- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 1/8] ext4: fix race condition between ext4_ioctl_setflags and ext4_fiemap
by Yongqiang Liu 20 Jul '22

20 Jul '22

From: Baokun Li <libaokun1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187222, https://gitee.com/openeuler/kernel/issues/I5H3KE CVE: NA -------------------------------- Hulk Robot reported a BUG: ================================================================== kernel BUG at fs/ext4/extents_status.c:762! invalid opcode: 0000 [#1] SMP KASAN PTI [...] Call Trace: ext4_cache_extents+0x238/0x2f0 ext4_find_extent+0x785/0xa40 ext4_fiemap+0x36d/0xe90 do_vfs_ioctl+0x6af/0x1200 [...] ================================================================== Above issue may happen as follows: ------------------------------------- cpu1 cpu2 _____________________|_____________________ do_vfs_ioctl ext4_ioctl ext4_ioctl_setflags ext4_ind_migrate do_vfs_ioctl ioctl_fiemap ext4_fiemap ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS) ext4_fill_fiemap_extents down_write(&EXT4_I(inode)->i_data_sem); ext4_ext_check_inode ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS) memset(ei->i_data, 0, sizeof(ei->i_data)) up_write(&EXT4_I(inode)->i_data_sem); down_read(&EXT4_I(inode)->i_data_sem); ext4_find_extent ext4_cache_extents ext4_es_cache_extent BUG_ON(end < lblk) We can easily reproduce this problem with the syzkaller testcase: ``` 02:37:07 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x40086602, &(0x7f0000000080)={0x17e}) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000180)={0x0, 0x1, 0x0, 0xef3, 0x6, []}) (async, rerun: 32) ioctl$FS_IOC_FSSETXATTR(r1, 0x40086602, &(0x7f0000000140)={0x17e}) (rerun: 32) ``` To solve this issue, we use __generic_block_fiemap() instead of generic_block_fiemap() and add inode_lock_shared to avoid race condition. Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/extents.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index d08e6d4afba6..8e5ed3e315cd 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -5267,13 +5267,18 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, return error; } + inode_lock_shared(inode); /* fallback to generic here if not in extents fmt */ - if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) - return generic_block_fiemap(inode, fieinfo, start, len, + if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) { + error = __generic_block_fiemap(inode, fieinfo, start, len, ext4_get_block); + goto out_unlock; + } - if (fiemap_check_flags(fieinfo, EXT4_FIEMAP_FLAGS)) - return -EBADR; + if (fiemap_check_flags(fieinfo, EXT4_FIEMAP_FLAGS)) { + error = -EBADR; + goto out_unlock; + } if (fieinfo->fi_flags & FIEMAP_FLAG_XATTR) { error = ext4_xattr_fiemap(inode, fieinfo); @@ -5294,6 +5299,8 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, error = ext4_fill_fiemap_extents(inode, start_blk, len_blks, fieinfo); } +out_unlock: + inode_unlock_shared(inode); return error; } -- 2.25.1

1 7

[PATCH openEuler-5.10 01/29] crypto: hisilicon/sec - don't sleep when in softirq
by Zheng Zengkai 19 Jul '22

19 Jul '22

From: Zhengchao Shao <shaozhengchao(a)huawei.com> mainline inclusion from mainline-v5.19-rc6 commit 02884a4f12de11f54d4ca67a07dd1f111d96fdbd category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5GEVR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git/c… -------------------------------- When kunpeng920 encryption driver is used to deencrypt and decrypt packets during the softirq, it is not allowed to use mutex lock. The kernel will report the following error: BUG: scheduling while atomic: swapper/57/0/0x00000300 Call trace: dump_backtrace+0x0/0x1e4 show_stack+0x20/0x2c dump_stack+0xd8/0x140 __schedule_bug+0x68/0x80 __schedule+0x728/0x840 schedule+0x50/0xe0 schedule_preempt_disabled+0x18/0x24 __mutex_lock.constprop.0+0x594/0x5dc __mutex_lock_slowpath+0x1c/0x30 mutex_lock+0x50/0x60 sec_request_init+0x8c/0x1a0 [hisi_sec2] sec_process+0x28/0x1ac [hisi_sec2] sec_skcipher_crypto+0xf4/0x1d4 [hisi_sec2] sec_skcipher_encrypt+0x1c/0x30 [hisi_sec2] crypto_skcipher_encrypt+0x2c/0x40 crypto_authenc_encrypt+0xc8/0xfc [authenc] crypto_aead_encrypt+0x2c/0x40 echainiv_encrypt+0x144/0x1a0 [echainiv] crypto_aead_encrypt+0x2c/0x40 esp_output_tail+0x348/0x5c0 [esp4] esp_output+0x120/0x19c [esp4] xfrm_output_one+0x25c/0x4d4 xfrm_output_resume+0x6c/0x1fc xfrm_output+0xac/0x3c0 xfrm4_output+0x64/0x130 ip_build_and_send_pkt+0x158/0x20c tcp_v4_send_synack+0xdc/0x1f0 tcp_conn_request+0x7d0/0x994 tcp_v4_conn_request+0x58/0x6c tcp_v6_conn_request+0xf0/0x100 tcp_rcv_state_process+0x1cc/0xd60 tcp_v4_do_rcv+0x10c/0x250 tcp_v4_rcv+0xfc4/0x10a4 ip_protocol_deliver_rcu+0xf4/0x200 ip_local_deliver_finish+0x58/0x70 ip_local_deliver+0x68/0x120 ip_sublist_rcv_finish+0x70/0x94 ip_list_rcv_finish.constprop.0+0x17c/0x1d0 ip_sublist_rcv+0x40/0xb0 ip_list_rcv+0x140/0x1dc __netif_receive_skb_list_core+0x154/0x28c __netif_receive_skb_list+0x120/0x1a0 netif_receive_skb_list_internal+0xe4/0x1f0 napi_complete_done+0x70/0x1f0 gro_cell_poll+0x9c/0xb0 napi_poll+0xcc/0x264 net_rx_action+0xd4/0x21c __do_softirq+0x130/0x358 irq_exit+0x11c/0x13c __handle_domain_irq+0x88/0xf0 gic_handle_irq+0x78/0x2c0 el1_irq+0xb8/0x140 arch_cpu_idle+0x18/0x40 default_idle_call+0x5c/0x1c0 cpuidle_idle_call+0x174/0x1b0 do_idle+0xc8/0x160 cpu_startup_entry+0x30/0x11c secondary_start_kernel+0x158/0x1e4 softirq: huh, entered softirq 3 NET_RX 0000000093774ee4 with preempt_count 00000100, exited with fffffe00? Fixes: 416d82204df4 ("crypto: hisilicon - add HiSilicon SEC V2 driver") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/crypto/hisilicon/sec2/sec.h | 2 +- drivers/crypto/hisilicon/sec2/sec_crypto.c | 20 ++++++++++---------- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h index c2e9b01187a7..a44c8dba3cda 100644 --- a/drivers/crypto/hisilicon/sec2/sec.h +++ b/drivers/crypto/hisilicon/sec2/sec.h @@ -119,7 +119,7 @@ struct sec_qp_ctx { struct idr req_idr; struct sec_alg_res res[QM_Q_DEPTH]; struct sec_ctx *ctx; - struct mutex req_lock; + spinlock_t req_lock; struct list_head backlog; struct hisi_acc_sgl_pool *c_in_pool; struct hisi_acc_sgl_pool *c_out_pool; diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c index 6eebe739893c..71dfa7db6394 100644 --- a/drivers/crypto/hisilicon/sec2/sec_crypto.c +++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c @@ -127,11 +127,11 @@ static int sec_alloc_req_id(struct sec_req *req, struct sec_qp_ctx *qp_ctx) { int req_id; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); req_id = idr_alloc_cyclic(&qp_ctx->req_idr, NULL, 0, QM_Q_DEPTH, GFP_ATOMIC); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); if (unlikely(req_id < 0)) { dev_err(req->ctx->dev, "alloc req id fail!\n"); return req_id; @@ -156,9 +156,9 @@ static void sec_free_req_id(struct sec_req *req) qp_ctx->req_list[req_id] = NULL; req->qp_ctx = NULL; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); idr_remove(&qp_ctx->req_idr, req_id); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); } static u8 pre_parse_finished_bd(struct bd_status *status, void *resp) @@ -273,7 +273,7 @@ static int sec_bd_send(struct sec_ctx *ctx, struct sec_req *req) !(req->flag & CRYPTO_TFM_REQ_MAY_BACKLOG)) return -EBUSY; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); ret = hisi_qp_send(qp_ctx->qp, &req->sec_sqe); if (ctx->fake_req_limit <= @@ -281,10 +281,10 @@ static int sec_bd_send(struct sec_ctx *ctx, struct sec_req *req) list_add_tail(&req->backlog_head, &qp_ctx->backlog); atomic64_inc(&ctx->sec->debug.dfx.send_cnt); atomic64_inc(&ctx->sec->debug.dfx.send_busy_cnt); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); return -EBUSY; } - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); if (unlikely(ret == -EBUSY)) return -ENOBUFS; @@ -487,7 +487,7 @@ static int sec_create_qp_ctx(struct hisi_qm *qm, struct sec_ctx *ctx, qp->req_cb = sec_req_cb; - mutex_init(&qp_ctx->req_lock); + spin_lock_init(&qp_ctx->req_lock); idr_init(&qp_ctx->req_idr); INIT_LIST_HEAD(&qp_ctx->backlog); @@ -1382,7 +1382,7 @@ static struct sec_req *sec_back_req_clear(struct sec_ctx *ctx, { struct sec_req *backlog_req = NULL; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); if (ctx->fake_req_limit >= atomic_read(&qp_ctx->qp->qp_status.used) && !list_empty(&qp_ctx->backlog)) { @@ -1390,7 +1390,7 @@ static struct sec_req *sec_back_req_clear(struct sec_ctx *ctx, typeof(*backlog_req), backlog_head); list_del(&backlog_req->backlog_head); } - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); return backlog_req; } -- 2.20.1

1 28

[PATCH openEuler-5.10-LTS 1/5] crypto: hisilicon/sec - don't sleep when in softirq
by Zheng Zengkai 19 Jul '22

19 Jul '22

From: Zhengchao Shao <shaozhengchao(a)huawei.com> mainline inclusion from mainline-v5.19-rc6 commit 02884a4f12de11f54d4ca67a07dd1f111d96fdbd category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5GEVR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git/c… -------------------------------- When kunpeng920 encryption driver is used to deencrypt and decrypt packets during the softirq, it is not allowed to use mutex lock. The kernel will report the following error: BUG: scheduling while atomic: swapper/57/0/0x00000300 Call trace: dump_backtrace+0x0/0x1e4 show_stack+0x20/0x2c dump_stack+0xd8/0x140 __schedule_bug+0x68/0x80 __schedule+0x728/0x840 schedule+0x50/0xe0 schedule_preempt_disabled+0x18/0x24 __mutex_lock.constprop.0+0x594/0x5dc __mutex_lock_slowpath+0x1c/0x30 mutex_lock+0x50/0x60 sec_request_init+0x8c/0x1a0 [hisi_sec2] sec_process+0x28/0x1ac [hisi_sec2] sec_skcipher_crypto+0xf4/0x1d4 [hisi_sec2] sec_skcipher_encrypt+0x1c/0x30 [hisi_sec2] crypto_skcipher_encrypt+0x2c/0x40 crypto_authenc_encrypt+0xc8/0xfc [authenc] crypto_aead_encrypt+0x2c/0x40 echainiv_encrypt+0x144/0x1a0 [echainiv] crypto_aead_encrypt+0x2c/0x40 esp_output_tail+0x348/0x5c0 [esp4] esp_output+0x120/0x19c [esp4] xfrm_output_one+0x25c/0x4d4 xfrm_output_resume+0x6c/0x1fc xfrm_output+0xac/0x3c0 xfrm4_output+0x64/0x130 ip_build_and_send_pkt+0x158/0x20c tcp_v4_send_synack+0xdc/0x1f0 tcp_conn_request+0x7d0/0x994 tcp_v4_conn_request+0x58/0x6c tcp_v6_conn_request+0xf0/0x100 tcp_rcv_state_process+0x1cc/0xd60 tcp_v4_do_rcv+0x10c/0x250 tcp_v4_rcv+0xfc4/0x10a4 ip_protocol_deliver_rcu+0xf4/0x200 ip_local_deliver_finish+0x58/0x70 ip_local_deliver+0x68/0x120 ip_sublist_rcv_finish+0x70/0x94 ip_list_rcv_finish.constprop.0+0x17c/0x1d0 ip_sublist_rcv+0x40/0xb0 ip_list_rcv+0x140/0x1dc __netif_receive_skb_list_core+0x154/0x28c __netif_receive_skb_list+0x120/0x1a0 netif_receive_skb_list_internal+0xe4/0x1f0 napi_complete_done+0x70/0x1f0 gro_cell_poll+0x9c/0xb0 napi_poll+0xcc/0x264 net_rx_action+0xd4/0x21c __do_softirq+0x130/0x358 irq_exit+0x11c/0x13c __handle_domain_irq+0x88/0xf0 gic_handle_irq+0x78/0x2c0 el1_irq+0xb8/0x140 arch_cpu_idle+0x18/0x40 default_idle_call+0x5c/0x1c0 cpuidle_idle_call+0x174/0x1b0 do_idle+0xc8/0x160 cpu_startup_entry+0x30/0x11c secondary_start_kernel+0x158/0x1e4 softirq: huh, entered softirq 3 NET_RX 0000000093774ee4 with preempt_count 00000100, exited with fffffe00? Fixes: 416d82204df4 ("crypto: hisilicon - add HiSilicon SEC V2 driver") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/crypto/hisilicon/sec2/sec.h | 2 +- drivers/crypto/hisilicon/sec2/sec_crypto.c | 20 ++++++++++---------- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h index d97cf02b1df7..cff00fd29765 100644 --- a/drivers/crypto/hisilicon/sec2/sec.h +++ b/drivers/crypto/hisilicon/sec2/sec.h @@ -119,7 +119,7 @@ struct sec_qp_ctx { struct idr req_idr; struct sec_alg_res res[QM_Q_DEPTH]; struct sec_ctx *ctx; - struct mutex req_lock; + spinlock_t req_lock; struct list_head backlog; struct hisi_acc_sgl_pool *c_in_pool; struct hisi_acc_sgl_pool *c_out_pool; diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c index 9d0a39f60fb2..b2228a935dcd 100644 --- a/drivers/crypto/hisilicon/sec2/sec_crypto.c +++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c @@ -127,11 +127,11 @@ static int sec_alloc_req_id(struct sec_req *req, struct sec_qp_ctx *qp_ctx) { int req_id; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); req_id = idr_alloc_cyclic(&qp_ctx->req_idr, NULL, 0, QM_Q_DEPTH, GFP_ATOMIC); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); if (unlikely(req_id < 0)) { dev_err(req->ctx->dev, "alloc req id fail!\n"); return req_id; @@ -156,9 +156,9 @@ static void sec_free_req_id(struct sec_req *req) qp_ctx->req_list[req_id] = NULL; req->qp_ctx = NULL; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); idr_remove(&qp_ctx->req_idr, req_id); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); } static u8 pre_parse_finished_bd(struct bd_status *status, void *resp) @@ -273,7 +273,7 @@ static int sec_bd_send(struct sec_ctx *ctx, struct sec_req *req) !(req->flag & CRYPTO_TFM_REQ_MAY_BACKLOG)) return -EBUSY; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); ret = hisi_qp_send(qp_ctx->qp, &req->sec_sqe); if (ctx->fake_req_limit <= @@ -281,10 +281,10 @@ static int sec_bd_send(struct sec_ctx *ctx, struct sec_req *req) list_add_tail(&req->backlog_head, &qp_ctx->backlog); atomic64_inc(&ctx->sec->debug.dfx.send_cnt); atomic64_inc(&ctx->sec->debug.dfx.send_busy_cnt); - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); return -EBUSY; } - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); if (unlikely(ret == -EBUSY)) return -ENOBUFS; @@ -487,7 +487,7 @@ static int sec_create_qp_ctx(struct hisi_qm *qm, struct sec_ctx *ctx, qp->req_cb = sec_req_cb; - mutex_init(&qp_ctx->req_lock); + spin_lock_init(&qp_ctx->req_lock); idr_init(&qp_ctx->req_idr); INIT_LIST_HEAD(&qp_ctx->backlog); @@ -1382,7 +1382,7 @@ static struct sec_req *sec_back_req_clear(struct sec_ctx *ctx, { struct sec_req *backlog_req = NULL; - mutex_lock(&qp_ctx->req_lock); + spin_lock_bh(&qp_ctx->req_lock); if (ctx->fake_req_limit >= atomic_read(&qp_ctx->qp->qp_status.used) && !list_empty(&qp_ctx->backlog)) { @@ -1390,7 +1390,7 @@ static struct sec_req *sec_back_req_clear(struct sec_ctx *ctx, typeof(*backlog_req), backlog_head); list_del(&backlog_req->backlog_head); } - mutex_unlock(&qp_ctx->req_lock); + spin_unlock_bh(&qp_ctx->req_lock); return backlog_req; } -- 2.20.1

1 4

[PATCH openEuler-5.10 01/46] Driver for Zhaoxin CPU core temperature monitoring
by Zheng Zengkai 19 Jul '22

19 Jul '22

From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> zhaoxin inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I52DS7 CVE: NA -------------------------------------------- Add support for the temperature sensor inside CPU. Supported are all known variants of the Zhaoxin processors. v1: Fix some character encoding mistaken. Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/hwmon/Kconfig | 9 + drivers/hwmon/Makefile | 1 + drivers/hwmon/via-cputemp.c | 1 - drivers/hwmon/zhaoxin-cputemp.c | 292 ++++++++++++++++++++++++++++++++ 4 files changed, 302 insertions(+), 1 deletion(-) create mode 100644 drivers/hwmon/zhaoxin-cputemp.c diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig index 45a1a5969d01..f2fe56e6f8bd 100644 --- a/drivers/hwmon/Kconfig +++ b/drivers/hwmon/Kconfig @@ -1899,6 +1899,15 @@ config SENSORS_VIA_CPUTEMP sensor inside your CPU. Supported are all known variants of the VIA C7 and Nano. +config SENSORS_ZHAOXIN_CPUTEMP + tristate "Zhaoxin CPU temperature sensor" + depends on X86 + select HWMON_VID + help + If you say yes here you get support for the temperature + sensor inside your CPU. Supported are all known variants of + the Zhaoxin processors. + config SENSORS_VIA686A tristate "VIA686A" depends on PCI diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile index c22a5316bd91..95908c478b94 100644 --- a/drivers/hwmon/Makefile +++ b/drivers/hwmon/Makefile @@ -184,6 +184,7 @@ obj-$(CONFIG_SENSORS_TMP421) += tmp421.o obj-$(CONFIG_SENSORS_TMP513) += tmp513.o obj-$(CONFIG_SENSORS_VEXPRESS) += vexpress-hwmon.o obj-$(CONFIG_SENSORS_VIA_CPUTEMP)+= via-cputemp.o +obj-$(CONFIG_SENSORS_ZHAOXIN_CPUTEMP) += zhaoxin-cputemp.o obj-$(CONFIG_SENSORS_VIA686A) += via686a.o obj-$(CONFIG_SENSORS_VT1211) += vt1211.o obj-$(CONFIG_SENSORS_VT8231) += vt8231.o diff --git a/drivers/hwmon/via-cputemp.c b/drivers/hwmon/via-cputemp.c index e5d18dac8ee7..0a5057dbe51a 100644 --- a/drivers/hwmon/via-cputemp.c +++ b/drivers/hwmon/via-cputemp.c @@ -273,7 +273,6 @@ static const struct x86_cpu_id __initconst cputemp_ids[] = { X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_A, NULL), X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_D, NULL), X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_NANO, NULL), - X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 7, X86_MODEL_ANY, NULL), {} }; MODULE_DEVICE_TABLE(x86cpu, cputemp_ids); diff --git a/drivers/hwmon/zhaoxin-cputemp.c b/drivers/hwmon/zhaoxin-cputemp.c new file mode 100644 index 000000000000..39e729590eba --- /dev/null +++ b/drivers/hwmon/zhaoxin-cputemp.c @@ -0,0 +1,292 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * zhaoxin-cputemp.c - Driver for Zhaoxin CPU core temperature monitoring + */ + +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +#include <linux/module.h> +#include <linux/init.h> +#include <linux/slab.h> +#include <linux/hwmon.h> +#include <linux/hwmon-vid.h> +#include <linux/sysfs.h> +#include <linux/hwmon-sysfs.h> +#include <linux/err.h> +#include <linux/mutex.h> +#include <linux/list.h> +#include <linux/platform_device.h> +#include <linux/cpu.h> +#include <asm/msr.h> +#include <asm/processor.h> +#include <asm/cpu_device_id.h> + +#define DRVNAME "zhaoxin_cputemp" + +enum { SHOW_TEMP, SHOW_LABEL, SHOW_NAME }; + +/* Functions declaration */ + +struct zhaoxin_cputemp_data { + struct device *hwmon_dev; + const char *name; + u8 vrm; + u32 id; + u32 msr_temp; + u32 msr_vid; +}; + +/* Sysfs stuff */ + +static ssize_t name_show(struct device *dev, struct device_attribute *devattr, + char *buf) +{ + int ret; + struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr); + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + + if (attr->index == SHOW_NAME) + ret = sprintf(buf, "%s\n", data->name); + else /* show label */ + ret = sprintf(buf, "Core %d\n", data->id); + return ret; +} + +static ssize_t temp_show(struct device *dev, struct device_attribute *devattr, char *buf) +{ + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + u32 eax, edx; + int err; + + err = rdmsr_safe_on_cpu(data->id, data->msr_temp, &eax, &edx); + if (err) + return -EAGAIN; + + return sprintf(buf, "%lu\n", ((unsigned long)eax & 0xffffff) * 1000); +} + +static ssize_t cpu0_vid_show(struct device *dev, struct device_attribute *devattr, char *buf) +{ + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + u32 eax, edx; + int err; + + err = rdmsr_safe_on_cpu(data->id, data->msr_vid, &eax, &edx); + if (err) + return -EAGAIN; + + return sprintf(buf, "%d\n", vid_from_reg(~edx & 0x7f, data->vrm)); +} + +static SENSOR_DEVICE_ATTR_RO(temp1_input, temp, SHOW_TEMP); +static SENSOR_DEVICE_ATTR_RO(temp1_label, name, SHOW_LABEL); +static SENSOR_DEVICE_ATTR_RO(name, name, SHOW_NAME); + +static struct attribute *zhaoxin_cputemp_attributes[] = { + &sensor_dev_attr_name.dev_attr.attr, + &sensor_dev_attr_temp1_label.dev_attr.attr, + &sensor_dev_attr_temp1_input.dev_attr.attr, + NULL +}; + +static const struct attribute_group zhaoxin_cputemp_group = { + .attrs = zhaoxin_cputemp_attributes, +}; + +/* Optional attributes */ +static DEVICE_ATTR_RO(cpu0_vid); + +static int zhaoxin_cputemp_probe(struct platform_device *pdev) +{ + struct zhaoxin_cputemp_data *data; + int err; + u32 eax, edx; + + data = devm_kzalloc(&pdev->dev, sizeof(struct zhaoxin_cputemp_data), GFP_KERNEL); + if (!data) + return -ENOMEM; + + data->id = pdev->id; + data->name = "zhaoxin_cputemp"; + data->msr_temp = 0x1423; + + /* test if we can access the TEMPERATURE MSR */ + err = rdmsr_safe_on_cpu(data->id, data->msr_temp, &eax, &edx); + if (err) { + dev_err(&pdev->dev, "Unable to access TEMPERATURE MSR, giving up\n"); + return err; + } + + platform_set_drvdata(pdev, data); + + err = sysfs_create_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + if (err) + return err; + + if (data->msr_vid) + data->vrm = vid_which_vrm(); + + if (data->vrm) { + err = device_create_file(&pdev->dev, &dev_attr_cpu0_vid); + if (err) + goto exit_remove; + } + + data->hwmon_dev = hwmon_device_register(&pdev->dev); + if (IS_ERR(data->hwmon_dev)) { + err = PTR_ERR(data->hwmon_dev); + dev_err(&pdev->dev, "Class registration failed (%d)\n", err); + goto exit_remove; + } + + return 0; + +exit_remove: + if (data->vrm) + device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + return err; +} + +static int zhaoxin_cputemp_remove(struct platform_device *pdev) +{ + struct zhaoxin_cputemp_data *data = platform_get_drvdata(pdev); + + hwmon_device_unregister(data->hwmon_dev); + if (data->vrm) + device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + return 0; +} + +static struct platform_driver zhaoxin_cputemp_driver = { + .driver = { + .name = DRVNAME, + }, + .probe = zhaoxin_cputemp_probe, + .remove = zhaoxin_cputemp_remove, +}; + +struct pdev_entry { + struct list_head list; + struct platform_device *pdev; + unsigned int cpu; +}; + +static LIST_HEAD(pdev_list); +static DEFINE_MUTEX(pdev_list_mutex); + +static int zhaoxin_cputemp_online(unsigned int cpu) +{ + int err; + struct platform_device *pdev; + struct pdev_entry *pdev_entry; + + pdev = platform_device_alloc(DRVNAME, cpu); + if (!pdev) { + err = -ENOMEM; + pr_err("Device allocation failed\n"); + goto exit; + } + + pdev_entry = kzalloc(sizeof(struct pdev_entry), GFP_KERNEL); + if (!pdev_entry) { + err = -ENOMEM; + goto exit_device_put; + } + + err = platform_device_add(pdev); + if (err) { + pr_err("Device addition failed (%d)\n", err); + goto exit_device_free; + } + + pdev_entry->pdev = pdev; + pdev_entry->cpu = cpu; + mutex_lock(&pdev_list_mutex); + list_add_tail(&pdev_entry->list, &pdev_list); + mutex_unlock(&pdev_list_mutex); + + return 0; + +exit_device_free: + kfree(pdev_entry); +exit_device_put: + platform_device_put(pdev); +exit: + return err; +} + +static int zhaoxin_cputemp_down_prep(unsigned int cpu) +{ + struct pdev_entry *p; + + mutex_lock(&pdev_list_mutex); + list_for_each_entry(p, &pdev_list, list) { + if (p->cpu == cpu) { + platform_device_unregister(p->pdev); + list_del(&p->list); + mutex_unlock(&pdev_list_mutex); + kfree(p); + return 0; + } + } + mutex_unlock(&pdev_list_mutex); + return 0; +} + +static const struct x86_cpu_id __initconst cputemp_ids[] = { + X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 7, X86_MODEL_ANY, NULL), + X86_MATCH_VENDOR_FAM_MODEL(ZHAOXIN, 7, X86_MODEL_ANY, NULL), + {} +}; +MODULE_DEVICE_TABLE(x86cpu, cputemp_ids); + +static enum cpuhp_state zhaoxin_temp_online; + +static int __init zhaoxin_cputemp_init(void) +{ + int err; + + if (!x86_match_cpu(cputemp_ids)) + return -ENODEV; + + err = platform_driver_register(&zhaoxin_cputemp_driver); + if (err) + goto exit; + + err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "hwmon/zhaoxin:online", + zhaoxin_cputemp_online, zhaoxin_cputemp_down_prep); + if (err < 0) + goto exit_driver_unreg; + zhaoxin_temp_online = err; + +#ifndef CONFIG_HOTPLUG_CPU + if (list_empty(&pdev_list)) { + err = -ENODEV; + goto exit_hp_unreg; + } +#endif + return 0; + +#ifndef CONFIG_HOTPLUG_CPU +exit_hp_unreg: + cpuhp_remove_state_nocalls(zhaoxin_temp_online); +#endif +exit_driver_unreg: + platform_driver_unregister(&zhaoxin_cputemp_driver); +exit: + return err; +} + +static void __exit zhaoxin_cputemp_exit(void) +{ + cpuhp_remove_state(zhaoxin_temp_online); + platform_driver_unregister(&zhaoxin_cputemp_driver); +} + +MODULE_DESCRIPTION("Zhaoxin CPU temperature monitor"); +MODULE_LICENSE("GPL"); + +module_init(zhaoxin_cputemp_init) +module_exit(zhaoxin_cputemp_exit) -- 2.20.1

1 45

[PATCH openEuler-5.10-LTS 01/10] Driver for Zhaoxin CPU core temperature monitoring
by Zheng Zengkai 19 Jul '22

19 Jul '22

From: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> zhaoxin inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I52DS7 CVE: NA -------------------------------------------- Add support for the temperature sensor inside CPU. Supported are all known variants of the Zhaoxin processors. v1: Fix some character encoding mistaken. Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/hwmon/Kconfig | 9 + drivers/hwmon/Makefile | 1 + drivers/hwmon/via-cputemp.c | 1 - drivers/hwmon/zhaoxin-cputemp.c | 292 ++++++++++++++++++++++++++++++++ 4 files changed, 302 insertions(+), 1 deletion(-) create mode 100644 drivers/hwmon/zhaoxin-cputemp.c diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig index 45a1a5969d01..f2fe56e6f8bd 100644 --- a/drivers/hwmon/Kconfig +++ b/drivers/hwmon/Kconfig @@ -1899,6 +1899,15 @@ config SENSORS_VIA_CPUTEMP sensor inside your CPU. Supported are all known variants of the VIA C7 and Nano. +config SENSORS_ZHAOXIN_CPUTEMP + tristate "Zhaoxin CPU temperature sensor" + depends on X86 + select HWMON_VID + help + If you say yes here you get support for the temperature + sensor inside your CPU. Supported are all known variants of + the Zhaoxin processors. + config SENSORS_VIA686A tristate "VIA686A" depends on PCI diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile index c22a5316bd91..95908c478b94 100644 --- a/drivers/hwmon/Makefile +++ b/drivers/hwmon/Makefile @@ -184,6 +184,7 @@ obj-$(CONFIG_SENSORS_TMP421) += tmp421.o obj-$(CONFIG_SENSORS_TMP513) += tmp513.o obj-$(CONFIG_SENSORS_VEXPRESS) += vexpress-hwmon.o obj-$(CONFIG_SENSORS_VIA_CPUTEMP)+= via-cputemp.o +obj-$(CONFIG_SENSORS_ZHAOXIN_CPUTEMP) += zhaoxin-cputemp.o obj-$(CONFIG_SENSORS_VIA686A) += via686a.o obj-$(CONFIG_SENSORS_VT1211) += vt1211.o obj-$(CONFIG_SENSORS_VT8231) += vt8231.o diff --git a/drivers/hwmon/via-cputemp.c b/drivers/hwmon/via-cputemp.c index e5d18dac8ee7..0a5057dbe51a 100644 --- a/drivers/hwmon/via-cputemp.c +++ b/drivers/hwmon/via-cputemp.c @@ -273,7 +273,6 @@ static const struct x86_cpu_id __initconst cputemp_ids[] = { X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_A, NULL), X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_C7_D, NULL), X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 6, X86_CENTAUR_FAM6_NANO, NULL), - X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 7, X86_MODEL_ANY, NULL), {} }; MODULE_DEVICE_TABLE(x86cpu, cputemp_ids); diff --git a/drivers/hwmon/zhaoxin-cputemp.c b/drivers/hwmon/zhaoxin-cputemp.c new file mode 100644 index 000000000000..39e729590eba --- /dev/null +++ b/drivers/hwmon/zhaoxin-cputemp.c @@ -0,0 +1,292 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * zhaoxin-cputemp.c - Driver for Zhaoxin CPU core temperature monitoring + */ + +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +#include <linux/module.h> +#include <linux/init.h> +#include <linux/slab.h> +#include <linux/hwmon.h> +#include <linux/hwmon-vid.h> +#include <linux/sysfs.h> +#include <linux/hwmon-sysfs.h> +#include <linux/err.h> +#include <linux/mutex.h> +#include <linux/list.h> +#include <linux/platform_device.h> +#include <linux/cpu.h> +#include <asm/msr.h> +#include <asm/processor.h> +#include <asm/cpu_device_id.h> + +#define DRVNAME "zhaoxin_cputemp" + +enum { SHOW_TEMP, SHOW_LABEL, SHOW_NAME }; + +/* Functions declaration */ + +struct zhaoxin_cputemp_data { + struct device *hwmon_dev; + const char *name; + u8 vrm; + u32 id; + u32 msr_temp; + u32 msr_vid; +}; + +/* Sysfs stuff */ + +static ssize_t name_show(struct device *dev, struct device_attribute *devattr, + char *buf) +{ + int ret; + struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr); + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + + if (attr->index == SHOW_NAME) + ret = sprintf(buf, "%s\n", data->name); + else /* show label */ + ret = sprintf(buf, "Core %d\n", data->id); + return ret; +} + +static ssize_t temp_show(struct device *dev, struct device_attribute *devattr, char *buf) +{ + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + u32 eax, edx; + int err; + + err = rdmsr_safe_on_cpu(data->id, data->msr_temp, &eax, &edx); + if (err) + return -EAGAIN; + + return sprintf(buf, "%lu\n", ((unsigned long)eax & 0xffffff) * 1000); +} + +static ssize_t cpu0_vid_show(struct device *dev, struct device_attribute *devattr, char *buf) +{ + struct zhaoxin_cputemp_data *data = dev_get_drvdata(dev); + u32 eax, edx; + int err; + + err = rdmsr_safe_on_cpu(data->id, data->msr_vid, &eax, &edx); + if (err) + return -EAGAIN; + + return sprintf(buf, "%d\n", vid_from_reg(~edx & 0x7f, data->vrm)); +} + +static SENSOR_DEVICE_ATTR_RO(temp1_input, temp, SHOW_TEMP); +static SENSOR_DEVICE_ATTR_RO(temp1_label, name, SHOW_LABEL); +static SENSOR_DEVICE_ATTR_RO(name, name, SHOW_NAME); + +static struct attribute *zhaoxin_cputemp_attributes[] = { + &sensor_dev_attr_name.dev_attr.attr, + &sensor_dev_attr_temp1_label.dev_attr.attr, + &sensor_dev_attr_temp1_input.dev_attr.attr, + NULL +}; + +static const struct attribute_group zhaoxin_cputemp_group = { + .attrs = zhaoxin_cputemp_attributes, +}; + +/* Optional attributes */ +static DEVICE_ATTR_RO(cpu0_vid); + +static int zhaoxin_cputemp_probe(struct platform_device *pdev) +{ + struct zhaoxin_cputemp_data *data; + int err; + u32 eax, edx; + + data = devm_kzalloc(&pdev->dev, sizeof(struct zhaoxin_cputemp_data), GFP_KERNEL); + if (!data) + return -ENOMEM; + + data->id = pdev->id; + data->name = "zhaoxin_cputemp"; + data->msr_temp = 0x1423; + + /* test if we can access the TEMPERATURE MSR */ + err = rdmsr_safe_on_cpu(data->id, data->msr_temp, &eax, &edx); + if (err) { + dev_err(&pdev->dev, "Unable to access TEMPERATURE MSR, giving up\n"); + return err; + } + + platform_set_drvdata(pdev, data); + + err = sysfs_create_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + if (err) + return err; + + if (data->msr_vid) + data->vrm = vid_which_vrm(); + + if (data->vrm) { + err = device_create_file(&pdev->dev, &dev_attr_cpu0_vid); + if (err) + goto exit_remove; + } + + data->hwmon_dev = hwmon_device_register(&pdev->dev); + if (IS_ERR(data->hwmon_dev)) { + err = PTR_ERR(data->hwmon_dev); + dev_err(&pdev->dev, "Class registration failed (%d)\n", err); + goto exit_remove; + } + + return 0; + +exit_remove: + if (data->vrm) + device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + return err; +} + +static int zhaoxin_cputemp_remove(struct platform_device *pdev) +{ + struct zhaoxin_cputemp_data *data = platform_get_drvdata(pdev); + + hwmon_device_unregister(data->hwmon_dev); + if (data->vrm) + device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &zhaoxin_cputemp_group); + return 0; +} + +static struct platform_driver zhaoxin_cputemp_driver = { + .driver = { + .name = DRVNAME, + }, + .probe = zhaoxin_cputemp_probe, + .remove = zhaoxin_cputemp_remove, +}; + +struct pdev_entry { + struct list_head list; + struct platform_device *pdev; + unsigned int cpu; +}; + +static LIST_HEAD(pdev_list); +static DEFINE_MUTEX(pdev_list_mutex); + +static int zhaoxin_cputemp_online(unsigned int cpu) +{ + int err; + struct platform_device *pdev; + struct pdev_entry *pdev_entry; + + pdev = platform_device_alloc(DRVNAME, cpu); + if (!pdev) { + err = -ENOMEM; + pr_err("Device allocation failed\n"); + goto exit; + } + + pdev_entry = kzalloc(sizeof(struct pdev_entry), GFP_KERNEL); + if (!pdev_entry) { + err = -ENOMEM; + goto exit_device_put; + } + + err = platform_device_add(pdev); + if (err) { + pr_err("Device addition failed (%d)\n", err); + goto exit_device_free; + } + + pdev_entry->pdev = pdev; + pdev_entry->cpu = cpu; + mutex_lock(&pdev_list_mutex); + list_add_tail(&pdev_entry->list, &pdev_list); + mutex_unlock(&pdev_list_mutex); + + return 0; + +exit_device_free: + kfree(pdev_entry); +exit_device_put: + platform_device_put(pdev); +exit: + return err; +} + +static int zhaoxin_cputemp_down_prep(unsigned int cpu) +{ + struct pdev_entry *p; + + mutex_lock(&pdev_list_mutex); + list_for_each_entry(p, &pdev_list, list) { + if (p->cpu == cpu) { + platform_device_unregister(p->pdev); + list_del(&p->list); + mutex_unlock(&pdev_list_mutex); + kfree(p); + return 0; + } + } + mutex_unlock(&pdev_list_mutex); + return 0; +} + +static const struct x86_cpu_id __initconst cputemp_ids[] = { + X86_MATCH_VENDOR_FAM_MODEL(CENTAUR, 7, X86_MODEL_ANY, NULL), + X86_MATCH_VENDOR_FAM_MODEL(ZHAOXIN, 7, X86_MODEL_ANY, NULL), + {} +}; +MODULE_DEVICE_TABLE(x86cpu, cputemp_ids); + +static enum cpuhp_state zhaoxin_temp_online; + +static int __init zhaoxin_cputemp_init(void) +{ + int err; + + if (!x86_match_cpu(cputemp_ids)) + return -ENODEV; + + err = platform_driver_register(&zhaoxin_cputemp_driver); + if (err) + goto exit; + + err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "hwmon/zhaoxin:online", + zhaoxin_cputemp_online, zhaoxin_cputemp_down_prep); + if (err < 0) + goto exit_driver_unreg; + zhaoxin_temp_online = err; + +#ifndef CONFIG_HOTPLUG_CPU + if (list_empty(&pdev_list)) { + err = -ENODEV; + goto exit_hp_unreg; + } +#endif + return 0; + +#ifndef CONFIG_HOTPLUG_CPU +exit_hp_unreg: + cpuhp_remove_state_nocalls(zhaoxin_temp_online); +#endif +exit_driver_unreg: + platform_driver_unregister(&zhaoxin_cputemp_driver); +exit: + return err; +} + +static void __exit zhaoxin_cputemp_exit(void) +{ + cpuhp_remove_state(zhaoxin_temp_online); + platform_driver_unregister(&zhaoxin_cputemp_driver); +} + +MODULE_DESCRIPTION("Zhaoxin CPU temperature monitor"); +MODULE_LICENSE("GPL"); + +module_init(zhaoxin_cputemp_init) +module_exit(zhaoxin_cputemp_exit) -- 2.20.1

1 9

[PATCH openEuler-5.10 00/95] Backport 5.10.112 LTS
by Zheng Zengkai 19 Jul '22

19 Jul '22

Backport 5.10.112 LTS patches from upstream. git cherry-pick v5.10.111..v5.10.112~1 -s Complicts: Already merged(10): 80a4df14643f7 hamradio: defer 6pack kfree after unregister_netdev cfa98ffc42f16 hamradio: remove needs_free_netdev to avoid UAF 5ea00fc60676 ax25: add refcount in ax25_dev to avoid UAF bugs 5ddae8d06441 ax25: fix reference count leaks of ax25_dev 57cc15f5fd55 ax25: fix UAF bugs of net_device caused by rebinding operation b20a5ab0f5fb ax25: Fix refcount leaks caused by ax25_cb_del() a4942c6fea87 ax25: fix UAF bug in ax25_send_control() 145ea8d213e8 ax25: fix NPD bug in ax25_disconnect f934fa478dd1 ax25: Fix NULL pointer dereferences in ax25 timers 5c62d3bf1410 ax25: Fix UAF bugs in ax25 timers Rejected(1, KABI changed and hard to fix): 845f44ce3d9f net/sched: flower: fix parsing of ethertype following VLAN header KABI fixes(2): scsi: iscsi: fix kabi broken in struct iscsi_cls_conn scsi: iscsi: fix kabi broken in struct iscsi_transport Total patches: 104 - 10 - 1 + 2 = 95 Adrian Hunter (1): perf tools: Fix misleading add event PMU debug message Ajish Koshy (2): scsi: pm80xx: Mask and unmask upper interrupt vectors 32-63 scsi: pm80xx: Enable upper inbound, outbound queues Alexey Galakhov (1): scsi: mvsas: Add PCI ID of RocketRaid 2640 Andy Chiu (1): net: axienet: setup mdio unconditionally Anna-Maria Behnsen (1): timers: Fix warning condition in __run_timers() Athira Rajeev (1): testing/selftests/mqueue: Fix mq_perf_tests to free the allocated cpu set Aurabindo Pillai (1): drm/amd: Add USBC connector ID Benedikt Spranger (1): net/sched: taprio: Check if socket flags are valid Borislav Petkov (1): perf/imx_ddr: Fix undefined behavior due to shift overflowing the constant Calvin Johnson (1): net: mdio: Alphabetically sort header inclusion Chandrakanth patil (1): scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan Chao Gao (1): dma-direct: avoid redundant memory sync for swiotlb Charlene Liu (1): drm/amd/display: fix audio format not updated after edid updated Chiawen Huang (1): drm/amd/display: FEC check in timing validation Christian Lamparter (1): ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs Chuck Lever (1): SUNRPC: Fix the svc_deferred_event trace class Cristian Marussi (1): firmware: arm_scmi: Fix sorting of retrieved clock rates Darrick J. Wong (1): btrfs: fix fallocate to use file_modified to update permissions consistently Dinh Nguyen (1): net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link Duoming Zhou (1): drivers: net: slip: fix NPD bug in sl_tx_timeout() Fabio M. De Francesco (1): ALSA: pcm: Test for "silence" field in struct "pcm_format_data" Felix Kuehling (1): drm/amdkfd: Use drm_priv to pass VM from KFD to amdgpu Guillaume Nault (1): veth: Ensure eth header is in skb's linear part Harshit Mogalapalli (1): cifs: potential buffer overflow in handling symlinks James Smart (1): scsi: lpfc: Fix queue failures when recovering from PCI parity error Jason A. Donenfeld (1): gcc-plugins: latent_entropy: use /dev/urandom Jeremy Linton (1): net: bcmgenet: Revert "Use stronger register read/writes to assure ordering" Jia-Ju Bai (1): btrfs: fix root ref counts in error handling in btrfs_get_root_ref Joey Gouly (1): arm64: alternatives: mark patch_alternative() as `noinstr` Johan Hovold (1): memory: renesas-rpc-if: fix platform-device leak in error path Johannes Berg (1): nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size Jonathan Bakker (1): regulator: wm8994: Add an off-on delay for WM8994 variant Josef Bacik (1): btrfs: do not warn for free space inode in cow_file_range Juergen Gross (1): mm, page_alloc: fix build_zonerefs_node() Karsten Graul (1): net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() Khazhismel Kumykov (1): dm mpath: only use ktime_get_ns() in historical selector Kyle Copperfield (1): media: rockchip/rga: do proper error checking in probe Leo (Hanghong) Ma (1): drm/amd/display: Update VTEM Infopacket definition Leo Ruan (1): gpu: ipu-v3: Fix dev_dbg frequency output Li Nan (1): scsi: iscsi: fix kabi broken in struct iscsi_transport Lin Ma (1): nfc: nci: add flush_workqueue to prevent uaf Linus Torvalds (1): gpiolib: acpi: use correct format characters Marcelo Ricardo Leitner (1): net/sched: fix initialization order when updating chain 0 head Marcin Kozlowski (1): net: usb: aqc111: Fix out-of-bounds accesses in RX fixup Mario Limonciello (2): cpuidle: PSCI: Move the `has_lpi` check to the beginning of the function ACPI: processor idle: Check for architectural support for LPI Martin Leung (1): drm/amd/display: Revert FEC check in validation Martin Povišer (1): i2c: pasemi: Wait for write xfers to finish Melissa Wen (1): drm/amd/display: don't ignore alpha property on pre-multiplied mode Miaoqian Lin (1): memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe Michael Kelley (1): Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer Michael Walle (1): net: dsa: felix: suppress -EPROBE_DEFER errors Mike Christie (10): scsi: iscsi: Stop queueing during ep_disconnect scsi: iscsi: Force immediate failure during shutdown scsi: iscsi: Use system_unbound_wq for destroy_work scsi: iscsi: Rel ref after iscsi_lookup_endpoint() scsi: iscsi: Fix in-kernel conn failure handling scsi: iscsi: Move iscsi_ep_disconnect() scsi: iscsi: Fix offload conn cleanup when iscsid restarts scsi: iscsi: Fix conn cleanup and stop race during iscsid restart scsi: iscsi: Fix endpoint reuse regression scsi: iscsi: Fix unbound endpoint error handling Mikulas Patocka (1): dm integrity: fix memory corruption when tag_size is less than digest size Minchan Kim (1): mm: fix unexpected zeroed page mapping with zram swap Nadav Amit (1): smp: Fix offline cpu check in flush_smp_call_function_queue() Naohiro Aota (1): btrfs: mark resumed async balance as writing Nathan Chancellor (2): btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups() ARM: davinci: da850-evm: Avoid NULL pointer dereference Nicolas Dichtel (1): ipv6: fix panic when forwarding a pkt with no in6 dev Patrick Wang (1): mm: kmemleak: take a full lowmem check in kmemleak_*_phys() Paul Gortmaker (1): tick/nohz: Use WARN_ON_ONCE() to prevent console saturation Petr Malat (1): sctp: Initialize daddr on peeled off socket QintaoShen (1): drm/amdkfd: Check for potential null return of kmalloc_array() Rameshkumar Sundaram (1): cfg80211: hold bss_lock while updating nontrans_list Randy Dunlap (1): net: micrel: fix KS8851_MLL Kconfig Rei Yamamoto (1): genirq/affinity: Consider that CPUs on nodes can be unbalanced Rob Clark (2): drm/msm: Add missing put_task_struct() in debugfs path drm/msm: Fix range size vs end confusion Roman Li (1): drm/amd/display: Fix allocate_mst_payload assert on resume Sean Christopherson (1): KVM: x86/mmu: Resolve nx_huge_pages when kvm.ko is loaded Stephen Boyd (1): drm/msm/dsi: Use connector directly in msm_dsi_manager_connector_init() Steve Capper (1): tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry Tao Jin (1): ALSA: hda/realtek: add quirk for Lenovo Thinkpad X12 speakers Tianci Yin (1): drm/amdgpu/vcn: improve vcn dpg stop procedure Tim Crawford (1): ALSA: hda/realtek: Add quirk for Clevo PD50PNT Toke Høiland-Jørgensen (2): ath9k: Properly clear TX status area before reporting to mac80211 ath9k: Fix usage of driver-private space in tx_info Tomasz Moń (1): drm/amdgpu: Enable gfxoff quirk on MacBook Pro Tushar Patel (1): drm/amdkfd: Fix Incorrect VMIDs passed to HWS Tyrel Datwyler (1): scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 Vadim Pasternak (1): mlxsw: i2c: Fix initialization error flow Xiaoguang Wang (1): scsi: target: tcmu: Fix possible page UAF Xiaomeng Tong (1): myri10ge: fix an incorrect free for skb in myri10ge_sw_tso Zhang Wensheng (1): scsi: iscsi: fix kabi broken in struct iscsi_cls_conn arch/arm/mach-davinci/board-da850-evm.c | 4 +- arch/arm64/kernel/alternative.c | 6 +- arch/arm64/kernel/cpuidle.c | 6 +- arch/x86/include/asm/kvm_host.h | 5 +- arch/x86/kvm/mmu/mmu.c | 20 +- arch/x86/kvm/x86.c | 20 +- drivers/acpi/processor_idle.c | 15 +- drivers/ata/libata-core.c | 3 + drivers/firmware/arm_scmi/clock.c | 3 +- drivers/gpio/gpiolib-acpi.c | 4 +- drivers/gpu/drm/amd/amdgpu/ObjectID.h | 1 + .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 + drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 3 + drivers/gpu/drm/amd/amdkfd/kfd_device.c | 11 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 2 + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +- .../gpu/drm/amd/display/dc/core/dc_resource.c | 4 +- .../amd/display/dc/dcn10/dcn10_hw_sequencer.c | 14 +- .../drm/amd/display/dc/dcn20/dcn20_hwseq.c | 14 +- .../display/modules/info_packet/info_packet.c | 5 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 +- drivers/gpu/drm/msm/dsi/dsi_manager.c | 2 +- drivers/gpu/drm/msm/msm_gem.c | 1 + drivers/gpu/ipu-v3/ipu-di.c | 5 +- drivers/hv/ring_buffer.c | 11 +- drivers/i2c/busses/i2c-pasemi.c | 6 + drivers/infiniband/ulp/iser/iscsi_iser.c | 9 +- drivers/md/dm-historical-service-time.c | 10 +- drivers/md/dm-integrity.c | 7 +- drivers/media/platform/rockchip/rga/rga.c | 2 +- drivers/memory/atmel-ebi.c | 23 +- drivers/memory/renesas-rpc-if.c | 10 +- drivers/net/dsa/ocelot/felix_vsc9959.c | 2 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 +- drivers/net/ethernet/mellanox/mlxsw/i2c.c | 1 + drivers/net/ethernet/micrel/Kconfig | 1 + .../net/ethernet/myricom/myri10ge/myri10ge.c | 6 +- .../ethernet/stmicro/stmmac/altr_tse_pcs.c | 8 - .../ethernet/stmicro/stmmac/altr_tse_pcs.h | 4 + .../ethernet/stmicro/stmmac/dwmac-socfpga.c | 13 +- .../net/ethernet/xilinx/xilinx_axienet_main.c | 13 +- drivers/net/mdio/mdio-bcm-unimac.c | 16 +- drivers/net/mdio/mdio-bitbang.c | 4 +- drivers/net/mdio/mdio-cavium.c | 2 +- drivers/net/mdio/mdio-gpio.c | 10 +- drivers/net/mdio/mdio-ipq4019.c | 4 +- drivers/net/mdio/mdio-ipq8064.c | 4 +- drivers/net/mdio/mdio-mscc-miim.c | 8 +- drivers/net/mdio/mdio-mux-bcm-iproc.c | 10 +- drivers/net/mdio/mdio-mux-gpio.c | 8 +- drivers/net/mdio/mdio-mux-mmioreg.c | 6 +- drivers/net/mdio/mdio-mux-multiplexer.c | 2 +- drivers/net/mdio/mdio-mux.c | 6 +- drivers/net/mdio/mdio-octeon.c | 8 +- drivers/net/mdio/mdio-thunder.c | 10 +- drivers/net/mdio/mdio-xgene.c | 6 +- drivers/net/mdio/of_mdio.c | 10 +- drivers/net/slip/slip.c | 2 +- drivers/net/usb/aqc111.c | 9 +- drivers/net/veth.c | 2 +- drivers/net/wireless/ath/ath9k/main.c | 2 +- drivers/net/wireless/ath/ath9k/xmit.c | 33 +- drivers/perf/fsl_imx8_ddr_perf.c | 2 +- drivers/regulator/wm8994-regulator.c | 42 +- drivers/scsi/be2iscsi/be_iscsi.c | 19 +- drivers/scsi/be2iscsi/be_main.c | 8 +- drivers/scsi/bnx2i/bnx2i_iscsi.c | 31 +- drivers/scsi/cxgbi/cxgb3i/cxgb3i.c | 8 +- drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | 8 +- drivers/scsi/cxgbi/libcxgbi.c | 12 +- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 2 +- drivers/scsi/libiscsi.c | 70 ++- drivers/scsi/lpfc/lpfc_init.c | 2 + drivers/scsi/megaraid/megaraid_sas.h | 3 + drivers/scsi/megaraid/megaraid_sas_base.c | 7 + drivers/scsi/mvsas/mv_init.c | 1 + drivers/scsi/pm8001/pm80xx_hwi.c | 33 +- drivers/scsi/qedi/qedi_iscsi.c | 32 +- drivers/scsi/qla4xxx/ql4_os.c | 8 +- drivers/scsi/scsi_transport_iscsi.c | 587 +++++++++++------- drivers/target/target_core_user.c | 3 +- fs/btrfs/block-group.c | 4 - fs/btrfs/disk-io.c | 5 +- fs/btrfs/file.c | 13 +- fs/btrfs/inode.c | 1 - fs/btrfs/volumes.c | 2 + fs/cifs/link.c | 3 + include/asm-generic/tlb.h | 10 +- include/scsi/iscsi_if.h | 1 + include/scsi/libiscsi.h | 1 + include/scsi/scsi_transport_iscsi.h | 39 +- include/trace/events/sunrpc.h | 7 +- kernel/dma/direct.h | 3 +- kernel/irq/affinity.c | 5 +- kernel/smp.c | 2 +- kernel/time/tick-sched.c | 2 +- kernel/time/timer.c | 11 +- mm/kmemleak.c | 8 +- mm/page_alloc.c | 2 +- mm/page_io.c | 54 -- net/ipv6/ip6_output.c | 2 +- net/nfc/nci/core.c | 4 + net/sched/cls_api.c | 2 +- net/sched/sch_taprio.c | 3 +- net/sctp/socket.c | 2 +- net/smc/smc_pnet.c | 5 +- net/wireless/nl80211.c | 3 +- net/wireless/scan.c | 2 + scripts/gcc-plugins/latent_entropy_plugin.c | 44 +- sound/core/pcm_misc.c | 2 +- sound/pci/hda/patch_realtek.c | 2 + tools/perf/util/parse-events.c | 5 +- .../testing/selftests/mqueue/mq_perf_tests.c | 25 +- 115 files changed, 1046 insertions(+), 565 deletions(-) -- 2.20.1

1 95

[PATCH openEuler-5.10 01/23] mm/sharepool: Allow share THP to kernel
by Zheng Zengkai 19 Jul '22

19 Jul '22

From: Wang Wensheng <wangwensheng4(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5DS9S CVE: NA -------------------------------------------------- This is not used for THP but the user page table is just like THP. The user alloc hugepages via a special driver and its vma is not marked with VM_HUGETLB. This commit allow to share those vma to kernel. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/share_pool.h | 1 + mm/share_pool.c | 44 +++++++++++++++++++++++++++++++++----- 2 files changed, 40 insertions(+), 5 deletions(-) diff --git a/include/linux/share_pool.h b/include/linux/share_pool.h index 6f294911c6af..d95084b8f624 100644 --- a/include/linux/share_pool.h +++ b/include/linux/share_pool.h @@ -178,6 +178,7 @@ struct sp_walk_data { unsigned long uva_aligned; unsigned long page_size; bool is_hugepage; + bool is_page_type_set; pmd_t *pmd; }; diff --git a/mm/share_pool.c b/mm/share_pool.c index 76088952d0a5..60ad48e238c4 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -2994,9 +2994,40 @@ EXPORT_SYMBOL_GPL(mg_sp_make_share_k2u); static int sp_pmd_entry(pmd_t *pmd, unsigned long addr, unsigned long next, struct mm_walk *walk) { + struct page *page; struct sp_walk_data *sp_walk_data = walk->private; + /* + * There exist a scene in DVPP where the pagetable is huge page but its + * vma doesn't record it, something like THP. + * So we cannot make out whether it is a hugepage map until we access the + * pmd here. If mixed size of pages appear, just return an error. + */ + if (pmd_huge(*pmd)) { + if (!sp_walk_data->is_page_type_set) { + sp_walk_data->is_page_type_set = true; + sp_walk_data->is_hugepage = true; + } else if (!sp_walk_data->is_hugepage) + return -EFAULT; + + /* To skip pte level walk */ + walk->action = ACTION_CONTINUE; + + page = pmd_page(*pmd); + get_page(page); + sp_walk_data->pages[sp_walk_data->page_count++] = page; + + return 0; + } + + if (!sp_walk_data->is_page_type_set) { + sp_walk_data->is_page_type_set = true; + sp_walk_data->is_hugepage = false; + } else if (sp_walk_data->is_hugepage) + return -EFAULT; + sp_walk_data->pmd = pmd; + return 0; } @@ -3140,6 +3171,8 @@ static int __sp_walk_page_range(unsigned long uva, unsigned long size, sp_walk.pmd_entry = sp_pmd_entry; } + sp_walk_data->is_page_type_set = false; + sp_walk_data->page_count = 0; sp_walk_data->page_size = page_size; uva_aligned = ALIGN_DOWN(uva, page_size); sp_walk_data->uva_aligned = uva_aligned; @@ -3164,8 +3197,12 @@ static int __sp_walk_page_range(unsigned long uva, unsigned long size, ret = walk_page_range(mm, uva_aligned, uva_aligned + size_aligned, &sp_walk, sp_walk_data); - if (ret) + if (ret) { + while (sp_walk_data->page_count--) + put_page(pages[sp_walk_data->page_count]); kvfree(pages); + sp_walk_data->pages = NULL; + } return ret; } @@ -3201,9 +3238,7 @@ void *sp_make_share_u2k(unsigned long uva, unsigned long size, int pid) int ret = 0; struct mm_struct *mm = current->mm; void *p = ERR_PTR(-ESRCH); - struct sp_walk_data sp_walk_data = { - .page_count = 0, - }; + struct sp_walk_data sp_walk_data; struct vm_struct *area; check_interrupt_context(); @@ -3544,7 +3579,6 @@ int sp_walk_page_range(unsigned long uva, unsigned long size, return -ESRCH; } - sp_walk_data->page_count = 0; down_write(&mm->mmap_lock); if (likely(!mm->core_state)) ret = __sp_walk_page_range(uva, size, mm, sp_walk_data); -- 2.20.1

1 22

[PATCH openEuler-5.10-LTS 00/94] Backport 5.10.112 LTS
by Zheng Zengkai 18 Jul '22

18 Jul '22

Backport 5.10.112 LTS patches from upstream. git cherry-pick v5.10.111..v5.10.112~1 -s Complicts: Already merged(10): 80a4df14643f7 hamradio: defer 6pack kfree after unregister_netdev cfa98ffc42f16 hamradio: remove needs_free_netdev to avoid UAF 5ea00fc60676 ax25: add refcount in ax25_dev to avoid UAF bugs 5ddae8d06441 ax25: fix reference count leaks of ax25_dev 57cc15f5fd55 ax25: fix UAF bugs of net_device caused by rebinding operation b20a5ab0f5fb ax25: Fix refcount leaks caused by ax25_cb_del() a4942c6fea87 ax25: fix UAF bug in ax25_send_control() 145ea8d213e8 ax25: fix NPD bug in ax25_disconnect f934fa478dd1 ax25: Fix NULL pointer dereferences in ax25 timers 5c62d3bf1410 ax25: Fix UAF bugs in ax25 timers Total patches: 104 - 10 = 94 Adrian Hunter (1): perf tools: Fix misleading add event PMU debug message Ajish Koshy (2): scsi: pm80xx: Mask and unmask upper interrupt vectors 32-63 scsi: pm80xx: Enable upper inbound, outbound queues Alexey Galakhov (1): scsi: mvsas: Add PCI ID of RocketRaid 2640 Andy Chiu (1): net: axienet: setup mdio unconditionally Anna-Maria Behnsen (1): timers: Fix warning condition in __run_timers() Athira Rajeev (1): testing/selftests/mqueue: Fix mq_perf_tests to free the allocated cpu set Aurabindo Pillai (1): drm/amd: Add USBC connector ID Benedikt Spranger (1): net/sched: taprio: Check if socket flags are valid Borislav Petkov (1): perf/imx_ddr: Fix undefined behavior due to shift overflowing the constant Calvin Johnson (1): net: mdio: Alphabetically sort header inclusion Chandrakanth patil (1): scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan Chao Gao (1): dma-direct: avoid redundant memory sync for swiotlb Charlene Liu (1): drm/amd/display: fix audio format not updated after edid updated Chiawen Huang (1): drm/amd/display: FEC check in timing validation Christian Lamparter (1): ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs Chuck Lever (1): SUNRPC: Fix the svc_deferred_event trace class Cristian Marussi (1): firmware: arm_scmi: Fix sorting of retrieved clock rates Darrick J. Wong (1): btrfs: fix fallocate to use file_modified to update permissions consistently Dinh Nguyen (1): net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link Duoming Zhou (1): drivers: net: slip: fix NPD bug in sl_tx_timeout() Fabio M. De Francesco (1): ALSA: pcm: Test for "silence" field in struct "pcm_format_data" Felix Kuehling (1): drm/amdkfd: Use drm_priv to pass VM from KFD to amdgpu Guillaume Nault (1): veth: Ensure eth header is in skb's linear part Harshit Mogalapalli (1): cifs: potential buffer overflow in handling symlinks James Smart (1): scsi: lpfc: Fix queue failures when recovering from PCI parity error Jason A. Donenfeld (1): gcc-plugins: latent_entropy: use /dev/urandom Jeremy Linton (1): net: bcmgenet: Revert "Use stronger register read/writes to assure ordering" Jia-Ju Bai (1): btrfs: fix root ref counts in error handling in btrfs_get_root_ref Joey Gouly (1): arm64: alternatives: mark patch_alternative() as `noinstr` Johan Hovold (1): memory: renesas-rpc-if: fix platform-device leak in error path Johannes Berg (1): nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size Jonathan Bakker (1): regulator: wm8994: Add an off-on delay for WM8994 variant Josef Bacik (1): btrfs: do not warn for free space inode in cow_file_range Juergen Gross (1): mm, page_alloc: fix build_zonerefs_node() Karsten Graul (1): net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() Khazhismel Kumykov (1): dm mpath: only use ktime_get_ns() in historical selector Kyle Copperfield (1): media: rockchip/rga: do proper error checking in probe Leo (Hanghong) Ma (1): drm/amd/display: Update VTEM Infopacket definition Leo Ruan (1): gpu: ipu-v3: Fix dev_dbg frequency output Lin Ma (1): nfc: nci: add flush_workqueue to prevent uaf Linus Torvalds (1): gpiolib: acpi: use correct format characters Marcelo Ricardo Leitner (1): net/sched: fix initialization order when updating chain 0 head Marcin Kozlowski (1): net: usb: aqc111: Fix out-of-bounds accesses in RX fixup Mario Limonciello (2): cpuidle: PSCI: Move the `has_lpi` check to the beginning of the function ACPI: processor idle: Check for architectural support for LPI Martin Leung (1): drm/amd/display: Revert FEC check in validation Martin Povišer (1): i2c: pasemi: Wait for write xfers to finish Melissa Wen (1): drm/amd/display: don't ignore alpha property on pre-multiplied mode Miaoqian Lin (1): memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe Michael Kelley (1): Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer Michael Walle (1): net: dsa: felix: suppress -EPROBE_DEFER errors Mike Christie (10): scsi: iscsi: Stop queueing during ep_disconnect scsi: iscsi: Force immediate failure during shutdown scsi: iscsi: Use system_unbound_wq for destroy_work scsi: iscsi: Rel ref after iscsi_lookup_endpoint() scsi: iscsi: Fix in-kernel conn failure handling scsi: iscsi: Move iscsi_ep_disconnect() scsi: iscsi: Fix offload conn cleanup when iscsid restarts scsi: iscsi: Fix conn cleanup and stop race during iscsid restart scsi: iscsi: Fix endpoint reuse regression scsi: iscsi: Fix unbound endpoint error handling Mikulas Patocka (1): dm integrity: fix memory corruption when tag_size is less than digest size Minchan Kim (1): mm: fix unexpected zeroed page mapping with zram swap Nadav Amit (1): smp: Fix offline cpu check in flush_smp_call_function_queue() Naohiro Aota (1): btrfs: mark resumed async balance as writing Nathan Chancellor (2): btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups() ARM: davinci: da850-evm: Avoid NULL pointer dereference Nicolas Dichtel (1): ipv6: fix panic when forwarding a pkt with no in6 dev Patrick Wang (1): mm: kmemleak: take a full lowmem check in kmemleak_*_phys() Paul Gortmaker (1): tick/nohz: Use WARN_ON_ONCE() to prevent console saturation Petr Malat (1): sctp: Initialize daddr on peeled off socket QintaoShen (1): drm/amdkfd: Check for potential null return of kmalloc_array() Rameshkumar Sundaram (1): cfg80211: hold bss_lock while updating nontrans_list Randy Dunlap (1): net: micrel: fix KS8851_MLL Kconfig Rei Yamamoto (1): genirq/affinity: Consider that CPUs on nodes can be unbalanced Rob Clark (2): drm/msm: Add missing put_task_struct() in debugfs path drm/msm: Fix range size vs end confusion Roman Li (1): drm/amd/display: Fix allocate_mst_payload assert on resume Sean Christopherson (1): KVM: x86/mmu: Resolve nx_huge_pages when kvm.ko is loaded Stephen Boyd (1): drm/msm/dsi: Use connector directly in msm_dsi_manager_connector_init() Steve Capper (1): tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry Tao Jin (1): ALSA: hda/realtek: add quirk for Lenovo Thinkpad X12 speakers Tianci Yin (1): drm/amdgpu/vcn: improve vcn dpg stop procedure Tim Crawford (1): ALSA: hda/realtek: Add quirk for Clevo PD50PNT Toke Høiland-Jørgensen (2): ath9k: Properly clear TX status area before reporting to mac80211 ath9k: Fix usage of driver-private space in tx_info Tomasz Moń (1): drm/amdgpu: Enable gfxoff quirk on MacBook Pro Tushar Patel (1): drm/amdkfd: Fix Incorrect VMIDs passed to HWS Tyrel Datwyler (1): scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 Vadim Pasternak (1): mlxsw: i2c: Fix initialization error flow Vlad Buslov (1): net/sched: flower: fix parsing of ethertype following VLAN header Xiaoguang Wang (1): scsi: target: tcmu: Fix possible page UAF Xiaomeng Tong (1): myri10ge: fix an incorrect free for skb in myri10ge_sw_tso arch/arm/mach-davinci/board-da850-evm.c | 4 +- arch/arm64/kernel/alternative.c | 6 +- arch/arm64/kernel/cpuidle.c | 6 +- arch/x86/include/asm/kvm_host.h | 5 +- arch/x86/kvm/mmu/mmu.c | 20 +- arch/x86/kvm/x86.c | 20 +- drivers/acpi/processor_idle.c | 15 +- drivers/ata/libata-core.c | 3 + drivers/firmware/arm_scmi/clock.c | 3 +- drivers/gpio/gpiolib-acpi.c | 4 +- drivers/gpu/drm/amd/amdgpu/ObjectID.h | 1 + .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 + drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 3 + drivers/gpu/drm/amd/amdkfd/kfd_device.c | 11 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 2 + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +- .../gpu/drm/amd/display/dc/core/dc_resource.c | 4 +- .../amd/display/dc/dcn10/dcn10_hw_sequencer.c | 14 +- .../drm/amd/display/dc/dcn20/dcn20_hwseq.c | 14 +- .../display/modules/info_packet/info_packet.c | 5 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 +- drivers/gpu/drm/msm/dsi/dsi_manager.c | 2 +- drivers/gpu/drm/msm/msm_gem.c | 1 + drivers/gpu/ipu-v3/ipu-di.c | 5 +- drivers/hv/ring_buffer.c | 11 +- drivers/i2c/busses/i2c-pasemi.c | 6 + drivers/infiniband/ulp/iser/iscsi_iser.c | 2 + drivers/md/dm-historical-service-time.c | 10 +- drivers/md/dm-integrity.c | 7 +- drivers/media/platform/rockchip/rga/rga.c | 2 +- drivers/memory/atmel-ebi.c | 23 +- drivers/memory/renesas-rpc-if.c | 10 +- drivers/net/dsa/ocelot/felix_vsc9959.c | 2 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 +- drivers/net/ethernet/mellanox/mlxsw/i2c.c | 1 + drivers/net/ethernet/micrel/Kconfig | 1 + .../net/ethernet/myricom/myri10ge/myri10ge.c | 6 +- .../ethernet/stmicro/stmmac/altr_tse_pcs.c | 8 - .../ethernet/stmicro/stmmac/altr_tse_pcs.h | 4 + .../ethernet/stmicro/stmmac/dwmac-socfpga.c | 13 +- .../net/ethernet/xilinx/xilinx_axienet_main.c | 13 +- drivers/net/mdio/mdio-bcm-unimac.c | 16 +- drivers/net/mdio/mdio-bitbang.c | 4 +- drivers/net/mdio/mdio-cavium.c | 2 +- drivers/net/mdio/mdio-gpio.c | 10 +- drivers/net/mdio/mdio-ipq4019.c | 4 +- drivers/net/mdio/mdio-ipq8064.c | 4 +- drivers/net/mdio/mdio-mscc-miim.c | 8 +- drivers/net/mdio/mdio-mux-bcm-iproc.c | 10 +- drivers/net/mdio/mdio-mux-gpio.c | 8 +- drivers/net/mdio/mdio-mux-mmioreg.c | 6 +- drivers/net/mdio/mdio-mux-multiplexer.c | 2 +- drivers/net/mdio/mdio-mux.c | 6 +- drivers/net/mdio/mdio-octeon.c | 8 +- drivers/net/mdio/mdio-thunder.c | 10 +- drivers/net/mdio/mdio-xgene.c | 6 +- drivers/net/mdio/of_mdio.c | 10 +- drivers/net/slip/slip.c | 2 +- drivers/net/usb/aqc111.c | 9 +- drivers/net/veth.c | 2 +- drivers/net/wireless/ath/ath9k/main.c | 2 +- drivers/net/wireless/ath/ath9k/xmit.c | 33 +- drivers/perf/fsl_imx8_ddr_perf.c | 2 +- drivers/regulator/wm8994-regulator.c | 42 +- drivers/scsi/be2iscsi/be_iscsi.c | 19 +- drivers/scsi/be2iscsi/be_main.c | 1 + drivers/scsi/bnx2i/bnx2i_iscsi.c | 24 +- drivers/scsi/cxgbi/cxgb3i/cxgb3i.c | 1 + drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | 1 + drivers/scsi/cxgbi/libcxgbi.c | 12 +- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 2 +- drivers/scsi/libiscsi.c | 70 ++- drivers/scsi/lpfc/lpfc_init.c | 2 + drivers/scsi/megaraid/megaraid_sas.h | 3 + drivers/scsi/megaraid/megaraid_sas_base.c | 7 + drivers/scsi/mvsas/mv_init.c | 1 + drivers/scsi/pm8001/pm80xx_hwi.c | 33 +- drivers/scsi/qedi/qedi_iscsi.c | 26 +- drivers/scsi/qla4xxx/ql4_os.c | 2 + drivers/scsi/scsi_transport_iscsi.c | 541 +++++++++++------- drivers/target/target_core_user.c | 3 +- fs/btrfs/block-group.c | 4 - fs/btrfs/disk-io.c | 5 +- fs/btrfs/file.c | 13 +- fs/btrfs/inode.c | 1 - fs/btrfs/volumes.c | 2 + fs/cifs/link.c | 3 + include/asm-generic/tlb.h | 10 +- include/net/flow_dissector.h | 2 + include/scsi/libiscsi.h | 1 + include/scsi/scsi_transport_iscsi.h | 14 +- include/trace/events/sunrpc.h | 7 +- kernel/dma/direct.h | 3 +- kernel/irq/affinity.c | 5 +- kernel/smp.c | 2 +- kernel/time/tick-sched.c | 2 +- kernel/time/timer.c | 11 +- mm/kmemleak.c | 8 +- mm/page_alloc.c | 2 +- mm/page_io.c | 54 -- net/core/flow_dissector.c | 1 + net/ipv6/ip6_output.c | 2 +- net/nfc/nci/core.c | 4 + net/sched/cls_api.c | 2 +- net/sched/cls_flower.c | 18 +- net/sched/sch_taprio.c | 3 +- net/sctp/socket.c | 2 +- net/smc/smc_pnet.c | 5 +- net/wireless/nl80211.c | 3 +- net/wireless/scan.c | 2 + scripts/gcc-plugins/latent_entropy_plugin.c | 44 +- sound/core/pcm_misc.c | 2 +- sound/pci/hda/patch_realtek.c | 2 + tools/perf/util/parse-events.c | 5 +- .../testing/selftests/mqueue/mq_perf_tests.c | 25 +- 117 files changed, 959 insertions(+), 554 deletions(-) -- 2.20.1

1 94

[PATCH openEuler-5.10-LTS 000/166] Backport 5.10.111 LTS
by Zheng Zengkai 14 Jul '22

14 Jul '22

Backport 5.10.111 LTS patches from upstream. Complicts: Already merged(4): 2dc49f58a29c ubifs: Rectify space amount budget for mkdir/tmpfile operations c688705a3978 Revert "NFSv4: Handle the special Linux file open access mode" 2827328e646d io_uring: fix race between timeout flush and removal 4665722d36ad cgroup: Use open-time credentials for process migraton perm checks Context conflict(3): 4820847e8bc2 usb: ehci: add pci device support for Aspeed platforms 8a7ada4b8f5d scsi: hisi_sas: Free irq vectors in order for v3 HW 9de98470db6e arm64: Add part number for Arm Cortex-A78AE Rejected(1): 2f2f017ea873 dm: requeue IO if mapping table not yet available Implement changed(-1+1): d36febbcd537 powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit Added(1): ipv6: fix kabi for mc_forwarding in struct ipv6_devconf Total patches: 170 - 4 - 1 + 1 - 1 + 1 = 166 Adam Wujek (1): clk: si5341: fix reported clk_rate when output divider is 2 Adrian Hunter (1): perf tools: Fix perf's libperf_print callback Aharon Landau (1): RDMA/mlx5: Don't remove cache MRs when a delay is needed Alex Deucher (2): drm/amdkfd: make CRAT table missing message informational only drm/amdgpu/smu10: fix SoC/fclk units in auto mode Alexander Lobakin (1): MIPS: fix fortify panic when copying asm exception handlers Amjad Ouled-Ameur (1): phy: amlogic: meson8b-usb2: Use dev_err_probe() Anatolii Gerasymenko (2): ice: Set txq_teid to ICE_INVAL_TEID on ring creation ice: Do not skip not enabled queues in ice_vc_dis_qs_msg Andre Przywara (1): irqchip/gic, gic-v3: Prevent GSI to SGI translations Andrea Parri (Microsoft) (1): Drivers: hv: vmbus: Replace smp_store_mb() with virt_store_mb() Andreas Gruenbacher (2): gfs2: Check for active reservation in gfs2_release gfs2: gfs2_setattr_size error path fix Andy Gospodarek (1): bnxt_en: reserve space inside receive page for skb_shared_info Anisse Astier (1): drm: Add orientation quirk for GPD Win Max Arnaldo Carvalho de Melo (4): perf build: Don't use -ffat-lto-objects in the python feature test when building with clang-13 perf python: Fix probing for some clang command line options tools build: Filter out options and warnings not supported by clang tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts Avraham Stern (1): cfg80211: don't add non transmitted BSS to 6GHz scanned channels Bob Peterson (1): gfs2: Fix gfs2_release for non-writers regression Chanho Park (1): arm64: Add part number for Arm Cortex-A78AE Chen-Yu Tsai (1): net: stmmac: Fix unset max_speed difference between DT and non-DT platforms Christian Lamparter (1): ata: sata_dwc_460ex: Fix crash due to OOB write Christophe JAILLET (1): scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() Dale Zhao (1): drm/amd/display: Add signal type check when verify stream backends same Damien Le Moal (5): scsi: pm8001: Fix pm80xx_pci_mem_copy() interface scsi: pm8001: Fix pm8001_mpi_task_abort_resp() scsi: pm8001: Fix task leak in pm8001_send_abort_all() scsi: pm8001: Fix tag leaks on error scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() Dan Carpenter (1): drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire() David Ahern (1): ipv6: Fix stats accounting in ip6_pkt_drop Denis Nikitin (1): perf session: Remap buf if there is no space for event Dongli Zhang (1): xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 Douglas Miller (1): RDMA/hfi1: Fix use-after-free bug for mm struct Dust Li (1): net/smc: correct settings of RMB window update limit Eric Dumazet (2): ipv6: make mc_forwarding atomic rxrpc: fix a race in rxrpc_exit_net() Ethan Lien (1): btrfs: fix qgroup reserve overflow the qgroup limit Evgeny Boger (1): power: supply: axp20x_battery: properly report current when discharging Fangrui Song (1): arm64: module: remove (NOLOAD) from linker script Guilherme G. Piccoli (1): Drivers: hv: vmbus: Fix potential crash on module unload Guo Ren (1): arm64: patch_text: Fixup last cpu should be master Guo Xuenan (1): lz4: fix LZ4_decompress_safe_partial read out of bound H. Nikolaus Schaller (1): usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm Haimin Zhang (1): jfs: prevent NULL deref in diFree Hangyu Hua (2): mips: ralink: fix a refcount leak in ill_acc_of_setup() powerpc/secvar: fix refcount leak in format_show() Hans de Goede (1): power: supply: axp288-charger: Set Vhold to 4.4V Harold Huang (1): tuntap: add sanity checks about msg_controllen in sendmsg Helge Deller (1): parisc: Fix CPU affinity for Lasi, WAX and Dino chips Hou Wenlong (1): KVM: x86/emulator: Emulate RDPID only if it is enabled in guest Hou Zhiqiang (1): PCI: endpoint: Fix alignment fault error in copy tests Ido Schimmel (1): ipv4: Invalidate neighbour for broadcast address upon address addition Ilan Peer (1): iwlwifi: mvm: Correctly set fragmented EBS Ilya Maximets (2): net: openvswitch: don't send internal clone attribute to the userspace. net: openvswitch: fix leak of nested actions Ivan Vecera (1): ice: Clear default forwarding VSI during VSI release Jakub Kicinski (2): net: account alternate interface name memory net: limit altnames to 64k total Jakub Sitnicki (1): bpf: Make dst_port field in struct bpf_sock 16-bit wide James Clark (1): perf: arm-spe: Fix perf report --mem-mode Jamie Bainbridge (1): qede: confirm skb is allocated before using Jianglei Nie (1): scsi: libfc: Fix use after free in fc_exch_abts_resp() Jiasheng Jiang (2): rtc: wm8350: Handle error for wm8350_register_irq drm/imx: imx-ldb: Check for null pointer after calling kmemdup Jim Mattson (1): KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs Jiri Slaby (1): serial: samsung_tty: do not unlock port->lock for uart_write_wakeup() John David Anglin (1): parisc: Fix patch code locking and flushing Jordy Zomer (1): dm ioctl: prevent potential spectre v1 gadget José Expósito (1): drm/imx: Fix memory leak in imx_pd_connector_get_modes Kaiwen Hu (1): btrfs: prevent subvol with swapfile from being deleted Kalle Valo (1): ath11k: mhi: use mhi_sync_power_up() Kamal Dasu (1): spi: bcm-qspi: fix MSPI only access with bcm_qspi_exec_mem_op() Karol Herbst (1): drm/nouveau/pmu: Add missing callbacks for Tegra devices Kees Cook (1): ubsan: remove CONFIG_UBSAN_OBJECT_SIZE Kefeng Wang (1): powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit Krzysztof Kozlowski (1): MIPS: ingenic: correct unit node address Lee Jones (1): drm/amdkfd: Create file descriptor after client is added to smi_clients list Li Chen (1): PCI: endpoint: Fix misused goto label Lorenzo Bianconi (1): mt76: dma: initialize skip_unmap in mt76_dma_rx_fill Lucas Denefle (1): w1: w1_therm: fixes w1_seq for ds28ea00 sensors Luiz Augusto von Dentz (2): Bluetooth: Fix not checking for valid hdev on bt_dev_{info,warn,err,dbg} Bluetooth: Fix use after free in hci_send_acl Lv Yunlong (1): drbd: Fix five use after free bugs in get_initial_state Maciej Fijalkowski (1): ice: synchronize_rcu() when terminating rings Manivannan Sadhasivam (1): PCI: pciehp: Add Qualcomm quirk for Command Completed erratum Marc Zyngier (1): irqchip/gic-v3: Fix GICR_CTLR.RWP polling Martin Habets (1): sfc: Do not free an empty page_ring Mauricio Faria de Oliveira (1): mm: fix race between MADV_FREE reclaim and blkdev direct IO read Max Filippov (1): xtensa: fix DTC warning unit_address_format Maxim Kiselev (1): powerpc: dts: t104xrdb: fix phy type for FMAN 4/5 Maxim Mikityanskiy (1): bpf: Support dual-stack sockets in bpf_tcp_check_syncookie Maxime Ripard (1): clk: Enforce that disjoints limits are invalid Miaohe Lin (1): mm/mempolicy: fix mpol_new leak in shared_policy_replace Miaoqian Lin (1): dpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe Michael Chan (1): bnxt_en: Eliminate unintended link toggle during FW reset Michael Walle (2): net: sfp: add 2500base-X quirk for Lantech SFP module net: phy: mscc-miim: reject clause 45 register accesses Minghao Chi (CGEL ZTE) (1): Bluetooth: use memset avoid memory leaks Nathan Chancellor (1): x86/Kconfig: Do not allow CONFIG_X86_X32_ABI=y with llvm-objcopy Neal Liu (1): usb: ehci: add pci device support for Aspeed platforms NeilBrown (5): SUNRPC/call_alloc: async tasks mustn't block waiting for memory SUNRPC/xprt: async tasks mustn't block waiting for memory SUNRPC: remove scheduling boost for "SWAPPER" tasks. NFS: swap IO handling is slightly different for O_DIRECT IO NFS: swap-out must always use STABLE writes. Niels Dossche (1): IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition Nikolay Aleksandrov (1): net: ipv4: fix route with nexthop object delete warning Oliver Hartkopp (1): can: isotp: set default value for N_As to 50 micro seconds Pali Rohár (2): PCI: aardvark: Fix support for MSI interrupts Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning" Paolo Bonzini (1): mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) Pavel Begunkov (1): io_uring: don't touch scm_fp_list after queueing skb Pawan Gupta (2): x86/pm: Save the MSR validity status at context setup x86/speculation: Restore speculation related MSRs during S3 resume Peter Xu (1): mm: don't skip swap entry even if zap_details specified Qi Liu (1): scsi: hisi_sas: Free irq vectors in order for v3 HW Qinghua Jin (1): minix: fix bug when opening a file with O_DIRECT Rajneesh Bhardwaj (1): drm/amdgpu: Fix recursive locking warning Randy Dunlap (3): scsi: aha152x: Fix aha152x_setup() __setup handler return value init/main.c: return 1 from handled __setup() functions virtio_console: eliminate anonymous module_init & module_exit Sachin Sant (1): selftests/cgroup: Fix build on older distros Sasha Levin (1): Revert "hv: utils: add PTP_1588_CLOCK to Kconfig to fix build" Sebastian Andrzej Siewior (1): tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH. Shreeya Patel (1): gpio: Restrict usage of GPIO chip irq members before initialization Sourabh Jain (1): powerpc: Set crashkernel offset to mid of RMA region Stefan Wahren (1): staging: vchiq_core: handle NULL result of find_service_by_handle Sven Eckelmann (1): macvtap: advertise link netns via netlink Tejun Heo (3): selftests: cgroup: Make cg_create() use 0755 for permission instead of 0644 selftests: cgroup: Test open-time credential usage for migration checks selftests: cgroup: Test open-time cgroup namespace usage for migration checks Tony Lindgren (2): clk: ti: Preserve node in ti_dt_clocks_register() iommu/omap: Fix regression in probe for NULL pointer dereference Trond Myklebust (7): NFSv4: Protect the state recovery thread against direct reclaim SUNRPC: Fix socket waits for write buffer space NFS: nfsiod should not block forever in mempool_alloc() NFS: Avoid writeback threads getting stuck in mempool_alloc() SUNRPC: Handle ENOMEM in call_transmit_status() SUNRPC: Handle low memory situations in call_status() SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec() Venkateswara Naralasetty (1): ath11k: fix kernel panic during unload/load ath11k modules Vinod Koul (1): dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error" Waiman Long (1): mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning Wang Yufen (1): netlabel: fix out-of-bounds memory accesses Wayne Chang (2): usb: gadget: tegra-xudc: Do not program SPARAM usb: gadget: tegra-xudc: Fix control endpoint's definitions Wolfram Sang (1): mmc: renesas_sdhi: don't overwrite TAP settings when HS400 tuning is complete Xiaoke Wang (1): staging: wfx: fix an error handling in wfx_init_common() Xiaomeng Tong (1): perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator Xin Xiong (2): drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify() Xiubo Li (1): ceph: fix memory leak in ceph_readdir when note_last_dentry returns error Yang Guang (3): ptp: replace snprintf with sysfs_emit scsi: mvsas: Replace snprintf() with sysfs_emit() scsi: bfa: Replace snprintf() with sysfs_emit() Yang Li (1): mt76: mt7615: Fix assigning negative values to unsigned variable Yann Gautier (1): mmc: mmci: stm32: correctly check all elements of sg list Yonghong Song (1): libbpf: Fix build issue with llvm-readelf Zekun Shen (1): ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 Zheng Zengkai (2): ipv6: fix kabi for mc_forwarding in struct ipv6_devconf Revert "powerpc: Fix virt_addr_valid() check" Zhou Guanghui (1): iommu/arm-smmu-v3: fix event handling soft lockup Ziyang Xuan (1): net/tls: fix slab-out-of-bounds bug in decrypt_internal arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/module.lds.h | 6 +- arch/arm64/kernel/insn.c | 4 +- arch/arm64/kernel/proton-pack.c | 1 + arch/mips/boot/dts/ingenic/jz4780.dtsi | 2 +- arch/mips/include/asm/setup.h | 2 +- arch/mips/kernel/traps.c | 22 +-- arch/mips/ralink/ill_acc.c | 1 + arch/parisc/kernel/patch.c | 25 ++- arch/powerpc/boot/dts/fsl/t104xrdb.dtsi | 4 +- arch/powerpc/include/asm/page.h | 7 +- arch/powerpc/kernel/rtas.c | 6 + arch/powerpc/kernel/secvar-sysfs.c | 9 +- arch/powerpc/kexec/core.c | 15 +- arch/x86/Kconfig | 5 + arch/x86/kvm/emulate.c | 4 +- arch/x86/kvm/kvm_emulate.h | 1 + arch/x86/kvm/svm/pmu.c | 8 +- arch/x86/kvm/x86.c | 6 + arch/x86/power/cpu.c | 21 ++- arch/x86/xen/smp_hvm.c | 6 + arch/x86/xen/time.c | 24 ++- arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi | 8 +- arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi | 8 +- arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi | 4 +- drivers/ata/sata_dwc_460ex.c | 6 +- drivers/block/drbd/drbd_int.h | 8 +- drivers/block/drbd/drbd_nl.c | 41 +++-- drivers/block/drbd/drbd_state.c | 18 +- drivers/block/drbd/drbd_state_change.h | 8 +- drivers/char/virtio_console.c | 8 +- drivers/clk/clk-si5341.c | 16 +- drivers/clk/clk.c | 24 +++ drivers/clk/ti/clk.c | 13 +- drivers/dma/sh/shdma-base.c | 4 +- drivers/gpio/gpiolib.c | 19 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 24 ++- .../gpu/drm/amd/display/dc/core/dc_resource.c | 3 + .../drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c | 8 +- .../gpu/drm/drm_panel_orientation_quirks.c | 6 + drivers/gpu/drm/imx/imx-ldb.c | 2 + drivers/gpu/drm/imx/parallel-display.c | 4 +- .../gpu/drm/nouveau/nvkm/subdev/pmu/gm20b.c | 1 + .../gpu/drm/nouveau/nvkm/subdev/pmu/gp102.c | 2 +- .../gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c | 1 + .../gpu/drm/nouveau/nvkm/subdev/pmu/priv.h | 1 + drivers/hv/Kconfig | 1 - drivers/hv/channel_mgmt.c | 6 +- drivers/hv/vmbus_drv.c | 9 +- drivers/infiniband/hw/hfi1/mmu_rb.c | 6 + drivers/infiniband/hw/mlx5/mr.c | 4 +- drivers/infiniband/sw/rdmavt/qp.c | 6 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 1 + drivers/iommu/omap-iommu.c | 2 +- drivers/irqchip/irq-gic-v3.c | 14 +- drivers/irqchip/irq-gic.c | 6 + drivers/md/dm-ioctl.c | 2 + drivers/mmc/host/mmci_stm32_sdmmc.c | 6 +- drivers/mmc/host/renesas_sdhi_core.c | 4 +- drivers/mmc/host/sdhci-xenon.c | 10 -- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 3 +- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 4 +- .../net/ethernet/freescale/dpaa2/dpaa2-ptp.c | 4 +- drivers/net/ethernet/intel/ice/ice.h | 2 +- drivers/net/ethernet/intel/ice/ice_lib.c | 3 + drivers/net/ethernet/intel/ice/ice_main.c | 4 +- .../net/ethernet/intel/ice/ice_virtchnl_pf.c | 4 +- drivers/net/ethernet/intel/ice/ice_xsk.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 3 + drivers/net/ethernet/sfc/rx_common.c | 3 + .../ethernet/stmicro/stmmac/stmmac_platform.c | 3 +- drivers/net/macvtap.c | 6 + drivers/net/mdio/mdio-mscc-miim.c | 6 + drivers/net/phy/sfp-bus.c | 6 + drivers/net/tap.c | 3 +- drivers/net/tun.c | 3 +- drivers/net/wireless/ath/ath11k/ahb.c | 2 + drivers/net/wireless/ath/ath11k/mhi.c | 2 +- drivers/net/wireless/ath/ath5k/eeprom.c | 3 + drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 5 +- drivers/net/wireless/mediatek/mt76/dma.c | 1 + .../net/wireless/mediatek/mt76/mt7615/mac.c | 2 +- drivers/parisc/dino.c | 41 ++++- drivers/parisc/gsc.c | 31 ++++ drivers/parisc/gsc.h | 1 + drivers/parisc/lasi.c | 7 +- drivers/parisc/wax.c | 7 +- drivers/pci/controller/pci-aardvark.c | 16 +- drivers/pci/endpoint/functions/pci-epf-test.c | 14 +- drivers/pci/hotplug/pciehp_hpc.c | 2 + drivers/perf/qcom_l2_pmu.c | 6 +- drivers/phy/amlogic/phy-meson8b-usb2.c | 5 +- drivers/power/supply/axp20x_battery.c | 13 +- drivers/power/supply/axp288_charger.c | 14 +- drivers/ptp/ptp_sysfs.c | 4 +- drivers/rtc/rtc-wm8350.c | 11 +- drivers/scsi/aha152x.c | 6 +- drivers/scsi/bfa/bfad_attr.c | 26 +-- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 16 +- drivers/scsi/libfc/fc_exch.c | 1 + drivers/scsi/mvsas/mv_init.c | 4 +- drivers/scsi/pm8001/pm8001_hwi.c | 27 ++- drivers/scsi/pm8001/pm8001_sas.c | 2 +- drivers/scsi/pm8001/pm80xx_hwi.c | 17 +- drivers/scsi/zorro7xx.c | 2 + drivers/spi/spi-bcm-qspi.c | 4 +- .../interface/vchiq_arm/vchiq_core.c | 6 + drivers/staging/wfx/main.c | 7 +- drivers/tty/serial/samsung_tty.c | 5 +- drivers/usb/dwc3/dwc3-omap.c | 2 +- drivers/usb/gadget/udc/tegra-xudc.c | 20 +-- drivers/usb/host/ehci-pci.c | 9 + drivers/vhost/net.c | 1 + drivers/w1/slaves/w1_therm.c | 8 +- fs/btrfs/extent_io.h | 2 +- fs/btrfs/inode.c | 22 +++ fs/ceph/dir.c | 11 +- fs/gfs2/bmap.c | 2 +- fs/gfs2/file.c | 3 +- fs/gfs2/inode.c | 2 +- fs/gfs2/rgrp.c | 7 +- fs/gfs2/rgrp.h | 2 +- fs/gfs2/super.c | 2 +- fs/io_uring.c | 8 +- fs/jfs/inode.c | 3 +- fs/minix/inode.c | 3 +- fs/nfs/direct.c | 48 +++-- fs/nfs/file.c | 4 +- fs/nfs/internal.h | 7 + fs/nfs/nfs42proc.c | 9 +- fs/nfs/nfs4state.c | 12 ++ fs/nfs/pagelist.c | 10 +- fs/nfs/pnfs_nfs.c | 8 +- fs/nfs/write.c | 34 ++-- include/linux/gpio/driver.h | 9 + include/linux/ipv6.h | 2 +- include/linux/mmzone.h | 11 +- include/linux/nfs_fs.h | 10 +- include/net/arp.h | 1 + include/net/bluetooth/bluetooth.h | 14 +- include/uapi/linux/bpf.h | 3 +- include/uapi/linux/can/isotp.h | 28 ++- init/main.c | 6 +- lib/lz4/lz4_decompress.c | 8 +- lib/test_ubsan.c | 11 -- mm/memory.c | 25 ++- mm/mempolicy.c | 1 + mm/mremap.c | 3 + mm/rmap.c | 25 ++- net/batman-adv/multicast.c | 2 +- net/bluetooth/hci_event.c | 3 +- net/bluetooth/l2cap_core.c | 1 + net/can/isotp.c | 12 +- net/core/filter.c | 27 ++- net/core/rtnetlink.c | 13 +- net/ipv4/arp.c | 9 +- net/ipv4/fib_frontend.c | 5 +- net/ipv4/fib_semantics.c | 7 +- net/ipv4/inet_hashtables.c | 53 +++--- net/ipv6/addrconf.c | 4 +- net/ipv6/inet6_hashtables.c | 5 +- net/ipv6/ip6_input.c | 2 +- net/ipv6/ip6mr.c | 8 +- net/ipv6/route.c | 2 +- net/netlabel/netlabel_kapi.c | 2 + net/openvswitch/actions.c | 2 +- net/openvswitch/flow_netlink.c | 99 ++++++++++- net/rxrpc/net_ns.c | 2 +- net/smc/smc_core.c | 2 +- net/sunrpc/clnt.c | 7 + net/sunrpc/sched.c | 11 +- net/sunrpc/svcsock.c | 4 +- net/sunrpc/xprt.c | 16 +- net/sunrpc/xprtrdma/transport.c | 6 +- net/sunrpc/xprtsock.c | 54 ++++-- net/tls/tls_sw.c | 2 +- net/wireless/scan.c | 9 +- scripts/Makefile.ubsan | 1 - tools/build/feature/Makefile | 9 +- tools/lib/bpf/Makefile | 4 +- tools/perf/Makefile.config | 6 + tools/perf/arch/arm64/util/arm-spe.c | 6 + tools/perf/perf.c | 2 +- tools/perf/util/session.c | 15 +- tools/perf/util/setup.py | 8 +- tools/testing/selftests/cgroup/cgroup_util.c | 6 +- tools/testing/selftests/cgroup/test_core.c | 165 ++++++++++++++++++ 191 files changed, 1365 insertions(+), 496 deletions(-) -- 2.20.1

1 165

[PATCH openEuler-1.0-LTS 1/5] rcu/tree: Mark functions as notrace
by Yongqiang Liu 14 Jul '22

14 Jul '22

From: Zheng Yejian <zhengyejian1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187209, https://gitee.com/openeuler/kernel/issues/I5GWFT CVE: NA -------------------------------- Syzkaller report a softlockup problem, see following logs: [ 41.463870] watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [ksoftirqd/0:9] [ 41.509763] Modules linked in: [ 41.512295] CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.19.90 #13 [ 41.516134] Hardware name: linux,dummy-virt (DT) [ 41.519182] pstate: 80c00005 (Nzcv daif +PAN +UAO) [ 41.522415] pc : perf_trace_buf_alloc+0x138/0x238 [ 41.525583] lr : perf_trace_buf_alloc+0x138/0x238 [ 41.528656] sp : ffff8000c137e880 [ 41.531050] x29: ffff8000c137e880 x28: ffff20000850ced0 [ 41.534759] x27: 0000000000000000 x26: ffff8000c137e9c0 [ 41.538456] x25: ffff8000ce5c2ae0 x24: ffff200008358b08 [ 41.542151] x23: 0000000000000000 x22: ffff2000084a50ac [ 41.545834] x21: ffff8000c137e880 x20: 000000000000001c [ 41.549516] x19: ffff7dffbfdf88e8 x18: 0000000000000000 [ 41.553202] x17: 0000000000000000 x16: 0000000000000000 [ 41.556892] x15: 1ffff00036e07805 x14: 0000000000000000 [ 41.560592] x13: 0000000000000004 x12: 0000000000000000 [ 41.564315] x11: 1fffefbff7fbf120 x10: ffff0fbff7fbf120 [ 41.568003] x9 : dfff200000000000 x8 : ffff7dffbfdf8904 [ 41.571699] x7 : 0000000000000000 x6 : ffff0fbff7fbf121 [ 41.575398] x5 : ffff0fbff7fbf121 x4 : ffff0fbff7fbf121 [ 41.579086] x3 : ffff20000850cdc8 x2 : 0000000000000008 [ 41.582773] x1 : ffff8000c1376000 x0 : 0000000000000100 [ 41.586495] Call trace: [ 41.588922] perf_trace_buf_alloc+0x138/0x238 [ 41.591912] perf_ftrace_function_call+0x1ac/0x248 [ 41.595123] ftrace_ops_no_ops+0x3a4/0x488 [ 41.597998] ftrace_graph_call+0x0/0xc [ 41.600715] rcu_dynticks_curr_cpu_in_eqs+0x14/0x70 [ 41.603962] rcu_is_watching+0xc/0x20 [ 41.606635] ftrace_ops_no_ops+0x240/0x488 [ 41.609530] ftrace_graph_call+0x0/0xc [ 41.612249] __read_once_size_nocheck.constprop.0+0x1c/0x38 [ 41.615905] unwind_frame+0x140/0x358 [ 41.618597] walk_stackframe+0x34/0x60 [ 41.621359] __save_stack_trace+0x204/0x3b8 [ 41.624328] save_stack_trace+0x2c/0x38 [ 41.627112] __kasan_slab_free+0x120/0x228 [ 41.630018] kasan_slab_free+0x10/0x18 [ 41.632752] kfree+0x84/0x250 [ 41.635107] skb_free_head+0x70/0xb0 [ 41.637772] skb_release_data+0x3f8/0x730 [ 41.640626] skb_release_all+0x50/0x68 [ 41.643350] kfree_skb+0x84/0x278 [ 41.645890] kfree_skb_list+0x4c/0x78 [ 41.648595] __dev_queue_xmit+0x1a4c/0x23a0 [ 41.651541] dev_queue_xmit+0x28/0x38 [ 41.654254] ip6_finish_output2+0xeb0/0x1630 [ 41.657261] ip6_finish_output+0x2d8/0x7f8 [ 41.660174] ip6_output+0x19c/0x348 [ 41.663850] mld_sendpack+0x560/0x9e0 [ 41.666564] mld_ifc_timer_expire+0x484/0x8a8 [ 41.669624] call_timer_fn+0x68/0x4b0 [ 41.672355] expire_timers+0x168/0x498 [ 41.675126] run_timer_softirq+0x230/0x7a8 [ 41.678052] __do_softirq+0x2d0/0xba0 [ 41.680763] run_ksoftirqd+0x110/0x1a0 [ 41.683512] smpboot_thread_fn+0x31c/0x620 [ 41.686429] kthread+0x2c8/0x348 [ 41.688927] ret_from_fork+0x10/0x18 Look into above call stack, we found a recursive call in 'ftrace_graph_call', see a snippet: __read_once_size_nocheck.constprop.0 ftrace_graph_call ...... rcu_dynticks_curr_cpu_in_eqs ftrace_graph_call We analyze that 'rcu_dynticks_curr_cpu_in_eqs' should not be tracable, and we verify that mark related functions as 'notrace' can avoid the problem. Comparing mainline kernel, we find that commit ff5c4f5cad33 ("rcu/tree: Mark the idle relevant functions noinstr") mark related functions as 'noinstr' which implies notrace, noinline and sticks things in the .noinstr.text section. Link: https://lore.kernel.org/all/20200416114706.625340212@infradead.org/ Currently 'noinstr' mechanism has not been introduced, so we would not directly backport that commit (otherwise more changes may be introduced). Instead, we mark the functions as 'notrace' where it is 'noinstr' in that commit. Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Reviewed-by: Zhen Lei <thunder.leizhen(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/rcu/tree.c | 22 +++++++++++----------- kernel/rcu/tree_plugin.h | 4 ++-- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c index 594d6ea99024..ea05c59096a2 100644 --- a/kernel/rcu/tree.c +++ b/kernel/rcu/tree.c @@ -275,7 +275,7 @@ static DEFINE_PER_CPU(struct rcu_dynticks, rcu_dynticks) = { * Record entry into an extended quiescent state. This is only to be * called when not already in an extended quiescent state. */ -static void rcu_dynticks_eqs_enter(void) +static notrace void rcu_dynticks_eqs_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); int seq; @@ -298,7 +298,7 @@ static void rcu_dynticks_eqs_enter(void) * Record exit from an extended quiescent state. This is only to be * called from an extended quiescent state. */ -static void rcu_dynticks_eqs_exit(void) +static notrace void rcu_dynticks_eqs_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); int seq; @@ -343,7 +343,7 @@ static void rcu_dynticks_eqs_online(void) * * No ordering, as we are sampling CPU-local information. */ -bool rcu_dynticks_curr_cpu_in_eqs(void) +static __always_inline bool rcu_dynticks_curr_cpu_in_eqs(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -706,7 +706,7 @@ static struct rcu_node *rcu_get_root(struct rcu_state *rsp) * the possibility of usermode upcalls having messed up our count * of interrupt nesting level during the prior busy period. */ -static void rcu_eqs_enter(bool user) +static notrace void rcu_eqs_enter(bool user) { struct rcu_state *rsp; struct rcu_data *rdp; @@ -763,7 +763,7 @@ void rcu_idle_enter(void) * If you add or remove a call to rcu_user_enter(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_user_enter(void) +notrace void rcu_user_enter(void) { lockdep_assert_irqs_disabled(); rcu_eqs_enter(true); @@ -781,7 +781,7 @@ void rcu_user_enter(void) * If you add or remove a call to rcu_nmi_exit(), be sure to test * with CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_nmi_exit(void) +notrace void rcu_nmi_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -829,7 +829,7 @@ void rcu_nmi_exit(void) * If you add or remove a call to rcu_irq_exit(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_irq_exit(void) +notrace void rcu_irq_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -864,7 +864,7 @@ void rcu_irq_exit_irqson(void) * allow for the possibility of usermode upcalls messing up our count of * interrupt nesting level during the busy period that is just now starting. */ -static void rcu_eqs_exit(bool user) +static notrace void rcu_eqs_exit(bool user) { struct rcu_dynticks *rdtp; long oldval; @@ -914,7 +914,7 @@ void rcu_idle_exit(void) * If you add or remove a call to rcu_user_exit(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_user_exit(void) +void notrace rcu_user_exit(void) { rcu_eqs_exit(1); } @@ -932,7 +932,7 @@ void rcu_user_exit(void) * If you add or remove a call to rcu_nmi_enter(), be sure to test * with CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_nmi_enter(void) +notrace void rcu_nmi_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); long incby = 2; @@ -982,7 +982,7 @@ void rcu_nmi_enter(void) * If you add or remove a call to rcu_irq_enter(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_irq_enter(void) +notrace void rcu_irq_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h index 5f6de49dc78e..568818bef28f 100644 --- a/kernel/rcu/tree_plugin.h +++ b/kernel/rcu/tree_plugin.h @@ -2677,7 +2677,7 @@ static void rcu_bind_gp_kthread(void) } /* Record the current task on dyntick-idle entry. */ -static void rcu_dynticks_task_enter(void) +static notrace void rcu_dynticks_task_enter(void) { #if defined(CONFIG_TASKS_RCU) && defined(CONFIG_NO_HZ_FULL) WRITE_ONCE(current->rcu_tasks_idle_cpu, smp_processor_id()); @@ -2685,7 +2685,7 @@ static void rcu_dynticks_task_enter(void) } /* Record no current task on dyntick-idle exit. */ -static void rcu_dynticks_task_exit(void) +static notrace void rcu_dynticks_task_exit(void) { #if defined(CONFIG_TASKS_RCU) && defined(CONFIG_NO_HZ_FULL) WRITE_ONCE(current->rcu_tasks_idle_cpu, -1); -- 2.25.1

1 4

[PATCH openEuler-1.0-LTS 1/5] rcu/tree: Mark functions as notrace
by Yongqiang Liu 14 Jul '22

14 Jul '22

From: Zheng Yejian <zhengyejian1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187209, https://gitee.com/openeuler/kernel/issues/I5GWFT CVE: NA -------------------------------- Syzkaller report a softlockup problem, see following logs: [ 41.463870] watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [ksoftirqd/0:9] [ 41.509763] Modules linked in: [ 41.512295] CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.19.90 #13 [ 41.516134] Hardware name: linux,dummy-virt (DT) [ 41.519182] pstate: 80c00005 (Nzcv daif +PAN +UAO) [ 41.522415] pc : perf_trace_buf_alloc+0x138/0x238 [ 41.525583] lr : perf_trace_buf_alloc+0x138/0x238 [ 41.528656] sp : ffff8000c137e880 [ 41.531050] x29: ffff8000c137e880 x28: ffff20000850ced0 [ 41.534759] x27: 0000000000000000 x26: ffff8000c137e9c0 [ 41.538456] x25: ffff8000ce5c2ae0 x24: ffff200008358b08 [ 41.542151] x23: 0000000000000000 x22: ffff2000084a50ac [ 41.545834] x21: ffff8000c137e880 x20: 000000000000001c [ 41.549516] x19: ffff7dffbfdf88e8 x18: 0000000000000000 [ 41.553202] x17: 0000000000000000 x16: 0000000000000000 [ 41.556892] x15: 1ffff00036e07805 x14: 0000000000000000 [ 41.560592] x13: 0000000000000004 x12: 0000000000000000 [ 41.564315] x11: 1fffefbff7fbf120 x10: ffff0fbff7fbf120 [ 41.568003] x9 : dfff200000000000 x8 : ffff7dffbfdf8904 [ 41.571699] x7 : 0000000000000000 x6 : ffff0fbff7fbf121 [ 41.575398] x5 : ffff0fbff7fbf121 x4 : ffff0fbff7fbf121 [ 41.579086] x3 : ffff20000850cdc8 x2 : 0000000000000008 [ 41.582773] x1 : ffff8000c1376000 x0 : 0000000000000100 [ 41.586495] Call trace: [ 41.588922] perf_trace_buf_alloc+0x138/0x238 [ 41.591912] perf_ftrace_function_call+0x1ac/0x248 [ 41.595123] ftrace_ops_no_ops+0x3a4/0x488 [ 41.597998] ftrace_graph_call+0x0/0xc [ 41.600715] rcu_dynticks_curr_cpu_in_eqs+0x14/0x70 [ 41.603962] rcu_is_watching+0xc/0x20 [ 41.606635] ftrace_ops_no_ops+0x240/0x488 [ 41.609530] ftrace_graph_call+0x0/0xc [ 41.612249] __read_once_size_nocheck.constprop.0+0x1c/0x38 [ 41.615905] unwind_frame+0x140/0x358 [ 41.618597] walk_stackframe+0x34/0x60 [ 41.621359] __save_stack_trace+0x204/0x3b8 [ 41.624328] save_stack_trace+0x2c/0x38 [ 41.627112] __kasan_slab_free+0x120/0x228 [ 41.630018] kasan_slab_free+0x10/0x18 [ 41.632752] kfree+0x84/0x250 [ 41.635107] skb_free_head+0x70/0xb0 [ 41.637772] skb_release_data+0x3f8/0x730 [ 41.640626] skb_release_all+0x50/0x68 [ 41.643350] kfree_skb+0x84/0x278 [ 41.645890] kfree_skb_list+0x4c/0x78 [ 41.648595] __dev_queue_xmit+0x1a4c/0x23a0 [ 41.651541] dev_queue_xmit+0x28/0x38 [ 41.654254] ip6_finish_output2+0xeb0/0x1630 [ 41.657261] ip6_finish_output+0x2d8/0x7f8 [ 41.660174] ip6_output+0x19c/0x348 [ 41.663850] mld_sendpack+0x560/0x9e0 [ 41.666564] mld_ifc_timer_expire+0x484/0x8a8 [ 41.669624] call_timer_fn+0x68/0x4b0 [ 41.672355] expire_timers+0x168/0x498 [ 41.675126] run_timer_softirq+0x230/0x7a8 [ 41.678052] __do_softirq+0x2d0/0xba0 [ 41.680763] run_ksoftirqd+0x110/0x1a0 [ 41.683512] smpboot_thread_fn+0x31c/0x620 [ 41.686429] kthread+0x2c8/0x348 [ 41.688927] ret_from_fork+0x10/0x18 Look into above call stack, we found a recursive call in 'ftrace_graph_call', see a snippet: __read_once_size_nocheck.constprop.0 ftrace_graph_call ...... rcu_dynticks_curr_cpu_in_eqs ftrace_graph_call We analyze that 'rcu_dynticks_curr_cpu_in_eqs' should not be tracable, and we verify that mark related functions as 'notrace' can avoid the problem. Comparing mainline kernel, we find that commit ff5c4f5cad33 ("rcu/tree: Mark the idle relevant functions noinstr") mark related functions as 'noinstr' which implies notrace, noinline and sticks things in the .noinstr.text section. Link: https://lore.kernel.org/all/20200416114706.625340212@infradead.org/ Currently 'noinstr' mechanism has not been introduced, so we would not directly backport that commit (otherwise more changes may be introduced). Instead, we mark the functions as 'notrace' where it is 'noinstr' in that commit. Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Reviewed-by: Zhen Lei <thunder.leizhen(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/rcu/tree.c | 22 +++++++++++----------- kernel/rcu/tree_plugin.h | 4 ++-- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c index 594d6ea99024..ea05c59096a2 100644 --- a/kernel/rcu/tree.c +++ b/kernel/rcu/tree.c @@ -275,7 +275,7 @@ static DEFINE_PER_CPU(struct rcu_dynticks, rcu_dynticks) = { * Record entry into an extended quiescent state. This is only to be * called when not already in an extended quiescent state. */ -static void rcu_dynticks_eqs_enter(void) +static notrace void rcu_dynticks_eqs_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); int seq; @@ -298,7 +298,7 @@ static void rcu_dynticks_eqs_enter(void) * Record exit from an extended quiescent state. This is only to be * called from an extended quiescent state. */ -static void rcu_dynticks_eqs_exit(void) +static notrace void rcu_dynticks_eqs_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); int seq; @@ -343,7 +343,7 @@ static void rcu_dynticks_eqs_online(void) * * No ordering, as we are sampling CPU-local information. */ -bool rcu_dynticks_curr_cpu_in_eqs(void) +static __always_inline bool rcu_dynticks_curr_cpu_in_eqs(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -706,7 +706,7 @@ static struct rcu_node *rcu_get_root(struct rcu_state *rsp) * the possibility of usermode upcalls having messed up our count * of interrupt nesting level during the prior busy period. */ -static void rcu_eqs_enter(bool user) +static notrace void rcu_eqs_enter(bool user) { struct rcu_state *rsp; struct rcu_data *rdp; @@ -763,7 +763,7 @@ void rcu_idle_enter(void) * If you add or remove a call to rcu_user_enter(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_user_enter(void) +notrace void rcu_user_enter(void) { lockdep_assert_irqs_disabled(); rcu_eqs_enter(true); @@ -781,7 +781,7 @@ void rcu_user_enter(void) * If you add or remove a call to rcu_nmi_exit(), be sure to test * with CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_nmi_exit(void) +notrace void rcu_nmi_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -829,7 +829,7 @@ void rcu_nmi_exit(void) * If you add or remove a call to rcu_irq_exit(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_irq_exit(void) +notrace void rcu_irq_exit(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); @@ -864,7 +864,7 @@ void rcu_irq_exit_irqson(void) * allow for the possibility of usermode upcalls messing up our count of * interrupt nesting level during the busy period that is just now starting. */ -static void rcu_eqs_exit(bool user) +static notrace void rcu_eqs_exit(bool user) { struct rcu_dynticks *rdtp; long oldval; @@ -914,7 +914,7 @@ void rcu_idle_exit(void) * If you add or remove a call to rcu_user_exit(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_user_exit(void) +void notrace rcu_user_exit(void) { rcu_eqs_exit(1); } @@ -932,7 +932,7 @@ void rcu_user_exit(void) * If you add or remove a call to rcu_nmi_enter(), be sure to test * with CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_nmi_enter(void) +notrace void rcu_nmi_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); long incby = 2; @@ -982,7 +982,7 @@ void rcu_nmi_enter(void) * If you add or remove a call to rcu_irq_enter(), be sure to test with * CONFIG_RCU_EQS_DEBUG=y. */ -void rcu_irq_enter(void) +notrace void rcu_irq_enter(void) { struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks); diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h index 5f6de49dc78e..568818bef28f 100644 --- a/kernel/rcu/tree_plugin.h +++ b/kernel/rcu/tree_plugin.h @@ -2677,7 +2677,7 @@ static void rcu_bind_gp_kthread(void) } /* Record the current task on dyntick-idle entry. */ -static void rcu_dynticks_task_enter(void) +static notrace void rcu_dynticks_task_enter(void) { #if defined(CONFIG_TASKS_RCU) && defined(CONFIG_NO_HZ_FULL) WRITE_ONCE(current->rcu_tasks_idle_cpu, smp_processor_id()); @@ -2685,7 +2685,7 @@ static void rcu_dynticks_task_enter(void) } /* Record no current task on dyntick-idle exit. */ -static void rcu_dynticks_task_exit(void) +static notrace void rcu_dynticks_task_exit(void) { #if defined(CONFIG_TASKS_RCU) && defined(CONFIG_NO_HZ_FULL) WRITE_ONCE(current->rcu_tasks_idle_cpu, -1); -- 2.25.1

1 4

[PATCH openEuler-1.0-LTS 1/4] vt: drop old FONT ioctls
by Yongqiang Liu 13 Jul '22

13 Jul '22

From: Jiri Slaby <jslaby(a)suse.cz> stable inclusion from stable-4.19.250 commit b15d5731b708a2190fec836990b8aefbbf36b07a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5GKVX CVE: CVE-2021-33656 -------------------------------- commit ff2047fb755d4415ec3c70ac799889371151796d upstream. Drop support for these ioctls: * PIO_FONT, PIO_FONTX * GIO_FONT, GIO_FONTX * PIO_FONTRESET As was demonstrated by commit 90bfdeef83f1 (tty: make FONTX ioctl use the tty pointer they were actually passed), these ioctls are not used from userspace, as: 1) they used to be broken (set up font on current console, not the open one) and racy (before the commit above) 2) KDFONTOP ioctl is used for years instead Note that PIO_FONTRESET is defunct on most systems as VGA_CONSOLE is set on them for ages. That turns on BROKEN_GRAPHICS_PROGRAMS which makes PIO_FONTRESET just return an error. We are removing KD_FONT_FLAG_OLD here as it was used only by these removed ioctls. kd.h header exists both in kernel and uapi headers, so we can remove the kernel one completely. Everyone includeing kd.h will now automatically get the uapi one. There are now unused definitions of the ioctl numbers and "struct consolefontdesc" in kd.h, but as it is a uapi header, I am not touching these. Signed-off-by: Jiri Slaby <jslaby(a)suse.cz> Link: https://lore.kernel.org/r/20210105120239.28031-8-jslaby@suse.cz Cc: guodaxing <guodaxing(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/tty/vt/vt.c | 39 +--------- drivers/tty/vt/vt_ioctl.c | 149 -------------------------------------- include/linux/kd.h | 8 -- 3 files changed, 3 insertions(+), 193 deletions(-) delete mode 100644 include/linux/kd.h diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 72e3989dffa6..dca627ccece5 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -4472,16 +4472,8 @@ static int con_font_get(struct vc_data *vc, struct console_font_op *op) if (op->data && font.charcount > op->charcount) rc = -ENOSPC; - if (!(op->flags & KD_FONT_FLAG_OLD)) { - if (font.width > op->width || font.height > op->height) - rc = -ENOSPC; - } else { - if (font.width != 8) - rc = -EIO; - else if ((op->height && font.height > op->height) || - font.height > 32) - rc = -ENOSPC; - } + if (font.width > op->width || font.height > op->height) + rc = -ENOSPC; if (rc) goto out; @@ -4509,7 +4501,7 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op) return -EINVAL; if (op->charcount > 512) return -EINVAL; - if (op->width <= 0 || op->width > 32 || op->height > 32) + if (op->width <= 0 || op->width > 32 || !op->height || op->height > 32) return -EINVAL; size = (op->width+7)/8 * 32 * op->charcount; if (size > max_font_size) @@ -4519,31 +4511,6 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op) if (IS_ERR(font.data)) return PTR_ERR(font.data); - if (!op->height) { /* Need to guess font height [compat] */ - int h, i; - u8 *charmap = font.data; - - /* - * If from KDFONTOP ioctl, don't allow things which can be done - * in userland,so that we can get rid of this soon - */ - if (!(op->flags & KD_FONT_FLAG_OLD)) { - kfree(font.data); - return -EINVAL; - } - - for (h = 32; h > 0; h--) - for (i = 0; i < op->charcount; i++) - if (charmap[32*i+h-1]) - goto nonzero; - - kfree(font.data); - return -EINVAL; - - nonzero: - op->height = h; - } - font.charcount = op->charcount; font.width = op->width; font.height = op->height; diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c index 13675008d1c7..915b0173b4f8 100644 --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -241,48 +241,6 @@ int vt_waitactive(int n) #define GPLAST 0x3df #define GPNUM (GPLAST - GPFIRST + 1) - - -static inline int -do_fontx_ioctl(struct vc_data *vc, int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op) -{ - struct consolefontdesc cfdarg; - int i; - - if (copy_from_user(&cfdarg, user_cfd, sizeof(struct consolefontdesc))) - return -EFAULT; - - switch (cmd) { - case PIO_FONTX: - if (!perm) - return -EPERM; - op->op = KD_FONT_OP_SET; - op->flags = KD_FONT_FLAG_OLD; - op->width = 8; - op->height = cfdarg.charheight; - op->charcount = cfdarg.charcount; - op->data = cfdarg.chardata; - return con_font_op(vc, op); - - case GIO_FONTX: - op->op = KD_FONT_OP_GET; - op->flags = KD_FONT_FLAG_OLD; - op->width = 8; - op->height = cfdarg.charheight; - op->charcount = cfdarg.charcount; - op->data = cfdarg.chardata; - i = con_font_op(vc, op); - if (i) - return i; - cfdarg.charheight = op->height; - cfdarg.charcount = op->charcount; - if (copy_to_user(user_cfd, &cfdarg, sizeof(struct consolefontdesc))) - return -EFAULT; - return 0; - } - return -EINVAL; -} - static inline int do_unimap_ioctl(int cmd, struct unimapdesc __user *user_ud, int perm, struct vc_data *vc) { @@ -918,30 +876,6 @@ int vt_ioctl(struct tty_struct *tty, break; } - case PIO_FONT: { - if (!perm) - return -EPERM; - op.op = KD_FONT_OP_SET; - op.flags = KD_FONT_FLAG_OLD | KD_FONT_FLAG_DONT_RECALC; /* Compatibility */ - op.width = 8; - op.height = 0; - op.charcount = 256; - op.data = up; - ret = con_font_op(vc, &op); - break; - } - - case GIO_FONT: { - op.op = KD_FONT_OP_GET; - op.flags = KD_FONT_FLAG_OLD; - op.width = 8; - op.height = 32; - op.charcount = 256; - op.data = up; - ret = con_font_op(vc, &op); - break; - } - case PIO_CMAP: if (!perm) ret = -EPERM; @@ -953,36 +887,6 @@ int vt_ioctl(struct tty_struct *tty, ret = con_get_cmap(up); break; - case PIO_FONTX: - case GIO_FONTX: - ret = do_fontx_ioctl(vc, cmd, up, perm, &op); - break; - - case PIO_FONTRESET: - { - if (!perm) - return -EPERM; - -#ifdef BROKEN_GRAPHICS_PROGRAMS - /* With BROKEN_GRAPHICS_PROGRAMS defined, the default - font is not saved. */ - ret = -ENOSYS; - break; -#else - { - op.op = KD_FONT_OP_SET_DEFAULT; - op.data = NULL; - ret = con_font_op(vc, &op); - if (ret) - break; - console_lock(); - con_set_default_unimap(vc); - console_unlock(); - break; - } -#endif - } - case KDFONTOP: { if (copy_from_user(&op, up, sizeof(op))) { ret = -EFAULT; @@ -1096,54 +1000,6 @@ void vc_SAK(struct work_struct *work) #ifdef CONFIG_COMPAT -struct compat_consolefontdesc { - unsigned short charcount; /* characters in font (256 or 512) */ - unsigned short charheight; /* scan lines per character (1-32) */ - compat_caddr_t chardata; /* font data in expanded form */ -}; - -static inline int -compat_fontx_ioctl(struct vc_data *vc, int cmd, - struct compat_consolefontdesc __user *user_cfd, - int perm, struct console_font_op *op) -{ - struct compat_consolefontdesc cfdarg; - int i; - - if (copy_from_user(&cfdarg, user_cfd, sizeof(struct compat_consolefontdesc))) - return -EFAULT; - - switch (cmd) { - case PIO_FONTX: - if (!perm) - return -EPERM; - op->op = KD_FONT_OP_SET; - op->flags = KD_FONT_FLAG_OLD; - op->width = 8; - op->height = cfdarg.charheight; - op->charcount = cfdarg.charcount; - op->data = compat_ptr(cfdarg.chardata); - return con_font_op(vc, op); - - case GIO_FONTX: - op->op = KD_FONT_OP_GET; - op->flags = KD_FONT_FLAG_OLD; - op->width = 8; - op->height = cfdarg.charheight; - op->charcount = cfdarg.charcount; - op->data = compat_ptr(cfdarg.chardata); - i = con_font_op(vc, op); - if (i) - return i; - cfdarg.charheight = op->height; - cfdarg.charcount = op->charcount; - if (copy_to_user(user_cfd, &cfdarg, sizeof(struct compat_consolefontdesc))) - return -EFAULT; - return 0; - } - return -EINVAL; -} - struct compat_console_font_op { compat_uint_t op; /* operation code KD_FONT_OP_* */ compat_uint_t flags; /* KD_FONT_FLAG_* */ @@ -1221,11 +1077,6 @@ long vt_compat_ioctl(struct tty_struct *tty, /* * these need special handlers for incompatible data structures */ - case PIO_FONTX: - case GIO_FONTX: - ret = compat_fontx_ioctl(vc, cmd, up, perm, &op); - break; - case KDFONTOP: ret = compat_kdfontop_ioctl(up, perm, &op, vc); break; diff --git a/include/linux/kd.h b/include/linux/kd.h deleted file mode 100644 index b130a18f860f..000000000000 --- a/include/linux/kd.h +++ /dev/null @@ -1,8 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -#ifndef _LINUX_KD_H -#define _LINUX_KD_H - -#include <uapi/linux/kd.h> - -#define KD_FONT_FLAG_OLD 0x80000000 /* Invoked via old interface [compat] */ -#endif /* _LINUX_KD_H */ -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS] dm thin: Fix crash in dm_sm_register_threshold_callback()
by Yongqiang Liu 13 Jul '22

13 Jul '22

From: Luo Meng <luomeng12(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5GRX6 CVE: NA -------------------------------- Fault inject on pool metadata device report: BUG: KASAN: use-after-free in dm_pool_register_metadata_threshold+0x40/0x80 Read of size 8 at addr ffff8881b9d50068 by task dmsetup/950 CPU: 7 PID: 950 Comm: dmsetup Tainted: G W 5.19.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_address_description.constprop.0.cold+0xeb/0x3f4 kasan_report.cold+0xe6/0x147 dm_pool_register_metadata_threshold+0x40/0x80 pool_ctr+0xa0a/0x1150 dm_table_add_target+0x2c8/0x640 table_load+0x1fd/0x430 ctl_ioctl+0x2c4/0x5a0 dm_ctl_ioctl+0xa/0x10 __x64_sys_ioctl+0xb3/0xd0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 This can be easy reproduce: echo offline > /sys/block/sda/device/state dd if=/dev/zero of=/dev/mapper/thin bs=4k count=10 dmsetup load pool --table "0 20971520 thin-pool /dev/sda /dev/sdb 128 0 0" If metadata commit failed, the transaction will be aborted and the metadata space manager will be destroyed. If load table on this pool, when register the metadata threshold callback, the UAF will happen on metadata space manager. So return error when load table if the pool is on FAIL status. Fixes: ac8c3f3df65e4 ("dm thin: generate event when metadata threshold passed") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/md/dm-thin-metadata.c | 8 +++++++- drivers/md/dm-thin.c | 4 +++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c index a6a5cee6b943..c3dc171114dc 100644 --- a/drivers/md/dm-thin-metadata.c +++ b/drivers/md/dm-thin-metadata.c @@ -1997,9 +1997,15 @@ int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd, int r; down_write(&pmd->root_lock); + if (pmd->fail_io) { + r = -EINVAL; + goto out; + } + r = dm_sm_register_threshold_callback(pmd->metadata_sm, threshold, fn, context); - up_write(&pmd->root_lock); +out: + up_write(&pmd->root_lock); return r; } diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c index 435a2ee4a392..2b6dd7a275eb 100644 --- a/drivers/md/dm-thin.c +++ b/drivers/md/dm-thin.c @@ -3383,8 +3383,10 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) calc_metadata_threshold(pt), metadata_low_callback, pool); - if (r) + if (r) { + ti->error = "Error registering metadata threshold"; goto out_flags_changed; + } pt->callbacks.congested_fn = pool_is_congested; dm_table_add_target_callbacks(ti->table, &pt->callbacks); -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 01/21] kabi: deduplication friendly structs
by Zheng Zengkai 13 Jul '22

13 Jul '22

From: Li Lingfeng <lilingfeng3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DI4S CVE: NA Reference: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/commit… --------------------------- We don't really need the field names to be globally unique, it is enough when they are unique in the given struct. Since structs do not generally span mutliple files, using the line number is enough to ensure an unique identifier. It means that we can't use two KABI_RENAME macros on the same line but that's not happening anyway. This allows pahole to deduplicate the type info of structs using KABI macros, lowering the size of vmlinuz from 26M to 8.5 Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/kabi.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/include/linux/kabi.h b/include/linux/kabi.h index a52d9fa72cfa..fe3213c0f576 100644 --- a/include/linux/kabi.h +++ b/include/linux/kabi.h @@ -393,6 +393,8 @@ # define __KABI_CHECK_SIZE(_item, _size) #endif +#define KABI_UNIQUE_ID __PASTE(kabi_hidden_, __LINE__) + # define _KABI_DEPRECATE(_type, _orig) _type kabi_reserved_##_orig # define _KABI_DEPRECATE_FN(_type, _orig, _args...) \ _type (* kabi_reserved_##_orig)(_args) @@ -402,7 +404,7 @@ _new; \ struct { \ _orig; \ - } __UNIQUE_ID(kabi_hide); \ + } KABI_UNIQUE_ID; \ __KABI_CHECK_SIZE_ALIGN(_orig, _new); \ } #else -- 2.20.1

1 20

[PATCH openEuler-1.0-LTS 1/6] xen/blkfront: fix memory allocation flags in blkfront_setup_indirect()
by Yongqiang Liu 13 Jul '22

13 Jul '22

From: Juergen Gross <jgross(a)suse.com> stable inclusion from stable-v4.19.116 commit 5f547e7cbd8435be3aa2a27e2ae594b4fd94865b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5GLXT CVE: CVE-2022-26365 -------------------------------- commit 3a169c0be75b59dd85d159493634870cdec6d3c4 upstream. Commit 1d5c76e664333 ("xen-blkfront: switch kcalloc to kvcalloc for large array allocation") didn't fix the issue it was meant to, as the flags for allocating the memory are GFP_NOIO, which will lead the memory allocation falling back to kmalloc(). So instead of GFP_NOIO use GFP_KERNEL and do all the memory allocation in blkfront_setup_indirect() in a memalloc_noio_{save,restore} section. Fixes: 1d5c76e664333 ("xen-blkfront: switch kcalloc to kvcalloc for large array allocation") Cc: stable(a)vger.kernel.org Signed-off-by: Juergen Gross <jgross(a)suse.com> Reviewed-by: Boris Ostrovsky <boris.ostrovsky(a)oracle.com> Acked-by: Roger Pau Monné <roger.pau(a)citrix.com> Link: https://lore.kernel.org/r/20200403090034.8753-1-jgross@suse.com Signed-off-by: Juergen Gross <jgross(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/block/xen-blkfront.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c index 0e451b17f33a..8059ff5ab4a6 100644 --- a/drivers/block/xen-blkfront.c +++ b/drivers/block/xen-blkfront.c @@ -47,6 +47,7 @@ #include <linux/bitmap.h> #include <linux/list.h> #include <linux/workqueue.h> +#include <linux/sched/mm.h> #include <xen/xen.h> #include <xen/xenbus.h> @@ -2251,10 +2252,12 @@ static void blkfront_setup_discard(struct blkfront_info *info) static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) { - unsigned int psegs, grants; + unsigned int psegs, grants, memflags; int err, i; struct blkfront_info *info = rinfo->dev_info; + memflags = memalloc_noio_save(); + if (info->max_indirect_segments == 0) { if (!HAS_EXTRA_REQ) grants = BLKIF_MAX_SEGMENTS_PER_REQUEST; @@ -2286,7 +2289,7 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) BUG_ON(!list_empty(&rinfo->indirect_pages)); for (i = 0; i < num; i++) { - struct page *indirect_page = alloc_page(GFP_NOIO); + struct page *indirect_page = alloc_page(GFP_KERNEL); if (!indirect_page) goto out_of_memory; list_add(&indirect_page->lru, &rinfo->indirect_pages); @@ -2297,15 +2300,15 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) rinfo->shadow[i].grants_used = kvcalloc(grants, sizeof(rinfo->shadow[i].grants_used[0]), - GFP_NOIO); + GFP_KERNEL); rinfo->shadow[i].sg = kvcalloc(psegs, sizeof(rinfo->shadow[i].sg[0]), - GFP_NOIO); + GFP_KERNEL); if (info->max_indirect_segments) rinfo->shadow[i].indirect_grants = kvcalloc(INDIRECT_GREFS(grants), sizeof(rinfo->shadow[i].indirect_grants[0]), - GFP_NOIO); + GFP_KERNEL); if ((rinfo->shadow[i].grants_used == NULL) || (rinfo->shadow[i].sg == NULL) || (info->max_indirect_segments && @@ -2314,6 +2317,7 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) sg_init_table(rinfo->shadow[i].sg, psegs); } + memalloc_noio_restore(memflags); return 0; @@ -2333,6 +2337,9 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) __free_page(indirect_page); } } + + memalloc_noio_restore(memflags); + return -ENOMEM; } -- 2.25.1

1 5

[PATCH openEuler-5.10 01/23] blk-throttle: fix io hung due to configuration updates
by Zheng Zengkai 12 Jul '22

12 Jul '22

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I58VE5 CVE: NA -------------------------------- If new configuration is submitted while a bio is throttled, then new waiting time is recaculated regardless that the bio might aready wait for some time: tg_conf_updated throtl_start_new_slice tg_update_disptime throtl_schedule_next_dispatch Then io hung can be triggered by always submmiting new configuration before the throttled bio is dispatched. Fix the problem by respecting the time that throttled bio aready waited. In order to do that, instead of start new slice in tg_conf_updated(), just update 'bytes_disp' and 'io_disp' based on the new configuration. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/blk-throttle.c | 79 ++++++++++++++++++++++++++++++++++++-------- 1 file changed, 66 insertions(+), 13 deletions(-) diff --git a/block/blk-throttle.c b/block/blk-throttle.c index 95a13da1f343..0427c9c63e81 100644 --- a/block/blk-throttle.c +++ b/block/blk-throttle.c @@ -1421,7 +1421,57 @@ static int tg_print_conf_uint(struct seq_file *sf, void *v) return 0; } -static void tg_conf_updated(struct throtl_grp *tg, bool global) +static u64 throtl_update_bytes_disp(u64 dispatched, u64 new_limit, + u64 old_limit) +{ + if (new_limit == old_limit) + return dispatched; + + if (!dispatched) + return 0; + + /* + * In the case that multiply will overflow, just return 0. It will only + * let bios to be dispatched earlier. + */ + if (div64_u64(U64_MAX, dispatched) < new_limit) + return 0; + + dispatched *= new_limit; + return div64_u64(dispatched, old_limit); +} + +static u32 throtl_update_io_disp(u32 dispatched, u32 new_limit, u32 old_limit) +{ + if (new_limit == old_limit) + return dispatched; + + if (!dispatched) + return 0; + /* + * In the case that multiply will overflow, just return 0. It will only + * let bios to be dispatched earlier. + */ + if (UINT_MAX / dispatched < new_limit) + return 0; + + dispatched *= new_limit; + return dispatched / old_limit; +} + +static void throtl_update_slice(struct throtl_grp *tg, u64 *old_limits) +{ + tg->bytes_disp[READ] = throtl_update_bytes_disp(tg->bytes_disp[READ], + tg_bps_limit(tg, READ), old_limits[0]); + tg->bytes_disp[WRITE] = throtl_update_bytes_disp(tg->bytes_disp[WRITE], + tg_bps_limit(tg, WRITE), old_limits[1]); + tg->io_disp[READ] = throtl_update_io_disp(tg->io_disp[READ], + tg_iops_limit(tg, READ), (u32)old_limits[2]); + tg->io_disp[WRITE] = throtl_update_io_disp(tg->io_disp[WRITE], + tg_iops_limit(tg, WRITE), (u32)old_limits[3]); +} + +static void tg_conf_updated(struct throtl_grp *tg, u64 *old_limits, bool global) { struct throtl_service_queue *sq = &tg->service_queue; struct cgroup_subsys_state *pos_css; @@ -1460,16 +1510,7 @@ static void tg_conf_updated(struct throtl_grp *tg, bool global) parent_tg->latency_target); } - /* - * We're already holding queue_lock and know @tg is valid. Let's - * apply the new config directly. - * - * Restart the slices for both READ and WRITES. It might happen - * that a group's limit are dropped suddenly and we don't want to - * account recently dispatched IO with new low rate. - */ - throtl_start_new_slice(tg, READ); - throtl_start_new_slice(tg, WRITE); + throtl_update_slice(tg, old_limits); if (tg->flags & THROTL_TG_PENDING) { tg_update_disptime(tg); @@ -1502,6 +1543,14 @@ static inline int throtl_restart_syscall_when_busy(int errno) return ret; } +static void tg_get_limits(struct throtl_grp *tg, u64 *limits) +{ + limits[0] = tg_bps_limit(tg, READ); + limits[1] = tg_bps_limit(tg, WRITE); + limits[2] = tg_iops_limit(tg, READ); + limits[3] = tg_iops_limit(tg, WRITE); +} + static ssize_t tg_set_conf(struct kernfs_open_file *of, char *buf, size_t nbytes, loff_t off, bool is_u64) { @@ -1510,6 +1559,7 @@ static ssize_t tg_set_conf(struct kernfs_open_file *of, struct throtl_grp *tg; int ret; u64 v; + u64 old_limits[4]; ret = blkg_conf_prep(blkcg, &blkcg_policy_throtl, buf, &ctx); if (ret) @@ -1526,13 +1576,14 @@ static ssize_t tg_set_conf(struct kernfs_open_file *of, v = U64_MAX; tg = blkg_to_tg(ctx.blkg); + tg_get_limits(tg, old_limits); if (is_u64) *(u64 *)((void *)tg + of_cft(of)->private) = v; else *(unsigned int *)((void *)tg + of_cft(of)->private) = v; - tg_conf_updated(tg, false); + tg_conf_updated(tg, old_limits, false); ret = 0; out_finish: blkg_conf_finish(&ctx); @@ -1703,6 +1754,7 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of, struct blkg_conf_ctx ctx; struct throtl_grp *tg; u64 v[4]; + u64 old_limits[4]; unsigned long idle_time; unsigned long latency_time; int ret; @@ -1721,6 +1773,7 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of, v[1] = tg->bps_conf[WRITE][index]; v[2] = tg->iops_conf[READ][index]; v[3] = tg->iops_conf[WRITE][index]; + tg_get_limits(tg, old_limits); idle_time = tg->idletime_threshold_conf; latency_time = tg->latency_target_conf; @@ -1807,7 +1860,7 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of, tg->td->limit_index = LIMIT_LOW; } else tg->td->limit_index = LIMIT_MAX; - tg_conf_updated(tg, index == LIMIT_LOW && + tg_conf_updated(tg, old_limits, index == LIMIT_LOW && tg->td->limit_valid[LIMIT_LOW]); ret = 0; out_finish: -- 2.20.1

1 22

[PATCH openEuler-1.0-LTS 1/2] tmpfs: fix undefined-behaviour in shmem_reconfigure()
by Yongqiang Liu 12 Jul '22

12 Jul '22

From: Luo Meng <luomeng12(a)huawei.com> mainline inclusion from mainline-v5.19-rc3 commit d14f5efadd846dbde561bd734318de6a9e6b26e6 category: bugfix bugzilla: 186471 https://gitee.com/openeuler/kernel/issues/I5DRKR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- When shmem_reconfigure() calls __percpu_counter_compare(), the second parameter is unsigned long long. But in the definition of __percpu_counter_compare(), the second parameter is s64. So when __percpu_counter_compare() executes abs(count - rhs), UBSAN shows the following warning: Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> ================================================================================ UBSAN: Undefined behaviour in lib/percpu_counter.c:209:6 signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long long int' CPU: 1 PID: 9636 Comm: syz-executor.2 Tainted: G ---------r- - 4.18.0 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack home/install/linux-rh-3-10/lib/dump_stack.c:77 [inline] dump_stack+0x125/0x1ae home/install/linux-rh-3-10/lib/dump_stack.c:117 ubsan_epilogue+0xe/0x81 home/install/linux-rh-3-10/lib/ubsan.c:159 handle_overflow+0x19d/0x1ec home/install/linux-rh-3-10/lib/ubsan.c:190 __percpu_counter_compare+0x124/0x140 home/install/linux-rh-3-10/lib/percpu_counter.c:209 percpu_counter_compare home/install/linux-rh-3-10/./include/linux/percpu_counter.h:50 [inline] shmem_remount_fs+0x1ce/0x6b0 home/install/linux-rh-3-10/mm/shmem.c:3530 do_remount_sb+0x11b/0x530 home/install/linux-rh-3-10/fs/super.c:888 do_remount home/install/linux-rh-3-10/fs/namespace.c:2344 [inline] do_mount+0xf8d/0x26b0 home/install/linux-rh-3-10/fs/namespace.c:2844 ksys_mount+0xad/0x120 home/install/linux-rh-3-10/fs/namespace.c:3075 __do_sys_mount home/install/linux-rh-3-10/fs/namespace.c:3089 [inline] __se_sys_mount home/install/linux-rh-3-10/fs/namespace.c:3086 [inline] __x64_sys_mount+0xbf/0x160 home/install/linux-rh-3-10/fs/namespace.c:3086 do_syscall_64+0xca/0x5c0 home/install/linux-rh-3-10/arch/x86/entry/common.c:298 entry_SYSCALL_64_after_hwframe+0x6a/0xdf RIP: 0033:0x46b5e9 Code: 5d db fa ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b db fa ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f54d5f22c68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 000000000077bf60 RCX: 000000000046b5e9 RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000000 RBP: 000000000077bf60 R08: 0000000020000140 R09: 0000000000000000 R10: 00000000026740a4 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd1fb1592f R14: 00007f54d5f239c0 R15: 000000000077bf6c ================================================================================ [akpm(a)linux-foundation.org: tweak error message text] Link: https://lkml.kernel.org/r/20220513025225.2678727-1-luomeng12@huawei.com Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/shmem.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/shmem.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mm/shmem.c b/mm/shmem.c index 8915a5b9ad0a..be91fb743426 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -3605,6 +3605,10 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data) spin_lock(&sbinfo->stat_lock); inodes = sbinfo->max_inodes - sbinfo->free_inodes; + if (config.max_blocks > S64_MAX) { + pr_err("Number of blocks too large"); + goto out; + } if (percpu_counter_compare(&sbinfo->used_blocks, config.max_blocks) > 0) goto out; if (config.max_inodes < inodes) -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] mm/sharepool: Check sp_is_enabled() before show spa_stat
by Yongqiang Liu 12 Jul '22

12 Jul '22

From: Wang Wensheng <wangwensheng4(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5GO4E CVE: NA -------------------------------- When we read file /proc/sharepool/spa_stat, we use sp_mapping_normal to iterator all the normal sp_area. The global pointer sp_mapping_normal is NULL if the sharepool feature is not enabled via kernel bootarg. This leads to a null-pointer-dereference issue. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/share_pool.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/mm/share_pool.c b/mm/share_pool.c index 893e5352bf01..661036a7df64 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -4365,6 +4365,9 @@ void spg_overview_show(struct seq_file *seq) static int spa_stat_show(struct seq_file *seq, void *offset) { + if (!sp_is_enabled()) + return 0; + spg_overview_show(seq); spa_overview_show(seq); /* print the file header */ @@ -4425,6 +4428,9 @@ static int idr_proc_stat_cb(int id, void *p, void *data) static int proc_stat_show(struct seq_file *seq, void *offset) { + if (!sp_is_enabled()) + return 0; + spg_overview_show(seq); spa_overview_show(seq); /* print the file header */ @@ -4474,6 +4480,9 @@ static int idr_proc_overview_cb(int id, void *p, void *data) static int proc_overview_show(struct seq_file *seq, void *offset) { + if (!sp_is_enabled()) + return 0; + seq_printf(seq, "%-8s %-16s %-9s %-9s %-9s %-10s %-10s %-8s\n", "PID", "COMM", "SP_ALLOC", "SP_K2U", "SP_RES", "Non-SP_RES", "Non-SP_Shm", "VIRT"); -- 2.25.1

1 0

[PATCH v1 OLK-5.10 51/71] sw64: iommu: fix iommu interrupt handler
by Gu Zitao 12 Jul '22

12 Jul '22

From: Zheng Chongzhen <zhengchongzhen(a)wxiat.com> Sunway inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I56OSP -------------------------------- When porting ZX200 chipset driver on SW64 platform, we meet an IOMMU exception show as follows: iommu_interrupt, iommu_status = 0xc8014000dffe0000, devid 0xa00, dva 0xdffe0000, 1Unable to handle kernel paging request at virtual address 0000000000000040 CPU 0 swapper/0(0): Oops 0 pc = [<ffffffff81424b80>] ra = [<ffffffff81424b24>] ps = 0001 Not tainted pc is at iommu_interrupt+0x140/0x3e0 ra is at iommu_interrupt+0xe4/0x3e0 v0 = 0000000000000051 t0 = c8014000dffe0000 t1 = 0000000000000000 t2 = 0000000000000000 t3 = 0000000000000000 t4 = 0000000000000001 t5 = 0000000000000001 t6 = 0000000000000000 t7 = ffffffff82948000 s0 = fff00003ffff0400 s1 = 0000000000000001 s2 = 0000000000000a00 s3 = 0000000000000a00 s4 = 00000000dffe0000 s5 = fff0000100680e80 s6 = ffffffff8294ba70 a0 = 0000000000000001 a1 = 0000000000000001 a2 = ffffffff8294b790 a3 = ffffffff8294b7a8 a4 = 0000000000000000 a5 = ffffffff82c5fb7a t8 = 0000000000000001 t9 = fffffffffffcac48 t10 = 0000000000000000 t11= 0000000000000000 pv = ffffffff809f4f10 at = ffffffff82bff6c0 gp = ffffffff82c1f510 sp = (____ptrval____) The root cause is that the device which raises iommu exception is not in the device list, then reference a null sdev will cause a page fualt. To work around this problem, we apply this patch by just clearing IOMMUEXCPT_STATUS and then go on. BTW, why the device raise IOMMU exception is not a valid device ID, it's a puzzling problem. Signed-off-by: Zheng Chongzhen <zhengchongzhen(a)wxiat.com> Signed-off-by: Gu Zitao <guzitao(a)wxiat.com> --- drivers/iommu/sw64/sunway_iommu.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/sw64/sunway_iommu.c b/drivers/iommu/sw64/sunway_iommu.c index 5797adf8fbc5..b6c8f1272d28 100644 --- a/drivers/iommu/sw64/sunway_iommu.c +++ b/drivers/iommu/sw64/sunway_iommu.c @@ -648,10 +648,21 @@ irqreturn_t iommu_interrupt(int irq, void *dev) type = (iommu_status >> 59) & 0x7; devid = (iommu_status >> 37) & 0xffff; dva = iommu_status & 0xffffffff; - sdev = search_dev_data(devid); - sdomain = sdev->domain; pr_info("%s, iommu_status = %#lx, devid %#lx, dva %#lx, ", __func__, iommu_status, devid, dva); + + sdev = search_dev_data(devid); + if (sdev == NULL) { + pr_info("no such dev!!!\n"); + + iommu_status &= ~(1UL << 62); + write_piu_ior0(hose->node, hose->index, + IOMMUEXCPT_STATUS, iommu_status); + + return IRQ_HANDLED; + } + + sdomain = sdev->domain; switch (type) { case DTE_LEVEL1: pr_info("invalid level1 dte, addr:%#lx, val:%#lx\n", @@ -674,7 +685,6 @@ irqreturn_t iommu_interrupt(int irq, void *dev) fetch_pte(sdomain, dva, PTE_LEVEL2_VAL)); iommu_status &= ~(1UL << 62); - iommu_status = iommu_status | (1UL << 63); write_piu_ior0(hose->node, hose->index, IOMMUEXCPT_STATUS, iommu_status); break; -- 2.17.1

1 20

[PATCH v1 OLK-5.10 00/71] sw64 update
by Gu Zitao 12 Jul '22

12 Jul '22

Gu Zitao (2): sw64: add ARCH_TRACEHOOK and regset support sw64: rename CONFIG_HAVE_GENERIC_GUP to CONFIG_HAVE_FAST_GUP Hang Xiaoqian (2): sw64: change the value of physical_id in /proc/cpuinfo sw64: remove unaligned count He Chuyue (6): sw64: simplify __phys_addr and __virt_addr_valid sw64: check integrity for dtb passed by BIOS sw64: fix some structs related to pt_regs sw64: perf: add exclude_user and exclude_kernel support sw64: perf: fix the number of supported raw events sw64: perf: fix raw event count He Sheng (36): sw64: remove unused header files sw64: uapi: generate some uapi headers from generic ones sw64: uapi: include generic param.h sw64: kapi: remove unused header-y from Kbuild sw64: kapi: generate some kapi headers from generic ones sw64: move ucontext.h to uapi sw64: kapi: remove redudant SMP_CACHE_BYTES sw64: kapi: remove unimplemented IPLs sw64: kapi: include generic modules.h sw64: remove VGA_HOSE things sw64: clean up unused pci iounmap operation sw64: kapi: use generic vga.h sw64: remove unused IO_CONCAT sw64: do not include sw64io.h in io.h sw64: read host IO registers with rdio64 hmcall sw64: map logical address with __va() sw64: access IO space with readX/writeX sw64: add fpu state save/restore interfaces sw64: switch to generic fork like system calls sw64: remove r9_r15 argument of dik_show_regs and die_if_kernel sw64: remove switch_stack from entMM and entSys sw64: remove switch_stack from signal handling sw64: dump callee-saved registers from pt_regs sw64: get blocked thread's frame pointer from thread_struct sw64: remove switch_stack and allregs from entUna sw64: remove switch_stack from __sw64_vcpu_run sw64: remove other struct switch_stack things sw64: access pt_regs with regoffsets where appropriate sw64: move struct pt_regs to kapi ptrace.h sw64: avoid copying thread_struct twice sw64: simplify pgtable helpers sw64: remove discontiguous memory support sw64: merge user_fpsimd_state into thread_struct sw64: fix ptrace.h with types.h and NOT __ASSEMBLY__ sw64: rewrite elf core copy interfaces sw64: rename debugfs dir sw_64 to sw64 Lu Feifei (2): sw64: add memhotplug support for guest os sw64: add a misc device to chip_vt.dts for memory-hotplug Mao Minkai (2): sw64: fix __csum_and_copy when dest is not 8-byte aligned sw64: fix simd version of memset Min Fanlei (1): sw64: kvm: fix incorrect page_ref_count() call Wang Yuanheng (1): sw64: kvm: enable binding_vcpu debug dynamically Wu Liliu (4): sw64: perf: add fp based stack trace support sw64: reimplement show_stack() method sw64: reimplement get_wchan() sw64: reimplement save_stack_trace() Xiong Aifei (2): sw64: gpu: correct low-level mmio memset/memcpy direct calls sw64: gpu: replace '_memset_c_io' by 'memset_io' Xu Chenjiao (2): sw64: fix compile errors for NOT chip3 sw64: pcie: fix lack of PME and AER interrupt service routines Yang Qiang (2): sw64: dtb: check address validity with physical address sw64: pci: fix maximum bus number for pci scan Zhao Yihan (1): sw64: map address by OR operation in __va() Zheng Chongzhen (2): sw64: fix dma features for zx200 sw64: iommu: fix iommu interrupt handler Zhou Qihang (1): sw64: iommu: work around iova mapping on pci bars Zhou Xuemei (1): sw64: fix floating point register corruption Zhu Donghong (4): irqchip: add sw64 chip3 builtin LPC interrupt controller driver sw64: add builtin LPC interrupt controller to chip3.dts drivers/irqchip: add sw64 interrupt controller support sw64: deliver a hot reset to Root Complex with plugin JMicron 585 card arch/sw_64/Kconfig | 28 +- arch/sw_64/boot/dts/chip3.dts | 16 +- arch/sw_64/boot/dts/chip_vt.dts | 12 + arch/sw_64/chip/chip3/Makefile | 1 - arch/sw_64/chip/chip3/chip.c | 66 ++- arch/sw_64/chip/chip3/i2c-lib.c | 41 +- arch/sw_64/include/asm/Kbuild | 26 +- arch/sw_64/include/asm/agp.h | 19 - arch/sw_64/include/asm/asm-prototypes.h | 1 - arch/sw_64/include/asm/cache.h | 4 +- arch/sw_64/include/asm/compiler.h | 7 - arch/sw_64/include/asm/console.h | 11 - arch/sw_64/include/asm/div64.h | 7 - arch/sw_64/include/asm/elf.h | 40 +- arch/sw_64/include/asm/emergency-restart.h | 7 - arch/sw_64/include/asm/exec.h | 7 - arch/sw_64/include/asm/extable.h | 4 + arch/sw_64/include/asm/floppy.h | 116 ----- arch/sw_64/include/asm/hcall.h | 1 + arch/sw_64/include/asm/io.h | 33 -- arch/sw_64/include/asm/irq_impl.h | 3 + arch/sw_64/include/asm/irq_regs.h | 7 - arch/sw_64/include/asm/irqflags.h | 8 - arch/sw_64/include/asm/kmap_types.h | 15 - arch/sw_64/include/asm/kvm_asm.h | 3 + arch/sw_64/include/asm/kvm_host.h | 11 +- arch/sw_64/include/asm/local.h | 125 ----- arch/sw_64/include/asm/local64.h | 7 - arch/sw_64/include/asm/memory.h | 1 + arch/sw_64/include/asm/mmu_context.h | 8 +- arch/sw_64/include/asm/mmzone.h | 30 -- arch/sw_64/include/asm/module.h | 10 +- arch/sw_64/include/asm/page.h | 5 +- arch/sw_64/include/asm/param.h | 11 - arch/sw_64/include/asm/parport.h | 19 - arch/sw_64/include/asm/pci.h | 4 +- arch/sw_64/include/asm/pgalloc.h | 2 +- arch/sw_64/include/asm/pgtable.h | 98 ++-- arch/sw_64/include/asm/preempt.h | 7 - arch/sw_64/include/asm/processor.h | 49 +- arch/sw_64/include/asm/ptrace.h | 54 +- arch/sw_64/include/asm/seccomp.h | 15 - arch/sw_64/include/asm/sections.h | 8 - arch/sw_64/include/asm/segment.h | 7 - arch/sw_64/include/asm/serial.h | 16 - arch/sw_64/include/asm/shmparam.h | 7 - arch/sw_64/include/asm/special_insns.h | 20 - arch/sw_64/include/asm/stacktrace.h | 72 +++ arch/sw_64/include/asm/sw64_init.h | 1 + arch/sw_64/include/asm/sw64io.h | 89 ++-- arch/sw_64/include/asm/switch_to.h | 37 +- arch/sw_64/include/asm/thread_info.h | 5 + arch/sw_64/include/asm/trace_clock.h | 10 - arch/sw_64/include/asm/types.h | 7 - arch/sw_64/include/asm/unaligned.h | 12 - arch/sw_64/include/asm/vga.h | 85 ---- arch/sw_64/include/asm/wrperfmon.h | 8 +- arch/sw_64/include/uapi/asm/Kbuild | 1 + arch/sw_64/include/uapi/asm/console.h | 51 -- arch/sw_64/include/uapi/asm/ipcbuf.h | 7 - arch/sw_64/include/uapi/asm/kvm_para.h | 7 - arch/sw_64/include/uapi/asm/msgbuf.h | 28 -- arch/sw_64/include/uapi/asm/param.h | 9 +- arch/sw_64/include/uapi/asm/perf_regs.h | 7 + arch/sw_64/include/uapi/asm/poll.h | 7 - arch/sw_64/include/uapi/asm/posix_types.h | 18 - arch/sw_64/include/uapi/asm/ptrace.h | 76 +-- arch/sw_64/include/uapi/asm/sembuf.h | 23 - arch/sw_64/include/uapi/asm/shmbuf.h | 39 -- arch/sw_64/include/uapi/asm/statfs.h | 9 - arch/sw_64/include/uapi/asm/types.h | 28 -- arch/sw_64/include/{ => uapi}/asm/ucontext.h | 8 +- arch/sw_64/kernel/Makefile | 7 +- arch/sw_64/kernel/asm-offsets.c | 136 ++--- arch/sw_64/kernel/bindvcpu.c | 29 ++ arch/sw_64/kernel/core.c | 35 -- arch/sw_64/kernel/dup_print.c | 10 +- arch/sw_64/kernel/entry.S | 467 +++++------------- arch/sw_64/kernel/fpu.S | 102 ++++ arch/sw_64/kernel/kgdb.c | 14 +- arch/sw_64/kernel/pci.c | 55 ++- arch/sw_64/kernel/pci_impl.h | 2 + arch/sw_64/kernel/perf_event.c | 100 +++- arch/sw_64/kernel/process.c | 156 ++---- arch/sw_64/kernel/proto.h | 5 +- arch/sw_64/kernel/ptrace.c | 245 ++++----- arch/sw_64/kernel/setup.c | 19 +- arch/sw_64/kernel/signal.c | 51 +- arch/sw_64/kernel/stacktrace.c | 212 +++++++- arch/sw_64/kernel/syscalls/syscall.tbl | 6 +- arch/sw_64/kernel/traps.c | 182 ++----- arch/sw_64/kernel/unaligned.c | 56 --- arch/sw_64/kvm/Kconfig | 7 + arch/sw_64/kvm/entry.S | 97 ++-- arch/sw_64/kvm/handle_exit.c | 5 + arch/sw_64/kvm/kvm-sw64.c | 137 ++++- arch/sw_64/lib/csum_partial_copy.c | 15 +- arch/sw_64/lib/deep-memset.S | 5 +- arch/sw_64/lib/iomap.c | 40 +- arch/sw_64/mm/fault.c | 20 +- arch/sw_64/mm/init.c | 25 +- arch/sw_64/mm/physaddr.c | 30 +- arch/sw_64/platform/platform_xuelang.c | 18 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 12 + drivers/gpu/drm/radeon/radeon_vce.c | 2 +- drivers/gpu/drm/radeon/vce_v1_0.c | 5 + drivers/iommu/sw64/sunway_iommu.c | 21 +- drivers/irqchip/Kconfig | 26 +- drivers/irqchip/Makefile | 3 +- drivers/irqchip/irq-intc-v1.c | 104 ---- .../irqchip/irq-sw64-intc-v2.c | 64 ++- drivers/irqchip/irq-sw64-lpc-intc.c | 137 +++++ drivers/mfd/lpc_sunway_chip3.c | 130 ----- drivers/misc/Kconfig | 8 + drivers/misc/Makefile | 1 + drivers/misc/sunway-ged.c | 253 ++++++++++ 116 files changed, 2009 insertions(+), 2686 deletions(-) delete mode 100644 arch/sw_64/include/asm/agp.h delete mode 100644 arch/sw_64/include/asm/compiler.h delete mode 100644 arch/sw_64/include/asm/console.h delete mode 100644 arch/sw_64/include/asm/div64.h delete mode 100644 arch/sw_64/include/asm/emergency-restart.h delete mode 100644 arch/sw_64/include/asm/exec.h delete mode 100644 arch/sw_64/include/asm/floppy.h delete mode 100644 arch/sw_64/include/asm/irq_regs.h delete mode 100644 arch/sw_64/include/asm/kmap_types.h delete mode 100644 arch/sw_64/include/asm/local.h delete mode 100644 arch/sw_64/include/asm/local64.h delete mode 100644 arch/sw_64/include/asm/param.h delete mode 100644 arch/sw_64/include/asm/parport.h delete mode 100644 arch/sw_64/include/asm/preempt.h delete mode 100644 arch/sw_64/include/asm/seccomp.h delete mode 100644 arch/sw_64/include/asm/sections.h delete mode 100644 arch/sw_64/include/asm/segment.h delete mode 100644 arch/sw_64/include/asm/serial.h delete mode 100644 arch/sw_64/include/asm/shmparam.h delete mode 100644 arch/sw_64/include/asm/special_insns.h create mode 100644 arch/sw_64/include/asm/stacktrace.h delete mode 100644 arch/sw_64/include/asm/trace_clock.h delete mode 100644 arch/sw_64/include/asm/types.h delete mode 100644 arch/sw_64/include/asm/unaligned.h delete mode 100644 arch/sw_64/include/asm/vga.h delete mode 100644 arch/sw_64/include/uapi/asm/console.h delete mode 100644 arch/sw_64/include/uapi/asm/ipcbuf.h delete mode 100644 arch/sw_64/include/uapi/asm/kvm_para.h delete mode 100644 arch/sw_64/include/uapi/asm/msgbuf.h delete mode 100644 arch/sw_64/include/uapi/asm/poll.h delete mode 100644 arch/sw_64/include/uapi/asm/posix_types.h delete mode 100644 arch/sw_64/include/uapi/asm/sembuf.h delete mode 100644 arch/sw_64/include/uapi/asm/shmbuf.h delete mode 100644 arch/sw_64/include/uapi/asm/statfs.h delete mode 100644 arch/sw_64/include/uapi/asm/types.h rename arch/sw_64/include/{ => uapi}/asm/ucontext.h (56%) create mode 100644 arch/sw_64/kernel/bindvcpu.c delete mode 100644 arch/sw_64/kernel/core.c create mode 100644 arch/sw_64/kernel/fpu.S delete mode 100644 arch/sw_64/kernel/unaligned.c delete mode 100644 drivers/irqchip/irq-intc-v1.c rename arch/sw_64/chip/chip3/irq_chip.c => drivers/irqchip/irq-sw64-intc-v2.c (59%) create mode 100644 drivers/irqchip/irq-sw64-lpc-intc.c create mode 100644 drivers/misc/sunway-ged.c -- 2.17.1

1 50

[PATCH openEuler-5.10-LTS 1/7] arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones
by Zheng Zengkai 11 Jul '22

11 Jul '22

From: Vijay Balakrishna <vijayb(a)linux.microsoft.com> stable inclusion from stable-v5.10.110 commit a25864c5bc20966cdc5ba5eb65b74b9b1e9ec8d2 bugzilla: https://gitee.com/openeuler/kernel/issues/I574AL Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 031495635b4668f94e964e037ca93d0d38bfde58 upstream. The following patches resulted in deferring crash kernel reservation to mem_init(), mainly aimed at platforms with DMA memory zones (no IOMMU), in particular Raspberry Pi 4. commit 1a8e1cef7603 ("arm64: use both ZONE_DMA and ZONE_DMA32") commit 8424ecdde7df ("arm64: mm: Set ZONE_DMA size based on devicetree's dma-ranges") commit 0a30c53573b0 ("arm64: mm: Move reserve_crashkernel() into mem_init()") commit 2687275a5843 ("arm64: Force NO_BLOCK_MAPPINGS if crashkernel reservation is required") Above changes introduced boot slowdown due to linear map creation for all the memory banks with NO_BLOCK_MAPPINGS, see discussion[1]. The proposed changes restore crash kernel reservation to earlier behavior thus avoids slow boot, particularly for platforms with IOMMU (no DMA memory zones). Tested changes to confirm no ~150ms boot slowdown on our SoC with IOMMU and 8GB memory. Also tested with ZONE_DMA and/or ZONE_DMA32 configs to confirm no regression to deferring scheme of crash kernel memory reservation. In both cases successfully collected kernel crash dump. [1] https://lore.kernel.org/all/9436d033-579b-55fa-9b00-6f4b661c2dd7@linux.micr… Signed-off-by: Vijay Balakrishna <vijayb(a)linux.microsoft.com> Cc: stable(a)vger.kernel.org Reviewed-by: Pasha Tatashin <pasha.tatashin(a)soleen.com> Link: https://lore.kernel.org/r/1646242689-20744-1-git-send-email-vijayb@linux.mi… [will: Add #ifdef CONFIG_KEXEC_CORE guards to fix 'crashk_res' references in allnoconfig build] Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> Conflicts: arch/arm64/mm/mmu.c Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- arch/arm64/mm/init.c | 36 ++++++++++++++++++++++++++++++++---- arch/arm64/mm/mmu.c | 26 ++++++++++++++++---------- 2 files changed, 48 insertions(+), 14 deletions(-) diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c index f5bd046f9e19..5023c7e1f754 100644 --- a/arch/arm64/mm/init.c +++ b/arch/arm64/mm/init.c @@ -63,8 +63,34 @@ EXPORT_SYMBOL(memstart_addr); * unless restricted on specific platforms (e.g. 30-bit on Raspberry Pi 4). * In such case, ZONE_DMA32 covers the rest of the 32-bit addressable memory, * otherwise it is empty. + * + * Memory reservation for crash kernel either done early or deferred + * depending on DMA memory zones configs (ZONE_DMA) -- + * + * In absence of ZONE_DMA configs arm64_dma_phys_limit initialized + * here instead of max_zone_phys(). This lets early reservation of + * crash kernel memory which has a dependency on arm64_dma_phys_limit. + * Reserving memory early for crash kernel allows linear creation of block + * mappings (greater than page-granularity) for all the memory bank rangs. + * In this scheme a comparatively quicker boot is observed. + * + * If ZONE_DMA configs are defined, crash kernel memory reservation + * is delayed until DMA zone memory range size initilazation performed in + * zone_sizes_init(). The defer is necessary to steer clear of DMA zone + * memory range to avoid overlap allocation. So crash kernel memory boundaries + * are not known when mapping all bank memory ranges, which otherwise means + * not possible to exclude crash kernel range from creating block mappings + * so page-granularity mappings are created for the entire memory range. + * Hence a slightly slower boot is observed. + * + * Note: Page-granularity mapppings are necessary for crash kernel memory + * range for shrinking its size via /sys/kernel/kexec_crash_size interface. */ -phys_addr_t arm64_dma_phys_limit __ro_after_init; +#if IS_ENABLED(CONFIG_ZONE_DMA) || IS_ENABLED(CONFIG_ZONE_DMA32) +phys_addr_t __ro_after_init arm64_dma_phys_limit; +#else +phys_addr_t __ro_after_init arm64_dma_phys_limit = PHYS_MASK + 1; +#endif #ifndef CONFIG_KEXEC_CORE static void __init reserve_crashkernel(void) @@ -173,8 +199,6 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max) if (!arm64_dma_phys_limit) arm64_dma_phys_limit = dma32_phys_limit; #endif - if (!arm64_dma_phys_limit) - arm64_dma_phys_limit = PHYS_MASK + 1; max_zone_pfns[ZONE_NORMAL] = max; free_area_init(max_zone_pfns); @@ -498,6 +522,9 @@ void __init arm64_memblock_init(void) reserve_elfcorehdr(); + if (!IS_ENABLED(CONFIG_ZONE_DMA) && !IS_ENABLED(CONFIG_ZONE_DMA32)) + reserve_crashkernel(); + high_memory = __va(memblock_end_of_DRAM() - 1) + 1; } @@ -553,7 +580,8 @@ void __init bootmem_init(void) * request_standard_resources() depends on crashkernel's memory being * reserved, so do it here. */ - reserve_crashkernel(); + if (IS_ENABLED(CONFIG_ZONE_DMA) || IS_ENABLED(CONFIG_ZONE_DMA32)) + reserve_crashkernel(); reserve_quick_kexec(); diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index 00e89be15ad2..e76765354040 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -562,16 +562,6 @@ static void __init map_mem(pgd_t *pgdp) PAGE_KERNEL, NO_CONT_MAPPINGS); memblock_clear_nomap(kernel_start, kernel_end - kernel_start); -#ifdef CONFIG_KEXEC_CORE - if (crashk_res.end) { - __map_memblock(pgdp, crashk_res.start, - crashk_res.end + 1, - PAGE_KERNEL, - NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS); - memblock_clear_nomap(crashk_res.start, - resource_size(&crashk_res)); - } -#endif #ifdef CONFIG_KFENCE /* * Map the __kfence_pool at page granularity now. @@ -584,6 +574,22 @@ static void __init map_mem(pgd_t *pgdp) memblock_clear_nomap(__pa(__kfence_pool), KFENCE_POOL_SIZE); } #endif + + /* + * Use page-level mappings here so that we can shrink the region + * in page granularity and put back unused memory to buddy system + * through /sys/kernel/kexec_crash_size interface. + */ +#ifdef CONFIG_KEXEC_CORE + if (crashk_res.end) { + __map_memblock(pgdp, crashk_res.start, + crashk_res.end + 1, + PAGE_KERNEL, + NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS); + memblock_clear_nomap(crashk_res.start, + resource_size(&crashk_res)); + } +#endif } void mark_rodata_ro(void) -- 2.20.1

1 6

[PATCH 01/34] ARM: 9196/1: spectre-bhb: enable for Cortex-A15
by Laibin Qiu 08 Jul '22

08 Jul '22

From: Ard Biesheuvel <ardb(a)kernel.org> stable inclusion from stable-4.19.245 commit 0569702c238290924fc1c7c6954258aa4a5fd649 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5FNPY CVE: NA -------------------------------- [ Upstream commit 0dc14aa94ccd8ba35eb17a0f9b123d1566efd39e ] The Spectre-BHB mitigations were inadvertently left disabled for Cortex-A15, due to the fact that cpu_v7_bugs_init() is not called in that case. So fix that. Fixes: b9baf5c8c5c3 ("ARM: Spectre-BHB workaround") Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- arch/arm/mm/proc-v7-bugs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c index 87a93b76e148..8c7d00cb63ef 100644 --- a/arch/arm/mm/proc-v7-bugs.c +++ b/arch/arm/mm/proc-v7-bugs.c @@ -299,6 +299,7 @@ void cpu_v7_ca15_ibe(void) { if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(0))) cpu_v7_spectre_v2_init(); + cpu_v7_spectre_bhb_init(); } void cpu_v7_bugs_init(void) -- 2.25.1

1 33

[PATCH openEuler-1.0-LTS 1/4] block: rename bd_invalidated
by Laibin Qiu 08 Jul '22

08 Jul '22

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v5.10-rc1 commit f4ad06f2bb8476548b08f89919ee65abc4e40212 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5ETAB CVE: NA ------------------------------------------------- Replace bd_invalidate with a new BDEV_NEED_PART_SCAN flag in a bd_flags variable to better describe the condition. Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: fs/block_dev.c include/linux/blk_types.h Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- block/genhd.c | 2 +- block/partition-generic.c | 6 +++--- drivers/block/nbd.c | 8 ++++---- fs/block_dev.c | 12 ++++++------ include/linux/fs.h | 4 +++- 5 files changed, 17 insertions(+), 15 deletions(-) diff --git a/block/genhd.c b/block/genhd.c index fc24384e2c85..afa3cf525f43 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -646,7 +646,7 @@ static void register_disk(struct device *parent, struct gendisk *disk) if (!bdev) goto exit; - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); err = blkdev_get(bdev, FMODE_READ, NULL); if (err < 0) goto exit; diff --git a/block/partition-generic.c b/block/partition-generic.c index 2261566741f4..ae3761fed854 100644 --- a/block/partition-generic.c +++ b/block/partition-generic.c @@ -546,7 +546,7 @@ int rescan_partitions(struct gendisk *disk, struct block_device *bdev) if (disk->fops->revalidate_disk) disk->fops->revalidate_disk(disk); check_disk_size_change(disk, bdev, true); - bdev->bd_invalidated = 0; + clear_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); if (!get_capacity(disk) || !(state = check_partition(disk, bdev))) return 0; if (IS_ERR(state)) { @@ -662,7 +662,7 @@ int invalidate_partitions(struct gendisk *disk, struct block_device *bdev) { int res; - if (!bdev->bd_invalidated) + if (!test_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags)) return 0; res = drop_partitions(disk, bdev); @@ -671,7 +671,7 @@ int invalidate_partitions(struct gendisk *disk, struct block_device *bdev) set_capacity(disk, 0); check_disk_size_change(disk, bdev, false); - bdev->bd_invalidated = 0; + clear_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); /* tell userspace that the media / partition table may have changed */ kobject_uevent(&disk_to_dev(disk)->kobj, KOBJ_CHANGE); diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index c2e5ba599418..f1986d8bb47c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -317,7 +317,7 @@ static void nbd_size_update(struct nbd_device *nbd, bool start) if (start) set_blocksize(bdev, config->blksize); } else - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); bdput(bdev); } kobject_uevent(&nbd_to_dev(nbd)->kobj, KOBJ_CHANGE); @@ -1343,7 +1343,7 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b return ret; if (max_part) - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); mutex_unlock(&nbd->config_lock); ret = wait_event_interruptible(config->recv_wq, atomic_read(&config->recv_threads) == 0); @@ -1518,9 +1518,9 @@ static int nbd_open(struct block_device *bdev, fmode_t mode) refcount_set(&nbd->config_refs, 1); refcount_inc(&nbd->refs); mutex_unlock(&nbd->config_lock); - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); } else if (nbd_disconnected(nbd->config)) { - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); } out: mutex_unlock(&nbd_index_mutex); diff --git a/fs/block_dev.c b/fs/block_dev.c index 9868b21b8ef9..f521b7cf907f 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -922,7 +922,7 @@ struct block_device *bdget(dev_t dev) bdev->bd_inode = inode; bdev->bd_block_size = i_blocksize(inode); bdev->bd_part_count = 0; - bdev->bd_invalidated = 0; + bdev->bd_flags = 0; inode->i_mode = S_IFBLK; inode->i_rdev = dev; inode->i_bdev = bdev; @@ -1404,7 +1404,7 @@ static void flush_disk(struct block_device *bdev, bool kill_dirty) "resized disk %s\n", bdev->bd_disk ? bdev->bd_disk->disk_name : ""); } - bdev->bd_invalidated = 1; + set_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); } /** @@ -1457,7 +1457,7 @@ int revalidate_disk(struct gendisk *disk) mutex_lock(&bdev->bd_mutex); check_disk_size_change(disk, bdev, ret == 0); - bdev->bd_invalidated = 0; + clear_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); mutex_unlock(&bdev->bd_mutex); bdput(bdev); return ret; @@ -1520,7 +1520,7 @@ static void bdev_disk_changed(struct block_device *bdev, bool invalidate) up_read(&disk->lookup_sem); } else { check_disk_size_change(bdev->bd_disk, bdev, !invalidate); - bdev->bd_invalidated = 0; + clear_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags); } } @@ -1605,7 +1605,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) * The latter is necessary to prevent ghost * partitions on a removed medium. */ - if (bdev->bd_invalidated && + if (test_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags) && (!ret || ret == -ENOMEDIUM)) bdev_disk_changed(bdev, ret == -ENOMEDIUM); @@ -1642,7 +1642,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) if (bdev->bd_disk->fops->open) ret = bdev->bd_disk->fops->open(bdev, mode); /* the same as first opener case, read comment there */ - if (bdev->bd_invalidated && + if (test_bit(BDEV_NEED_PART_SCAN, &bdev->bd_flags) && (!ret || ret == -ENOMEDIUM)) bdev_disk_changed(bdev, ret == -ENOMEDIUM); if (ret) diff --git a/include/linux/fs.h b/include/linux/fs.h index bcd2131ca06c..480936c2d938 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -459,6 +459,8 @@ struct address_space { */ struct request_queue; +#define BDEV_NEED_PART_SCAN 0 + struct block_device { dev_t bd_dev; /* not a kdev_t - it's a search key */ int bd_openers; @@ -479,7 +481,7 @@ struct block_device { struct hd_struct * bd_part; /* number of times partitions within this device have been opened. */ unsigned bd_part_count; - int bd_invalidated; + unsigned long bd_flags; struct gendisk * bd_disk; struct request_queue * bd_queue; struct backing_dev_info *bd_bdi; -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS 1/3] scsi: hisi_sas: Change DMA setup lock timeout to 2.5s
by Laibin Qiu 07 Jul '22

07 Jul '22

From: Xingui Yang <yangxingui(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5BXH1 CVE: NA ------------------------------------------------------------------- DMA setup lock timeout protection is added when DMA setup frames are received, it's a function outside the protocol and used to prevent SATA disk I/Os from being delivered for a long time. The default value is 100ms , it's too strict and easily triggered timeout when the disk is overloaded or faulty. Based on the average I/O latency of 300 disks, we adjust the value to 2.5s. Signed-off-by: Xingui Yang <yangxingui(a)huawei.com> Reviewed-by: kang fenglong <kangfenglong(a)huawei.com> Acked-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c index baae04adc8e4..91f02357d5b4 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c @@ -35,6 +35,7 @@ #define SATA_INITI_D2H_STORE_ADDR_HI 0x64 #define CFG_MAX_TAG 0x68 #define SAS_DMAC_OUTSTAND 0x6c +#define TRANS_LOCK_ICT_TIME 0X70 #define HGC_SAS_TX_OPEN_FAIL_RETRY_CTRL 0x84 #define HGC_SAS_TXFAIL_RETRY_CTRL 0x88 #define HGC_GET_ITV_TIME 0x90 @@ -596,6 +597,8 @@ static void init_reg_v3_hw(struct hisi_hba *hisi_hba) (u32)((1ULL << hisi_hba->queue_count) - 1)); hisi_sas_write32(hisi_hba, SAS_AXI_USER3, 0); hisi_sas_write32(hisi_hba, CFG_MAX_TAG, 0xfff0400); + /* time / CLK_AHB = 2.5s / 2ns = 0x4A817C80 */ + hisi_sas_write32(hisi_hba, TRANS_LOCK_ICT_TIME, 0x4A817C80); hisi_sas_write32(hisi_hba, HGC_SAS_TXFAIL_RETRY_CTRL, 0x108); hisi_sas_write32(hisi_hba, CFG_AGING_TIME, 0x1); hisi_sas_write32(hisi_hba, INT_COAL_EN, 0x1); @@ -3061,6 +3064,7 @@ static const struct hisi_sas_debugfs_reg_lu debugfs_global_reg_lu[] = { HISI_SAS_DEBUGFS_REG(SATA_INITI_D2H_STORE_ADDR_LO), HISI_SAS_DEBUGFS_REG(SATA_INITI_D2H_STORE_ADDR_HI), HISI_SAS_DEBUGFS_REG(CFG_MAX_TAG), + HISI_SAS_DEBUGFS_REG(TRANS_LOCK_ICT_TIME), HISI_SAS_DEBUGFS_REG(HGC_SAS_TX_OPEN_FAIL_RETRY_CTRL), HISI_SAS_DEBUGFS_REG(HGC_SAS_TXFAIL_RETRY_CTRL), HISI_SAS_DEBUGFS_REG(HGC_GET_ITV_TIME), -- 2.25.1

1 2

[PATCH openEuler-5.10 01/40] mm,hwpoison: drain pcplists before bailing out for non-buddy zero-refcount page
by Zheng Zengkai 06 Jul '22

06 Jul '22

From: Oscar Salvador <osalvador(a)suse.de> mainline inclusion from mainline-v5.11-rc1 commit 17e395b60f5b3dea204fcae60c7b38e84a00d87a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5E2IG CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Patch series "HWpoison: further fixes and cleanups", v5. This patchset includes some more fixes and a cleanup. Patch#2 and patch#3 are both fixes for taking a HWpoison page off a buddy freelist, since having them there has proved to be bad (see [1] and pathch#2's commit log). Patch#3 does the same for hugetlb pages. [1] https://lkml.org/lkml/2020/9/22/565 This patch (of 4): A page with 0-refcount and !PageBuddy could perfectly be a pcppage. Currently, we bail out with an error if we encounter such a page, meaning that we do not handle pcppages neither from hard-offline nor from soft-offline path. Fix this by draining pcplists whenever we find this kind of page and retry the check again. It might be that pcplists have been spilled into the buddy allocator and so we can handle it. Link: https://lkml.kernel.org/r/20201013144447.6706-1-osalvador@suse.de Link: https://lkml.kernel.org/r/20201013144447.6706-2-osalvador@suse.de Signed-off-by: Oscar Salvador <osalvador(a)suse.de> Acked-by: Naoya Horiguchi <naoya.horiguchi(a)nec.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- mm/memory-failure.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 63bacfcca122..de36b4aa4b6f 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -947,13 +947,13 @@ static int page_action(struct page_state *ps, struct page *p, } /** - * get_hwpoison_page() - Get refcount for memory error handling: + * __get_hwpoison_page() - Get refcount for memory error handling: * @page: raw error page (hit by memory error) * * Return: return 0 if failed to grab the refcount, otherwise true (some * non-zero value.) */ -static int get_hwpoison_page(struct page *page) +static int __get_hwpoison_page(struct page *page) { struct page *head = compound_head(page); @@ -983,6 +983,26 @@ static int get_hwpoison_page(struct page *page) return 0; } +static int get_hwpoison_page(struct page *p) +{ + int ret; + bool drained = false; + +retry: + ret = __get_hwpoison_page(p); + if (!ret && !is_free_buddy_page(p) && !page_count(p) && !drained) { + /* + * The page might be in a pcplist, so try to drain those + * and see if we are lucky. + */ + drain_all_pages(page_zone(p)); + drained = true; + goto retry; + } + + return ret; +} + /* * Do all that is necessary to remove user space mappings. Unmap * the pages and send SIGBUS to the processes if the data was dirty. -- 2.20.1

1 38

[PATCH openEuler-5.10 01/30] Documentation: Add documentation for Processor MMIO Stale Data
by Zheng Zengkai 06 Jul '22

06 Jul '22

From: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> stable inclusion from stable-v5.10.123 commit f8a85334a57e7842320476ff27be3a5f151da364 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5D5RS CVE: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4419470191386456e0b8ed4eb06a70b0021798a6 upstream Add the admin guide for Processor MMIO stale data vulnerabilities. Signed-off-by: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> Signed-off-by: Borislav Petkov <bp(a)suse.de> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Liao Chang <liaochang1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- Documentation/admin-guide/hw-vuln/index.rst | 1 + .../hw-vuln/processor_mmio_stale_data.rst | 246 ++++++++++++++++++ 2 files changed, 247 insertions(+) create mode 100644 Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/admin-guide/hw-vuln/index.rst index ca4dbdd9016d..2adec1e6520a 100644 --- a/Documentation/admin-guide/hw-vuln/index.rst +++ b/Documentation/admin-guide/hw-vuln/index.rst @@ -15,3 +15,4 @@ are configurable at compile, boot or run time. tsx_async_abort multihit.rst special-register-buffer-data-sampling.rst + processor_mmio_stale_data.rst diff --git a/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst new file mode 100644 index 000000000000..9393c50b5afc --- /dev/null +++ b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst @@ -0,0 +1,246 @@ +========================================= +Processor MMIO Stale Data Vulnerabilities +========================================= + +Processor MMIO Stale Data Vulnerabilities are a class of memory-mapped I/O +(MMIO) vulnerabilities that can expose data. The sequences of operations for +exposing data range from simple to very complex. Because most of the +vulnerabilities require the attacker to have access to MMIO, many environments +are not affected. System environments using virtualization where MMIO access is +provided to untrusted guests may need mitigation. These vulnerabilities are +not transient execution attacks. However, these vulnerabilities may propagate +stale data into core fill buffers where the data can subsequently be inferred +by an unmitigated transient execution attack. Mitigation for these +vulnerabilities includes a combination of microcode update and software +changes, depending on the platform and usage model. Some of these mitigations +are similar to those used to mitigate Microarchitectural Data Sampling (MDS) or +those used to mitigate Special Register Buffer Data Sampling (SRBDS). + +Data Propagators +================ +Propagators are operations that result in stale data being copied or moved from +one microarchitectural buffer or register to another. Processor MMIO Stale Data +Vulnerabilities are operations that may result in stale data being directly +read into an architectural, software-visible state or sampled from a buffer or +register. + +Fill Buffer Stale Data Propagator (FBSDP) +----------------------------------------- +Stale data may propagate from fill buffers (FB) into the non-coherent portion +of the uncore on some non-coherent writes. Fill buffer propagation by itself +does not make stale data architecturally visible. Stale data must be propagated +to a location where it is subject to reading or sampling. + +Sideband Stale Data Propagator (SSDP) +------------------------------------- +The sideband stale data propagator (SSDP) is limited to the client (including +Intel Xeon server E3) uncore implementation. The sideband response buffer is +shared by all client cores. For non-coherent reads that go to sideband +destinations, the uncore logic returns 64 bytes of data to the core, including +both requested data and unrequested stale data, from a transaction buffer and +the sideband response buffer. As a result, stale data from the sideband +response and transaction buffers may now reside in a core fill buffer. + +Primary Stale Data Propagator (PSDP) +------------------------------------ +The primary stale data propagator (PSDP) is limited to the client (including +Intel Xeon server E3) uncore implementation. Similar to the sideband response +buffer, the primary response buffer is shared by all client cores. For some +processors, MMIO primary reads will return 64 bytes of data to the core fill +buffer including both requested data and unrequested stale data. This is +similar to the sideband stale data propagator. + +Vulnerabilities +=============== +Device Register Partial Write (DRPW) (CVE-2022-21166) +----------------------------------------------------- +Some endpoint MMIO registers incorrectly handle writes that are smaller than +the register size. Instead of aborting the write or only copying the correct +subset of bytes (for example, 2 bytes for a 2-byte write), more bytes than +specified by the write transaction may be written to the register. On +processors affected by FBSDP, this may expose stale data from the fill buffers +of the core that created the write transaction. + +Shared Buffers Data Sampling (SBDS) (CVE-2022-21125) +---------------------------------------------------- +After propagators may have moved data around the uncore and copied stale data +into client core fill buffers, processors affected by MFBDS can leak data from +the fill buffer. It is limited to the client (including Intel Xeon server E3) +uncore implementation. + +Shared Buffers Data Read (SBDR) (CVE-2022-21123) +------------------------------------------------ +It is similar to Shared Buffer Data Sampling (SBDS) except that the data is +directly read into the architectural software-visible state. It is limited to +the client (including Intel Xeon server E3) uncore implementation. + +Affected Processors +=================== +Not all the CPUs are affected by all the variants. For instance, most +processors for the server market (excluding Intel Xeon E3 processors) are +impacted by only Device Register Partial Write (DRPW). + +Below is the list of affected Intel processors [#f1]_: + + =================== ============ ========= + Common name Family_Model Steppings + =================== ============ ========= + HASWELL_X 06_3FH 2,4 + SKYLAKE_L 06_4EH 3 + BROADWELL_X 06_4FH All + SKYLAKE_X 06_55H 3,4,6,7,11 + BROADWELL_D 06_56H 3,4,5 + SKYLAKE 06_5EH 3 + ICELAKE_X 06_6AH 4,5,6 + ICELAKE_D 06_6CH 1 + ICELAKE_L 06_7EH 5 + ATOM_TREMONT_D 06_86H All + LAKEFIELD 06_8AH 1 + KABYLAKE_L 06_8EH 9 to 12 + ATOM_TREMONT 06_96H 1 + ATOM_TREMONT_L 06_9CH 0 + KABYLAKE 06_9EH 9 to 13 + COMETLAKE 06_A5H 2,3,5 + COMETLAKE_L 06_A6H 0,1 + ROCKETLAKE 06_A7H 1 + =================== ============ ========= + +If a CPU is in the affected processor list, but not affected by a variant, it +is indicated by new bits in MSR IA32_ARCH_CAPABILITIES. As described in a later +section, mitigation largely remains the same for all the variants, i.e. to +clear the CPU fill buffers via VERW instruction. + +New bits in MSRs +================ +Newer processors and microcode update on existing affected processors added new +bits to IA32_ARCH_CAPABILITIES MSR. These bits can be used to enumerate +specific variants of Processor MMIO Stale Data vulnerabilities and mitigation +capability. + +MSR IA32_ARCH_CAPABILITIES +-------------------------- +Bit 13 - SBDR_SSDP_NO - When set, processor is not affected by either the + Shared Buffers Data Read (SBDR) vulnerability or the sideband stale + data propagator (SSDP). +Bit 14 - FBSDP_NO - When set, processor is not affected by the Fill Buffer + Stale Data Propagator (FBSDP). +Bit 15 - PSDP_NO - When set, processor is not affected by Primary Stale Data + Propagator (PSDP). +Bit 17 - FB_CLEAR - When set, VERW instruction will overwrite CPU fill buffer + values as part of MD_CLEAR operations. Processors that do not + enumerate MDS_NO (meaning they are affected by MDS) but that do + enumerate support for both L1D_FLUSH and MD_CLEAR implicitly enumerate + FB_CLEAR as part of their MD_CLEAR support. +Bit 18 - FB_CLEAR_CTRL - Processor supports read and write to MSR + IA32_MCU_OPT_CTRL[FB_CLEAR_DIS]. On such processors, the FB_CLEAR_DIS + bit can be set to cause the VERW instruction to not perform the + FB_CLEAR action. Not all processors that support FB_CLEAR will support + FB_CLEAR_CTRL. + +MSR IA32_MCU_OPT_CTRL +--------------------- +Bit 3 - FB_CLEAR_DIS - When set, VERW instruction does not perform the FB_CLEAR +action. This may be useful to reduce the performance impact of FB_CLEAR in +cases where system software deems it warranted (for example, when performance +is more critical, or the untrusted software has no MMIO access). Note that +FB_CLEAR_DIS has no impact on enumeration (for example, it does not change +FB_CLEAR or MD_CLEAR enumeration) and it may not be supported on all processors +that enumerate FB_CLEAR. + +Mitigation +========== +Like MDS, all variants of Processor MMIO Stale Data vulnerabilities have the +same mitigation strategy to force the CPU to clear the affected buffers before +an attacker can extract the secrets. + +This is achieved by using the otherwise unused and obsolete VERW instruction in +combination with a microcode update. The microcode clears the affected CPU +buffers when the VERW instruction is executed. + +Kernel reuses the MDS function to invoke the buffer clearing: + + mds_clear_cpu_buffers() + +On MDS affected CPUs, the kernel already invokes CPU buffer clear on +kernel/userspace, hypervisor/guest and C-state (idle) transitions. No +additional mitigation is needed on such CPUs. + +For CPUs not affected by MDS or TAA, mitigation is needed only for the attacker +with MMIO capability. Therefore, VERW is not required for kernel/userspace. For +virtualization case, VERW is only needed at VMENTER for a guest with MMIO +capability. + +Mitigation points +----------------- +Return to user space +^^^^^^^^^^^^^^^^^^^^ +Same mitigation as MDS when affected by MDS/TAA, otherwise no mitigation +needed. + +C-State transition +^^^^^^^^^^^^^^^^^^ +Control register writes by CPU during C-state transition can propagate data +from fill buffer to uncore buffers. Execute VERW before C-state transition to +clear CPU fill buffers. + +Guest entry point +^^^^^^^^^^^^^^^^^ +Same mitigation as MDS when processor is also affected by MDS/TAA, otherwise +execute VERW at VMENTER only for MMIO capable guests. On CPUs not affected by +MDS/TAA, guest without MMIO access cannot extract secrets using Processor MMIO +Stale Data vulnerabilities, so there is no need to execute VERW for such guests. + +Mitigation control on the kernel command line +--------------------------------------------- +The kernel command line allows to control the Processor MMIO Stale Data +mitigations at boot time with the option "mmio_stale_data=". The valid +arguments for this option are: + + ========== ================================================================= + full If the CPU is vulnerable, enable mitigation; CPU buffer clearing + on exit to userspace and when entering a VM. Idle transitions are + protected as well. It does not automatically disable SMT. + full,nosmt Same as full, with SMT disabled on vulnerable CPUs. This is the + complete mitigation. + off Disables mitigation completely. + ========== ================================================================= + +If the CPU is affected and mmio_stale_data=off is not supplied on the kernel +command line, then the kernel selects the appropriate mitigation. + +Mitigation status information +----------------------------- +The Linux kernel provides a sysfs interface to enumerate the current +vulnerability status of the system: whether the system is vulnerable, and +which mitigations are active. The relevant sysfs file is: + + /sys/devices/system/cpu/vulnerabilities/mmio_stale_data + +The possible values in this file are: + + .. list-table:: + + * - 'Not affected' + - The processor is not vulnerable + * - 'Vulnerable' + - The processor is vulnerable, but no mitigation enabled + * - 'Vulnerable: Clear CPU buffers attempted, no microcode' + - The processor is vulnerable, but microcode is not updated. The + mitigation is enabled on a best effort basis. + * - 'Mitigation: Clear CPU buffers' + - The processor is vulnerable and the CPU buffer clearing mitigation is + enabled. + +If the processor is vulnerable then the following information is appended to +the above information: + + ======================== =========================================== + 'SMT vulnerable' SMT is enabled + 'SMT disabled' SMT is disabled + 'SMT Host state unknown' Kernel runs in a VM, Host SMT state unknown + ======================== =========================================== + +References +---------- +.. [#f1] Affected Processors + https://www.intel.com/content/www/us/en/developer/topic-technology/software… -- 2.20.1

1 29

[PATCH openEuler-5.10 000/557] Backport 5.10.110 LTS
by Zheng Zengkai 06 Jul '22

06 Jul '22

Backport 5.10.110 LTS patches from upstream arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" can: m_can: m_can_tx_handler(): fix use after free of skb openvswitch: Fixed nd target mask field in the flow dump. docs: sysctl/kernel: add missing bit to panic_print um: Fix uml_mconsole stop/go ARM: dts: spear13xx: Update SPI dma properties ARM: dts: spear1340: Update serial node properties ASoC: topology: Allow TLV control to be either read or write dt-bindings: spi: mxic: The interrupt property is not mandatory dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: mtd: nand-controller: Fix the reg property description bpf: Fix comment for helper bpf_current_task_under_cgroup() bpf: Adjust BPF stack helper functions to accommodate skip > 0 mm/usercopy: return 1 from hardened_usercopy __setup() handler mm/memcontrol: return 1 from cgroup.memory __setup() handler ARM: 9187/1: JIVE: fix return value of __setup handler mm/mmap: return 1 from stack_guard_gap __setup() handler batman-adv: Check ptr for NULL before reducing its refcnt ASoC: soc-compress: Change the check for codec_dai staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet proc: bootconfig: Add null pointer check can: isotp: restore accidentally removed MSG_PEEK feature platform/chrome: cros_ec_typec: Check for EC device ACPI: CPPC: Avoid out of bounds access when parsing _CPC data riscv module: remove (NOLOAD) io_uring: fix memory leak of uid in files registration ARM: iop32x: offset IRQ numbers by 1 ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function pinctrl: pinconf-generic: Print arguments for bias-pull-* watch_queue: Free the page array when watch_queue is dismantled crypto: arm/aes-neonbs-cbc - Select generic cbc and aes mailbox: imx: fix wakeup failure from freeze mode rxrpc: Fix call timer start racing with call destruction gfs2: Make sure FITRIM minlen is rounded up to fs block size rtc: check if __rtc_read_time was successful XArray: Update the LRU list in xas_split() can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value can: mcba_usb: properly check endpoint type XArray: Fix xas_create_range() when multi-order entry present wireguard: socket: ignore v6 endpoints when ipv6 is disabled wireguard: socket: free skb in send6 when ipv6 is disabled wireguard: queueing: use CFI-safe ptr_ring cleanup function ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM KVM: SVM: fix panic on out-of-bounds guest IRQ KVM: x86: fix sending PV IPI KVM: Prevent module exit until all VMs are freed KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated platform: chrome: Split trace include file scsi: qla2xxx: Use correct feature type field during RFF_ID processing scsi: qla2xxx: Reduce false trigger to login scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() scsi: qla2xxx: Check for firmware dump already collected scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Fix warning for missing error code scsi: qla2xxx: Fix wrong FDMI data for 64G adapter scsi: qla2xxx: Fix scheduling while atomic scsi: qla2xxx: Fix stuck session in gpdb powerpc: Fix build errors with newer binutils powerpc/lib/sstep: Fix build errors with newer binutils powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/kasan: Fix early region not updated correctly KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU ALSA: hda/realtek: Add alc256-samsung-headphone fixup media: atomisp: fix bad usage at error handling logic mmc: host: Return an error when ->enable_sdio_irq() ops is missing media: hdpvr: initialize dev->worker at hdpvr_register_videodev media: Revert "media: em28xx: add missing em28xx_close_extension" video: fbdev: sm712fb: Fix crash in smtcfb_write() ARM: mmp: Fix failure to remove sram device ARM: tegra: tamonten: Fix I2C3 pad setting lib/test_lockup: fix kernel pointer check for separate address spaces uaccess: fix type mismatch warnings from access_ok() media: cx88-mpeg: clear interrupt status register before streaming video ASoC: soc-core: skip zero num_dai component in searching dai name ARM: dts: bcm2711: Add the missing L1/L2 cache information video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() arm64: defconfig: build imx-sdma as a module ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk ARM: ftrace: avoid redundant loads or clobbering IP media: atomisp: fix dummy_ptr check to avoid duplicate active_bo media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards ASoC: madera: Add dependencies on MFD ARM: dts: bcm2837: Add the missing L1/L2 cache information ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit video: fbdev: cirrusfb: check pixclock to avoid divide by zero video: fbdev: w100fb: Reset global state video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow media: ir_toy: free before error exiting media: staging: media: zoran: fix various V4L2 compliance errors media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com media: staging: media: zoran: move videodev alloc ntfs: add sanity check on allocation size f2fs: compress: fix to print raw data size in error path of lz4 decompression NFSD: Fix nfsd_breaker_owns_lease() return values f2fs: fix to do sanity check on curseg->alloc_type ext4: don't BUG if someone dirty pages without asking ext4 first ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb locking/lockdep: Iterate lock_classes directly when reading lockdep files spi: tegra20: Use of_device_get_match_data() nvme-tcp: lockdep: annotate in-kernel sockets parisc: Fix handling off probe non-access faults PM: core: keep irq flags in device_pm_check_callbacks() ACPI/APEI: Limit printable size of BERT table data Revert "Revert "block, bfq: honor already-setup queue merges"" lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 ACPICA: Avoid walking the ACPI Namespace if it is not there fs/binfmt_elf: Fix AT_PHDR for unusual ELF files irqchip/nvic: Release nvic_base upon failure irqchip/qcom-pdc: Fix broken locking Fix incorrect type in assignment of ipv6 port for audit loop: use sysfs_emit() in the sysfs xxx show() selinux: allow FIOCLEX and FIONCLEX with policy capability selinux: use correct type for context length pinctrl: npcm: Fix broken references to chip->parent_device gcc-plugins/stackleak: Exactly match strings instead of prefixes regulator: rpi-panel: Handle I2C errors/timing to the Atmel LSM: general protection fault in legacy_parse_param fs: fix fd table size alignment properly lib/test: use after free in register_test_dev_kmod() fs: fd tables have to be multiples of BITS_PER_LONG net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator NFSv4/pNFS: Fix another issue with a list iterator pointing to the head qlcnic: dcb: default to returning -EOPNOTSUPP selftests: test_vxlan_under_vrf: Fix broken test case net: phy: broadcom: Fix brcm_fet_config_init() net: enetc: report software timestamping via SO_TIMESTAMPING xen: fix is_xen_pmu() clk: Initialize orphan req_rate clk: qcom: gcc-msm8994: Fix gpll4 width kdb: Fix the putarea helper function NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options jfs: fix divide error in dbNextAG driver core: dd: fix return value of __setup handler firmware: google: Properly state IOMEM dependency kgdbts: fix return value of __setup handler serial: 8250: fix XOFF/XON sending when DMA is used kgdboc: fix return value of __setup handler tty: hvc: fix return value of __setup handler pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init staging: mt7621-dts: fix GB-PC2 devicetree staging: mt7621-dts: fix pinctrl properties for ethernet staging: mt7621-dts: fix formatting staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree NFS: remove unneeded check in decode_devicenotify_args() clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver clk: clps711x: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: actions: Terminate clk_div_table with sentinel element nvdimm/region: Fix default alignment for small regions remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma clk: qcom: clk-rcg2: Update the frac table for pixel clock clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: at91: sama7g5: fix parents of PDMCs' GCLK clk: imx7d: Remove audio_mclk_root_clk dma-debug: fix return value of __setup handlers NFS: Return valid errors from nfs2/3_decode_dirent() habanalabs: Add check for pci_enable_device iio: adc: Add check for devm_request_threaded_irq serial: 8250: Fix race condition in RTS-after-send handling NFS: Use of mapping_set_error() results in spurious errors serial: 8250_lpss: Balance reference count for PCI DMA device serial: 8250_mid: Balance reference count for PCI DMA device phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) clk: qcom: ipq8074: Use floor ops for SDCC1 clock pinctrl: renesas: checker: Fix miscalculation of number of states pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel staging:iio:adc:ad7280a: Fix handing of device address bit reversing. iio: mma8452: Fix probe failing when an i2c_device_id is used clk: qcom: ipq8074: fix PCI-E clock oops soundwire: intel: fix wrong register name in intel_shim_wake cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse misc: alcor_pci: Fix an error handling path fsi: Aspeed: Fix a potential double free fsi: aspeed: convert to devm_platform_ioremap_resource pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() mxser: fix xmit_buf leak in activate when LSR == 0xff mfd: asic3: Add missing iounmap() on error asic3_mfd_probe tipc: fix the timer expires after interval 100ms openvswitch: always update flow key after nat tcp: ensure PMTU updates are processed during fastopen net: bcmgenet: Use stronger register read/writes to assure ordering PCI: Avoid broken MSI on SB600 USB devices selftests/bpf/test_lirc_mode2.sh: Exit with proper code i2c: mux: demux-pinctrl: do not deactivate a master that is not active i2c: meson: Fix wrong speed use from probe af_netlink: Fix shift out of bounds in group mask calculation ipv4: Fix route lookups when handling ICMP redirects and PMTU updates Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed selftests/bpf: Fix error reporting from sock_fields programs bareudp: use ipv6_mod_enabled to check if IPv6 enabled can: isotp: support MSG_TRUNC flag when reading from socket can: isotp: return -EADDRNOTAVAIL when reading from unbound socket USB: storage: ums-realtek: fix error code in rts51x_read_mem() samples/bpf, xdpsock: Fix race when running for fix duration of time RDMA/mlx5: Fix memory leak in error flow for subscribe event routine mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init MIPS: pgalloc: fix memory leak caused by pgd_free() MIPS: RB532: fix return value of __setup handler mips: cdmm: Fix refcount leak in mips_cdmm_phys_base ath10k: Fix error handling in ath10k_setup_msa_resources vxcan: enable local echo for sent CAN frames powerpc: 8xx: fix a return value error in mpc8xx_pic_init platform/x86: huawei-wmi: check the return value of device_create_file() selftests/bpf: Make test_lwt_ip_encap more stable and faster libbpf: Unmap rings when umem deleted mfd: mc13xxx: Add check for mc13xxx_irq_request powerpc/sysdev: fix incorrect use to determine if list is empty mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n net: axienet: fix RX ring refill allocation failure handling IB/hfi1: Allow larger MTU without AIP power: supply: wm8350-power: Add missing free in free_charger_irq power: supply: wm8350-power: Handle error for wm8350_register_irq i2c: xiic: Make bus names unique hv_balloon: rate-limit "Unhandled message" warning KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() KVM: x86: Fix emulation in writing cr8 powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() libbpf: Skip forward declaration when counting duplicated type names gpu: host1x: Fix a memory leak in 'host1x_remove()' bpf, arm64: Feed byte-offset into bpf line info bpf, arm64: Call build_prologue() first in first JIT pass drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt scsi: hisi_sas: Change permission of parameter prot_mask power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return drm/tegra: Fix reference leak in tegra_dsi_ganged_probe ext2: correct max file size computing TOMOYO: fix __setup handlers return values drm/amd/display: Remove vupdate_int_entry definition RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR scsi: pm8001: Fix abort all task initialization scsi: pm8001: Fix NCQ NON DATA command completion handling scsi: pm8001: Fix NCQ NON DATA command task initialization scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix command initialization in pm80XX_send_read_log() dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS drm/msm/dpu: fix dp audio condition drm/msm/dpu: add DSPP blocks teardown drm/msm/dp: populate connector of struct dp_panel iwlwifi: mvm: Fix an error code in iwl_mvm_up() iwlwifi: Fix -EIO error code that is never returned dax: make sure inodes are flushed before destroy cache IB/cma: Allow XRC INI QPs to set their local ACK timeout drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug drm/amd/pm: enable pm sysfs write for one VF mode iommu/ipmmu-vmsa: Check for error num after setting mask HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init drm/bridge: dw-hdmi: use safe format when first in bridge chain PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge scripts/dtc: Call pkg-config POSIXly correct net: dsa: mv88e6xxx: Enable port policy support on 6097 mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode powerpc/perf: Don't use perf_hw_context for trace IMC PMU KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch ray_cs: Check ioremap return value power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe i40e: respect metadata on XSK Rx to skb i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb KVM: PPC: Fix vmx/vsx mixup in mmio emulation RDMA/core: Set MR type in ib_reg_user_mr ath9k_htc: fix uninit value bugs drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() ionic: fix type complaint in ionic_dev_cmd_clean() drm/edid: Don't clear formats if using deep color mtd: rawnand: gpmi: fix controller timings setting mtd: onenand: Check for error irq Bluetooth: hci_serdev: call init_rwsem() before p->open() udmabuf: validate ubuf->pagecount libbpf: Fix possible NULL pointer dereference when destroying skeleton drm/panfrost: Check for error num after setting mask ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern drm: bridge: adv7511: Fix ADV7535 HPD enablement drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() mmc: davinci_mmc: Handle error for clk_enable ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe ASoC: imx-es8328: Fix error return code in imx_es8328_probe() ASoC: fsl_spdif: Disable TX clock when stop ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: dmaengine: do not use a NULL prepare_slave_config() callback ASoC: SOF: Add missing of_node_put() in imx8m_probe ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() ivtv: fix incorrect device_caps for ivtvfb media: saa7134: fix incorrect use to determine if list is empty media: saa7134: convert list_for_each to entry variant video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of ASoC: fsi: Add check for clk_enable ASoC: wm8350: Handle error for wm8350_register_irq ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe media: vidtv: Check for null return of vzalloc media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction memory: emif: check the pointer temp in get_device_details() memory: emif: Add check for setup_interrupts ASoC: soc-compress: prevent the potentially use of null pointer ASoC: dwc-i2s: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: mxs-saif: Handle errors for clk_enable printk: fix return value of printk.devkmsg __setup handler arm64: dts: broadcom: Fix sata nodename arm64: dts: ns2: Fix spi-cpol and spi-cpha property ALSA: spi: Add check for clk_enable() ASoC: ti: davinci-i2s: Add check for clk_enable() ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() uaccess: fix nios2 and microblaze get_user_8() ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put media: cedrus: h264: Fix neighbour info buffer size media: cedrus: H265: Fix neighbour info buffer size media: usb: go7007: s2250-board: fix leak in probe() media: em28xx: initialize refcount before kref_get media: video/hdmi: handle short reads of hdmi info frame. ARM: dts: imx: Add missing LVDS decoder on M53Menlo ARM: dts: sun8i: v3s: Move the csi1 block to follow address order soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc arm64: dts: qcom: sdm845: fix microphone bias properties and values soc: qcom: aoss: remove spurious IRQF_ONESHOT flags soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem soc: qcom: rpmpd: Check for null return of devm_kcalloc ARM: dts: qcom: ipq4019: fix sleep clock firmware: qcom: scm: Remove reassignment to desc following initializer video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() video: fbdev: controlfb: Fix COMPILE_TEST build video: fbdev: controlfb: Fix set but not used warnings video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen media: aspeed: Correct value for h-total-pixels media: hantro: Fix overfill bottom register field name media: meson: vdec: potential dereference of null pointer media: coda: Fix missing put_device() call in coda_get_vdoa_data ASoC: generic: simple-card-utils: remove useless assignment ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting media: bttv: fix WARNING regression on tunerless devices media: mtk-vcodec: potential dereference of null pointer media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size kunit: make kunit_test_timeout compatible with comment selftests, x86: fix how check_cc.sh is being invoked f2fs: fix compressed file start atomic write may cause data corruption f2fs: compress: remove unneeded read when rewrite whole cluster btrfs: fix unexpected error path when reflinking an inline extent f2fs: fix to avoid potential deadlock nfsd: more robust allocation failure handling in nfsd_file_cache_init f2fs: fix missing free nid in f2fs_handle_failed_inode perf/x86/intel/pt: Fix address filter config for 32-bit kernel perf/core: Fix address filter parser for multiple filters rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() sched/core: Export pelt_thermal_tp sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa f2fs: fix to enable ATGC correctly via gc_idle sysfs interface watch_queue: Actually free the watch watch_queue: Fix NULL dereference in error cleanup io_uring: terminate manual loop iterator loop correctly for non-vecs clocksource: acpi_pm: fix return value of __setup handler hwmon: (pmbus) Add Vin unit off handling hwrng: nomadik - Change clk_disable to clk_disable_unprepare amba: Make the remove callback return void vfio: platform: simplify device removal crypto: ccree - Fix use after free in cc_cipher_exit() crypto: ccp - ccp_dmaengine_unregister release dma channels ACPI: APEI: fix return value of __setup handlers clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() clocksource/drivers/timer-microchip-pit64b: Use notrace clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts clocksource/drivers/exynos_mct: Refactor resources allocation clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix crypto: vmx - add missing dependencies crypto: amlogic - call finalize with bh disabled crypto: sun8i-ce - call finalize with bh disabled crypto: sun8i-ss - call finalize with bh disabled hwrng: atmel - disable trng on failure path spi: spi-zynqmp-gqspi: Handle error for dma_set_mask PM: suspend: fix return value of __setup handler PM: hibernate: fix __setup handler error handling block: don't delete queue kobject before its children nvme: cleanup __nvme_check_ids hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING hwmon: (pmbus) Add mutex to regulator ops spi: pxa2xx-pci: Balance reference count for PCI DMA device crypto: ccree - don't attempt 0 len DMA mappings EVM: fix the evm= __setup handler return value audit: log AUDIT_TIME_* records only from rules crypto: rockchip - ECB does not need IV selftests/x86: Add validity check and allow field splitting arm64/mm: avoid fixmap race condition when create pud mapping spi: tegra114: Add missing IRQ check in tegra_spi_probe thermal: int340x: Check for NULL after calling kmemdup() crypto: mxs-dcp - Fix scatterlist processing crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: sun8i-ss - really disable hash on A80 hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER hwrng: cavium - Check health status while reading random data selinux: check return value of sel_make_avc_files regulator: qcom_smd: fix for_each_child.cocci warnings PCI: xgene: Revert "PCI: xgene: Fix IB window setup" PCI: pciehp: Clear cmd_busy bit in polling mode drm/i915/gem: add missing boundary check in vm_access brcmfmac: pcie: Fix crashes due to early IRQs brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: firmware: Allocate space for default boardrev in nvram xtensa: fix xtensa_wsr always writing 0 xtensa: fix stop_machine_cpuslocked call in patch_text media: davinci: vpif: fix unbalanced runtime PM enable media: davinci: vpif: fix unbalanced runtime PM get media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC DEC: Limit PMAX memory probing to R3k systems crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - only allow with rsa exec: Force single empty string when argv is empty lib/raid6/test: fix multiple definition linking error thermal: int340x: Increase bitmap size pstore: Don't use semaphores in always-atomic-context code carl9170: fix missing bit-wise or operator for tx_params mgag200 fix memmapsl configuration in GCTL6 register ARM: dts: exynos: add missing HDMI supplies on SMDK5420 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: at91: sama5d2: Fix PMERRLOC resource size video: fbdev: atari: Atari 2 bpp (STe) palette bugfix video: fbdev: sm712fb: Fix crash in smtcfb_read() drm/edid: check basic audio support on CEA extension block block: limit request dispatch loop duration mailbox: tegra-hsp: Flush whole channel ext4: fix fs corruption when tring to remove a non-empty directory with IO error ext4: fix ext4_fc_stats trace point coredump: Also dump first pages of non-executable ELF libraries ACPI: properties: Consistently return -ENOENT if there are no more references arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs arm64: signal: nofpsimd: Do not allocate fp/simd context when not available udp: call udp_encap_enable for v6 sockets when enabling encap powerpc/kvm: Fix kvm_use_magic_page can: isotp: sanitize CAN ID checks in isotp_bind() drbd: fix potential silent data corruption dm integrity: set journal entry unused when shrinking device mm/kmemleak: reset tag when compare object pointer mm,hwpoison: unmap poisoned page before invalidation Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" mm: madvise: return correct bytes advised with process_madvise mm: madvise: skip unmapped vma holes passed to process_madvise ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock ALSA: hda: Avoid unsol event during RPM suspending ALSA: cs4236: fix an incorrect NULL check on list iterator cifs: fix NULL ptr dereference in smb2_ioctl_query_info() cifs: prevent bad output lengths in smb2_ioctl_query_info() Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" riscv: Increase stack size under KASAN riscv: Fix fill_callchain return value qed: display VF trust config scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands mempolicy: mbind_range() set_policy() after vma_merge() mm: invalidate hwpoison page cache page in fault path mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node mtd: rawnand: protect access to rawnand devices while in suspend spi: mxic: Fix the transmit path pinctrl: samsung: drop pin banks references on error paths remoteproc: Fix count check in rproc_coredump_write() f2fs: fix to do sanity check on .cp_pack_total_block_count f2fs: quota: fix loop condition at f2fs_quota_sync() f2fs: fix to unlock page correctly in error path of is_alive() NFSD: prevent integer overflow on 32 bit systems NFSD: prevent underflow in nfssvc_decode_writeargs() SUNRPC: avoid race between mod_timer() and del_timer_sync() HID: intel-ish-hid: Use dma_alloc_coherent for firmware update firmware: stratix10-svc: add missing callback parameter on RSU Documentation: update stable tree link Documentation: add link to stable release candidate tree KEYS: fix length validation in keyctl_pkey_params_get_2() clk: uniphier: Fix fixed-rate initialization greybus: svc: fix an error handling bug in gb_svc_hello() iio: inkern: make a best effort on offset calculation iio: inkern: apply consumer scale when no channel scale is available iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: afe: rescale: use s64 for temporary scale calculations coresight: Fix TRCCONFIGR.QE sysfs interface mei: avoid iterator usage outside of list_for_each_entry mei: me: add Alder Lake N device id. xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() xhci: make xhci_handshake timeout for xhci_reset() adjustable xhci: fix runtime PM imbalance in USB2 resume xhci: fix garbage USBSTS being logged in some cases USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c virtio-blk: Use blk_validate_block_size() to validate block size tpm: fix reference counting for struct tpm_chip iommu/iova: Improve 32-bit free space estimate locking/lockdep: Avoid potential access of invalid memory in lock_class net: dsa: microchip: add spi_device_id tables Input: zinitix - do not report shadow fingers spi: Fix erroneous sgs value with min_t() Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" net:mcf8390: Use platform_get_irq() to get the interrupt spi: Fix invalid sgs value gpio: Revert regression in sysfs-gpio (gpiolib.c) ethernet: sun: Free the coherent when failing in probing tools/virtio: fix virtio_test execution vdpa/mlx5: should verify CTRL_VQ feature exists for MQ virtio_console: break out of buf poll on remove ARM: mstar: Select HAVE_ARM_ARCH_TIMER xfrm: fix tunnel model fragmentation behavior HID: logitech-dj: add new lightspeed receiver id hv: utils: add PTP_1588_CLOCK to Kconfig to fix build USB: serial: simple: add Nokia phone driver USB: serial: pl2303: add IBM device IDs already merged(32) can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path KVM: x86/mmu: do compare-and-exchange of gPTE via the user address ubi: fastmap: Return error code if memory allocation fails in add_aeb() ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path ubifs: rename_whiteout: correct old_dir size computing ubifs: Fix to add refcount once page is set private ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() ubifs: setflags: Make dirtied_ino_d 8 bytes aligned ubifs: Add missing iput if do_tmpfile() failed in rename whiteout ubifs: Fix deadlock in concurrent rename whiteout and inode writeback ubifs: rename_whiteout: Fix double free for whiteout_ui->data bfq: fix use-after-free in bfq_dispatch_request block, bfq: don't move oom_bfqq net/x25: Fix null-ptr-deref caused by x25_disconnect net: hns3: fix bug when PF set the duplicate MAC address for VFs bpf, sockmap: Fix double uncharge the mem of sk_msg bpf, sockmap: Fix more uncharged while msg has more_data bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full livepatch: Fix build failure on 32 bits processors drm/i915/opregion: check port number bounds for SWSCI display power state bcache: fixup multiple threads crash drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() jffs2: fix memory leak in jffs2_scan_medium jffs2: fix memory leak in jffs2_do_mount_fs jffs2: fix use-after-free in jffs2_clear_xattr_subsystem can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register netdevice: add the case if dev is NULL swiotlb: fix info leak with DMA_FROM_DEVICE kabi conflict(8) PCI: Reduce warnings on possible RW1C corruption qed: validate and restrict untrusted VFs vlan promisc mode block: don't merge across cgroup boundaries if blkcg is enabled rseq: Remove broken uapi field layout on 32-bit little endian coredump: Use the vma snapshot in fill_files_note coredump/elf: Pass coredump_params into fill_note_info coredump: Remove the WARN_ON in dump_vma_snapshot coredump: Snapshot the vmas in do_coredump Total Patches = 597 - 32 - 8 = 557 Aaron Conole (1): openvswitch: always update flow key after nat Aashish Sharma (1): dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS Abel Vesa (2): clk: imx7d: Remove audio_mclk_root_clk ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk Adrian Hunter (2): perf/core: Fix address filter parser for multiple filters perf/x86/intel/pt: Fix address filter config for 32-bit kernel Aharon Landau (1): RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR Akira Kawata (1): fs/binfmt_elf: Fix AT_PHDR for unusual ELF files Alan Stern (1): USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c Alexander Lobakin (2): i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb i40e: respect metadata on XSK Rx to skb Alexander Usyskin (2): mei: me: add Alder Lake N device id. mei: avoid iterator usage outside of list_for_each_entry Alexey Khoroshilov (1): NFS: remove unneeded check in decode_devicenotify_args() Alistair Delva (1): remoteproc: Fix count check in rproc_coredump_write() Alistair Popple (1): mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node Amadeusz Sławiński (1): ASoC: topology: Allow TLV control to be either read or write Amir Goldstein (1): nfsd: more robust allocation failure handling in nfsd_file_cache_init Ammar Faizi (1): ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM Anders Roxell (3): powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/lib/sstep: Fix build errors with newer binutils powerpc: Fix build errors with newer binutils Andre Przywara (1): ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS Andreas Gruenbacher (1): powerpc/kvm: Fix kvm_use_magic_page Andrew Price (1): gfs2: Make sure FITRIM minlen is rounded up to fs block size Andy Shevchenko (3): spi: pxa2xx-pci: Balance reference count for PCI DMA device serial: 8250_mid: Balance reference count for PCI DMA device serial: 8250_lpss: Balance reference count for PCI DMA device Ang Tien Sung (1): firmware: stratix10-svc: add missing callback parameter on RSU Anssi Hannula (3): xhci: fix garbage USBSTS being logged in some cases xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() hv_balloon: rate-limit "Unhandled message" warning Anton Ivanov (1): um: Fix uml_mconsole stop/go Ard Biesheuvel (1): ARM: ftrace: avoid redundant loads or clobbering IP Armin Wolf (1): hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING Arnd Bergmann (4): uaccess: fix nios2 and microblaze get_user_8() uaccess: fix type mismatch warnings from access_ok() lib/test_lockup: fix kernel pointer check for separate address spaces ARM: iop32x: offset IRQ numbers by 1 Arun Easi (2): scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests Arınç ÜNAL (5): staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree staging: mt7621-dts: fix formatting staging: mt7621-dts: fix pinctrl properties for ethernet staging: mt7621-dts: fix GB-PC2 devicetree staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet Athira Rajeev (1): powerpc/perf: Don't use perf_hw_context for trace IMC PMU Bagas Sanjaya (2): Documentation: add link to stable release candidate tree Documentation: update stable tree link Bartosz Golaszewski (1): Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" Bharata B Rao (1): sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa Biju Das (2): spi: Fix invalid sgs value spi: Fix erroneous sgs value with min_t() Bikash Hazarika (1): scsi: qla2xxx: Fix wrong FDMI data for 64G adapter Bjorn Helgaas (1): PCI: Avoid broken MSI on SB600 USB devices Brandon Wyman (1): hwmon: (pmbus) Add Vin unit off handling Casey Schaufler (2): LSM: general protection fault in legacy_parse_param Fix incorrect type in assignment of ipv6 port for audit Chaitanya Kulkarni (1): loop: use sysfs_emit() in the sysfs xxx show() Chao Yu (6): f2fs: fix to unlock page correctly in error path of is_alive() f2fs: fix to do sanity check on .cp_pack_total_block_count f2fs: fix to enable ATGC correctly via gc_idle sysfs interface f2fs: fix to avoid potential deadlock f2fs: fix to do sanity check on curseg->alloc_type f2fs: compress: fix to print raw data size in error path of lz4 decompression Charan Teja Kalla (3): mm: madvise: skip unmapped vma holes passed to process_madvise mm: madvise: return correct bytes advised with process_madvise Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" Charles Keepax (1): ASoC: madera: Add dependencies on MFD Chen Jingwen (1): powerpc/kasan: Fix early region not updated correctly Chen-Yu Tsai (7): media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls media: hantro: Fix overfill bottom register field name pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs pinctrl: pinconf-generic: Print arguments for bias-pull-* Chris Leech (1): nvme-tcp: lockdep: annotate in-kernel sockets Christian Göttsche (2): selinux: check return value of sel_make_avc_files selinux: use correct type for context length Christoph Hellwig (1): nvme: cleanup __nvme_check_ids Christophe JAILLET (4): firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined gpu: host1x: Fix a memory leak in 'host1x_remove()' fsi: Aspeed: Fix a potential double free misc: alcor_pci: Fix an error handling path Chuck Lever (1): NFSD: Fix nfsd_breaker_owns_lease() return values Claudiu Beznea (3): net: dsa: microchip: add spi_device_id tables hwrng: atmel - disable trng on failure path clocksource/drivers/timer-microchip-pit64b: Use notrace Codrin Ciubotariu (2): ASoC: dmaengine: do not use a NULL prepare_slave_config() callback clk: at91: sama7g5: fix parents of PDMCs' GCLK Colin Ian King (2): carl9170: fix missing bit-wise or operator for tx_params iwlwifi: Fix -EIO error code that is never returned Cooper Chiou (1): drm/edid: check basic audio support on CEA extension block Corentin Labbe (8): crypto: sun8i-ss - really disable hash on A80 crypto: rockchip - ECB does not need IV crypto: sun8i-ss - call finalize with bh disabled crypto: sun8i-ce - call finalize with bh disabled crypto: amlogic - call finalize with bh disabled media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size media: staging: media: zoran: move videodev alloc media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com Dafna Hirschfeld (1): media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED Damien Le Moal (11): scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands scsi: pm8001: Fix command initialization in pm80XX_send_read_log() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() scsi: pm8001: Fix NCQ NON DATA command task initialization scsi: pm8001: Fix NCQ NON DATA command completion handling scsi: pm8001: Fix abort all task initialization Dan Carpenter (9): greybus: svc: fix an error handling bug in gb_svc_hello() NFSD: prevent underflow in nfssvc_decode_writeargs() NFSD: prevent integer overflow on 32 bit systems video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() media: usb: go7007: s2250-board: fix leak in probe() iwlwifi: mvm: Fix an error code in iwl_mvm_up() USB: storage: ums-realtek: fix error code in rts51x_read_mem() lib/test: use after free in register_test_dev_kmod() Dan Williams (1): nvdimm/region: Fix default alignment for small regions Daniel González Cabanelas (1): media: cx88-mpeg: clear interrupt status register before streaming video Daniel Henrique Barboza (1): powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() Daniel Palmer (1): ARM: mstar: Select HAVE_ARM_ARCH_TIMER Daniel Thompson (2): soc: qcom: aoss: remove spurious IRQF_ONESHOT flags kdb: Fix the putarea helper function Dario Binacchi (1): mtd: rawnand: gpmi: fix controller timings setting Darren Hart (1): ACPI/APEI: Limit printable size of BERT table data Dave Stevenson (1): regulator: rpi-panel: Handle I2C errors/timing to the Atmel David Engraf (1): arm64: signal: nofpsimd: Do not allocate fp/simd context when not available David Gow (1): firmware: google: Properly state IOMEM dependency David Heidelberg (2): arm64: dts: qcom: sdm845: fix microphone bias properties and values ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 David Howells (3): watch_queue: Fix NULL dereference in error cleanup watch_queue: Actually free the watch rxrpc: Fix call timer start racing with call destruction David Matlack (1): KVM: Prevent module exit until all VMs are freed Dirk Buchwalder (1): clk: qcom: ipq8074: Use floor ops for SDCC1 clock Dirk Müller (1): lib/raid6/test: fix multiple definition linking error Dmitry Baryshkov (3): drm/msm/dpu: add DSPP blocks teardown drm/msm/dpu: fix dp audio condition PM: core: keep irq flags in device_pm_check_callbacks() Dmitry Torokhov (1): HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports Dmitry Vyukov (1): riscv: Increase stack size under KASAN Dongliang Mu (3): media: em28xx: initialize refcount before kref_get ntfs: add sanity check on allocation size media: hdpvr: initialize dev->worker at hdpvr_register_videodev Drew Fustini (1): clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix Dāvis Mosāns (1): crypto: ccp - ccp_dmaengine_unregister release dma channels Eddie James (1): USB: serial: pl2303: add IBM device IDs Eric Biggers (6): KEYS: fix length validation in keyctl_pkey_params_get_2() crypto: rsa-pkcs1pad - only allow with rsa crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() block: don't delete queue kobject before its children Eric Dumazet (2): rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() watch_queue: Free the page array when watch_queue is dismantled Evgeny Novikov (1): video: fbdev: w100fb: Reset global state Fabiano Rosas (2): KVM: PPC: Fix vmx/vsx mixup in mmio emulation KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init Fangrui Song (1): riscv module: remove (NOLOAD) Felix Maurer (1): selftests/bpf: Make test_lwt_ip_encap more stable and faster Fengnan Chang (2): f2fs: compress: remove unneeded read when rewrite whole cluster f2fs: fix compressed file start atomic write may cause data corruption Filipe Manana (1): btrfs: fix unexpected error path when reflinking an inline extent Florian Fainelli (1): net: phy: broadcom: Fix brcm_fet_config_init() Frank Wunderlich (1): arm64: dts: broadcom: Fix sata nodename Geert Uytterhoeven (3): hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel pinctrl: renesas: checker: Fix miscalculation of number of states George Kennedy (1): video: fbdev: cirrusfb: check pixclock to avoid divide by zero Gilad Ben-Yossef (1): crypto: ccree - don't attempt 0 len DMA mappings Guilherme G. Piccoli (1): docs: sysctl/kernel: add missing bit to panic_print Guillaume Nault (1): ipv4: Fix route lookups when handling ICMP redirects and PMTU updates Guillaume Ranquet (1): clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() Guillaume Tucker (1): selftests, x86: fix how check_cc.sh is being invoked Gwendal Grignou (2): HID: intel-ish-hid: Use dma_alloc_coherent for firmware update platform: chrome: Split trace include file Hangbin Liu (2): bareudp: use ipv6_mod_enabled to check if IPv6 enabled selftests/bpf/test_lirc_mode2.sh: Exit with proper code Hangyu Hua (1): powerpc: 8xx: fix a return value error in mpc8xx_pic_init Hans Verkuil (2): ivtv: fix incorrect device_caps for ivtvfb media: staging: media: zoran: fix various V4L2 compliance errors Hans de Goede (3): power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return iio: mma8452: Fix probe failing when an i2c_device_id is used media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards Hector Martin (4): brcmfmac: firmware: Allocate space for default boardrev in nvram brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Fix crashes due to early IRQs Helge Deller (1): video: fbdev: sm712fb: Fix crash in smtcfb_read() Hengqi Chen (1): bpf: Fix comment for helper bpf_current_task_under_cgroup() Henry Lin (1): xhci: fix runtime PM imbalance in USB2 resume Herbert Xu (2): crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: arm/aes-neonbs-cbc - Select generic cbc and aes Hoang Le (1): tipc: fix the timer expires after interval 100ms Hou Tao (2): bpf, arm64: Call build_prologue() first in first JIT pass bpf, arm64: Feed byte-offset into bpf line info Hou Wenlong (1): KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() Hugh Dickins (1): mempolicy: mbind_range() set_policy() after vma_merge() Håkon Bugge (1): IB/cma: Allow XRC INI QPs to set their local ACK timeout Ido Schimmel (1): selftests: test_vxlan_under_vrf: Fix broken test case Ilpo Järvinen (1): serial: 8250: fix XOFF/XON sending when DMA is used Jaegeuk Kim (1): f2fs: fix missing free nid in f2fs_handle_failed_inode Jagan Teki (1): drm: bridge: adv7511: Fix ADV7535 HPD enablement Jakob Koschel (2): media: saa7134: fix incorrect use to determine if list is empty powerpc/sysdev: fix incorrect use to determine if list is empty Jakub Kicinski (1): tcp: ensure PMTU updates are processed during fastopen Jakub Sitnicki (1): selftests/bpf: Fix error reporting from sock_fields programs James Clark (1): coresight: Fix TRCCONFIGR.QE sysfs interface Jammy Huang (1): media: aspeed: Correct value for h-total-pixels Jann Horn (2): coredump: Also dump first pages of non-executable ELF libraries pstore: Don't use semaphores in always-atomic-context code Jason A. Donenfeld (2): wireguard: queueing: use CFI-safe ptr_ring cleanup function wireguard: socket: ignore v6 endpoints when ipv6 is disabled Jens Axboe (1): io_uring: terminate manual loop iterator loop correctly for non-vecs Jeremy Linton (1): net: bcmgenet: Use stronger register read/writes to assure ordering Jernej Skrabec (2): media: cedrus: H265: Fix neighbour info buffer size media: cedrus: h264: Fix neighbour info buffer size Jia-Ju Bai (3): ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() memory: emif: check the pointer temp in get_device_details() platform/x86: huawei-wmi: check the return value of device_create_file() Jianglei Nie (1): crypto: ccree - Fix use after free in cc_cipher_exit() Jianyong Wu (1): arm64/mm: avoid fixmap race condition when create pud mapping Jiasheng Jiang (26): thermal: int340x: Check for NULL after calling kmemdup() spi: spi-zynqmp-gqspi: Handle error for dma_set_mask media: mtk-vcodec: potential dereference of null pointer media: meson: vdec: potential dereference of null pointer soc: qcom: rpmpd: Check for null return of devm_kcalloc ASoC: ti: davinci-i2s: Add check for clk_enable() ALSA: spi: Add check for clk_enable() ASoC: mxs-saif: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: dwc-i2s: Handle errors for clk_enable ASoC: soc-compress: prevent the potentially use of null pointer memory: emif: Add check for setup_interrupts media: vidtv: Check for null return of vzalloc ASoC: wm8350: Handle error for wm8350_register_irq ASoC: fsi: Add check for clk_enable mmc: davinci_mmc: Handle error for clk_enable drm/panfrost: Check for error num after setting mask mtd: onenand: Check for error irq ray_cs: Check ioremap return value iommu/ipmmu-vmsa: Check for error num after setting mask power: supply: wm8350-power: Handle error for wm8350_register_irq power: supply: wm8350-power: Add missing free in free_charger_irq mfd: mc13xxx: Add check for mc13xxx_irq_request iio: adc: Add check for devm_request_threaded_irq habanalabs: Add check for pci_enable_device ASoC: soc-compress: Change the check for codec_dai Jiaxin Yu (1): ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs Jie Hai (1): dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma Jing Yao (3): video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit Jiri Slaby (1): mxser: fix xmit_buf leak in activate when LSR == 0xff Jocelyn Falempe (1): mgag200 fix memmapsl configuration in GCTL6 register Joe Carnuccio (2): scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Check for firmware dump already collected Johan Hovold (3): USB: serial: simple: add Nokia phone driver media: davinci: vpif: fix unbalanced runtime PM get media: davinci: vpif: fix unbalanced runtime PM enable John David Anglin (1): parisc: Fix handling off probe non-access faults Jonathan Cameron (1): staging:iio:adc:ad7280a: Fix handing of device address bit reversing. Jonathan Neuschäfer (5): clk: actions: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: clps711x: Terminate clk_div_table with sentinel element pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() José Expósito (1): Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" Juergen Gross (1): xen: fix is_xen_pmu() Juhyung Park (1): f2fs: quota: fix loop condition at f2fs_quota_sync() Kai-Heng Feng (1): ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 Kees Cook (2): exec: Force single empty string when argv is empty gcc-plugins/stackleak: Exactly match strings instead of prefixes Konrad Dybcio (1): clk: qcom: gcc-msm8994: Fix gpll4 width Krzysztof Kozlowski (5): pinctrl: samsung: drop pin banks references on error paths ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5420 clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts Kuan-Ying Lee (1): mm/kmemleak: reset tag when compare object pointer Kuldeep Singh (3): arm64: dts: ns2: Fix spi-cpol and spi-cpha property ARM: dts: spear1340: Update serial node properties ARM: dts: spear13xx: Update SPI dma properties Kunihiko Hayashi (1): clk: uniphier: Fix fixed-rate initialization Kuogee Hsieh (1): drm/msm/dp: populate connector of struct dp_panel Lars Ellenberg (1): drbd: fix potential silent data corruption Li RongQing (1): KVM: x86: fix sending PV IPI Liam Beguin (4): iio: afe: rescale: use s64 for temporary scale calculations iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: inkern: apply consumer scale when no channel scale is available iio: inkern: make a best effort on offset calculation Libin Yang (1): soundwire: intel: fix wrong register name in intel_shim_wake Liguang Zhang (1): PCI: pciehp: Clear cmd_busy bit in polling mode Lina Wang (1): xfrm: fix tunnel model fragmentation behavior Lino Sanfilippo (1): tpm: fix reference counting for struct tpm_chip Linus Torvalds (2): fs: fd tables have to be multiples of BITS_PER_LONG fs: fix fd table size alignment properly Linus Walleij (1): Input: zinitix - do not report shadow fingers Liu Ying (1): phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) Lorenzo Bianconi (4): mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update Luca Weiss (1): cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse Lucas Tanure (1): i2c: meson: Fix wrong speed use from probe Lucas Zampieri (1): HID: logitech-dj: add new lightspeed receiver id Lv Ruyi (1): proc: bootconfig: Add null pointer check Maciej W. Rozycki (1): DEC: Limit PMAX memory probing to R3k systems Manish Chopra (1): qed: display VF trust config Manish Rangankar (1): scsi: qla2xxx: Use correct feature type field during RFF_ID processing Maor Gottlieb (1): RDMA/core: Set MR type in ib_reg_user_mr Marc Kleine-Budde (1): can: m_can: m_can_tx_handler(): fix use after free of skb Marc Zyngier (4): PCI: xgene: Revert "PCI: xgene: Fix IB window setup" pinctrl: npcm: Fix broken references to chip->parent_device irqchip/qcom-pdc: Fix broken locking PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" Marcel Ziswiler (1): arm64: defconfig: build imx-sdma as a module Marcelo Roberto Jimenez (1): gpio: Revert regression in sysfs-gpio (gpiolib.c) Marek Szyprowski (1): clocksource/drivers/exynos_mct: Refactor resources allocation Marek Vasut (1): ARM: dts: imx: Add missing LVDS decoder on M53Menlo Marijn Suijten (1): firmware: qcom: scm: Remove reassignment to desc following initializer Martin Blumenstingl (1): drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops Martin Varghese (1): openvswitch: Fixed nd target mask field in the flow dump. Mastan Katragadda (1): drm/i915/gem: add missing boundary check in vm_access Mathias Nyman (1): xhci: make xhci_handshake timeout for xhci_reset() adjustable Matt Kramer (1): ALSA: hda/realtek: Add alc256-samsung-headphone fixup Matthew Wilcox (Oracle) (2): XArray: Fix xas_create_range() when multi-order entry present XArray: Update the LRU list in xas_split() Maulik Shah (1): arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc Mauro Carvalho Chehab (1): media: atomisp: fix bad usage at error handling logic Max Filippov (2): xtensa: fix stop_machine_cpuslocked call in patch_text xtensa: fix xtensa_wsr always writing 0 Maxim Kiselev (1): powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch Maxime Ripard (2): drm/edid: Don't clear formats if using deep color clk: Initialize orphan req_rate Maíra Canal (1): drm/amd/display: Remove vupdate_int_entry definition Miaoqian Lin (31): spi: tegra114: Add missing IRQ check in tegra_spi_probe hwrng: nomadik - Change clk_disable to clk_disable_unprepare media: coda: Fix missing put_device() call in coda_get_vdoa_data soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe ASoC: SOF: Add missing of_node_put() in imx8m_probe ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init drm/tegra: Fix reference leak in tegra_dsi_ganged_probe ath10k: Fix error handling in ath10k_setup_msa_resources mips: cdmm: Fix refcount leak in mips_cdmm_phys_base mfd: asic3: Add missing iounmap() on error asic3_mfd_probe remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function Michael Ellerman (1): powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit Michael S. Tsirkin (1): virtio_console: break out of buf poll on remove Michael Schmitz (1): video: fbdev: atari: Atari 2 bpp (STe) palette bugfix Mike Marciniszyn (1): IB/hfi1: Allow larger MTU without AIP Mikulas Patocka (1): dm integrity: set journal entry unused when shrinking device Minghao Chi (1): spi: tegra20: Use of_device_get_match_data() Minghao Chi (CGEL ZTE) (1): net:mcf8390: Use platform_get_irq() to get the interrupt Miquel Raynal (4): spi: mxic: Fix the transmit path dt-bindings: mtd: nand-controller: Fix the reg property description dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: spi: mxic: The interrupt property is not mandatory Mohan Kumar (1): ALSA: hda: Avoid unsol event during RPM suspending Muhammad Usama Anjum (1): selftests/x86: Add validity check and allow field splitting Namhyung Kim (1): bpf: Adjust BPF stack helper functions to accommodate skip > 0 Neil Armstrong (1): drm/bridge: dw-hdmi: use safe format when first in bridge chain NeilBrown (1): SUNRPC: avoid race between mod_timer() and del_timer_sync() Niels Dossche (1): Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed Nikita Shubin (1): riscv: Fix fill_callchain return value Niklas Söderlund (1): samples/bpf, xdpsock: Fix race when running for fix duration of time Nilesh Javali (1): scsi: qla2xxx: Fix warning for missing error code Nishanth Menon (4): arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt Olga Kornievskaia (1): NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error Oliver Hartkopp (5): can: isotp: sanitize CAN ID checks in isotp_bind() vxcan: enable local echo for sent CAN frames can: isotp: return -EADDRNOTAVAIL when reading from unbound socket can: isotp: support MSG_TRUNC flag when reading from socket can: isotp: restore accidentally removed MSG_PEEK feature Ondrej Zary (1): media: bttv: fix WARNING regression on tunerless devices Pablo Neira Ayuso (1): netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options Pali Rohár (1): PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge Paolo Valente (1): Revert "Revert "block, bfq: honor already-setup queue merges"" Patrick Rudolph (1): hwmon: (pmbus) Add mutex to regulator ops Paul Kocialkowski (1): ARM: dts: sun8i: v3s: Move the csi1 block to follow address order Paul Menzel (1): lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 Paulo Alcantara (2): cifs: prevent bad output lengths in smb2_ioctl_query_info() cifs: fix NULL ptr dereference in smb2_ioctl_query_info() Pavel Begunkov (1): io_uring: fix memory leak of uid in files registration Pavel Kubelun (1): ARM: dts: qcom: ipq4019: fix sleep clock Pavel Skripkin (6): udmabuf: validate ubuf->pagecount Bluetooth: hci_serdev: call init_rwsem() before p->open() ath9k_htc: fix uninit value bugs jfs: fix divide error in dbNextAG media: Revert "media: em28xx: add missing em28xx_close_extension" can: mcba_usb: properly check endpoint type Peiwei Hu (1): media: ir_toy: free before error exiting Pekka Pessi (1): mailbox: tegra-hsp: Flush whole channel Peng Liu (1): kunit: make kunit_test_timeout compatible with comment Peter Rosin (1): i2c: mux: demux-pinctrl: do not deactivate a master that is not active Petr Machata (1): af_netlink: Fix shift out of bounds in group mask calculation Petr Vorel (1): crypto: vmx - add missing dependencies Pierre-Louis Bossart (1): ASoC: generic: simple-card-utils: remove useless assignment Prashant Malani (1): platform/chrome: cros_ec_typec: Check for EC device Qais Yousef (1): sched/core: Export pelt_thermal_tp Quinn Tran (7): scsi: qla2xxx: Fix stuck session in gpdb scsi: qla2xxx: Fix scheduling while atomic scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Reduce false trigger to login Rafael J. Wysocki (2): ACPICA: Avoid walking the ACPI Namespace if it is not there ACPI: CPPC: Avoid out of bounds access when parsing _CPC data Randy Dunlap (20): hv: utils: add PTP_1588_CLOCK to Kconfig to fix build EVM: fix the evm= __setup handler return value PM: hibernate: fix __setup handler error handling PM: suspend: fix return value of __setup handler ACPI: APEI: fix return value of __setup handlers clocksource: acpi_pm: fix return value of __setup handler printk: fix return value of printk.devkmsg __setup handler m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined TOMOYO: fix __setup handlers return values mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n MIPS: RB532: fix return value of __setup handler dma-debug: fix return value of __setup handlers tty: hvc: fix return value of __setup handler kgdboc: fix return value of __setup handler kgdbts: fix return value of __setup handler driver core: dd: fix return value of __setup handler mm/mmap: return 1 from stack_guard_gap __setup() handler ARM: 9187/1: JIVE: fix return value of __setup handler mm/memcontrol: return 1 from cgroup.memory __setup() handler mm/usercopy: return 1 from hardened_usercopy __setup() handler Richard Guy Briggs (1): audit: log AUDIT_TIME_* records only from rules Richard Haines (1): selinux: allow FIOCLEX and FIONCLEX with policy capability Richard Leitner (1): ARM: tegra: tamonten: Fix I2C3 pad setting Richard Schleich (2): ARM: dts: bcm2837: Add the missing L1/L2 cache information ARM: dts: bcm2711: Add the missing L1/L2 cache information Rik van Riel (2): mm: invalidate hwpoison page cache page in fault path mm,hwpoison: unmap poisoned page before invalidation Ritesh Harjani (3): ext4: fix ext4_fc_stats trace point ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit Rob Herring (1): arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly Robert Hancock (3): ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting i2c: xiic: Make bus names unique net: axienet: fix RX ring refill allocation failure handling Robert Marko (1): clk: qcom: ipq8074: fix PCI-E clock oops Robin Gong (1): mailbox: imx: fix wakeup failure from freeze mode Robin Murphy (1): iommu/iova: Improve 32-bit free space estimate Roman Li (1): drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug Sakari Ailus (1): ACPI: properties: Consistently return -ENOENT if there are no more references Sam Ravnborg (1): video: fbdev: controlfb: Fix set but not used warnings Saurav Kashyap (1): scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() Sean Christopherson (1): KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU Sean Nyekjaer (1): mtd: rawnand: protect access to rawnand devices while in suspend Sean Young (1): media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC Shannon Nelson (1): ionic: fix type complaint in ionic_dev_cmd_clean() Shengjiu Wang (2): ASoC: fsl_spdif: Disable TX clock when stop ASoC: soc-core: skip zero num_dai component in searching dai name Shin'ichiro Kawasaki (1): block: limit request dispatch loop duration Si-Wei Liu (1): vdpa/mlx5: should verify CTRL_VQ feature exists for MQ Souptick Joarder (HPE) (1): irqchip/nvic: Release nvic_base upon failure Srinivas Kandagatla (1): ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put Srinivas Pandruvada (1): thermal: int340x: Increase bitmap size Stefano Garzarella (1): tools/virtio: fix virtio_test execution Sunil Goutham (1): hwrng: cavium - Check health status while reading random data Sven Eckelmann (1): batman-adv: Check ptr for NULL before reducing its refcnt Takashi Iwai (1): ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock Takashi Sakamoto (1): ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction Taniya Das (2): clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: qcom: clk-rcg2: Update the frac table for pixel clock Theodore Ts'o (1): ext4: don't BUG if someone dirty pages without asking ext4 first Thomas Bracht Laumann Jespersen (1): scripts/dtc: Call pkg-config POSIXly correct Tim Gardner (1): video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow Tobias Waldekranz (1): net: dsa: mv88e6xxx: Enable port policy support on 6097 Tom Rix (5): media: video/hdmi: handle short reads of hdmi info frame. drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function qlcnic: dcb: default to returning -EOPNOTSUPP can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value rtc: check if __rtc_read_time was successful Tomas Paukrt (1): crypto: mxs-dcp - Fix scatterlist processing Tong Zhang (1): dax: make sure inodes are flushed before destroy cache Trond Myklebust (3): NFS: Use of mapping_set_error() results in spurious errors NFS: Return valid errors from nfs2/3_decode_dirent() NFSv4/pNFS: Fix another issue with a list iterator pointing to the head Tsuchiya Yuto (1): media: atomisp: fix dummy_ptr check to avoid duplicate active_bo Tudor Ambarus (1): ARM: dts: at91: sama5d2: Fix PMERRLOC resource size Ulf Hansson (1): mmc: host: Return an error when ->enable_sdio_irq() ops is missing Uwe Kleine-König (5): vfio: platform: simplify device removal amba: Make the remove callback return void pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() serial: 8250: Fix race condition in RTS-after-send handling ARM: mmp: Fix failure to remove sram device Vijay Balakrishna (1): arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones Vitaly Kuznetsov (1): KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated Vladimir Oltean (1): net: enetc: report software timestamping via SO_TIMESTAMPING Waiman Long (2): locking/lockdep: Avoid potential access of invalid memory in lock_class locking/lockdep: Iterate lock_classes directly when reading lockdep files Wang Hai (2): video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() wireguard: socket: free skb in send6 when ipv6 is disabled Wang Wensheng (1): ASoC: imx-es8328: Fix error return code in imx_es8328_probe() Wen Gong (1): ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern Xiang Chen (1): scsi: hisi_sas: Change permission of parameter prot_mask Xiaomeng Tong (2): ALSA: cs4236: fix an incorrect NULL check on list iterator net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator Xie Yongji (1): virtio-blk: Use blk_validate_block_size() to validate block size Xin Long (1): udp: call udp_encap_enable for v6 sockets when enabling encap Xin Xiong (1): mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init Xu Kuohai (1): libbpf: Skip forward declaration when counting duplicated type names Yafang Shao (1): libbpf: Fix possible NULL pointer dereference when destroying skeleton Yake Yang (1): Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt Yaliang Wang (1): MIPS: pgalloc: fix memory leak caused by pgd_free() Yang Guang (1): video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit Yang Yingliang (3): media: saa7134: convert list_for_each to entry variant ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() Yangtao Li (1): fsi: aspeed: convert to devm_platform_ioremap_resource Ye Bin (1): ext4: fix fs corruption when tring to remove a non-empty directory with IO error Yi Wang (1): KVM: SVM: fix panic on out-of-bounds guest IRQ Yiqing Yao (1): drm/amd/pm: enable pm sysfs write for one VF mode Yongzhi Liu (1): RDMA/mlx5: Fix memory leak in error flow for subscribe event routine YueHaibing (1): video: fbdev: controlfb: Fix COMPILE_TEST build Z. Liu (1): video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen Zhang Yi (1): ext2: correct max file size computing Zhenzhong Duan (1): KVM: x86: Fix emulation in writing cr8 Zheyu Ma (2): ethernet: sun: Free the coherent when failing in probing video: fbdev: sm712fb: Fix crash in smtcfb_write() Zhou Qingyang (2): drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() kernel test robot (1): regulator: qcom_smd: fix for_each_child.cocci warnings lic121 (1): libbpf: Unmap rings when umem deleted Documentation/admin-guide/sysctl/kernel.rst | 1 + .../bindings/mtd/nand-controller.yaml | 4 +- .../devicetree/bindings/spi/spi-mxic.txt | 4 +- Documentation/process/stable-kernel-rules.rst | 11 +- Documentation/sound/hd-audio/models.rst | 4 + arch/arc/kernel/process.c | 2 +- arch/arm/boot/dts/bcm2711.dtsi | 50 +++++ arch/arm/boot/dts/bcm2837.dtsi | 49 ++++ arch/arm/boot/dts/dra7-l4.dtsi | 5 +- arch/arm/boot/dts/dra7.dtsi | 8 +- arch/arm/boot/dts/exynos5250-pinctrl.dtsi | 2 +- arch/arm/boot/dts/exynos5250-smdk5250.dts | 3 + arch/arm/boot/dts/exynos5420-smdk5420.dts | 3 + arch/arm/boot/dts/imx53-m53menlo.dts | 29 ++- arch/arm/boot/dts/imx7-colibri.dtsi | 4 +- arch/arm/boot/dts/imx7-mba7.dtsi | 2 +- arch/arm/boot/dts/imx7d-nitrogen7.dts | 2 +- arch/arm/boot/dts/imx7d-pico-hobbit.dts | 4 +- arch/arm/boot/dts/imx7d-pico-pi.dts | 4 +- arch/arm/boot/dts/imx7d-sdb.dts | 4 +- arch/arm/boot/dts/imx7s-warp.dts | 4 +- arch/arm/boot/dts/qcom-ipq4019.dtsi | 3 +- arch/arm/boot/dts/qcom-msm8960.dtsi | 8 +- arch/arm/boot/dts/sama5d2.dtsi | 2 +- arch/arm/boot/dts/spear1340.dtsi | 6 +- arch/arm/boot/dts/spear13xx.dtsi | 6 +- arch/arm/boot/dts/sun8i-v3s.dtsi | 22 +- arch/arm/boot/dts/tegra20-tamonten.dtsi | 6 +- arch/arm/configs/multi_v5_defconfig | 1 + arch/arm/crypto/Kconfig | 2 + arch/arm/kernel/entry-ftrace.S | 51 ++--- arch/arm/kernel/swp_emulate.c | 2 +- arch/arm/kernel/traps.c | 2 +- .../mach-iop32x/include/mach/entry-macro.S | 2 +- arch/arm/mach-iop32x/include/mach/irqs.h | 2 +- arch/arm/mach-iop32x/irq.c | 6 +- arch/arm/mach-iop32x/irqs.h | 60 ++--- arch/arm/mach-mmp/sram.c | 22 +- arch/arm/mach-mstar/Kconfig | 1 + arch/arm/mach-s3c/mach-jive.c | 6 +- .../boot/dts/broadcom/northstar2/ns2-svk.dts | 8 +- .../boot/dts/broadcom/northstar2/ns2.dtsi | 2 +- arch/arm64/boot/dts/qcom/sdm845.dtsi | 8 +- arch/arm64/boot/dts/qcom/sm8150.dtsi | 6 +- .../boot/dts/rockchip/rk3399-firefly.dts | 4 +- arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-am65.dtsi | 1 + arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-j7200.dtsi | 1 + arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-j721e.dtsi | 1 + arch/arm64/configs/defconfig | 2 +- arch/arm64/kernel/signal.c | 10 +- arch/arm64/mm/init.c | 36 ++- arch/arm64/mm/mmu.c | 36 ++- arch/arm64/net/bpf_jit_comp.c | 18 +- arch/csky/kernel/perf_callchain.c | 2 +- arch/csky/kernel/signal.c | 2 +- arch/m68k/coldfire/device.c | 6 +- arch/microblaze/include/asm/uaccess.h | 18 +- arch/mips/dec/int-handler.S | 6 +- arch/mips/dec/prom/Makefile | 2 +- arch/mips/dec/setup.c | 3 +- arch/mips/include/asm/dec/prom.h | 15 +- arch/mips/include/asm/pgalloc.h | 6 + arch/mips/rb532/devices.c | 6 +- arch/nios2/include/asm/uaccess.h | 26 ++- arch/nios2/kernel/signal.c | 20 +- arch/parisc/include/asm/traps.h | 1 + arch/parisc/kernel/traps.c | 2 + arch/parisc/mm/fault.c | 89 ++++++++ arch/powerpc/Makefile | 2 +- arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts | 30 +++ arch/powerpc/boot/dts/fsl/t1040rdb.dts | 8 +- arch/powerpc/include/asm/io.h | 40 +++- arch/powerpc/include/asm/uaccess.h | 3 + arch/powerpc/kernel/kvm.c | 2 +- arch/powerpc/kvm/book3s_hv.c | 5 +- arch/powerpc/kvm/powerpc.c | 4 +- arch/powerpc/lib/sstep.c | 12 +- arch/powerpc/mm/kasan/kasan_init_32.c | 3 +- arch/powerpc/mm/numa.c | 4 +- arch/powerpc/perf/imc-pmu.c | 6 +- arch/powerpc/platforms/8xx/pic.c | 1 + arch/powerpc/platforms/powernv/rng.c | 6 +- arch/powerpc/sysdev/fsl_gtm.c | 4 +- arch/riscv/include/asm/module.lds.h | 6 +- arch/riscv/include/asm/thread_info.h | 10 +- arch/riscv/kernel/perf_callchain.c | 6 +- arch/sparc/kernel/signal_32.c | 2 +- arch/um/drivers/mconsole_kern.c | 3 +- arch/x86/events/intel/pt.c | 2 +- arch/x86/kernel/kvm.c | 2 +- arch/x86/kvm/emulate.c | 14 +- arch/x86/kvm/hyperv.c | 9 +- arch/x86/kvm/lapic.c | 5 +- arch/x86/kvm/mmu/tdp_mmu.c | 3 + arch/x86/kvm/svm/avic.c | 10 +- arch/x86/xen/pmu.c | 10 +- arch/x86/xen/pmu.h | 3 +- arch/x86/xen/smp_pv.c | 2 +- arch/xtensa/include/asm/processor.h | 4 +- arch/xtensa/kernel/jump_label.c | 2 +- block/bfq-iosched.c | 16 +- block/blk-mq-sched.c | 9 +- block/blk-sysfs.c | 8 +- crypto/authenc.c | 2 +- crypto/rsa-pkcs1pad.c | 11 +- drivers/acpi/acpica/nswalk.c | 3 + drivers/acpi/apei/bert.c | 10 +- drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/hest.c | 2 +- drivers/acpi/cppc_acpi.c | 5 + drivers/acpi/property.c | 2 +- drivers/amba/bus.c | 5 +- drivers/base/dd.c | 2 +- drivers/base/power/main.c | 6 +- drivers/block/drbd/drbd_req.c | 3 +- drivers/block/loop.c | 10 +- drivers/block/virtio_blk.c | 12 +- drivers/bluetooth/btmtksdio.c | 4 +- drivers/bluetooth/hci_serdev.c | 3 +- drivers/bus/mips_cdmm.c | 1 + drivers/char/hw_random/Kconfig | 2 +- drivers/char/hw_random/atmel-rng.c | 1 + drivers/char/hw_random/cavium-rng-vf.c | 194 +++++++++++++++- drivers/char/hw_random/cavium-rng.c | 11 +- drivers/char/hw_random/nomadik-rng.c | 7 +- drivers/char/tpm/tpm-chip.c | 46 +--- drivers/char/tpm/tpm.h | 2 + drivers/char/tpm/tpm2-space.c | 65 ++++++ drivers/char/virtio_console.c | 7 + drivers/clk/actions/owl-s700.c | 1 + drivers/clk/actions/owl-s900.c | 2 +- drivers/clk/at91/sama7g5.c | 8 +- drivers/clk/clk-clps711x.c | 2 + drivers/clk/clk.c | 13 ++ drivers/clk/imx/clk-imx7d.c | 1 - drivers/clk/loongson1/clk-loongson1c.c | 1 + drivers/clk/qcom/clk-rcg2.c | 14 +- drivers/clk/qcom/gcc-ipq8074.c | 21 +- drivers/clk/qcom/gcc-msm8994.c | 1 + drivers/clk/tegra/clk-tegra124-emc.c | 1 + .../clk/uniphier/clk-uniphier-fixed-rate.c | 1 + drivers/clocksource/acpi_pm.c | 6 +- drivers/clocksource/exynos_mct.c | 60 +++-- drivers/clocksource/timer-microchip-pit64b.c | 2 +- drivers/clocksource/timer-of.c | 6 +- drivers/clocksource/timer-ti-dm-systimer.c | 4 +- drivers/cpufreq/qcom-cpufreq-nvmem.c | 2 +- .../allwinner/sun8i-ce/sun8i-ce-cipher.c | 3 + .../crypto/allwinner/sun8i-ce/sun8i-ce-hash.c | 3 + .../allwinner/sun8i-ss/sun8i-ss-cipher.c | 3 + .../crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 2 + .../crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 3 + drivers/crypto/amlogic/amlogic-gxl-cipher.c | 2 + drivers/crypto/ccp/ccp-dmaengine.c | 16 ++ drivers/crypto/ccree/cc_buffer_mgr.c | 7 + drivers/crypto/ccree/cc_cipher.c | 2 +- drivers/crypto/mxs-dcp.c | 2 +- .../crypto/rockchip/rk3288_crypto_skcipher.c | 1 - drivers/crypto/vmx/Kconfig | 4 + drivers/dax/super.c | 1 + drivers/dma-buf/udmabuf.c | 4 + drivers/dma/hisi_dma.c | 2 +- drivers/dma/pl330.c | 3 +- drivers/firmware/efi/efi-pstore.c | 2 +- drivers/firmware/google/Kconfig | 2 +- drivers/firmware/qcom_scm.c | 6 - drivers/firmware/stratix10-svc.c | 2 +- drivers/fsi/fsi-master-aspeed.c | 21 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 +- .../display/dc/irq/dcn21/irq_service_dcn21.c | 14 -- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 4 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 2 +- drivers/gpu/drm/bridge/adv7511/adv7511.h | 1 + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 29 ++- drivers/gpu/drm/bridge/cdns-dsi.c | 1 + drivers/gpu/drm/bridge/nwl-dsi.c | 1 + drivers/gpu/drm/bridge/sil-sii8620.c | 2 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 5 +- drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c | 1 + drivers/gpu/drm/drm_edid.c | 11 +- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 2 +- drivers/gpu/drm/meson/meson_drv.c | 6 +- drivers/gpu/drm/meson/meson_osd_afbcd.c | 41 ++-- drivers/gpu/drm/meson/meson_osd_afbcd.h | 1 + drivers/gpu/drm/mgag200/mgag200_mode.c | 5 +- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 +- drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 8 + drivers/gpu/drm/msm/dp/dp_display.c | 5 + .../gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c | 9 +- drivers/gpu/drm/panfrost/panfrost_gpu.c | 5 +- drivers/gpu/drm/pl111/pl111_drv.c | 4 +- drivers/gpu/drm/tegra/dsi.c | 4 +- drivers/gpu/host1x/dev.c | 1 + drivers/greybus/svc.c | 8 +- drivers/hid/hid-logitech-dj.c | 1 + drivers/hid/i2c-hid/i2c-hid-core.c | 32 ++- drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 29 +-- drivers/hv/Kconfig | 1 + drivers/hv/hv_balloon.c | 2 +- drivers/hwmon/pmbus/pmbus.h | 1 + drivers/hwmon/pmbus/pmbus_core.c | 18 +- drivers/hwmon/sch56xx-common.c | 2 +- drivers/hwtracing/coresight/coresight-catu.c | 3 +- .../hwtracing/coresight/coresight-cpu-debug.c | 4 +- .../hwtracing/coresight/coresight-cti-core.c | 4 +- drivers/hwtracing/coresight/coresight-etb10.c | 4 +- .../coresight/coresight-etm3x-core.c | 4 +- .../coresight/coresight-etm4x-core.c | 4 +- .../coresight/coresight-etm4x-sysfs.c | 8 +- .../hwtracing/coresight/coresight-funnel.c | 4 +- .../coresight/coresight-replicator.c | 4 +- drivers/hwtracing/coresight/coresight-stm.c | 4 +- .../hwtracing/coresight/coresight-tmc-core.c | 4 +- drivers/hwtracing/coresight/coresight-tpiu.c | 4 +- drivers/i2c/busses/i2c-meson.c | 12 +- drivers/i2c/busses/i2c-nomadik.c | 4 +- drivers/i2c/busses/i2c-xiic.c | 3 +- drivers/i2c/muxes/i2c-demux-pinctrl.c | 5 +- drivers/iio/accel/mma8452.c | 29 ++- drivers/iio/adc/twl6030-gpadc.c | 2 + drivers/iio/afe/iio-rescale.c | 8 +- drivers/iio/inkern.c | 40 +++- drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/verbs.c | 1 + drivers/infiniband/hw/hfi1/verbs.c | 3 +- drivers/infiniband/hw/mlx5/devx.c | 4 +- drivers/infiniband/hw/mlx5/mr.c | 2 + drivers/input/input.c | 6 - drivers/input/serio/ambakmi.c | 3 +- drivers/input/touchscreen/zinitix.c | 44 +++- drivers/iommu/iova.c | 5 +- drivers/iommu/ipmmu-vmsa.c | 4 +- drivers/irqchip/irq-nvic.c | 2 + drivers/irqchip/qcom-pdc.c | 5 +- drivers/mailbox/imx-mailbox.c | 9 + drivers/mailbox/tegra-hsp.c | 5 + drivers/md/dm-crypt.c | 2 +- drivers/md/dm-integrity.c | 6 +- drivers/media/i2c/adv7511-v4l2.c | 2 +- drivers/media/i2c/adv7604.c | 2 +- drivers/media/i2c/adv7842.c | 2 +- drivers/media/pci/bt8xx/bttv-driver.c | 4 +- drivers/media/pci/cx88/cx88-mpeg.c | 3 + drivers/media/pci/ivtv/ivtv-driver.h | 1 - drivers/media/pci/ivtv/ivtv-ioctl.c | 10 +- drivers/media/pci/ivtv/ivtv-streams.c | 11 +- drivers/media/pci/saa7134/saa7134-alsa.c | 8 +- drivers/media/platform/aspeed-video.c | 9 +- drivers/media/platform/coda/coda-common.c | 1 + drivers/media/platform/davinci/vpif.c | 12 +- .../platform/mtk-vcodec/mtk_vcodec_fw_vpu.c | 2 + drivers/media/rc/gpio-ir-tx.c | 28 ++- drivers/media/rc/ir_toy.c | 2 +- .../media/test-drivers/vidtv/vidtv_s302m.c | 17 +- drivers/media/usb/em28xx/em28xx-cards.c | 13 +- drivers/media/usb/go7007/s2250-board.c | 10 +- drivers/media/usb/hdpvr/hdpvr-video.c | 4 +- drivers/media/usb/stk1160/stk1160-core.c | 2 +- drivers/media/usb/stk1160/stk1160-v4l.c | 10 +- drivers/media/usb/stk1160/stk1160.h | 2 +- drivers/media/v4l2-core/v4l2-mem2mem.c | 53 ++++- drivers/memory/emif.c | 8 +- drivers/memory/pl172.c | 4 +- drivers/memory/pl353-smc.c | 4 +- drivers/mfd/asic3.c | 10 +- drivers/mfd/mc13xxx-core.c | 4 +- drivers/misc/cardreader/alcor_pci.c | 9 +- drivers/misc/habanalabs/common/debugfs.c | 2 + drivers/misc/kgdbts.c | 4 +- drivers/misc/mei/hw-me-regs.h | 1 + drivers/misc/mei/interrupt.c | 35 ++- drivers/misc/mei/pci-me.c | 1 + drivers/mmc/core/host.c | 15 +- drivers/mmc/host/davinci_mmc.c | 6 +- drivers/mmc/host/mmci.c | 4 +- drivers/mtd/nand/onenand/generic.c | 7 +- drivers/mtd/nand/raw/atmel/nand-controller.c | 14 +- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 3 + drivers/mtd/nand/raw/nand_base.c | 44 ++-- drivers/net/bareudp.c | 25 +-- drivers/net/can/m_can/m_can.c | 5 +- .../net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +- drivers/net/can/usb/mcba_usb.c | 26 ++- drivers/net/can/vxcan.c | 2 +- drivers/net/dsa/bcm_sf2_cfp.c | 6 +- drivers/net/dsa/microchip/ksz8795_spi.c | 11 + drivers/net/dsa/microchip/ksz9477_spi.c | 12 + drivers/net/dsa/mv88e6xxx/chip.c | 1 + drivers/net/ethernet/8390/mcf8390.c | 10 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 +- .../ethernet/freescale/enetc/enetc_ethtool.c | 5 +- drivers/net/ethernet/intel/i40e/i40e_xsk.c | 16 +- .../net/ethernet/pensando/ionic/ionic_main.c | 6 +- drivers/net/ethernet/qlogic/qed/qed_sriov.c | 1 + .../net/ethernet/qlogic/qlcnic/qlcnic_dcb.h | 10 +- drivers/net/ethernet/sun/sunhme.c | 6 +- .../net/ethernet/xilinx/xilinx_axienet_main.c | 72 +++--- drivers/net/phy/broadcom.c | 21 ++ drivers/net/wireguard/queueing.c | 3 +- drivers/net/wireguard/socket.c | 5 +- drivers/net/wireless/ath/ath10k/snoc.c | 2 +- drivers/net/wireless/ath/ath10k/wow.c | 7 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 5 + drivers/net/wireless/ath/carl9170/main.c | 2 +- .../broadcom/brcm80211/brcmfmac/firmware.c | 2 + .../broadcom/brcm80211/brcmfmac/pcie.c | 66 ++---- .../net/wireless/intel/iwlwifi/dvm/mac80211.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 +- .../net/wireless/mediatek/mt76/mt7603/main.c | 3 + .../net/wireless/mediatek/mt76/mt7615/main.c | 3 + .../net/wireless/mediatek/mt76/mt7915/mcu.c | 9 +- drivers/net/wireless/ray_cs.c | 6 + drivers/nvdimm/region_devs.c | 3 + drivers/nvme/host/core.c | 9 +- drivers/nvme/host/tcp.c | 40 ++++ drivers/pci/controller/pci-aardvark.c | 4 +- drivers/pci/controller/pci-xgene.c | 35 ++- drivers/pci/hotplug/pciehp_hpc.c | 2 + drivers/pci/quirks.c | 12 + drivers/phy/phy-core-mipi-dphy.c | 4 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 2 + drivers/pinctrl/mediatek/pinctrl-paris.c | 30 ++- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 4 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 185 ++++++++-------- drivers/pinctrl/pinconf-generic.c | 6 +- drivers/pinctrl/pinctrl-rockchip.c | 2 + drivers/pinctrl/renesas/core.c | 5 +- drivers/pinctrl/renesas/pfc-r8a77470.c | 4 +- drivers/pinctrl/samsung/pinctrl-samsung.c | 30 ++- drivers/platform/chrome/Makefile | 3 +- .../platform/chrome/cros_ec_sensorhub_ring.c | 3 +- .../platform/chrome/cros_ec_sensorhub_trace.h | 123 +++++++++++ drivers/platform/chrome/cros_ec_trace.h | 95 -------- drivers/platform/chrome/cros_ec_typec.c | 6 + drivers/platform/x86/huawei-wmi.c | 13 +- drivers/power/reset/gemini-poweroff.c | 4 +- drivers/power/supply/ab8500_fg.c | 4 +- drivers/power/supply/bq24190_charger.c | 7 +- drivers/power/supply/wm8350_power.c | 97 ++++++-- drivers/pwm/pwm-lpc18xx-sct.c | 20 +- drivers/regulator/qcom_smd-regulator.c | 4 +- .../regulator/rpi-panel-attiny-regulator.c | 56 ++++- drivers/remoteproc/qcom_q6v5_adsp.c | 1 + drivers/remoteproc/qcom_q6v5_mss.c | 11 +- drivers/remoteproc/qcom_wcnss.c | 1 + drivers/remoteproc/remoteproc_debugfs.c | 2 +- drivers/rtc/interface.c | 7 +- drivers/rtc/rtc-pl030.c | 4 +- drivers/rtc/rtc-pl031.c | 4 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- drivers/scsi/libsas/sas_ata.c | 2 +- drivers/scsi/pm8001/pm8001_hwi.c | 23 +- drivers/scsi/pm8001/pm80xx_hwi.c | 209 ++++++++++-------- drivers/scsi/qla2xxx/qla_attr.c | 7 +- drivers/scsi/qla2xxx/qla_def.h | 10 +- drivers/scsi/qla2xxx/qla_gs.c | 5 +- drivers/scsi/qla2xxx/qla_init.c | 73 ++++-- drivers/scsi/qla2xxx/qla_iocb.c | 8 +- drivers/scsi/qla2xxx/qla_isr.c | 1 + drivers/scsi/qla2xxx/qla_mbx.c | 14 +- drivers/scsi/qla2xxx/qla_nvme.c | 22 ++ drivers/scsi/qla2xxx/qla_os.c | 8 +- drivers/scsi/qla2xxx/qla_sup.c | 4 +- drivers/scsi/qla2xxx/qla_target.c | 4 +- drivers/soc/qcom/ocmem.c | 1 + drivers/soc/qcom/qcom_aoss.c | 2 +- drivers/soc/qcom/rpmpd.c | 3 + drivers/soc/ti/wkup_m3_ipc.c | 4 +- drivers/soundwire/intel.c | 4 +- drivers/spi/spi-mxic.c | 28 +-- drivers/spi/spi-pl022.c | 5 +- drivers/spi/spi-pxa2xx-pci.c | 17 +- drivers/spi/spi-tegra114.c | 4 + drivers/spi/spi-tegra20-slink.c | 8 +- drivers/spi/spi-zynqmp-gqspi.c | 5 +- drivers/spi/spi.c | 4 +- drivers/staging/iio/adc/ad7280a.c | 4 +- .../staging/media/atomisp/pci/atomisp_acc.c | 28 ++- .../media/atomisp/pci/atomisp_gmin_platform.c | 18 ++ drivers/staging/media/atomisp/pci/hmm/hmm.c | 7 +- .../staging/media/hantro/hantro_h1_jpeg_enc.c | 2 +- drivers/staging/media/hantro/hantro_h1_regs.h | 2 +- drivers/staging/media/meson/vdec/esparser.c | 7 +- .../staging/media/meson/vdec/vdec_helpers.c | 8 +- .../staging/media/meson/vdec/vdec_helpers.h | 4 +- .../staging/media/sunxi/cedrus/cedrus_h264.c | 2 +- .../staging/media/sunxi/cedrus/cedrus_h265.c | 2 +- drivers/staging/media/zoran/zoran.h | 2 +- drivers/staging/media/zoran/zoran_card.c | 86 ++++--- drivers/staging/media/zoran/zoran_device.c | 7 +- drivers/staging/media/zoran/zoran_driver.c | 18 +- drivers/staging/mt7621-dts/gbpc1.dts | 40 ++-- drivers/staging/mt7621-dts/gbpc2.dts | 116 +++++++++- drivers/staging/mt7621-dts/mt7621.dtsi | 26 ++- .../intel/int340x_thermal/int3400_thermal.c | 7 +- drivers/tty/hvc/hvc_iucv.c | 4 +- drivers/tty/mxser.c | 15 +- drivers/tty/serial/8250/8250_dma.c | 11 +- drivers/tty/serial/8250/8250_lpss.c | 28 ++- drivers/tty/serial/8250/8250_mid.c | 19 +- drivers/tty/serial/8250/8250_port.c | 16 +- drivers/tty/serial/amba-pl010.c | 4 +- drivers/tty/serial/amba-pl011.c | 3 +- drivers/tty/serial/kgdboc.c | 6 +- drivers/tty/serial/serial_core.c | 14 ++ drivers/usb/host/xhci-hub.c | 5 +- drivers/usb/host/xhci-mem.c | 2 +- drivers/usb/host/xhci.c | 20 +- drivers/usb/host/xhci.h | 14 +- drivers/usb/serial/Kconfig | 1 + drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 3 + drivers/usb/serial/usb-serial-simple.c | 7 + drivers/usb/storage/ene_ub6250.c | 155 +++++++------ drivers/usb/storage/realtek_cr.c | 2 +- drivers/vdpa/mlx5/net/mlx5_vnet.c | 18 +- drivers/vfio/platform/vfio_amba.c | 15 +- drivers/video/fbdev/amba-clcd.c | 4 +- drivers/video/fbdev/atafb.c | 12 +- drivers/video/fbdev/atmel_lcdfb.c | 11 +- drivers/video/fbdev/cirrusfb.c | 16 +- drivers/video/fbdev/controlfb.c | 6 +- drivers/video/fbdev/core/fbcvt.c | 53 ++--- drivers/video/fbdev/matrox/matroxfb_base.c | 2 +- drivers/video/fbdev/nvidia/nv_i2c.c | 2 +- .../omap2/omapfb/displays/connector-dvi.c | 1 + .../omap2/omapfb/displays/panel-dsi-cm.c | 8 +- .../omapfb/displays/panel-sony-acx565akm.c | 2 +- .../omapfb/displays/panel-tpo-td043mtea1.c | 4 +- drivers/video/fbdev/sm712fb.c | 46 +--- drivers/video/fbdev/smscufx.c | 3 +- drivers/video/fbdev/udlfb.c | 8 +- drivers/video/fbdev/w100fb.c | 15 +- drivers/watchdog/rti_wdt.c | 1 + drivers/watchdog/sp805_wdt.c | 4 +- fs/binfmt_elf.c | 24 +- fs/btrfs/reflink.c | 7 +- fs/cifs/smb2ops.c | 130 ++++++----- fs/coredump.c | 39 +++- fs/exec.c | 26 ++- fs/ext2/super.c | 6 +- fs/ext4/inline.c | 9 +- fs/ext4/inode.c | 25 +++ fs/ext4/mballoc.c | 126 ++++++----- fs/ext4/namei.c | 10 +- fs/f2fs/checkpoint.c | 8 +- fs/f2fs/compress.c | 5 +- fs/f2fs/data.c | 9 +- fs/f2fs/file.c | 5 +- fs/f2fs/gc.c | 4 +- fs/f2fs/inode.c | 1 + fs/f2fs/node.c | 6 +- fs/f2fs/segment.c | 7 + fs/f2fs/super.c | 6 +- fs/f2fs/sysfs.c | 2 +- fs/file.c | 31 ++- fs/gfs2/rgrp.c | 3 +- fs/io_uring.c | 7 +- fs/jfs/jfs_dmap.c | 7 + fs/nfs/callback_proc.c | 27 +-- fs/nfs/callback_xdr.c | 4 - fs/nfs/nfs2xdr.c | 2 +- fs/nfs/nfs3xdr.c | 21 +- fs/nfs/nfs4proc.c | 1 + fs/nfs/pnfs.c | 11 + fs/nfs/pnfs.h | 2 + fs/nfs/write.c | 5 +- fs/nfsd/filecache.c | 6 +- fs/nfsd/nfs4state.c | 12 +- fs/nfsd/nfsproc.c | 2 +- fs/nfsd/xdr.h | 2 +- fs/ntfs/inode.c | 4 + fs/proc/bootconfig.c | 2 + fs/pstore/platform.c | 38 ++-- include/linux/amba/bus.h | 2 +- include/linux/mtd/rawnand.h | 2 + include/linux/pstore.h | 6 +- include/linux/serial_core.h | 2 + include/linux/soc/ti/ti_sci_protocol.h | 2 +- include/linux/sunrpc/xdr.h | 2 + include/net/udp.h | 1 + include/net/udp_tunnel.h | 3 +- include/sound/pcm.h | 1 + include/trace/events/ext4.h | 78 ++++--- include/trace/events/rxrpc.h | 8 +- include/uapi/linux/bpf.h | 12 +- kernel/audit.h | 4 + kernel/auditsc.c | 87 ++++++-- kernel/bpf/stackmap.c | 56 ++--- kernel/debug/kdb/kdb_support.c | 2 +- kernel/dma/debug.c | 4 +- kernel/events/core.c | 3 + kernel/locking/lockdep.c | 38 ++-- kernel/locking/lockdep_internals.h | 6 +- kernel/locking/lockdep_proc.c | 51 ++++- kernel/power/hibernate.c | 2 +- kernel/power/suspend_test.c | 8 +- kernel/printk/printk.c | 6 +- kernel/rseq.c | 9 + kernel/sched/core.c | 1 + kernel/sched/debug.c | 10 - kernel/watch_queue.c | 4 +- lib/kunit/try-catch.c | 2 +- lib/raid6/test/Makefile | 4 +- lib/raid6/test/test.c | 1 - lib/test_kmod.c | 1 + lib/test_lockup.c | 11 +- lib/test_xarray.c | 22 ++ lib/xarray.c | 4 + mm/kmemleak.c | 9 +- mm/madvise.c | 3 +- mm/memcontrol.c | 2 +- mm/memory.c | 17 +- mm/mempolicy.c | 8 +- mm/mmap.c | 2 +- mm/page_alloc.c | 9 +- mm/usercopy.c | 5 +- net/batman-adv/bridge_loop_avoidance.c | 6 + net/batman-adv/distributed-arp-table.c | 3 + net/batman-adv/gateway_client.c | 12 +- net/batman-adv/gateway_client.h | 16 +- net/batman-adv/hard-interface.h | 3 + net/batman-adv/network-coding.c | 6 + net/batman-adv/originator.c | 72 +----- net/batman-adv/originator.h | 96 +++++++- net/batman-adv/soft-interface.c | 15 +- net/batman-adv/soft-interface.h | 16 +- net/batman-adv/tp_meter.c | 3 + net/batman-adv/translation-table.c | 22 +- net/batman-adv/translation-table.h | 18 +- net/batman-adv/tvlv.c | 6 + net/bluetooth/hci_conn.c | 2 + net/can/isotp.c | 69 +++--- net/ipv4/route.c | 18 +- net/ipv4/tcp_output.c | 5 +- net/ipv4/udp.c | 6 + net/ipv6/udp.c | 4 +- net/ipv6/xfrm6_output.c | 16 ++ net/netfilter/nf_conntrack_proto_tcp.c | 17 +- net/netlink/af_netlink.c | 2 + net/openvswitch/conntrack.c | 118 +++++----- net/openvswitch/flow_netlink.c | 4 +- net/rxrpc/ar-internal.h | 15 +- net/rxrpc/call_event.c | 2 +- net/rxrpc/call_object.c | 40 +++- net/sunrpc/xprt.c | 7 + net/tipc/socket.c | 3 +- net/xfrm/xfrm_interface.c | 5 +- samples/bpf/xdpsock_user.c | 5 +- scripts/dtc/Makefile | 2 +- scripts/gcc-plugins/stackleak_plugin.c | 25 ++- security/integrity/evm/evm_main.c | 2 +- security/keys/keyctl_pkey.c | 14 +- security/security.c | 17 +- security/selinux/hooks.c | 11 +- security/selinux/include/policycap.h | 1 + security/selinux/include/policycap_names.h | 3 +- security/selinux/include/security.h | 7 + security/selinux/selinuxfs.c | 2 + security/selinux/xfrm.c | 2 +- security/smack/smack_lsm.c | 2 +- security/tomoyo/load_policy.c | 4 +- sound/arm/aaci.c | 4 +- sound/core/pcm.c | 1 + sound/core/pcm_lib.c | 9 +- sound/core/pcm_native.c | 39 +++- sound/firewire/fcp.c | 4 +- sound/isa/cs423x/cs4236.c | 8 +- sound/pci/hda/patch_hdmi.c | 8 +- sound/pci/hda/patch_realtek.c | 15 +- sound/soc/atmel/atmel_ssc_dai.c | 5 +- sound/soc/atmel/sam9g20_wm8731.c | 1 + sound/soc/atmel/sam9x5_wm8731.c | 16 +- sound/soc/codecs/Kconfig | 5 + sound/soc/codecs/msm8916-wcd-analog.c | 22 +- sound/soc/codecs/msm8916-wcd-digital.c | 5 +- sound/soc/codecs/mt6358.c | 4 + sound/soc/codecs/rt5663.c | 2 + sound/soc/codecs/wcd934x.c | 6 +- sound/soc/codecs/wm8350.c | 28 ++- sound/soc/dwc/dwc-i2s.c | 17 +- sound/soc/fsl/fsl_spdif.c | 2 + sound/soc/fsl/imx-es8328.c | 1 + sound/soc/generic/simple-card-utils.c | 2 +- sound/soc/mxs/mxs-saif.c | 5 +- sound/soc/mxs/mxs-sgtl5000.c | 3 + sound/soc/rockchip/rockchip_i2s.c | 18 +- sound/soc/sh/fsi.c | 19 +- sound/soc/soc-compress.c | 5 + sound/soc/soc-core.c | 2 +- sound/soc/soc-generic-dmaengine-pcm.c | 6 +- sound/soc/soc-topology.c | 3 +- sound/soc/sof/imx/imx8m.c | 1 + sound/soc/sof/intel/hda-loader.c | 11 +- sound/soc/ti/davinci-i2s.c | 5 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 25 +++ sound/spi/at73c213.c | 27 ++- tools/include/uapi/linux/bpf.h | 4 +- tools/lib/bpf/btf_dump.c | 5 + tools/lib/bpf/libbpf.c | 3 + tools/lib/bpf/xsk.c | 11 + .../selftests/bpf/progs/test_sock_fields.c | 2 +- .../testing/selftests/bpf/test_lirc_mode2.sh | 5 +- .../selftests/bpf/test_lwt_ip_encap.sh | 10 +- .../selftests/net/test_vxlan_under_vrf.sh | 8 +- tools/testing/selftests/vm/Makefile | 6 +- tools/testing/selftests/x86/Makefile | 6 +- tools/testing/selftests/x86/check_cc.sh | 2 +- tools/virtio/virtio_test.c | 1 + virt/kvm/kvm_main.c | 13 ++ 613 files changed, 4980 insertions(+), 2512 deletions(-) create mode 100644 arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts create mode 100644 drivers/platform/chrome/cros_ec_sensorhub_trace.h -- 2.20.1

1 557

[PATCH openEuler-1.0-LTS 00/16] intel CVEs fix
by Yongqiang Liu 06 Jul '22

06 Jul '22

CVE-2022-21123,CVE-2022-21125,CVE-2022-21166 Gayatri Kammela (2): x86/cpu: Add Elkhart Lake to Intel family x86/cpu: Add another Alder Lake CPU to the Intel family Guenter Roeck (1): cpu/speculation: Add prototype for cpu_show_srbds() Josh Poimboeuf (1): x86/speculation/mmio: Print SMT warning Pawan Gupta (10): Documentation: Add documentation for Processor MMIO Stale Data x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug x86/speculation: Add a common function for MD_CLEAR mitigation update x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations x86/speculation/mmio: Enable CPU Fill buffer clearing on idle x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data x86/speculation/srbds: Update SRBDS mitigation selection x86/speculation/mmio: Reuse SRBDS mitigation for SBDS KVM: x86/speculation: Disable Fill buffer clear within guests Tony Luck (1): x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family Zhang Rui (1): x86/cpu: Add Jasper Lake to Intel family .../ABI/testing/sysfs-devices-system-cpu | 1 + Documentation/admin-guide/hw-vuln/index.rst | 1 + .../hw-vuln/processor_mmio_stale_data.rst | 246 ++++++++++++++++++ .../admin-guide/kernel-parameters.txt | 36 +++ arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/intel-family.h | 11 + arch/x86/include/asm/msr-index.h | 25 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 235 ++++++++++++++--- arch/x86/kernel/cpu/common.c | 52 +++- arch/x86/kvm/vmx.c | 76 +++++- arch/x86/kvm/x86.c | 4 + drivers/base/cpu.c | 8 + include/linux/cpu.h | 4 + 14 files changed, 662 insertions(+), 40 deletions(-) create mode 100644 Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst -- 2.25.1

1 16

[PATCH openEuler-1.0-LTS 1/4] fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages
by Yongqiang Liu 06 Jul '22

06 Jul '22

From: Zhihao Cheng <chengzhihao1(a)huawei.com> mainline inclusion from mainline-5.19-rc1 commit 68f4c6eba70df70a720188bce95c85570ddfcc87 category: bugfix bugzilla: 186540, https://gitee.com/openeuler/kernel/issues/I55AKK CVE: NA -------------------------------- Commit 505a666ee3fc ("writeback: plug writeback in wb_writeback() and writeback_inodes_wb()") has us holding a plug during wb_writeback, which may cause a potential ABBA dead lock: wb_writeback fat_file_fsync blk_start_plug(&plug) for (;;) { iter i-1: some reqs have been added into plug->mq_list // LOCK A iter i: progress = __writeback_inodes_wb(wb, work) . writeback_sb_inodes // fat's bdev . __writeback_single_inode . . generic_writepages . . __block_write_full_page . . . . __generic_file_fsync . . . . sync_inode_metadata . . . . writeback_single_inode . . . . __writeback_single_inode . . . . fat_write_inode . . . . __fat_write_inode . . . . sync_dirty_buffer // fat's bdev . . . . lock_buffer(bh) // LOCK B . . . . submit_bh . . . . blk_mq_get_tag // LOCK A . . . trylock_buffer(bh) // LOCK B . . . redirty_page_for_writepage . . . wbc->pages_skipped++ . . --wbc->nr_to_write . wrote += write_chunk - wbc.nr_to_write // wrote > 0 . requeue_inode . redirty_tail_locked if (progress) // progress > 0 continue; iter i+1: queue_io // similar process with iter i, infinite for-loop ! } blk_finish_plug(&plug) // flush plug won't be called Above process triggers a hungtask like: [ 399.044861] INFO: task bb:2607 blocked for more than 30 seconds. [ 399.046824] Not tainted 5.18.0-rc1-00005-gefae4d9eb6a2-dirty [ 399.051539] task:bb state:D stack: 0 pid: 2607 ppid: 2426 flags:0x00004000 [ 399.051556] Call Trace: [ 399.051570] __schedule+0x480/0x1050 [ 399.051592] schedule+0x92/0x1a0 [ 399.051602] io_schedule+0x22/0x50 [ 399.051613] blk_mq_get_tag+0x1d3/0x3c0 [ 399.051640] __blk_mq_alloc_requests+0x21d/0x3f0 [ 399.051657] blk_mq_submit_bio+0x68d/0xca0 [ 399.051674] __submit_bio+0x1b5/0x2d0 [ 399.051708] submit_bio_noacct+0x34e/0x720 [ 399.051718] submit_bio+0x3b/0x150 [ 399.051725] submit_bh_wbc+0x161/0x230 [ 399.051734] __sync_dirty_buffer+0xd1/0x420 [ 399.051744] sync_dirty_buffer+0x17/0x20 [ 399.051750] __fat_write_inode+0x289/0x310 [ 399.051766] fat_write_inode+0x2a/0xa0 [ 399.051783] __writeback_single_inode+0x53c/0x6f0 [ 399.051795] writeback_single_inode+0x145/0x200 [ 399.051803] sync_inode_metadata+0x45/0x70 [ 399.051856] __generic_file_fsync+0xa3/0x150 [ 399.051880] fat_file_fsync+0x1d/0x80 [ 399.051895] vfs_fsync_range+0x40/0xb0 [ 399.051929] __x64_sys_fsync+0x18/0x30 In my test, 'need_resched()' (which is imported by 590dca3a71 "fs-writeback: unplug before cond_resched in writeback_sb_inodes") in function 'writeback_sb_inodes()' seldom comes true, unless cond_resched() is deleted from write_cache_pages(). Fix it by correcting wrote number according number of skipped pages in writeback_sb_inodes(). Goto Link to find a reproducer. Link: https://bugzilla.kernel.org/show_bug.cgi?id=215837 Cc: stable(a)vger.kernel.org # v4.3 Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20220510133805.1988292-1-chengzhihao1@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/fs-writeback.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c index 5abb71da2b9a..23a632f02839 100644 --- a/fs/fs-writeback.c +++ b/fs/fs-writeback.c @@ -1568,11 +1568,12 @@ static long writeback_sb_inodes(struct super_block *sb, }; unsigned long start_time = jiffies; long write_chunk; - long wrote = 0; /* count both pages and inodes */ + long total_wrote = 0; /* count both pages and inodes */ while (!list_empty(&wb->b_io)) { struct inode *inode = wb_inode(wb->b_io.prev); struct bdi_writeback *tmp_wb; + long wrote; if (inode->i_sb != sb) { if (work->sb) { @@ -1648,7 +1649,9 @@ static long writeback_sb_inodes(struct super_block *sb, wbc_detach_inode(&wbc); work->nr_pages -= write_chunk - wbc.nr_to_write; - wrote += write_chunk - wbc.nr_to_write; + wrote = write_chunk - wbc.nr_to_write - wbc.pages_skipped; + wrote = wrote < 0 ? 0 : wrote; + total_wrote += wrote; if (need_resched()) { /* @@ -1670,7 +1673,7 @@ static long writeback_sb_inodes(struct super_block *sb, tmp_wb = inode_to_wb_and_lock_list(inode); spin_lock(&inode->i_lock); if (!(inode->i_state & I_DIRTY_ALL)) - wrote++; + total_wrote++; requeue_inode(inode, tmp_wb, &wbc); inode_sync_complete(inode); spin_unlock(&inode->i_lock); @@ -1684,14 +1687,14 @@ static long writeback_sb_inodes(struct super_block *sb, * bail out to wb_writeback() often enough to check * background threshold and other termination conditions. */ - if (wrote) { + if (total_wrote) { if (time_is_before_jiffies(start_time + HZ / 10UL)) break; if (work->nr_pages <= 0) break; } } - return wrote; + return total_wrote; } static long __writeback_inodes_wb(struct bdi_writeback *wb, -- 2.25.1

1 3

[PATCH openEuler-5.10-LTS 01/30] Documentation: Add documentation for Processor MMIO Stale Data
by Zheng Zengkai 05 Jul '22

05 Jul '22

From: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> stable inclusion from stable-v5.10.123 commit f8a85334a57e7842320476ff27be3a5f151da364 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5D5RS CVE: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4419470191386456e0b8ed4eb06a70b0021798a6 upstream Add the admin guide for Processor MMIO stale data vulnerabilities. Signed-off-by: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> Signed-off-by: Borislav Petkov <bp(a)suse.de> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- Documentation/admin-guide/hw-vuln/index.rst | 1 + .../hw-vuln/processor_mmio_stale_data.rst | 246 ++++++++++++++++++ 2 files changed, 247 insertions(+) create mode 100644 Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/admin-guide/hw-vuln/index.rst index ca4dbdd9016d..2adec1e6520a 100644 --- a/Documentation/admin-guide/hw-vuln/index.rst +++ b/Documentation/admin-guide/hw-vuln/index.rst @@ -15,3 +15,4 @@ are configurable at compile, boot or run time. tsx_async_abort multihit.rst special-register-buffer-data-sampling.rst + processor_mmio_stale_data.rst diff --git a/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst new file mode 100644 index 000000000000..9393c50b5afc --- /dev/null +++ b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst @@ -0,0 +1,246 @@ +========================================= +Processor MMIO Stale Data Vulnerabilities +========================================= + +Processor MMIO Stale Data Vulnerabilities are a class of memory-mapped I/O +(MMIO) vulnerabilities that can expose data. The sequences of operations for +exposing data range from simple to very complex. Because most of the +vulnerabilities require the attacker to have access to MMIO, many environments +are not affected. System environments using virtualization where MMIO access is +provided to untrusted guests may need mitigation. These vulnerabilities are +not transient execution attacks. However, these vulnerabilities may propagate +stale data into core fill buffers where the data can subsequently be inferred +by an unmitigated transient execution attack. Mitigation for these +vulnerabilities includes a combination of microcode update and software +changes, depending on the platform and usage model. Some of these mitigations +are similar to those used to mitigate Microarchitectural Data Sampling (MDS) or +those used to mitigate Special Register Buffer Data Sampling (SRBDS). + +Data Propagators +================ +Propagators are operations that result in stale data being copied or moved from +one microarchitectural buffer or register to another. Processor MMIO Stale Data +Vulnerabilities are operations that may result in stale data being directly +read into an architectural, software-visible state or sampled from a buffer or +register. + +Fill Buffer Stale Data Propagator (FBSDP) +----------------------------------------- +Stale data may propagate from fill buffers (FB) into the non-coherent portion +of the uncore on some non-coherent writes. Fill buffer propagation by itself +does not make stale data architecturally visible. Stale data must be propagated +to a location where it is subject to reading or sampling. + +Sideband Stale Data Propagator (SSDP) +------------------------------------- +The sideband stale data propagator (SSDP) is limited to the client (including +Intel Xeon server E3) uncore implementation. The sideband response buffer is +shared by all client cores. For non-coherent reads that go to sideband +destinations, the uncore logic returns 64 bytes of data to the core, including +both requested data and unrequested stale data, from a transaction buffer and +the sideband response buffer. As a result, stale data from the sideband +response and transaction buffers may now reside in a core fill buffer. + +Primary Stale Data Propagator (PSDP) +------------------------------------ +The primary stale data propagator (PSDP) is limited to the client (including +Intel Xeon server E3) uncore implementation. Similar to the sideband response +buffer, the primary response buffer is shared by all client cores. For some +processors, MMIO primary reads will return 64 bytes of data to the core fill +buffer including both requested data and unrequested stale data. This is +similar to the sideband stale data propagator. + +Vulnerabilities +=============== +Device Register Partial Write (DRPW) (CVE-2022-21166) +----------------------------------------------------- +Some endpoint MMIO registers incorrectly handle writes that are smaller than +the register size. Instead of aborting the write or only copying the correct +subset of bytes (for example, 2 bytes for a 2-byte write), more bytes than +specified by the write transaction may be written to the register. On +processors affected by FBSDP, this may expose stale data from the fill buffers +of the core that created the write transaction. + +Shared Buffers Data Sampling (SBDS) (CVE-2022-21125) +---------------------------------------------------- +After propagators may have moved data around the uncore and copied stale data +into client core fill buffers, processors affected by MFBDS can leak data from +the fill buffer. It is limited to the client (including Intel Xeon server E3) +uncore implementation. + +Shared Buffers Data Read (SBDR) (CVE-2022-21123) +------------------------------------------------ +It is similar to Shared Buffer Data Sampling (SBDS) except that the data is +directly read into the architectural software-visible state. It is limited to +the client (including Intel Xeon server E3) uncore implementation. + +Affected Processors +=================== +Not all the CPUs are affected by all the variants. For instance, most +processors for the server market (excluding Intel Xeon E3 processors) are +impacted by only Device Register Partial Write (DRPW). + +Below is the list of affected Intel processors [#f1]_: + + =================== ============ ========= + Common name Family_Model Steppings + =================== ============ ========= + HASWELL_X 06_3FH 2,4 + SKYLAKE_L 06_4EH 3 + BROADWELL_X 06_4FH All + SKYLAKE_X 06_55H 3,4,6,7,11 + BROADWELL_D 06_56H 3,4,5 + SKYLAKE 06_5EH 3 + ICELAKE_X 06_6AH 4,5,6 + ICELAKE_D 06_6CH 1 + ICELAKE_L 06_7EH 5 + ATOM_TREMONT_D 06_86H All + LAKEFIELD 06_8AH 1 + KABYLAKE_L 06_8EH 9 to 12 + ATOM_TREMONT 06_96H 1 + ATOM_TREMONT_L 06_9CH 0 + KABYLAKE 06_9EH 9 to 13 + COMETLAKE 06_A5H 2,3,5 + COMETLAKE_L 06_A6H 0,1 + ROCKETLAKE 06_A7H 1 + =================== ============ ========= + +If a CPU is in the affected processor list, but not affected by a variant, it +is indicated by new bits in MSR IA32_ARCH_CAPABILITIES. As described in a later +section, mitigation largely remains the same for all the variants, i.e. to +clear the CPU fill buffers via VERW instruction. + +New bits in MSRs +================ +Newer processors and microcode update on existing affected processors added new +bits to IA32_ARCH_CAPABILITIES MSR. These bits can be used to enumerate +specific variants of Processor MMIO Stale Data vulnerabilities and mitigation +capability. + +MSR IA32_ARCH_CAPABILITIES +-------------------------- +Bit 13 - SBDR_SSDP_NO - When set, processor is not affected by either the + Shared Buffers Data Read (SBDR) vulnerability or the sideband stale + data propagator (SSDP). +Bit 14 - FBSDP_NO - When set, processor is not affected by the Fill Buffer + Stale Data Propagator (FBSDP). +Bit 15 - PSDP_NO - When set, processor is not affected by Primary Stale Data + Propagator (PSDP). +Bit 17 - FB_CLEAR - When set, VERW instruction will overwrite CPU fill buffer + values as part of MD_CLEAR operations. Processors that do not + enumerate MDS_NO (meaning they are affected by MDS) but that do + enumerate support for both L1D_FLUSH and MD_CLEAR implicitly enumerate + FB_CLEAR as part of their MD_CLEAR support. +Bit 18 - FB_CLEAR_CTRL - Processor supports read and write to MSR + IA32_MCU_OPT_CTRL[FB_CLEAR_DIS]. On such processors, the FB_CLEAR_DIS + bit can be set to cause the VERW instruction to not perform the + FB_CLEAR action. Not all processors that support FB_CLEAR will support + FB_CLEAR_CTRL. + +MSR IA32_MCU_OPT_CTRL +--------------------- +Bit 3 - FB_CLEAR_DIS - When set, VERW instruction does not perform the FB_CLEAR +action. This may be useful to reduce the performance impact of FB_CLEAR in +cases where system software deems it warranted (for example, when performance +is more critical, or the untrusted software has no MMIO access). Note that +FB_CLEAR_DIS has no impact on enumeration (for example, it does not change +FB_CLEAR or MD_CLEAR enumeration) and it may not be supported on all processors +that enumerate FB_CLEAR. + +Mitigation +========== +Like MDS, all variants of Processor MMIO Stale Data vulnerabilities have the +same mitigation strategy to force the CPU to clear the affected buffers before +an attacker can extract the secrets. + +This is achieved by using the otherwise unused and obsolete VERW instruction in +combination with a microcode update. The microcode clears the affected CPU +buffers when the VERW instruction is executed. + +Kernel reuses the MDS function to invoke the buffer clearing: + + mds_clear_cpu_buffers() + +On MDS affected CPUs, the kernel already invokes CPU buffer clear on +kernel/userspace, hypervisor/guest and C-state (idle) transitions. No +additional mitigation is needed on such CPUs. + +For CPUs not affected by MDS or TAA, mitigation is needed only for the attacker +with MMIO capability. Therefore, VERW is not required for kernel/userspace. For +virtualization case, VERW is only needed at VMENTER for a guest with MMIO +capability. + +Mitigation points +----------------- +Return to user space +^^^^^^^^^^^^^^^^^^^^ +Same mitigation as MDS when affected by MDS/TAA, otherwise no mitigation +needed. + +C-State transition +^^^^^^^^^^^^^^^^^^ +Control register writes by CPU during C-state transition can propagate data +from fill buffer to uncore buffers. Execute VERW before C-state transition to +clear CPU fill buffers. + +Guest entry point +^^^^^^^^^^^^^^^^^ +Same mitigation as MDS when processor is also affected by MDS/TAA, otherwise +execute VERW at VMENTER only for MMIO capable guests. On CPUs not affected by +MDS/TAA, guest without MMIO access cannot extract secrets using Processor MMIO +Stale Data vulnerabilities, so there is no need to execute VERW for such guests. + +Mitigation control on the kernel command line +--------------------------------------------- +The kernel command line allows to control the Processor MMIO Stale Data +mitigations at boot time with the option "mmio_stale_data=". The valid +arguments for this option are: + + ========== ================================================================= + full If the CPU is vulnerable, enable mitigation; CPU buffer clearing + on exit to userspace and when entering a VM. Idle transitions are + protected as well. It does not automatically disable SMT. + full,nosmt Same as full, with SMT disabled on vulnerable CPUs. This is the + complete mitigation. + off Disables mitigation completely. + ========== ================================================================= + +If the CPU is affected and mmio_stale_data=off is not supplied on the kernel +command line, then the kernel selects the appropriate mitigation. + +Mitigation status information +----------------------------- +The Linux kernel provides a sysfs interface to enumerate the current +vulnerability status of the system: whether the system is vulnerable, and +which mitigations are active. The relevant sysfs file is: + + /sys/devices/system/cpu/vulnerabilities/mmio_stale_data + +The possible values in this file are: + + .. list-table:: + + * - 'Not affected' + - The processor is not vulnerable + * - 'Vulnerable' + - The processor is vulnerable, but no mitigation enabled + * - 'Vulnerable: Clear CPU buffers attempted, no microcode' + - The processor is vulnerable, but microcode is not updated. The + mitigation is enabled on a best effort basis. + * - 'Mitigation: Clear CPU buffers' + - The processor is vulnerable and the CPU buffer clearing mitigation is + enabled. + +If the processor is vulnerable then the following information is appended to +the above information: + + ======================== =========================================== + 'SMT vulnerable' SMT is enabled + 'SMT disabled' SMT is disabled + 'SMT Host state unknown' Kernel runs in a VM, Host SMT state unknown + ======================== =========================================== + +References +---------- +.. [#f1] Affected Processors + https://www.intel.com/content/www/us/en/developer/topic-technology/software… -- 2.20.1

1 29

[PATCH openEuler-5.10-LTS 000/559] Backport 5.10.110 LTS
by Zheng Zengkai 05 Jul '22

05 Jul '22

Backport 5.10.110 LTS patches from upstream PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" can: m_can: m_can_tx_handler(): fix use after free of skb openvswitch: Fixed nd target mask field in the flow dump. docs: sysctl/kernel: add missing bit to panic_print um: Fix uml_mconsole stop/go ARM: dts: spear13xx: Update SPI dma properties ARM: dts: spear1340: Update serial node properties ASoC: topology: Allow TLV control to be either read or write dt-bindings: spi: mxic: The interrupt property is not mandatory dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: mtd: nand-controller: Fix the reg property description bpf: Fix comment for helper bpf_current_task_under_cgroup() bpf: Adjust BPF stack helper functions to accommodate skip > 0 mm/usercopy: return 1 from hardened_usercopy __setup() handler mm/memcontrol: return 1 from cgroup.memory __setup() handler ARM: 9187/1: JIVE: fix return value of __setup handler mm/mmap: return 1 from stack_guard_gap __setup() handler batman-adv: Check ptr for NULL before reducing its refcnt ASoC: soc-compress: Change the check for codec_dai staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet proc: bootconfig: Add null pointer check can: isotp: restore accidentally removed MSG_PEEK feature platform/chrome: cros_ec_typec: Check for EC device ACPI: CPPC: Avoid out of bounds access when parsing _CPC data riscv module: remove (NOLOAD) io_uring: fix memory leak of uid in files registration ARM: iop32x: offset IRQ numbers by 1 ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function pinctrl: pinconf-generic: Print arguments for bias-pull-* watch_queue: Free the page array when watch_queue is dismantled crypto: arm/aes-neonbs-cbc - Select generic cbc and aes mailbox: imx: fix wakeup failure from freeze mode rxrpc: Fix call timer start racing with call destruction gfs2: Make sure FITRIM minlen is rounded up to fs block size rtc: check if __rtc_read_time was successful XArray: Update the LRU list in xas_split() can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value can: mcba_usb: properly check endpoint type XArray: Fix xas_create_range() when multi-order entry present wireguard: socket: ignore v6 endpoints when ipv6 is disabled wireguard: socket: free skb in send6 when ipv6 is disabled wireguard: queueing: use CFI-safe ptr_ring cleanup function ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM KVM: SVM: fix panic on out-of-bounds guest IRQ KVM: x86: fix sending PV IPI KVM: Prevent module exit until all VMs are freed KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated platform: chrome: Split trace include file scsi: qla2xxx: Use correct feature type field during RFF_ID processing scsi: qla2xxx: Reduce false trigger to login scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() scsi: qla2xxx: Check for firmware dump already collected scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Fix warning for missing error code scsi: qla2xxx: Fix wrong FDMI data for 64G adapter scsi: qla2xxx: Fix scheduling while atomic scsi: qla2xxx: Fix stuck session in gpdb powerpc: Fix build errors with newer binutils powerpc/lib/sstep: Fix build errors with newer binutils powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/kasan: Fix early region not updated correctly KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU ALSA: hda/realtek: Add alc256-samsung-headphone fixup media: atomisp: fix bad usage at error handling logic mmc: host: Return an error when ->enable_sdio_irq() ops is missing media: hdpvr: initialize dev->worker at hdpvr_register_videodev media: Revert "media: em28xx: add missing em28xx_close_extension" video: fbdev: sm712fb: Fix crash in smtcfb_write() ARM: mmp: Fix failure to remove sram device ARM: tegra: tamonten: Fix I2C3 pad setting lib/test_lockup: fix kernel pointer check for separate address spaces uaccess: fix type mismatch warnings from access_ok() media: cx88-mpeg: clear interrupt status register before streaming video ASoC: soc-core: skip zero num_dai component in searching dai name ARM: dts: bcm2711: Add the missing L1/L2 cache information video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() arm64: defconfig: build imx-sdma as a module ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk ARM: ftrace: avoid redundant loads or clobbering IP media: atomisp: fix dummy_ptr check to avoid duplicate active_bo media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards ASoC: madera: Add dependencies on MFD ARM: dts: bcm2837: Add the missing L1/L2 cache information ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit video: fbdev: cirrusfb: check pixclock to avoid divide by zero video: fbdev: w100fb: Reset global state video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow media: ir_toy: free before error exiting media: staging: media: zoran: fix various V4L2 compliance errors media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com media: staging: media: zoran: move videodev alloc ntfs: add sanity check on allocation size f2fs: compress: fix to print raw data size in error path of lz4 decompression NFSD: Fix nfsd_breaker_owns_lease() return values f2fs: fix to do sanity check on curseg->alloc_type ext4: don't BUG if someone dirty pages without asking ext4 first ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb locking/lockdep: Iterate lock_classes directly when reading lockdep files spi: tegra20: Use of_device_get_match_data() nvme-tcp: lockdep: annotate in-kernel sockets parisc: Fix handling off probe non-access faults PM: core: keep irq flags in device_pm_check_callbacks() ACPI/APEI: Limit printable size of BERT table data Revert "Revert "block, bfq: honor already-setup queue merges"" lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 ACPICA: Avoid walking the ACPI Namespace if it is not there fs/binfmt_elf: Fix AT_PHDR for unusual ELF files irqchip/nvic: Release nvic_base upon failure irqchip/qcom-pdc: Fix broken locking Fix incorrect type in assignment of ipv6 port for audit loop: use sysfs_emit() in the sysfs xxx show() selinux: allow FIOCLEX and FIONCLEX with policy capability selinux: use correct type for context length pinctrl: npcm: Fix broken references to chip->parent_device gcc-plugins/stackleak: Exactly match strings instead of prefixes regulator: rpi-panel: Handle I2C errors/timing to the Atmel LSM: general protection fault in legacy_parse_param fs: fix fd table size alignment properly lib/test: use after free in register_test_dev_kmod() fs: fd tables have to be multiples of BITS_PER_LONG net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator NFSv4/pNFS: Fix another issue with a list iterator pointing to the head qlcnic: dcb: default to returning -EOPNOTSUPP selftests: test_vxlan_under_vrf: Fix broken test case net: phy: broadcom: Fix brcm_fet_config_init() net: enetc: report software timestamping via SO_TIMESTAMPING xen: fix is_xen_pmu() clk: Initialize orphan req_rate clk: qcom: gcc-msm8994: Fix gpll4 width kdb: Fix the putarea helper function NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options jfs: fix divide error in dbNextAG driver core: dd: fix return value of __setup handler firmware: google: Properly state IOMEM dependency kgdbts: fix return value of __setup handler serial: 8250: fix XOFF/XON sending when DMA is used kgdboc: fix return value of __setup handler tty: hvc: fix return value of __setup handler pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init staging: mt7621-dts: fix GB-PC2 devicetree staging: mt7621-dts: fix pinctrl properties for ethernet staging: mt7621-dts: fix formatting staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree NFS: remove unneeded check in decode_devicenotify_args() clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver clk: clps711x: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: actions: Terminate clk_div_table with sentinel element nvdimm/region: Fix default alignment for small regions remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma clk: qcom: clk-rcg2: Update the frac table for pixel clock clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: at91: sama7g5: fix parents of PDMCs' GCLK clk: imx7d: Remove audio_mclk_root_clk dma-debug: fix return value of __setup handlers NFS: Return valid errors from nfs2/3_decode_dirent() habanalabs: Add check for pci_enable_device iio: adc: Add check for devm_request_threaded_irq serial: 8250: Fix race condition in RTS-after-send handling NFS: Use of mapping_set_error() results in spurious errors serial: 8250_lpss: Balance reference count for PCI DMA device serial: 8250_mid: Balance reference count for PCI DMA device phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) clk: qcom: ipq8074: Use floor ops for SDCC1 clock pinctrl: renesas: checker: Fix miscalculation of number of states pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel staging:iio:adc:ad7280a: Fix handing of device address bit reversing. iio: mma8452: Fix probe failing when an i2c_device_id is used clk: qcom: ipq8074: fix PCI-E clock oops soundwire: intel: fix wrong register name in intel_shim_wake cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse misc: alcor_pci: Fix an error handling path fsi: Aspeed: Fix a potential double free fsi: aspeed: convert to devm_platform_ioremap_resource pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() mxser: fix xmit_buf leak in activate when LSR == 0xff mfd: asic3: Add missing iounmap() on error asic3_mfd_probe tipc: fix the timer expires after interval 100ms openvswitch: always update flow key after nat tcp: ensure PMTU updates are processed during fastopen net: bcmgenet: Use stronger register read/writes to assure ordering PCI: Avoid broken MSI on SB600 USB devices selftests/bpf/test_lirc_mode2.sh: Exit with proper code i2c: mux: demux-pinctrl: do not deactivate a master that is not active i2c: meson: Fix wrong speed use from probe af_netlink: Fix shift out of bounds in group mask calculation ipv4: Fix route lookups when handling ICMP redirects and PMTU updates Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed selftests/bpf: Fix error reporting from sock_fields programs bareudp: use ipv6_mod_enabled to check if IPv6 enabled can: isotp: support MSG_TRUNC flag when reading from socket can: isotp: return -EADDRNOTAVAIL when reading from unbound socket USB: storage: ums-realtek: fix error code in rts51x_read_mem() samples/bpf, xdpsock: Fix race when running for fix duration of time bpf, sockmap: Fix double uncharge the mem of sk_msg bpf, sockmap: Fix more uncharged while msg has more_data bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full RDMA/mlx5: Fix memory leak in error flow for subscribe event routine mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init MIPS: pgalloc: fix memory leak caused by pgd_free() MIPS: RB532: fix return value of __setup handler mips: cdmm: Fix refcount leak in mips_cdmm_phys_base ath10k: Fix error handling in ath10k_setup_msa_resources vxcan: enable local echo for sent CAN frames powerpc: 8xx: fix a return value error in mpc8xx_pic_init platform/x86: huawei-wmi: check the return value of device_create_file() selftests/bpf: Make test_lwt_ip_encap more stable and faster libbpf: Unmap rings when umem deleted mfd: mc13xxx: Add check for mc13xxx_irq_request powerpc/sysdev: fix incorrect use to determine if list is empty mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n net: axienet: fix RX ring refill allocation failure handling IB/hfi1: Allow larger MTU without AIP power: supply: wm8350-power: Add missing free in free_charger_irq power: supply: wm8350-power: Handle error for wm8350_register_irq i2c: xiic: Make bus names unique hv_balloon: rate-limit "Unhandled message" warning KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() KVM: x86: Fix emulation in writing cr8 powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() libbpf: Skip forward declaration when counting duplicated type names gpu: host1x: Fix a memory leak in 'host1x_remove()' bpf, arm64: Feed byte-offset into bpf line info bpf, arm64: Call build_prologue() first in first JIT pass drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt scsi: hisi_sas: Change permission of parameter prot_mask power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return drm/tegra: Fix reference leak in tegra_dsi_ganged_probe ext2: correct max file size computing TOMOYO: fix __setup handlers return values drm/amd/display: Remove vupdate_int_entry definition RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR scsi: pm8001: Fix abort all task initialization scsi: pm8001: Fix NCQ NON DATA command completion handling scsi: pm8001: Fix NCQ NON DATA command task initialization scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix command initialization in pm80XX_send_read_log() dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS drm/msm/dpu: fix dp audio condition drm/msm/dpu: add DSPP blocks teardown drm/msm/dp: populate connector of struct dp_panel iwlwifi: mvm: Fix an error code in iwl_mvm_up() iwlwifi: Fix -EIO error code that is never returned dax: make sure inodes are flushed before destroy cache IB/cma: Allow XRC INI QPs to set their local ACK timeout drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug drm/amd/pm: enable pm sysfs write for one VF mode iommu/ipmmu-vmsa: Check for error num after setting mask HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init drm/bridge: dw-hdmi: use safe format when first in bridge chain PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge scripts/dtc: Call pkg-config POSIXly correct net: dsa: mv88e6xxx: Enable port policy support on 6097 mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode powerpc/perf: Don't use perf_hw_context for trace IMC PMU KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch ray_cs: Check ioremap return value power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe i40e: respect metadata on XSK Rx to skb i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb KVM: PPC: Fix vmx/vsx mixup in mmio emulation RDMA/core: Set MR type in ib_reg_user_mr ath9k_htc: fix uninit value bugs drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() ionic: fix type complaint in ionic_dev_cmd_clean() drm/edid: Don't clear formats if using deep color mtd: rawnand: gpmi: fix controller timings setting mtd: onenand: Check for error irq Bluetooth: hci_serdev: call init_rwsem() before p->open() udmabuf: validate ubuf->pagecount libbpf: Fix possible NULL pointer dereference when destroying skeleton drm/panfrost: Check for error num after setting mask ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern drm: bridge: adv7511: Fix ADV7535 HPD enablement drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() mmc: davinci_mmc: Handle error for clk_enable ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe ASoC: imx-es8328: Fix error return code in imx_es8328_probe() ASoC: fsl_spdif: Disable TX clock when stop ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: dmaengine: do not use a NULL prepare_slave_config() callback ASoC: SOF: Add missing of_node_put() in imx8m_probe ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() ivtv: fix incorrect device_caps for ivtvfb media: saa7134: fix incorrect use to determine if list is empty media: saa7134: convert list_for_each to entry variant video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of ASoC: fsi: Add check for clk_enable ASoC: wm8350: Handle error for wm8350_register_irq ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe media: vidtv: Check for null return of vzalloc media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction memory: emif: check the pointer temp in get_device_details() memory: emif: Add check for setup_interrupts ASoC: soc-compress: prevent the potentially use of null pointer ASoC: dwc-i2s: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: mxs-saif: Handle errors for clk_enable printk: fix return value of printk.devkmsg __setup handler arm64: dts: broadcom: Fix sata nodename arm64: dts: ns2: Fix spi-cpol and spi-cpha property ALSA: spi: Add check for clk_enable() ASoC: ti: davinci-i2s: Add check for clk_enable() ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() uaccess: fix nios2 and microblaze get_user_8() ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put media: cedrus: h264: Fix neighbour info buffer size media: cedrus: H265: Fix neighbour info buffer size media: usb: go7007: s2250-board: fix leak in probe() media: em28xx: initialize refcount before kref_get media: video/hdmi: handle short reads of hdmi info frame. ARM: dts: imx: Add missing LVDS decoder on M53Menlo ARM: dts: sun8i: v3s: Move the csi1 block to follow address order soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc arm64: dts: qcom: sdm845: fix microphone bias properties and values soc: qcom: aoss: remove spurious IRQF_ONESHOT flags soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem soc: qcom: rpmpd: Check for null return of devm_kcalloc ARM: dts: qcom: ipq4019: fix sleep clock firmware: qcom: scm: Remove reassignment to desc following initializer video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() video: fbdev: controlfb: Fix COMPILE_TEST build video: fbdev: controlfb: Fix set but not used warnings video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen media: aspeed: Correct value for h-total-pixels media: hantro: Fix overfill bottom register field name media: meson: vdec: potential dereference of null pointer media: coda: Fix missing put_device() call in coda_get_vdoa_data ASoC: generic: simple-card-utils: remove useless assignment ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting media: bttv: fix WARNING regression on tunerless devices media: mtk-vcodec: potential dereference of null pointer media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size kunit: make kunit_test_timeout compatible with comment selftests, x86: fix how check_cc.sh is being invoked f2fs: fix compressed file start atomic write may cause data corruption f2fs: compress: remove unneeded read when rewrite whole cluster btrfs: fix unexpected error path when reflinking an inline extent f2fs: fix to avoid potential deadlock nfsd: more robust allocation failure handling in nfsd_file_cache_init f2fs: fix missing free nid in f2fs_handle_failed_inode perf/x86/intel/pt: Fix address filter config for 32-bit kernel perf/core: Fix address filter parser for multiple filters rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() sched/core: Export pelt_thermal_tp sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa f2fs: fix to enable ATGC correctly via gc_idle sysfs interface watch_queue: Actually free the watch watch_queue: Fix NULL dereference in error cleanup io_uring: terminate manual loop iterator loop correctly for non-vecs clocksource: acpi_pm: fix return value of __setup handler hwmon: (pmbus) Add Vin unit off handling hwrng: nomadik - Change clk_disable to clk_disable_unprepare amba: Make the remove callback return void vfio: platform: simplify device removal crypto: ccree - Fix use after free in cc_cipher_exit() crypto: ccp - ccp_dmaengine_unregister release dma channels ACPI: APEI: fix return value of __setup handlers clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() clocksource/drivers/timer-microchip-pit64b: Use notrace clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts clocksource/drivers/exynos_mct: Refactor resources allocation clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix crypto: vmx - add missing dependencies crypto: amlogic - call finalize with bh disabled crypto: sun8i-ce - call finalize with bh disabled crypto: sun8i-ss - call finalize with bh disabled hwrng: atmel - disable trng on failure path spi: spi-zynqmp-gqspi: Handle error for dma_set_mask PM: suspend: fix return value of __setup handler PM: hibernate: fix __setup handler error handling block: don't delete queue kobject before its children nvme: cleanup __nvme_check_ids hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING hwmon: (pmbus) Add mutex to regulator ops spi: pxa2xx-pci: Balance reference count for PCI DMA device crypto: ccree - don't attempt 0 len DMA mappings EVM: fix the evm= __setup handler return value audit: log AUDIT_TIME_* records only from rules crypto: rockchip - ECB does not need IV selftests/x86: Add validity check and allow field splitting arm64/mm: avoid fixmap race condition when create pud mapping spi: tegra114: Add missing IRQ check in tegra_spi_probe thermal: int340x: Check for NULL after calling kmemdup() crypto: mxs-dcp - Fix scatterlist processing crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: sun8i-ss - really disable hash on A80 hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER hwrng: cavium - Check health status while reading random data selinux: check return value of sel_make_avc_files regulator: qcom_smd: fix for_each_child.cocci warnings PCI: xgene: Revert "PCI: xgene: Fix IB window setup" PCI: pciehp: Clear cmd_busy bit in polling mode drm/i915/gem: add missing boundary check in vm_access brcmfmac: pcie: Fix crashes due to early IRQs brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: firmware: Allocate space for default boardrev in nvram xtensa: fix xtensa_wsr always writing 0 xtensa: fix stop_machine_cpuslocked call in patch_text media: davinci: vpif: fix unbalanced runtime PM enable media: davinci: vpif: fix unbalanced runtime PM get media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC DEC: Limit PMAX memory probing to R3k systems crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - only allow with rsa exec: Force single empty string when argv is empty lib/raid6/test: fix multiple definition linking error thermal: int340x: Increase bitmap size pstore: Don't use semaphores in always-atomic-context code carl9170: fix missing bit-wise or operator for tx_params mgag200 fix memmapsl configuration in GCTL6 register ARM: dts: exynos: add missing HDMI supplies on SMDK5420 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: at91: sama5d2: Fix PMERRLOC resource size video: fbdev: atari: Atari 2 bpp (STe) palette bugfix video: fbdev: sm712fb: Fix crash in smtcfb_read() drm/edid: check basic audio support on CEA extension block block: limit request dispatch loop duration mailbox: tegra-hsp: Flush whole channel ext4: fix fs corruption when tring to remove a non-empty directory with IO error ext4: fix ext4_fc_stats trace point coredump: Also dump first pages of non-executable ELF libraries ACPI: properties: Consistently return -ENOENT if there are no more references arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs arm64: signal: nofpsimd: Do not allocate fp/simd context when not available udp: call udp_encap_enable for v6 sockets when enabling encap powerpc/kvm: Fix kvm_use_magic_page can: isotp: sanitize CAN ID checks in isotp_bind() drbd: fix potential silent data corruption dm integrity: set journal entry unused when shrinking device mm/kmemleak: reset tag when compare object pointer mm,hwpoison: unmap poisoned page before invalidation Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" mm: madvise: return correct bytes advised with process_madvise mm: madvise: skip unmapped vma holes passed to process_madvise ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock ALSA: hda: Avoid unsol event during RPM suspending ALSA: cs4236: fix an incorrect NULL check on list iterator cifs: fix NULL ptr dereference in smb2_ioctl_query_info() cifs: prevent bad output lengths in smb2_ioctl_query_info() Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" riscv: Increase stack size under KASAN riscv: Fix fill_callchain return value qed: display VF trust config scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands mempolicy: mbind_range() set_policy() after vma_merge() mm: invalidate hwpoison page cache page in fault path mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node mtd: rawnand: protect access to rawnand devices while in suspend spi: mxic: Fix the transmit path pinctrl: samsung: drop pin banks references on error paths remoteproc: Fix count check in rproc_coredump_write() f2fs: fix to do sanity check on .cp_pack_total_block_count f2fs: quota: fix loop condition at f2fs_quota_sync() f2fs: fix to unlock page correctly in error path of is_alive() NFSD: prevent integer overflow on 32 bit systems NFSD: prevent underflow in nfssvc_decode_writeargs() SUNRPC: avoid race between mod_timer() and del_timer_sync() HID: intel-ish-hid: Use dma_alloc_coherent for firmware update firmware: stratix10-svc: add missing callback parameter on RSU Documentation: update stable tree link Documentation: add link to stable release candidate tree KEYS: fix length validation in keyctl_pkey_params_get_2() clk: uniphier: Fix fixed-rate initialization greybus: svc: fix an error handling bug in gb_svc_hello() iio: inkern: make a best effort on offset calculation iio: inkern: apply consumer scale when no channel scale is available iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: afe: rescale: use s64 for temporary scale calculations coresight: Fix TRCCONFIGR.QE sysfs interface mei: avoid iterator usage outside of list_for_each_entry mei: me: add Alder Lake N device id. xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() xhci: make xhci_handshake timeout for xhci_reset() adjustable xhci: fix runtime PM imbalance in USB2 resume xhci: fix garbage USBSTS being logged in some cases USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c virtio-blk: Use blk_validate_block_size() to validate block size tpm: fix reference counting for struct tpm_chip iommu/iova: Improve 32-bit free space estimate locking/lockdep: Avoid potential access of invalid memory in lock_class net: dsa: microchip: add spi_device_id tables Input: zinitix - do not report shadow fingers spi: Fix erroneous sgs value with min_t() Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" net:mcf8390: Use platform_get_irq() to get the interrupt spi: Fix invalid sgs value gpio: Revert regression in sysfs-gpio (gpiolib.c) ethernet: sun: Free the coherent when failing in probing tools/virtio: fix virtio_test execution vdpa/mlx5: should verify CTRL_VQ feature exists for MQ virtio_console: break out of buf poll on remove ARM: mstar: Select HAVE_ARM_ARCH_TIMER xfrm: fix tunnel model fragmentation behavior HID: logitech-dj: add new lightspeed receiver id hv: utils: add PTP_1588_CLOCK to Kconfig to fix build USB: serial: simple: add Nokia phone driver USB: serial: pl2303: add IBM device IDs already merged(30) arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path KVM: x86/mmu: do compare-and-exchange of gPTE via the user address ubi: fastmap: Return error code if memory allocation fails in add_aeb() ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path ubifs: rename_whiteout: correct old_dir size computing ubifs: Fix to add refcount once page is set private ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() ubifs: setflags: Make dirtied_ino_d 8 bytes aligned ubifs: Add missing iput if do_tmpfile() failed in rename whiteout ubifs: Fix deadlock in concurrent rename whiteout and inode writeback ubifs: rename_whiteout: Fix double free for whiteout_ui->data bfq: fix use-after-free in bfq_dispatch_request net/x25: Fix null-ptr-deref caused by x25_disconnect net: hns3: fix bug when PF set the duplicate MAC address for VFs livepatch: Fix build failure on 32 bits processors bcache: fixup multiple threads crash drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() jffs2: fix memory leak in jffs2_scan_medium jffs2: fix memory leak in jffs2_do_mount_fs jffs2: fix use-after-free in jffs2_clear_xattr_subsystem can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register netdevice: add the case if dev is NULL swiotlb: fix info leak with DMA_FROM_DEVICE block, bfq: don't move oom_bfqq drm/i915/opregion: check port number bounds for SWSCI display power state kabi conflict(8) PCI: Reduce warnings on possible RW1C corruption qed: validate and restrict untrusted VFs vlan promisc mode block: don't merge across cgroup boundaries if blkcg is enabled rseq: Remove broken uapi field layout on 32-bit little endian coredump: Snapshot the vmas in do_coredump coredump: Use the vma snapshot in fill_files_note coredump/elf: Pass coredump_params into fill_note_info coredump: Remove the WARN_ON in dump_vma_snapshot all patches: 597 - 30 - 8 = 559 Aaron Conole (1): openvswitch: always update flow key after nat Aashish Sharma (1): dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS Abel Vesa (2): clk: imx7d: Remove audio_mclk_root_clk ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk Adrian Hunter (2): perf/core: Fix address filter parser for multiple filters perf/x86/intel/pt: Fix address filter config for 32-bit kernel Aharon Landau (1): RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR Akira Kawata (1): fs/binfmt_elf: Fix AT_PHDR for unusual ELF files Alan Stern (1): USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c Alexander Lobakin (2): i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb i40e: respect metadata on XSK Rx to skb Alexander Usyskin (2): mei: me: add Alder Lake N device id. mei: avoid iterator usage outside of list_for_each_entry Alexey Khoroshilov (1): NFS: remove unneeded check in decode_devicenotify_args() Alistair Delva (1): remoteproc: Fix count check in rproc_coredump_write() Alistair Popple (1): mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node Amadeusz Sławiński (1): ASoC: topology: Allow TLV control to be either read or write Amir Goldstein (1): nfsd: more robust allocation failure handling in nfsd_file_cache_init Ammar Faizi (1): ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM Anders Roxell (3): powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/lib/sstep: Fix build errors with newer binutils powerpc: Fix build errors with newer binutils Andre Przywara (1): ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS Andreas Gruenbacher (1): powerpc/kvm: Fix kvm_use_magic_page Andrew Price (1): gfs2: Make sure FITRIM minlen is rounded up to fs block size Andy Shevchenko (3): spi: pxa2xx-pci: Balance reference count for PCI DMA device serial: 8250_mid: Balance reference count for PCI DMA device serial: 8250_lpss: Balance reference count for PCI DMA device Ang Tien Sung (1): firmware: stratix10-svc: add missing callback parameter on RSU Anssi Hannula (3): xhci: fix garbage USBSTS being logged in some cases xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() hv_balloon: rate-limit "Unhandled message" warning Anton Ivanov (1): um: Fix uml_mconsole stop/go Ard Biesheuvel (1): ARM: ftrace: avoid redundant loads or clobbering IP Armin Wolf (1): hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING Arnd Bergmann (4): uaccess: fix nios2 and microblaze get_user_8() uaccess: fix type mismatch warnings from access_ok() lib/test_lockup: fix kernel pointer check for separate address spaces ARM: iop32x: offset IRQ numbers by 1 Arun Easi (2): scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests Arınç ÜNAL (5): staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree staging: mt7621-dts: fix formatting staging: mt7621-dts: fix pinctrl properties for ethernet staging: mt7621-dts: fix GB-PC2 devicetree staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet Athira Rajeev (1): powerpc/perf: Don't use perf_hw_context for trace IMC PMU Bagas Sanjaya (2): Documentation: add link to stable release candidate tree Documentation: update stable tree link Bartosz Golaszewski (1): Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" Bharata B Rao (1): sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa Biju Das (2): spi: Fix invalid sgs value spi: Fix erroneous sgs value with min_t() Bikash Hazarika (1): scsi: qla2xxx: Fix wrong FDMI data for 64G adapter Bjorn Helgaas (1): PCI: Avoid broken MSI on SB600 USB devices Brandon Wyman (1): hwmon: (pmbus) Add Vin unit off handling Casey Schaufler (2): LSM: general protection fault in legacy_parse_param Fix incorrect type in assignment of ipv6 port for audit Chaitanya Kulkarni (1): loop: use sysfs_emit() in the sysfs xxx show() Chao Yu (6): f2fs: fix to unlock page correctly in error path of is_alive() f2fs: fix to do sanity check on .cp_pack_total_block_count f2fs: fix to enable ATGC correctly via gc_idle sysfs interface f2fs: fix to avoid potential deadlock f2fs: fix to do sanity check on curseg->alloc_type f2fs: compress: fix to print raw data size in error path of lz4 decompression Charan Teja Kalla (3): mm: madvise: skip unmapped vma holes passed to process_madvise mm: madvise: return correct bytes advised with process_madvise Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" Charles Keepax (1): ASoC: madera: Add dependencies on MFD Chen Jingwen (1): powerpc/kasan: Fix early region not updated correctly Chen-Yu Tsai (7): media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls media: hantro: Fix overfill bottom register field name pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs pinctrl: pinconf-generic: Print arguments for bias-pull-* Chris Leech (1): nvme-tcp: lockdep: annotate in-kernel sockets Christian Göttsche (2): selinux: check return value of sel_make_avc_files selinux: use correct type for context length Christoph Hellwig (1): nvme: cleanup __nvme_check_ids Christophe JAILLET (4): firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined gpu: host1x: Fix a memory leak in 'host1x_remove()' fsi: Aspeed: Fix a potential double free misc: alcor_pci: Fix an error handling path Chuck Lever (1): NFSD: Fix nfsd_breaker_owns_lease() return values Claudiu Beznea (3): net: dsa: microchip: add spi_device_id tables hwrng: atmel - disable trng on failure path clocksource/drivers/timer-microchip-pit64b: Use notrace Codrin Ciubotariu (2): ASoC: dmaengine: do not use a NULL prepare_slave_config() callback clk: at91: sama7g5: fix parents of PDMCs' GCLK Colin Ian King (2): carl9170: fix missing bit-wise or operator for tx_params iwlwifi: Fix -EIO error code that is never returned Cooper Chiou (1): drm/edid: check basic audio support on CEA extension block Corentin Labbe (8): crypto: sun8i-ss - really disable hash on A80 crypto: rockchip - ECB does not need IV crypto: sun8i-ss - call finalize with bh disabled crypto: sun8i-ce - call finalize with bh disabled crypto: amlogic - call finalize with bh disabled media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size media: staging: media: zoran: move videodev alloc media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com Dafna Hirschfeld (1): media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED Damien Le Moal (11): scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands scsi: pm8001: Fix command initialization in pm80XX_send_read_log() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() scsi: pm8001: Fix NCQ NON DATA command task initialization scsi: pm8001: Fix NCQ NON DATA command completion handling scsi: pm8001: Fix abort all task initialization Dan Carpenter (9): greybus: svc: fix an error handling bug in gb_svc_hello() NFSD: prevent underflow in nfssvc_decode_writeargs() NFSD: prevent integer overflow on 32 bit systems video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() media: usb: go7007: s2250-board: fix leak in probe() iwlwifi: mvm: Fix an error code in iwl_mvm_up() USB: storage: ums-realtek: fix error code in rts51x_read_mem() lib/test: use after free in register_test_dev_kmod() Dan Williams (1): nvdimm/region: Fix default alignment for small regions Daniel González Cabanelas (1): media: cx88-mpeg: clear interrupt status register before streaming video Daniel Henrique Barboza (1): powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() Daniel Palmer (1): ARM: mstar: Select HAVE_ARM_ARCH_TIMER Daniel Thompson (2): soc: qcom: aoss: remove spurious IRQF_ONESHOT flags kdb: Fix the putarea helper function Dario Binacchi (1): mtd: rawnand: gpmi: fix controller timings setting Darren Hart (1): ACPI/APEI: Limit printable size of BERT table data Dave Stevenson (1): regulator: rpi-panel: Handle I2C errors/timing to the Atmel David Engraf (1): arm64: signal: nofpsimd: Do not allocate fp/simd context when not available David Gow (1): firmware: google: Properly state IOMEM dependency David Heidelberg (2): arm64: dts: qcom: sdm845: fix microphone bias properties and values ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 David Howells (3): watch_queue: Fix NULL dereference in error cleanup watch_queue: Actually free the watch rxrpc: Fix call timer start racing with call destruction David Matlack (1): KVM: Prevent module exit until all VMs are freed Dirk Buchwalder (1): clk: qcom: ipq8074: Use floor ops for SDCC1 clock Dirk Müller (1): lib/raid6/test: fix multiple definition linking error Dmitry Baryshkov (3): drm/msm/dpu: add DSPP blocks teardown drm/msm/dpu: fix dp audio condition PM: core: keep irq flags in device_pm_check_callbacks() Dmitry Torokhov (1): HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports Dmitry Vyukov (1): riscv: Increase stack size under KASAN Dongliang Mu (3): media: em28xx: initialize refcount before kref_get ntfs: add sanity check on allocation size media: hdpvr: initialize dev->worker at hdpvr_register_videodev Drew Fustini (1): clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix Dāvis Mosāns (1): crypto: ccp - ccp_dmaengine_unregister release dma channels Eddie James (1): USB: serial: pl2303: add IBM device IDs Eric Biggers (6): KEYS: fix length validation in keyctl_pkey_params_get_2() crypto: rsa-pkcs1pad - only allow with rsa crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() block: don't delete queue kobject before its children Eric Dumazet (2): rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() watch_queue: Free the page array when watch_queue is dismantled Evgeny Novikov (1): video: fbdev: w100fb: Reset global state Fabiano Rosas (2): KVM: PPC: Fix vmx/vsx mixup in mmio emulation KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init Fangrui Song (1): riscv module: remove (NOLOAD) Felix Maurer (1): selftests/bpf: Make test_lwt_ip_encap more stable and faster Fengnan Chang (2): f2fs: compress: remove unneeded read when rewrite whole cluster f2fs: fix compressed file start atomic write may cause data corruption Filipe Manana (1): btrfs: fix unexpected error path when reflinking an inline extent Florian Fainelli (1): net: phy: broadcom: Fix brcm_fet_config_init() Frank Wunderlich (1): arm64: dts: broadcom: Fix sata nodename Geert Uytterhoeven (3): hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel pinctrl: renesas: checker: Fix miscalculation of number of states George Kennedy (1): video: fbdev: cirrusfb: check pixclock to avoid divide by zero Gilad Ben-Yossef (1): crypto: ccree - don't attempt 0 len DMA mappings Guilherme G. Piccoli (1): docs: sysctl/kernel: add missing bit to panic_print Guillaume Nault (1): ipv4: Fix route lookups when handling ICMP redirects and PMTU updates Guillaume Ranquet (1): clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() Guillaume Tucker (1): selftests, x86: fix how check_cc.sh is being invoked Gwendal Grignou (2): HID: intel-ish-hid: Use dma_alloc_coherent for firmware update platform: chrome: Split trace include file Hangbin Liu (2): bareudp: use ipv6_mod_enabled to check if IPv6 enabled selftests/bpf/test_lirc_mode2.sh: Exit with proper code Hangyu Hua (1): powerpc: 8xx: fix a return value error in mpc8xx_pic_init Hans Verkuil (2): ivtv: fix incorrect device_caps for ivtvfb media: staging: media: zoran: fix various V4L2 compliance errors Hans de Goede (3): power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return iio: mma8452: Fix probe failing when an i2c_device_id is used media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards Hector Martin (4): brcmfmac: firmware: Allocate space for default boardrev in nvram brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Fix crashes due to early IRQs Helge Deller (1): video: fbdev: sm712fb: Fix crash in smtcfb_read() Hengqi Chen (1): bpf: Fix comment for helper bpf_current_task_under_cgroup() Henry Lin (1): xhci: fix runtime PM imbalance in USB2 resume Herbert Xu (2): crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: arm/aes-neonbs-cbc - Select generic cbc and aes Hoang Le (1): tipc: fix the timer expires after interval 100ms Hou Tao (2): bpf, arm64: Call build_prologue() first in first JIT pass bpf, arm64: Feed byte-offset into bpf line info Hou Wenlong (1): KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() Hugh Dickins (1): mempolicy: mbind_range() set_policy() after vma_merge() Håkon Bugge (1): IB/cma: Allow XRC INI QPs to set their local ACK timeout Ido Schimmel (1): selftests: test_vxlan_under_vrf: Fix broken test case Ilpo Järvinen (1): serial: 8250: fix XOFF/XON sending when DMA is used Jaegeuk Kim (1): f2fs: fix missing free nid in f2fs_handle_failed_inode Jagan Teki (1): drm: bridge: adv7511: Fix ADV7535 HPD enablement Jakob Koschel (2): media: saa7134: fix incorrect use to determine if list is empty powerpc/sysdev: fix incorrect use to determine if list is empty Jakub Kicinski (1): tcp: ensure PMTU updates are processed during fastopen Jakub Sitnicki (1): selftests/bpf: Fix error reporting from sock_fields programs James Clark (1): coresight: Fix TRCCONFIGR.QE sysfs interface Jammy Huang (1): media: aspeed: Correct value for h-total-pixels Jann Horn (2): coredump: Also dump first pages of non-executable ELF libraries pstore: Don't use semaphores in always-atomic-context code Jason A. Donenfeld (2): wireguard: queueing: use CFI-safe ptr_ring cleanup function wireguard: socket: ignore v6 endpoints when ipv6 is disabled Jens Axboe (1): io_uring: terminate manual loop iterator loop correctly for non-vecs Jeremy Linton (1): net: bcmgenet: Use stronger register read/writes to assure ordering Jernej Skrabec (2): media: cedrus: H265: Fix neighbour info buffer size media: cedrus: h264: Fix neighbour info buffer size Jia-Ju Bai (3): ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() memory: emif: check the pointer temp in get_device_details() platform/x86: huawei-wmi: check the return value of device_create_file() Jianglei Nie (1): crypto: ccree - Fix use after free in cc_cipher_exit() Jianyong Wu (1): arm64/mm: avoid fixmap race condition when create pud mapping Jiasheng Jiang (26): thermal: int340x: Check for NULL after calling kmemdup() spi: spi-zynqmp-gqspi: Handle error for dma_set_mask media: mtk-vcodec: potential dereference of null pointer media: meson: vdec: potential dereference of null pointer soc: qcom: rpmpd: Check for null return of devm_kcalloc ASoC: ti: davinci-i2s: Add check for clk_enable() ALSA: spi: Add check for clk_enable() ASoC: mxs-saif: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: dwc-i2s: Handle errors for clk_enable ASoC: soc-compress: prevent the potentially use of null pointer memory: emif: Add check for setup_interrupts media: vidtv: Check for null return of vzalloc ASoC: wm8350: Handle error for wm8350_register_irq ASoC: fsi: Add check for clk_enable mmc: davinci_mmc: Handle error for clk_enable drm/panfrost: Check for error num after setting mask mtd: onenand: Check for error irq ray_cs: Check ioremap return value iommu/ipmmu-vmsa: Check for error num after setting mask power: supply: wm8350-power: Handle error for wm8350_register_irq power: supply: wm8350-power: Add missing free in free_charger_irq mfd: mc13xxx: Add check for mc13xxx_irq_request iio: adc: Add check for devm_request_threaded_irq habanalabs: Add check for pci_enable_device ASoC: soc-compress: Change the check for codec_dai Jiaxin Yu (1): ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs Jie Hai (1): dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma Jing Yao (3): video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit Jiri Slaby (1): mxser: fix xmit_buf leak in activate when LSR == 0xff Jocelyn Falempe (1): mgag200 fix memmapsl configuration in GCTL6 register Joe Carnuccio (2): scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Check for firmware dump already collected Johan Hovold (3): USB: serial: simple: add Nokia phone driver media: davinci: vpif: fix unbalanced runtime PM get media: davinci: vpif: fix unbalanced runtime PM enable John David Anglin (1): parisc: Fix handling off probe non-access faults Jonathan Cameron (1): staging:iio:adc:ad7280a: Fix handing of device address bit reversing. Jonathan Neuschäfer (5): clk: actions: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: clps711x: Terminate clk_div_table with sentinel element pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() José Expósito (1): Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" Juergen Gross (1): xen: fix is_xen_pmu() Juhyung Park (1): f2fs: quota: fix loop condition at f2fs_quota_sync() Kai-Heng Feng (1): ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 Kees Cook (2): exec: Force single empty string when argv is empty gcc-plugins/stackleak: Exactly match strings instead of prefixes Konrad Dybcio (1): clk: qcom: gcc-msm8994: Fix gpll4 width Krzysztof Kozlowski (5): pinctrl: samsung: drop pin banks references on error paths ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5420 clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts Kuan-Ying Lee (1): mm/kmemleak: reset tag when compare object pointer Kuldeep Singh (3): arm64: dts: ns2: Fix spi-cpol and spi-cpha property ARM: dts: spear1340: Update serial node properties ARM: dts: spear13xx: Update SPI dma properties Kunihiko Hayashi (1): clk: uniphier: Fix fixed-rate initialization Kuogee Hsieh (1): drm/msm/dp: populate connector of struct dp_panel Lars Ellenberg (1): drbd: fix potential silent data corruption Li RongQing (1): KVM: x86: fix sending PV IPI Liam Beguin (4): iio: afe: rescale: use s64 for temporary scale calculations iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: inkern: apply consumer scale when no channel scale is available iio: inkern: make a best effort on offset calculation Libin Yang (1): soundwire: intel: fix wrong register name in intel_shim_wake Liguang Zhang (1): PCI: pciehp: Clear cmd_busy bit in polling mode Lina Wang (1): xfrm: fix tunnel model fragmentation behavior Lino Sanfilippo (1): tpm: fix reference counting for struct tpm_chip Linus Torvalds (2): fs: fd tables have to be multiples of BITS_PER_LONG fs: fix fd table size alignment properly Linus Walleij (1): Input: zinitix - do not report shadow fingers Liu Ying (1): phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) Lorenzo Bianconi (4): mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update Luca Weiss (1): cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse Lucas Tanure (1): i2c: meson: Fix wrong speed use from probe Lucas Zampieri (1): HID: logitech-dj: add new lightspeed receiver id Lv Ruyi (1): proc: bootconfig: Add null pointer check Maciej W. Rozycki (1): DEC: Limit PMAX memory probing to R3k systems Manish Chopra (1): qed: display VF trust config Manish Rangankar (1): scsi: qla2xxx: Use correct feature type field during RFF_ID processing Maor Gottlieb (1): RDMA/core: Set MR type in ib_reg_user_mr Marc Kleine-Budde (1): can: m_can: m_can_tx_handler(): fix use after free of skb Marc Zyngier (4): PCI: xgene: Revert "PCI: xgene: Fix IB window setup" pinctrl: npcm: Fix broken references to chip->parent_device irqchip/qcom-pdc: Fix broken locking PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" Marcel Ziswiler (1): arm64: defconfig: build imx-sdma as a module Marcelo Roberto Jimenez (1): gpio: Revert regression in sysfs-gpio (gpiolib.c) Marek Szyprowski (1): clocksource/drivers/exynos_mct: Refactor resources allocation Marek Vasut (1): ARM: dts: imx: Add missing LVDS decoder on M53Menlo Marijn Suijten (1): firmware: qcom: scm: Remove reassignment to desc following initializer Martin Blumenstingl (1): drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops Martin Varghese (1): openvswitch: Fixed nd target mask field in the flow dump. Mastan Katragadda (1): drm/i915/gem: add missing boundary check in vm_access Mathias Nyman (1): xhci: make xhci_handshake timeout for xhci_reset() adjustable Matt Kramer (1): ALSA: hda/realtek: Add alc256-samsung-headphone fixup Matthew Wilcox (Oracle) (2): XArray: Fix xas_create_range() when multi-order entry present XArray: Update the LRU list in xas_split() Maulik Shah (1): arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc Mauro Carvalho Chehab (1): media: atomisp: fix bad usage at error handling logic Max Filippov (2): xtensa: fix stop_machine_cpuslocked call in patch_text xtensa: fix xtensa_wsr always writing 0 Maxim Kiselev (1): powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch Maxime Ripard (2): drm/edid: Don't clear formats if using deep color clk: Initialize orphan req_rate Maíra Canal (1): drm/amd/display: Remove vupdate_int_entry definition Miaoqian Lin (31): spi: tegra114: Add missing IRQ check in tegra_spi_probe hwrng: nomadik - Change clk_disable to clk_disable_unprepare media: coda: Fix missing put_device() call in coda_get_vdoa_data soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe ASoC: SOF: Add missing of_node_put() in imx8m_probe ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init drm/tegra: Fix reference leak in tegra_dsi_ganged_probe ath10k: Fix error handling in ath10k_setup_msa_resources mips: cdmm: Fix refcount leak in mips_cdmm_phys_base mfd: asic3: Add missing iounmap() on error asic3_mfd_probe remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function Michael Ellerman (1): powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit Michael S. Tsirkin (1): virtio_console: break out of buf poll on remove Michael Schmitz (1): video: fbdev: atari: Atari 2 bpp (STe) palette bugfix Mike Marciniszyn (1): IB/hfi1: Allow larger MTU without AIP Mikulas Patocka (1): dm integrity: set journal entry unused when shrinking device Minghao Chi (1): spi: tegra20: Use of_device_get_match_data() Minghao Chi (CGEL ZTE) (1): net:mcf8390: Use platform_get_irq() to get the interrupt Miquel Raynal (4): spi: mxic: Fix the transmit path dt-bindings: mtd: nand-controller: Fix the reg property description dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: spi: mxic: The interrupt property is not mandatory Mohan Kumar (1): ALSA: hda: Avoid unsol event during RPM suspending Muhammad Usama Anjum (1): selftests/x86: Add validity check and allow field splitting Namhyung Kim (1): bpf: Adjust BPF stack helper functions to accommodate skip > 0 Neil Armstrong (1): drm/bridge: dw-hdmi: use safe format when first in bridge chain NeilBrown (1): SUNRPC: avoid race between mod_timer() and del_timer_sync() Niels Dossche (1): Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed Nikita Shubin (1): riscv: Fix fill_callchain return value Niklas Söderlund (1): samples/bpf, xdpsock: Fix race when running for fix duration of time Nilesh Javali (1): scsi: qla2xxx: Fix warning for missing error code Nishanth Menon (4): arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt Olga Kornievskaia (1): NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error Oliver Hartkopp (5): can: isotp: sanitize CAN ID checks in isotp_bind() vxcan: enable local echo for sent CAN frames can: isotp: return -EADDRNOTAVAIL when reading from unbound socket can: isotp: support MSG_TRUNC flag when reading from socket can: isotp: restore accidentally removed MSG_PEEK feature Ondrej Zary (1): media: bttv: fix WARNING regression on tunerless devices Pablo Neira Ayuso (1): netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options Pali Rohár (1): PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge Paolo Valente (1): Revert "Revert "block, bfq: honor already-setup queue merges"" Patrick Rudolph (1): hwmon: (pmbus) Add mutex to regulator ops Paul Kocialkowski (1): ARM: dts: sun8i: v3s: Move the csi1 block to follow address order Paul Menzel (1): lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 Paulo Alcantara (2): cifs: prevent bad output lengths in smb2_ioctl_query_info() cifs: fix NULL ptr dereference in smb2_ioctl_query_info() Pavel Begunkov (1): io_uring: fix memory leak of uid in files registration Pavel Kubelun (1): ARM: dts: qcom: ipq4019: fix sleep clock Pavel Skripkin (6): udmabuf: validate ubuf->pagecount Bluetooth: hci_serdev: call init_rwsem() before p->open() ath9k_htc: fix uninit value bugs jfs: fix divide error in dbNextAG media: Revert "media: em28xx: add missing em28xx_close_extension" can: mcba_usb: properly check endpoint type Peiwei Hu (1): media: ir_toy: free before error exiting Pekka Pessi (1): mailbox: tegra-hsp: Flush whole channel Peng Liu (1): kunit: make kunit_test_timeout compatible with comment Peter Rosin (1): i2c: mux: demux-pinctrl: do not deactivate a master that is not active Petr Machata (1): af_netlink: Fix shift out of bounds in group mask calculation Petr Vorel (1): crypto: vmx - add missing dependencies Pierre-Louis Bossart (1): ASoC: generic: simple-card-utils: remove useless assignment Prashant Malani (1): platform/chrome: cros_ec_typec: Check for EC device Qais Yousef (1): sched/core: Export pelt_thermal_tp Quinn Tran (7): scsi: qla2xxx: Fix stuck session in gpdb scsi: qla2xxx: Fix scheduling while atomic scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Reduce false trigger to login Rafael J. Wysocki (2): ACPICA: Avoid walking the ACPI Namespace if it is not there ACPI: CPPC: Avoid out of bounds access when parsing _CPC data Randy Dunlap (20): hv: utils: add PTP_1588_CLOCK to Kconfig to fix build EVM: fix the evm= __setup handler return value PM: hibernate: fix __setup handler error handling PM: suspend: fix return value of __setup handler ACPI: APEI: fix return value of __setup handlers clocksource: acpi_pm: fix return value of __setup handler printk: fix return value of printk.devkmsg __setup handler m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined TOMOYO: fix __setup handlers return values mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n MIPS: RB532: fix return value of __setup handler dma-debug: fix return value of __setup handlers tty: hvc: fix return value of __setup handler kgdboc: fix return value of __setup handler kgdbts: fix return value of __setup handler driver core: dd: fix return value of __setup handler mm/mmap: return 1 from stack_guard_gap __setup() handler ARM: 9187/1: JIVE: fix return value of __setup handler mm/memcontrol: return 1 from cgroup.memory __setup() handler mm/usercopy: return 1 from hardened_usercopy __setup() handler Richard Guy Briggs (1): audit: log AUDIT_TIME_* records only from rules Richard Haines (1): selinux: allow FIOCLEX and FIONCLEX with policy capability Richard Leitner (1): ARM: tegra: tamonten: Fix I2C3 pad setting Richard Schleich (2): ARM: dts: bcm2837: Add the missing L1/L2 cache information ARM: dts: bcm2711: Add the missing L1/L2 cache information Rik van Riel (2): mm: invalidate hwpoison page cache page in fault path mm,hwpoison: unmap poisoned page before invalidation Ritesh Harjani (3): ext4: fix ext4_fc_stats trace point ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit Rob Herring (1): arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly Robert Hancock (3): ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting i2c: xiic: Make bus names unique net: axienet: fix RX ring refill allocation failure handling Robert Marko (1): clk: qcom: ipq8074: fix PCI-E clock oops Robin Gong (1): mailbox: imx: fix wakeup failure from freeze mode Robin Murphy (1): iommu/iova: Improve 32-bit free space estimate Roman Li (1): drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug Sakari Ailus (1): ACPI: properties: Consistently return -ENOENT if there are no more references Sam Ravnborg (1): video: fbdev: controlfb: Fix set but not used warnings Saurav Kashyap (1): scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() Sean Christopherson (1): KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU Sean Nyekjaer (1): mtd: rawnand: protect access to rawnand devices while in suspend Sean Young (1): media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC Shannon Nelson (1): ionic: fix type complaint in ionic_dev_cmd_clean() Shengjiu Wang (2): ASoC: fsl_spdif: Disable TX clock when stop ASoC: soc-core: skip zero num_dai component in searching dai name Shin'ichiro Kawasaki (1): block: limit request dispatch loop duration Si-Wei Liu (1): vdpa/mlx5: should verify CTRL_VQ feature exists for MQ Souptick Joarder (HPE) (1): irqchip/nvic: Release nvic_base upon failure Srinivas Kandagatla (1): ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put Srinivas Pandruvada (1): thermal: int340x: Increase bitmap size Stefano Garzarella (1): tools/virtio: fix virtio_test execution Sunil Goutham (1): hwrng: cavium - Check health status while reading random data Sven Eckelmann (1): batman-adv: Check ptr for NULL before reducing its refcnt Takashi Iwai (1): ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock Takashi Sakamoto (1): ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction Taniya Das (2): clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: qcom: clk-rcg2: Update the frac table for pixel clock Theodore Ts'o (1): ext4: don't BUG if someone dirty pages without asking ext4 first Thomas Bracht Laumann Jespersen (1): scripts/dtc: Call pkg-config POSIXly correct Tim Gardner (1): video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow Tobias Waldekranz (1): net: dsa: mv88e6xxx: Enable port policy support on 6097 Tom Rix (5): media: video/hdmi: handle short reads of hdmi info frame. drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function qlcnic: dcb: default to returning -EOPNOTSUPP can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value rtc: check if __rtc_read_time was successful Tomas Paukrt (1): crypto: mxs-dcp - Fix scatterlist processing Tong Zhang (1): dax: make sure inodes are flushed before destroy cache Trond Myklebust (3): NFS: Use of mapping_set_error() results in spurious errors NFS: Return valid errors from nfs2/3_decode_dirent() NFSv4/pNFS: Fix another issue with a list iterator pointing to the head Tsuchiya Yuto (1): media: atomisp: fix dummy_ptr check to avoid duplicate active_bo Tudor Ambarus (1): ARM: dts: at91: sama5d2: Fix PMERRLOC resource size Ulf Hansson (1): mmc: host: Return an error when ->enable_sdio_irq() ops is missing Uwe Kleine-König (5): vfio: platform: simplify device removal amba: Make the remove callback return void pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() serial: 8250: Fix race condition in RTS-after-send handling ARM: mmp: Fix failure to remove sram device Vitaly Kuznetsov (1): KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated Vladimir Oltean (1): net: enetc: report software timestamping via SO_TIMESTAMPING Waiman Long (2): locking/lockdep: Avoid potential access of invalid memory in lock_class locking/lockdep: Iterate lock_classes directly when reading lockdep files Wang Hai (2): video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() wireguard: socket: free skb in send6 when ipv6 is disabled Wang Wensheng (1): ASoC: imx-es8328: Fix error return code in imx_es8328_probe() Wang Yufen (3): bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full bpf, sockmap: Fix more uncharged while msg has more_data bpf, sockmap: Fix double uncharge the mem of sk_msg Wen Gong (1): ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern Xiang Chen (1): scsi: hisi_sas: Change permission of parameter prot_mask Xiaomeng Tong (2): ALSA: cs4236: fix an incorrect NULL check on list iterator net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator Xie Yongji (1): virtio-blk: Use blk_validate_block_size() to validate block size Xin Long (1): udp: call udp_encap_enable for v6 sockets when enabling encap Xin Xiong (1): mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init Xu Kuohai (1): libbpf: Skip forward declaration when counting duplicated type names Yafang Shao (1): libbpf: Fix possible NULL pointer dereference when destroying skeleton Yake Yang (1): Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt Yaliang Wang (1): MIPS: pgalloc: fix memory leak caused by pgd_free() Yang Guang (1): video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit Yang Yingliang (3): media: saa7134: convert list_for_each to entry variant ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() Yangtao Li (1): fsi: aspeed: convert to devm_platform_ioremap_resource Ye Bin (1): ext4: fix fs corruption when tring to remove a non-empty directory with IO error Yi Wang (1): KVM: SVM: fix panic on out-of-bounds guest IRQ Yiqing Yao (1): drm/amd/pm: enable pm sysfs write for one VF mode Yongzhi Liu (1): RDMA/mlx5: Fix memory leak in error flow for subscribe event routine YueHaibing (1): video: fbdev: controlfb: Fix COMPILE_TEST build Z. Liu (1): video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen Zhang Yi (1): ext2: correct max file size computing Zhenzhong Duan (1): KVM: x86: Fix emulation in writing cr8 Zheyu Ma (2): ethernet: sun: Free the coherent when failing in probing video: fbdev: sm712fb: Fix crash in smtcfb_write() Zhou Qingyang (2): drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() kernel test robot (1): regulator: qcom_smd: fix for_each_child.cocci warnings lic121 (1): libbpf: Unmap rings when umem deleted Documentation/admin-guide/sysctl/kernel.rst | 1 + .../bindings/mtd/nand-controller.yaml | 4 +- .../devicetree/bindings/spi/spi-mxic.txt | 4 +- Documentation/process/stable-kernel-rules.rst | 11 +- Documentation/sound/hd-audio/models.rst | 4 + arch/arc/kernel/process.c | 2 +- arch/arm/boot/dts/bcm2711.dtsi | 50 +++++ arch/arm/boot/dts/bcm2837.dtsi | 49 ++++ arch/arm/boot/dts/dra7-l4.dtsi | 5 +- arch/arm/boot/dts/dra7.dtsi | 8 +- arch/arm/boot/dts/exynos5250-pinctrl.dtsi | 2 +- arch/arm/boot/dts/exynos5250-smdk5250.dts | 3 + arch/arm/boot/dts/exynos5420-smdk5420.dts | 3 + arch/arm/boot/dts/imx53-m53menlo.dts | 29 ++- arch/arm/boot/dts/imx7-colibri.dtsi | 4 +- arch/arm/boot/dts/imx7-mba7.dtsi | 2 +- arch/arm/boot/dts/imx7d-nitrogen7.dts | 2 +- arch/arm/boot/dts/imx7d-pico-hobbit.dts | 4 +- arch/arm/boot/dts/imx7d-pico-pi.dts | 4 +- arch/arm/boot/dts/imx7d-sdb.dts | 4 +- arch/arm/boot/dts/imx7s-warp.dts | 4 +- arch/arm/boot/dts/qcom-ipq4019.dtsi | 3 +- arch/arm/boot/dts/qcom-msm8960.dtsi | 8 +- arch/arm/boot/dts/sama5d2.dtsi | 2 +- arch/arm/boot/dts/spear1340.dtsi | 6 +- arch/arm/boot/dts/spear13xx.dtsi | 6 +- arch/arm/boot/dts/sun8i-v3s.dtsi | 22 +- arch/arm/boot/dts/tegra20-tamonten.dtsi | 6 +- arch/arm/configs/multi_v5_defconfig | 1 + arch/arm/crypto/Kconfig | 2 + arch/arm/kernel/entry-ftrace.S | 51 ++--- arch/arm/kernel/swp_emulate.c | 2 +- arch/arm/kernel/traps.c | 2 +- .../mach-iop32x/include/mach/entry-macro.S | 2 +- arch/arm/mach-iop32x/include/mach/irqs.h | 2 +- arch/arm/mach-iop32x/irq.c | 6 +- arch/arm/mach-iop32x/irqs.h | 60 ++--- arch/arm/mach-mmp/sram.c | 22 +- arch/arm/mach-mstar/Kconfig | 1 + arch/arm/mach-s3c/mach-jive.c | 6 +- .../boot/dts/broadcom/northstar2/ns2-svk.dts | 8 +- .../boot/dts/broadcom/northstar2/ns2.dtsi | 2 +- arch/arm64/boot/dts/qcom/sdm845.dtsi | 8 +- arch/arm64/boot/dts/qcom/sm8150.dtsi | 6 +- .../boot/dts/rockchip/rk3399-firefly.dts | 4 +- arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-am65.dtsi | 1 + arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-j7200.dtsi | 1 + arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 5 +- arch/arm64/boot/dts/ti/k3-j721e.dtsi | 1 + arch/arm64/configs/defconfig | 2 +- arch/arm64/kernel/signal.c | 10 +- arch/arm64/mm/mmu.c | 9 + arch/arm64/net/bpf_jit_comp.c | 18 +- arch/csky/kernel/perf_callchain.c | 2 +- arch/csky/kernel/signal.c | 2 +- arch/m68k/coldfire/device.c | 6 +- arch/microblaze/include/asm/uaccess.h | 18 +- arch/mips/dec/int-handler.S | 6 +- arch/mips/dec/prom/Makefile | 2 +- arch/mips/dec/setup.c | 3 +- arch/mips/include/asm/dec/prom.h | 15 +- arch/mips/include/asm/pgalloc.h | 6 + arch/mips/rb532/devices.c | 6 +- arch/nios2/include/asm/uaccess.h | 26 ++- arch/nios2/kernel/signal.c | 20 +- arch/parisc/include/asm/traps.h | 1 + arch/parisc/kernel/traps.c | 2 + arch/parisc/mm/fault.c | 89 ++++++++ arch/powerpc/Makefile | 2 +- arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts | 30 +++ arch/powerpc/boot/dts/fsl/t1040rdb.dts | 8 +- arch/powerpc/include/asm/io.h | 40 +++- arch/powerpc/include/asm/uaccess.h | 3 + arch/powerpc/kernel/kvm.c | 2 +- arch/powerpc/kvm/book3s_hv.c | 5 +- arch/powerpc/kvm/powerpc.c | 4 +- arch/powerpc/lib/sstep.c | 12 +- arch/powerpc/mm/kasan/kasan_init_32.c | 3 +- arch/powerpc/mm/numa.c | 4 +- arch/powerpc/perf/imc-pmu.c | 6 +- arch/powerpc/platforms/8xx/pic.c | 1 + arch/powerpc/platforms/powernv/rng.c | 6 +- arch/powerpc/sysdev/fsl_gtm.c | 4 +- arch/riscv/include/asm/module.lds.h | 6 +- arch/riscv/include/asm/thread_info.h | 10 +- arch/riscv/kernel/perf_callchain.c | 6 +- arch/sparc/kernel/signal_32.c | 2 +- arch/um/drivers/mconsole_kern.c | 3 +- arch/x86/events/intel/pt.c | 2 +- arch/x86/kernel/kvm.c | 2 +- arch/x86/kvm/emulate.c | 14 +- arch/x86/kvm/hyperv.c | 9 +- arch/x86/kvm/lapic.c | 5 +- arch/x86/kvm/mmu/tdp_mmu.c | 3 + arch/x86/kvm/svm/avic.c | 10 +- arch/x86/xen/pmu.c | 10 +- arch/x86/xen/pmu.h | 3 +- arch/x86/xen/smp_pv.c | 2 +- arch/xtensa/include/asm/processor.h | 4 +- arch/xtensa/kernel/jump_label.c | 2 +- block/bfq-iosched.c | 16 +- block/blk-mq-sched.c | 9 +- block/blk-sysfs.c | 8 +- crypto/authenc.c | 2 +- crypto/rsa-pkcs1pad.c | 11 +- drivers/acpi/acpica/nswalk.c | 3 + drivers/acpi/apei/bert.c | 10 +- drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/hest.c | 2 +- drivers/acpi/cppc_acpi.c | 5 + drivers/acpi/property.c | 2 +- drivers/amba/bus.c | 5 +- drivers/base/dd.c | 2 +- drivers/base/power/main.c | 6 +- drivers/block/drbd/drbd_req.c | 3 +- drivers/block/loop.c | 10 +- drivers/block/virtio_blk.c | 12 +- drivers/bluetooth/btmtksdio.c | 4 +- drivers/bluetooth/hci_serdev.c | 3 +- drivers/bus/mips_cdmm.c | 1 + drivers/char/hw_random/Kconfig | 2 +- drivers/char/hw_random/atmel-rng.c | 1 + drivers/char/hw_random/cavium-rng-vf.c | 194 +++++++++++++++- drivers/char/hw_random/cavium-rng.c | 11 +- drivers/char/hw_random/nomadik-rng.c | 7 +- drivers/char/tpm/tpm-chip.c | 46 +--- drivers/char/tpm/tpm.h | 2 + drivers/char/tpm/tpm2-space.c | 65 ++++++ drivers/char/virtio_console.c | 7 + drivers/clk/actions/owl-s700.c | 1 + drivers/clk/actions/owl-s900.c | 2 +- drivers/clk/at91/sama7g5.c | 8 +- drivers/clk/clk-clps711x.c | 2 + drivers/clk/clk.c | 13 ++ drivers/clk/imx/clk-imx7d.c | 1 - drivers/clk/loongson1/clk-loongson1c.c | 1 + drivers/clk/qcom/clk-rcg2.c | 14 +- drivers/clk/qcom/gcc-ipq8074.c | 21 +- drivers/clk/qcom/gcc-msm8994.c | 1 + drivers/clk/tegra/clk-tegra124-emc.c | 1 + .../clk/uniphier/clk-uniphier-fixed-rate.c | 1 + drivers/clocksource/acpi_pm.c | 6 +- drivers/clocksource/exynos_mct.c | 60 +++-- drivers/clocksource/timer-microchip-pit64b.c | 2 +- drivers/clocksource/timer-of.c | 6 +- drivers/clocksource/timer-ti-dm-systimer.c | 4 +- drivers/cpufreq/qcom-cpufreq-nvmem.c | 2 +- .../allwinner/sun8i-ce/sun8i-ce-cipher.c | 3 + .../crypto/allwinner/sun8i-ce/sun8i-ce-hash.c | 3 + .../allwinner/sun8i-ss/sun8i-ss-cipher.c | 3 + .../crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 2 + .../crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 3 + drivers/crypto/amlogic/amlogic-gxl-cipher.c | 2 + drivers/crypto/ccp/ccp-dmaengine.c | 16 ++ drivers/crypto/ccree/cc_buffer_mgr.c | 7 + drivers/crypto/ccree/cc_cipher.c | 2 +- drivers/crypto/mxs-dcp.c | 2 +- .../crypto/rockchip/rk3288_crypto_skcipher.c | 1 - drivers/crypto/vmx/Kconfig | 4 + drivers/dax/super.c | 1 + drivers/dma-buf/udmabuf.c | 4 + drivers/dma/hisi_dma.c | 2 +- drivers/dma/pl330.c | 3 +- drivers/firmware/efi/efi-pstore.c | 2 +- drivers/firmware/google/Kconfig | 2 +- drivers/firmware/qcom_scm.c | 6 - drivers/firmware/stratix10-svc.c | 2 +- drivers/fsi/fsi-master-aspeed.c | 21 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 +- .../display/dc/irq/dcn21/irq_service_dcn21.c | 14 -- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 4 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 2 +- drivers/gpu/drm/bridge/adv7511/adv7511.h | 1 + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 29 ++- drivers/gpu/drm/bridge/cdns-dsi.c | 1 + drivers/gpu/drm/bridge/nwl-dsi.c | 1 + drivers/gpu/drm/bridge/sil-sii8620.c | 2 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 5 +- drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c | 1 + drivers/gpu/drm/drm_edid.c | 11 +- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 2 +- drivers/gpu/drm/meson/meson_drv.c | 6 +- drivers/gpu/drm/meson/meson_osd_afbcd.c | 41 ++-- drivers/gpu/drm/meson/meson_osd_afbcd.h | 1 + drivers/gpu/drm/mgag200/mgag200_mode.c | 5 +- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 +- drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 8 + drivers/gpu/drm/msm/dp/dp_display.c | 5 + .../gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c | 9 +- drivers/gpu/drm/panfrost/panfrost_gpu.c | 5 +- drivers/gpu/drm/pl111/pl111_drv.c | 4 +- drivers/gpu/drm/tegra/dsi.c | 4 +- drivers/gpu/host1x/dev.c | 1 + drivers/greybus/svc.c | 8 +- drivers/hid/hid-logitech-dj.c | 1 + drivers/hid/i2c-hid/i2c-hid-core.c | 32 ++- drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 29 +-- drivers/hv/Kconfig | 1 + drivers/hv/hv_balloon.c | 2 +- drivers/hwmon/pmbus/pmbus.h | 1 + drivers/hwmon/pmbus/pmbus_core.c | 18 +- drivers/hwmon/sch56xx-common.c | 2 +- drivers/hwtracing/coresight/coresight-catu.c | 3 +- .../hwtracing/coresight/coresight-cpu-debug.c | 4 +- .../hwtracing/coresight/coresight-cti-core.c | 4 +- drivers/hwtracing/coresight/coresight-etb10.c | 4 +- .../coresight/coresight-etm3x-core.c | 4 +- .../coresight/coresight-etm4x-core.c | 4 +- .../coresight/coresight-etm4x-sysfs.c | 8 +- .../hwtracing/coresight/coresight-funnel.c | 4 +- .../coresight/coresight-replicator.c | 4 +- drivers/hwtracing/coresight/coresight-stm.c | 4 +- .../hwtracing/coresight/coresight-tmc-core.c | 4 +- drivers/hwtracing/coresight/coresight-tpiu.c | 4 +- drivers/i2c/busses/i2c-meson.c | 12 +- drivers/i2c/busses/i2c-nomadik.c | 4 +- drivers/i2c/busses/i2c-xiic.c | 3 +- drivers/i2c/muxes/i2c-demux-pinctrl.c | 5 +- drivers/iio/accel/mma8452.c | 29 ++- drivers/iio/adc/twl6030-gpadc.c | 2 + drivers/iio/afe/iio-rescale.c | 8 +- drivers/iio/inkern.c | 40 +++- drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/verbs.c | 1 + drivers/infiniband/hw/hfi1/verbs.c | 3 +- drivers/infiniband/hw/mlx5/devx.c | 4 +- drivers/infiniband/hw/mlx5/mr.c | 2 + drivers/input/input.c | 6 - drivers/input/serio/ambakmi.c | 3 +- drivers/input/touchscreen/zinitix.c | 44 +++- drivers/iommu/iova.c | 5 +- drivers/iommu/ipmmu-vmsa.c | 4 +- drivers/irqchip/irq-nvic.c | 2 + drivers/irqchip/qcom-pdc.c | 5 +- drivers/mailbox/imx-mailbox.c | 9 + drivers/mailbox/tegra-hsp.c | 5 + drivers/md/dm-crypt.c | 2 +- drivers/md/dm-integrity.c | 6 +- drivers/media/i2c/adv7511-v4l2.c | 2 +- drivers/media/i2c/adv7604.c | 2 +- drivers/media/i2c/adv7842.c | 2 +- drivers/media/pci/bt8xx/bttv-driver.c | 4 +- drivers/media/pci/cx88/cx88-mpeg.c | 3 + drivers/media/pci/ivtv/ivtv-driver.h | 1 - drivers/media/pci/ivtv/ivtv-ioctl.c | 10 +- drivers/media/pci/ivtv/ivtv-streams.c | 11 +- drivers/media/pci/saa7134/saa7134-alsa.c | 8 +- drivers/media/platform/aspeed-video.c | 9 +- drivers/media/platform/coda/coda-common.c | 1 + drivers/media/platform/davinci/vpif.c | 12 +- .../platform/mtk-vcodec/mtk_vcodec_fw_vpu.c | 2 + drivers/media/rc/gpio-ir-tx.c | 28 ++- drivers/media/rc/ir_toy.c | 2 +- .../media/test-drivers/vidtv/vidtv_s302m.c | 17 +- drivers/media/usb/em28xx/em28xx-cards.c | 13 +- drivers/media/usb/go7007/s2250-board.c | 10 +- drivers/media/usb/hdpvr/hdpvr-video.c | 4 +- drivers/media/usb/stk1160/stk1160-core.c | 2 +- drivers/media/usb/stk1160/stk1160-v4l.c | 10 +- drivers/media/usb/stk1160/stk1160.h | 2 +- drivers/media/v4l2-core/v4l2-mem2mem.c | 53 ++++- drivers/memory/emif.c | 8 +- drivers/memory/pl172.c | 4 +- drivers/memory/pl353-smc.c | 4 +- drivers/mfd/asic3.c | 10 +- drivers/mfd/mc13xxx-core.c | 4 +- drivers/misc/cardreader/alcor_pci.c | 9 +- drivers/misc/habanalabs/common/debugfs.c | 2 + drivers/misc/kgdbts.c | 4 +- drivers/misc/mei/hw-me-regs.h | 1 + drivers/misc/mei/interrupt.c | 35 ++- drivers/misc/mei/pci-me.c | 1 + drivers/mmc/core/host.c | 15 +- drivers/mmc/host/davinci_mmc.c | 6 +- drivers/mmc/host/mmci.c | 4 +- drivers/mtd/nand/onenand/generic.c | 7 +- drivers/mtd/nand/raw/atmel/nand-controller.c | 14 +- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 3 + drivers/mtd/nand/raw/nand_base.c | 44 ++-- drivers/net/bareudp.c | 25 +-- drivers/net/can/m_can/m_can.c | 5 +- .../net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +- drivers/net/can/usb/mcba_usb.c | 26 ++- drivers/net/can/vxcan.c | 2 +- drivers/net/dsa/bcm_sf2_cfp.c | 6 +- drivers/net/dsa/microchip/ksz8795_spi.c | 11 + drivers/net/dsa/microchip/ksz9477_spi.c | 12 + drivers/net/dsa/mv88e6xxx/chip.c | 1 + drivers/net/ethernet/8390/mcf8390.c | 10 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 +- .../ethernet/freescale/enetc/enetc_ethtool.c | 5 +- drivers/net/ethernet/intel/i40e/i40e_xsk.c | 16 +- .../net/ethernet/pensando/ionic/ionic_main.c | 6 +- drivers/net/ethernet/qlogic/qed/qed_sriov.c | 1 + .../net/ethernet/qlogic/qlcnic/qlcnic_dcb.h | 10 +- drivers/net/ethernet/sun/sunhme.c | 6 +- .../net/ethernet/xilinx/xilinx_axienet_main.c | 72 +++--- drivers/net/phy/broadcom.c | 21 ++ drivers/net/wireguard/queueing.c | 3 +- drivers/net/wireguard/socket.c | 5 +- drivers/net/wireless/ath/ath10k/snoc.c | 2 +- drivers/net/wireless/ath/ath10k/wow.c | 7 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 5 + drivers/net/wireless/ath/carl9170/main.c | 2 +- .../broadcom/brcm80211/brcmfmac/firmware.c | 2 + .../broadcom/brcm80211/brcmfmac/pcie.c | 66 ++---- .../net/wireless/intel/iwlwifi/dvm/mac80211.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 +- .../net/wireless/mediatek/mt76/mt7603/main.c | 3 + .../net/wireless/mediatek/mt76/mt7615/main.c | 3 + .../net/wireless/mediatek/mt76/mt7915/mcu.c | 9 +- drivers/net/wireless/ray_cs.c | 6 + drivers/nvdimm/region_devs.c | 3 + drivers/nvme/host/core.c | 9 +- drivers/nvme/host/tcp.c | 40 ++++ drivers/pci/controller/pci-aardvark.c | 4 +- drivers/pci/controller/pci-xgene.c | 35 ++- drivers/pci/hotplug/pciehp_hpc.c | 2 + drivers/pci/quirks.c | 12 + drivers/phy/phy-core-mipi-dphy.c | 4 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 2 + drivers/pinctrl/mediatek/pinctrl-paris.c | 30 ++- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 4 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 185 ++++++++-------- drivers/pinctrl/pinconf-generic.c | 6 +- drivers/pinctrl/pinctrl-rockchip.c | 2 + drivers/pinctrl/renesas/core.c | 5 +- drivers/pinctrl/renesas/pfc-r8a77470.c | 4 +- drivers/pinctrl/samsung/pinctrl-samsung.c | 30 ++- drivers/platform/chrome/Makefile | 3 +- .../platform/chrome/cros_ec_sensorhub_ring.c | 3 +- .../platform/chrome/cros_ec_sensorhub_trace.h | 123 +++++++++++ drivers/platform/chrome/cros_ec_trace.h | 95 -------- drivers/platform/chrome/cros_ec_typec.c | 6 + drivers/platform/x86/huawei-wmi.c | 13 +- drivers/power/reset/gemini-poweroff.c | 4 +- drivers/power/supply/ab8500_fg.c | 4 +- drivers/power/supply/bq24190_charger.c | 7 +- drivers/power/supply/wm8350_power.c | 97 ++++++-- drivers/pwm/pwm-lpc18xx-sct.c | 20 +- drivers/regulator/qcom_smd-regulator.c | 4 +- .../regulator/rpi-panel-attiny-regulator.c | 56 ++++- drivers/remoteproc/qcom_q6v5_adsp.c | 1 + drivers/remoteproc/qcom_q6v5_mss.c | 11 +- drivers/remoteproc/qcom_wcnss.c | 1 + drivers/remoteproc/remoteproc_debugfs.c | 2 +- drivers/rtc/interface.c | 7 +- drivers/rtc/rtc-pl030.c | 4 +- drivers/rtc/rtc-pl031.c | 4 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- drivers/scsi/libsas/sas_ata.c | 2 +- drivers/scsi/pm8001/pm8001_hwi.c | 23 +- drivers/scsi/pm8001/pm80xx_hwi.c | 209 ++++++++++-------- drivers/scsi/qla2xxx/qla_attr.c | 7 +- drivers/scsi/qla2xxx/qla_def.h | 10 +- drivers/scsi/qla2xxx/qla_gs.c | 5 +- drivers/scsi/qla2xxx/qla_init.c | 73 ++++-- drivers/scsi/qla2xxx/qla_iocb.c | 8 +- drivers/scsi/qla2xxx/qla_isr.c | 1 + drivers/scsi/qla2xxx/qla_mbx.c | 14 +- drivers/scsi/qla2xxx/qla_nvme.c | 22 ++ drivers/scsi/qla2xxx/qla_os.c | 8 +- drivers/scsi/qla2xxx/qla_sup.c | 4 +- drivers/scsi/qla2xxx/qla_target.c | 4 +- drivers/soc/qcom/ocmem.c | 1 + drivers/soc/qcom/qcom_aoss.c | 2 +- drivers/soc/qcom/rpmpd.c | 3 + drivers/soc/ti/wkup_m3_ipc.c | 4 +- drivers/soundwire/intel.c | 4 +- drivers/spi/spi-mxic.c | 28 +-- drivers/spi/spi-pl022.c | 5 +- drivers/spi/spi-pxa2xx-pci.c | 17 +- drivers/spi/spi-tegra114.c | 4 + drivers/spi/spi-tegra20-slink.c | 8 +- drivers/spi/spi-zynqmp-gqspi.c | 5 +- drivers/spi/spi.c | 4 +- drivers/staging/iio/adc/ad7280a.c | 4 +- .../staging/media/atomisp/pci/atomisp_acc.c | 28 ++- .../media/atomisp/pci/atomisp_gmin_platform.c | 18 ++ drivers/staging/media/atomisp/pci/hmm/hmm.c | 7 +- .../staging/media/hantro/hantro_h1_jpeg_enc.c | 2 +- drivers/staging/media/hantro/hantro_h1_regs.h | 2 +- drivers/staging/media/meson/vdec/esparser.c | 7 +- .../staging/media/meson/vdec/vdec_helpers.c | 8 +- .../staging/media/meson/vdec/vdec_helpers.h | 4 +- .../staging/media/sunxi/cedrus/cedrus_h264.c | 2 +- .../staging/media/sunxi/cedrus/cedrus_h265.c | 2 +- drivers/staging/media/zoran/zoran.h | 2 +- drivers/staging/media/zoran/zoran_card.c | 86 ++++--- drivers/staging/media/zoran/zoran_device.c | 7 +- drivers/staging/media/zoran/zoran_driver.c | 18 +- drivers/staging/mt7621-dts/gbpc1.dts | 40 ++-- drivers/staging/mt7621-dts/gbpc2.dts | 116 +++++++++- drivers/staging/mt7621-dts/mt7621.dtsi | 26 ++- .../intel/int340x_thermal/int3400_thermal.c | 7 +- drivers/tty/hvc/hvc_iucv.c | 4 +- drivers/tty/mxser.c | 15 +- drivers/tty/serial/8250/8250_dma.c | 11 +- drivers/tty/serial/8250/8250_lpss.c | 28 ++- drivers/tty/serial/8250/8250_mid.c | 19 +- drivers/tty/serial/8250/8250_port.c | 16 +- drivers/tty/serial/amba-pl010.c | 4 +- drivers/tty/serial/amba-pl011.c | 3 +- drivers/tty/serial/kgdboc.c | 6 +- drivers/tty/serial/serial_core.c | 14 ++ drivers/usb/host/xhci-hub.c | 5 +- drivers/usb/host/xhci-mem.c | 2 +- drivers/usb/host/xhci.c | 20 +- drivers/usb/host/xhci.h | 14 +- drivers/usb/serial/Kconfig | 1 + drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 3 + drivers/usb/serial/usb-serial-simple.c | 7 + drivers/usb/storage/ene_ub6250.c | 155 +++++++------ drivers/usb/storage/realtek_cr.c | 2 +- drivers/vdpa/mlx5/net/mlx5_vnet.c | 18 +- drivers/vfio/platform/vfio_amba.c | 15 +- drivers/video/fbdev/amba-clcd.c | 4 +- drivers/video/fbdev/atafb.c | 12 +- drivers/video/fbdev/atmel_lcdfb.c | 11 +- drivers/video/fbdev/cirrusfb.c | 16 +- drivers/video/fbdev/controlfb.c | 6 +- drivers/video/fbdev/core/fbcvt.c | 53 ++--- drivers/video/fbdev/matrox/matroxfb_base.c | 2 +- drivers/video/fbdev/nvidia/nv_i2c.c | 2 +- .../omap2/omapfb/displays/connector-dvi.c | 1 + .../omap2/omapfb/displays/panel-dsi-cm.c | 8 +- .../omapfb/displays/panel-sony-acx565akm.c | 2 +- .../omapfb/displays/panel-tpo-td043mtea1.c | 4 +- drivers/video/fbdev/sm712fb.c | 46 +--- drivers/video/fbdev/smscufx.c | 3 +- drivers/video/fbdev/udlfb.c | 8 +- drivers/video/fbdev/w100fb.c | 15 +- drivers/watchdog/rti_wdt.c | 1 + drivers/watchdog/sp805_wdt.c | 4 +- fs/binfmt_elf.c | 24 +- fs/btrfs/reflink.c | 7 +- fs/cifs/smb2ops.c | 130 ++++++----- fs/coredump.c | 39 +++- fs/exec.c | 26 ++- fs/ext2/super.c | 6 +- fs/ext4/inline.c | 9 +- fs/ext4/inode.c | 25 +++ fs/ext4/mballoc.c | 126 ++++++----- fs/ext4/namei.c | 10 +- fs/f2fs/checkpoint.c | 8 +- fs/f2fs/compress.c | 5 +- fs/f2fs/data.c | 9 +- fs/f2fs/file.c | 5 +- fs/f2fs/gc.c | 4 +- fs/f2fs/inode.c | 1 + fs/f2fs/node.c | 6 +- fs/f2fs/segment.c | 7 + fs/f2fs/super.c | 6 +- fs/f2fs/sysfs.c | 2 +- fs/file.c | 31 ++- fs/gfs2/rgrp.c | 3 +- fs/io_uring.c | 7 +- fs/jfs/jfs_dmap.c | 7 + fs/nfs/callback_proc.c | 27 +-- fs/nfs/callback_xdr.c | 4 - fs/nfs/nfs2xdr.c | 2 +- fs/nfs/nfs3xdr.c | 21 +- fs/nfs/nfs4proc.c | 1 + fs/nfs/pnfs.c | 11 + fs/nfs/pnfs.h | 2 + fs/nfs/write.c | 5 +- fs/nfsd/filecache.c | 6 +- fs/nfsd/nfs4state.c | 12 +- fs/nfsd/nfsproc.c | 2 +- fs/nfsd/xdr.h | 2 +- fs/ntfs/inode.c | 4 + fs/proc/bootconfig.c | 2 + fs/pstore/platform.c | 38 ++-- include/linux/amba/bus.h | 2 +- include/linux/mtd/rawnand.h | 2 + include/linux/pstore.h | 6 +- include/linux/serial_core.h | 2 + include/linux/soc/ti/ti_sci_protocol.h | 2 +- include/linux/sunrpc/xdr.h | 2 + include/net/udp.h | 1 + include/net/udp_tunnel.h | 3 +- include/sound/pcm.h | 1 + include/trace/events/ext4.h | 78 ++++--- include/trace/events/rxrpc.h | 8 +- include/uapi/linux/bpf.h | 12 +- kernel/audit.h | 4 + kernel/auditsc.c | 87 ++++++-- kernel/bpf/stackmap.c | 56 ++--- kernel/debug/kdb/kdb_support.c | 2 +- kernel/dma/debug.c | 4 +- kernel/events/core.c | 3 + kernel/locking/lockdep.c | 38 ++-- kernel/locking/lockdep_internals.h | 6 +- kernel/locking/lockdep_proc.c | 51 ++++- kernel/power/hibernate.c | 2 +- kernel/power/suspend_test.c | 8 +- kernel/printk/printk.c | 6 +- kernel/rseq.c | 9 + kernel/sched/core.c | 1 + kernel/sched/debug.c | 10 - kernel/watch_queue.c | 4 +- lib/kunit/try-catch.c | 2 +- lib/raid6/test/Makefile | 4 +- lib/raid6/test/test.c | 1 - lib/test_kmod.c | 1 + lib/test_lockup.c | 11 +- lib/test_xarray.c | 22 ++ lib/xarray.c | 4 + mm/kmemleak.c | 9 +- mm/madvise.c | 3 +- mm/memcontrol.c | 2 +- mm/memory.c | 17 +- mm/mempolicy.c | 8 +- mm/mmap.c | 2 +- mm/page_alloc.c | 9 +- mm/usercopy.c | 5 +- net/batman-adv/bridge_loop_avoidance.c | 6 + net/batman-adv/distributed-arp-table.c | 3 + net/batman-adv/gateway_client.c | 12 +- net/batman-adv/gateway_client.h | 16 +- net/batman-adv/hard-interface.h | 3 + net/batman-adv/network-coding.c | 6 + net/batman-adv/originator.c | 72 +----- net/batman-adv/originator.h | 96 +++++++- net/batman-adv/soft-interface.c | 15 +- net/batman-adv/soft-interface.h | 16 +- net/batman-adv/tp_meter.c | 3 + net/batman-adv/translation-table.c | 22 +- net/batman-adv/translation-table.h | 18 +- net/batman-adv/tvlv.c | 6 + net/bluetooth/hci_conn.c | 2 + net/can/isotp.c | 69 +++--- net/core/skmsg.c | 17 +- net/ipv4/route.c | 18 +- net/ipv4/tcp_bpf.c | 14 +- net/ipv4/tcp_output.c | 5 +- net/ipv4/udp.c | 6 + net/ipv6/udp.c | 4 +- net/ipv6/xfrm6_output.c | 16 ++ net/netfilter/nf_conntrack_proto_tcp.c | 17 +- net/netlink/af_netlink.c | 2 + net/openvswitch/conntrack.c | 118 +++++----- net/openvswitch/flow_netlink.c | 4 +- net/rxrpc/ar-internal.h | 15 +- net/rxrpc/call_event.c | 2 +- net/rxrpc/call_object.c | 40 +++- net/sunrpc/xprt.c | 7 + net/tipc/socket.c | 3 +- net/xfrm/xfrm_interface.c | 5 +- samples/bpf/xdpsock_user.c | 5 +- scripts/dtc/Makefile | 2 +- scripts/gcc-plugins/stackleak_plugin.c | 25 ++- security/integrity/evm/evm_main.c | 2 +- security/keys/keyctl_pkey.c | 14 +- security/security.c | 17 +- security/selinux/hooks.c | 11 +- security/selinux/include/policycap.h | 1 + security/selinux/include/policycap_names.h | 3 +- security/selinux/include/security.h | 7 + security/selinux/selinuxfs.c | 2 + security/selinux/xfrm.c | 2 +- security/smack/smack_lsm.c | 2 +- security/tomoyo/load_policy.c | 4 +- sound/arm/aaci.c | 4 +- sound/core/pcm.c | 1 + sound/core/pcm_lib.c | 9 +- sound/core/pcm_native.c | 39 +++- sound/firewire/fcp.c | 4 +- sound/isa/cs423x/cs4236.c | 8 +- sound/pci/hda/patch_hdmi.c | 8 +- sound/pci/hda/patch_realtek.c | 15 +- sound/soc/atmel/atmel_ssc_dai.c | 5 +- sound/soc/atmel/sam9g20_wm8731.c | 1 + sound/soc/atmel/sam9x5_wm8731.c | 16 +- sound/soc/codecs/Kconfig | 5 + sound/soc/codecs/msm8916-wcd-analog.c | 22 +- sound/soc/codecs/msm8916-wcd-digital.c | 5 +- sound/soc/codecs/mt6358.c | 4 + sound/soc/codecs/rt5663.c | 2 + sound/soc/codecs/wcd934x.c | 6 +- sound/soc/codecs/wm8350.c | 28 ++- sound/soc/dwc/dwc-i2s.c | 17 +- sound/soc/fsl/fsl_spdif.c | 2 + sound/soc/fsl/imx-es8328.c | 1 + sound/soc/generic/simple-card-utils.c | 2 +- sound/soc/mxs/mxs-saif.c | 5 +- sound/soc/mxs/mxs-sgtl5000.c | 3 + sound/soc/rockchip/rockchip_i2s.c | 18 +- sound/soc/sh/fsi.c | 19 +- sound/soc/soc-compress.c | 5 + sound/soc/soc-core.c | 2 +- sound/soc/soc-generic-dmaengine-pcm.c | 6 +- sound/soc/soc-topology.c | 3 +- sound/soc/sof/imx/imx8m.c | 1 + sound/soc/sof/intel/hda-loader.c | 11 +- sound/soc/ti/davinci-i2s.c | 5 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 25 +++ sound/spi/at73c213.c | 27 ++- tools/include/uapi/linux/bpf.h | 4 +- tools/lib/bpf/btf_dump.c | 5 + tools/lib/bpf/libbpf.c | 3 + tools/lib/bpf/xsk.c | 11 + .../selftests/bpf/progs/test_sock_fields.c | 2 +- .../testing/selftests/bpf/test_lirc_mode2.sh | 5 +- .../selftests/bpf/test_lwt_ip_encap.sh | 10 +- .../selftests/net/test_vxlan_under_vrf.sh | 8 +- tools/testing/selftests/vm/Makefile | 6 +- tools/testing/selftests/x86/Makefile | 6 +- tools/testing/selftests/x86/check_cc.sh | 2 +- tools/virtio/virtio_test.c | 1 + virt/kvm/kvm_main.c | 13 ++ 614 files changed, 4953 insertions(+), 2507 deletions(-) create mode 100644 arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts create mode 100644 drivers/platform/chrome/cros_ec_sensorhub_trace.h -- 2.20.1

1 559

[PATCH] vfio: framework supporting vfio device hot migration
by RongWang 05 Jul '22

05 Jul '22

From: Rong Wang <w_angrong(a)163.com> kunpeng inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5CO9A CVE: NA --------------------------------- As pass through devices, hypervisor can`t control the status of device, and can`t track dirty memory DMA from device, during migration. The goal of this framework is to combine hardware to accomplish the task above. qemu |status control and dirty memory report vfio |ops to hardware hardware Signed-off-by: Rong Wang <w_angrong(a)163.com> Signed-off-by: HuHua Li <18245010845(a)163.com> Signed-off-by: Ripeng Qiu <965412048(a)qq.com> --- drivers/vfio/pci/Makefile | 2 +- drivers/vfio/pci/vfio_pci.c | 54 +++ drivers/vfio/pci/vfio_pci_migration.c | 755 ++++++++++++++++++++++++++++++++++ drivers/vfio/pci/vfio_pci_private.h | 14 +- drivers/vfio/vfio.c | 411 +++++++++++++++++- include/linux/vfio_pci_migration.h | 136 ++++++ 6 files changed, 1367 insertions(+), 5 deletions(-) create mode 100644 drivers/vfio/pci/vfio_pci_migration.c create mode 100644 include/linux/vfio_pci_migration.h diff --git a/drivers/vfio/pci/Makefile b/drivers/vfio/pci/Makefile index 76d8ec0..80a777d 100644 --- a/drivers/vfio/pci/Makefile +++ b/drivers/vfio/pci/Makefile @@ -1,5 +1,5 @@ -vfio-pci-y := vfio_pci.o vfio_pci_intrs.o vfio_pci_rdwr.o vfio_pci_config.o +vfio-pci-y := vfio_pci.o vfio_pci_intrs.o vfio_pci_rdwr.o vfio_pci_config.o vfio_pci_migration.o vfio-pci-$(CONFIG_VFIO_PCI_IGD) += vfio_pci_igd.o obj-$(CONFIG_VFIO_PCI) += vfio-pci.o diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c index 51b791c..59d8280 100644 --- a/drivers/vfio/pci/vfio_pci.c +++ b/drivers/vfio/pci/vfio_pci.c @@ -30,6 +30,7 @@ #include <linux/vgaarb.h> #include <linux/nospec.h> #include <linux/sched/mm.h> +#include <linux/vfio_pci_migration.h> #include "vfio_pci_private.h" @@ -296,6 +297,14 @@ static int vfio_pci_enable(struct vfio_pci_device *vdev) vfio_pci_probe_mmaps(vdev); + if (vfio_dev_migration_is_supported(pdev)) { + ret = vfio_pci_migration_init(vdev); + if (ret) { + dev_warn(&vdev->pdev->dev, "Failed to init vfio_pci_migration\n"); + vfio_pci_disable(vdev); + return ret; + } + } return 0; } @@ -392,6 +401,7 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev) out: pci_disable_device(pdev); + vfio_pci_migration_exit(vdev); vfio_pci_try_bus_reset(vdev); if (!disable_idle_d3) @@ -642,6 +652,41 @@ struct vfio_devices { int max_index; }; +static long vfio_pci_handle_log_buf_ctl(struct vfio_pci_device *vdev, + const unsigned long arg) +{ + struct vfio_log_buf_ctl *log_buf_ctl = NULL; + struct vfio_log_buf_info *log_buf_info = NULL; + struct vf_migration_log_info migration_log_info; + long ret = 0; + + log_buf_ctl = (struct vfio_log_buf_ctl *)arg; + log_buf_info = (struct vfio_log_buf_info *)log_buf_ctl->data; + + switch (log_buf_ctl->flags) { + case VFIO_DEVICE_LOG_BUF_FLAG_START: + migration_log_info.dom_uuid = log_buf_info->uuid; + migration_log_info.buffer_size = + log_buf_info->buffer_size; + migration_log_info.sge_num = log_buf_info->addrs_size; + migration_log_info.sge_len = log_buf_info->frag_size; + migration_log_info.sgevec = log_buf_info->sgevec; + ret = vfio_pci_device_log_start(vdev, + &migration_log_info); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STOP: + ret = vfio_pci_device_log_stop(vdev, + log_buf_info->uuid); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY: + ret = vfio_pci_device_log_status_query(vdev); + break; + default: + ret = -EINVAL; + break; + } + return ret; +} static long vfio_pci_ioctl(void *device_data, unsigned int cmd, unsigned long arg) { @@ -1142,6 +1187,8 @@ static long vfio_pci_ioctl(void *device_data, return vfio_pci_ioeventfd(vdev, ioeventfd.offset, ioeventfd.data, count, ioeventfd.fd); + } else if (cmd == VFIO_DEVICE_LOG_BUF_CTL) { + return vfio_pci_handle_log_buf_ctl(vdev, arg); } return -ENOTTY; @@ -1566,6 +1613,9 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) pci_set_power_state(pdev, PCI_D3hot); } + if (vfio_dev_migration_is_supported(pdev)) + ret = vfio_pci_device_init(pdev); + return ret; } @@ -1591,6 +1641,10 @@ static void vfio_pci_remove(struct pci_dev *pdev) if (!disable_idle_d3) pci_set_power_state(pdev, PCI_D0); + + if (vfio_dev_migration_is_supported(pdev)) { + vfio_pci_device_uninit(pdev); + } } static pci_ers_result_t vfio_pci_aer_err_detected(struct pci_dev *pdev, diff --git a/drivers/vfio/pci/vfio_pci_migration.c b/drivers/vfio/pci/vfio_pci_migration.c new file mode 100644 index 0000000..f69cd13 --- /dev/null +++ b/drivers/vfio/pci/vfio_pci_migration.c @@ -0,0 +1,755 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) 2022 Huawei Technologies Co., Ltd. All rights reserved. + */ + +#include <linux/module.h> +#include <linux/io.h> +#include <linux/pci.h> +#include <linux/uaccess.h> +#include <linux/vfio.h> +#include <linux/vfio_pci_migration.h> + +#include "vfio_pci_private.h" + +static LIST_HEAD(vfio_pci_mig_drivers_list); +static DEFINE_MUTEX(vfio_pci_mig_drivers_mutex); + +static void vfio_pci_add_mig_drv(struct vfio_pci_vendor_mig_driver *mig_drv) +{ + mutex_lock(&vfio_pci_mig_drivers_mutex); + atomic_set(&mig_drv->count, 1); + list_add_tail(&mig_drv->list, &vfio_pci_mig_drivers_list); + mutex_unlock(&vfio_pci_mig_drivers_mutex); +} + +static void vfio_pci_remove_mig_drv(struct vfio_pci_vendor_mig_driver *mig_drv) +{ + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_del(&mig_drv->list); + mutex_unlock(&vfio_pci_mig_drivers_mutex); +} + +static struct vfio_pci_vendor_mig_driver * + vfio_pci_find_mig_drv(struct pci_dev *pdev, struct module *module) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = NULL; + + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_for_each_entry(mig_drv, &vfio_pci_mig_drivers_list, list) { + if (mig_drv->owner == module) { + if (mig_drv->bus_num == pdev->bus->number) + goto out; + } + } + mig_drv = NULL; +out: + mutex_unlock(&vfio_pci_mig_drivers_mutex); + return mig_drv; +} + +static struct vfio_pci_vendor_mig_driver * + vfio_pci_get_mig_driver(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = NULL; + struct pci_dev *pf_dev = pci_physfn(pdev); + + mutex_lock(&vfio_pci_mig_drivers_mutex); + list_for_each_entry(mig_drv, &vfio_pci_mig_drivers_list, list) { + if (mig_drv->bus_num == pf_dev->bus->number) + goto out; + } + mig_drv = NULL; +out: + mutex_unlock(&vfio_pci_mig_drivers_mutex); + return mig_drv; +} + +bool vfio_dev_migration_is_supported(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + mig_driver = vfio_pci_get_mig_driver(pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_warn(&pdev->dev, "unable to find a mig_drv module\n"); + return false; + } + + return true; +} + +int vfio_pci_device_log_start(struct vfio_pci_device *vdev, + struct vf_migration_log_info *log_info) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->log_start || + (mig_driver->dev_mig_ops->log_start(vdev->pdev, + log_info) != 0)) { + dev_err(&vdev->pdev->dev, "failed to set log start\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_log_stop(struct vfio_pci_device *vdev, uint32_t uuid) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->log_stop || + (mig_driver->dev_mig_ops->log_stop(vdev->pdev, uuid) != 0)) { + dev_err(&vdev->pdev->dev, "failed to set log stop\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_log_status_query(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&vdev->pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (!mig_driver->dev_mig_ops->get_log_status || + (mig_driver->dev_mig_ops->get_log_status(vdev->pdev) != 0)) { + dev_err(&vdev->pdev->dev, "failed to get log status\n"); + return -EFAULT; + } + + return 0; +} + +int vfio_pci_device_init(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv; + + mig_drv = vfio_pci_get_mig_driver(pdev); + if (!mig_drv || !mig_drv->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_drv module\n"); + return -EFAULT; + } + + if (mig_drv->dev_mig_ops->init) + return mig_drv->dev_mig_ops->init(pdev); + + return -EFAULT; +} + +void vfio_pci_device_uninit(struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_drv; + + mig_drv = vfio_pci_get_mig_driver(pdev); + if (!mig_drv || !mig_drv->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_drv module\n"); + return; + } + + if (mig_drv->dev_mig_ops->uninit) + mig_drv->dev_mig_ops->uninit(pdev); +} + +static void vfio_pci_device_release(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (mig_drv->dev_mig_ops->release) + mig_drv->dev_mig_ops->release(pdev); +} + +static int vfio_pci_device_get_info(struct pci_dev *pdev, + struct vfio_device_migration_info *mig_info, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (mig_drv->dev_mig_ops->get_info) + return mig_drv->dev_mig_ops->get_info(pdev, mig_info); + return -EFAULT; +} + +static int vfio_pci_device_enable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->enable || + (mig_drv->dev_mig_ops->enable(pdev) != 0)) { + return -EINVAL; + } + + return 0; +} + +static int vfio_pci_device_disable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->disable || + (mig_drv->dev_mig_ops->disable(pdev) != 0)) + return -EINVAL; + + return 0; +} + +static int vfio_pci_device_pre_enable(struct pci_dev *pdev, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + if (!mig_drv->dev_mig_ops->pre_enable || + (mig_drv->dev_mig_ops->pre_enable(pdev) != 0)) + return -EINVAL; + + return 0; +} + +static int vfio_pci_device_state_save(struct pci_dev *pdev, + struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_info = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + void *base = (void *)mig_info; + int ret = 0; + + if ((mig_info->device_state & VFIO_DEVICE_STATE_RUNNING) != 0) { + ret = vfio_pci_device_disable(pdev, mig_drv); + if (ret) { + dev_err(&pdev->dev, "failed to stop VF function!\n"); + return ret; + } + mig_info->device_state &= ~VFIO_DEVICE_STATE_RUNNING; + } + + if (mig_drv->dev_mig_ops && mig_drv->dev_mig_ops->save) { + ret = mig_drv->dev_mig_ops->save(pdev, base, + mig_info->data_offset, data->state_size); + if (ret) { + dev_err(&pdev->dev, "failed to save device state!\n"); + return -EINVAL; + } + } else { + return -EFAULT; + } + + mig_info->data_size = data->state_size; + mig_info->pending_bytes = mig_info->data_size; + return ret; +} + +static int vfio_pci_device_state_restore(struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_info = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + void *base = (void *)mig_info; + int ret; + + if (mig_drv->dev_mig_ops && mig_drv->dev_mig_ops->restore) { + ret = mig_drv->dev_mig_ops->restore(pdev, base, + mig_info->data_offset, mig_info->data_size); + if (ret) { + dev_err(&pdev->dev, "failed to restore device state!\n"); + return -EINVAL; + } + return 0; + } + + return -EFAULT; +} + +static int vfio_pci_set_device_state(struct vfio_pci_migration_data *data, + u32 state) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + int ret = 0; + + if (state == mig_ctl->device_state) + return 0; + + if (!mig_drv->dev_mig_ops) + return -EINVAL; + + switch (state) { + case VFIO_DEVICE_STATE_RUNNING: + if (!(mig_ctl->device_state & + VFIO_DEVICE_STATE_RUNNING)) + ret = vfio_pci_device_enable(pdev, mig_drv); + break; + case VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RUNNING: + /* + * (pre-copy) - device should start logging data. + */ + ret = 0; + break; + case VFIO_DEVICE_STATE_SAVING: + /* stop the vf function, save state */ + ret = vfio_pci_device_state_save(pdev, data); + break; + case VFIO_DEVICE_STATE_STOP: + if (mig_ctl->device_state & VFIO_DEVICE_STATE_RUNNING) + ret = vfio_pci_device_disable(pdev, mig_drv); + break; + case VFIO_DEVICE_STATE_RESUMING: + ret = vfio_pci_device_pre_enable(pdev, mig_drv); + break; + default: + ret = -EFAULT; + break; + } + + if (ret) + return ret; + + mig_ctl->device_state = state; + return 0; +} + +static ssize_t vfio_pci_handle_mig_dev_state( + struct vfio_pci_migration_data *data, + char __user *buf, size_t count, bool iswrite) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + u32 device_state; + int ret; + + if (count != sizeof(device_state)) + return -EINVAL; + + if (iswrite) { + if (copy_from_user(&device_state, buf, count)) + return -EFAULT; + + ret = vfio_pci_set_device_state(data, device_state); + if (ret) + return ret; + } else { + if (copy_to_user(buf, &mig_ctl->device_state, count)) + return -EFAULT; + } + + return count; +} + +static ssize_t vfio_pci_handle_mig_pending_bytes( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 pending_bytes; + + if (count != sizeof(pending_bytes) || iswrite) + return -EINVAL; + + if (mig_info->device_state == + (VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RUNNING)) { + /* In pre-copy state we have no data to return for now, + * return 0 pending bytes + */ + pending_bytes = 0; + } else { + pending_bytes = mig_info->pending_bytes; + } + + if (copy_to_user(buf, &pending_bytes, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_offset( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 data_offset = mig_info->data_offset; + + if (count != sizeof(data_offset) || iswrite) + return -EINVAL; + + if (copy_to_user(buf, &data_offset, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_size( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u64 data_size; + + if (count != sizeof(data_size)) + return -EINVAL; + + if (iswrite) { + /* data_size is writable only during resuming state */ + if (mig_info->device_state != VFIO_DEVICE_STATE_RESUMING) + return -EINVAL; + + if (copy_from_user(&data_size, buf, sizeof(data_size))) + return -EFAULT; + + mig_info->data_size = data_size; + } else { + if (mig_info->device_state != VFIO_DEVICE_STATE_SAVING) + return -EINVAL; + + if (copy_to_user(buf, &mig_info->data_size, + sizeof(data_size))) + return -EFAULT; + } + + return count; +} + +static ssize_t vfio_pci_handle_mig_dev_cmd(struct vfio_pci_migration_data *data, + char __user *buf, size_t count, bool iswrite) +{ + struct vfio_pci_vendor_mig_driver *mig_drv = data->mig_driver; + struct pci_dev *pdev = data->vf_dev; + u32 device_cmd; + int ret = -EFAULT; + + if (count != sizeof(device_cmd) || !iswrite || !mig_drv->dev_mig_ops) + return -EINVAL; + + if (copy_from_user(&device_cmd, buf, count)) + return -EFAULT; + + switch (device_cmd) { + case VFIO_DEVICE_MIGRATION_CANCEL: + if (mig_drv->dev_mig_ops->cancel) + ret = mig_drv->dev_mig_ops->cancel(pdev); + break; + default: + dev_err(&pdev->dev, "cmd is invaild\n"); + return -EINVAL; + } + + if (ret != 0) + return ret; + + return count; +} + +static ssize_t vfio_pci_handle_mig_drv_version( + struct vfio_device_migration_info *mig_info, + char __user *buf, size_t count, bool iswrite) +{ + u32 version_id = mig_info->version_id; + + if (count != sizeof(version_id) || iswrite) + return -EINVAL; + + if (copy_to_user(buf, &version_id, count)) + return -EFAULT; + + return count; +} + +static ssize_t vfio_pci_handle_mig_data_rw( + struct vfio_pci_migration_data *data, + char __user *buf, size_t count, u64 pos, bool iswrite) +{ + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + void *data_addr = data->vf_data; + + if (count == 0) { + dev_err(&data->vf_dev->dev, "qemu operation data size error!\n"); + return -EINVAL; + } + + data_addr += pos - mig_ctl->data_offset; + if (iswrite) { + if (copy_from_user(data_addr, buf, count)) + return -EFAULT; + + mig_ctl->pending_bytes += count; + if (mig_ctl->pending_bytes > data->state_size) + return -EINVAL; + } else { + if (copy_to_user(buf, data_addr, count)) + return -EFAULT; + + if (mig_ctl->pending_bytes < count) + return -EINVAL; + + mig_ctl->pending_bytes -= count; + } + + return count; +} + +static ssize_t vfio_pci_dev_migrn_rw(struct vfio_pci_device *vdev, + char __user *buf, size_t count, loff_t *ppos, bool iswrite) +{ + unsigned int index = + VFIO_PCI_OFFSET_TO_INDEX(*ppos) - VFIO_PCI_NUM_REGIONS; + struct vfio_pci_migration_data *data = + (struct vfio_pci_migration_data *)vdev->region[index].data; + loff_t pos = *ppos & VFIO_PCI_OFFSET_MASK; + struct vfio_device_migration_info *mig_ctl = data->mig_ctl; + int ret; + + if (pos >= vdev->region[index].size) + return -EINVAL; + + count = min(count, (size_t)(vdev->region[index].size - pos)); + if (pos >= VFIO_MIGRATION_REGION_DATA_OFFSET) + return vfio_pci_handle_mig_data_rw(data, + buf, count, pos, iswrite); + + switch (pos) { + case VFIO_DEVICE_MIGRATION_OFFSET(device_state): + ret = vfio_pci_handle_mig_dev_state(data, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(pending_bytes): + ret = vfio_pci_handle_mig_pending_bytes(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(data_offset): + ret = vfio_pci_handle_mig_data_offset(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(data_size): + ret = vfio_pci_handle_mig_data_size(mig_ctl, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(device_cmd): + ret = vfio_pci_handle_mig_dev_cmd(data, + buf, count, iswrite); + break; + case VFIO_DEVICE_MIGRATION_OFFSET(version_id): + ret = vfio_pci_handle_mig_drv_version(mig_ctl, + buf, count, iswrite); + break; + default: + dev_err(&vdev->pdev->dev, "invalid pos offset\n"); + ret = -EFAULT; + break; + } + + if (mig_ctl->device_state == VFIO_DEVICE_STATE_RESUMING && + mig_ctl->pending_bytes == data->state_size && + mig_ctl->data_size == data->state_size) { + if (vfio_pci_device_state_restore(data) != 0) { + dev_err(&vdev->pdev->dev, "Failed to restore device state!\n"); + return -EFAULT; + } + mig_ctl->pending_bytes = 0; + mig_ctl->data_size = 0; + } + + return ret; +} + +static void vfio_pci_dev_migrn_release(struct vfio_pci_device *vdev, + struct vfio_pci_region *region) +{ + struct vfio_pci_migration_data *data = region->data; + + if (data) { + kfree(data->mig_ctl); + kfree(data); + } +} + +static const struct vfio_pci_regops vfio_pci_migration_regops = { + .rw = vfio_pci_dev_migrn_rw, + .release = vfio_pci_dev_migrn_release, +}; + +static int vfio_pci_migration_info_init(struct pci_dev *pdev, + struct vfio_device_migration_info *mig_info, + struct vfio_pci_vendor_mig_driver *mig_drv) +{ + int ret; + + ret = vfio_pci_device_get_info(pdev, mig_info, mig_drv); + if (ret) { + dev_err(&pdev->dev, "failed to get device info\n"); + return ret; + } + + if (mig_info->data_size > VFIO_MIGRATION_BUFFER_MAX_SIZE) { + dev_err(&pdev->dev, "mig_info->data_size %llu is invalid\n", + mig_info->data_size); + return -EINVAL; + } + + mig_info->data_offset = VFIO_MIGRATION_REGION_DATA_OFFSET; + return ret; +} + +static int vfio_device_mig_data_init(struct vfio_pci_device *vdev, + struct vfio_pci_migration_data *data) +{ + struct vfio_device_migration_info *mig_ctl; + u64 mig_offset; + int ret; + + mig_ctl = kzalloc(sizeof(*mig_ctl), GFP_KERNEL); + if (!mig_ctl) + return -ENOMEM; + + ret = vfio_pci_migration_info_init(vdev->pdev, mig_ctl, + data->mig_driver); + if (ret) { + dev_err(&vdev->pdev->dev, "get device info error!\n"); + goto err; + } + + mig_offset = sizeof(struct vfio_device_migration_info); + data->state_size = mig_ctl->data_size; + data->mig_ctl = krealloc(mig_ctl, mig_offset + data->state_size, + GFP_KERNEL); + if (!data->mig_ctl) { + ret = -ENOMEM; + goto err; + } + + data->vf_data = (void *)((char *)data->mig_ctl + mig_offset); + memset(data->vf_data, 0, data->state_size); + data->mig_ctl->data_size = 0; + + ret = vfio_pci_register_dev_region(vdev, VFIO_REGION_TYPE_MIGRATION, + VFIO_REGION_SUBTYPE_MIGRATION, + &vfio_pci_migration_regops, mig_offset + data->state_size, + VFIO_REGION_INFO_FLAG_READ | VFIO_REGION_INFO_FLAG_WRITE, data); + if (ret) { + kfree(data->mig_ctl); + return ret; + } + + return 0; +err: + kfree(mig_ctl); + return ret; +} + +int vfio_pci_migration_init(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + struct vfio_pci_migration_data *data = NULL; + struct pci_dev *pdev = vdev->pdev; + int ret; + + mig_driver = vfio_pci_get_mig_driver(pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_err(&pdev->dev, "unable to find a mig_driver module\n"); + return -EINVAL; + } + + if (!try_module_get(mig_driver->owner)) { + pr_err("module %s is not live\n", mig_driver->owner->name); + return -ENODEV; + } + + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) { + module_put(mig_driver->owner); + return -ENOMEM; + } + + data->mig_driver = mig_driver; + data->vf_dev = pdev; + + ret = vfio_device_mig_data_init(vdev, data); + if (ret) { + dev_err(&pdev->dev, "failed to init vfio device migration data!\n"); + goto err; + } + + return ret; +err: + kfree(data); + module_put(mig_driver->owner); + return ret; +} + +void vfio_pci_migration_exit(struct vfio_pci_device *vdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + mig_driver = vfio_pci_get_mig_driver(vdev->pdev); + if (!mig_driver || !mig_driver->dev_mig_ops) { + dev_warn(&vdev->pdev->dev, "mig_driver is not found\n"); + return; + } + + if (module_refcount(mig_driver->owner) > 0) { + vfio_pci_device_release(vdev->pdev, mig_driver); + module_put(mig_driver->owner); + } +} + +int vfio_pci_register_migration_ops(struct vfio_device_migration_ops *ops, + struct module *mod, struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + if (!ops || !mod || !pdev) + return -EINVAL; + + mig_driver = vfio_pci_find_mig_drv(pdev, mod); + if (mig_driver) { + pr_info("%s migration ops has already been registered\n", + mod->name); + atomic_add(1, &mig_driver->count); + return 0; + } + + if (!try_module_get(THIS_MODULE)) + return -ENODEV; + + mig_driver = kzalloc(sizeof(*mig_driver), GFP_KERNEL); + if (!mig_driver) { + module_put(THIS_MODULE); + return -ENOMEM; + } + + mig_driver->pdev = pdev; + mig_driver->bus_num = pdev->bus->number; + mig_driver->owner = mod; + mig_driver->dev_mig_ops = ops; + + vfio_pci_add_mig_drv(mig_driver); + + return 0; +} +EXPORT_SYMBOL_GPL(vfio_pci_register_migration_ops); + +void vfio_pci_unregister_migration_ops(struct module *mod, struct pci_dev *pdev) +{ + struct vfio_pci_vendor_mig_driver *mig_driver = NULL; + + if (!mod || !pdev) + return; + + mig_driver = vfio_pci_find_mig_drv(pdev, mod); + if (!mig_driver) { + pr_err("mig_driver is not found\n"); + return; + } + + if (atomic_sub_and_test(1, &mig_driver->count)) { + vfio_pci_remove_mig_drv(mig_driver); + kfree(mig_driver); + module_put(THIS_MODULE); + pr_info("%s succeed to unregister migration ops\n", + THIS_MODULE->name); + } +} +EXPORT_SYMBOL_GPL(vfio_pci_unregister_migration_ops); diff --git a/drivers/vfio/pci/vfio_pci_private.h b/drivers/vfio/pci/vfio_pci_private.h index 17d2bae..03af269 100644 --- a/drivers/vfio/pci/vfio_pci_private.h +++ b/drivers/vfio/pci/vfio_pci_private.h @@ -15,6 +15,7 @@ #include <linux/pci.h> #include <linux/irqbypass.h> #include <linux/types.h> +#include <linux/vfio_pci_migration.h> #ifndef VFIO_PCI_PRIVATE_H #define VFIO_PCI_PRIVATE_H @@ -55,7 +56,7 @@ struct vfio_pci_irq_ctx { struct vfio_pci_region; struct vfio_pci_regops { - size_t (*rw)(struct vfio_pci_device *vdev, char __user *buf, + ssize_t (*rw)(struct vfio_pci_device *vdev, char __user *buf, size_t count, loff_t *ppos, bool iswrite); void (*release)(struct vfio_pci_device *vdev, struct vfio_pci_region *region); @@ -173,4 +174,15 @@ static inline int vfio_pci_igd_init(struct vfio_pci_device *vdev) return -ENODEV; } #endif + +extern bool vfio_dev_migration_is_supported(struct pci_dev *pdev); +extern int vfio_pci_migration_init(struct vfio_pci_device *vdev); +extern void vfio_pci_migration_exit(struct vfio_pci_device *vdev); +extern int vfio_pci_device_log_start(struct vfio_pci_device *vdev, + struct vf_migration_log_info *log_info); +extern int vfio_pci_device_log_stop(struct vfio_pci_device *vdev, + uint32_t uuid); +extern int vfio_pci_device_log_status_query(struct vfio_pci_device *vdev); +extern int vfio_pci_device_init(struct pci_dev *pdev); +extern void vfio_pci_device_uninit(struct pci_dev *pdev); #endif /* VFIO_PCI_PRIVATE_H */ diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c index 7a386fb..35f2a29 100644 --- a/drivers/vfio/vfio.c +++ b/drivers/vfio/vfio.c @@ -33,6 +33,7 @@ #include <linux/string.h> #include <linux/uaccess.h> #include <linux/vfio.h> +#include <linux/vfio_pci_migration.h> #include <linux/wait.h> #include <linux/sched/signal.h> @@ -40,6 +41,9 @@ #define DRIVER_AUTHOR "Alex Williamson <alex.williamson(a)redhat.com>" #define DRIVER_DESC "VFIO - User Level meta-driver" +#define LOG_BUF_FRAG_SIZE (2 * 1024 * 1024) // fix to 2M +#define LOG_BUF_MAX_ADDRS_SIZE 128 // max vm ram size is 1T + static struct vfio { struct class *class; struct list_head iommu_drivers_list; @@ -57,6 +61,14 @@ struct vfio_iommu_driver { struct list_head vfio_next; }; +struct vfio_log_buf { + struct vfio_log_buf_info info; + int fd; + int buffer_state; + int device_state; + unsigned long *cpu_addrs; +}; + struct vfio_container { struct kref kref; struct list_head group_list; @@ -64,6 +76,7 @@ struct vfio_container { struct vfio_iommu_driver *iommu_driver; void *iommu_data; bool noiommu; + struct vfio_log_buf log_buf; }; struct vfio_unbound_dev { @@ -1158,8 +1171,398 @@ static long vfio_ioctl_set_iommu(struct vfio_container *container, return ret; } +static long vfio_dispatch_cmd_to_devices(const struct vfio_container *container, + unsigned int cmd, unsigned long arg) +{ + struct vfio_group *group = NULL; + struct vfio_device *device = NULL; + long ret = -ENXIO; + + list_for_each_entry(group, &container->group_list, container_next) { + list_for_each_entry(device, &group->device_list, group_next) { + ret = device->ops->ioctl(device->device_data, cmd, arg); + if (ret) { + pr_err("dispatch cmd to devices failed\n"); + return ret; + } + } + } + return ret; +} + +static long vfio_log_buf_start(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret; + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_START; + log_buf_ctl.data = (void *)&container->log_buf.info; + ret = vfio_dispatch_cmd_to_devices(container, VFIO_DEVICE_LOG_BUF_CTL, + (unsigned long)&log_buf_ctl); + if (ret) + return ret; + + container->log_buf.device_state = 1; + return 0; +} + +static long vfio_log_buf_stop(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret; + + if (container->log_buf.device_state == 0) { + pr_warn("device already stopped\n"); + return 0; + } + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_STOP; + log_buf_ctl.data = (void *)&container->log_buf.info; + ret = vfio_dispatch_cmd_to_devices(container, VFIO_DEVICE_LOG_BUF_CTL, + (unsigned long)&log_buf_ctl); + if (ret) + return ret; + + container->log_buf.device_state = 0; + return 0; +} + +static long vfio_log_buf_query(struct vfio_container *container) +{ + struct vfio_log_buf_ctl log_buf_ctl; + + log_buf_ctl.argsz = sizeof(struct vfio_log_buf_info); + log_buf_ctl.flags = VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY; + log_buf_ctl.data = (void *)&container->log_buf.info; + + return vfio_dispatch_cmd_to_devices(container, + VFIO_DEVICE_LOG_BUF_CTL, (unsigned long)&log_buf_ctl); +} + +static int vfio_log_buf_fops_mmap(struct file *filep, + struct vm_area_struct *vma) +{ + struct vfio_container *container = filep->private_data; + struct vfio_log_buf *log_buf = &container->log_buf; + unsigned long frag_pg_size; + unsigned long frag_offset; + phys_addr_t pa; + int ret = -EINVAL; + + if (!log_buf->cpu_addrs) { + pr_err("mmap before setup, please setup log buf first\n"); + return ret; + } + + if (log_buf->info.frag_size < PAGE_SIZE) { + pr_err("mmap frag size should not less than page size!\n"); + return ret; + } + + frag_pg_size = log_buf->info.frag_size / PAGE_SIZE; + frag_offset = vma->vm_pgoff / frag_pg_size; + + if (frag_offset >= log_buf->info.addrs_size) { + pr_err("mmap offset out of range!\n"); + return ret; + } + + if (vma->vm_end - vma->vm_start != log_buf->info.frag_size) { + pr_err("mmap size error, should be aligned with frag size!\n"); + return ret; + } + + pa = virt_to_phys((void *)log_buf->cpu_addrs[frag_offset]); + ret = remap_pfn_range(vma, vma->vm_start, + pa >> PAGE_SHIFT, + vma->vm_end - vma->vm_start, + vma->vm_page_prot); + if (ret) + pr_err("remap_pfn_range error!\n"); + return ret; +} + +static struct device *vfio_get_dev(struct vfio_container *container) +{ + struct vfio_group *group = NULL; + struct vfio_device *device = NULL; + + list_for_each_entry(group, &container->group_list, container_next) { + list_for_each_entry(device, &group->device_list, group_next) { + return device->dev; + } + } + return NULL; +} + +static void vfio_log_buf_release_dma(struct device *dev, + struct vfio_log_buf *log_buf) +{ + int i; + + for (i = 0; i < log_buf->info.addrs_size; i++) { + if ((log_buf->cpu_addrs && log_buf->cpu_addrs[i] != 0) && + (log_buf->info.sgevec && + log_buf->info.sgevec[i].addr != 0)) { + dma_free_coherent(dev, log_buf->info.frag_size, + (void *)log_buf->cpu_addrs[i], + log_buf->info.sgevec[i].addr); + log_buf->cpu_addrs[i] = 0; + log_buf->info.sgevec[i].addr = 0; + } + } +} + +static long vfio_log_buf_alloc_dma(struct vfio_log_buf_info *info, + struct vfio_log_buf *log_buf, struct device *dev) +{ + int i; + + for (i = 0; i < info->addrs_size; i++) { + log_buf->cpu_addrs[i] = (unsigned long)dma_alloc_coherent(dev, + info->frag_size, &log_buf->info.sgevec[i].addr, + GFP_KERNEL); + log_buf->info.sgevec[i].len = info->frag_size; + if (log_buf->cpu_addrs[i] == 0 || + log_buf->info.sgevec[i].addr == 0) { + return -ENOMEM; + } + } + return 0; +} + +static long vfio_log_buf_alloc_addrs(struct vfio_log_buf_info *info, + struct vfio_log_buf *log_buf) +{ + log_buf->info.sgevec = kcalloc(info->addrs_size, + sizeof(struct vfio_log_buf_sge), GFP_KERNEL); + if (!log_buf->info.sgevec) + return -ENOMEM; + + log_buf->cpu_addrs = kcalloc(info->addrs_size, + sizeof(unsigned long), GFP_KERNEL); + if (!log_buf->cpu_addrs) { + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; + return -ENOMEM; + } + + return 0; +} + +static long vfio_log_buf_info_valid(struct vfio_log_buf_info *info) +{ + if (info->addrs_size > LOG_BUF_MAX_ADDRS_SIZE || + info->addrs_size == 0) { + pr_err("can`t support vm ram size larger than 1T or equal to 0\n"); + return -EINVAL; + } + if (info->frag_size != LOG_BUF_FRAG_SIZE) { + pr_err("only support %d frag size\n", LOG_BUF_FRAG_SIZE); + return -EINVAL; + } + return 0; +} + +static long vfio_log_buf_setup(struct vfio_container *container, + unsigned long data) +{ + struct vfio_log_buf_info info; + struct vfio_log_buf *log_buf = &container->log_buf; + struct device *dev = NULL; + long ret; + + if (log_buf->info.sgevec) { + pr_warn("log buf already setup\n"); + return 0; + } + + if (copy_from_user(&info, (void __user *)data, + sizeof(struct vfio_log_buf_info))) + return -EFAULT; + + ret = vfio_log_buf_info_valid(&info); + if (ret) + return ret; + + ret = vfio_log_buf_alloc_addrs(&info, log_buf); + if (ret) + goto err_out; + + dev = vfio_get_dev(container); + if (!dev) { + pr_err("can`t get dev\n"); + goto err_free_addrs; + } + + ret = vfio_log_buf_alloc_dma(&info, log_buf, dev); + if (ret) + goto err_free_dma_array; + + log_buf->info.uuid = info.uuid; + log_buf->info.buffer_size = info.buffer_size; + log_buf->info.frag_size = info.frag_size; + log_buf->info.addrs_size = info.addrs_size; + log_buf->buffer_state = 1; + return 0; + +err_free_dma_array: + vfio_log_buf_release_dma(dev, log_buf); +err_free_addrs: + kfree(log_buf->cpu_addrs); + log_buf->cpu_addrs = NULL; + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; +err_out: + return -ENOMEM; +} + +static long vfio_log_buf_release_buffer(struct vfio_container *container) +{ + struct vfio_log_buf *log_buf = &container->log_buf; + struct device *dev = NULL; + + if (log_buf->buffer_state == 0) { + pr_warn("buffer already released\n"); + return 0; + } + + dev = vfio_get_dev(container); + if (!dev) { + pr_err("can`t get dev\n"); + return -EFAULT; + } + + vfio_log_buf_release_dma(dev, log_buf); + + kfree(log_buf->cpu_addrs); + log_buf->cpu_addrs = NULL; + + kfree(log_buf->info.sgevec); + log_buf->info.sgevec = NULL; + + log_buf->buffer_state = 0; + return 0; +} + +static int vfio_log_buf_release(struct inode *inode, struct file *filep) +{ + struct vfio_container *container = filep->private_data; + + vfio_log_buf_stop(container); + vfio_log_buf_release_buffer(container); + memset(&container->log_buf, 0, sizeof(struct vfio_log_buf)); + return 0; +} + +static long vfio_ioctl_handle_log_buf_ctl(struct vfio_container *container, + unsigned long arg) +{ + struct vfio_log_buf_ctl log_buf_ctl; + long ret = 0; + + if (copy_from_user(&log_buf_ctl, (void __user *)arg, + sizeof(struct vfio_log_buf_ctl))) + return -EFAULT; + + switch (log_buf_ctl.flags) { + case VFIO_DEVICE_LOG_BUF_FLAG_SETUP: + ret = vfio_log_buf_setup(container, + (unsigned long)log_buf_ctl.data); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_RELEASE: + ret = vfio_log_buf_release_buffer(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_START: + ret = vfio_log_buf_start(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STOP: + ret = vfio_log_buf_stop(container); + break; + case VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY: + ret = vfio_log_buf_query(container); + break; + default: + pr_err("log buf control flag incorrect\n"); + ret = -EINVAL; + break; + } + return ret; +} + +static long vfio_log_buf_fops_unl_ioctl(struct file *filep, + unsigned int cmd, unsigned long arg) +{ + struct vfio_container *container = filep->private_data; + long ret = -EINVAL; + + switch (cmd) { + case VFIO_LOG_BUF_CTL: + ret = vfio_ioctl_handle_log_buf_ctl(container, arg); + break; + default: + pr_err("log buf control cmd incorrect\n"); + break; + } + + return ret; +} + +#ifdef CONFIG_COMPAT +static long vfio_log_buf_fops_compat_ioctl(struct file *filep, + unsigned int cmd, unsigned long arg) +{ + arg = (unsigned long)compat_ptr(arg); + return vfio_log_buf_fops_unl_ioctl(filep, cmd, arg); +} +#endif /* CONFIG_COMPAT */ + +static const struct file_operations vfio_log_buf_fops = { + .owner = THIS_MODULE, + .mmap = vfio_log_buf_fops_mmap, + .unlocked_ioctl = vfio_log_buf_fops_unl_ioctl, + .release = vfio_log_buf_release, +#ifdef CONFIG_COMPAT + .compat_ioctl = vfio_log_buf_fops_compat_ioctl, +#endif +}; + +static int vfio_get_log_buf_fd(struct vfio_container *container, + unsigned long arg) +{ + struct file *filep = NULL; + int ret; + + if (container->log_buf.fd > 0) + return container->log_buf.fd; + + ret = get_unused_fd_flags(O_CLOEXEC); + if (ret < 0) { + pr_err("get_unused_fd_flags get fd failed\n"); + return ret; + } + + filep = anon_inode_getfile("[vfio-log-buf]", &vfio_log_buf_fops, + container, O_RDWR); + if (IS_ERR(filep)) { + pr_err("anon_inode_getfile failed\n"); + put_unused_fd(ret); + ret = PTR_ERR(filep); + return ret; + } + + filep->f_mode |= (FMODE_READ | FMODE_WRITE | FMODE_LSEEK); + + fd_install(ret, filep); + + container->log_buf.fd = ret; + return ret; +} + static long vfio_fops_unl_ioctl(struct file *filep, - unsigned int cmd, unsigned long arg) + unsigned int cmd, unsigned long arg) { struct vfio_container *container = filep->private_data; struct vfio_iommu_driver *driver; @@ -1179,6 +1582,9 @@ static long vfio_fops_unl_ioctl(struct file *filep, case VFIO_SET_IOMMU: ret = vfio_ioctl_set_iommu(container, arg); break; + case VFIO_GET_LOG_BUF_FD: + ret = vfio_get_log_buf_fd(container, arg); + break; default: driver = container->iommu_driver; data = container->iommu_data; @@ -1210,6 +1616,7 @@ static int vfio_fops_open(struct inode *inode, struct file *filep) INIT_LIST_HEAD(&container->group_list); init_rwsem(&container->group_lock); kref_init(&container->kref); + memset(&container->log_buf, 0, sizeof(struct vfio_log_buf)); filep->private_data = container; @@ -1219,9 +1626,7 @@ static int vfio_fops_open(struct inode *inode, struct file *filep) static int vfio_fops_release(struct inode *inode, struct file *filep) { struct vfio_container *container = filep->private_data; - filep->private_data = NULL; - vfio_container_put(container); return 0; diff --git a/include/linux/vfio_pci_migration.h b/include/linux/vfio_pci_migration.h new file mode 100644 index 0000000..464ffb4 --- /dev/null +++ b/include/linux/vfio_pci_migration.h @@ -0,0 +1,136 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) 2022 Huawei Technologies Co., Ltd. All rights reserved. + */ + +#ifndef VFIO_PCI_MIGRATION_H +#define VFIO_PCI_MIGRATION_H + +#include <linux/types.h> +#include <linux/pci.h> + +#define VFIO_REGION_TYPE_MIGRATION (3) +/* sub-types for VFIO_REGION_TYPE_MIGRATION */ +#define VFIO_REGION_SUBTYPE_MIGRATION (1) + +#define VFIO_MIGRATION_BUFFER_MAX_SIZE SZ_256K +#define VFIO_MIGRATION_REGION_DATA_OFFSET \ + (sizeof(struct vfio_device_migration_info)) +#define VFIO_DEVICE_MIGRATION_OFFSET(x) \ + offsetof(struct vfio_device_migration_info, x) + +struct vfio_device_migration_info { + __u32 device_state; /* VFIO device state */ +#define VFIO_DEVICE_STATE_STOP (0) +#define VFIO_DEVICE_STATE_RUNNING (1 << 0) +#define VFIO_DEVICE_STATE_SAVING (1 << 1) +#define VFIO_DEVICE_STATE_RESUMING (1 << 2) +#define VFIO_DEVICE_STATE_MASK (VFIO_DEVICE_STATE_RUNNING | \ + VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RESUMING) + __u32 reserved; + + __u32 device_cmd; + __u32 version_id; + + __u64 pending_bytes; + __u64 data_offset; + __u64 data_size; +}; + +enum { + VFIO_DEVICE_STOP = 0xffff0001, + VFIO_DEVICE_CONTINUE, + VFIO_DEVICE_MIGRATION_CANCEL, +}; + +struct vfio_log_buf_sge { + __u64 len; + __u64 addr; +}; + +struct vfio_log_buf_info { + __u32 uuid; + __u64 buffer_size; + __u64 addrs_size; + __u64 frag_size; + struct vfio_log_buf_sge *sgevec; +}; + +struct vfio_log_buf_ctl { + __u32 argsz; + __u32 flags; + #define VFIO_DEVICE_LOG_BUF_FLAG_SETUP (1 << 0) + #define VFIO_DEVICE_LOG_BUF_FLAG_RELEASE (1 << 1) + #define VFIO_DEVICE_LOG_BUF_FLAG_START (1 << 2) + #define VFIO_DEVICE_LOG_BUF_FLAG_STOP (1 << 3) + #define VFIO_DEVICE_LOG_BUF_FLAG_STATUS_QUERY (1 << 4) + void *data; +}; +#define VFIO_LOG_BUF_CTL _IO(VFIO_TYPE, VFIO_BASE + 21) +#define VFIO_GET_LOG_BUF_FD _IO(VFIO_TYPE, VFIO_BASE + 22) +#define VFIO_DEVICE_LOG_BUF_CTL _IO(VFIO_TYPE, VFIO_BASE + 23) + +struct vf_migration_log_info { + __u32 dom_uuid; + __u64 buffer_size; + __u64 sge_len; + __u64 sge_num; + struct vfio_log_buf_sge *sgevec; +}; + +struct vfio_device_migration_ops { + /* Get device information */ + int (*get_info)(struct pci_dev *pdev, + struct vfio_device_migration_info *info); + /* Enable a vf device */ + int (*enable)(struct pci_dev *pdev); + /* Disable a vf device */ + int (*disable)(struct pci_dev *pdev); + /* Save a vf device */ + int (*save)(struct pci_dev *pdev, void *base, + uint64_t off, uint64_t count); + /* Resuming a vf device */ + int (*restore)(struct pci_dev *pdev, void *base, + uint64_t off, uint64_t count); + /* Log start a vf device */ + int (*log_start)(struct pci_dev *pdev, + struct vf_migration_log_info *log_info); + /* Log stop a vf device */ + int (*log_stop)(struct pci_dev *pdev, uint32_t uuid); + /* Get vf device log status */ + int (*get_log_status)(struct pci_dev *pdev); + /* Pre enable a vf device(load_setup, before restore a vf) */ + int (*pre_enable)(struct pci_dev *pdev); + /* Cancel a vf device when live migration failed (rollback) */ + int (*cancel)(struct pci_dev *pdev); + /* Init a vf device */ + int (*init)(struct pci_dev *pdev); + /* Uninit a vf device */ + void (*uninit)(struct pci_dev *pdev); + /* Release a vf device */ + void (*release)(struct pci_dev *pdev); +}; + +struct vfio_pci_vendor_mig_driver { + struct pci_dev *pdev; + unsigned char bus_num; + struct vfio_device_migration_ops *dev_mig_ops; + struct module *owner; + atomic_t count; + struct list_head list; +}; + +struct vfio_pci_migration_data { + u64 state_size; + struct pci_dev *vf_dev; + struct vfio_pci_vendor_mig_driver *mig_driver; + struct vfio_device_migration_info *mig_ctl; + void *vf_data; +}; + +int vfio_pci_register_migration_ops(struct vfio_device_migration_ops *ops, + struct module *mod, struct pci_dev *pdev); +void vfio_pci_unregister_migration_ops(struct module *mod, + struct pci_dev *pdev); + +#endif /* VFIO_PCI_MIGRATION_H */ -- 1.8.3.1

3 2

[PATCH OLK-5.10 0/7] eulerfs: Add extended attributes support
by gouhao＠uniontech.com 05 Jul '22

05 Jul '22

From: Gou Hao <gouhao(a)uniontech.com> Patch series "Add extended attributes support for EulerFS". I refer to the extended attribute implementation code of ext2 file system. At first, I implemented it completely according to the extended attribute of ext file system. But later, I changed the disk layout of entries. About layout of entry: The layout of ext2's extended attribute is that name and value are stored separately,with name growing from top to bottom and value growing from bottom to top. I think the layout of ext2 wastes space, because, Name and value are aligned with 4 bytes, In the worst case, the name and value of entry need 3 bytes of padding respectively, and a total of 6 bytes are wasted. I store the name and value together. In the worst case, only need 3 bytes of padding.Use xattr-test.c selftests, with the same block size, my method can store 112 entries, while using ext2 layout can only store 102 entries. In ext4 file system, value can be stored in different blocks, which increases the scalability. In my method, it can add a pointer to the next block in the header to achieve the same function, and it is simpler. The performance of my method is the same as that of ext2, or even better. About block share: In ext2, if the extended attributes of two files are exactly the same, they can share the same disk block. Its implementation process is: 1. When accessing the extended attribute of a file, add this extended attribute block to a specific cache. 2. When setting the extended attribute of a file, if there is a block with exactly the same content as this extended attribute in the cache, share that block directly. There is a problem here. If the block of a file is not added to the cache, the extended attribute block will not be shared.So in this patch set, I didn't realize the shared disk block. I'll implement it later when there is a good method or when there is a need. At present, only user. prefix xattr is implemented. Trusted, ACL and security will be implemented later. Gou Hao (7): eulerfs: add EULER_FS_XATTR config eulerfs: add related fields of extended attributes eulerfs: add alloc xattr block interface eulerfs: implement extended attribute core functions eulerfs: add callback interface of extended attribute eulerfs: add implementation of user. prefix extended attribute eulerfs: add selftests for eulerfs extended attribute fs/eulerfs/Kconfig | 9 + fs/eulerfs/Makefile | 1 + fs/eulerfs/alloc_interface.h | 4 + fs/eulerfs/const.h | 1 + fs/eulerfs/euler.h | 1 + fs/eulerfs/euler_def.h | 3 + fs/eulerfs/file.c | 1 + fs/eulerfs/inode.c | 3 + fs/eulerfs/namei.c | 2 + fs/eulerfs/nvalloc.c | 1 + fs/eulerfs/nvalloc.h | 1 + fs/eulerfs/nvm_struct.h | 12 + fs/eulerfs/super.c | 36 +- fs/eulerfs/symlink.c | 1 + fs/eulerfs/xattr.c | 422 ++++++++++++++ fs/eulerfs/xattr.h | 99 ++++ fs/eulerfs/xattr_user.c | 43 ++ tools/testing/selftests/eulerfs/Makefile | 6 + tools/testing/selftests/eulerfs/xattr-test.c | 565 +++++++++++++++++++ 19 files changed, 1209 insertions(+), 2 deletions(-) create mode 100644 fs/eulerfs/xattr.c create mode 100644 fs/eulerfs/xattr.h create mode 100644 fs/eulerfs/xattr_user.c create mode 100644 tools/testing/selftests/eulerfs/Makefile create mode 100644 tools/testing/selftests/eulerfs/xattr-test.c -- 2.20.1

1 7

openEuler kernel SIG例会
by openEuler conference 05 Jul '22

05 Jul '22

您好！ Kernel SIG 邀请您参加 2022-07-08 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler kernel SIG例会会议内容：美团贡献富容器隔离及内部自研混部特性到openEuler kernel的讨论会议链接：https://us06web.zoom.us/j/89123664797?pwd=S1BKR3BHTTBOZUd0TTg2VE9FRUVMQT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-07-08 14:00, The subject of the conference is openEuler kernel SIG例会, Summary: 美团贡献富容器隔离及内部自研混部特性到openEuler kernel的讨论 You can join the meeting at https://us06web.zoom.us/j/89123664797?pwd=S1BKR3BHTTBOZUd0TTg2VE9FRUVMQT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

请问咱们的内核有对飞腾的的设备的支持吗？
by sireg 04 Jul '22

04 Jul '22

我运行咱们的系统在一台分腾d2000的机器上，发现网卡是驱动不起来的。网卡型号是PHYT0004，走的MDIO的总线，使用stmmac的驱动。以上是我了解的相关技术，目前网卡驱动不起来，所以没有相关dmesg日志。正在着手解决该问题，所以提请咨询。                                                                    王铭 sireg firerun(a)qq.com  

2 1

请问咱们的内核有对飞腾的的设备的支持吗？
by sireg 04 Jul '22

04 Jul '22

我运行咱们的系统在一台飞腾d2000的机器上，发现网卡驱动不起来。以上是我了解的相关技术，目前网卡驱动不起来，所以没有相关dmesg日志。网卡型号是PHYT0004，如果驱动起来，应该是走的MDIO的总线，使用stmmac的驱动。正在着手解决该问题，所以提请咨询。                                                                    王铭 sireg firerun(a)qq.com  

1 0

[PATCH openEuler-1.0-LTS 1/4] ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
by Yongqiang Liu 02 Jul '22

02 Jul '22

From: Baokun Li <libaokun1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186866, https://gitee.com/openeuler/kernel/issues/I5DTBL CVE: NA -------------------------------- When adding an xattr to an inode, we must ensure that the inode_size is not less than EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. Otherwise, the end position may be greater than the start position, resulting in UAF. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/xattr.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h index f39cad2abe2a..990084e00374 100644 --- a/fs/ext4/xattr.h +++ b/fs/ext4/xattr.h @@ -95,6 +95,19 @@ struct ext4_xattr_entry { #define EXT4_ZERO_XATTR_VALUE ((void *)-1) +/* + * If we want to add an xattr to the inode, we should make sure that + * i_extra_isize is not 0 and that the inode size is not less than + * EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. + * EXT4_GOOD_OLD_INODE_SIZE extra_isize header entry pad data + * |--------------------------|------------|------|---------|---|-------| + */ +#define EXT4_INODE_HAS_XATTR_SPACE(inode) \ + ((EXT4_I(inode)->i_extra_isize != 0) && \ + (EXT4_GOOD_OLD_INODE_SIZE + EXT4_I(inode)->i_extra_isize + \ + sizeof(struct ext4_xattr_ibody_header) + EXT4_XATTR_PAD <= \ + EXT4_INODE_SIZE((inode)->i_sb))) + struct ext4_xattr_info { const char *name; const void *value; -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS 1/4] mm/sharepool: Fix using uninitialized sp_flag
by Yongqiang Liu 01 Jul '22

01 Jul '22

From: Wang Wensheng <wangwensheng4(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I578LV CVE: NA ------------------------------------------------- Add the missing initialization for kc.sp_flag in sp_make_share_kva_to_spg(). Or a random value would be used in sp_remap_kva_to_vma(). Fixes: da51b55eeff9 ("mm/share_pool: Support read-only memory allocation") Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/share_pool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index ec889155b0ff..893e5352bf01 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -3023,7 +3023,7 @@ static void *sp_make_share_kva_to_spg(unsigned long kva, unsigned long size, } spa->kva = kva; - + kc.sp_flags = sp_flags; list_for_each_entry(spg_node, &spg->procs, proc_node) { mm = spg_node->master->mm; kc.state = K2U_NORMAL; -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS 1/4] alinux: sched: Defend cfs and rt bandwidth against overflow
by liuzhengyuan＠kylinos.cn 30 Jun '22

30 Jun '22

From: Huaixin Chang <changhuaixin(a)linux.alibaba.com> anolis inclusion from anolis_master commit 9d168f216486333f24aa1b33706eddf3b13d7228 category: performance bugzilla: NA CVE: NA --------------------------- Kernel limitation on cpu.cfs_quota_us is insufficient. Some large numbers might cause overflow in to_ratio() calculation and produce unexpected results. For example, if we make two cpu cgroups and then write a reasonable value and a large value into child's and parent's cpu.cfs_quota_us. This will cause a write error. cd /sys/fs/cgroup/cpu mkdir parent; mkdir parent/child echo 8000 > parent/child/cpu.cfs_quota_us # 17592186044416 is (1UL << 44) echo 17592186044416 > parent/cpu.cfs_quota_us In this case, quota will overflow and thus fail the __cfs_schedulable check. Similar overflow also affects rt bandwidth. Burstable CFS bandwidth controller will also benefit from limiting quota. Change-Id: I0f89d1f26b168c5cfa041e886395c7f3068114ae Reviewed-by: Shanpei Chen <shanpeic(a)linux.alibaba.com> Signed-off-by: Huaixin Chang <changhuaixin(a)linux.alibaba.com> Signed-off-by: Zhengyuan Liu <liuzhengyuan(a)kylinos.cn> --- kernel/sched/core.c | 8 ++++++++ kernel/sched/rt.c | 9 +++++++++ kernel/sched/sched.h | 2 ++ 3 files changed, 19 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 36d7422da0ac..51fdd30f188a 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -6679,6 +6679,8 @@ static DEFINE_MUTEX(cfs_constraints_mutex); const u64 max_cfs_quota_period = 1 * NSEC_PER_SEC; /* 1s */ const u64 min_cfs_quota_period = 1 * NSEC_PER_MSEC; /* 1ms */ +/* More than 203 days if BW_SHIFT equals 20. */ +const u64 max_cfs_runtime = MAX_BW_USEC * NSEC_PER_USEC; static int __cfs_schedulable(struct task_group *tg, u64 period, u64 runtime); @@ -6706,6 +6708,12 @@ static int tg_set_cfs_bandwidth(struct task_group *tg, u64 period, u64 quota) if (period > max_cfs_quota_period) return -EINVAL; + /* + * Bound quota to defend quota against overflow during bandwidth shift. + */ + if (quota != RUNTIME_INF && quota > max_cfs_runtime) + return -EINVAL; + /* * Prevent race between setting of cfs_rq->runtime_enabled and * unthrottle_offline_cfs_rqs(). diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index 301ba04d9130..f31e0aaf1f43 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -2518,6 +2518,9 @@ static int __rt_schedulable(struct task_group *tg, u64 period, u64 runtime) return ret; } +/* More than 203 days if BW_SHIFT equals 20. */ +static const u64 max_rt_runtime = MAX_BW_USEC * NSEC_PER_USEC; + static int tg_set_rt_bandwidth(struct task_group *tg, u64 rt_period, u64 rt_runtime) { @@ -2534,6 +2537,12 @@ static int tg_set_rt_bandwidth(struct task_group *tg, if (rt_period == 0) return -EINVAL; + /* + * Bound quota to defend quota against overflow during bandwidth shift. + */ + if (rt_runtime != RUNTIME_INF && rt_runtime > max_rt_runtime) + return -EINVAL; + mutex_lock(&rt_constraints_mutex); read_lock(&tasklist_lock); err = __rt_schedulable(tg, rt_period, rt_runtime); diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index ae3068153093..f3808a49ce48 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -1732,6 +1732,8 @@ extern void init_dl_rq_bw_ratio(struct dl_rq *dl_rq); #define BW_SHIFT 20 #define BW_UNIT (1 << BW_SHIFT) #define RATIO_SHIFT 8 +#define MAX_BW_BITS (64 - BW_SHIFT) +#define MAX_BW_USEC ((1UL << MAX_BW_BITS) - 1) unsigned long to_ratio(u64 period, u64 runtime); extern void init_entity_runnable_average(struct sched_entity *se); -- 2.25.1

3 6

[PATCH openEuler-1.0-LTS 01/14] mm/sharepool: Delete single-group mode
by Yongqiang Liu 29 Jun '22

29 Jun '22

From: Zhou Guanghui <zhouguanghui1(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5EORS CVE: NA -------------------------------- The single-group mode has no application scenario. Therefore, the related branch is deleted. The boot option "enable_sp_multi_group_mode" does not take effect. Signed-off-by: Zhou Guanghui <zhouguanghui1(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/share_pool.c | 137 +++++++++--------------------------------------- 1 file changed, 25 insertions(+), 112 deletions(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index 5ba353ddfabd..48e309e3ddd3 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -65,9 +65,6 @@ #define byte2mb(size) ((size) >> 20) #define page2kb(page_num) ((page_num) << (PAGE_SHIFT - 10)) -#define SINGLE_GROUP_MODE 1 -#define MULTI_GROUP_MODE 2 - #define MAX_GROUP_FOR_SYSTEM 50000 #define MAX_GROUP_FOR_TASK 3000 #define MAX_PROC_PER_GROUP 1024 @@ -98,8 +95,6 @@ int sysctl_sp_perf_alloc; int sysctl_sp_perf_k2u; -static int share_pool_group_mode = SINGLE_GROUP_MODE; - static int system_group_count; static unsigned int sp_device_number; @@ -1088,12 +1083,6 @@ static int mm_add_group_init(struct mm_struct *mm, struct sp_group *spg) struct sp_group_master *master = mm->sp_group_master; bool exist = false; - if (share_pool_group_mode == SINGLE_GROUP_MODE && master && - master->count == 1) { - pr_err_ratelimited("at most one sp group for a task is allowed in single mode\n"); - return -EEXIST; - } - master = sp_init_group_master_locked(mm, &exist); if (IS_ERR(master)) return PTR_ERR(master); @@ -2235,72 +2224,30 @@ static int sp_alloc_prepare(unsigned long size, unsigned long sp_flags, if (sp_flags & SP_HUGEPAGE_ONLY) sp_flags |= SP_HUGEPAGE; - if (share_pool_group_mode == SINGLE_GROUP_MODE) { - spg = __sp_find_spg(current->pid, SPG_ID_DEFAULT); - if (spg) { - if (spg_id != SPG_ID_DEFAULT && spg->id != spg_id) { - sp_group_drop(spg); - return -ENODEV; - } - - /* up_read will be at the end of sp_alloc */ - down_read(&spg->rw_lock); - if (!spg_valid(spg)) { - up_read(&spg->rw_lock); - sp_group_drop(spg); - pr_err_ratelimited("allocation failed, spg is dead\n"); - return -ENODEV; - } - } else { /* alocation pass through scene */ - if (enable_mdc_default_group) { - int ret = 0; - - ret = sp_group_add_task(current->tgid, spg_id); - if (ret < 0) { - pr_err_ratelimited("add group failed in pass through\n"); - return ret; - } - - spg = __sp_find_spg(current->pid, SPG_ID_DEFAULT); - - /* up_read will be at the end of sp_alloc */ - down_read(&spg->rw_lock); - if (!spg_valid(spg)) { - up_read(&spg->rw_lock); - sp_group_drop(spg); - pr_err_ratelimited("pass through allocation failed, spg is dead\n"); - return -ENODEV; - } - } else { - spg = spg_none; - } + if (spg_id != SPG_ID_DEFAULT) { + spg = __sp_find_spg(current->pid, spg_id); + if (!spg) { + pr_err_ratelimited("allocation failed, can't find group\n"); + return -ENODEV; } - } else { - if (spg_id != SPG_ID_DEFAULT) { - spg = __sp_find_spg(current->pid, spg_id); - if (!spg) { - pr_err_ratelimited("allocation failed, can't find group\n"); - return -ENODEV; - } - /* up_read will be at the end of sp_alloc */ - down_read(&spg->rw_lock); - if (!spg_valid(spg)) { - up_read(&spg->rw_lock); - sp_group_drop(spg); - pr_err_ratelimited("allocation failed, spg is dead\n"); - return -ENODEV; - } + /* up_read will be at the end of sp_alloc */ + down_read(&spg->rw_lock); + if (!spg_valid(spg)) { + up_read(&spg->rw_lock); + sp_group_drop(spg); + pr_err_ratelimited("allocation failed, spg is dead\n"); + return -ENODEV; + } - if (!is_process_in_group(spg, current->mm)) { - up_read(&spg->rw_lock); - sp_group_drop(spg); - pr_err_ratelimited("allocation failed, task not in group\n"); - return -ENODEV; - } - } else { /* alocation pass through scene */ - spg = spg_none; + if (!is_process_in_group(spg, current->mm)) { + up_read(&spg->rw_lock); + sp_group_drop(spg); + pr_err_ratelimited("allocation failed, task not in group\n"); + return -ENODEV; } + } else { /* alocation pass through scene */ + spg = spg_none; } if (sp_flags & SP_HUGEPAGE) { @@ -2914,33 +2861,12 @@ static int sp_k2u_prepare(unsigned long kva, unsigned long size, kc->size_aligned = size_aligned; kc->sp_flags = sp_flags; kc->spg_id = spg_id; - kc->to_task = false; - return 0; -} - -static int sp_check_k2task(struct sp_k2u_context *kc) -{ - int ret = 0; - int spg_id = kc->spg_id; - - if (share_pool_group_mode == SINGLE_GROUP_MODE) { - struct sp_group *spg = get_first_group(current->mm); + if (spg_id == SPG_ID_DEFAULT || spg_id == SPG_ID_NONE) + kc->to_task = true; + else + kc->to_task = false; - if (!spg) { - if (spg_id != SPG_ID_NONE && spg_id != SPG_ID_DEFAULT) - ret = -EINVAL; - else - kc->to_task = true; - } else { - if (spg_id != SPG_ID_DEFAULT && spg_id != spg->id) - ret = -EINVAL; - sp_group_drop(spg); - } - } else { - if (spg_id == SPG_ID_DEFAULT || spg_id == SPG_ID_NONE) - kc->to_task = true; - } - return ret; + return 0; } static void *sp_k2u_finish(void *uva, struct sp_k2u_context *kc) @@ -2985,12 +2911,6 @@ void *sp_make_share_k2u(unsigned long kva, unsigned long size, if (ret) return ERR_PTR(ret); - ret = sp_check_k2task(&kc); - if (ret) { - uva = ERR_PTR(ret); - goto out; - } - if (kc.to_task) uva = sp_make_share_kva_to_task(kc.kva_aligned, kc.size_aligned, kc.sp_flags); else { @@ -3738,13 +3658,6 @@ static int __init enable_share_k2u_to_group(char *s) } __setup("enable_sp_share_k2u_spg", enable_share_k2u_to_group); -static int __init enable_sp_multi_group_mode(char *s) -{ - share_pool_group_mode = MULTI_GROUP_MODE; - return 1; -} -__setup("enable_sp_multi_group_mode", enable_sp_multi_group_mode); - /*** Statistical and maintenance functions ***/ static void free_process_spg_proc_stat(struct sp_proc_stat *proc_stat) -- 2.25.1

1 13

[PATCH openEuler-22.03-LTS 1/2] ipmi/watchdog: replace atomic_add() and atomic_sub()
by Miaohe Lin 29 Jun '22

29 Jun '22

From: Yejune Deng <yejune.deng(a)gmail.com> mainline inclusion from v5.11-rc1 commit a01a89b1db1066a6af23ae08b9a0c345b7966f0b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DVR9 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- atomic_inc() and atomic_dec() looks better Signed-off-by: Yejune Deng <yejune.deng(a)gmail.com> Message-Id: <1605511807-7135-1-git-send-email-yejune.deng(a)gmail.com> Signed-off-by: Corey Minyard <cminyard(a)mvista.com> Signed-off-by: Miaohe Lin <linmiaohe(a)huawei.com> --- drivers/char/ipmi/ipmi_watchdog.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c index f78156d93c3f..32c334e34d55 100644 --- a/drivers/char/ipmi/ipmi_watchdog.c +++ b/drivers/char/ipmi/ipmi_watchdog.c @@ -495,7 +495,7 @@ static void panic_halt_ipmi_heartbeat(void) msg.cmd = IPMI_WDOG_RESET_TIMER; msg.data = NULL; msg.data_len = 0; - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = ipmi_request_supply_msgs(watchdog_user, (struct ipmi_addr *) &addr, 0, @@ -505,7 +505,7 @@ static void panic_halt_ipmi_heartbeat(void) &panic_halt_heartbeat_recv_msg, 1); if (rv) - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); } static struct ipmi_smi_msg panic_halt_smi_msg = { @@ -529,12 +529,12 @@ static void panic_halt_ipmi_set_timeout(void) /* Wait for the messages to be free. */ while (atomic_read(&panic_done_count) != 0) ipmi_poll_interface(watchdog_user); - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = __ipmi_set_timeout(&panic_halt_smi_msg, &panic_halt_recv_msg, &send_heartbeat_now); if (rv) { - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); pr_warn("Unable to extend the watchdog timeout\n"); } else { if (send_heartbeat_now) -- 2.23.0

1 1

[PATCH openEuler-5.10-LTS 1/8] net: hns3: set port base vlan tbl_sta to false before removing old vlan
by Zheng Zengkai 28 Jun '22

28 Jun '22

From: Guangbin Huang <huangguangbin2(a)huawei.com> mainline inclusion from mainline-v5.19-rc1 commit 9eda7d8bcbdb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DGNU CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- When modify port base vlan, the port base vlan tbl_sta needs to set to false before removing old vlan, to indicate this operation is not finish. Fixes: c0f46de30c96 ("net: hns3: fix port base vlan add fail when concurrent with reset") Signed-off-by: Guangbin Huang <huangguangbin2(a)huawei.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Jiantao Xiao <xiaojiantao1(a)h-partners.com> Reviewed-by: Jian Shen <shenjian15(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index 3e0d8388ad3f..57aaa2f1536f 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -10117,6 +10117,7 @@ static int hclge_modify_port_base_vlan_tag(struct hclge_vport *vport, if (ret) return ret; + vport->port_base_vlan_cfg.tbl_sta = false; /* remove old VLAN tag */ if (old_info->vlan_tag == 0) ret = hclge_set_vf_vlan_common(hdev, vport->vport_id, -- 2.20.1

1 7

[PATCH OLK-5.10 v3 1/2] ipmi/watchdog: replace atomic_add() and atomic_sub()
by Miaohe Lin 28 Jun '22

28 Jun '22

From: Yejune Deng <yejune.deng(a)gmail.com> mainline inclusion from v5.11-rc1 commit a01a89b1db1066a6af23ae08b9a0c345b7966f0b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DVR9 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- atomic_inc() and atomic_dec() looks better Signed-off-by: Yejune Deng <yejune.deng(a)gmail.com> Message-Id: <1605511807-7135-1-git-send-email-yejune.deng(a)gmail.com> Signed-off-by: Corey Minyard <cminyard(a)mvista.com> Signed-off-by: Miaohe Lin <linmiaohe(a)huawei.com> --- drivers/char/ipmi/ipmi_watchdog.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c index f78156d93c3f..32c334e34d55 100644 --- a/drivers/char/ipmi/ipmi_watchdog.c +++ b/drivers/char/ipmi/ipmi_watchdog.c @@ -495,7 +495,7 @@ static void panic_halt_ipmi_heartbeat(void) msg.cmd = IPMI_WDOG_RESET_TIMER; msg.data = NULL; msg.data_len = 0; - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = ipmi_request_supply_msgs(watchdog_user, (struct ipmi_addr *) &addr, 0, @@ -505,7 +505,7 @@ static void panic_halt_ipmi_heartbeat(void) &panic_halt_heartbeat_recv_msg, 1); if (rv) - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); } static struct ipmi_smi_msg panic_halt_smi_msg = { @@ -529,12 +529,12 @@ static void panic_halt_ipmi_set_timeout(void) /* Wait for the messages to be free. */ while (atomic_read(&panic_done_count) != 0) ipmi_poll_interface(watchdog_user); - atomic_add(1, &panic_done_count); + atomic_inc(&panic_done_count); rv = __ipmi_set_timeout(&panic_halt_smi_msg, &panic_halt_recv_msg, &send_heartbeat_now); if (rv) { - atomic_sub(1, &panic_done_count); + atomic_dec(&panic_done_count); pr_warn("Unable to extend the watchdog timeout\n"); } else { if (send_heartbeat_now) -- 2.23.0

1 1

[PATCH openEuler-5.10 1/5] lockdown: also lock down previous kgdb use
by Zheng Zengkai 28 Jun '22

28 Jun '22

From: Daniel Thompson <daniel.thompson(a)linaro.org> from stable-v5.10.119 commit a8f4d63142f947cd22fa615b8b3b8921cdaf4991 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5A5YP CVE: CVE-2022-21499 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… commit eadb2f47a3ced5c64b23b90fd2a3463f63726066 upstream. KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port (for example, via a hypervisor console, which some cloud vendors provide over the network) could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. Fix this by integrating lockdown into kdb's existing permissions mechanism. Unfortunately kgdb does not have any permissions mechanism (although it certainly could be added later) so, for now, kgdb is simply and brutally disabled by immediately exiting the gdb stub without taking any action. For lockdowns established early in the boot (e.g. the normal case) then this should be fine but on systems where kgdb has set breakpoints before the lockdown is enacted than "bad things" will happen. CVE: CVE-2022-21499 Co-developed-by: Stephen Brennan <stephen.s.brennan(a)oracle.com> Signed-off-by: Stephen Brennan <stephen.s.brennan(a)oracle.com> Reviewed-by: Douglas Anderson <dianders(a)chromium.org> Signed-off-by: Daniel Thompson <daniel.thompson(a)linaro.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/security.h | 2 ++ kernel/debug/debug_core.c | 24 ++++++++++++++ kernel/debug/kdb/kdb_main.c | 62 +++++++++++++++++++++++++++++++++++-- security/security.c | 2 ++ 4 files changed, 87 insertions(+), 3 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index 35355429648e..330029ef7e89 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -121,10 +121,12 @@ enum lockdown_reason { LOCKDOWN_DEBUGFS, LOCKDOWN_XMON_WR, LOCKDOWN_BPF_WRITE_USER, + LOCKDOWN_DBG_WRITE_KERNEL, LOCKDOWN_INTEGRITY_MAX, LOCKDOWN_KCORE, LOCKDOWN_KPROBES, LOCKDOWN_BPF_READ, + LOCKDOWN_DBG_READ_KERNEL, LOCKDOWN_PERF, LOCKDOWN_TRACEFS, LOCKDOWN_XMON_RW, diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c index be5b6b97adbf..363f781b56ca 100644 --- a/kernel/debug/debug_core.c +++ b/kernel/debug/debug_core.c @@ -56,6 +56,7 @@ #include <linux/vmacache.h> #include <linux/rcupdate.h> #include <linux/irq.h> +#include <linux/security.h> #include <asm/cacheflush.h> #include <asm/byteorder.h> @@ -762,6 +763,29 @@ static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs, continue; kgdb_connected = 0; } else { + /* + * This is a brutal way to interfere with the debugger + * and prevent gdb being used to poke at kernel memory. + * This could cause trouble if lockdown is applied when + * there is already an active gdb session. For now the + * answer is simply "don't do that". Typically lockdown + * *will* be applied before the debug core gets started + * so only developers using kgdb for fairly advanced + * early kernel debug can be biten by this. Hopefully + * they are sophisticated enough to take care of + * themselves, especially with help from the lockdown + * message printed on the console! + */ + if (security_locked_down(LOCKDOWN_DBG_WRITE_KERNEL)) { + if (IS_ENABLED(CONFIG_KGDB_KDB)) { + /* Switch back to kdb if possible... */ + dbg_kdb_mode = 1; + continue; + } else { + /* ... otherwise just bail */ + break; + } + } error = gdb_serial_stub(ks); } diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c index 930ac1b25ec7..4e09fab52faf 100644 --- a/kernel/debug/kdb/kdb_main.c +++ b/kernel/debug/kdb/kdb_main.c @@ -45,6 +45,7 @@ #include <linux/proc_fs.h> #include <linux/uaccess.h> #include <linux/slab.h> +#include <linux/security.h> #include "kdb_private.h" #undef MODULE_PARAM_PREFIX @@ -197,10 +198,62 @@ struct task_struct *kdb_curr_task(int cpu) } /* - * Check whether the flags of the current command and the permissions - * of the kdb console has allow a command to be run. + * Update the permissions flags (kdb_cmd_enabled) to match the + * current lockdown state. + * + * Within this function the calls to security_locked_down() are "lazy". We + * avoid calling them if the current value of kdb_cmd_enabled already excludes + * flags that might be subject to lockdown. Additionally we deliberately check + * the lockdown flags independently (even though read lockdown implies write + * lockdown) since that results in both simpler code and clearer messages to + * the user on first-time debugger entry. + * + * The permission masks during a read+write lockdown permits the following + * flags: INSPECT, SIGNAL, REBOOT (and ALWAYS_SAFE). + * + * The INSPECT commands are not blocked during lockdown because they are + * not arbitrary memory reads. INSPECT covers the backtrace family (sometimes + * forcing them to have no arguments) and lsmod. These commands do expose + * some kernel state but do not allow the developer seated at the console to + * choose what state is reported. SIGNAL and REBOOT should not be controversial, + * given these are allowed for root during lockdown already. + */ +static void kdb_check_for_lockdown(void) +{ + const int write_flags = KDB_ENABLE_MEM_WRITE | + KDB_ENABLE_REG_WRITE | + KDB_ENABLE_FLOW_CTRL; + const int read_flags = KDB_ENABLE_MEM_READ | + KDB_ENABLE_REG_READ; + + bool need_to_lockdown_write = false; + bool need_to_lockdown_read = false; + + if (kdb_cmd_enabled & (KDB_ENABLE_ALL | write_flags)) + need_to_lockdown_write = + security_locked_down(LOCKDOWN_DBG_WRITE_KERNEL); + + if (kdb_cmd_enabled & (KDB_ENABLE_ALL | read_flags)) + need_to_lockdown_read = + security_locked_down(LOCKDOWN_DBG_READ_KERNEL); + + /* De-compose KDB_ENABLE_ALL if required */ + if (need_to_lockdown_write || need_to_lockdown_read) + if (kdb_cmd_enabled & KDB_ENABLE_ALL) + kdb_cmd_enabled = KDB_ENABLE_MASK & ~KDB_ENABLE_ALL; + + if (need_to_lockdown_write) + kdb_cmd_enabled &= ~write_flags; + + if (need_to_lockdown_read) + kdb_cmd_enabled &= ~read_flags; +} + +/* + * Check whether the flags of the current command, the permissions of the kdb + * console and the lockdown state allow a command to be run. */ -static inline bool kdb_check_flags(kdb_cmdflags_t flags, int permissions, +static bool kdb_check_flags(kdb_cmdflags_t flags, int permissions, bool no_args) { /* permissions comes from userspace so needs massaging slightly */ @@ -1194,6 +1247,9 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs, kdb_curr_task(raw_smp_processor_id()); KDB_DEBUG_STATE("kdb_local 1", reason); + + kdb_check_for_lockdown(); + kdb_go_count = 0; if (reason == KDB_REASON_DEBUG) { /* special case below */ diff --git a/security/security.c b/security/security.c index 4fb58543eeb9..2fc40217d49d 100644 --- a/security/security.c +++ b/security/security.c @@ -59,10 +59,12 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { [LOCKDOWN_DEBUGFS] = "debugfs access", [LOCKDOWN_XMON_WR] = "xmon write access", [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM", + [LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM", [LOCKDOWN_INTEGRITY_MAX] = "integrity", [LOCKDOWN_KCORE] = "/proc/kcore access", [LOCKDOWN_KPROBES] = "use of kprobes", [LOCKDOWN_BPF_READ] = "use of bpf to read kernel RAM", + [LOCKDOWN_DBG_READ_KERNEL] = "use of kgdb/kdb to read kernel RAM", [LOCKDOWN_PERF] = "unsafe use of perf", [LOCKDOWN_TRACEFS] = "use of tracefs", [LOCKDOWN_XMON_RW] = "xmon read and write access", -- 2.20.1

1 4

[PATCH openEuler-5.10 00/31] Backport 5.10.109 LTS
by Zheng Zengkai 28 Jun '22

28 Jun '22

Backport 5.10.109 LTS patches from upstream nds32: fix access_ok() checks in get/put_user wcn36xx: Differentiate wcn3660 from wcn3620 tpm: use try_get_ops() in tpm-space.c mac80211: fix potential double free on mesh join rcu: Don't deboost before reporting expedited quiescent state Revert "ath: add support for special 0x0 regulatory domain" crypto: qat - disable registration of algorithms ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board drivers: net: xgene: Fix regression in CRC stripping ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec ALSA: cmipci: Restore aux vol on suspend/resume ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB ALSA: pcm: Add stream lock during PCM reset ioctl operations ALSA: pcm: Fix races among concurrent prealloc proc writes ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls ALSA: pcm: Fix races among concurrent read/write and buffer changes ALSA: pcm: Fix races among concurrent hw_params and hw_free calls ALSA: hda/realtek: Add quirk for ASUS GA402 ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 ALSA: hda/realtek: Add quirk for Clevo NP50PNJ ALSA: hda/realtek: Add quirk for Clevo NP70PNJ ALSA: usb-audio: add mapping for new Corsair Virtuoso SE ALSA: oss: Fix PCM OSS buffer allocation overflow ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call staging: fbtft: fb_st7789v: reset display before initialization tpm: Fix error handling in async work cgroup-v1: Correct privileges check in release_agent writes exfat: avoid incorrectly releasing for root inode net: ipv6: fix skb_over_panic in __ip6_append_data Already merged: llc: only change llc->dev when bind() succeeds netfilter: nf_tables: initialize registers in nft_do_chain() llc: fix netdevice reference leaks in llc_ui_bind() cgroup: Use open-time cgroup namespace for process migration perm checks cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION Total patches: 37 - 6 = 31 Arnd Bergmann (1): nds32: fix access_ok() checks in get/put_user Brian Norris (1): Revert "ath: add support for special 0x0 regulatory domain" Bryan O'Donoghue (1): wcn36xx: Differentiate wcn3660 from wcn3620 Chen Li (1): exfat: avoid incorrectly releasing for root inode Giacomo Guiduzzi (1): ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec Giovanni Cabiddu (1): crypto: qat - disable registration of algorithms James Bottomley (1): tpm: use try_get_ops() in tpm-space.c Jason Zheng (1): ALSA: hda/realtek: Add quirk for ASUS GA402 Jonathan Teh (1): ALSA: cmipci: Restore aux vol on suspend/resume Lars-Peter Clausen (1): ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB Linus Lüssing (1): mac80211: fix potential double free on mesh join Mark Cilissen (1): ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board Maximilian Luz (1): ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 Michal Koutný (1): cgroup-v1: Correct privileges check in release_agent writes Oliver Graute (1): staging: fbtft: fb_st7789v: reset display before initialization Paul E. McKenney (1): rcu: Don't deboost before reporting expedited quiescent state Reza Jahanbakhshi (1): ALSA: usb-audio: add mapping for new Corsair Virtuoso SE Stephane Graber (1): drivers: net: xgene: Fix regression in CRC stripping Tadeusz Struk (2): net: ipv6: fix skb_over_panic in __ip6_append_data tpm: Fix error handling in async work Takashi Iwai (7): ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call ALSA: oss: Fix PCM OSS buffer allocation overflow ALSA: pcm: Fix races among concurrent hw_params and hw_free calls ALSA: pcm: Fix races among concurrent read/write and buffer changes ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls ALSA: pcm: Fix races among concurrent prealloc proc writes ALSA: pcm: Add stream lock during PCM reset ioctl operations Tim Crawford (2): ALSA: hda/realtek: Add quirk for Clevo NP70PNJ ALSA: hda/realtek: Add quirk for Clevo NP50PNJ Werner Sembach (1): ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU huangwenhui (1): ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 arch/nds32/include/asm/uaccess.h | 22 ++++- arch/x86/kernel/acpi/boot.c | 24 +++++ drivers/acpi/battery.c | 12 +++ drivers/acpi/video_detect.c | 75 ++++++++++++++ drivers/char/tpm/tpm-dev-common.c | 8 +- drivers/char/tpm/tpm2-space.c | 8 +- drivers/crypto/qat/qat_common/qat_crypto.c | 8 ++ .../net/ethernet/apm/xgene/xgene_enet_main.c | 12 ++- drivers/net/wireless/ath/regd.c | 10 +- drivers/net/wireless/ath/wcn36xx/main.c | 3 + drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 + drivers/staging/fbtft/fb_st7789v.c | 2 + fs/exfat/super.c | 2 +- include/sound/pcm.h | 1 + kernel/cgroup/cgroup-v1.c | 6 +- kernel/rcu/tree_plugin.h | 9 +- net/ipv6/ip6_output.c | 4 +- net/mac80211/cfg.c | 3 - sound/core/oss/pcm_oss.c | 12 ++- sound/core/oss/pcm_plugin.c | 5 +- sound/core/pcm.c | 2 + sound/core/pcm_lib.c | 4 + sound/core/pcm_memory.c | 11 ++- sound/core/pcm_native.c | 97 ++++++++++++------- sound/pci/ac97/ac97_codec.c | 4 +- sound/pci/cmipci.c | 3 +- sound/pci/hda/patch_realtek.c | 4 + sound/soc/sti/uniperif_player.c | 6 +- sound/soc/sti/uniperif_reader.c | 2 +- sound/usb/mixer_maps.c | 10 ++ sound/usb/mixer_quirks.c | 7 +- 31 files changed, 289 insertions(+), 88 deletions(-) -- 2.20.1

1 31

[PATCH openEuler-1.0-LTS] io_uring: io_close: Set owner as current->files if req->work.files uninitialized
by Yongqiang Liu 28 Jun '22

28 Jun '22

From: Zhihao Cheng <chengzhihao1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186543, https://gitee.com/openeuler/kernel/issues/I5BGFA CVE: NA -------------------------------- Following process will trigger an use-after-free problem: 1. open /proc/sysvipc/msg and lock it by file lock fcntl_setlk do_lock_file_wait vfs_lock_file posix_lock_file locks_insert_lock_ctx locks_insert_global_locks // Added to lock list 2. Close /proc/sysvipc/msg by io_uring filp_close(close->put_file, req->work.files) // req->work.files equals NULL，io_grab_files() initialize it, non-async operations won't invokes the function. locks_remove_posix(filp, NULL) lock.fl_owner = NULL vfs_lock_file posix_lock_file posix_same_owner // Return false according to fl_owner. locks_delete_lock_ctx(fl, &dispose) and locks_dispose_list won't be executed, flock is not removed from lock list fput(filp) // release filp 3. Read /proc/locks seq_read locks_start // Get flock from lock list locks_show lock_get_status file_inode(f->file) // Access released file, UAF occurs! Fix it by passing current->files when req->work.files is uninitialized, because io-sq thread shares same files with uring_fd task, so it still works in SQPOLL mode. Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/io_uring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index c104425b2557..7ae8ba98e73b 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -3903,7 +3903,7 @@ static int io_close(struct io_kiocb *req, bool force_nonblock, } /* No ->flush() or already async, safely close from here */ - ret = filp_close(close->put_file, req->work.files); + ret = filp_close(close->put_file, req->work.files ? : current->files); if (ret < 0) req_set_fail_links(req); fput(close->put_file); -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 1/5] lockdown: also lock down previous kgdb use
by Zheng Zengkai 27 Jun '22

27 Jun '22

From: Daniel Thompson <daniel.thompson(a)linaro.org> from stable-v5.10.119 commit a8f4d63142f947cd22fa615b8b3b8921cdaf4991 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5A5YP CVE: CVE-2022-21499 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… commit eadb2f47a3ced5c64b23b90fd2a3463f63726066 upstream. KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port (for example, via a hypervisor console, which some cloud vendors provide over the network) could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. Fix this by integrating lockdown into kdb's existing permissions mechanism. Unfortunately kgdb does not have any permissions mechanism (although it certainly could be added later) so, for now, kgdb is simply and brutally disabled by immediately exiting the gdb stub without taking any action. For lockdowns established early in the boot (e.g. the normal case) then this should be fine but on systems where kgdb has set breakpoints before the lockdown is enacted than "bad things" will happen. CVE: CVE-2022-21499 Co-developed-by: Stephen Brennan <stephen.s.brennan(a)oracle.com> Signed-off-by: Stephen Brennan <stephen.s.brennan(a)oracle.com> Reviewed-by: Douglas Anderson <dianders(a)chromium.org> Signed-off-by: Daniel Thompson <daniel.thompson(a)linaro.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/security.h | 2 ++ kernel/debug/debug_core.c | 24 ++++++++++++++ kernel/debug/kdb/kdb_main.c | 62 +++++++++++++++++++++++++++++++++++-- security/security.c | 2 ++ 4 files changed, 87 insertions(+), 3 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index 35355429648e..330029ef7e89 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -121,10 +121,12 @@ enum lockdown_reason { LOCKDOWN_DEBUGFS, LOCKDOWN_XMON_WR, LOCKDOWN_BPF_WRITE_USER, + LOCKDOWN_DBG_WRITE_KERNEL, LOCKDOWN_INTEGRITY_MAX, LOCKDOWN_KCORE, LOCKDOWN_KPROBES, LOCKDOWN_BPF_READ, + LOCKDOWN_DBG_READ_KERNEL, LOCKDOWN_PERF, LOCKDOWN_TRACEFS, LOCKDOWN_XMON_RW, diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c index be5b6b97adbf..363f781b56ca 100644 --- a/kernel/debug/debug_core.c +++ b/kernel/debug/debug_core.c @@ -56,6 +56,7 @@ #include <linux/vmacache.h> #include <linux/rcupdate.h> #include <linux/irq.h> +#include <linux/security.h> #include <asm/cacheflush.h> #include <asm/byteorder.h> @@ -762,6 +763,29 @@ static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs, continue; kgdb_connected = 0; } else { + /* + * This is a brutal way to interfere with the debugger + * and prevent gdb being used to poke at kernel memory. + * This could cause trouble if lockdown is applied when + * there is already an active gdb session. For now the + * answer is simply "don't do that". Typically lockdown + * *will* be applied before the debug core gets started + * so only developers using kgdb for fairly advanced + * early kernel debug can be biten by this. Hopefully + * they are sophisticated enough to take care of + * themselves, especially with help from the lockdown + * message printed on the console! + */ + if (security_locked_down(LOCKDOWN_DBG_WRITE_KERNEL)) { + if (IS_ENABLED(CONFIG_KGDB_KDB)) { + /* Switch back to kdb if possible... */ + dbg_kdb_mode = 1; + continue; + } else { + /* ... otherwise just bail */ + break; + } + } error = gdb_serial_stub(ks); } diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c index 930ac1b25ec7..4e09fab52faf 100644 --- a/kernel/debug/kdb/kdb_main.c +++ b/kernel/debug/kdb/kdb_main.c @@ -45,6 +45,7 @@ #include <linux/proc_fs.h> #include <linux/uaccess.h> #include <linux/slab.h> +#include <linux/security.h> #include "kdb_private.h" #undef MODULE_PARAM_PREFIX @@ -197,10 +198,62 @@ struct task_struct *kdb_curr_task(int cpu) } /* - * Check whether the flags of the current command and the permissions - * of the kdb console has allow a command to be run. + * Update the permissions flags (kdb_cmd_enabled) to match the + * current lockdown state. + * + * Within this function the calls to security_locked_down() are "lazy". We + * avoid calling them if the current value of kdb_cmd_enabled already excludes + * flags that might be subject to lockdown. Additionally we deliberately check + * the lockdown flags independently (even though read lockdown implies write + * lockdown) since that results in both simpler code and clearer messages to + * the user on first-time debugger entry. + * + * The permission masks during a read+write lockdown permits the following + * flags: INSPECT, SIGNAL, REBOOT (and ALWAYS_SAFE). + * + * The INSPECT commands are not blocked during lockdown because they are + * not arbitrary memory reads. INSPECT covers the backtrace family (sometimes + * forcing them to have no arguments) and lsmod. These commands do expose + * some kernel state but do not allow the developer seated at the console to + * choose what state is reported. SIGNAL and REBOOT should not be controversial, + * given these are allowed for root during lockdown already. + */ +static void kdb_check_for_lockdown(void) +{ + const int write_flags = KDB_ENABLE_MEM_WRITE | + KDB_ENABLE_REG_WRITE | + KDB_ENABLE_FLOW_CTRL; + const int read_flags = KDB_ENABLE_MEM_READ | + KDB_ENABLE_REG_READ; + + bool need_to_lockdown_write = false; + bool need_to_lockdown_read = false; + + if (kdb_cmd_enabled & (KDB_ENABLE_ALL | write_flags)) + need_to_lockdown_write = + security_locked_down(LOCKDOWN_DBG_WRITE_KERNEL); + + if (kdb_cmd_enabled & (KDB_ENABLE_ALL | read_flags)) + need_to_lockdown_read = + security_locked_down(LOCKDOWN_DBG_READ_KERNEL); + + /* De-compose KDB_ENABLE_ALL if required */ + if (need_to_lockdown_write || need_to_lockdown_read) + if (kdb_cmd_enabled & KDB_ENABLE_ALL) + kdb_cmd_enabled = KDB_ENABLE_MASK & ~KDB_ENABLE_ALL; + + if (need_to_lockdown_write) + kdb_cmd_enabled &= ~write_flags; + + if (need_to_lockdown_read) + kdb_cmd_enabled &= ~read_flags; +} + +/* + * Check whether the flags of the current command, the permissions of the kdb + * console and the lockdown state allow a command to be run. */ -static inline bool kdb_check_flags(kdb_cmdflags_t flags, int permissions, +static bool kdb_check_flags(kdb_cmdflags_t flags, int permissions, bool no_args) { /* permissions comes from userspace so needs massaging slightly */ @@ -1194,6 +1247,9 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs, kdb_curr_task(raw_smp_processor_id()); KDB_DEBUG_STATE("kdb_local 1", reason); + + kdb_check_for_lockdown(); + kdb_go_count = 0; if (reason == KDB_REASON_DEBUG) { /* special case below */ diff --git a/security/security.c b/security/security.c index 4fb58543eeb9..2fc40217d49d 100644 --- a/security/security.c +++ b/security/security.c @@ -59,10 +59,12 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { [LOCKDOWN_DEBUGFS] = "debugfs access", [LOCKDOWN_XMON_WR] = "xmon write access", [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM", + [LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM", [LOCKDOWN_INTEGRITY_MAX] = "integrity", [LOCKDOWN_KCORE] = "/proc/kcore access", [LOCKDOWN_KPROBES] = "use of kprobes", [LOCKDOWN_BPF_READ] = "use of bpf to read kernel RAM", + [LOCKDOWN_DBG_READ_KERNEL] = "use of kgdb/kdb to read kernel RAM", [LOCKDOWN_PERF] = "unsafe use of perf", [LOCKDOWN_TRACEFS] = "use of tracefs", [LOCKDOWN_XMON_RW] = "xmon read and write access", -- 2.20.1

1 4

[PATCH openEuler-5.10-LTS 00/31] Backport 5.10.109 LTS
by Zheng Zengkai 27 Jun '22

27 Jun '22

Backport 5.10.109 LTS patches from upstream nds32: fix access_ok() checks in get/put_user wcn36xx: Differentiate wcn3660 from wcn3620 tpm: use try_get_ops() in tpm-space.c mac80211: fix potential double free on mesh join rcu: Don't deboost before reporting expedited quiescent state Revert "ath: add support for special 0x0 regulatory domain" crypto: qat - disable registration of algorithms ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board drivers: net: xgene: Fix regression in CRC stripping ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec ALSA: cmipci: Restore aux vol on suspend/resume ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB ALSA: pcm: Add stream lock during PCM reset ioctl operations ALSA: pcm: Fix races among concurrent prealloc proc writes ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls ALSA: pcm: Fix races among concurrent read/write and buffer changes ALSA: pcm: Fix races among concurrent hw_params and hw_free calls ALSA: hda/realtek: Add quirk for ASUS GA402 ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 ALSA: hda/realtek: Add quirk for Clevo NP50PNJ ALSA: hda/realtek: Add quirk for Clevo NP70PNJ ALSA: usb-audio: add mapping for new Corsair Virtuoso SE ALSA: oss: Fix PCM OSS buffer allocation overflow ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call staging: fbtft: fb_st7789v: reset display before initialization tpm: Fix error handling in async work cgroup-v1: Correct privileges check in release_agent writes exfat: avoid incorrectly releasing for root inode net: ipv6: fix skb_over_panic in __ip6_append_data Already merged: llc: only change llc->dev when bind() succeeds netfilter: nf_tables: initialize registers in nft_do_chain() llc: fix netdevice reference leaks in llc_ui_bind() cgroup: Use open-time cgroup namespace for process migration perm checks cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION Total patches: 37 - 6 = 31 Arnd Bergmann (1): nds32: fix access_ok() checks in get/put_user Brian Norris (1): Revert "ath: add support for special 0x0 regulatory domain" Bryan O'Donoghue (1): wcn36xx: Differentiate wcn3660 from wcn3620 Chen Li (1): exfat: avoid incorrectly releasing for root inode Giacomo Guiduzzi (1): ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec Giovanni Cabiddu (1): crypto: qat - disable registration of algorithms James Bottomley (1): tpm: use try_get_ops() in tpm-space.c Jason Zheng (1): ALSA: hda/realtek: Add quirk for ASUS GA402 Jonathan Teh (1): ALSA: cmipci: Restore aux vol on suspend/resume Lars-Peter Clausen (1): ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB Linus Lüssing (1): mac80211: fix potential double free on mesh join Mark Cilissen (1): ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board Maximilian Luz (1): ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 Michal Koutný (1): cgroup-v1: Correct privileges check in release_agent writes Oliver Graute (1): staging: fbtft: fb_st7789v: reset display before initialization Paul E. McKenney (1): rcu: Don't deboost before reporting expedited quiescent state Reza Jahanbakhshi (1): ALSA: usb-audio: add mapping for new Corsair Virtuoso SE Stephane Graber (1): drivers: net: xgene: Fix regression in CRC stripping Tadeusz Struk (2): net: ipv6: fix skb_over_panic in __ip6_append_data tpm: Fix error handling in async work Takashi Iwai (7): ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call ALSA: oss: Fix PCM OSS buffer allocation overflow ALSA: pcm: Fix races among concurrent hw_params and hw_free calls ALSA: pcm: Fix races among concurrent read/write and buffer changes ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls ALSA: pcm: Fix races among concurrent prealloc proc writes ALSA: pcm: Add stream lock during PCM reset ioctl operations Tim Crawford (2): ALSA: hda/realtek: Add quirk for Clevo NP70PNJ ALSA: hda/realtek: Add quirk for Clevo NP50PNJ Werner Sembach (1): ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU huangwenhui (1): ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 arch/nds32/include/asm/uaccess.h | 22 ++++- arch/x86/kernel/acpi/boot.c | 24 +++++ drivers/acpi/battery.c | 12 +++ drivers/acpi/video_detect.c | 75 ++++++++++++++ drivers/char/tpm/tpm-dev-common.c | 8 +- drivers/char/tpm/tpm2-space.c | 8 +- drivers/crypto/qat/qat_common/qat_crypto.c | 8 ++ .../net/ethernet/apm/xgene/xgene_enet_main.c | 12 ++- drivers/net/wireless/ath/regd.c | 10 +- drivers/net/wireless/ath/wcn36xx/main.c | 3 + drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 + drivers/staging/fbtft/fb_st7789v.c | 2 + fs/exfat/super.c | 2 +- include/sound/pcm.h | 1 + kernel/cgroup/cgroup-v1.c | 6 +- kernel/rcu/tree_plugin.h | 9 +- net/ipv6/ip6_output.c | 4 +- net/mac80211/cfg.c | 3 - sound/core/oss/pcm_oss.c | 12 ++- sound/core/oss/pcm_plugin.c | 5 +- sound/core/pcm.c | 2 + sound/core/pcm_lib.c | 4 + sound/core/pcm_memory.c | 11 ++- sound/core/pcm_native.c | 97 ++++++++++++------- sound/pci/ac97/ac97_codec.c | 4 +- sound/pci/cmipci.c | 3 +- sound/pci/hda/patch_realtek.c | 4 + sound/soc/sti/uniperif_player.c | 6 +- sound/soc/sti/uniperif_reader.c | 2 +- sound/usb/mixer_maps.c | 10 ++ sound/usb/mixer_quirks.c | 7 +- 31 files changed, 289 insertions(+), 88 deletions(-) -- 2.20.1

1 31

[PATCH openEuler-1.0-LTS] mm/memcontrol: fix wrong vmstats for dying memcg
by Yongqiang Liu 27 Jun '22

27 Jun '22

From: Lu Jialin <lujialin4(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5E8LA CVE: NA -------------------------------- At present, only when the absolute value of stat_cpu->count exceeds MEMCG_CHARGE_BATCH will it be updated to stat, so there will always be a certain lag difference between stat and the correct value. In addition, since the partially deleted memcg is still referenced, it will not be freed immediately after it is offline. Although the remaining memcg has released the page, it and the parent's stat will still be not 0 or too large due to the update lag, which leads to the abnormality of the total_<count> parameter in the memory.stat file. This patch mainly solves the problem of synchronization between memcg's stat and the correct value during the destruction process from two aspects: 1) Perform a flush synchronization operation when memcg is offline 2) For memcg in the process of being destroyed, bypass the threshold judgment when updating vmstats Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/memcontrol.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 2983baf910f4..345a9d159ad8 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -697,7 +697,8 @@ void __mod_memcg_state(struct mem_cgroup *memcg, int idx, int val) return; x = val + __this_cpu_read(memcg->stat_cpu->count[idx]); - if (unlikely(abs(x) > MEMCG_CHARGE_BATCH)) { + if (unlikely(abs(x) > MEMCG_CHARGE_BATCH || + memcg->css.flags & CSS_DYING)) { struct mem_cgroup *mi; struct mem_cgroup_extension *memcg_ext; @@ -3244,8 +3245,10 @@ static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg) stat[i] = 0; for_each_online_cpu(cpu) - for (i = 0; i < MEMCG_NR_STAT; i++) + for (i = 0; i < MEMCG_NR_STAT; i++) { stat[i] += per_cpu(memcg->stat_cpu->count[i], cpu); + per_cpu(memcg->stat_cpu->count[i], cpu) = 0; + } for (mi = memcg; mi; mi = parent_mem_cgroup(mi)) for (i = 0; i < MEMCG_NR_STAT; i++) @@ -3259,9 +3262,11 @@ static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg) stat[i] = 0; for_each_online_cpu(cpu) - for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++) + for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++) { stat[i] += per_cpu( pn->lruvec_stat_cpu->count[i], cpu); + per_cpu(pn->lruvec_stat_cpu->count[i], cpu) = 0; + } for (pi = pn; pi; pi = parent_nodeinfo(pi, node)) for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++) @@ -3279,9 +3284,11 @@ static void memcg_flush_percpu_vmevents(struct mem_cgroup *memcg) events[i] = 0; for_each_online_cpu(cpu) - for (i = 0; i < NR_VM_EVENT_ITEMS; i++) + for (i = 0; i < NR_VM_EVENT_ITEMS; i++) { events[i] += per_cpu(memcg->stat_cpu->events[i], cpu); + per_cpu(memcg->stat_cpu->events[i], cpu) = 0; + } for (mi = memcg; mi; mi = parent_mem_cgroup(mi)) for (i = 0; i < NR_VM_EVENT_ITEMS; i++) @@ -5106,6 +5113,9 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css) memcg_offline_kmem(memcg); wb_memcg_offline(memcg); + memcg_flush_percpu_vmstats(memcg); + memcg_flush_percpu_vmevents(memcg); + mem_cgroup_id_put(memcg); } -- 2.25.1

1 0

sig-Intel-Arch 例会
by Tian, Jun J 27 Jun '22

27 Jun '22

大家好，本次Intel Arch例会定于本周二6/28 10:00-11:00AM进行, 欢迎大家提出更多需求或议题和参与讨论。本次初步议题： Agenda: *Status update *SPR feature PRs merge into intel-kernel & OLK-5.10 kernel *Compiler support for new instructions *Support 22.09 release for SPR fundamental features -----Original Appointment----- From: openEuler conference <public(a)openeuler.org> Sent: Monday, June 20, 2022 3:10 PM To: openEuler conference; jun.j.tian@intel.com,kai.liu@suse.com Subject: sig-Intel-Arch When: Tuesday, June 28, 2022 10:00 AM-11:00 AM (UTC+08:00) Beijing, Chongqing, Hong Kong, Urumqi. Where: 您好！ sig-Intel-Arch SIG 邀请您参加 2022-06-28 10:00 召开的Zoom会议会议主题：sig-Intel-Arch 会议链接：https://us06web.zoom.us/j/81976528831?pwd=cVIxUkRhUXFGcldFV0ZtNkpvUFpxZz09 会议纪要：https://etherpad.openeuler.org/p/sig-Intel-Arch-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler sig-Intel-Arch SIG invites you to attend the Zoom conference will be held at 2022-06-28 10:00, The subject of the conference is sig-Intel-Arch, You can join the meeting at https://us06web.zoom.us/j/81976528831?pwd=cVIxUkRhUXFGcldFV0ZtNkpvUFpxZz09. Add topics at https://etherpad.openeuler.org/p/sig-Intel-Arch-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

2024

2023

2022

2021

2020

2019

Kernel