include -I./tools/perf -I./tools/lib -DHAVE_ATTR_TEST=0" \ LDFLAGS=-Wl,--as-needed -specs=/usr/lib/gcc/x86_64-redhat-linux/13/libsanitizer.spec srctree=./samples/bpf/../../ \ O= OUTPUT=./samples/bpf/libbpf/ DESTDIR=./samples/bpf/libbpf prefix= \ ./samples/bpf/libbpf/libbpf.a install_headers make: invalid option -- 'c' make: invalid option -- '=' make: invalid option -- '/' make: invalid option -- 'u' make: invalid option -- '/' [...] Fix the error by properly quoting $(TPROGS_LDFLAGS). Suggested-by: Donald Zickus Signed-off-by: Viktor Malik Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/c690de6671cc6c983d32a566d33fd7eabd18b526.1698213811.git.vmalik@redhat.com samples/bpf/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 870f09f1ba3014e2c157b14299c172b4bb716638 Author: Viktor Malik Date: Wed Oct 25 08:19:12 2023 +0200 samples/bpf: Allow building with custom CFLAGS/LDFLAGS Currently, it is not possible to specify custom flags when building samples/bpf. The flags are defined in TPROGS_CFLAGS/TPROGS_LDFLAGS variables, however, when trying to override those from the make command, compilation fails. For example, when trying to build with PIE: $ make -C samples/bpf TPROGS_CFLAGS="-fpie" TPROGS_LDFLAGS="-pie" This is because samples/bpf/Makefile updates these variables, especially appends include paths to TPROGS_CFLAGS and these updates are overridden by setting the variables from the make command. This patch introduces variables TPROGS_USER_CFLAGS/TPROGS_USER_LDFLAGS for this purpose, which can be set from the make command and their values are propagated to TPROGS_CFLAGS/TPROGS_LDFLAGS. Signed-off-by: Viktor Malik Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/2d81100b830a71f0e72329cc7781edaefab75f62.1698213811.git.vmalik@redhat.com samples/bpf/Makefile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 7dc5a2779f84c3b822789b8423ebb70fcd8dc89c Author: Helen Koike Date: Mon Oct 23 21:45:25 2023 -0300 drm/ci: docs: add step about how to request privileges Clarify the procedure developer must follow to request privileges to run tests on Freedesktop gitlab CI. This measure was added to avoid untrusted people to misuse the infrastructure. Signed-off-by: Helen Koike Reviewed-by: David Heidelberg Link: https://lore.kernel.org/r/20231024004525.169002-11-helen.koike@collabora.com Signed-off-by: Maxime Ripard Documentation/gpu/automated_testing.rst | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit c2cdbb7a30fe6ff43c1a068121ba332f7399ed54 Author: Helen Koike Date: Mon Oct 23 21:45:24 2023 -0300 drm/ci: do not automatically retry on error Since the kernel doesn't use a bot like Mesa that requires tests to pass in order to merge the patches, leave it to developers and/or maintainers to manually retry. Suggested-by: Rob Clark Signed-off-by: Helen Koike Reviewed-by: David Heidelberg Link: https://lore.kernel.org/r/20231024004525.169002-10-helen.koike@collabora.com Signed-off-by: Maxime Ripard drivers/gpu/drm/ci/gitlab-ci.yml | 14 -------------- 1 file changed, 14 deletions(-) commit 80b6434b57a137afa965dc762716c30938b4e6bf Author: Helen Koike Date: Mon Oct 23 21:45:23 2023 -0300 drm/ci: export kernel config Export the resultant kernel config, making it easier to verify if the resultant config was correctly generated. Suggested-by: Rob Clark Signed-off-by: Helen Koike Acked-by: Dmitry Baryshkov Reviewed-by: David Heidelberg Link: https://lore.kernel.org/r/20231024004525.169002-9-helen.koike@collabora.com Signed-off-by: Maxime Ripard drivers/gpu/drm/ci/build.sh | 1 + drivers/gpu/drm/ci/image-tags.yml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) commit 5fa8f128462c5b3b20576b12286dca7fe95b3af1 Author: Helen Koike Date: Mon Oct 23 21:45:22 2023 -0300 drm/ci: increase i915 job timeout to 1h30m With the new sharding, the default job timeout is not enough for i915 and their jobs are failing before completing. See below the current execution time: 🞋 job i915:tgl 8/8 has new status: success (37m3s) 🞋 job i915:tgl 7/8 has new status: success (19m43s) 🞋 job i915:tgl 6/8 has new status: success (21m47s) 🞋 job i915:tgl 5/8 has new status: success (18m16s) 🞋 job i915:tgl 4/8 has new status: success (21m43s) 🞋 job i915:tgl 3/8 has new status: success (17m59s) 🞋 job i915:tgl 2/8 has new status: success (22m15s) 🞋 job i915:tgl 1/8 has new status: success (18m52s) 🞋 job i915:cml 2/2 has new status: success (1h19m58s) 🞋 job i915:cml 1/2 has new status: success (55m45s) 🞋 job i915:whl 2/2 has new status: success (1h8m56s) 🞋 job i915:whl 1/2 has new status: success (54m3s) 🞋 job i915:kbl 3/3 has new status: success (37m43s) 🞋 job i915:kbl 2/3 has new status: success (36m37s) 🞋 job i915:kbl 1/3 has new status: success (34m52s) 🞋 job i915:amly 2/2 has new status: success (1h7m60s) 🞋 job i915:amly 1/2 has new status: success (59m18s) 🞋 job i915:glk 2/2 has new status: success (58m26s) 🞋 job i915:glk 1/2 has new status: success (50m23s) 🞋 job i915:apl 3/3 has new status: success (1h6m39s) 🞋 job i915:apl 2/3 has new status: success (1h4m45s) 🞋 job i915:apl 1/3 has new status: success (1h7m38s) (generated with ci_run_n_monitor.py script) The longest job is 1h19m58s, so adjust the timeout. Signed-off-by: Helen Koike Link: https://lore.kernel.org/r/20231024004525.169002-8-helen.koike@collabora.com Signed-off-by: Maxime Ripard drivers/gpu/drm/ci/test.yml | 5 +++++ 1 file changed, 5 insertions(+) commit 68a3f17732d1d72be958576b6ce0e6c29686a40b Author: Helen Koike Date: Mon Oct 23 21:45:21 2023 -0300 drm/ci: add subset-1-gfx to LAVA_TAGS and adjust shards The Collabora Lava farm added a tag called `subset-1-gfx` to half of devices the graphics community use. Lets use this tag so we don't occupy all the resources. This is particular important because Mesa3D shares the resources with DRM-CI and use them to do pre-merge tests, so it can block developers from getting their patches merged. Signed-off-by: Helen Koike Reviewed-by: David Heidelberg Link: https://lore.kernel.org/r/20231024004525.169002-7-helen.koike@collabora.com Signed-off-by: Maxime Ripard drivers/gpu/drm/ci/gitlab-ci.yml | 2 +- drivers/gpu/drm/ci/test.yml | 23 ++++++++++++++--------- 2 files changed, 15 insertions(+), 10 deletions(-) commit 81224d948ceb8433eb25fe33528b0696f1fcfc42 Author: Helen Koike Date: Mon Oct 23 21:45:20 2023 -0300 drm/ci: clean up xfails (specially flakes list) Since the script that collected the list of the expectation files was bogus and placing test to the flakes list incorrectly, restart the expectation files with the correct script. This reduces a lot the number of tests in the flakes list. Signed-off-by: Helen Koike Reviewed-by: David Heidelberg Link: https://lore.kernel.org/r/20231024004525.169002-6-helen.koike@collabora.com Signed-off-by: Maxime Ripard drivers/gpu/drm/ci/xfails/amdgpu-stoney-fails.txt | 12 +++++-- drivers/gpu/drm/ci/xfails/amdgpu-stoney-flakes.txt | 20 ----------- drivers/gpu/drm/ci/xfails/i915-amly-fails.txt | 9 +++++ drivers/gpu/drm/ci/xfails/i915-amly-flakes.txt | 32 ----------------- drivers/gpu/drm/ci/xfails/i915-apl-fails.txt | 11 ------ drivers/gpu/drm/ci/xfails/i915-apl-flakes.txt | 1 - drivers/gpu/drm/ci/xfails/i915-cml-fails.txt | 14 +++++++- drivers/gpu/drm/ci/xfails/i915-cml-flakes.txt | 38 -------------------- drivers/gpu/drm/ci/xfails/i915-glk-fails.txt | 17 +++++++++ drivers/gpu/drm/ci/xfails/i915-glk-flakes.txt | 41 ---------------------- drivers/gpu/drm/ci/xfails/i915-kbl-fails.txt | 7 ++++ drivers/gpu/drm/ci/xfails/i915-kbl-flakes.txt | 25 ------------- drivers/gpu/drm/ci/xfails/i915-tgl-fails.txt | 1 - drivers/gpu/drm/ci/xfails/i915-tgl-flakes.txt | 5 --- drivers/gpu/drm/ci/xfails/i915-whl-flakes.txt | 1 - .../gpu/drm/ci/xfails/mediatek-mt8173-flakes.txt | 0 .../gpu/drm/ci/xfails/mediatek-mt8183-fails.txt | 5 ++- .../gpu/drm/ci/xfails/mediatek-mt8183-flakes.txt | 14 -------- drivers/gpu/drm/ci/xfails/meson-g12b-fails.txt | 14 +++++--- drivers/gpu/drm/ci/xfails/meson-g12b-flakes.txt | 4 --- drivers/gpu/drm/ci/xfails/msm-apq8016-flakes.txt | 4 --- drivers/gpu/drm/ci/xfails/msm-apq8096-fails.txt | 2 ++ drivers/gpu/drm/ci/xfails/msm-apq8096-flakes.txt | 4 --- drivers/gpu/drm/ci/xfails/msm-sc7180-fails.txt | 15 +++++--- drivers/gpu/drm/ci/xfails/msm-sc7180-flakes.txt | 24 +++++++++---- drivers/gpu/drm/ci/xfails/msm-sc7180-skips.txt | 18 +--------- drivers/gpu/drm/ci/xfails/msm-sdm845-fails.txt | 9 ++--- drivers/gpu/drm/ci/xfails/msm-sdm845-flakes.txt | 19 +++++----- .../gpu/drm/ci/xfails/rockchip-rk3288-fails.txt | 6 ++++ .../gpu/drm/ci/xfails/rockchip-rk3288-flakes.txt | 9 ----- .../gpu/drm/ci/xfails/rockchip-rk3399-fails.txt | 40 ++++++++++++++++++++- .../gpu/drm/ci/xfails/rockchip-rk3399-flakes.txt | 28 ++++----------- .../gpu/drm/ci/xfails/virtio_gpu-none-flakes.txt | 0 33 files changed, 162 insertions(+), 287 deletions(-) commit 57e3cd26c14bc53666f9cbaaca000fdcbff9ee5b Author: Helen Koike Date: Mon Oct 23 21:45:19 2023 -0300 drm/ci: uprev IGT and make sure core_getversion is run IGT has recently merged a patch that makes code_getversion test to fails if the driver isn't loaded or if it isn't the expected one defined in variable IGT_FORCE_DRIVER. Without this test, jobs were passing when the driver didn't load or probe for some reason, giving the illusion that everything was ok. Uprev IGT to include this modification and include core_getversion test in all the shards. Signed-off-by: Helen Koike Reviewed-by: David Heidelberg Link: https://lore.kernel.org/r/20231024004525.169002-5-helen.koike@collabora.com Signed-off-by: Maxime Ripard drivers/gpu/drm/ci/gitlab-ci.yml | 2 +- drivers/gpu/drm/ci/igt_runner.sh | 31 ++++++++++++++++++++++++------- drivers/gpu/drm/ci/image-tags.yml | 2 +- 3 files changed, 26 insertions(+), 9 deletions(-) commit d70896f296ff24764a7ba90efe1afa6c680e104c Author: Helen Koike Date: Mon Oct 23 21:45:18 2023 -0300 drm/ci: add helper script update-xfails.py Add helper script that given a gitlab pipeline url, analyse which are the failures and flakes and update the xfails folder accordingly. Example: Trigger a pipeline in gitlab infrastructure, than re-try a few jobs more than once (so we can have data if failures are consistent across jobs with the same name or if they are flakes) and execute: update-xfails.py https://gitlab.freedesktop.org/helen.fornazier/linux/-/pipelines/970661 git diff should show you that it updated files in xfails folder. Signed-off-by: Helen Koike Tested-by: Vignesh Raman Reviewed-by: David Heidelberg Link: https://lore.kernel.org/r/20231024004525.169002-4-helen.koike@collabora.com Signed-off-by: Maxime Ripard drivers/gpu/drm/ci/xfails/requirements.txt | 17 +++ drivers/gpu/drm/ci/xfails/update-xfails.py | 204 +++++++++++++++++++++++++++++ 2 files changed, 221 insertions(+) commit 2b126e065ea0cea6cac2aa6c9b9d3ec014a006c9 Author: Helen Koike Date: Mon Oct 23 21:45:17 2023 -0300 drm/ci: fix DEBIAN_ARCH and get amdgpu probing amdgpu driver wasn't loading because amdgpu firmware wasn't being installed in the rootfs due to the wrong DEBIAN_ARCH variable. rename ARCH to DEBIAN_ARCH also, so we don't have the confusing DEBIAN_ARCH, KERNEL_ARCH and ARCH. Signed-off-by: Helen Koike Reviewed-by: David Heidelberg Link: https://lore.kernel.org/r/20231024004525.169002-3-helen.koike@collabora.com Signed-off-by: Maxime Ripard drivers/gpu/drm/ci/build.sh | 2 +- drivers/gpu/drm/ci/image-tags.yml | 4 ++-- drivers/gpu/drm/ci/lava-submit.sh | 4 ++-- drivers/gpu/drm/ci/test.yml | 6 +++--- 4 files changed, 8 insertions(+), 8 deletions(-) commit 1887de00867d7a700babefc9647ccb9e0d11ee56 Author: Helen Koike Date: Mon Oct 23 21:45:16 2023 -0300 drm/ci: uprev mesa version: fix container build & crosvm When building containers, some rust packages were installed without locking the dependencies version, which got updated and started giving errors like: error: failed to compile `bindgen-cli v0.62.0`, intermediate artifacts can be found at `/tmp/cargo-installkNKRwf` Caused by: package `rustix v0.38.13` cannot be built because it requires rustc 1.63 or newer, while the currently active rustc version is 1.60.0 A patch to Mesa was added fixing this error, so update it. Also, commit in linux kernel 6.6 rc3 broke booting in crosvm. Mesa has upreved crosvm to fix this issue. Signed-off-by: Helen Koike [crosvm mesa update] Co-Developed-by: Vignesh Raman Signed-off-by: Vignesh Raman [v1 container build uprev] Tested-by: Jessica Zhang Acked-by: Jessica Zhang Reviewed-by: David Heidelberg Link: https://lore.kernel.org/r/20231024004525.169002-2-helen.koike@collabora.com Signed-off-by: Maxime Ripard drivers/gpu/drm/ci/build.yml | 1 + drivers/gpu/drm/ci/gitlab-ci.yml | 20 +++++++++++++++++++- drivers/gpu/drm/ci/image-tags.yml | 2 +- drivers/gpu/drm/ci/lava-submit.sh | 2 +- 4 files changed, 22 insertions(+), 3 deletions(-) commit b829e932eeef272c1d898cc316ce9abcc041b4c1 Author: Rob Clark Date: Mon Oct 2 09:47:14 2023 -0700 drm/ci: Enable CONFIG_BACKLIGHT_CLASS_DEVICE Dependency for CONFIG_DRM_PANEL_EDP. Missing this was causing the drm driver to not probe on devices that use panel-edp. Signed-off-by: Rob Clark Tested-by: Helen Koike Acked-by: Helen Koike Link: https://lore.kernel.org/r/20231002164715.157298-1-robdclark@gmail.com Signed-off-by: Maxime Ripard drivers/gpu/drm/ci/arm.config | 1 + drivers/gpu/drm/ci/arm64.config | 1 + 2 files changed, 2 insertions(+) commit b1abb484417ec8edd68df0c9bf8cb1c1fc035fd2 Author: Dmitry Baryshkov Date: Sun Oct 8 16:23:20 2023 +0300 drm/ci: force-enable CONFIG_MSM_MMCC_8996 as built-in Enable CONFIG_MSM_MMCC_8996, the multimedia clock controller on Qualcomm MSM8996 to prevent the the board from hitting the probe deferral timeouts in CI run. Signed-off-by: Dmitry Baryshkov Tested-by: Helen Koike Acked-by: Helen Koike Link: https://lore.kernel.org/r/20231008132320.762542-2-dmitry.baryshkov@linaro.org Signed-off-by: Maxime Ripard drivers/gpu/drm/ci/arm64.config | 1 + 1 file changed, 1 insertion(+) commit f9b4fbcb4567ed5fc4af76b5ef82b71417ff9adf Author: Dmitry Baryshkov Date: Sun Oct 8 16:23:19 2023 +0300 drm/ci: pick up -external-fixes from the merge target repo In case of the merge requests it might be useful to push repo-specific fixes which have not yet propagated to the -external-fixes branch in the main UPSTREAM_REPO. For example, in case of drm/msm development, we are staging fixes locally for testing, before pushing them to the drm/drm repo. Thus, if the CI run was triggered by merge request, also pick up the -external fixes basing on the the CI_MERGE target repo / and branch. Signed-off-by: Dmitry Baryshkov Acked-by: Helen Koike Link: https://lore.kernel.org/r/20231008132320.762542-1-dmitry.baryshkov@linaro.org Signed-off-by: Maxime Ripard drivers/gpu/drm/ci/build.sh | 5 +++++ 1 file changed, 5 insertions(+) commit ef113733c288eccadc105579b8e8c1bfdcc09ad1 Author: Beniamino Galvani Date: Wed Oct 25 11:44:41 2023 +0200 bareudp: use ports to lookup route The source and destination ports should be taken into account when determining the route destination; they can affect the result, for example in case there are routing rules defined. Signed-off-by: Beniamino Galvani Reviewed-by: Przemek Kitszel Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20231025094441.417464-1-b.galvani@gmail.com Signed-off-by: Paolo Abeni drivers/net/bareudp.c | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) commit bf224871c27a7c7e2146d667176977ffe3752750 Merge: 78b1f56a6f96 ffc843fc9c7a a60ec4485f1c e68cb15bdc93 Author: Rafael J. Wysocki Date: Thu Oct 26 15:16:03 2023 +0200 Merge branches 'pm-sleep', 'powercap' and 'pm-tools' Merge updates related to system sleep handling, one power capping update and one PM utility update for 6.7-rc1: - Use __get_safe_page() rather than touching the list in hibernation snapshot code (Brian Geffon). - Fix symbol export for _SIMPLE_ variants of _PM_OPS() (Raag Jadav). - Clean up sync_read handling in snapshot_write_next() (Brian Geffon). - Fix kerneldoc comments for swsusp_check() and swsusp_close() to better match code (Christoph Hellwig). - Downgrade BIOS locked limits pr_warn() in the Intel RAPL power capping driver to pr_debug() (Ville Syrjälä). - Change the minimum python version for the intel_pstate_tracer utility from 2.7 to 3.6 (Doug Smythies). * pm-sleep: PM: hibernate: fix the kerneldoc comment for swsusp_check() and swsusp_close() PM: hibernate: Clean up sync_read handling in snapshot_write_next() PM: sleep: Fix symbol export for _SIMPLE_ variants of _PM_OPS() PM: hibernate: Use __get_safe_page() rather than touching the list * powercap: powercap: intel_rapl: Downgrade BIOS locked limits pr_warn() to pr_debug() * pm-tools: tools/power/x86/intel_pstate_tracer: python minimum version commit 78b1f56a6f9623d5ac42dc2e9860a58273e8ccae Merge: c1bdc9aaf8d0 7c35584899ff Author: Rafael J. Wysocki Date: Thu Oct 26 15:14:38 2023 +0200 Merge branch 'pm-cpufreq' Merge cpufreq updates for 6.7-rc1: - Add support for several Qualcomm SoC versions and other similar changes (Christian Marangi, Dmitry Baryshkov, Luca Weiss, Neil Armstrong, Richard Acayan, Robert Marko, Rohit Agarwal, Stephan Gerhold and Varadarajan Narayanan). - Clean up the tegra cpufreq driver (Sumit Gupta). - Use of_property_read_reg() to parse "reg" in pmac32 driver (Rob Herring). - Add support for TI's am62p5 Soc (Bryan Brattlof). - Make ARM_BRCMSTB_AVS_CPUFREQ depends on !ARM_SCMI_CPUFREQ (Florian Fainelli). - Update Kconfig to mention i.MX7 as well (Alexander Stein). - Revise global turbo disable check in intel_pstate (Srinivas Pandruvada). - Carry out initialization of sg_cpu in the schedutil cpufreq governor in one loop (Liao Chang). - Simplify the condition for storing 'down_threshold' in the conservative cpufreq governor (Liao Chang). - Use fine-grained mutex in the userspace cpufreq governor (Liao Chang). - Move is_managed indicator in the userspace cpufreq governor into a per-policy structure (Liao Chang). - Rebuild sched-domains when removing cpufreq driver (Pierre Gondois). - Fix buffer overflow detection in trans_stats() (Christian Marangi). * pm-cpufreq: (32 commits) dt-bindings: cpufreq: qcom-hw: document SM8650 CPUFREQ Hardware cpufreq: arm: Kconfig: Add i.MX7 to supported SoC for ARM_IMX_CPUFREQ_DT cpufreq: qcom-nvmem: add support for IPQ8064 cpufreq: qcom-nvmem: also accept operating-points-v2-krait-cpu cpufreq: qcom-nvmem: drop pvs_ver for format a fuses dt-bindings: cpufreq: qcom-cpufreq-nvmem: Document krait-cpu cpufreq: qcom-nvmem: add support for IPQ6018 dt-bindings: cpufreq: qcom-cpufreq-nvmem: document IPQ6018 cpufreq: qcom-nvmem: Add MSM8909 cpufreq: qcom-nvmem: Simplify driver data allocation cpufreq: stats: Fix buffer overflow detection in trans_stats() dt-bindings: cpufreq: cpufreq-qcom-hw: Add SDX75 compatible cpufreq: ARM_BRCMSTB_AVS_CPUFREQ cannot be used with ARM_SCMI_CPUFREQ cpufreq: ti-cpufreq: Add opp support for am62p5 SoCs cpufreq: dt-platdev: add am62p5 to blocklist cpufreq: tegra194: remove redundant AND with cpu_online_mask cpufreq: tegra194: use refclk delta based loop instead of udelay cpufreq: tegra194: save CPU data to avoid repeated SMP calls cpufreq: Rebuild sched-domains when removing cpufreq driver cpufreq: userspace: Move is_managed indicator into per-policy structure ... commit c1bdc9aaf8d05e12c80f6cbd26f187f29fbe163a Merge: 067e61399d3d af6664668de9 Author: Rafael J. Wysocki Date: Thu Oct 26 15:13:00 2023 +0200 Merge branch 'pm-devfreq' Merge devfreq updates for 6.7-rc1: - Switch to dev_pm_opp_find_freq_(ceil/floor)_indexed() APIs to support specific devices like UFS which handle multiple clocks through OPP (Operationg Performance Point) framework (Manivannan Sadhasivam). - Add perf support to the Rockchip DFI (DDR Monitor Module) devfreq- event driver: * Generalize rockchip-dfi.c to support new RK3568/RK3588 using different DDR type (Sascha Hauer). * Convert devicetree bidning document format to yaml (Sascha Hauer). * Add perf support for DFI (a unit suitable for measuring DDR utilization) to rockchip-dfi.c to extend DFI usage (Sascha Hauer). - Add locking to the OPP handling code in the Mediatek CCI devfreq driver, because the voltage of shared OPP might be changed by multiple drivers (Mark Tseng, Dan Carpenter). - Use device_get_match_data() in the Samsung Exynos PPMU devfreq-event driver (Rob Herring). * pm-devfreq: (26 commits) dt-bindings: devfreq: event: rockchip,dfi: Add rk3588 support dt-bindings: devfreq: event: rockchip,dfi: Add rk3568 support dt-bindings: devfreq: event: convert Rockchip DFI binding to yaml PM / devfreq: rockchip-dfi: add support for RK3588 PM / devfreq: rockchip-dfi: account for multiple DDRMON_CTRL registers PM / devfreq: rockchip-dfi: make register stride SoC specific PM / devfreq: rockchip-dfi: Add perf support PM / devfreq: rockchip-dfi: give variable a better name PM / devfreq: rockchip-dfi: Prepare for multiple users PM / devfreq: rockchip-dfi: Pass private data struct to internal functions PM / devfreq: rockchip-dfi: Handle LPDDR4X PM / devfreq: rockchip-dfi: Handle LPDDR2 correctly PM / devfreq: rockchip-dfi: Add RK3568 support PM / devfreq: rockchip-dfi: Clean up DDR type register defines PM / devfreq: rk3399_dmc,dfi: generalize DDRTYPE defines PM / devfreq: rockchip-dfi: introduce channel mask PM / devfreq: rockchip-dfi: Use free running counter PM / devfreq: mediatek: unlock on error in mtk_ccifreq_target() PM / devfreq: exynos-ppmu: Use device_get_match_data() PM / devfreq: rockchip-dfi: dfi store raw values in counter struct ... commit f4cb34a75e4a4aee09ff832ea2147cf8322a6a7f Merge: 3660e641ef68 c7b59371fe56 5ccd40c5c7ad 50cbdaf1b93a Author: Rafael J. Wysocki Date: Thu Oct 26 15:06:01 2023 +0200 Merge branches 'acpi-ac', 'acpi-pad' and 'pnp' Merge updates of the ACPI AC and ACPI PAD drivers and PNP updates for 6.7-rc1: - Switch over the ACPI AC and ACPI PAD drivers to using the platform driver interface which, is more logically consistent than binding a driver directly to an ACPI device object, and clean them up (Michal Wilczynski). - Replace strncpy() in the PNP code with either memcpy() or strscpy() as appropriate (Justin Stitt). - Clean up coding style in pnp.h (GuoHua Cheng). * acpi-ac: ACPI: AC: Rename ACPI device from device to adev ACPI: AC: Replace acpi_driver with platform_driver ACPI: AC: Use string_choices API instead of ternary operator ACPI: AC: Remove redundant checks * acpi-pad: ACPI: acpi_pad: Rename ACPI device from device to adev ACPI: acpi_pad: Use dev groups for sysfs ACPI: acpi_pad: Replace acpi_driver with platform_driver * pnp: PNP: replace deprecated strncpy() with memcpy() PNP: ACPI: replace deprecated strncpy() with strscpy() PNP: Clean up coding style in pnp.h commit 3660e641ef68dc2503e3c3120814e80359e0e66b Merge: e8c3c7f97aa7 470508f63ad2 Author: Rafael J. Wysocki Date: Thu Oct 26 15:04:49 2023 +0200 Merge branch 'acpi-bus' Merge ACPI bus type driver updates for 6.7-rc1: - Add context argument to acpi_dev_install_notify_handler() (Rafael Wysocki). - Clarify ACPI bus concepts in the ACPI device enumeration documentation (Rafael Wysocki). * acpi-bus: ACPI: bus: Add context argument to acpi_dev_install_notify_handler() ACPI: docs: enumeration: Clarify ACPI bus concepts commit 6a2e332c2cbddd17d7dcb8f334953593f1324c8e Author: Mark Brown Date: Mon Oct 23 18:19:12 2023 +0100 regmap: kunit: Add test for cache sync interaction with ranges Hector Martin reports that since when doing a cache sync we enable cache bypass if the selector register for a range is cached then we might leave the physical selector register pointing to a different value to that which we have in the cache. If we then try to write to the page that our cache tells us is selected we will not update the selector register and write to the wrong page. Add a test case covering this. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20231023-regmap-test-window-cache-v1-2-d8a71f441968@kernel.org Signed-off-by: Mark Brown drivers/base/regmap/regmap-kunit.c | 66 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 64 insertions(+), 2 deletions(-) commit fabe32cc1eca7857837abcb56b242bc4845b7067 Author: Mark Brown Date: Mon Oct 23 18:19:11 2023 +0100 regmap: kunit: Fix marking of the range window as volatile For some reason the regmap used for testing ranges was not including the end of the range of paged registers as volatile since it found the end by counting from the selector register rather than the base of the window. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20231023-regmap-test-window-cache-v1-1-d8a71f441968@kernel.org Signed-off-by: Mark Brown drivers/base/regmap/regmap-kunit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e8c3c7f97aa79c93713aecba5bdf83273076cf5d Merge: f3c0d6a1a25f 891ddc03e2f4 bc8f7abe9715 553921875ff7 6fdba3db1480 Author: Rafael J. Wysocki Date: Thu Oct 26 14:59:52 2023 +0200 Merge branches 'acpi-ec', 'acpi-sysfs', 'acpi-misc' and 'acpi-uid' Merge ACPI EC driver updates, ACPI sysfs interface updates, misc updates related to ACPI and changes related to ACPI _UID handling for 6.7-rc1: - Add EC GPE detection quirk for HP 250 G7 Notebook PC (Jonathan Denose). - Fix and clean up create_pnp_modalias() and create_of_modalias() (Christophe JAILLET). - Modify 2 pieces of code to use acpi_evaluate_dsm_typed() (Andy Shevchenko). - Define acpi_dev_uid_match() for matching _UID and use it in several places (Raag Jadav). - Use acpi_device_uid() for fetching _UID in 2 places (Raag Jadav). * acpi-ec: ACPI: EC: Add quirk for HP 250 G7 Notebook PC * acpi-sysfs: ACPI: sysfs: Clean up create_pnp_modalias() and create_of_modalias() ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() * acpi-misc: ACPI: x86: s2idle: Switch to use acpi_evaluate_dsm_typed() ACPI: PCI: Switch to use acpi_evaluate_dsm_typed() * acpi-uid: perf: arm_cspmu: use acpi_dev_hid_uid_match() for matching _HID and _UID ACPI: x86: use acpi_dev_uid_match() for matching _UID ACPI: utils: use acpi_dev_uid_match() for matching _UID pinctrl: intel: use acpi_dev_uid_match() for matching _UID ACPI: utils: Introduce acpi_dev_uid_match() for matching _UID perf: qcom: use acpi_device_uid() for fetching _UID ACPI: sysfs: use acpi_device_uid() for fetching _UID commit f3c0d6a1a25f24421aa0554da52cd2158cd162dc Merge: ea4007528c8a 35a341c9b25d 2e89345764c6 fac475aab70b aa2e505c80ba Author: Rafael J. Wysocki Date: Thu Oct 26 14:58:20 2023 +0200 Merge branches 'acpi-video', 'acpi-prm', 'acpi-apei' and 'acpi-pcc' Merge ACPI backlight driver updates, ACPI APEI updates, ACPI PRM updates and changes related to ACPI PCC for 6.7-rc1: - Add acpi_backlight=vendor quirk for Toshiba Portégé R100 (Ondrej Zary). - Add "vendor" backlight quirks for 3 Lenovo x86 Android tablets (Hans de Goede). - Move Xiaomi Mi Pad 2 backlight quirk to its own section (Hans de Goede). - Annotate struct prm_module_info with __counted_by (Kees Cook). - Fix AER info corruption in aer_recover_queue() when error status data has multiple sections (Shiju Jose). - Make APEI use ERST max execution time value for slow devices (Jeshua Smith). - Add support for platform notification handling to the PCC mailbox driver and modify it to support shared interrupts for multiple subspaces (Huisong Li). - Define common macros to use when referring to various bitfields in the PCC generic communications channel command and status fields and use them in some drivers (Sudeep Holla). * acpi-video: ACPI: video: Add acpi_backlight=vendor quirk for Toshiba Portégé R100 ACPI: video: Add "vendor" quirks for 3 Lenovo x86 Android tablets ACPI: video: Move Xiaomi Mi Pad 2 quirk to its own section * acpi-prm: ACPI: PRM: Annotate struct prm_module_info with __counted_by * acpi-apei: ACPI: APEI: Use ERST timeout for slow devices ACPI: APEI: Fix AER info corruption when error status data has multiple sections * acpi-pcc: soc: kunpeng_hccs: Migrate to use generic PCC shmem related macros hwmon: (xgene) Migrate to use generic PCC shmem related macros i2c: xgene-slimpro: Migrate to use generic PCC shmem related macros ACPI: PCC: Add PCC shared memory region command and status bitfields mailbox: pcc: Support shared interrupt for multiple subspaces mailbox: pcc: Add support for platform notification handling commit ea4007528c8a2645630b19dfeacc3d4321a1860b Merge: 93003de27a5e 6b54bdd1685a 0da9eccde327 43451c4bf9b0 bda3df10fb1e Author: Rafael J. Wysocki Date: Thu Oct 26 14:55:04 2023 +0200 Merge branches 'acpi-utils', 'acpi-resource', 'acpi-property' and 'acpi-soc' Merge ACPI utilities updates, ACPI resource management updates, ACPI device properties management updates and ACPI LPSS (Intel SoC) driver update for 6.7-rc1: - Rework acpi_handle_list handling so as to manage it dynamically, including size computation (Rafael Wysocki). - Clean up ACPI utilities code so as to make it follow the kernel coding style (Jonathan Bergh). - Consolidate IRQ trigger-type override DMI tables and drop .ident values from dmi_system_id tables used for ACPI resources management quirks (Hans de Goede). - Add ACPI IRQ override for TongFang GMxXGxx (Werner Sembach). - Allow _DSD buffer data only for byte accessors and document the _DSD data buffer GUID (Andy Shevchenko). - Drop BayTrail and Lynxpoint pinctrl device IDs from the ACPI LPSS driver, because it does not need them (Raag Jadav). * acpi-utils: ACPI: utils: Remove redundant braces around individual statement ACPI: utils: Fix up white space in a few places ACPI: utils: Dynamically determine acpi_handle_list size ACPI: thermal: Merge trip initialization functions ACPI: thermal: Collapse trip devices update function wrappers ACPI: thermal: Collapse trip devices update functions ACPI: thermal: Add device list to struct acpi_thermal_trip ACPI: thermal: Fix a small leak in acpi_thermal_add() ACPI: thermal: Drop valid flag from struct acpi_thermal_trip ACPI: thermal: Drop redundant trip point flags ACPI: thermal: Untangle initialization and updates of active trips ACPI: thermal: Untangle initialization and updates of the passive trip ACPI: thermal: Simplify critical and hot trips representation ACPI: thermal: Create and populate trip points table earlier ACPI: thermal: Determine the number of trip points earlier ACPI: thermal: Fold acpi_thermal_get_info() into its caller ACPI: thermal: Simplify initialization of critical and hot trips * acpi-resource: ACPI: resource: Do IRQ override on TongFang GMxXGxx ACPI: resource: Drop .ident values from dmi_system_id tables ACPI: resource: Consolidate IRQ trigger-type override DMI tables * acpi-property: ACPI: property: Document the _DSD data buffer GUID ACPI: property: Allow _DSD buffer data only for byte accessors * acpi-soc: ACPI: LPSS: drop BayTrail and Lynxpoint pinctrl HIDs commit 93003de27a5e20f4977bf24f1d33c2abb7d177d0 Merge: d633c387f28f 8c6fdbd635d4 a1da3b78c083 f1fce1cf4509 a83c68a3bf7c Author: Rafael J. Wysocki Date: Thu Oct 26 14:44:04 2023 +0200 Merge branches 'acpi-scan', 'acpi-osl', 'acpi-osi' and 'acpi-tables' Merge ACPI updates related to device enumeration, low-level interface for ACPICA (OSL), _OSI handling and table parsing for 6.7-rc1: - Use the acpi_device_is_present() helper in more places and rename acpi_scan_device_not_present() to be about enumeration (James Morse). - Add __printf format attribute to acpi_os_vprintf() (Su Hui). - Clean up departures from kernel coding style in the low-level interface for ACPICA (Jonathan Bergh). - Replace strncpy() with strscpy() in acpi_osi_setup() (Justin Stitt). - Fail FPDT parsing on zero length records and add proper handling for fpdt_process_subtable() to acpi_init_fpdt() (Vasily Khoruzhick). * acpi-scan: ACPI: scan: Rename acpi_scan_device_not_present() to be about enumeration ACPI: scan: Use the acpi_device_is_present() helper in more places * acpi-osl: ACPI: OSL: Add empty lines after local variable declarations ACPI: OSL: Remove redundant parentheses in return statements ACPI: OSL: Fix up white space in parameter lists ACPI: OSL: add __printf format attribute to acpi_os_vprintf() * acpi-osi: ACPI: OSI: refactor deprecated strncpy() * acpi-tables: ACPI: FPDT: properly handle invalid FPDT subtables commit c421c12586b3f00fb96b5c9af15c9a051a9090b1 Author: Hou Tao Date: Sat Oct 21 09:49:59 2023 +0800 bpf: Add more WARN_ON_ONCE checks for mismatched alloc and free There are two possible mismatched alloc and free cases in BPF memory allocator: 1) allocate from cache X but free by cache Y with a different unit_size 2) allocate from per-cpu cache but free by kmalloc cache or vice versa So add more WARN_ON_ONCE checks in free_bulk() and __free_by_rcu() to spot these mismatched alloc and free early. Signed-off-by: Hou Tao Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20231021014959.3563841-1-houtao@huaweicloud.com kernel/bpf/memalloc.c | 4 ++++ 1 file changed, 4 insertions(+) commit 2fccd11518f19571f3802f22d2aad6e72b254c3e Author: Thippeswamy Havalige Date: Mon Oct 16 10:41:02 2023 +0530 PCI: xilinx-nwl: Modify ECAM size to enable support for 256 buses The PCIe Root Port controller expects ECAM size to be set through software. As such, update the value of the NWL_ECAM_VALUE_DEFAULT macro to 16 to allow the controller to address the 256 MB ECAM region and, as such, enable support for detecting up to 256 buses. [kwilczynski: commit log] Link: https://patchwork.kernel.org/project/linux-pci/patch/20231016051102.1180432-5-thippeswamy.havalige@amd.com/ Signed-off-by: Thippeswamy Havalige Signed-off-by: Krzysztof Wilczyński drivers/pci/controller/pcie-xilinx-nwl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 177692115f6f7abac90d05dfa9054f40818718c2 Author: Thippeswamy Havalige Date: Mon Oct 16 10:41:01 2023 +0530 PCI: xilinx-nwl: Rename the NWL_ECAM_VALUE_DEFAULT macro Rename the NWL_ECAM_VALUE_DEFAULT macro to NWL_ECAM_MAX_SIZE and drop the no longer needed ecam_value variable from struct nwl_pcie. [kwilczynski: commit log] Link: https://lore.kernel.org/linux-pci/20231016051102.1180432-4-thippeswamy.havalige@amd.com Signed-off-by: Thippeswamy Havalige Signed-off-by: Krzysztof Wilczyński drivers/pci/controller/pcie-xilinx-nwl.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 22f38a2442730183289c28652b2c01264e66a563 Author: Thippeswamy Havalige Date: Mon Oct 16 10:41:00 2023 +0530 dt-bindings: PCI: xilinx-nwl: Modify ECAM size in the DT example Update ECAM size in the devicetree example to allow for the discovery of up to 256 buses. [kwilczynski: commit log] Link: https://lore.kernel.org/linux-pci/20231016051102.1180432-3-thippeswamy.havalige@amd.com Signed-off-by: Thippeswamy Havalige Signed-off-by: Krzysztof Wilczyński Acked-by: Rob Herring Documentation/devicetree/bindings/pci/xlnx,nwl-pcie.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a2492ff1fcb94ee823d38a3965138e6ab33a4f80 Author: Thippeswamy Havalige Date: Mon Oct 16 10:40:59 2023 +0530 PCI: xilinx-nwl: Remove redundant code that sets Type 1 header fields The PCI core already updates the primary, secondary and subordinate bus number registers fields of the Type 1 header. Thus, remove the redundant code from the nwl_pcie_bridge_init(). [kwilczynski: commit log] Link: https://lore.kernel.org/linux-pci/20231016051102.1180432-2-thippeswamy.havalige@amd.com Signed-off-by: Thippeswamy Havalige Signed-off-by: Krzysztof Wilczyński drivers/pci/controller/pcie-xilinx-nwl.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) commit b56ebe7c896dc78b5865ec2c4b1dae3c93537517 Author: Koichiro Den Date: Thu Oct 26 12:20:36 2023 +0900 x86/apic/msi: Fix misconfigured non-maskable MSI quirk commit ef8dd01538ea ("genirq/msi: Make interrupt allocation less convoluted"), reworked the code so that the x86 specific quirk for affinity setting of non-maskable PCI/MSI interrupts is not longer activated if necessary. This could be solved by restoring the original logic in the core MSI code, but after a deeper analysis it turned out that the quirk flag is not required at all. The quirk is only required when the PCI/MSI device cannot mask the MSI interrupts, which in turn also prevents reservation mode from being enabled for the affected interrupt. This allows ot remove the NOMASK quirk bit completely as msi_set_affinity() can instead check whether reservation mode is enabled for the interrupt, which gives exactly the same answer. Even in the momentary non-existing case that the reservation mode would be not set for a maskable MSI interrupt this would not cause any harm as it just would cause msi_set_affinity() to go needlessly through the functionaly equivalent slow path, which works perfectly fine with maskable interrupts as well. Rework msi_set_affinity() to query the reservation mode and remove all NOMASK quirk logic from the core code. [ tglx: Massaged changelog ] Fixes: ef8dd01538ea ("genirq/msi: Make interrupt allocation less convoluted") Suggested-by: Thomas Gleixner Signed-off-by: Koichiro Den Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20231026032036.2462428-1-den@valinux.co.jp arch/x86/kernel/apic/msi.c | 8 +++----- include/linux/irq.h | 26 ++++---------------------- include/linux/msi.h | 6 ------ kernel/irq/debugfs.c | 1 - kernel/irq/msi.c | 12 +----------- 5 files changed, 8 insertions(+), 45 deletions(-) commit 168d97844a61db302dec76d44406e9d4d7106b8e Author: Cezary Rojewski Date: Thu Oct 26 10:25:58 2023 +0200 ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails Error path in snd_skl_parse_uuids() shall free last allocated module if its instance_id allocation fails. Fixes: f8e066521192 ("ASoC: Intel: Skylake: Fix uuid_module memory leak in failure case") Signed-off-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20231026082558.1864910-1-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown sound/soc/intel/skylake/skl-sst-utils.c | 1 + 1 file changed, 1 insertion(+) commit f82eb06a40c86c9a82537e956de401d497203d3a Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:28 2023 +0200 ASoC: tegra: machine: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231023095428.166563-18-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/tegra/tegra_asoc_machine.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 317dd0dbadd8bd4de2d69fa6a0611456f3e15b1a Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:27 2023 +0200 ASoC: samsung: speyside: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231023095428.166563-17-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/samsung/speyside.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 86cfaf99e4d3c7b4707fb8cc9eb06d8db10c1414 Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:26 2023 +0200 ASoC: mediatek: mt8192: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20231023095428.166563-16-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/mediatek/mt8192/mt8192-dai-adda.c | 4 ++-- sound/soc/mediatek/mt8192/mt8192-dai-i2s.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) commit d1ecaabe9f1a669354de7420261bd8737da4bf48 Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:25 2023 +0200 ASoC: mediatek: mt8188: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Trevor Wu Link: https://lore.kernel.org/r/20231023095428.166563-15-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/mediatek/mt8188/mt8188-dai-etdm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 0fe153a99fcc2edeae4e863b03c5a8f71376629e Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:24 2023 +0200 ASoC: mediatek: mt8186: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20231023095428.166563-14-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/mediatek/mt8186/mt8186-dai-adda.c | 2 +- sound/soc/mediatek/mt8186/mt8186-dai-hw-gain.c | 2 +- sound/soc/mediatek/mt8186/mt8186-dai-i2s.c | 4 ++-- sound/soc/mediatek/mt8186/mt8186-dai-src.c | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) commit e84c7f5db97474cb4becd863a93d4ea541dc4110 Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:23 2023 +0200 ASoC: mediatek: mt8183: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20231023095428.166563-13-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/mediatek/mt8183/mt8183-dai-i2s.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 343b62590d5b950c8bf7f78fef7c81103c5f982c Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:22 2023 +0200 ASoC: codecs: wm8995: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20231023095428.166563-12-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/wm8995.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e13b63c47578a27dbf8907974f0dcba0bb2efe58 Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:21 2023 +0200 ASoC: codecs: wm8994: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20231023095428.166563-11-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/wm8994.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e54db8826f48c9ca52f2abd108d6e030ff20cae5 Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:20 2023 +0200 ASoC: codecs: wm8962: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20231023095428.166563-10-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/wm8962.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7df1e6a3c608ab0c345b8898f9ee5d5ac19f2eb4 Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:19 2023 +0200 ASoC: codecs: wcd9335: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231023095428.166563-9-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/wcd9335.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit e2d38e1196f61735716f9c2dd89dff32c0655529 Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:18 2023 +0200 ASoC: codecs: rtq9128: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231023095428.166563-8-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/rtq9128.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit b2056ce3cf61a39796041dc5c94d7255de7f9f0c Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:17 2023 +0200 ASoC: codecs: rt5682s: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231023095428.166563-7-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/rt5682s.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a1fa72a780f428ddc956cf5ed4b97e2be76ceba3 Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:16 2023 +0200 ASoC: codecs: max9867: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Nuno Sa Link: https://lore.kernel.org/r/20231023095428.166563-6-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/max9867.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 5efc1c903e2b43a267ad13696698fcc152ed873a Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:15 2023 +0200 ASoC: codecs: lpass-rx-macro: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231023095428.166563-5-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/lpass-rx-macro.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit ecea1812b911fed5e675b2d37b29ad4265c067ce Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:14 2023 +0200 ASoC: codecs: adav80x: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Nuno Sa Link: https://lore.kernel.org/r/20231023095428.166563-4-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/adav80x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7a0762587a814387e631c07ae81169a7c646f012 Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:13 2023 +0200 ASoC: codecs: adau1373: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Nuno Sa Link: https://lore.kernel.org/r/20231023095428.166563-3-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/adau1373.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ccd0c6c7097b52b01a2c5951cfe96714d4421cd2 Author: Krzysztof Kozlowski Date: Mon Oct 23 11:54:12 2023 +0200 ASoC: codecs: 88pm860x: Handle component name prefix Use snd_soc_dapm_widget_name_cmp() helper when comparing widget names, to include also the component's name prefix. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20231023095428.166563-2-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/88pm860x-codec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit cdcd6aef9db5797995d4153ea19fdf56d189f0e4 Author: Maxime Ripard Date: Tue Oct 24 12:56:40 2023 +0200 drm/vc4: tests: Fix UAF in the mock helpers The VC4 mock helpers allocate the CRTC, encoders and connectors using a call to kunit_kzalloc(), but the DRM device they are attache to survives for longer than the test itself which leads to use-after-frees reported by KASAN. Switch to drmm_kzalloc to tie the lifetime of these objects to the main DRM device. Fixes: f759f5b53f1c ("drm/vc4: tests: Introduce a mocking infrastructure") Reported-by: Linux Kernel Functional Testing Closes: https://lore.kernel.org/all/CA+G9fYvJA2HGqzR9LGgq63v0SKaUejHAE6f7+z9cwWN-ourJ_g@mail.gmail.com/ Tested-by: Anders Roxell Reviewed-by: Maíra Canal Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20231024105640.352752-1-mripard@kernel.org drivers/gpu/drm/vc4/tests/vc4_mock_crtc.c | 2 +- drivers/gpu/drm/vc4/tests/vc4_mock_output.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 820f59ed9680cd145138c39fb2956a140a0e38f0 Author: D Scott Phillips Date: Fri Sep 29 17:20:36 2023 -0700 PCI: hotplug: Add Ampere Altra Attention Indicator extension driver On Ampere Altra, PCIe hotplug is handled through ACPI. A side interface is also present to request system firmware control of the hotplug Attention Indicators. Add an ACPI PCI Hotplug companion driver to support Attention Indicator control. Link: https://lore.kernel.org/r/20230930002036.6491-2-scott@os.amperecomputing.com Signed-off-by: D Scott Phillips [bhelgaas: mask domain to low 4 bits] Signed-off-by: Bjorn Helgaas Acked-by: "Rafael J. Wysocki" drivers/pci/hotplug/Kconfig | 12 +++ drivers/pci/hotplug/Makefile | 1 + drivers/pci/hotplug/acpiphp_ampere_altra.c | 127 +++++++++++++++++++++++++++++ 3 files changed, 140 insertions(+) commit 0da9eccde3270b832c059ad618bf66e510c75d33 Author: Werner Sembach Date: Mon Oct 16 18:08:28 2023 +0200 ACPI: resource: Do IRQ override on TongFang GMxXGxx The TongFang GMxXGxx/TUXEDO Stellaris/Pollaris Gen5 needs IRQ overriding for the keyboard to work. Adding an entry for this laptop to the override_table makes the internal keyboard functional. Signed-off-by: Werner Sembach Cc: All applicable Reviewed-by: Hans de Goede Signed-off-by: Rafael J. Wysocki drivers/acpi/resource.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 78fdccdc8b9f941d6575625c625f2f4e86db53ce Merge: f9b3ea02555e 424009ab2030 Author: Rafael J. Wysocki Date: Thu Oct 26 12:26:41 2023 +0200 Merge back earlier ACPI resources management changes for v6.7. commit 39673361266bcb76a9782ee9e27dad1be5dcadcc Merge: df3bc66219e3 9cdee0634769 Author: Paolo Abeni Date: Thu Oct 26 12:20:35 2023 +0200 Merge tag 'nf-next-23-10-25' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for net-next. Mostly nf_tables updates with two patches for connlabel and br_netfilter. 1) Rename function name to perform on-demand GC for rbtree elements, and replace async GC in rbtree by sync GC. Patches from Florian Westphal. 2) Use commit_mutex for NFT_MSG_GETRULE_RESET to ensure that two concurrent threads invoking this command do not underrun stateful objects. Patches from Phil Sutter. 3) Use single hook to deal with IP and ARP packets in br_netfilter. Patch from Florian Westphal. 4) Use atomic_t in netns->connlabel use counter instead of using a spinlock, also patch from Florian. 5) Cleanups for stateful objects infrastructure in nf_tables. Patches from Phil Sutter. 6) Flush path uses opaque set element offered by the iterator, instead of calling pipapo_deactivate() which looks up for it again. 7) Set backend .flush interface always succeeds, make it return void instead. 8) Add struct nft_elem_priv placeholder structure and use it by replacing void * to pass opaque set element representation from backend to frontend which defeats compiler type checks. 9) Shrink memory consumption of set element transactions, by reducing struct nft_trans_elem object size and reducing stack memory usage. 10) Use struct nft_elem_priv also for set backend .insert operation too. 11) Carry reset flag in nft_set_dump_ctx structure, instead of passing it as a function argument, from Phil Sutter. netfilter pull request 23-10-25 * tag 'nf-next-23-10-25' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nf_tables: Carry reset boolean in nft_set_dump_ctx netfilter: nf_tables: set->ops->insert returns opaque set element in case of EEXIST netfilter: nf_tables: shrink memory consumption of set elements netfilter: nf_tables: expose opaque set element as struct nft_elem_priv netfilter: nf_tables: set backend .flush always succeeds netfilter: nft_set_pipapo: no need to call pipapo_deactivate() from flush netfilter: nf_tables: Carry reset boolean in nft_obj_dump_ctx netfilter: nf_tables: nft_obj_filter fits into cb->ctx netfilter: nf_tables: Carry s_idx in nft_obj_dump_ctx netfilter: nf_tables: A better name for nft_obj_filter netfilter: nf_tables: Unconditionally allocate nft_obj_filter netfilter: nf_tables: Drop pointless memset in nf_tables_dump_obj netfilter: conntrack: switch connlabels to atomic_t br_netfilter: use single forward hook for ip and arp netfilter: nf_tables: Add locking for NFT_MSG_GETRULE_RESET requests netfilter: nf_tables: Introduce nf_tables_getrule_single() netfilter: nf_tables: Open-code audit log call in nf_tables_getrule() netfilter: nft_set_rbtree: prefer sync gc to async worker netfilter: nft_set_rbtree: rename gc deactivate+erase function ==================== Link: https://lore.kernel.org/r/20231025212555.132775-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit d633c387f28f2bdb0226762887b6ef95639fd3b0 Merge: 611da07b89fd 178e1ea6a68f Author: Rafael J. Wysocki Date: Thu Oct 26 11:47:50 2023 +0200 Merge branch 'acpica' Merge an ACPICA change for 6.7-rc1 which adds symbol definitions related to CDAT (Dave Jiang). * acpica: ACPICA: Add defines for CDAT SSLBIS commit 3a75b205de43365f80a33b98ec9289785da56243 Author: Daniel Starke Date: Thu Oct 26 07:58:43 2023 +0200 tty: n_gsm: fix race condition in status line change on dead connections gsm_cleanup_mux() cleans up the gsm by closing all DLCIs, stopping all timers, removing the virtual tty devices and clearing the data queues. This procedure, however, may cause subsequent changes of the virtual modem status lines of a DLCI. More data is being added the outgoing data queue and the deleted kick timer is restarted to handle this. At this point many resources have already been removed by the cleanup procedure. Thus, a kernel panic occurs. Fix this by proving in gsm_modem_update() that the cleanup procedure has not been started and the mux is still alive. Note that writing to a virtual tty is already protected by checks against the DLCI specific connection state. Fixes: c568f7086c6e ("tty: n_gsm: fix missing timer to handle stalled links") Cc: stable Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20231026055844.3127-1-daniel.starke@siemens.com Signed-off-by: Greg Kroah-Hartman drivers/tty/n_gsm.c | 2 ++ 1 file changed, 2 insertions(+) commit 51c2385f608b08025600dd8015c43a8811c714c6 Author: Maxime Ripard Date: Wed Oct 25 16:24:41 2023 +0200 drm/doc: ci: Require more context for flaky tests Flaky tests can be very difficult to reproduce after the facts, which will make it even harder to ever fix. Let's document the metadata we agreed on to provide more context to anyone trying to address these fixes. Link: https://lore.kernel.org/dri-devel/CAPj87rPbJ1V1-R7WMTHkDat2A4nwSd61Df9mdGH2PR=ZzxaU=Q@mail.gmail.com/ Acked-by: Daniel Vetter Acked-by: Helen Koike Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20231025142441.745947-1-mripard@kernel.org Documentation/gpu/automated_testing.rst | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 3e6b0bb22a803532a7ddf8ba255c46213c24a478 Author: Hans de Goede Date: Wed Oct 25 21:01:51 2023 +0200 HID: logitech-hidpp: Stop IO before calling hid_connect() hid_connect() will call hid_pidff_init() which does hid_device_io_start() leading to an "io already started" warning. To fix this call hid_device_io_stop() before calling hid_connect(), stopping IO means that connect events may be lost while hid_connect() runs, re-enable IO and move the hidpp_connect_event() work queuing after the hid_connect(). Note re-enabling IO is also necessary for the g920_get_config() call later during hidpp_probe(). Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20231025190151.302376-1-hdegoede@redhat.com Signed-off-by: Benjamin Tissoires drivers/hid/hid-logitech-hidpp.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 970171a9050e554168751494f88aa90692148f2d Author: Takashi Iwai Date: Wed Oct 25 15:23:14 2023 +0200 ALSA: seq: Replace with __packed attribute Replace the old __attribute__((packed)) with the new __packed. Only cleanup, no functional changes. Link: https://lore.kernel.org/r/20231025132314.5878-12-tiwai@suse.de Signed-off-by: Takashi Iwai include/uapi/sound/asequencer.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ba238233e454a2c11eccb80d8aacf8028439097c Author: Takashi Iwai Date: Wed Oct 25 15:23:13 2023 +0200 ALSA: wavefront: Drop obsoleted comments and definitions The header file contains lots of outdated comments and definitions. Drop those as cleanup. Link: https://lore.kernel.org/r/20231025132314.5878-11-tiwai@suse.de Signed-off-by: Takashi Iwai include/sound/wavefront.h | 51 ----------------------------------------------- 1 file changed, 51 deletions(-) commit 0e646fc3a2b0435a1a171bea817a76050f59ee97 Author: Takashi Iwai Date: Wed Oct 25 15:23:12 2023 +0200 ALSA: wavefront: Replace with __packed attribute Replace the old __attribute__((packed)) with the new __packed. Only cleanup, no functional changes. Link: https://lore.kernel.org/r/20231025132314.5878-10-tiwai@suse.de Signed-off-by: Takashi Iwai include/sound/wavefront.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9ffbedf07d556af1203dd8d5fc28b59a0563a49f Author: Takashi Iwai Date: Wed Oct 25 15:23:11 2023 +0200 ALSA: opl3: Replace with __packed attribute Replace the old __attribute__((packed)) with the new __packed. Only cleanup, no functional changes. Link: https://lore.kernel.org/r/20231025132314.5878-9-tiwai@suse.de Signed-off-by: Takashi Iwai include/sound/opl3.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ce8466cd4c0920929e43816b6a812093e7ba4f5a Author: Takashi Iwai Date: Wed Oct 25 15:23:10 2023 +0200 ALSA: aoa: Replace with __packed attribute Replace the old __attribute__((packed)) with the new __packed. Only cleanup, no functional changes. Link: https://lore.kernel.org/r/20231025132314.5878-8-tiwai@suse.de Signed-off-by: Takashi Iwai sound/aoa/soundbus/i2sbus/interface.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 98a4e82e57063653593c6257660afc659acc0a2b Author: Takashi Iwai Date: Wed Oct 25 15:23:09 2023 +0200 ALSA: caiaq: Replace with __packed attribute Replace the old __attribute__((packed)) with the new __packed. Only cleanup, no functional changes. Link: https://lore.kernel.org/r/20231025132314.5878-7-tiwai@suse.de Signed-off-by: Takashi Iwai sound/usb/caiaq/device.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e244953ef618f19a3df65cc8d15c2bd3da64c4dd Author: Takashi Iwai Date: Wed Oct 25 15:23:08 2023 +0200 ALSA: mixart: Replace with __packed attribute Replace the old __attribute__((packed)) with the new __packed. Only cleanup, no functional changes. Link: https://lore.kernel.org/r/20231025132314.5878-6-tiwai@suse.de Signed-off-by: Takashi Iwai sound/pci/mixart/mixart_core.h | 70 +++++++++++++++++++++--------------------- 1 file changed, 35 insertions(+), 35 deletions(-) commit afcd82afd2022191532c5492edd9e28da0617fcf Author: Takashi Iwai Date: Wed Oct 25 15:23:07 2023 +0200 ALSA: azt3328: Replace with __packed attribute Replace the old __attribute__((packed)) with the new __packed. Only cleanup, no functional changes. Link: https://lore.kernel.org/r/20231025132314.5878-5-tiwai@suse.de Signed-off-by: Takashi Iwai sound/pci/azt3328.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2fb203dbeaea54255d1ca8ae93b8a69a096d44b2 Author: Takashi Iwai Date: Wed Oct 25 15:23:06 2023 +0200 ALSA: rawmidi: Replace with __packed attribute Replace the old __attribute__((packed)) with the new __packed. Only cleanup, no functional changes. Link: https://lore.kernel.org/r/20231025132314.5878-4-tiwai@suse.de Signed-off-by: Takashi Iwai sound/core/rawmidi_compat.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit fdbe0f20445cc005f951088eae9d210382846f87 Author: Takashi Iwai Date: Wed Oct 25 15:23:05 2023 +0200 ALSA: pcm: Replace with __packed attribute Replace the old __attribute__((packed)) with the new __packed. Only cleanup, no functional changes. Link: https://lore.kernel.org/r/20231025132314.5878-3-tiwai@suse.de Signed-off-by: Takashi Iwai sound/core/pcm_native.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b7cbd9c934ec08c3dd9436e1f4d1bd190553b202 Author: Takashi Iwai Date: Wed Oct 25 15:23:04 2023 +0200 ALSA: control: Replace with __packed attribute Replace the old __attribute__((packed)) with the new __packed. Only cleanup, no functional changes. Link: https://lore.kernel.org/r/20231025132314.5878-2-tiwai@suse.de Signed-off-by: Takashi Iwai sound/core/control_compat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 47846d51348dd62e5231a83be040981b17c955fa Author: Paul Moore Date: Mon Oct 9 13:18:49 2023 -0400 audit: don't take task_lock() in audit_exe_compare() code path The get_task_exe_file() function locks the given task with task_lock() which when used inside audit_exe_compare() can cause deadlocks on systems that generate audit records when the task_lock() is held. We resolve this problem with two changes: ignoring those cases where the task being audited is not the current task, and changing our approach to obtaining the executable file struct to not require task_lock(). With the intent of the audit exe filter being to filter on audit events generated by processes started by the specified executable, it makes sense that we would only want to use the exe filter on audit records associated with the currently executing process, e.g. @current. If we are asked to filter records using a non-@current task_struct we can safely ignore the exe filter without negatively impacting the admin's expectations for the exe filter. Knowing that we only have to worry about filtering the currently executing task in audit_exe_compare() we can do away with the task_lock() and call get_mm_exe_file() with @current->mm directly. Cc: Fixes: 5efc244346f9 ("audit: fix exe_file access in audit_exe_compare") Reported-by: Andreas Steinmetz Reviewed-by: John Johansen Reviewed-by: Mateusz Guzik Signed-off-by: Paul Moore kernel/audit_watch.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 29e06c10702e81a7d0b75020ca514d2f2962704a Author: Steven Rostedt (Google) Date: Tue Oct 24 13:10:24 2023 -0400 eventfs: Fix typo in eventfs_inode union comment It's eventfs_inode not eventfs_indoe. There's no deer involved! Link: https://lore.kernel.org/linux-trace-kernel/20231024131024.5634c743@gandalf.local.home Cc: Masami Hiramatsu Cc: Mark Rutland Fixes: 5790b1fb3d672 ("eventfs: Remove eventfs_file and just use eventfs_inode") Signed-off-by: Steven Rostedt (Google) fs/tracefs/internal.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a9de4eb15ad430fe45747c211e367da745a90093 Author: Steven Rostedt (Google) Date: Tue Oct 24 12:36:28 2023 -0400 eventfs: Fix WARN_ON() in create_file_dentry() As the comment right above a WARN_ON() in create_file_dentry() states: * Note, with the mutex held, the e_dentry cannot have content * and the ei->is_freed be true at the same time. But the WARN_ON() only has: WARN_ON_ONCE(ei->is_free); Where to match the comment (and what it should actually do) is: dentry = *e_dentry; WARN_ON_ONCE(dentry && ei->is_free) Also in that case, set dentry to NULL (although it should never happen). Link: https://lore.kernel.org/linux-trace-kernel/20231024123628.62b88755@gandalf.local.home Cc: Masami Hiramatsu Cc: Mark Rutland Fixes: 5790b1fb3d672 ("eventfs: Remove eventfs_file and just use eventfs_inode") Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 0f7f544af60a6082cfaa3ed4c8f4ca1a858807ee Author: Matthew Wilcox (Oracle) Date: Tue Oct 24 15:55:59 2023 +0100 powerpc: Remove initialisation of readpos While powerpc doesn't use the seq_buf readpos, it did explicitly initialise it for no good reason. Link: https://lore.kernel.org/linux-trace-kernel/20231024145600.739451-1-willy@infradead.org Cc: Christoph Hellwig Cc: Justin Stitt Cc: Kent Overstreet Cc: Petr Mladek Cc: Andy Shevchenko Cc: Rasmus Villemoes Cc: Sergey Senozhatsky Cc: Michael Ellerman Reviewed-by: Kees Cook Fixes: d0ed46b60396 ("tracing: Move readpos from seq_buf to trace_seq") Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Steven Rostedt (Google) arch/powerpc/kernel/setup-common.c | 1 - 1 file changed, 1 deletion(-) commit df3bc66219e32377b2fd251c121c43bf031a5854 Merge: d8c4ef76d7cc ec575f885e3e Author: Jakub Kicinski Date: Wed Oct 25 18:23:08 2023 -0700 Merge branch 'net-ipv6-addrconf-ensure-that-temporary-addresses-preferred-lifetimes-are-in-the-valid-range' Alex Henrie says: ==================== net: ipv6/addrconf: ensure that temporary addresses' preferred lifetimes are in the valid range No changes from v2, but there are only four patches now because the first patch has already been applied. https://lore.kernel.org/all/20230829054623.104293-1-alexhenrie24@gmail.com/ ==================== Link: https://lore.kernel.org/r/20231024212312.299370-1-alexhenrie24@gmail.com Signed-off-by: Jakub Kicinski commit ec575f885e3eca6b003e007f4acfba9a0ec3c04a Author: Alex Henrie Date: Tue Oct 24 15:23:10 2023 -0600 Documentation: networking: explain what happens if temp_prefered_lft is too small or too large Signed-off-by: Alex Henrie Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20231024212312.299370-5-alexhenrie24@gmail.com Signed-off-by: Jakub Kicinski Documentation/networking/ip-sysctl.rst | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 433d6c8048cb297c3e25af237d6d006daa2195f9 Author: Alex Henrie Date: Tue Oct 24 15:23:09 2023 -0600 Documentation: networking: explain what happens if temp_valid_lft is too small Signed-off-by: Alex Henrie Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20231024212312.299370-4-alexhenrie24@gmail.com Signed-off-by: Jakub Kicinski Documentation/networking/ip-sysctl.rst | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 629df6701c8a9172f4274af6de9dfa99e2c7ac56 Author: Alex Henrie Date: Tue Oct 24 15:23:08 2023 -0600 net: ipv6/addrconf: clamp preferred_lft to the minimum required If the preferred lifetime was less than the minimum required lifetime, ipv6_create_tempaddr would error out without creating any new address. On my machine and network, this error happened immediately with the preferred lifetime set to 1 second, after a few minutes with the preferred lifetime set to 4 seconds, and not at all with the preferred lifetime set to 5 seconds. During my investigation, I found a Stack Exchange post from another person who seems to have had the same problem: They stopped getting new addresses if they lowered the preferred lifetime below 3 seconds, and they didn't really know why. The preferred lifetime is a preference, not a hard requirement. The kernel does not strictly forbid new connections on a deprecated address, nor does it guarantee that the address will be disposed of the instant its total valid lifetime expires. So rather than disable IPv6 privacy extensions altogether if the minimum required lifetime swells above the preferred lifetime, it is more in keeping with the user's intent to increase the temporary address's lifetime to the minimum necessary for the current network conditions. With these fixes, setting the preferred lifetime to 3 or 4 seconds "just works" because the extra fraction of a second is practically unnoticeable. It's even possible to reduce the time before deprecation to 1 or 2 seconds by also disabling duplicate address detection (setting /proc/sys/net/ipv6/conf/*/dad_transmits to 0). I realize that that is a pretty niche use case, but I know at least one person who would gladly sacrifice performance and convenience to be sure that they are getting the maximum possible level of privacy. Link: https://serverfault.com/a/1031168/310447 Signed-off-by: Alex Henrie Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20231024212312.299370-3-alexhenrie24@gmail.com Signed-off-by: Jakub Kicinski net/ipv6/addrconf.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) commit bfbf81b31093e0dc3d61b390a9bd0904d3bf5374 Author: Alex Henrie Date: Tue Oct 24 15:23:07 2023 -0600 net: ipv6/addrconf: clamp preferred_lft to the maximum allowed Without this patch, there is nothing to stop the preferred lifetime of a temporary address from being greater than its valid lifetime. If that was the case, the valid lifetime was effectively ignored. Signed-off-by: Alex Henrie Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20231024212312.299370-2-alexhenrie24@gmail.com Signed-off-by: Jakub Kicinski net/ipv6/addrconf.c | 1 + 1 file changed, 1 insertion(+) commit d8c4ef76d7ccd478f8c9a3b7de1ba0b25fdffbee Merge: 8846f9a04b10 03d6c848bfb4 Author: Jakub Kicinski Date: Wed Oct 25 18:04:31 2023 -0700 Merge branch 'ipv6-avoid-atomic-fragment-on-gso-output' Yan Zhai says: ==================== ipv6: avoid atomic fragment on GSO output When the ipv6 stack output a GSO packet, if its gso_size is larger than dst MTU, then all segments would be fragmented. However, it is possible for a GSO packet to have a trailing segment with smaller actual size than both gso_size as well as the MTU, which leads to an "atomic fragment". Atomic fragments are considered harmful in RFC-8021. An Existing report from APNIC also shows that atomic fragments are more likely to be dropped even it is equivalent to a no-op [1]. The series contains following changes: * drop feature RTAX_FEATURE_ALLFRAG, which has been broken. This helps simplifying other changes in this set. * refactor __ip6_finish_output code to separate GSO and non-GSO packet processing, mirroring IPv4 side logic. * avoid generating atomic fragment on GSO packets. Link: https://www.potaroo.net/presentations/2022-03-01-ipv6-frag.pdf [1] V4: https://lore.kernel.org/netdev/cover.1698114636.git.yan@cloudflare.com/ V3: https://lore.kernel.org/netdev/cover.1697779681.git.yan@cloudflare.com/ V2: https://lore.kernel.org/netdev/ZS1%2Fqtr0dZJ35VII@debian.debian/ ==================== Link: https://lore.kernel.org/r/cover.1698156966.git.yan@cloudflare.com Signed-off-by: Jakub Kicinski commit 03d6c848bfb406e9ef6d9846d759e97beaeea113 Author: Yan Zhai Date: Tue Oct 24 07:26:40 2023 -0700 ipv6: avoid atomic fragment on GSO packets When the ipv6 stack output a GSO packet, if its gso_size is larger than dst MTU, then all segments would be fragmented. However, it is possible for a GSO packet to have a trailing segment with smaller actual size than both gso_size as well as the MTU, which leads to an "atomic fragment". Atomic fragments are considered harmful in RFC-8021. An Existing report from APNIC also shows that atomic fragments are more likely to be dropped even it is equivalent to a no-op [1]. Add an extra check in the GSO slow output path. For each segment from the original over-sized packet, if it fits with the path MTU, then avoid generating an atomic fragment. Link: https://www.potaroo.net/presentations/2022-03-01-ipv6-frag.pdf [1] Fixes: b210de4f8c97 ("net: ipv6: Validate GSO SKB before finish IPv6 processing") Reported-by: David Wragg Signed-off-by: Yan Zhai Link: https://lore.kernel.org/r/90912e3503a242dca0bc36958b11ed03a2696e5e.1698156966.git.yan@cloudflare.com Signed-off-by: Jakub Kicinski net/ipv6/ip6_output.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 1f7ec1b3721d7f49f13d01e6f5ed5f28a305e3b6 Author: Yan Zhai Date: Tue Oct 24 07:26:37 2023 -0700 ipv6: refactor ip6_finish_output for GSO handling Separate GSO and non-GSO packets handling to make the logic cleaner. For GSO packets, frag_max_size check can be omitted because it is only useful for packets defragmented by netfilter hooks. Both local output and GRO logic won't produce GSO packets when defragment is needed. This also mirrors what IPv4 side code is doing. Suggested-by: Florian Westphal Signed-off-by: Yan Zhai Reviewed-by: Willem de Bruijn Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/0e1d4599f858e2becff5c4fe0b5f843236bc3fe8.1698156966.git.yan@cloudflare.com Signed-off-by: Jakub Kicinski net/ipv6/ip6_output.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) commit e57a34478586fe3562560ccebd655b707a5b4a56 Author: Yan Zhai Date: Tue Oct 24 07:26:33 2023 -0700 ipv6: drop feature RTAX_FEATURE_ALLFRAG RTAX_FEATURE_ALLFRAG was added before the first git commit: https://www.mail-archive.com/bk-commits-head@vger.kernel.org/msg03399.html The feature would send packets to the fragmentation path if a box receives a PMTU value with less than 1280 byte. However, since commit 9d289715eb5c ("ipv6: stop sending PTB packets for MTU < 1280"), such message would be simply discarded. The feature flag is neither supported in iproute2 utility. In theory one can still manipulate it with direct netlink message, but it is not ideal because it was based on obsoleted guidance of RFC-2460 (replaced by RFC-8200). The feature would always test false at the moment, so remove related code or mark them as unused. Signed-off-by: Yan Zhai Reviewed-by: Florian Westphal Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/d78e44dcd9968a252143ffe78460446476a472a1.1698156966.git.yan@cloudflare.com Signed-off-by: Jakub Kicinski include/net/dst.h | 7 ------- include/net/inet_connection_sock.h | 1 - include/net/inet_sock.h | 1 - include/uapi/linux/rtnetlink.h | 2 +- net/ipv4/tcp_output.c | 20 +------------------- net/ipv6/ip6_output.c | 15 ++------------- net/ipv6/tcp_ipv6.c | 1 - net/ipv6/xfrm6_output.c | 2 +- net/mptcp/subflow.c | 1 - 9 files changed, 5 insertions(+), 45 deletions(-) commit 88c91dc58582f1d0c6f5f501051b0262d06ec4ed Author: Hugh Dickins Date: Tue Oct 3 02:29:00 2023 -0700 mempolicy: migration attempt to match interleave nodes Improve alloc_migration_target_by_mpol()'s treatment of MPOL_INTERLEAVE. Make an effort in do_mbind(), to identify the correct interleave index for the first page to be migrated, so that it and all subsequent pages from the same vma will be targeted to precisely their intended nodes. Pages from following vmas will still be interleaved from the requested nodemask, but perhaps starting from a different base. Whether this is worth doing at all, or worth improving further, is arguable: queue_folio_required() is right not to care about the precise placement on interleaved nodes; but this little effort seems appropriate. [hughd@google.com: do vma_iter search under mmap_write_unlock()] Link: https://lkml.kernel.org/r/3311d544-fb05-a7f1-1b74-16aa0f6cd4fe@google.com Link: https://lkml.kernel.org/r/77954a5-9c9b-1c11-7d5c-3262c01b895f@google.com Signed-off-by: Hugh Dickins Cc: Andi Kleen Cc: Christoph Lameter Cc: David Hildenbrand Cc: Greg Kroah-Hartman Cc: "Huang, Ying" Cc: Kefeng Wang Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Kravetz Cc: Nhat Pham Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Tejun heo Cc: Vishal Moola (Oracle) Cc: Yang Shi Cc: Yosry Ahmed Signed-off-by: Andrew Morton mm/mempolicy.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 50 insertions(+), 5 deletions(-) commit 72e315f7a750281b4410ac30d8930f735459e72d Author: Hugh Dickins Date: Tue Oct 3 02:27:47 2023 -0700 mempolicy: mmap_lock is not needed while migrating folios mbind(2) holds down_write of current task's mmap_lock throughout (exclusive because it needs to set the new mempolicy on the vmas); migrate_pages(2) holds down_read of pid's mmap_lock throughout. They both hold mmap_lock across the internal migrate_pages(), under which all new page allocations (huge or small) are made. I'm nervous about it; and migrate_pages() certainly does not need mmap_lock itself. It's done this way for mbind(2), because its page allocator is vma_alloc_folio() or alloc_hugetlb_folio_vma(), both of which depend on vma and address. Now that we have alloc_pages_mpol(), depending on (refcounted) memory policy and interleave index, mbind(2) can be modified to use that or alloc_hugetlb_folio_nodemask(), and then not need mmap_lock across the internal migrate_pages() at all: add alloc_migration_target_by_mpol() to replace mbind's new_page(). (After that change, alloc_hugetlb_folio_vma() is used by nothing but a userfaultfd function: move it out of hugetlb.h and into the #ifdef.) migrate_pages(2) has chosen its target node before migrating, so can continue to use the standard alloc_migration_target(); but let it take and drop mmap_lock just around migrate_to_node()'s queue_pages_range(): neither the node-to-node calculations nor the page migrations need it. It seems unlikely, but it is conceivable that some userspace depends on the kernel's mmap_lock exclusion here, instead of doing its own locking: more likely in a testsuite than in real life. It is also possible, of course, that some pages on the list will be munmapped by another thread before they are migrated, or a newer memory policy applied to the range by that time: but such races could happen before, as soon as mmap_lock was dropped, so it does not appear to be a concern. Link: https://lkml.kernel.org/r/21e564e8-269f-6a89-7ee2-fd612831c289@google.com Signed-off-by: Hugh Dickins Cc: Andi Kleen Cc: Christoph Lameter Cc: David Hildenbrand Cc: Greg Kroah-Hartman Cc: "Huang, Ying" Cc: Kefeng Wang Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Kravetz Cc: Nhat Pham Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Tejun heo Cc: Vishal Moola (Oracle) Cc: Yang Shi Cc: Yosry Ahmed Signed-off-by: Andrew Morton include/linux/hugetlb.h | 9 ------ mm/hugetlb.c | 38 +++++++++++----------- mm/mempolicy.c | 83 +++++++++++++++++++++++++------------------------ 3 files changed, 63 insertions(+), 67 deletions(-) commit ddc1a5cbc05dc62743a2f409b96faa5cf95ba064 Author: Hugh Dickins Date: Thu Oct 19 13:39:08 2023 -0700 mempolicy: alloc_pages_mpol() for NUMA policy without vma Shrink shmem's stack usage by eliminating the pseudo-vma from its folio allocation. alloc_pages_mpol(gfp, order, pol, ilx, nid) becomes the principal actor for passing mempolicy choice down to __alloc_pages(), rather than vma_alloc_folio(gfp, order, vma, addr, hugepage). vma_alloc_folio() and alloc_pages() remain, but as wrappers around alloc_pages_mpol(). alloc_pages_bulk_*() untouched, except to provide the additional args to policy_nodemask(), which subsumes policy_node(). Cleanup throughout, cutting out some unhelpful "helpers". It would all be much simpler without MPOL_INTERLEAVE, but that adds a dynamic to the constant mpol: complicated by v3.6 commit 09c231cb8bfd ("tmpfs: distribute interleave better across nodes"), which added ino bias to the interleave, hidden from mm/mempolicy.c until this commit. Hence "ilx" throughout, the "interleave index". Originally I thought it could be done just with nid, but that's wrong: the nodemask may come from the shared policy layer below a shmem vma, or it may come from the task layer above a shmem vma; and without the final nodemask then nodeid cannot be decided. And how ilx is applied depends also on page order. The interleave index is almost always irrelevant unless MPOL_INTERLEAVE: with one exception in alloc_pages_mpol(), where the NO_INTERLEAVE_INDEX passed down from vma-less alloc_pages() is also used as hint not to use THP-style hugepage allocation - to avoid the overhead of a hugepage arg (though I don't understand why we never just added a GFP bit for THP - if it actually needs a different allocation strategy from other pages of the same order). vma_alloc_folio() still carries its hugepage arg here, but it is not used, and should be removed when agreed. get_vma_policy() no longer allows a NULL vma: over time I believe we've eradicated all the places which used to need it e.g. swapoff and madvise used to pass NULL vma to read_swap_cache_async(), but now know the vma. [hughd@google.com: handle NULL mpol being passed to __read_swap_cache_async()] Link: https://lkml.kernel.org/r/ea419956-4751-0102-21f7-9c93cb957892@google.com Link: https://lkml.kernel.org/r/74e34633-6060-f5e3-aee-7040d43f2e93@google.com Link: https://lkml.kernel.org/r/1738368e-bac0-fd11-ed7f-b87142a939fe@google.com Signed-off-by: Hugh Dickins Cc: Andi Kleen Cc: Christoph Lameter Cc: David Hildenbrand Cc: Greg Kroah-Hartman Cc: Huang Ying Cc: Kefeng Wang Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Kravetz Cc: Nhat Pham Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Tejun heo Cc: Vishal Moola (Oracle) Cc: Yang Shi Cc: Yosry Ahmed Cc: Domenico Cerasuolo Cc: Johannes Weiner Signed-off-by: Andrew Morton fs/proc/task_mmu.c | 5 +- include/linux/gfp.h | 10 +- include/linux/mempolicy.h | 20 ++- include/linux/mm.h | 2 +- ipc/shm.c | 21 +-- mm/mempolicy.c | 379 +++++++++++++++++++--------------------------- mm/shmem.c | 92 ++++++----- mm/swap.h | 9 +- mm/swap_state.c | 86 +++++++---- mm/zswap.c | 7 +- 10 files changed, 308 insertions(+), 323 deletions(-) commit 23e4883248f0472d806c8b3422ba6257e67bf1a5 Author: Hugh Dickins Date: Tue Oct 3 02:25:33 2023 -0700 mm: add page_rmappable_folio() wrapper folio_prep_large_rmappable() is being used repeatedly along with a conversion from page to folio, a check non-NULL, a check order > 1: wrap it all up into struct folio *page_rmappable_folio(struct page *). Link: https://lkml.kernel.org/r/8d92c6cf-eebe-748-e29c-c8ab224c741@google.com Signed-off-by: Hugh Dickins Cc: Andi Kleen Cc: Christoph Lameter Cc: David Hildenbrand Cc: Greg Kroah-Hartman Cc: "Huang, Ying" Cc: Kefeng Wang Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Kravetz Cc: Nhat Pham Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Tejun heo Cc: Vishal Moola (Oracle) Cc: Yang Shi Cc: Yosry Ahmed Signed-off-by: Andrew Morton mm/internal.h | 9 +++++++++ mm/mempolicy.c | 17 +++-------------- mm/page_alloc.c | 8 ++------ 3 files changed, 14 insertions(+), 20 deletions(-) commit 2cafb582173f3870240af90de3f31d18b0728882 Author: Hugh Dickins Date: Tue Oct 3 02:24:18 2023 -0700 mempolicy: remove confusing MPOL_MF_LAZY dead code v3.8 commit b24f53a0bea3 ("mm: mempolicy: Add MPOL_MF_LAZY") introduced MPOL_MF_LAZY, and included it in the MPOL_MF_VALID flags; but a720094ded8 ("mm: mempolicy: Hide MPOL_NOOP and MPOL_MF_LAZY from userspace for now") immediately removed it from MPOL_MF_VALID flags, pending further review. "This will need to be revisited", but it has not been reinstated. The present state is confusing: there is dead code in mm/mempolicy.c to handle MPOL_MF_LAZY cases which can never occur. Remove that: it can be resurrected later if necessary. But keep the definition of MPOL_MF_LAZY, which must remain in the UAPI, even though it always fails with EINVAL. https://lore.kernel.org/linux-mm/1553041659-46787-1-git-send-email-yang.shi@linux.alibaba.com/ links to a previous request to remove MPOL_MF_LAZY. Link: https://lkml.kernel.org/r/80c9665c-1c3f-17ba-21a3-f6115cebf7d@google.com Signed-off-by: Hugh Dickins Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Yang Shi Cc: Andi Kleen Cc: Christoph Lameter Cc: David Hildenbrand Cc: Greg Kroah-Hartman Cc: "Huang, Ying" Cc: Kefeng Wang Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Kravetz Cc: Nhat Pham Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Tejun heo Cc: Vishal Moola (Oracle) Cc: Yosry Ahmed Signed-off-by: Andrew Morton include/uapi/linux/mempolicy.h | 2 +- mm/mempolicy.c | 18 ------------------ 2 files changed, 1 insertion(+), 19 deletions(-) commit 35ec8fa0207b3c7f7c3c22337c9a507d7b291626 Author: Hugh Dickins Date: Tue Oct 3 02:22:59 2023 -0700 mempolicy: mpol_shared_policy_init() without pseudo-vma mpol_shared_policy_init() does not need to use a pseudo-vma: it can use sp_alloc() and sp_insert() directly, since the object's shared policy tree is empty and inaccessible (needing no lock) at get_inode() time. Link: https://lkml.kernel.org/r/3bef62d8-ae78-4c2-533-56a44ae425c@google.com Signed-off-by: Hugh Dickins Cc: Andi Kleen Cc: Christoph Lameter Cc: David Hildenbrand Cc: Greg Kroah-Hartman Cc: "Huang, Ying" Cc: Kefeng Wang Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Kravetz Cc: Nhat Pham Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Tejun heo Cc: Vishal Moola (Oracle) Cc: Yang Shi Cc: Yosry Ahmed Signed-off-by: Andrew Morton mm/mempolicy.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) commit 93397c3b7684555b7cec726cd13eef6742d191fe Author: Hugh Dickins Date: Tue Oct 3 02:21:34 2023 -0700 mempolicy trivia: use pgoff_t in shared mempolicy tree Prefer the more explicit "pgoff_t" to "unsigned long" when dealing with a shared mempolicy tree. Delete confusing comment about pseudo mm vmas. Link: https://lkml.kernel.org/r/5451157-3818-4af5-fd2c-5d26a5d1dc53@google.com Signed-off-by: Hugh Dickins Cc: Andi Kleen Cc: Christoph Lameter Cc: David Hildenbrand Cc: Greg Kroah-Hartman Cc: "Huang, Ying" Cc: Kefeng Wang Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Kravetz Cc: Nhat Pham Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Tejun heo Cc: Vishal Moola (Oracle) Cc: Yang Shi Cc: Yosry Ahmed Signed-off-by: Andrew Morton include/linux/mempolicy.h | 20 +++++++------------- mm/mempolicy.c | 12 ++++++------ 2 files changed, 13 insertions(+), 19 deletions(-) commit c36f6e6dff4d32ec8b6da8f553933727a57a7a4a Author: Hugh Dickins Date: Tue Oct 3 02:20:14 2023 -0700 mempolicy trivia: slightly more consistent naming Before getting down to work, do a little cleanup, mainly of inconsistent variable naming. I gave up trying to rationalize mpol versus pol versus policy, and node versus nid, but let's avoid p and nd. Remove a few superfluous blank lines, but add one; and here prefer vma->vm_policy to vma_policy(vma) - the latter being appropriate in other sources, which have to allow for !CONFIG_NUMA. That intriguing line about KERNEL_DS? should have gone in v2.6.15, when numa_policy_init() stopped using set_mempolicy(2)'s system call handler. Link: https://lkml.kernel.org/r/68287974-b6ae-7df-4ba-d19ddd69cbf@google.com Signed-off-by: Hugh Dickins Reviewed-by: Matthew Wilcox (Oracle) Cc: Andi Kleen Cc: Christoph Lameter Cc: David Hildenbrand Cc: Greg Kroah-Hartman Cc: "Huang, Ying" Cc: Kefeng Wang Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Kravetz Cc: Nhat Pham Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Tejun heo Cc: Vishal Moola (Oracle) Cc: Yang Shi Cc: Yosry Ahmed Signed-off-by: Andrew Morton include/linux/mempolicy.h | 11 ++++--- mm/mempolicy.c | 73 +++++++++++++++++++++-------------------------- 2 files changed, 38 insertions(+), 46 deletions(-) commit 7f1ee4e2070883d18a431c761db8bb30a958b654 Author: Hugh Dickins Date: Tue Oct 3 02:19:00 2023 -0700 mempolicy trivia: delete those ancient pr_debug()s Delete those ancient pr_debug()s - PDprintk()s in Andi Kleen's original submission of core NUMA API, and useful when debugging shared mempolicy lifetime back then, but not used recently. Link: https://lkml.kernel.org/r/f25135-ffb2-40d8-9577-720772b333@google.com Signed-off-by: Hugh Dickins Reviewed-by: Matthew Wilcox (Oracle) Cc: Andi Kleen Cc: Christoph Lameter Cc: David Hildenbrand Cc: Greg Kroah-Hartman Cc: "Huang, Ying" Cc: Kefeng Wang Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Kravetz Cc: Nhat Pham Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Tejun heo Cc: Vishal Moola (Oracle) Cc: Yang Shi Cc: Yosry Ahmed Signed-off-by: Andrew Morton mm/mempolicy.c | 21 --------------------- 1 file changed, 21 deletions(-) commit 1cb5d11a370f661c5d0d888bb0cfc2cdc5791382 Author: Hugh Dickins Date: Tue Oct 3 02:17:43 2023 -0700 mempolicy: fix migrate_pages(2) syscall return nr_failed "man 2 migrate_pages" says "On success migrate_pages() returns the number of pages that could not be moved". Although 5.3 and 5.4 commits fixed mbind(MPOL_MF_STRICT|MPOL_MF_MOVE*) to fail with EIO when not all pages could be moved (because some could not be isolated for migration), migrate_pages(2) was left still reporting only those pages failing at the migration stage, forgetting those failing at the earlier isolation stage. Fix that by accumulating a long nr_failed count in struct queue_pages, returned by queue_pages_range() when it's not returning an error, for adding on to the nr_failed count from migrate_pages() in mm/migrate.c. A count of pages? It's more a count of folios, but changing it to pages would entail more work (also in mm/migrate.c): does not seem justified. queue_pages_range() itself should only return -EIO in the "strictly unmovable" case (STRICT without any MOVEs): in that case it's best to break out as soon as nr_failed gets set; but otherwise it should continue to isolate pages for MOVing even when nr_failed - as the mbind(2) manpage promises. There's a case when nr_failed should be incremented when it was missed: queue_folios_pte_range() and queue_folios_hugetlb() count the transient migration entries, like queue_folios_pmd() already did. And there's a case when nr_failed should not be incremented when it would have been: in meeting later PTEs of the same large folio, which can only be isolated once: fixed by recording the current large folio in struct queue_pages. Clean up the affected functions, fixing or updating many comments. Bool migrate_folio_add(), without -EIO: true if adding, or if skipping shared (but its arguable folio_estimated_sharers() heuristic left unchanged). Use MPOL_MF_WRLOCK flag to queue_pages_range(), instead of bool lock_vma. Use explicit STRICT|MOVE* flags where queue_pages_test_walk() checks for skipping, instead of hiding them behind MPOL_MF_VALID. Link: https://lkml.kernel.org/r/9a6b0b9-3bb-dbef-8adf-efab4397b8d@google.com Signed-off-by: Hugh Dickins Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: "Huang, Ying" Cc: Andi Kleen Cc: Christoph Lameter Cc: David Hildenbrand Cc: Greg Kroah-Hartman Cc: Kefeng Wang Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Kravetz Cc: Nhat Pham Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Tejun heo Cc: Vishal Moola (Oracle) Cc: Yang Shi Cc: Yosry Ahmed Signed-off-by: Andrew Morton mm/mempolicy.c | 338 +++++++++++++++++++++++++++------------------------------ 1 file changed, 159 insertions(+), 179 deletions(-) commit 4b981bc1aa73c204c2aa7f99b5f4f74d03b0e381 Author: Hugh Dickins Date: Tue Oct 3 02:16:29 2023 -0700 kernfs: drop shared NUMA mempolicy hooks It seems strange that kernfs should be an outlier with a set_policy and get_policy in its kernfs_vm_ops. Ah, it dates back to v2.6.30's commit 095160aee954 ("sysfs: fix some bin_vm_ops errors"), when I had crashed on powerpc's pci_mmap_legacy_page_range() fallback to shmem_zero_setup(). Well, that was commendably thorough, to give sysfs-bin a set_policy and get_policy, just to avoid the way it was coded resulting in EINVAL from mmap when CONFIG_NUMA; but somehow feels a bit over-the-top to me now. It's easier to say that nobody should expect to manage a shmem object's shared NUMA mempolicy via some kernfs backdoor to that object: delete that code (and there's no longer an EINVAL from mmap in the NUMA case). This then leaves set_policy/get_policy as implemented only by shmem - though importantly also by SysV SHM, which has to interface with shmem which implements them, and with SHM_HUGETLB which does not. Link: https://lkml.kernel.org/r/302164-a760-4a9e-879b-6870c9b4013@google.com Signed-off-by: Hugh Dickins Reviewed-by: Matthew Wilcox (Oracle) Cc: Andi Kleen Cc: Christoph Lameter Cc: David Hildenbrand Cc: Greg Kroah-Hartman Cc: "Huang, Ying" Cc: Kefeng Wang Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Kravetz Cc: Nhat Pham Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Tejun heo Cc: Vishal Moola (Oracle) Cc: Yang Shi Cc: Yosry Ahmed Signed-off-by: Andrew Morton fs/kernfs/file.c | 49 ------------------------------------------------- 1 file changed, 49 deletions(-) commit 10969b5571387047cd461a9c701b8b9cd007f6c7 Author: Hugh Dickins Date: Tue Oct 3 02:15:09 2023 -0700 hugetlbfs: drop shared NUMA mempolicy pretence Patch series "mempolicy: cleanups leading to NUMA mpol without vma", v2. Mostly cleanups in mm/mempolicy.c, but finally removing the pseudo-vma from shmem folio allocation, and removing the mmap_lock around folio migration for mbind and migrate_pages syscalls. This patch (of 12): hugetlbfs_fallocate() goes through the motions of pasting a shared NUMA mempolicy onto its pseudo-vma, but how could there ever be a shared NUMA mempolicy for this file? hugetlb_vm_ops has never offered a set_policy method, and hugetlbfs_parse_param() has never supported any mpol options for a mount-wide default policy. It's just an illusion: clean it away so as not to confuse others, giving us more freedom to adjust shmem's set_policy/get_policy implementation. But hugetlbfs_inode_info is still required, just to accommodate seals. Yes, shared NUMA mempolicy support could be added to hugetlbfs, with a set_policy method and/or mpol mount option (Andi's first posting did include an admitted-unsatisfactory hugetlb_set_policy()); but it seems that nobody has bothered to add that in the nineteen years since v2.6.7 made it possible, and there is at least one company that has invested enough into hugetlbfs, that I guess they have learnt well enough how to manage its NUMA, without needing shared mempolicy. Remove linux/mempolicy.h from linux/hugetlb.h: include linux/pagemap.h in its place, because hugetlb.h's recently added use of filemap_lock_folio() requires that (although most .configs and .c's get it in some other way). Link: https://lkml.kernel.org/r/ebc0987e-beff-8bfb-9283-234c2cbd17c5@google.com Link: https://lkml.kernel.org/r/cae82d4b-904a-faaf-282a-34fcc188c81f@google.com Signed-off-by: Hugh Dickins Reviewed-by: Matthew Wilcox (Oracle) Cc: Andi Kleen Cc: Christoph Lameter Cc: David Hildenbrand Cc: Greg Kroah-Hartman Cc: "Huang, Ying" Cc: Kefeng Wang Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Kravetz Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Tejun heo Cc: Vishal Moola (Oracle) Cc: Yang Shi Cc: Nhat Pham Cc: Yosry Ahmed Signed-off-by: Andrew Morton fs/hugetlbfs/inode.c | 41 +---------------------------------------- include/linux/hugetlb.h | 3 +-- 2 files changed, 2 insertions(+), 42 deletions(-) commit b8ee5575f763c239902f8523d82103a45c153b29 Author: SeongJae Park Date: Sun Oct 22 21:07:34 2023 +0000 mm/damon/sysfs-test: add a unit test for damon_sysfs_set_targets() damon_sysfs_set_targets() had a bug that can result in unexpected memory usage and monitoring overhead increase. The bug has fixed by a previous commit. Add a unit test for avoiding a similar bug of future. Link: https://lkml.kernel.org/r/20231022210735.46409-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Signed-off-by: Andrew Morton mm/damon/Kconfig | 12 +++++++ mm/damon/sysfs-test.h | 86 +++++++++++++++++++++++++++++++++++++++++++++++++++ mm/damon/sysfs.c | 2 ++ 3 files changed, 100 insertions(+) commit 62f76a7b53bfa2ecfe1570a5b1d0d574c576a56d Author: SeongJae Park Date: Thu Oct 19 19:49:24 2023 +0000 mm/damon/core: avoid divide-by-zero from pseudo-moving window length calculation When calculating the pseudo-moving access rate, DAMON divides some values by the maximum nr_accesses. However, due to the type of the related variables, simple division-based calculation of the divisor can return zero. As a result, divide-by-zero is possible. Fix it by using damon_max_nr_accesses(), which handles the case. Note that this is a fix for a commit that not in the mainline but mm tree. Link: https://lkml.kernel.org/r/20231019194924.100347-6-sj@kernel.org Fixes: ace30fb21af5 ("mm/damon/core: use pseudo-moving sum for nr_accesses_bp") Reported-by: Jakub Acs Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton mm/damon/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 44063f125af4bb4efd1d500d8091fa33a98af325 Author: SeongJae Park Date: Thu Oct 19 19:49:23 2023 +0000 mm/damon/lru_sort: avoid divide-by-zero in hot threshold calculation When calculating the hotness threshold for lru_prio scheme of DAMON_LRU_SORT, the module divides some values by the maximum nr_accesses. However, due to the type of the related variables, simple division-based calculation of the divisor can return zero. As a result, divide-by-zero is possible. Fix it by using damon_max_nr_accesses(), which handles the case. Link: https://lkml.kernel.org/r/20231019194924.100347-5-sj@kernel.org Fixes: 40e983cca927 ("mm/damon: introduce DAMON-based LRU-lists Sorting") Signed-off-by: SeongJae Park Reported-by: Jakub Acs Cc: [6.0+] Signed-off-by: Andrew Morton mm/damon/lru_sort.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 3bafc47d3c4a2fc4d3b382aeb3c087f8fc84d9fd Author: SeongJae Park Date: Thu Oct 19 19:49:22 2023 +0000 mm/damon/ops-common: avoid divide-by-zero during region hotness calculation When calculating the hotness of each region for the under-quota regions prioritization, DAMON divides some values by the maximum nr_accesses. However, due to the type of the related variables, simple division-based calculation of the divisor can return zero. As a result, divide-by-zero is possible. Fix it by using damon_max_nr_accesses(), which handles the case. Link: https://lkml.kernel.org/r/20231019194924.100347-4-sj@kernel.org Fixes: 198f0f4c58b9 ("mm/damon/vaddr,paddr: support pageout prioritization") Signed-off-by: SeongJae Park Reported-by: Jakub Acs Cc: [5.16+] Signed-off-by: Andrew Morton mm/damon/ops-common.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit d35963bfb05877455228ecec6b194f624489f96a Author: SeongJae Park Date: Thu Oct 19 19:49:21 2023 +0000 mm/damon/core: avoid divide-by-zero during monitoring results update When monitoring attributes are changed, DAMON updates access rate of the monitoring results accordingly. For that, it divides some values by the maximum nr_accesses. However, due to the type of the related variables, simple division-based calculation of the divisor can return zero. As a result, divide-by-zero is possible. Fix it by using damon_max_nr_accesses(), which handles the case. Link: https://lkml.kernel.org/r/20231019194924.100347-3-sj@kernel.org Fixes: 2f5bef5a590b ("mm/damon/core: update monitoring results for new monitoring attributes") Signed-off-by: SeongJae Park Reported-by: Jakub Acs Cc: [6.3+] Signed-off-by: Andrew Morton mm/damon/core.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) commit 35f5d94187a6a3a8df2cba54beccca1c2379edb8 Author: SeongJae Park Date: Thu Oct 19 19:49:20 2023 +0000 mm/damon: implement a function for max nr_accesses safe calculation Patch series "avoid divide-by-zero due to max_nr_accesses overflow". The maximum nr_accesses of given DAMON context can be calculated by dividing the aggregation interval by the sampling interval. Some logics in DAMON uses the maximum nr_accesses as a divisor. Hence, the value shouldn't be zero. Such case is avoided since DAMON avoids setting the agregation interval as samller than the sampling interval. However, since nr_accesses is unsigned int while the intervals are unsigned long, the maximum nr_accesses could be zero while casting. Avoid the divide-by-zero by implementing a function that handles the corner case (first patch), and replaces the vulnerable direct max nr_accesses calculations (remaining patches). Note that the patches for the replacements are divided for broken commits, to make backporting on required tres easier. Especially, the last patch is for a patch that not yet merged into the mainline but in mm tree. This patch (of 4): The maximum nr_accesses of given DAMON context can be calculated by dividing the aggregation interval by the sampling interval. Some logics in DAMON uses the maximum nr_accesses as a divisor. Hence, the value shouldn't be zero. Such case is avoided since DAMON avoids setting the agregation interval as samller than the sampling interval. However, since nr_accesses is unsigned int while the intervals are unsigned long, the maximum nr_accesses could be zero while casting. Implement a function that handles the corner case. Note that this commit is not fixing the real issue since this is only introducing the safe function that will replaces the problematic divisions. The replacements will be made by followup commits, to make backporting on stable series easier. Link: https://lkml.kernel.org/r/20231019194924.100347-1-sj@kernel.org Link: https://lkml.kernel.org/r/20231019194924.100347-2-sj@kernel.org Fixes: 198f0f4c58b9 ("mm/damon/vaddr,paddr: support pageout prioritization") Signed-off-by: SeongJae Park Reported-by: Jakub Acs Cc: [5.16+] Signed-off-by: Andrew Morton include/linux/damon.h | 7 +++++++ 1 file changed, 7 insertions(+) commit b1454b463c217e5bc553acc44b2389d9257c9708 Author: Hugh Dickins Date: Mon Oct 23 23:38:41 2023 -0700 mm: mlock: avoid folio_within_range() on KSM pages Since commit dc68badcede4 ("mm: mlock: update mlock_pte_range to handle large folio") I've just occasionally seen VM_WARN_ON_FOLIO(folio_test_ksm) warnings from folio_within_range(), in a splurge after testing with KSM hyperactive. folio_referenced_one()'s use of folio_within_vma() is safe because it checks folio_test_large() first; but allow_mlock_munlock() needs to do the same to avoid those warnings (or check !folio_test_ksm() itself? Or move either check into folio_within_range()? Hard to tell without more examples of its use). Link: https://lkml.kernel.org/r/23852f6a-5bfa-1ffd-30db-30c5560ad426@google.com Fixes: dc68badcede4 ("mm: mlock: update mlock_pte_range to handle large folio") Signed-off-by: Hugh Dickins Reviewed-by: Yin Fengwei Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Stefan Roesch Signed-off-by: Andrew Morton mm/mlock.c | 4 ++++ 1 file changed, 4 insertions(+) commit 1cbf0a58847b30507611f92ad69964ef37264d14 Author: Hugh Dickins Date: Mon Oct 23 23:26:08 2023 -0700 ext4: add __GFP_NOWARN to GFP_NOWAIT in readahead Since commit e509ad4d77e6 ("ext4: use bdev_getblk() to avoid memory reclaim in readahead path") rightly replaced GFP_NOFAIL allocations by GFP_NOWAIT allocations, I've occasionally been seeing "page allocation failure: order:0" warnings under load: all with ext4_sb_breadahead_unmovable() in the stack. I don't think those warnings are of any interest: suppress them with __GFP_NOWARN. Link: https://lkml.kernel.org/r/7bc6ad16-9a4d-dd90-202e-47d6cbb5a136@google.com Fixes: e509ad4d77e6 ("ext4: use bdev_getblk() to avoid memory reclaim in readahead path") Signed-off-by: Hugh Dickins Reviewed-by: Jan Kara Cc: Hui Zhu Cc: Matthew Wilcox (Oracle) Cc: Theodore Ts'o Signed-off-by: Andrew Morton fs/ext4/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit eebb3dabbb5cc590afe32880b5d3726d0fbf88db Author: Baolin Wang Date: Sat Oct 21 12:33:22 2023 +0800 mm: migrate: record the mlocked page status to remove unnecessary lru drain When doing compaction, I found the lru_add_drain() is an obvious hotspot when migrating pages. The distribution of this hotspot is as follows: - 18.75% compact_zone - 17.39% migrate_pages - 13.79% migrate_pages_batch - 11.66% migrate_folio_move - 7.02% lru_add_drain + 7.02% lru_add_drain_cpu + 3.00% move_to_new_folio 1.23% rmap_walk + 1.92% migrate_folio_unmap + 3.20% migrate_pages_sync + 0.90% isolate_migratepages The lru_add_drain() was added by commit c3096e6782b7 ("mm/migrate: __unmap_and_move() push good newpage to LRU") to drain the newpage to LRU immediately, to help to build up the correct newpage->mlock_count in remove_migration_ptes() for mlocked pages. However, if there are no mlocked pages are migrating, then we can avoid this lru drain operation, especailly for the heavy concurrent scenarios. So we can record the source pages' mlocked status in migrate_folio_unmap(), and only drain the lru list when the mlocked status is set in migrate_folio_move(). In addition, the page was already isolated from lru when migrating, so checking the mlocked status is stable by folio_test_mlocked() in migrate_folio_unmap(). After this patch, I can see the hotpot of the lru_add_drain() is gone: - 9.41% migrate_pages_batch - 6.15% migrate_folio_move - 3.64% move_to_new_folio + 1.80% migrate_folio_extra + 1.70% buffer_migrate_folio + 1.41% rmap_walk + 0.62% folio_add_lru + 3.07% migrate_folio_unmap Meanwhile, the compaction latency shows some improvements when running thpscale: base patched Amean fault-both-1 1131.22 ( 0.00%) 1112.55 * 1.65%* Amean fault-both-3 2489.75 ( 0.00%) 2324.15 * 6.65%* Amean fault-both-5 3257.37 ( 0.00%) 3183.18 * 2.28%* Amean fault-both-7 4257.99 ( 0.00%) 4079.04 * 4.20%* Amean fault-both-12 6614.02 ( 0.00%) 6075.60 * 8.14%* Amean fault-both-18 10607.78 ( 0.00%) 8978.86 * 15.36%* Amean fault-both-24 14911.65 ( 0.00%) 11619.55 * 22.08%* Amean fault-both-30 14954.67 ( 0.00%) 14925.66 * 0.19%* Amean fault-both-32 16654.87 ( 0.00%) 15580.31 * 6.45%* Link: https://lkml.kernel.org/r/06e9153a7a4850352ec36602df3a3a844de45698.1697859741.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: "Huang, Ying" Reviewed-by: Zi Yan Cc: Hugh Dickins Cc: Mel Gorman Cc: Vlastimil Babka Cc: Yin Fengwei Signed-off-by: Andrew Morton mm/migrate.c | 48 +++++++++++++++++++++++++++++------------------- 1 file changed, 29 insertions(+), 19 deletions(-) commit e5b16c862884a62c09ab60cbfc6c7b544670bf9e Author: Vegard Nossum Date: Sun Oct 22 20:56:19 2023 +0200 mm: hugetlb_vmemmap: fix reference to nonexistent file The directory this file is in was renamed but the reference didn't get updated. Fix it. Link: https://lkml.kernel.org/r/20231022185619.919397-1-vegard.nossum@oracle.com Fixes: ee65728e103b ("docs: rename Documentation/vm to Documentation/mm") Signed-off-by: Vegard Nossum Acked-by: Mike Rapoport (IBM) Reviewed-by: Muchun Song Reviewed-by: Rik van Riel Acked-by: Mike Kravetz Cc: Matthew Wilcox Cc: Ira Weiny Cc: Jonathan Corbet Cc: Wu XiangCheng Signed-off-by: Andrew Morton mm/hugetlb_vmemmap.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 76f26535d1446373d4735a252ea4247c39d64ba6 Author: Hyesoo Yu Date: Mon Oct 23 17:32:16 2023 +0900 mm: page_alloc: check the order of compound page even when the order is zero For compound pages, the head sets the PG_head flag and the tail sets the compound_head to indicate the head page. If a user allocates a compound page and frees it with a different order, the compound page information will not be properly initialized. To detect this problem, compound_order(page) and the order argument are compared, but this is not checked when the order argument is zero. That error should be checked regardless of the order. Link: https://lkml.kernel.org/r/20231023083217.1866451-1-hyesoo.yu@samsung.com Signed-off-by: Hyesoo Yu Reviewed-by: Vishal Moola (Oracle) Signed-off-by: Andrew Morton mm/page_alloc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit be16dd764a69752a31096d1a6b2ad775b728b1bd Author: Muhammad Muzammil Date: Mon Oct 23 17:44:05 2023 +0500 mm: fix multiple typos in multiple files Link: https://lkml.kernel.org/r/20231023124405.36981-1-m.muzzammilashraf@gmail.com Signed-off-by: Muhammad Muzammil Reviewed-by: Randy Dunlap Cc: "James E.J. Bottomley" Cc: Matthew Wilcox (Oracle) Cc: Muhammad Muzammil Signed-off-by: Andrew Morton mm/debug_vm_pgtable.c | 4 ++-- mm/internal.h | 2 +- mm/memcontrol.c | 4 ++-- mm/mmap.c | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) commit 98b32d296d95d7aa0516c36b72406277412268cd Author: Vishal Moola (Oracle) Date: Fri Oct 20 11:33:31 2023 -0700 mm/khugepaged: convert collapse_pte_mapped_thp() to use folios This removes 2 calls to compound_head() and helps convert khugepaged to use folios throughout. Previously, if the address passed to collapse_pte_mapped_thp() corresponded to a tail page, the scan would fail immediately. Using filemap_lock_folio() we get the corresponding folio back and try to operate on the folio instead. Link: https://lkml.kernel.org/r/20231020183331.10770-6-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: Rik van Riel Reviewed-by: Yang Shi Cc: Kefeng Wang Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton mm/khugepaged.c | 45 ++++++++++++++++++++------------------------- 1 file changed, 20 insertions(+), 25 deletions(-) commit b455f39d228935f88eebcd1f7c1a6981093c6a3b Author: Vishal Moola (Oracle) Date: Fri Oct 20 11:33:30 2023 -0700 mm/khugepaged: convert alloc_charge_hpage() to use folios Also remove count_memcg_page_event now that its last caller no longer uses it and reword hpage_collapse_alloc_page() to hpage_collapse_alloc_folio(). This removes 1 call to compound_head() and helps convert khugepaged to use folios throughout. Link: https://lkml.kernel.org/r/20231020183331.10770-5-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: Rik van Riel Reviewed-by: Yang Shi Cc: Kefeng Wang Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton include/linux/memcontrol.h | 14 -------------- mm/khugepaged.c | 17 ++++++++++------- 2 files changed, 10 insertions(+), 21 deletions(-) commit dbf85c21e4aff90912b5d7755d2b25611f9191e9 Author: Vishal Moola (Oracle) Date: Fri Oct 20 11:33:29 2023 -0700 mm/khugepaged: convert is_refcount_suitable() to use folios Both callers of is_refcount_suitable() have been converted to use folios, so convert it to take in a folio. Both callers only operate on head pages of folios so mapcount/refcount conversions here are trivial. Removes 3 calls to compound head, and removes 315 bytes of kernel text. Link: https://lkml.kernel.org/r/20231020183331.10770-4-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: David Hildenbrand Reviewed-by: Yang Shi Cc: Kefeng Wang Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton mm/khugepaged.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit 5c07ebb372d66423e508ecfb8e00324f8797f072 Author: Vishal Moola (Oracle) Date: Fri Oct 20 11:33:28 2023 -0700 mm/khugepaged: convert hpage_collapse_scan_pmd() to use folios Replaces 5 calls to compound_head(), and removes 1385 bytes of kernel text. Link: https://lkml.kernel.org/r/20231020183331.10770-3-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: Rik van Riel Reviewed-by: Yang Shi Cc: Kefeng Wang Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton mm/khugepaged.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit 8dd1e896735f6e5abf66525dfd39bbd7b8c0c6d6 Author: Vishal Moola (Oracle) Date: Fri Oct 20 11:33:27 2023 -0700 mm/khugepaged: convert __collapse_huge_page_isolate() to use folios Patch series "Some khugepaged folio conversions", v3. This patchset converts a number of functions to use folios. This cleans up some khugepaged code and removes a large number of hidden compound_head() calls. This patch (of 5): Replaces 11 calls to compound_head() with 1, and removes 1348 bytes of kernel text. Link: https://lkml.kernel.org/r/20231020183331.10770-1-vishal.moola@gmail.com Link: https://lkml.kernel.org/r/20231020183331.10770-2-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: David Hildenbrand Reviewed-by: Yang Shi Cc: Kefeng Wang Signed-off-by: Andrew Morton mm/khugepaged.c | 45 +++++++++++++++++++++++---------------------- 1 file changed, 23 insertions(+), 22 deletions(-) commit b7812c86c7403283f8b3775ee11c6c01d457016c Author: Qi Zheng Date: Thu Oct 19 18:43:55 2023 +0800 mm: memory_hotplug: drop memoryless node from fallback lists In offline_pages(), if a node becomes memoryless, we will clear its N_MEMORY state by calling node_states_clear_node(). But we do this after rebuilding the zonelists by calling build_all_zonelists(), which will cause this memoryless node to still be in the fallback nodes (node_order[]) of other nodes. To drop memoryless nodes from fallback nodes in this case, just call node_states_clear_node() before calling build_all_zonelists(). In this way, we will not try to allocate pages from memoryless node0, then the panic mentioned in [1] will also be fixed. Even though this problem has been solved by dropping the NODE_MIN_SIZE constrain in x86 [2], it would be better to fix it in the core MM as well. https://lore.kernel.org/all/20230212110305.93670-1-zhengqi.arch@bytedance.com/ [1] https://lore.kernel.org/all/20231017062215.171670-1-rppt@kernel.org/ [2] Link: https://lkml.kernel.org/r/9f1dbe7ee1301c7163b2770e32954ff5e3ecf2c4.1697711415.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Acked-by: David Hildenbrand Acked-by: Ingo Molnar Cc: Aneesh Kumar K.V Cc: "Huang, Ying" Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Vlastimil Babka Signed-off-by: Andrew Morton mm/memory_hotplug.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit c2baef394af88af19e3945f861145679e92ff3e4 Author: Qi Zheng Date: Thu Oct 19 18:43:54 2023 +0800 mm: page_alloc: skip memoryless nodes entirely Patch series "handle memoryless nodes more appropriately", v3. Currently, in the process of initialization or offline memory, memoryless nodes will still be built into the fallback list of itself or other nodes. This is not what we expected, so this patch series removes memoryless nodes from the fallback list entirely. This patch (of 2): In find_next_best_node(), we skipped the memoryless nodes when building the zonelists of other normal nodes (N_NORMAL), but did not skip the memoryless node itself when building the zonelist. This will cause it to be traversed at runtime. For example, say we have node0 and node1, node0 is memoryless node, then the fallback order of node0 and node1 as follows: [ 0.153005] Fallback order for Node 0: 0 1 [ 0.153564] Fallback order for Node 1: 1 After this patch, we skip memoryless node0 entirely, then the fallback order of node0 and node1 as follows: [ 0.155236] Fallback order for Node 0: 1 [ 0.155806] Fallback order for Node 1: 1 So it becomes completely invisible, which will reduce runtime overhead. And in this way, we will not try to allocate pages from memoryless node0, then the panic mentioned in [1] will also be fixed. Even though this problem has been solved by dropping the NODE_MIN_SIZE constrain in x86 [2], it would be better to fix it in core MM as well. [1]. https://lore.kernel.org/all/20230212110305.93670-1-zhengqi.arch@bytedance.com/ [2]. https://lore.kernel.org/all/20231017062215.171670-1-rppt@kernel.org/ [zhengqi.arch@bytedance.com: update comment, per Ingo] Link: https://lkml.kernel.org/r/7300fc00a057eefeb9a68c8ad28171c3f0ce66ce.1697799303.git.zhengqi.arch@bytedance.com Link: https://lkml.kernel.org/r/cover.1697799303.git.zhengqi.arch@bytedance.com Link: https://lkml.kernel.org/r/cover.1697711415.git.zhengqi.arch@bytedance.com Link: https://lkml.kernel.org/r/157013e978468241de4a4c05d5337a44638ecb0e.1697711415.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Acked-by: David Hildenbrand Acked-by: Ingo Molnar Cc: Aneesh Kumar K.V Cc: "Huang, Ying" Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Vlastimil Babka Signed-off-by: Andrew Morton mm/page_alloc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 49cac03a8f0a56cafa5329911564c97c130ced43 Author: Zi Yan Date: Tue Oct 17 12:31:29 2023 -0400 mm/migrate: add nr_split to trace_mm_migrate_pages stats. Add nr_split to trace_mm_migrate_pages for large folio (including THP) split events. [akpm@linux-foundation.org: cleanup per Huang, Ying] Link: https://lkml.kernel.org/r/20231017163129.2025214-2-zi.yan@sent.com Signed-off-by: Zi Yan Reviewed-by: "Huang, Ying" Reviewed-by: Baolin Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Matthew Wilcox Signed-off-by: Andrew Morton include/trace/events/migrate.h | 24 ++++++++++++++---------- mm/migrate.c | 5 +++-- 2 files changed, 17 insertions(+), 12 deletions(-) commit a259945efe6ada94087ef666e9b38f8e34ea34ba Author: Zi Yan Date: Tue Oct 17 12:31:28 2023 -0400 mm/migrate: correct nr_failed in migrate_pages_sync() nr_failed was missing the large folio splits from migrate_pages_batch() and can cause a mismatch between migrate_pages() return value and the number of not migrated pages, i.e., when the return value of migrate_pages() is 0, there are still pages left in the from page list. It will happen when a non-PMD THP large folio fails to migrate due to -ENOMEM and is split successfully but not all the split pages are not migrated, migrate_pages_batch() would return non-zero, but astats.nr_thp_split = 0. nr_failed would be 0 and returned to the caller of migrate_pages(), but the not migrated pages are left in the from page list without being added back to LRU lists. Fix it by adding a new nr_split counter for large folio splits and adding it to nr_failed in migrate_page_sync() after migrate_pages_batch() is done. Link: https://lkml.kernel.org/r/20231017163129.2025214-1-zi.yan@sent.com Fixes: 2ef7dbb26990 ("migrate_pages: try migrate in batch asynchronously firstly") Signed-off-by: Zi Yan Acked-by: Huang Ying Reviewed-by: Baolin Wang Cc: David Hildenbrand Cc: Matthew Wilcox Signed-off-by: Andrew Morton mm/migrate.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) commit 245245c2fffd0050772a3f30ba50e2be92537a32 Author: Liu Shixin Date: Mon Oct 23 10:51:25 2023 +0800 mm/kmemleak: move the initialisation of object to __link_object In patch (mm: kmemleak: split __create_object into two functions), the initialisation of object has been splited in two places. Catalin said it feels a bit weird and error prone. So leave __alloc_object() to just do the actual allocation and let __link_object() do the full initialisation. Link: https://lkml.kernel.org/r/20231023025125.90972-1-liushixin2@huawei.com Signed-off-by: Liu Shixin Suggested-by: Catalin Marinas Signed-off-by: Andrew Morton mm/kmemleak.c | 36 +++++++++++++++++------------------- 1 file changed, 17 insertions(+), 19 deletions(-) commit 5e4fc577db2514fee3cc2729415d0e2589d5d056 Author: Liu Shixin Date: Wed Oct 18 18:29:52 2023 +0800 mm/kmemleak: fix partially freeing unknown object warning delete_object_part() can be called by multiple callers in the same time. If an object is found and removed by a caller, and then another caller try to find it too, it failed and return directly. It still be recorded by kmemleak even if it has already been freed to buddy. With DEBUG on, kmemleak will report the following warning, kmemleak: Partially freeing unknown object at 0xa1af86000 (size 4096) CPU: 0 PID: 742 Comm: test_huge Not tainted 6.6.0-rc3kmemleak+ #54 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: dump_stack_lvl+0x37/0x50 kmemleak_free_part_phys+0x50/0x60 hugetlb_vmemmap_optimize+0x172/0x290 ? __pfx_vmemmap_remap_pte+0x10/0x10 __prep_new_hugetlb_folio+0xe/0x30 prep_new_hugetlb_folio.isra.0+0xe/0x40 alloc_fresh_hugetlb_folio+0xc3/0xd0 alloc_surplus_hugetlb_folio.constprop.0+0x6e/0xd0 hugetlb_acct_memory.part.0+0xe6/0x2a0 hugetlb_reserve_pages+0x110/0x2c0 hugetlbfs_file_mmap+0x11d/0x1b0 mmap_region+0x248/0x9a0 ? hugetlb_get_unmapped_area+0x15c/0x2d0 do_mmap+0x38b/0x580 vm_mmap_pgoff+0xe6/0x190 ksys_mmap_pgoff+0x18a/0x1f0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Expand __create_object() and move __alloc_object() to the beginning. Then use kmemleak_lock to protect __find_and_remove_object() and __link_object() as a whole, which can guarantee all objects are processed sequentialally. Link: https://lkml.kernel.org/r/20231018102952.3339837-8-liushixin2@huawei.com Fixes: 53238a60dd4a ("kmemleak: Allow partial freeing of memory blocks") Signed-off-by: Liu Shixin Reviewed-by: Catalin Marinas Cc: Kefeng Wang Cc: Patrick Wang Signed-off-by: Andrew Morton mm/kmemleak.c | 42 +++++++++++++++++++++++++++++++----------- 1 file changed, 31 insertions(+), 11 deletions(-) commit 858a195b9330d0bd36f59e8652f693a1beb7da2f Author: Liu Shixin Date: Wed Oct 18 18:29:51 2023 +0800 mm: kmemleak: add __find_and_remove_object() Add new __find_and_remove_object() without kmemleak_lock protect, it is in preparation for the next patch. Link: https://lkml.kernel.org/r/20231018102952.3339837-7-liushixin2@huawei.com Signed-off-by: Liu Shixin Acked-by: Catalin Marinas Cc: Kefeng Wang Cc: Patrick Wang Signed-off-by: Andrew Morton mm/kmemleak.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) commit 2e1d47385f98aa0fa7d71aeee32d26cc6f8493e0 Author: Liu Shixin Date: Wed Oct 18 18:29:50 2023 +0800 mm: kmemleak: use mem_pool_free() to free object The kmemleak object is allocated by mem_pool_alloc(), which could be from slab or mem_pool[], so it's not suitable using __kmem_cache_free() to free the object, use __mem_pool_free() instead. Link: https://lkml.kernel.org/r/20231018102952.3339837-6-liushixin2@huawei.com Fixes: 0647398a8c7b ("mm: kmemleak: simple memory allocation pool for kmemleak objects") Signed-off-by: Liu Shixin Reviewed-by: Catalin Marinas Cc: Kefeng Wang Cc: Patrick Wang Signed-off-by: Andrew Morton mm/kmemleak.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) commit 0edd7b58293340d26380d7510fd4fc08e5902511 Author: Liu Shixin Date: Wed Oct 18 18:29:49 2023 +0800 mm: kmemleak: split __create_object into two functions __create_object() consists of two part, the first part allocate a kmemleak object and initialize it, the second part insert it into object tree. This function need kmemleak_lock but actually only the second part need lock. Split it into two functions, the first function __alloc_object only allocate a kmemleak object, and the second function __link_object() will initialize the object and insert it into object tree, use the kmemleak_lock to protect __link_object() only. [akpm@linux-foundation.org: coding-style cleanups] Link: https://lkml.kernel.org/r/20231018102952.3339837-5-liushixin2@huawei.com Signed-off-by: Liu Shixin Cc: Catalin Marinas Cc: Kefeng Wang Cc: Patrick Wang Signed-off-by: Andrew Morton mm/kmemleak.c | 61 +++++++++++++++++++++++++++++++++++++++-------------------- 1 file changed, 40 insertions(+), 21 deletions(-) commit 62047e0f3e3a707599afe6d43cf684a2a02d05d5 Author: Liu Shixin Date: Wed Oct 18 18:29:48 2023 +0800 mm/kmemleak: fix print format of pointer in pr_debug() With 0x%p, the pointer will be hashed and print (____ptrval____) instead. And with 0x%pa, the pointer can be successfully printed but with duplicate prefixes, which looks like: kmemleak: kmemleak_free(0x(____ptrval____)) kmemleak: kmemleak_free_percpu(0x(____ptrval____)) kmemleak: kmemleak_free_part_phys(0x0x0000000a1af86000) Use 0x%px instead of 0x%p or 0x%pa to print the pointer. Then the print will be like: kmemleak: kmemleak_free(0xffff9111c145b020) kmemleak: kmemleak_free_percpu(0x00000000000333b0) kmemleak: kmemleak_free_part_phys(0x0000000a1af80000) Link: https://lkml.kernel.org/r/20231018102952.3339837-4-liushixin2@huawei.com Signed-off-by: Liu Shixin Acked-by: Catalin Marinas Cc: Kefeng Wang Cc: Patrick Wang Signed-off-by: Andrew Morton mm/kmemleak.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) commit 80203f1ca086835100843f1474bd6dd4a48cc73b Author: Liu Shixin Date: Wed Oct 18 18:29:47 2023 +0800 bootmem: use kmemleak_free_part_phys in free_bootmem_page Since kmemleak_alloc_phys() rather than kmemleak_alloc() was called from memblock_alloc_range_nid(), kmemleak_free_part_phys() should be used to delete kmemleak object in free_bootmem_page(). In debug mode, there are following warning: kmemleak: Partially freeing unknown object at 0xffff97345aff7000 (size 4096) Link: https://lkml.kernel.org/r/20231018102952.3339837-3-liushixin2@huawei.com Fixes: 028725e73375 ("bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page") Signed-off-by: Liu Shixin Acked-by: Catalin Marinas Cc: Kefeng Wang Cc: Patrick Wang Signed-off-by: Andrew Morton include/linux/bootmem_info.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6d4e2cda62af38f7c21052b6847ffff08ea7173f Author: Liu Shixin Date: Wed Oct 18 18:29:46 2023 +0800 bootmem: use kmemleak_free_part_phys in put_page_bootmem Patch series "Some bugfix about kmemleak", v3. Some bugfixes for kmemleak and the printed info from debug mode. This patch (of 7): Since kmemleak_alloc_phys() rather than kmemleak_alloc() was called from memblock_alloc_range_nid(), kmemleak_free_part_phys() should be used to delete kmemleak object in put_page_bootmem(). In debug mode, there are following warning: kmemleak: Partially freeing unknown object at 0xffff97345aff7000 (size 4096) Link: https://lkml.kernel.org/r/20231018102952.3339837-1-liushixin2@huawei.com Link: https://lkml.kernel.org/r/20231018102952.3339837-2-liushixin2@huawei.com Fixes: dd0ff4d12dd2 ("bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem") Signed-off-by: Liu Shixin Acked-by: Catalin Marinas Cc: Kefeng Wang Cc: Patrick Wang Signed-off-by: Andrew Morton mm/bootmem_info.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8f0f4788b1247c2f92ecacd8f86ce0b379b807b9 Author: Kefeng Wang Date: Wed Oct 18 22:08:06 2023 +0800 mm: remove page_cpupid_xchg_last() Since all calls use folio_xchg_last_cpupid(), remove page_cpupid_xchg_last(). Link: https://lkml.kernel.org/r/20231018140806.2783514-20-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton include/linux/mm.h | 19 +++++++------------ mm/mmzone.c | 6 +++--- 2 files changed, 10 insertions(+), 15 deletions(-) commit c2c3b5148052cef670d359b81d338d20b96bf47f Author: Kefeng Wang Date: Wed Oct 18 22:08:05 2023 +0800 mm: use folio_xchg_last_cpupid() in wp_page_reuse() Convert to use folio_xchg_last_cpupid() in wp_page_reuse(), and remove page variable. Since now only normal and PMD-mapped page is handled by numa balancing, it's enough to only update the entire folio's last cpupid. Link: https://lkml.kernel.org/r/20231018140806.2783514-19-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton mm/memory.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) commit a86bc96b77df40c27ead5ef4ac3837904b7eb53f Author: Kefeng Wang Date: Wed Oct 18 22:08:04 2023 +0800 mm: convert wp_page_reuse() and finish_mkwrite_fault() to take a folio Saves one compound_head() call, also in preparation for page_cpupid_xchg_last() conversion. Link: https://lkml.kernel.org/r/20231018140806.2783514-18-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton mm/memory.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) commit c08b7e3830dbf24dd2552ddeea84f00393842f1b Author: Kefeng Wang Date: Wed Oct 18 22:08:03 2023 +0800 mm: make finish_mkwrite_fault() static Make finish_mkwrite_fault static since it is not used outside of memory.c. Link: https://lkml.kernel.org/r/20231018140806.2783514-17-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton include/linux/mm.h | 1 - mm/memory.c | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) commit c82530113480f8db9dd9584c51ec9326e6ce9790 Author: Kefeng Wang Date: Wed Oct 18 22:08:02 2023 +0800 mm: huge_memory: use folio_xchg_last_cpupid() in __split_huge_page_tail() Convert to use folio_xchg_last_cpupid() in __split_huge_page_tail(). Link: https://lkml.kernel.org/r/20231018140806.2783514-16-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton mm/huge_memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4e694fe4d2fa3031392bdbeaa88066f67c886a0c Author: Kefeng Wang Date: Wed Oct 18 22:08:01 2023 +0800 mm: migrate: use folio_xchg_last_cpupid() in folio_migrate_flags() Convert to use folio_xchg_last_cpupid() in folio_migrate_flags(), also directly use folio_nid() instead of page_to_nid(&folio->page). Link: https://lkml.kernel.org/r/20231018140806.2783514-15-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton mm/migrate.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 1b143cc77f2074dd43b610d6bfffc822d20b6e16 Author: Kefeng Wang Date: Wed Oct 18 22:08:00 2023 +0800 sched/fair: use folio_xchg_last_cpupid() in should_numa_migrate_memory() Convert to use folio_xchg_last_cpupid() in should_numa_migrate_memory(). Link: https://lkml.kernel.org/r/20231018140806.2783514-14-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 136d0b47576f8701d68c2d504e7237d9fdc4ebbd Author: Kefeng Wang Date: Wed Oct 18 22:07:59 2023 +0800 mm: add folio_xchg_last_cpupid() Add folio_xchg_last_cpupid() wrapper, which is required to convert page_cpupid_xchg_last() to folio vertion later in the series. Link: https://lkml.kernel.org/r/20231018140806.2783514-13-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton include/linux/mm.h | 5 +++++ 1 file changed, 5 insertions(+) commit f393084382fa3bbd5840b428d538dbcb33be0186 Author: Kefeng Wang Date: Wed Oct 18 22:07:58 2023 +0800 mm: remove xchg_page_access_time() Since all calls use folio_xchg_access_time(), remove xchg_page_access_time(). Link: https://lkml.kernel.org/r/20231018140806.2783514-12-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton include/linux/mm.h | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) commit d986ba2b1953f761d3859c22160e82c58ed4287d Author: Kefeng Wang Date: Wed Oct 18 22:07:57 2023 +0800 mm: huge_memory: use a folio in change_huge_pmd() Use a folio in change_huge_pmd(), which helps to remove last xchg_page_access_time() caller. Link: https://lkml.kernel.org/r/20231018140806.2783514-11-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton mm/huge_memory.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit ec1778807a8053d14cde7cfd75fbd66e0c7b9c9f Author: Kefeng Wang Date: Wed Oct 18 22:07:56 2023 +0800 mm: mprotect: use a folio in change_pte_range() Use a folio in change_pte_range() to save three compound_head() calls. Since now only normal and PMD-mapped page is handled by numa balancing, it is enough to only update the entire folio's access time. Link: https://lkml.kernel.org/r/20231018140806.2783514-10-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton mm/mprotect.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) commit 0b201c3624ae9f58ebfff8484f304f3008fb01b8 Author: Kefeng Wang Date: Wed Oct 18 22:07:55 2023 +0800 sched/fair: use folio_xchg_access_time() in numa_hint_fault_latency() Convert to use folio_xchg_access_time() in numa_hint_fault_latency(). Link: https://lkml.kernel.org/r/20231018140806.2783514-9-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 55c199385c4465e9abe1a3d6d1aba348d0356e03 Author: Kefeng Wang Date: Wed Oct 18 22:07:54 2023 +0800 mm: add folio_xchg_access_time() Add folio_xchg_access_time() wrapper, which is required to convert xchg_page_access_time() to folio vertion later in the series. Link: https://lkml.kernel.org/r/20231018140806.2783514-8-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton include/linux/mm.h | 5 +++++ 1 file changed, 5 insertions(+) commit f39eac30a8f334f0765ef78fe4d13b3fd5bfa3fd Author: Kefeng Wang Date: Wed Oct 18 22:07:53 2023 +0800 mm: remove page_cpupid_last() Since all calls use folio_last_cpupid(), remove page_cpupid_last(). Link: https://lkml.kernel.org/r/20231018140806.2783514-7-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton include/linux/mm.h | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) commit 19c1ac02ce02158fa22eb53f2750525ae93da9ef Author: Kefeng Wang Date: Wed Oct 18 22:07:52 2023 +0800 mm: huge_memory: use folio_last_cpupid() in __split_huge_page_tail() Convert to use folio_last_cpupid() in __split_huge_page_tail(). Link: https://lkml.kernel.org/r/20231018140806.2783514-6-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton mm/huge_memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c4a8d2faab1f9165df1543795254b1c2470ce7f8 Author: Kefeng Wang Date: Wed Oct 18 22:07:51 2023 +0800 mm: huge_memory: use folio_last_cpupid() in do_huge_pmd_numa_page() Convert to use folio_last_cpupid() in do_huge_pmd_numa_page(). Link: https://lkml.kernel.org/r/20231018140806.2783514-5-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton mm/huge_memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 67b33e3ff58374b3fca929933ccc04a1858fda6a Author: Kefeng Wang Date: Wed Oct 18 22:07:50 2023 +0800 mm: memory: use folio_last_cpupid() in do_numa_page() Convert to use folio_last_cpupid() in do_numa_page(). Link: https://lkml.kernel.org/r/20231018140806.2783514-4-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton mm/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 155c98cfcf961327adedabd629edfc2301cf354b Author: Kefeng Wang Date: Wed Oct 18 22:07:49 2023 +0800 mm: add folio_last_cpupid() Add folio_last_cpupid() wrapper, which is required to convert page_cpupid_last() to folio vertion later in the series. Link: https://lkml.kernel.org/r/20231018140806.2783514-3-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton include/linux/mm.h | 5 +++++ 1 file changed, 5 insertions(+) commit 1d44f2e6d178163a94980fd5f9a4b04b6b36535b Author: Kefeng Wang Date: Wed Oct 18 22:07:48 2023 +0800 mm_types: add virtual and _last_cpupid into struct folio Patch series "mm: convert page cpupid functions to folios", v3. The cpupid(or access time) used by numa balancing is stored in flags or _last_cpupid(if LAST_CPUPID_NOT_IN_PAGE_FLAGS) of page, this is to convert page cpupid to folio cpupid, a new _last_cpupid is added into folio, which make us to use folio->_last_cpupid directly, and the page cpupid functions are converted to folio ones. page_cpupid_last() -> folio_last_cpupid() xchg_page_access_time() -> folio_xchg_access_time() page_cpupid_xchg_last() -> folio_xchg_last_cpupid() This patch (of 19): If WANT_PAGE_VIRTUAL and LAST_CPUPID_NOT_IN_PAGE_FLAGS defined, the 'virtual' and '_last_cpupid' are in struct page, and since _last_cpupid is used by numa balancing feature, it is better to move it before KMSAN metadata from struct page, also add them into struct folio to make us to access them from folio directly. Link: https://lkml.kernel.org/r/20231018140806.2783514-1-wangkefeng.wang@huawei.com Link: https://lkml.kernel.org/r/20231018140806.2783514-2-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: David Hildenbrand Cc: Huang Ying Cc: Ingo Molnar Cc: Juri Lelli Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Vincent Guittot Cc: Zi Yan Signed-off-by: Andrew Morton include/linux/mm_types.h | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) commit e5b306a082982cb98bc7ec48a382225522401a61 Author: Kairui Song Date: Tue Oct 17 09:17:28 2023 +0800 mm/swap: avoid a xa load for swapout path A variable is never used for swapout path (shadowp is NULL) and compiler is unable to optimize out the unneeded load since it's a function call. The was introduced by 3852f6768ede ("mm/swapcache: support to handle the shadow entries"). Link: https://lkml.kernel.org/r/20231017011728.37508-1-ryncsn@gmail.com Signed-off-by: Kairui Song Reviewed-by: Matthew Wilcox (Oracle) Cc: Huang Ying Signed-off-by: Andrew Morton mm/swap_state.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit e56808fef8f71a192b2740c0b6ea8be7ab865d54 Author: Roman Gushchin Date: Thu Oct 19 15:53:46 2023 -0700 mm: kmem: reimplement get_obj_cgroup_from_current() Reimplement get_obj_cgroup_from_current() using current_obj_cgroup(). get_obj_cgroup_from_current() and current_obj_cgroup() share 80% of the code, so the new implementation is almost trivial. get_obj_cgroup_from_current() is a convenient function used by the bpf subsystem, so there is no reason to get rid of it completely. Link: https://lkml.kernel.org/r/20231019225346.1822282-7-roman.gushchin@linux.dev Signed-off-by: Roman Gushchin (Cruise) Reviewed-by: Vlastimil Babka Acked-by: Shakeel Butt Cc: David Rientjes Cc: Dennis Zhou Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Naresh Kamboju Signed-off-by: Andrew Morton include/linux/memcontrol.h | 11 ++++++++++- mm/memcontrol.c | 32 -------------------------------- 2 files changed, 10 insertions(+), 33 deletions(-) commit c63b835d0eafc956c43b8c6605708240ac52b8cd Author: Roman Gushchin Date: Thu Oct 19 15:53:45 2023 -0700 percpu: scoped objcg protection Similar to slab and kmem, switch to a scope-based protection of the objcg pointer to avoid. Link: https://lkml.kernel.org/r/20231019225346.1822282-6-roman.gushchin@linux.dev Signed-off-by: Roman Gushchin (Cruise) Tested-by: Naresh Kamboju Acked-by: Shakeel Butt Reviewed-by: Vlastimil Babka Cc: David Rientjes Cc: Dennis Zhou Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Signed-off-by: Andrew Morton mm/percpu.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit e86828e5446d95676835679837d995dec188d2be Author: Roman Gushchin Date: Thu Oct 19 15:53:44 2023 -0700 mm: kmem: scoped objcg protection Switch to a scope-based protection of the objcg pointer on slab/kmem allocation paths. Instead of using the get_() semantics in the pre-allocation hook and put the reference afterwards, let's rely on the fact that objcg is pinned by the scope. It's possible because: 1) if the objcg is received from the current task struct, the task is keeping a reference to the objcg. 2) if the objcg is received from an active memcg (remote charging), the memcg is pinned by the scope and has a reference to the corresponding objcg. Link: https://lkml.kernel.org/r/20231019225346.1822282-5-roman.gushchin@linux.dev Signed-off-by: Roman Gushchin (Cruise) Tested-by: Naresh Kamboju Acked-by: Shakeel Butt Reviewed-by: Vlastimil Babka Cc: David Rientjes Cc: Dennis Zhou Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Signed-off-by: Andrew Morton include/linux/memcontrol.h | 9 +++++++++ include/linux/sched/mm.h | 4 ++++ mm/memcontrol.c | 47 ++++++++++++++++++++++++++++++++++++++++++++-- mm/slab.h | 15 ++++++++------- 4 files changed, 66 insertions(+), 9 deletions(-) commit 675d6c9b59e313ca2573c93e8fd87011a99bb8ce Author: Roman Gushchin Date: Thu Oct 19 15:53:43 2023 -0700 mm: kmem: make memcg keep a reference to the original objcg Keep a reference to the original objcg object for the entire life of a memcg structure. This allows to simplify the synchronization on the kernel memory allocation paths: pinning a (live) memcg will also pin the corresponding objcg. The memory overhead of this change is minimal because object cgroups usually outlive their corresponding memory cgroups even without this change, so it's only an additional pointer per memcg. Link: https://lkml.kernel.org/r/20231019225346.1822282-4-roman.gushchin@linux.dev Signed-off-by: Roman Gushchin (Cruise) Tested-by: Naresh Kamboju Acked-by: Shakeel Butt Reviewed-by: Vlastimil Babka Cc: David Rientjes Cc: Dennis Zhou Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Signed-off-by: Andrew Morton include/linux/memcontrol.h | 8 +++++++- mm/memcontrol.c | 5 +++++ 2 files changed, 12 insertions(+), 1 deletion(-) commit 1aacbd354313f25c855e662e41c04e2abf71444a Author: Roman Gushchin Date: Thu Oct 19 15:53:42 2023 -0700 mm: kmem: add direct objcg pointer to task_struct To charge a freshly allocated kernel object to a memory cgroup, the kernel needs to obtain an objcg pointer. Currently it does it indirectly by obtaining the memcg pointer first and then calling to __get_obj_cgroup_from_memcg(). Usually tasks spend their entire life belonging to the same object cgroup. So it makes sense to save the objcg pointer on task_struct directly, so it can be obtained faster. It requires some work on fork, exit and cgroup migrate paths, but these paths are way colder. To avoid any costly synchronization the following rules are applied: 1) A task sets it's objcg pointer itself. 2) If a task is being migrated to another cgroup, the least significant bit of the objcg pointer is set atomically. 3) On the allocation path the objcg pointer is obtained locklessly using the READ_ONCE() macro and the least significant bit is checked. If it's set, the following procedure is used to update it locklessly: - task->objcg is zeroed using cmpxcg - new objcg pointer is obtained - task->objcg is updated using try_cmpxchg - operation is repeated if try_cmpxcg fails It guarantees that no updates will be lost if task migration is racing against objcg pointer update. It also allows to keep both read and write paths fully lockless. Because the task is keeping a reference to the objcg, it can't go away while the task is alive. This commit doesn't change the way the remote memcg charging works. Link: https://lkml.kernel.org/r/20231019225346.1822282-3-roman.gushchin@linux.dev Signed-off-by: Roman Gushchin (Cruise) Tested-by: Naresh Kamboju Acked-by: Johannes Weiner Acked-by: Shakeel Butt Reviewed-by: Vlastimil Babka Cc: David Rientjes Cc: Dennis Zhou Cc: Michal Hocko Cc: Muchun Song Signed-off-by: Andrew Morton include/linux/sched.h | 4 ++ mm/memcontrol.c | 139 ++++++++++++++++++++++++++++++++++++++++++++++---- 2 files changed, 134 insertions(+), 9 deletions(-) commit 7d0715d0d6b28a831b6fdfefb29c5a7a4929fa49 Author: Roman Gushchin Date: Thu Oct 19 15:53:41 2023 -0700 mm: kmem: optimize get_obj_cgroup_from_current() Patch series "mm: improve performance of accounted kernel memory allocations", v5. This patchset improves the performance of accounted kernel memory allocations by ~30% as measured by a micro-benchmark [1]. The benchmark is very straightforward: 1M of 64 bytes-large kmalloc() allocations. Below are results with the disabled kernel memory accounting, the original state and with this patchset applied. | | Kmem disabled | Original | Patched | Delta | |-------------+---------------+----------+---------+--------| | User cgroup | 29764 | 84548 | 59078 | -30.0% | | Root cgroup | 29742 | 48342 | 31501 | -34.8% | As we can see, the patchset removes the majority of the overhead when there is no actual accounting (a task belongs to the root memory cgroup) and almost halves the accounting overhead otherwise. The main idea is to get rid of unnecessary memcg to objcg conversions and switch to a scope-based protection of objcgs, which eliminates extra operations with objcg reference counters under a rcu read lock. More details are provided in individual commit descriptions. This patch (of 5): Manually inline memcg_kmem_bypass() and active_memcg() to speed up get_obj_cgroup_from_current() by avoiding duplicate in_task() checks and active_memcg() readings. Also add a likely() macro to __get_obj_cgroup_from_memcg(): obj_cgroup_tryget() should succeed at almost all times except a very unlikely race with the memcg deletion path. Link: https://lkml.kernel.org/r/20231019225346.1822282-1-roman.gushchin@linux.dev Link: https://lkml.kernel.org/r/20231019225346.1822282-2-roman.gushchin@linux.dev Signed-off-by: Roman Gushchin (Cruise) Tested-by: Naresh Kamboju Acked-by: Shakeel Butt Acked-by: Johannes Weiner Reviewed-by: Vlastimil Babka Cc: David Rientjes Cc: Dennis Zhou Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Signed-off-by: Andrew Morton mm/memcontrol.c | 34 ++++++++++++++-------------------- 1 file changed, 14 insertions(+), 20 deletions(-) commit 6ccdcb6d3a741c4e005ca6ffd4a62ddf8b5bead3 Author: Huang Ying Date: Mon Oct 16 13:30:02 2023 +0800 mm, pcp: reduce detecting time of consecutive high order page freeing In current PCP auto-tuning design, if the number of pages allocated is much more than that of pages freed on a CPU, the PCP high may become the maximal value even if the allocating/freeing depth is small, for example, in the sender of network workloads. If a CPU was used as sender originally, then it is used as receiver after context switching, we need to fill the whole PCP with maximal high before triggering PCP draining for consecutive high order freeing. This will hurt the performance of some network workloads. To solve the issue, in this patch, we will track the consecutive page freeing with a counter in stead of relying on PCP draining. So, we can detect consecutive page freeing much earlier. On a 2-socket Intel server with 128 logical CPU, we tested SCTP_STREAM_MANY test case of netperf test suite with 64-pair processes. With the patch, the network bandwidth improves 5.0%. This restores the performance drop caused by PCP auto-tuning. Link: https://lkml.kernel.org/r/20231016053002.756205-10-ying.huang@intel.com Signed-off-by: "Huang, Ying" Cc: Mel Gorman Cc: Vlastimil Babka Cc: David Hildenbrand Cc: Johannes Weiner Cc: Dave Hansen Cc: Michal Hocko Cc: Pavel Tatashin Cc: Matthew Wilcox Cc: Christoph Lameter Cc: Arjan van de Ven Cc: Sudeep Holla Signed-off-by: Andrew Morton include/linux/mmzone.h | 2 +- mm/page_alloc.c | 27 +++++++++++++++------------ 2 files changed, 16 insertions(+), 13 deletions(-) commit 57c0419c5f0ea2ccab8700895c8fac20ba1eb21f Author: Huang Ying Date: Mon Oct 16 13:30:01 2023 +0800 mm, pcp: decrease PCP high if free pages < high watermark One target of PCP is to minimize pages in PCP if the system free pages is too few. To reach that target, when page reclaiming is active for the zone (ZONE_RECLAIM_ACTIVE), we will stop increasing PCP high in allocating path, decrease PCP high and free some pages in freeing path. But this may be too late because the background page reclaiming may introduce latency for some workloads. So, in this patch, during page allocation we will detect whether the number of free pages of the zone is below high watermark. If so, we will stop increasing PCP high in allocating path, decrease PCP high and free some pages in freeing path. With this, we can reduce the possibility of the premature background page reclaiming caused by too large PCP. The high watermark checking is done in allocating path to reduce the overhead in hotter freeing path. Link: https://lkml.kernel.org/r/20231016053002.756205-9-ying.huang@intel.com Signed-off-by: "Huang, Ying" Cc: Mel Gorman Cc: Vlastimil Babka Cc: David Hildenbrand Cc: Johannes Weiner Cc: Dave Hansen Cc: Michal Hocko Cc: Pavel Tatashin Cc: Matthew Wilcox Cc: Christoph Lameter Cc: Arjan van de Ven Cc: Sudeep Holla Signed-off-by: Andrew Morton include/linux/mmzone.h | 1 + mm/page_alloc.c | 33 +++++++++++++++++++++++++++++++-- 2 files changed, 32 insertions(+), 2 deletions(-) commit 51a755c56dc05a8b31ed28d24f28354946dc7529 Author: Huang Ying Date: Mon Oct 16 13:30:00 2023 +0800 mm: tune PCP high automatically The target to tune PCP high automatically is as follows, - Minimize allocation/freeing from/to shared zone - Minimize idle pages in PCP - Minimize pages in PCP if the system free pages is too few To reach these target, a tuning algorithm as follows is designed, - When we refill PCP via allocating from the zone, increase PCP high. Because if we had larger PCP, we could avoid to allocate from the zone. - In periodic vmstat updating kworker (via refresh_cpu_vm_stats()), decrease PCP high to try to free possible idle PCP pages. - When page reclaiming is active for the zone, stop increasing PCP high in allocating path, decrease PCP high and free some pages in freeing path. So, the PCP high can be tuned to the page allocating/freeing depth of workloads eventually. One issue of the algorithm is that if the number of pages allocated is much more than that of pages freed on a CPU, the PCP high may become the maximal value even if the allocating/freeing depth is small. But this isn't a severe issue, because there are no idle pages in this case. One alternative choice is to increase PCP high when we drain PCP via trying to free pages to the zone, but don't increase PCP high during PCP refilling. This can avoid the issue above. But if the number of pages allocated is much less than that of pages freed on a CPU, there will be many idle pages in PCP and it is hard to free these idle pages. 1/8 (>> 3) of PCP high will be decreased periodically. The value 1/8 is kind of arbitrary. Just to make sure that the idle PCP pages will be freed eventually. On a 2-socket Intel server with 224 logical CPU, we run 8 kbuild instances in parallel (each with `make -j 28`) in 8 cgroup. This simulates the kbuild server that is used by 0-Day kbuild service. With the patch, the build time decreases 3.5%. The cycles% of the spinlock contention (mostly for zone lock) decreases from 11.0% to 0.5%. The number of PCP draining for high order pages freeing (free_high) decreases 65.6%. The number of pages allocated from zone (instead of from PCP) decreases 83.9%. Link: https://lkml.kernel.org/r/20231016053002.756205-8-ying.huang@intel.com Signed-off-by: "Huang, Ying" Suggested-by: Mel Gorman Suggested-by: Michal Hocko Cc: Vlastimil Babka Cc: David Hildenbrand Cc: Johannes Weiner Cc: Dave Hansen Cc: Pavel Tatashin Cc: Matthew Wilcox Cc: Christoph Lameter Cc: Arjan van de Ven Cc: Sudeep Holla Signed-off-by: Andrew Morton include/linux/gfp.h | 1 + mm/page_alloc.c | 119 +++++++++++++++++++++++++++++++++++++++++----------- mm/vmstat.c | 8 ++-- 3 files changed, 99 insertions(+), 29 deletions(-) commit 90b41691b9881376fe784e13b5766ec3676fdb55 Author: Huang Ying Date: Mon Oct 16 13:29:59 2023 +0800 mm: add framework for PCP high auto-tuning The page allocation performance requirements of different workloads are usually different. So, we need to tune PCP (per-CPU pageset) high to optimize the workload page allocation performance. Now, we have a system wide sysctl knob (percpu_pagelist_high_fraction) to tune PCP high by hand. But, it's hard to find out the best value by hand. And one global configuration may not work best for the different workloads that run on the same system. One solution to these issues is to tune PCP high of each CPU automatically. This patch adds the framework for PCP high auto-tuning. With it, pcp->high of each CPU will be changed automatically by tuning algorithm at runtime. The minimal high (pcp->high_min) is the original PCP high value calculated based on the low watermark pages. While the maximal high (pcp->high_max) is the PCP high value when percpu_pagelist_high_fraction sysctl knob is set to MIN_PERCPU_PAGELIST_HIGH_FRACTION. That is, the maximal pcp->high that can be set via sysctl knob by hand. It's possible that PCP high auto-tuning doesn't work well for some workloads. So, when PCP high is tuned by hand via the sysctl knob, the auto-tuning will be disabled. The PCP high set by hand will be used instead. This patch only adds the framework, so pcp->high will be set to pcp->high_min (original default) always. We will add actual auto-tuning algorithm in the following patches in the series. Link: https://lkml.kernel.org/r/20231016053002.756205-7-ying.huang@intel.com Signed-off-by: "Huang, Ying" Acked-by: Mel Gorman Cc: Vlastimil Babka Cc: David Hildenbrand Cc: Johannes Weiner Cc: Dave Hansen Cc: Michal Hocko Cc: Pavel Tatashin Cc: Matthew Wilcox Cc: Christoph Lameter Cc: Arjan van de Ven Cc: Sudeep Holla Signed-off-by: Andrew Morton include/linux/mmzone.h | 5 +++- mm/page_alloc.c | 71 ++++++++++++++++++++++++++++++++------------------ 2 files changed, 50 insertions(+), 26 deletions(-) commit c0a242394cb980bd00e1f61dc8aacb453d2bbe6a Author: Huang Ying Date: Mon Oct 16 13:29:58 2023 +0800 mm, page_alloc: scale the number of pages that are batch allocated When a task is allocating a large number of order-0 pages, it may acquire the zone->lock multiple times allocating pages in batches. This may unnecessarily contend on the zone lock when allocating very large number of pages. This patch adapts the size of the batch based on the recent pattern to scale the batch size for subsequent allocations. On a 2-socket Intel server with 224 logical CPU, we run 8 kbuild instances in parallel (each with `make -j 28`) in 8 cgroup. This simulates the kbuild server that is used by 0-Day kbuild service. With the patch, the cycles% of the spinlock contention (mostly for zone lock) decreases from 12.6% to 11.0% (with PCP size == 367). Link: https://lkml.kernel.org/r/20231016053002.756205-6-ying.huang@intel.com Signed-off-by: "Huang, Ying" Suggested-by: Mel Gorman Acked-by: Mel Gorman Cc: Vlastimil Babka Cc: David Hildenbrand Cc: Johannes Weiner Cc: Dave Hansen Cc: Michal Hocko Cc: Pavel Tatashin Cc: Matthew Wilcox Cc: Christoph Lameter Cc: Arjan van de Ven Cc: Sudeep Holla Signed-off-by: Andrew Morton include/linux/mmzone.h | 3 ++- mm/page_alloc.c | 53 ++++++++++++++++++++++++++++++++++++++++---------- 2 files changed, 45 insertions(+), 11 deletions(-) commit 52166607ecc980391b1fffbce0be3074a96d0c7b Author: Huang Ying Date: Mon Oct 16 13:29:57 2023 +0800 mm: restrict the pcp batch scale factor to avoid too long latency In page allocator, PCP (Per-CPU Pageset) is refilled and drained in batches to increase page allocation throughput, reduce page allocation/freeing latency per page, and reduce zone lock contention. But too large batch size will cause too long maximal allocation/freeing latency, which may punish arbitrary users. So the default batch size is chosen carefully (in zone_batchsize(), the value is 63 for zone > 1GB) to avoid that. In commit 3b12e7e97938 ("mm/page_alloc: scale the number of pages that are batch freed"), the batch size will be scaled for large number of page freeing to improve page freeing performance and reduce zone lock contention. Similar optimization can be used for large number of pages allocation too. To find out a suitable max batch scale factor (that is, max effective batch size), some tests and measurement on some machines were done as follows. A set of debug patches are implemented as follows, - Set PCP high to be 2 * batch to reduce the effect of PCP high - Disable free batch size scaling to get the raw performance. - The code with zone lock held is extracted from rmqueue_bulk() and free_pcppages_bulk() to 2 separate functions to make it easy to measure the function run time with ftrace function_graph tracer. - The batch size is hard coded to be 63 (default), 127, 255, 511, 1023, 2047, 4095. Then will-it-scale/page_fault1 is used to generate the page allocation/freeing workload. The page allocation/freeing throughput (page/s) is measured via will-it-scale. The page allocation/freeing average latency (alloc/free latency avg, in us) and allocation/freeing latency at 99 percentile (alloc/free latency 99%, in us) are measured with ftrace function_graph tracer. The test results are as follows, Sapphire Rapids Server ====================== Batch throughput free latency free latency alloc latency alloc latency page/s avg / us 99% / us avg / us 99% / us ----- ---------- ------------ ------------ ------------- ------------- 63 513633.4 2.33 3.57 2.67 6.83 127 517616.7 4.35 6.65 4.22 13.03 255 520822.8 8.29 13.32 7.52 25.24 511 524122.0 15.79 23.42 14.02 49.35 1023 525980.5 30.25 44.19 25.36 94.88 2047 526793.6 59.39 84.50 45.22 140.81 Ice Lake Server =============== Batch throughput free latency free latency alloc latency alloc latency page/s avg / us 99% / us avg / us 99% / us ----- ---------- ------------ ------------ ------------- ------------- 63 620210.3 2.21 3.68 2.02 4.35 127 627003.0 4.09 6.86 3.51 8.28 255 630777.5 7.70 13.50 6.17 15.97 511 633651.5 14.85 22.62 11.66 31.08 1023 637071.1 28.55 42.02 20.81 54.36 2047 638089.7 56.54 84.06 39.28 91.68 Cascade Lake Server =================== Batch throughput free latency free latency alloc latency alloc latency page/s avg / us 99% / us avg / us 99% / us ----- ---------- ------------ ------------ ------------- ------------- 63 404706.7 3.29 5.03 3.53 4.75 127 422475.2 6.12 9.09 6.36 8.76 255 411522.2 11.68 16.97 10.90 16.39 511 428124.1 22.54 31.28 19.86 32.25 1023 414718.4 43.39 62.52 40.00 66.33 2047 429848.7 86.64 120.34 71.14 106.08 Commet Lake Desktop =================== Batch throughput free latency free latency alloc latency alloc latency page/s avg / us 99% / us avg / us 99% / us ----- ---------- ------------ ------------ ------------- ------------- 63 795183.13 2.18 3.55 2.03 3.05 127 803067.85 3.91 6.56 3.85 5.52 255 812771.10 7.35 10.80 7.14 10.20 511 817723.48 14.17 27.54 13.43 30.31 1023 818870.19 27.72 40.10 27.89 46.28 Coffee Lake Desktop =================== Batch throughput free latency free latency alloc latency alloc latency page/s avg / us 99% / us avg / us 99% / us ----- ---------- ------------ ------------ ------------- ------------- 63 510542.8 3.13 4.40 2.48 3.43 127 514288.6 5.97 7.89 4.65 6.04 255 516889.7 11.86 15.58 8.96 12.55 511 519802.4 23.10 28.81 16.95 26.19 1023 520802.7 45.30 52.51 33.19 45.95 2047 519997.1 90.63 104.00 65.26 81.74 From the above data, to restrict the allocation/freeing latency to be less than 100 us in most times, the max batch scale factor needs to be less than or equal to 5. Although it is reasonable to use 5 as max batch scale factor for the systems tested, there are also slower systems. Where smaller value should be used to constrain the page allocation/freeing latency. So, in this patch, a new kconfig option (PCP_BATCH_SCALE_MAX) is added to set the max batch scale factor. Whose default value is 5, and users can reduce it when necessary. Link: https://lkml.kernel.org/r/20231016053002.756205-5-ying.huang@intel.com Signed-off-by: "Huang, Ying" Acked-by: Andrew Morton Acked-by: Mel Gorman Cc: Vlastimil Babka Cc: David Hildenbrand Cc: Johannes Weiner Cc: Dave Hansen Cc: Michal Hocko Cc: Pavel Tatashin Cc: Matthew Wilcox Cc: Christoph Lameter Cc: Arjan van de Ven Cc: Sudeep Holla Signed-off-by: Andrew Morton mm/Kconfig | 11 +++++++++++ mm/page_alloc.c | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) commit 362d37a106dd3f6431b2fdd91d9208b0d023b50d Author: Huang Ying Date: Mon Oct 16 13:29:56 2023 +0800 mm, pcp: reduce lock contention for draining high-order pages In commit f26b3fa04611 ("mm/page_alloc: limit number of high-order pages on PCP during bulk free"), the PCP (Per-CPU Pageset) will be drained when PCP is mostly used for high-order pages freeing to improve the cache-hot pages reusing between page allocating and freeing CPUs. On system with small per-CPU data cache slice, pages shouldn't be cached before draining to guarantee cache-hot. But on a system with large per-CPU data cache slice, some pages can be cached before draining to reduce zone lock contention. So, in this patch, instead of draining without any caching, "pcp->batch" pages will be cached in PCP before draining if the size of the per-CPU data cache slice is more than "3 * batch". In theory, if the size of per-CPU data cache slice is more than "2 * batch", we can reuse cache-hot pages between CPUs. But considering the other usage of cache (code, other data accessing, etc.), "3 * batch" is used. Note: "3 * batch" is chosen to make sure the optimization works on recent x86_64 server CPUs. If you want to increase it, please check whether it breaks the optimization. On a 2-socket Intel server with 128 logical CPU, with the patch, the network bandwidth of the UNIX (AF_UNIX) test case of lmbench test suite with 16-pair processes increase 70.5%. The cycles% of the spinlock contention (mostly for zone lock) decreases from 46.1% to 21.3%. The number of PCP draining for high order pages freeing (free_high) decreases 89.9%. The cache miss rate keeps 0.2%. Link: https://lkml.kernel.org/r/20231016053002.756205-4-ying.huang@intel.com Signed-off-by: "Huang, Ying" Acked-by: Mel Gorman Cc: Sudeep Holla Cc: Vlastimil Babka Cc: David Hildenbrand Cc: Johannes Weiner Cc: Dave Hansen Cc: Michal Hocko Cc: Pavel Tatashin Cc: Matthew Wilcox Cc: Christoph Lameter Cc: Arjan van de Ven Signed-off-by: Andrew Morton drivers/base/cacheinfo.c | 2 ++ include/linux/gfp.h | 1 + include/linux/mmzone.h | 6 ++++++ mm/page_alloc.c | 38 +++++++++++++++++++++++++++++++++++++- 4 files changed, 46 insertions(+), 1 deletion(-) commit 94a3bfe4073cd88b05f7fb201ea7bf9dfa2cf5d5 Author: Huang Ying Date: Mon Oct 16 13:29:55 2023 +0800 cacheinfo: calculate size of per-CPU data cache slice This can be used to estimate the size of the data cache slice that can be used by one CPU under ideal circumstances. Both DATA caches and UNIFIED caches are used in calculation. So, the users need to consider the impact of the code cache usage. Because the cache inclusive/non-inclusive information isn't available now, we just use the size of the per-CPU slice of LLC to make the result more predictable across architectures. This may be improved when more cache information is available in the future. A brute-force algorithm to iterate all online CPUs is used to avoid to allocate an extra cpumask, especially in offline callback. Link: https://lkml.kernel.org/r/20231016053002.756205-3-ying.huang@intel.com Signed-off-by: "Huang, Ying" Acked-by: Mel Gorman Cc: Sudeep Holla Cc: Vlastimil Babka Cc: David Hildenbrand Cc: Johannes Weiner Cc: Dave Hansen Cc: Michal Hocko Cc: Pavel Tatashin Cc: Matthew Wilcox Cc: Christoph Lameter Cc: Arjan van de Ven Signed-off-by: Andrew Morton drivers/base/cacheinfo.c | 49 ++++++++++++++++++++++++++++++++++++++++++++++- include/linux/cacheinfo.h | 1 + 2 files changed, 49 insertions(+), 1 deletion(-) commit ca71fe1ad9221a89c6a25f49159c600d9e598ae1 Author: Huang Ying Date: Mon Oct 16 13:29:54 2023 +0800 mm, pcp: avoid to drain PCP when process exit Patch series "mm: PCP high auto-tuning", v3. The page allocation performance requirements of different workloads are often different. So, we need to tune the PCP (Per-CPU Pageset) high on each CPU automatically to optimize the page allocation performance. The list of patches in series is as follows, [1/9] mm, pcp: avoid to drain PCP when process exit [2/9] cacheinfo: calculate per-CPU data cache size [3/9] mm, pcp: reduce lock contention for draining high-order pages [4/9] mm: restrict the pcp batch scale factor to avoid too long latency [5/9] mm, page_alloc: scale the number of pages that are batch allocated [6/9] mm: add framework for PCP high auto-tuning [7/9] mm: tune PCP high automatically [8/9] mm, pcp: decrease PCP high if free pages < high watermark [9/9] mm, pcp: reduce detecting time of consecutive high order page freeing Patch [1/9], [2/9], [3/9] optimize the PCP draining for consecutive high-order pages freeing. Patch [4/9], [5/9] optimize batch freeing and allocating. Patch [6/9], [7/9], [8/9] implement and optimize a PCP high auto-tuning method. Patch [9/9] optimize the PCP draining for consecutive high order page freeing based on PCP high auto-tuning. The test results for patches with performance impact are as follows, kbuild ====== On a 2-socket Intel server with 224 logical CPU, we run 8 kbuild instances in parallel (each with `make -j 28`) in 8 cgroup. This simulates the kbuild server that is used by 0-Day kbuild service. build time lock contend% free_high alloc_zone ---------- ---------- --------- ---------- base 100.0 14.0 100.0 100.0 patch1 99.5 12.8 19.5 95.6 patch3 99.4 12.6 7.1 95.6 patch5 98.6 11.0 8.1 97.1 patch7 95.1 0.5 2.8 15.6 patch9 95.0 1.0 8.8 20.0 The PCP draining optimization (patch [1/9], [3/9]) and PCP batch allocation optimization (patch [5/9]) reduces zone lock contention a little. The PCP high auto-tuning (patch [7/9], [9/9]) reduces build time visibly. Where the tuning target: the number of pages allocated from zone reduces greatly. So, the zone contention cycles% reduces greatly. With PCP tuning patches (patch [7/9], [9/9]), the average used memory during test increases up to 18.4% because more pages are cached in PCP. But at the end of the test, the number of the used memory decreases to the same level as that of the base patch. That is, the pages cached in PCP will be released to zone after not being used actively. netperf SCTP_STREAM_MANY ======================== On a 2-socket Intel server with 128 logical CPU, we tested SCTP_STREAM_MANY test case of netperf test suite with 64-pair processes. score lock contend% free_high alloc_zone cache miss rate% ----- ---------- --------- ---------- ---------------- base 100.0 2.1 100.0 100.0 1.3 patch1 99.4 2.1 99.4 99.4 1.3 patch3 106.4 1.3 13.3 106.3 1.3 patch5 106.0 1.2 13.2 105.9 1.3 patch7 103.4 1.9 6.7 90.3 7.6 patch9 108.6 1.3 13.7 108.6 1.3 The PCP draining optimization (patch [1/9]+[3/9]) improves performance. The PCP high auto-tuning (patch [7/9]) reduces performance a little because PCP draining cannot be triggered in time sometimes. So, the cache miss rate% increases. The further PCP draining optimization (patch [9/9]) based on PCP tuning restore the performance. lmbench3 UNIX (AF_UNIX) ======================= On a 2-socket Intel server with 128 logical CPU, we tested UNIX (AF_UNIX socket) test case of lmbench3 test suite with 16-pair processes. score lock contend% free_high alloc_zone cache miss rate% ----- ---------- --------- ---------- ---------------- base 100.0 51.4 100.0 100.0 0.2 patch1 116.8 46.1 69.5 104.3 0.2 patch3 199.1 21.3 7.0 104.9 0.2 patch5 200.0 20.8 7.1 106.9 0.3 patch7 191.6 19.9 6.8 103.8 2.8 patch9 193.4 21.7 7.0 104.7 2.1 The PCP draining optimization (patch [1/9], [3/9]) improves performance much. The PCP tuning (patch [7/9]) reduces performance a little because PCP draining cannot be triggered in time sometimes. The further PCP draining optimization (patch [9/9]) based on PCP tuning restores the performance partly. The patchset adds several fields in struct per_cpu_pages. The struct layout before/after the patchset is as follows, base ==== struct per_cpu_pages { spinlock_t lock; /* 0 4 */ int count; /* 4 4 */ int high; /* 8 4 */ int batch; /* 12 4 */ short int free_factor; /* 16 2 */ short int expire; /* 18 2 */ /* XXX 4 bytes hole, try to pack */ struct list_head lists[13]; /* 24 208 */ /* size: 256, cachelines: 4, members: 7 */ /* sum members: 228, holes: 1, sum holes: 4 */ /* padding: 24 */ } __attribute__((__aligned__(64))); patched ======= struct per_cpu_pages { spinlock_t lock; /* 0 4 */ int count; /* 4 4 */ int high; /* 8 4 */ int high_min; /* 12 4 */ int high_max; /* 16 4 */ int batch; /* 20 4 */ u8 flags; /* 24 1 */ u8 alloc_factor; /* 25 1 */ u8 expire; /* 26 1 */ /* XXX 1 byte hole, try to pack */ short int free_count; /* 28 2 */ /* XXX 2 bytes hole, try to pack */ struct list_head lists[13]; /* 32 208 */ /* size: 256, cachelines: 4, members: 11 */ /* sum members: 237, holes: 2, sum holes: 3 */ /* padding: 16 */ } __attribute__((__aligned__(64))); The size of the struct doesn't changed with the patchset. This patch (of 9): In commit f26b3fa04611 ("mm/page_alloc: limit number of high-order pages on PCP during bulk free"), the PCP (Per-CPU Pageset) will be drained when PCP is mostly used for high-order pages freeing to improve the cache-hot pages reusing between page allocation and freeing CPUs. But, the PCP draining mechanism may be triggered unexpectedly when process exits. With some customized trace point, it was found that PCP draining (free_high == true) was triggered with the order-1 page freeing with the following call stack, => free_unref_page_commit => free_unref_page => __mmdrop => exit_mm => do_exit => do_group_exit => __x64_sys_exit_group => do_syscall_64 Checking the source code, this is the page table PGD freeing (mm_free_pgd()). It's a order-1 page freeing if CONFIG_PAGE_TABLE_ISOLATION=y. Which is a common configuration for security. Just before that, page freeing with the following call stack was found, => free_unref_page_commit => free_unref_page_list => release_pages => tlb_batch_pages_flush => tlb_finish_mmu => exit_mmap => __mmput => exit_mm => do_exit => do_group_exit => __x64_sys_exit_group => do_syscall_64 So, when a process exits, - a large number of user pages of the process will be freed without page allocation, it's highly possible that pcp->free_factor becomes > 0. In fact, this is expected behavior to improve process exit performance. - after freeing all user pages, the PGD will be freed, which is a order-1 page freeing, PCP will be drained. All in all, when a process exits, it's high possible that the PCP will be drained. This is an unexpected behavior. To avoid this, in the patch, the PCP draining will only be triggered for 2 consecutive high-order page freeing. On a 2-socket Intel server with 224 logical CPU, we run 8 kbuild instances in parallel (each with `make -j 28`) in 8 cgroup. This simulates the kbuild server that is used by 0-Day kbuild service. With the patch, the cycles% of the spinlock contention (mostly for zone lock) decreases from 14.0% to 12.8% (with PCP size == 367). The number of PCP draining for high order pages freeing (free_high) decreases 80.5%. This helps network workload too for reduced zone lock contention. On a 2-socket Intel server with 128 logical CPU, with the patch, the network bandwidth of the UNIX (AF_UNIX) test case of lmbench test suite with 16-pair processes increase 16.8%. The cycles% of the spinlock contention (mostly for zone lock) decreases from 51.4% to 46.1%. The number of PCP draining for high order pages freeing (free_high) decreases 30.5%. The cache miss rate keeps 0.2%. Link: https://lkml.kernel.org/r/20231016053002.756205-1-ying.huang@intel.com Link: https://lkml.kernel.org/r/20231016053002.756205-2-ying.huang@intel.com Signed-off-by: "Huang, Ying" Acked-by: Mel Gorman Cc: Vlastimil Babka Cc: David Hildenbrand Cc: Johannes Weiner Cc: Dave Hansen Cc: Michal Hocko Cc: Pavel Tatashin Cc: Matthew Wilcox Cc: Christoph Lameter Cc: Arjan van de Ven Cc: Sudeep Holla Signed-off-by: Andrew Morton include/linux/mmzone.h | 12 +++++++++++- mm/page_alloc.c | 11 ++++++++--- 2 files changed, 19 insertions(+), 4 deletions(-) commit 1f4f7f0f8845dbac40289cc3d50b81314c5a12b8 Author: Kairui Song Date: Mon Oct 16 19:31:03 2023 +0800 mm/oom_killer: simplify OOM killer info dump helper There is only one caller wants to dump the kill victim info, so just let it call the standalone helper, no need to make the generic info dump helper take an extra argument for that. Result of bloat-o-meter: ./scripts/bloat-o-meter ./mm/oom_kill.old.o ./mm/oom_kill.o add/remove: 0/0 grow/shrink: 1/2 up/down: 131/-142 (-11) Function old new delta oom_kill_process 412 543 +131 out_of_memory 1422 1418 -4 dump_header 562 424 -138 Total: Before=21514, After=21503, chg -0.05% Link: https://lkml.kernel.org/r/20231016113103.86477-1-ryncsn@gmail.com Signed-off-by: Kairui Song Acked-by: Michal Hocko Cc: Christian Brauner Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton mm/oom_kill.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 09aec5f9b2505c73a9380800f61ad920cc64a7cd Author: Pedro Falcato Date: Mon Oct 16 16:34:46 2023 +0100 mm: kmsan: panic on failure to allocate early boot metadata Given large enough allocations and a machine with low enough memory (i.e a default QEMU VM), it's entirely possible that kmsan_init_alloc_meta_for_range's shadow+origin allocation fails. Instead of eating a NULL deref kernel oops, check explicitly for memblock_alloc() failure and panic with a nice error message. Alexander Potapenko said: For posterity, it is generally quite important for the allocated shadow and origin to be contiguous, otherwise an unaligned memory write may result in memory corruption (the corresponding unaligned shadow write will be assuming that shadow pages are adjacent). So instead of panicking we could have split the range into smaller ones until the allocation succeeds, but that would've led to hard-to-debug problems in the future. Link: https://lkml.kernel.org/r/20231016153446.132763-1-pedro.falcato@gmail.com Signed-off-by: Pedro Falcato Reviewed-by: Alexander Potapenko Cc: Dmitry Vyukov Cc: Marco Elver Signed-off-by: Andrew Morton mm/kmsan/shadow.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 0a88810d9b76e6ecfd234f5728e27344a39e3ff8 Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:11:14 2023 +0100 buffer: remove folio_create_empty_buffers() With all users converted, remove the old create_empty_buffers() and rename folio_create_empty_buffers() to create_empty_buffers(). Link: https://lkml.kernel.org/r/20231016201114.1928083-28-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Andreas Gruenbacher Cc: Pankaj Raghav Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/buffer.c | 13 +++---------- fs/ext4/inode.c | 6 +++--- fs/ext4/move_extent.c | 4 ++-- fs/gfs2/aops.c | 2 +- fs/gfs2/bmap.c | 2 +- fs/gfs2/meta_io.c | 2 +- fs/gfs2/quota.c | 2 +- fs/mpage.c | 2 +- fs/nilfs2/mdt.c | 2 +- fs/nilfs2/page.c | 4 ++-- fs/nilfs2/segment.c | 2 +- fs/ntfs/aops.c | 4 ++-- fs/ntfs/file.c | 2 +- fs/ntfs3/file.c | 2 +- fs/ocfs2/aops.c | 2 +- fs/reiserfs/inode.c | 2 +- fs/ufs/util.c | 2 +- include/linux/buffer_head.h | 4 +--- 18 files changed, 25 insertions(+), 34 deletions(-) commit c9f2480ed7b221baf738edf431757e5ca4115bca Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:11:13 2023 +0100 ufs: remove ufs_get_locked_page() Both callers are now converted to ufs_get_locked_folio(). Link: https://lkml.kernel.org/r/20231016201114.1928083-27-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Andreas Gruenbacher Cc: Pankaj Raghav Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/ufs/util.c | 9 --------- fs/ufs/util.h | 7 ------- 2 files changed, 16 deletions(-) commit c7e8812ce5cfcb16c69faa86d38b36ddd3141ba9 Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:11:12 2023 +0100 ufs: convert ufs_change_blocknr() to use folios Convert the locked_page argument to a folio, then use folios throughout. Saves three hidden calls to compound_head(). Link: https://lkml.kernel.org/r/20231016201114.1928083-26-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Andreas Gruenbacher Cc: Pankaj Raghav Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/ufs/balloc.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) commit e7ca7f1725b3b0b276dd7c5119326b5e098abb53 Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:11:11 2023 +0100 ufs: use ufs_get_locked_folio() in ufs_alloc_lastblock() Switch to the folio APIs, saving one folio->page->folio conversion. Link: https://lkml.kernel.org/r/20231016201114.1928083-25-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Andreas Gruenbacher Cc: Pankaj Raghav Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/ufs/inode.c | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) commit 5fb7bd50b3516a9d5fea5775e7ebd43f0c96bb3d Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:11:10 2023 +0100 ufs: add ufs_get_locked_folio and ufs_put_locked_folio Convert the _page variants to call them. Saves a few hidden calls to compound_head(). Link: https://lkml.kernel.org/r/20231016201114.1928083-24-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Andreas Gruenbacher Cc: Pankaj Raghav Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/ufs/util.c | 43 +++++++++++++++++++++++++------------------ fs/ufs/util.h | 13 +++++++++---- 2 files changed, 34 insertions(+), 22 deletions(-) commit 44f68575267ecfc439d11bb782c69ba2598b3ed0 Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:11:09 2023 +0100 reiserfs: convert writepage to use a folio Convert the incoming page to a folio and then use it throughout the writeback path. This definitely isn't enough to support large folios, but I don't expect reiserfs to gain support for those before it is removed. Link: https://lkml.kernel.org/r/20231016201114.1928083-23-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Andreas Gruenbacher Cc: Pankaj Raghav Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/reiserfs/inode.c | 80 ++++++++++++++++++++++++++--------------------------- 1 file changed, 40 insertions(+), 40 deletions(-) commit 414ae0a440333143dcac39faaef00f098cceeff5 Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:11:08 2023 +0100 ocfs2: convert ocfs2_map_page_blocks to use a folio Convert the page argument to a folio and then use the folio APIs throughout. Replaces three hidden calls to compound_head() with one explicit one. Link: https://lkml.kernel.org/r/20231016201114.1928083-22-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Andreas Gruenbacher Cc: Pankaj Raghav Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/ocfs2/aops.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) commit c3f4200ac61ae98ea29d28519ea5076c04f22e06 Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:11:07 2023 +0100 ntfs3: convert ntfs_zero_range() to use a folio Use the folio API throughout, saving six hidden calls to compound_head(). Link: https://lkml.kernel.org/r/20231016201114.1928083-21-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Andreas Gruenbacher Cc: Pankaj Raghav Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/ntfs3/file.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) commit 24a7b35285c5514393e7ed46407111c68f4602ba Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:11:06 2023 +0100 ntfs: convert ntfs_prepare_pages_for_non_resident_write() to folios Convert each element of the pages array to a folio before using it. This in no way renders the function large-folio safe, but it does remove a lot of hidden calls to compound_head(). Link: https://lkml.kernel.org/r/20231016201114.1928083-20-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Andreas Gruenbacher Cc: Pankaj Raghav Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/ntfs/file.c | 89 +++++++++++++++++++++++++++------------------------------- 1 file changed, 41 insertions(+), 48 deletions(-) commit a04eb7cb186b4d537eefc2d68dba8a7e5eb7e6d7 Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:11:05 2023 +0100 ntfs: convert ntfs_writepage to use a folio Use folio APIs throughout. Saves many hidden calls to compound_head(). Link: https://lkml.kernel.org/r/20231016201114.1928083-19-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Andreas Gruenbacher Cc: Pankaj Raghav Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/ntfs/aops.c | 211 +++++++++++++++++++++++++++------------------------------ 1 file changed, 100 insertions(+), 111 deletions(-) commit a2da3afce96ce747ec0e1670bfc73fec85d20f95 Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:11:04 2023 +0100 ntfs: convert ntfs_read_block() to use a folio The caller already has the folio, so pass it in and use the folio API throughout saving five hidden calls to compound_head(). Link: https://lkml.kernel.org/r/20231016201114.1928083-18-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Andreas Gruenbacher Cc: Pankaj Raghav Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/ntfs/aops.c | 44 +++++++++++++++++++------------------------- 1 file changed, 19 insertions(+), 25 deletions(-) commit 922b12eff0b293fc13ae4045c7d7264e18938878 Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:11:03 2023 +0100 nilfs2: convert nilfs_lookup_dirty_data_buffers to use folio_create_empty_buffers This function was already using a folio, so this update to the new API removes a single folio->page->folio conversion. Link: https://lkml.kernel.org/r/20231016201114.1928083-17-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Ryusuke Konishi Cc: Andreas Gruenbacher Cc: Pankaj Raghav Signed-off-by: Andrew Morton fs/nilfs2/segment.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 73c32e07a3977f8470b29889d30d2f808e6fee4a Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:11:02 2023 +0100 nilfs2: remove nilfs_page_get_nth_block All users have now been converted to get_nth_block(). Link: https://lkml.kernel.org/r/20231016201114.1928083-16-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Ryusuke Konishi Cc: Andreas Gruenbacher Cc: Pankaj Raghav Signed-off-by: Andrew Morton fs/nilfs2/page.h | 6 ------ 1 file changed, 6 deletions(-) commit 664c87b75ef6ec3ebb97383891a6787b63925547 Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:11:01 2023 +0100 nilfs2: convert nilfs_mdt_get_frozen_buffer to use a folio Remove a number of folio->page->folio conversions. Link: https://lkml.kernel.org/r/20231016201114.1928083-15-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Ryusuke Konishi Cc: Andreas Gruenbacher Cc: Pankaj Raghav Signed-off-by: Andrew Morton fs/nilfs2/mdt.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) commit 1a846bf3884694b2f9ecbd70011927c2fb40f224 Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:11:00 2023 +0100 nilfs2: convert nilfs_mdt_forget_block() to use a folio Remove a number of folio->page->folio conversions. Link: https://lkml.kernel.org/r/20231016201114.1928083-14-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Ryusuke Konishi Cc: Andreas Gruenbacher Cc: Pankaj Raghav Signed-off-by: Andrew Morton fs/nilfs2/mdt.c | 30 ++++++++++++++---------------- 1 file changed, 14 insertions(+), 16 deletions(-) commit 4093602d6bbb2c82b922d1b442a022a069cdb59e Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:10:59 2023 +0100 nilfs2: convert nilfs_copy_page() to nilfs_copy_folio() Both callers already have a folio, so pass it in and use it directly. Removes a lot of hidden calls to compound_head(). Link: https://lkml.kernel.org/r/20231016201114.1928083-13-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Ryusuke Konishi Cc: Andreas Gruenbacher Cc: Pankaj Raghav Signed-off-by: Andrew Morton fs/nilfs2/page.c | 50 ++++++++++++++++++++++++++------------------------ mm/util.c | 1 + 2 files changed, 27 insertions(+), 24 deletions(-) commit c5521c7689b892c8ea684a284722b5584ba1ce8f Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:10:58 2023 +0100 nilfs2: convert nilfs_grab_buffer() to use a folio Remove a number of folio->page->folio conversions. Link: https://lkml.kernel.org/r/20231016201114.1928083-12-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Ryusuke Konishi Cc: Andreas Gruenbacher Cc: Pankaj Raghav Signed-off-by: Andrew Morton fs/nilfs2/page.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) commit 6c346be91dcf2b588510e41e4e04c0638af3d536 Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:10:57 2023 +0100 nilfs2: convert nilfs_mdt_freeze_buffer to use a folio Remove a number of folio->page->folio conversions. Link: https://lkml.kernel.org/r/20231016201114.1928083-11-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Ryusuke Konishi Cc: Andreas Gruenbacher Cc: Pankaj Raghav Signed-off-by: Andrew Morton fs/nilfs2/mdt.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) commit 4064a0aa8a6a341b14fb9ee8cf0f0bb86c575e3b Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:10:56 2023 +0100 gfs2: convert gfs2_write_buf_to_page() to use a folio Remove several folio->page->folio conversions. Link: https://lkml.kernel.org/r/20231016201114.1928083-10-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Andreas Gruenbacher Cc: Pankaj Raghav Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/gfs2/quota.c | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-) commit c646e573729bfe885280c343203c775f1f5d71c2 Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:10:55 2023 +0100 gfs2: convert gfs2_getjdatabuf to use a folio Use the folio APIs, saving four hidden calls to compound_head(). Link: https://lkml.kernel.org/r/20231016201114.1928083-9-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Andreas Gruenbacher Cc: Pankaj Raghav Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/gfs2/meta_io.c | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-) commit 0eb751791df86dc05a87fff1ada8d37044267a7e Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:10:54 2023 +0100 gfs2: convert gfs2_getbuf() to folios Remove several folio->page->folio conversions. Also use __GFP_NOFAIL instead of calling yield() and the new get_nth_bh(). Link: https://lkml.kernel.org/r/20231016201114.1928083-8-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Andreas Gruenbacher Cc: Pankaj Raghav Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/gfs2/meta_io.c | 39 +++++++++++++++++---------------------- 1 file changed, 17 insertions(+), 22 deletions(-) commit 81cb277ebdfd73b4b4cbfcdf377b4b514e90520a Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:10:53 2023 +0100 gfs2: convert inode unstuffing to use a folio Use the folio APIs, removing numerous hidden calls to compound_head(). Also remove the stale comment about the page being looked up if it's NULL. Link: https://lkml.kernel.org/r/20231016201114.1928083-7-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Andreas Gruenbacher Cc: Pankaj Raghav Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/gfs2/bmap.c | 48 +++++++++++++++++++++++------------------------- 1 file changed, 23 insertions(+), 25 deletions(-) commit 0217fbb0271a7c78e16629cf45375916ec2eb35f Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:10:52 2023 +0100 buffer: add get_nth_bh() Extract this useful helper from nilfs_page_get_nth_block() Link: https://lkml.kernel.org/r/20231016201114.1928083-6-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Ryusuke Konishi Cc: Andreas Gruenbacher Cc: Pankaj Raghav Signed-off-by: Andrew Morton fs/nilfs2/page.h | 7 +------ include/linux/buffer_head.h | 22 ++++++++++++++++++++++ 2 files changed, 23 insertions(+), 6 deletions(-) commit d4059993674b533798a551859042957bb5578332 Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:10:51 2023 +0100 ext4: convert to folio_create_empty_buffers Remove an unnecessary folio->page->folio conversion and take advantage of the new return value from folio_create_empty_buffers(). Link: https://lkml.kernel.org/r/20231016201114.1928083-5-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Pankaj Raghav Cc: Andreas Gruenbacher Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/ext4/inode.c | 14 +++++--------- fs/ext4/move_extent.c | 11 +++++------ 2 files changed, 10 insertions(+), 15 deletions(-) commit 4f05f139e3f8938c4c456bd886355c9bbcc3190d Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:10:50 2023 +0100 mpage: convert map_buffer_to_folio() to folio_create_empty_buffers() Saves a folio->page->folio conversion. Link: https://lkml.kernel.org/r/20231016201114.1928083-4-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Pankaj Raghav Cc: Andreas Gruenbacher Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/mpage.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 3decb8564eff88a2533f83b01cec2cf9259c3eaf Author: Matthew Wilcox (Oracle) Date: Mon Oct 16 21:10:49 2023 +0100 buffer: make folio_create_empty_buffers() return a buffer_head Patch series "Finish the create_empty_buffers() transition", v2. Pankaj recently added folio_create_empty_buffers() as the folio equivalent to create_empty_buffers(). This patch set finishes the conversion by first converting all remaining filesystems to call folio_create_empty_buffers(), then renaming it back to create_empty_buffers(). I took the opportunity to make a few simplifications like making folio_create_empty_buffers() return the head buffer and extracting get_nth_bh() from nilfs2. A few of the patches in this series aren't directly related to create_empty_buffers(), but I saw them while I was working on this and thought they'd be easy enough to add to this series. Compile-tested only, other than ext4. This patch (of 26): Almost all callers want to know the first BH that was allocated for this folio. We already have that handy, so return it. Link: https://lkml.kernel.org/r/20231016201114.1928083-1-willy@infradead.org Link: https://lkml.kernel.org/r/20231016201114.1928083-3-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Pankaj Raghav Cc: Andreas Gruenbacher Cc: Ryusuke Konishi Signed-off-by: Andrew Morton fs/buffer.c | 24 +++++++++++++----------- include/linux/buffer_head.h | 4 ++-- 2 files changed, 15 insertions(+), 13 deletions(-) commit c5ad3233ead566d74918bd76ba2dbdbe83ba1d9d Author: Usama Arif Date: Wed Oct 11 15:45:57 2023 +0100 hugetlb_vmemmap: use folio argument for hugetlb_vmemmap_* functions Most function calls in hugetlb.c are made with folio arguments. This brings hugetlb_vmemmap calls inline with them by using folio instead of head struct page. Head struct page is still needed within these functions. The set/clear/test functions for hugepages are also changed to folio versions. Link: https://lkml.kernel.org/r/20231011144557.1720481-2-usama.arif@bytedance.com Signed-off-by: Usama Arif Reviewed-by: Muchun Song Cc: Fam Zheng Cc: Mike Kravetz Cc: Punit Agrawal Signed-off-by: Andrew Morton mm/hugetlb.c | 14 +++++++------- mm/hugetlb_vmemmap.c | 50 ++++++++++++++++++++++++++------------------------ mm/hugetlb_vmemmap.h | 8 ++++---- 3 files changed, 37 insertions(+), 35 deletions(-) commit c24f188b22892908a2a3bb2de0ce7d121dd72989 Author: Mike Kravetz Date: Wed Oct 18 19:31:10 2023 -0700 hugetlb: batch TLB flushes when restoring vmemmap Update the internal hugetlb restore vmemmap code path such that TLB flushing can be batched. Use the existing mechanism of passing the VMEMMAP_REMAP_NO_TLB_FLUSH flag to indicate flushing should not be performed for individual pages. The routine hugetlb_vmemmap_restore_folios is the only user of this new mechanism, and it will perform a global flush after all vmemmap is restored. Link: https://lkml.kernel.org/r/20231019023113.345257-9-mike.kravetz@oracle.com Signed-off-by: Joao Martins Signed-off-by: Mike Kravetz Reviewed-by: Muchun Song Cc: Anshuman Khandual Cc: Barry Song <21cnbao@gmail.com> Cc: David Hildenbrand Cc: David Rientjes Cc: James Houghton Cc: Konrad Dybcio Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Oscar Salvador Cc: Sergey Senozhatsky Cc: Usama Arif Cc: Xiongchun Duan Signed-off-by: Andrew Morton mm/hugetlb_vmemmap.c | 39 ++++++++++++++++++++++++--------------- 1 file changed, 24 insertions(+), 15 deletions(-) commit f13b83fdd996409e3dbf6f34c7629a9d13fdb9c1 Author: Joao Martins Date: Wed Oct 18 19:31:09 2023 -0700 hugetlb: batch TLB flushes when freeing vmemmap Now that a list of pages is deduplicated at once, the TLB flush can be batched for all vmemmap pages that got remapped. Expand the flags field value to pass whether to skip the TLB flush on remap of the PTE. The TLB flush is global as we don't have guarantees from caller that the set of folios is contiguous, or to add complexity in composing a list of kVAs to flush. Modified by Mike Kravetz to perform TLB flush on single folio if an error is encountered. Link: https://lkml.kernel.org/r/20231019023113.345257-8-mike.kravetz@oracle.com Signed-off-by: Joao Martins Signed-off-by: Mike Kravetz Reviewed-by: Muchun Song Cc: Anshuman Khandual Cc: Barry Song <21cnbao@gmail.com> Cc: David Hildenbrand Cc: David Rientjes Cc: James Houghton Cc: Konrad Dybcio Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Oscar Salvador Cc: Sergey Senozhatsky Cc: Usama Arif Cc: Xiongchun Duan Signed-off-by: Andrew Morton mm/hugetlb_vmemmap.c | 49 ++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 38 insertions(+), 11 deletions(-) commit f4b7e3efaddbf8fa7cffacb5956b0823b7a7730a Author: Joao Martins Date: Wed Oct 18 19:31:08 2023 -0700 hugetlb: batch PMD split for bulk vmemmap dedup In an effort to minimize amount of TLB flushes, batch all PMD splits belonging to a range of pages in order to perform only 1 (global) TLB flush. Add a flags field to the walker and pass whether it's a bulk allocation or just a single page to decide to remap. First value (VMEMMAP_SPLIT_NO_TLB_FLUSH) designates the request to not do the TLB flush when we split the PMD. Rebased and updated by Mike Kravetz Link: https://lkml.kernel.org/r/20231019023113.345257-7-mike.kravetz@oracle.com Signed-off-by: Joao Martins Signed-off-by: Mike Kravetz Reviewed-by: Muchun Song Cc: Anshuman Khandual Cc: Barry Song <21cnbao@gmail.com> Cc: David Hildenbrand Cc: David Rientjes Cc: James Houghton Cc: Konrad Dybcio Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Oscar Salvador Cc: Sergey Senozhatsky Cc: Usama Arif Cc: Xiongchun Duan Signed-off-by: Andrew Morton mm/hugetlb_vmemmap.c | 92 +++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 88 insertions(+), 4 deletions(-) commit 91f386bf0772c1976622bd0b119b78094603c3d0 Author: Mike Kravetz Date: Wed Oct 18 19:31:07 2023 -0700 hugetlb: batch freeing of vmemmap pages Now that batching of hugetlb vmemmap optimization processing is possible, batch the freeing of vmemmap pages. When freeing vmemmap pages for a hugetlb page, we add them to a list that is freed after the entire batch has been processed. This enhances the ability to return contiguous ranges of memory to the low level allocators. Link: https://lkml.kernel.org/r/20231019023113.345257-6-mike.kravetz@oracle.com Signed-off-by: Mike Kravetz Reviewed-by: Muchun Song Cc: Anshuman Khandual Cc: Barry Song <21cnbao@gmail.com> Cc: David Hildenbrand Cc: David Rientjes Cc: James Houghton Cc: Joao Martins Cc: Konrad Dybcio Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Oscar Salvador Cc: Sergey Senozhatsky Cc: Usama Arif Cc: Xiongchun Duan Signed-off-by: Andrew Morton mm/hugetlb_vmemmap.c | 82 +++++++++++++++++++++++++++++++++++----------------- 1 file changed, 56 insertions(+), 26 deletions(-) commit cfb8c75099dbf152db1b075eead5029c5a30ce51 Author: Mike Kravetz Date: Wed Oct 18 19:31:06 2023 -0700 hugetlb: perform vmemmap restoration on a list of pages The routine update_and_free_pages_bulk already performs vmemmap restoration on the list of hugetlb pages in a separate step. In preparation for more functionality to be added in this step, create a new routine hugetlb_vmemmap_restore_folios() that will restore vmemmap for a list of folios. This new routine must provide sufficient feedback about errors and actual restoration performed so that update_and_free_pages_bulk can perform optimally. Special care must be taken when encountering an error from hugetlb_vmemmap_restore_folios. We want to continue making as much forward progress as possible. A new routine bulk_vmemmap_restore_error handles this specific situation. Link: https://lkml.kernel.org/r/20231019023113.345257-5-mike.kravetz@oracle.com Signed-off-by: Mike Kravetz Reviewed-by: Muchun Song Cc: Anshuman Khandual Cc: Barry Song <21cnbao@gmail.com> Cc: David Hildenbrand Cc: David Rientjes Cc: James Houghton Cc: Joao Martins Cc: Konrad Dybcio Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Oscar Salvador Cc: Sergey Senozhatsky Cc: Usama Arif Cc: Xiongchun Duan Signed-off-by: Andrew Morton mm/hugetlb.c | 99 +++++++++++++++++++++++++++++++++++++--------------- mm/hugetlb_vmemmap.c | 38 ++++++++++++++++++++ mm/hugetlb_vmemmap.h | 11 ++++++ 3 files changed, 120 insertions(+), 28 deletions(-) commit 79359d6d24df2f304abbf6f137b01d2b76175ce3 Author: Mike Kravetz Date: Wed Oct 18 19:31:05 2023 -0700 hugetlb: perform vmemmap optimization on a list of pages When adding hugetlb pages to the pool, we first create a list of the allocated pages before adding to the pool. Pass this list of pages to a new routine hugetlb_vmemmap_optimize_folios() for vmemmap optimization. Due to significant differences in vmemmmap initialization for bootmem allocated hugetlb pages, a new routine prep_and_add_bootmem_folios is created. We also modify the routine vmemmap_should_optimize() to check for pages that are already optimized. There are code paths that might request vmemmap optimization twice and we want to make sure this is not attempted. Link: https://lkml.kernel.org/r/20231019023113.345257-4-mike.kravetz@oracle.com Signed-off-by: Mike Kravetz Reviewed-by: Muchun Song Cc: Anshuman Khandual Cc: Barry Song <21cnbao@gmail.com> Cc: David Hildenbrand Cc: David Rientjes Cc: James Houghton Cc: Joao Martins Cc: Konrad Dybcio Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Oscar Salvador Cc: Sergey Senozhatsky Cc: Usama Arif Cc: Xiongchun Duan Signed-off-by: Andrew Morton mm/hugetlb.c | 43 +++++++++++++++++++++++++++++++++++-------- mm/hugetlb_vmemmap.c | 11 +++++++++++ mm/hugetlb_vmemmap.h | 5 +++++ 3 files changed, 51 insertions(+), 8 deletions(-) commit d67e32f26713c35669e343edfdce6fa97a7d6bbc Author: Mike Kravetz Date: Wed Oct 18 19:31:04 2023 -0700 hugetlb: restructure pool allocations Allocation of a hugetlb page for the hugetlb pool is done by the routine alloc_pool_huge_page. This routine will allocate contiguous pages from a low level allocator, prep the pages for usage as a hugetlb page and then add the resulting hugetlb page to the pool. In the 'prep' stage, optional vmemmap optimization is done. For performance reasons we want to perform vmemmap optimization on multiple hugetlb pages at once. To do this, restructure the hugetlb pool allocation code such that vmemmap optimization can be isolated and later batched. The code to allocate hugetlb pages from bootmem was also modified to allow batching. No functional changes, only code restructure. Link: https://lkml.kernel.org/r/20231019023113.345257-3-mike.kravetz@oracle.com Signed-off-by: Mike Kravetz Reviewed-by: Muchun Song Tested-by: Sergey Senozhatsky Cc: Anshuman Khandual Cc: Barry Song <21cnbao@gmail.com> Cc: David Hildenbrand Cc: David Rientjes Cc: James Houghton Cc: Joao Martins Cc: Konrad Dybcio Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Oscar Salvador Cc: Usama Arif Cc: Xiongchun Duan Signed-off-by: Andrew Morton mm/hugetlb.c | 180 ++++++++++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 141 insertions(+), 39 deletions(-) commit d2cf88c27f51361dfe2982e510a444411d2fc78a Author: Mike Kravetz Date: Wed Oct 18 19:31:03 2023 -0700 hugetlb: optimize update_and_free_pages_bulk to avoid lock cycles Patch series "Batch hugetlb vmemmap modification operations", v8. When hugetlb vmemmap optimization was introduced, the overhead of enabling the option was measured as described in commit 426e5c429d16 [1]. The summary states that allocating a hugetlb page should be ~2x slower with optimization and freeing a hugetlb page should be ~2-3x slower. Such overhead was deemed an acceptable trade off for the memory savings obtained by freeing vmemmap pages. It was recently reported that the overhead associated with enabling vmemmap optimization could be as high as 190x for hugetlb page allocations. Yes, 190x! Some actual numbers from other environments are: Bare Metal 8 socket Intel(R) Xeon(R) CPU E7-8895 ------------------------------------------------ Unmodified next-20230824, vm.hugetlb_optimize_vmemmap = 0 time echo 500000 > .../hugepages-2048kB/nr_hugepages real 0m4.119s time echo 0 > .../hugepages-2048kB/nr_hugepages real 0m4.477s Unmodified next-20230824, vm.hugetlb_optimize_vmemmap = 1 time echo 500000 > .../hugepages-2048kB/nr_hugepages real 0m28.973s time echo 0 > .../hugepages-2048kB/nr_hugepages real 0m36.748s VM with 252 vcpus on host with 2 socket AMD EPYC 7J13 Milan ----------------------------------------------------------- Unmodified next-20230824, vm.hugetlb_optimize_vmemmap = 0 time echo 524288 > .../hugepages-2048kB/nr_hugepages real 0m2.463s time echo 0 > .../hugepages-2048kB/nr_hugepages real 0m2.931s Unmodified next-20230824, vm.hugetlb_optimize_vmemmap = 1 time echo 524288 > .../hugepages-2048kB/nr_hugepages real 2m27.609s time echo 0 > .../hugepages-2048kB/nr_hugepages real 2m29.924s In the VM environment, the slowdown of enabling hugetlb vmemmap optimization resulted in allocation times being 61x slower. A quick profile showed that the vast majority of this overhead was due to TLB flushing. Each time we modify the kernel pagetable we need to flush the TLB. For each hugetlb that is optimized, there could be potentially two TLB flushes performed. One for the vmemmap pages associated with the hugetlb page, and potentially another one if the vmemmap pages are mapped at the PMD level and must be split. The TLB flushes required for the kernel pagetable, result in a broadcast IPI with each CPU having to flush a range of pages, or do a global flush if a threshold is exceeded. So, the flush time increases with the number of CPUs. In addition, in virtual environments the broadcast IPI can’t be accelerated by hypervisor hardware and leads to traps that need to wakeup/IPI all vCPUs which is very expensive. Because of this the slowdown in virtual environments is even worse than bare metal as the number of vCPUS/CPUs is increased. The following series attempts to reduce amount of time spent in TLB flushing. The idea is to batch the vmemmap modification operations for multiple hugetlb pages. Instead of doing one or two TLB flushes for each page, we do two TLB flushes for each batch of pages. One flush after splitting pages mapped at the PMD level, and another after remapping vmemmap associated with all hugetlb pages. Results of such batching are as follows: Bare Metal 8 socket Intel(R) Xeon(R) CPU E7-8895 ------------------------------------------------ next-20230824 + Batching patches, vm.hugetlb_optimize_vmemmap = 0 time echo 500000 > .../hugepages-2048kB/nr_hugepages real 0m4.719s time echo 0 > .../hugepages-2048kB/nr_hugepages real 0m4.245s next-20230824 + Batching patches, vm.hugetlb_optimize_vmemmap = 1 time echo 500000 > .../hugepages-2048kB/nr_hugepages real 0m7.267s time echo 0 > .../hugepages-2048kB/nr_hugepages real 0m13.199s VM with 252 vcpus on host with 2 socket AMD EPYC 7J13 Milan ----------------------------------------------------------- next-20230824 + Batching patches, vm.hugetlb_optimize_vmemmap = 0 time echo 524288 > .../hugepages-2048kB/nr_hugepages real 0m2.715s time echo 0 > .../hugepages-2048kB/nr_hugepages real 0m3.186s next-20230824 + Batching patches, vm.hugetlb_optimize_vmemmap = 1 time echo 524288 > .../hugepages-2048kB/nr_hugepages real 0m4.799s time echo 0 > .../hugepages-2048kB/nr_hugepages real 0m5.273s With batching, results are back in the 2-3x slowdown range. This patch (of 8): update_and_free_pages_bulk is designed to free a list of hugetlb pages back to their associated lower level allocators. This may require allocating vmemmmap pages associated with each hugetlb page. The hugetlb page destructor must be changed before pages are freed to lower level allocators. However, the destructor must be changed under the hugetlb lock. This means there is potentially one lock cycle per page. Minimize the number of lock cycles in update_and_free_pages_bulk by: 1) allocating necessary vmemmap for all hugetlb pages on the list 2) take hugetlb lock and clear destructor for all pages on the list 3) free all pages on list back to low level allocators Link: https://lkml.kernel.org/r/20231019023113.345257-1-mike.kravetz@oracle.com Link: https://lkml.kernel.org/r/20231019023113.345257-2-mike.kravetz@oracle.com Signed-off-by: Mike Kravetz Reviewed-by: Muchun Song Acked-by: James Houghton Cc: Anshuman Khandual Cc: Barry Song <21cnbao@gmail.com> Cc: David Hildenbrand Cc: David Rientjes Cc: Joao Martins Cc: Konrad Dybcio Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Oscar Salvador Cc: Sergey Senozhatsky Cc: Usama Arif Cc: Xiongchun Duan Signed-off-by: Andrew Morton mm/hugetlb.c | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) commit fa8c4f9a665bd0cf5a475327aea4fd179e896216 Author: Huang Ying Date: Fri Aug 11 17:08:19 2023 +0800 mm: fix draining remote pageset If there is no memory allocation/freeing in the PCP (Per-CPU Pageset) of a remote zone (zone in remote NUMA node) after some time (3 seconds for now), the pages of the PCP of the remote zone will be drained to avoid memory wastage. This behavior was introduced in the commit 4ae7c03943fc ("[PATCH] Periodically drain non local pagesets") and the commit 4037d452202e ("Move remote node draining out of slab allocators") But, after the commit 7cc36bbddde5 ("vmstat: on-demand vmstat workers V8"), the vmstat updater worker which is used to drain the PCP of remote zones may not be re-queued when we are waiting for the timeout (pcp->expire != 0) if there are no vmstat changes on this CPU, for example, when the CPU goes idle or runs user space only workloads. This may cause the pages of a remote zone be kept in PCP of this CPU for long time. So that, the page reclaiming of the remote zone may be triggered prematurely. This isn't a severe problem in practice, because the PCP of the remote zone will be drained if some memory are allocated/freed again on this CPU. And, the PCP will eventually be drained during the direct reclaiming if necessary. Anyway, the problem still deserves a fix via guaranteeing that the vmstat updater worker will always be re-queued when we are waiting for the timeout. In effect, this restores the original behavior before the commit 7cc36bbddde5. We can reproduce the bug via allocating/freeing pages from a remote zone then go idle as follows. And the patch can fix it. - Run some workloads, use `numactl` to bind CPU to node 0 and memory to node 1. So the PCP of the CPU on node 0 for zone on node 1 will be filled. - After workloads finish, idle for 60s - Check /proc/zoneinfo With the original kernel, the number of pages in the PCP of the CPU on node 0 for zone on node 1 is non-zero after idle. With the patched kernel, it becomes 0 after idle. That is, we avoid to keep pages in the remote PCP during idle. Link: https://lkml.kernel.org/r/20231007062356.187621-1-ying.huang@intel.com Link: https://lkml.kernel.org/r/20230811090819.60845-1-ying.huang@intel.com Fixes: 7cc36bbddde5 ("vmstat: on-demand vmstat workers V8") Signed-off-by: "Huang, Ying" Reviewed-by: Christoph Lameter Cc: Mel Gorman Cc: Vlastimil Babka Cc: Michal Hocko Signed-off-by: Andrew Morton mm/vmstat.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 13cf36c648df0c7de6b74ca7163713d8fcae53e2 Author: Kai-Heng Feng Date: Fri May 12 08:00:12 2023 +0800 PCI/AER: Factor out interrupt toggling into helpers There are many places that enable and disable AER interrupt, so move them into helpers. Link: https://lore.kernel.org/r/20230512000014.118942-1-kai.heng.feng@canonical.com Signed-off-by: Kai-Heng Feng Signed-off-by: Bjorn Helgaas Reviewed-by: Mika Westerberg Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Jonathan Cameron drivers/pci/pcie/aer.c | 45 +++++++++++++++++++++++++++------------------ 1 file changed, 27 insertions(+), 18 deletions(-) commit 3779416eed25a843364b940decee452620a1de4b Author: Ian Rogers Date: Mon Sep 25 20:10:34 2023 -0700 perf vendor events intel: Fix broadwellde tma_info_system_dram_bw_use metric Broadwell-de has a consumer core and server uncore. The uncore_arb PMU isn't present and the broadwellx style cbox PMU should be used instead. Fix the tma_info_system_dram_bw_use metric to use the server metric rather than client. The associated converter script fix is in: https://github.com/intel/perfmon/pull/111 Fixes: 7d124303d620 ("perf vendor events intel: Update broadwell variant events/metrics") Signed-off-by: Ian Rogers Reviewed-by: Kan Liang Cc: Caleb Biggers Cc: Perry Taylor Link: https://lore.kernel.org/r/20230926031034.1201145-1-irogers@google.com Signed-off-by: Namhyung Kim tools/perf/pmu-events/arch/x86/broadwellde/bdwde-metrics.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9b5c6281838fc84683dd99b47302d81fce399918 Author: Dominique Martinet Date: Wed Oct 25 19:34:44 2023 +0900 9p: v9fs_listxattr: fix %s null argument warning W=1 warns about null argument to kprintf: In file included from fs/9p/xattr.c:12: In function ‘v9fs_xattr_get’, inlined from ‘v9fs_listxattr’ at fs/9p/xattr.c:142:9: include/net/9p/9p.h:55:2: error: ‘%s’ directive argument is null [-Werror=format-overflow=] 55 | _p9_debug(level, __func__, fmt, ##__VA_ARGS__) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Use an empty string instead of : - this is ok 9p-wise because p9pdu_vwritef serializes a null string and an empty string the same way (one '0' word for length) - since this degrades the print statements, add new single quotes for xattr's name delimter (Old: "file = (null)", new: "file = ''") Link: https://lore.kernel.org/r/20231008060138.517057-1-suhui@nfschina.com Suggested-by: Su Hui Signed-off-by: Dominique Martinet Acked-by: Christian Schoenebeck Message-ID: <20231025103445.1248103-2-asmadeus@codewreck.org> fs/9p/xattr.c | 5 +++-- net/9p/client.c | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) commit 355f074609dbf3042900ea9d30fcd2b0c323a365 Author: Marco Elver Date: Wed Oct 25 19:34:43 2023 +0900 9p/trans_fd: Annotate data-racy writes to file::f_flags syzbot reported: | BUG: KCSAN: data-race in p9_fd_create / p9_fd_create | | read-write to 0xffff888130fb3d48 of 4 bytes by task 15599 on cpu 0: | p9_fd_open net/9p/trans_fd.c:842 [inline] | p9_fd_create+0x210/0x250 net/9p/trans_fd.c:1092 | p9_client_create+0x595/0xa70 net/9p/client.c:1010 | v9fs_session_init+0xf9/0xd90 fs/9p/v9fs.c:410 | v9fs_mount+0x69/0x630 fs/9p/vfs_super.c:123 | legacy_get_tree+0x74/0xd0 fs/fs_context.c:611 | vfs_get_tree+0x51/0x190 fs/super.c:1519 | do_new_mount+0x203/0x660 fs/namespace.c:3335 | path_mount+0x496/0xb30 fs/namespace.c:3662 | do_mount fs/namespace.c:3675 [inline] | __do_sys_mount fs/namespace.c:3884 [inline] | [...] | | read-write to 0xffff888130fb3d48 of 4 bytes by task 15563 on cpu 1: | p9_fd_open net/9p/trans_fd.c:842 [inline] | p9_fd_create+0x210/0x250 net/9p/trans_fd.c:1092 | p9_client_create+0x595/0xa70 net/9p/client.c:1010 | v9fs_session_init+0xf9/0xd90 fs/9p/v9fs.c:410 | v9fs_mount+0x69/0x630 fs/9p/vfs_super.c:123 | legacy_get_tree+0x74/0xd0 fs/fs_context.c:611 | vfs_get_tree+0x51/0x190 fs/super.c:1519 | do_new_mount+0x203/0x660 fs/namespace.c:3335 | path_mount+0x496/0xb30 fs/namespace.c:3662 | do_mount fs/namespace.c:3675 [inline] | __do_sys_mount fs/namespace.c:3884 [inline] | [...] | | value changed: 0x00008002 -> 0x00008802 Within p9_fd_open(), O_NONBLOCK is added to f_flags of the read and write files. This may happen concurrently if e.g. mounting process modifies the fd in another thread. Mark the plain read-modify-writes as intentional data-races, with the assumption that the result of executing the accesses concurrently will always result in the same result despite the accesses themselves not being atomic. Reported-by: syzbot+e441aeeb422763cc5511@syzkaller.appspotmail.com Signed-off-by: Marco Elver Link: https://lore.kernel.org/r/ZO38mqkS0TYUlpFp@elver.google.com Signed-off-by: Dominique Martinet Message-ID: <20231025103445.1248103-1-asmadeus@codewreck.org> net/9p/trans_fd.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) commit d621a46d05107f4e510383d6a38f2160c62d28f7 Author: Guenter Roeck Date: Wed Oct 25 14:32:40 2023 -0700 Revert "hwmon: (sch56xx-common) Add automatic module loading on supported devices" This reverts commit 393935baa45e5ccb9603cf7f9f020ed1bc0915f7. As reported by Ian Nartowicz, this and the next patch result in a failure to load the driver on Celsius W280. While the alternative would be to add the board to the DMI override table, it is quite likely that other systems are also affected. Revert the offending patches to avoid future problems. Fixes: 393935baa45e ("hwmon: (sch56xx-common) Add automatic module loading on supported devices") Reported-by: Ian Nartowicz Closes: https://lore.kernel.org/linux-hwmon/20231025192239.3c5389ae@debian.org/T/#t Cc: Armin Wolf Signed-off-by: Guenter Roeck drivers/hwmon/sch56xx-common.c | 40 ++-------------------------------------- 1 file changed, 2 insertions(+), 38 deletions(-) commit 28da9dee3594423534f3ea1e1f61e6bb2d2fa651 Author: Guenter Roeck Date: Wed Oct 25 14:28:49 2023 -0700 Revert "hwmon: (sch56xx-common) Add DMI override table" This reverts commit fd2d53c367ae9983c2100ac733a834e0c79d7537. As reported by Ian Nartowicz, this and the preceding patch result in a failure to load the driver on Celsius W280. While the alternative would be to add the board to the DMI override table, it is quite likely that other systems are also affected. Revert the offending patches to avoid future problems. Fixes: fd2d53c367ae ("hwmon: (sch56xx-common) Add DMI override table") Reported-by: Ian Nartowicz Closes: https://lore.kernel.org/linux-hwmon/20231025192239.3c5389ae@debian.org/T/#t Cc: Armin Wolf Signed-off-by: Guenter Roeck drivers/hwmon/sch56xx-common.c | 44 ++++++++++-------------------------------- 1 file changed, 10 insertions(+), 34 deletions(-) commit c505e1e4b10d751e93ca361d56d2270d6180a183 Merge: f652f84a9fbd 2806a69f3fef Author: Arnd Bergmann Date: Wed Oct 25 23:11:54 2023 +0200 Merge tag 'v6.7-rockchip-dts64-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt One new board the Turing RK1 system on module. Support for DFI (DDR performance monitoring) for rk3588, rk3568 and an enable-fix for rk3399 as well as some small fixups for the RGB30 handheld (non-existent uart and better vpll frequency). * tag 'v6.7-rockchip-dts64-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: Add Turing RK1 SoM support dt-bindings: arm: rockchip: Add Turing RK1 dt-bindings: vendor-prefixes: add turing arm64: dts: rockchip: Add DFI to rk3588s arm64: dts: rockchip: Add DFI to rk356x arm64: dts: rockchip: Always enable DFI on rk3399 arm64: dts: rockchip: Remove UART2 from RGB30 arm64: dts: rockchip: Update VPLL Frequency for RGB30 Link: https://lore.kernel.org/r/2777623.BEx9A2HvPv@phil Signed-off-by: Arnd Bergmann commit f652f84a9fbdc8db29d00c0b65aaf120e9152b2c Merge: a26dffc16361 a4d5bc3214eb Author: Arnd Bergmann Date: Wed Oct 25 23:10:28 2023 +0200 Merge tag 'ti-k3-dt-for-v6.7-part2' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt TI K3 device-tree updates for v6.7 - part 2 Second round of few DT updates for K3 platforms. These have been in linux-next for a few days without issues. Most of the additions is for newer AM62P SoC dtsi bringing support on par with rest of AM62x family. New features: AM62P SoCs: Support for wide range of peripherals such as eMMC/SD, CPSW Ethernet, OSPI, etc similar to AM62 J721s2/J784s4/AM69 SoCs: Display support via DP and HDMI interfaces and associated SerDes support AM654 EVM/IDK: ICSSG/PRU based industrial Ethernet support * tag 'ti-k3-dt-for-v6.7-part2' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: arm64: dts: ti: k3-am654-idk: Add ICSSG Ethernet ports arm64: dts: ti: k3-am654-icssg2: add ICSSG2 Ethernet support arm64: dts: ti: k3-am65-main: Add ICSSG IEP nodes arm64: dts: ti: k3-am62p5-sk: Updates for SK EVM arm64: dts: ti: k3-am62p: Add nodes for more IPs arm64: dts: ti: k3-am69-sk: Add DP and HDMI support arm64: dts: ti: k3-j784s4-evm: Enable DisplayPort-0 arm64: dts: ti: k3-j784s4-main: Add DSS and DP-bridge node arm64: dts: ti: k3-j784s4-main: Add WIZ and SERDES PHY nodes arm64: dts: ti: k3-j784s4-main: Add system controller and SERDES lane mux Link: https://lore.kernel.org/r/35a3c4c9-5c1b-4891-9ea2-e3f648a9afe0@ti.com Signed-off-by: Arnd Bergmann commit a26dffc16361438d96ff90d7451e43915589a0fa Merge: e209b029c7d7 253358f37349 Author: Arnd Bergmann Date: Wed Oct 25 23:09:25 2023 +0200 Merge tag 'arm-soc/for-6.7/devicetree' of https://github.com/Broadcom/stblinux into soc/dt This pull request contains Broadcom ARM-based SoCs changes for 6.7, please pull the following: - Rafal makes a number of updates to the BCM5301X (Northstar) SoCs DTS to set MAC addresses for D-LInk DIR-885L, Asus, RT-AC87U, he relicenses parts of the DTSI to GPL 2.0+ / MIT, and finally fixes a number of Ethernet switch ports properties to enable/disable ports adequately. * tag 'arm-soc/for-6.7/devicetree' of https://github.com/Broadcom/stblinux: ARM: dts: BCM5301X: Set switch ports for Linksys EA9200 ARM: dts: BCM5301X: Set fixed-link for extra Netgear R8000 CPU ports ARM: dts: BCM5301X: Explicitly disable unused switch CPU ports ARM: dts: BCM5301X: Relicense Vivek's code to the GPL 2.0+ / MIT ARM: dts: BCM5301X: Relicense Felix's code to the GPL 2.0+ / MIT ARM: dts: BCM5301X: Set MAC address for Asus RT-AC87U ARM: dts: BCM5301X: Set MACs for D-Link DIR-885L Link: https://lore.kernel.org/r/20231024155927.977263-1-florian.fainelli@broadcom.com Signed-off-by: Arnd Bergmann commit e209b029c7d7f6205e510633d6ba966900b87ac2 Merge: f0bb192440e6 4a48fa417abc Author: Arnd Bergmann Date: Wed Oct 25 23:08:35 2023 +0200 Merge tag 'samsung-dt-6.7-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM changes for v6.7, part two Two minor improvements for Midas boards (Exynos4412, e.g. Samsung Galaxy S3): 1. Correct the middle hardware key to emit KEY_OK instead of KEY_MENU, because there is already separate touchkey providing KEY_MENU and both label and node name suggests this should be KEY_OK. 2. Use defines for other key input constants. * tag 'samsung-dt-6.7-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: dts: samsung: exynos4412-midas: use Linux event codes for input keys ARM: dts: samsung: exynos4412-midas: fix key-ok event code Link: https://lore.kernel.org/r/20231024132615.65609-1-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit dfae947836d867e127e2b64f981ebb299c28f0dc Merge: 759c2e043a60 723d346173e7 Author: Arnd Bergmann Date: Wed Oct 25 22:58:30 2023 +0200 Merge tag 'qcom-drivers-for-6.7-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers More Qualcomm driver updates for v6.7 The Qualcomm SMC an QSEECOM drivers are moved into a "qcom" subdirectory, to declutter the base directory. Missing include guards are added to the qseecom header file. Unneded extern specifiers are removed from the scm call wrappers. __counted_by is added to the apr_rx_buf structure, in the APR driver. Lastly in the pmic_glink driver the pmic_glink drm_bridge type is corrected to DisplayPort, over the incorrect "USB" value. The return values are added to error prints for the various typec set() calls. * tag 'qcom-drivers-for-6.7-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: soc: qcom: pmic_glink_altmode: Print return value on error firmware: qcom: scm: remove unneeded 'extern' specifiers firmware: qcom: scm: add a missing forward declaration for struct device firmware: qcom: move Qualcomm code into its own directory soc: qcom: apr: Add __counted_by for struct apr_rx_buf and use struct_size() soc: qcom: pmic_glink: fix connector type to be DisplayPort firmware: qcom: qseecom: add missing include guards Link: https://lore.kernel.org/r/20231025201109.1016121-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 759c2e043a60a4603580bfd63342602ef11f1cec Merge: 8519f9c3c399 112cd2f9614d Author: Arnd Bergmann Date: Wed Oct 25 22:56:23 2023 +0200 Merge tag 'arm-soc/for-6.7/drivers' of https://github.com/Broadcom/stblinux into soc/drivers This pull request contains Broadcom ARM/ARM64/MIPS SoCs drivers changes for 6.7, please pull the following: - Kieran fixes the kdoc for devm_rpi_firmware_get - Peter updates the dependices of the brcmstb SoC driver and brcmstb_gisb drivers which are ARCH_BRCMSTB specific * tag 'arm-soc/for-6.7/drivers' of https://github.com/Broadcom/stblinux: bus: brcmstb_gisb: Depend on SoC specifics over generic arm soc: bcm: brcmstb: depend on ARCH_BRCMSTB over arm arches firmware: raspberrypi: Fix devm_rpi_firmware_get documentation Link: https://lore.kernel.org/r/20231024155927.977263-2-florian.fainelli@broadcom.com Signed-off-by: Arnd Bergmann commit 56e144fe98260a0f8a17326993ceb576ef859ed5 Author: Ian Rogers Date: Tue Oct 24 15:23:14 2023 -0700 perf mem_info: Add and use map_symbol__exit and addr_map_symbol__exit Fix leak where mem_info__put wouldn't release the maps/map as used by perf mem. Add exit functions and use elsewhere that the maps and map are released. Signed-off-by: Ian Rogers Cc: K Prateek Nayak Cc: Ravi Bangoria Cc: Sandipan Das Cc: Anshuman Khandual Cc: German Gomez Cc: James Clark Cc: Nick Terrell Cc: Sean Christopherson Cc: Changbin Du Cc: liuwenyu Cc: Yang Jihong Cc: Masami Hiramatsu Cc: Miguel Ojeda Cc: Song Liu Cc: Leo Yan Cc: Kajol Jain Cc: Andi Kleen Cc: Kan Liang Cc: Athira Rajeev Cc: Yanteng Si Cc: Liam Howlett Cc: Paolo Bonzini Link: https://lore.kernel.org/r/20231024222353.3024098-12-irogers@google.com Signed-off-by: Namhyung Kim tools/perf/util/Build | 1 + tools/perf/util/callchain.c | 27 +++++++++------------------ tools/perf/util/hist.c | 28 ++++++++++++---------------- tools/perf/util/machine.c | 6 ++---- tools/perf/util/map_symbol.c | 15 +++++++++++++++ tools/perf/util/map_symbol.h | 4 ++++ tools/perf/util/symbol.c | 5 ++++- 7 files changed, 47 insertions(+), 39 deletions(-) commit dec07fe5d4fd29aed2faf17f56140cd402175d72 Author: Ian Rogers Date: Tue Oct 24 15:23:13 2023 -0700 perf callchain: Minor layout changes to callchain_list Avoid 6 byte hole for padding. Place more frequently used fields first in an attempt to use just 1 cacheline in the common case. Before: ``` struct callchain_list { u64 ip; /* 0 8 */ struct map_symbol ms; /* 8 24 */ struct { _Bool unfolded; /* 32 1 */ _Bool has_children; /* 33 1 */ }; /* 32 2 */ /* XXX 6 bytes hole, try to pack */ u64 branch_count; /* 40 8 */ u64 from_count; /* 48 8 */ u64 predicted_count; /* 56 8 */ /* --- cacheline 1 boundary (64 bytes) --- */ u64 abort_count; /* 64 8 */ u64 cycles_count; /* 72 8 */ u64 iter_count; /* 80 8 */ u64 iter_cycles; /* 88 8 */ struct branch_type_stat * brtype_stat; /* 96 8 */ const char * srcline; /* 104 8 */ struct list_head list; /* 112 16 */ /* size: 128, cachelines: 2, members: 13 */ /* sum members: 122, holes: 1, sum holes: 6 */ }; ``` After: ``` struct callchain_list { struct list_head list; /* 0 16 */ u64 ip; /* 16 8 */ struct map_symbol ms; /* 24 24 */ const char * srcline; /* 48 8 */ u64 branch_count; /* 56 8 */ /* --- cacheline 1 boundary (64 bytes) --- */ u64 from_count; /* 64 8 */ u64 cycles_count; /* 72 8 */ u64 iter_count; /* 80 8 */ u64 iter_cycles; /* 88 8 */ struct branch_type_stat * brtype_stat; /* 96 8 */ u64 predicted_count; /* 104 8 */ u64 abort_count; /* 112 8 */ struct { _Bool unfolded; /* 120 1 */ _Bool has_children; /* 121 1 */ }; /* 120 2 */ /* size: 128, cachelines: 2, members: 13 */ /* padding: 6 */ }; ``` Signed-off-by: Ian Rogers Cc: K Prateek Nayak Cc: Ravi Bangoria Cc: Sandipan Das Cc: Anshuman Khandual Cc: German Gomez Cc: James Clark Cc: Nick Terrell Cc: Sean Christopherson Cc: Changbin Du Cc: liuwenyu Cc: Yang Jihong Cc: Masami Hiramatsu Cc: Miguel Ojeda Cc: Song Liu Cc: Leo Yan Cc: Kajol Jain Cc: Andi Kleen Cc: Kan Liang Cc: Athira Rajeev Cc: Yanteng Si Cc: Liam H