4 months agoLinux 5.19-rc8 v5.19-rc8
Linus Torvalds [Sun, 24 Jul 2022 20:26:27 +0000 (13:26 -0700)]
Linux 5.19-rc8

4 months agocerts: make system keyring depend on x509 parser
Adam Borowski [Mon, 18 Jul 2022 13:50:34 +0000 (15:50 +0200)]
certs: make system keyring depend on x509 parser

This code requires x509_load_certificate_list() to be built-in.

Fixes: 60050ffe3d77 ("certs: Move load_certificate_list() to be with the asymmetric keys code")
Reported-by: kernel test robot <>
Reported-by: Steven Rostedt <>
Signed-off-by: Adam Borowski <>
Signed-off-by: Linus Torvalds <>
4 months agoMerge tag 'perf_urgent_for_v5.19_rc8' of git://
Linus Torvalds [Sun, 24 Jul 2022 16:55:53 +0000 (09:55 -0700)]
Merge tag 'perf_urgent_for_v5.19_rc8' of git://git./linux/kernel/git/tip/tip

Pull perf fix from Borislav Petkov:

 - Reorganize the perf LBR init code so that a TSX quirk is applied
   early enough in order for the LBR MSR access to not #GP

* tag 'perf_urgent_for_v5.19_rc8' of git://
  perf/x86/intel/lbr: Fix unchecked MSR access error on HSW

4 months agoMerge tag 'sched_urgent_for_v5.19_rc8' of git://
Linus Torvalds [Sun, 24 Jul 2022 16:50:53 +0000 (09:50 -0700)]
Merge tag 'sched_urgent_for_v5.19_rc8' of git://git./linux/kernel/git/tip/tip

Pull scheduler fix from Borislav Petkov:
 "A single fix to correct a wrong BUG_ON() condition for deboosted

* tag 'sched_urgent_for_v5.19_rc8' of git://
  sched/deadline: Fix BUG_ON condition for deboosted tasks

4 months agoMerge tag 'x86_urgent_for_v5.19_rc8' of git://
Linus Torvalds [Sun, 24 Jul 2022 16:40:17 +0000 (09:40 -0700)]
Merge tag 'x86_urgent_for_v5.19_rc8' of git://git./linux/kernel/git/tip/tip

Pull x86 fixes from Borislav Petkov:
 "A couple more retbleed fallout fixes.

  It looks like their urgency is decreasing so it seems like we've
  managed to catch whatever snafus the limited -rc testing has exposed.
  Maybe we're getting ready... :)

   - Make retbleed mitigations 64-bit only (32-bit will need a bit more
     work if even needed, at all).

   - Prevent return thunks patching of the LKDTM modules as it is not
     needed there

   - Avoid writing the SPEC_CTRL MSR on every kernel entry on eIBRS

   - Enhance error output of apply_returns() when it fails to patch a
     return thunk

   - A sparse fix to the sev-guest module

   - Protect EFI fw calls by issuing an IBPB on AMD"

* tag 'x86_urgent_for_v5.19_rc8' of git://
  x86/speculation: Make all RETbleed mitigations 64-bit only
  lkdtm: Disable return thunks in rodata.c
  x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts
  x86/alternative: Report missing return thunk details
  virt: sev-guest: Pass the appropriate argument type to iounmap()
  x86/amd: Use IBPB for firmware calls

4 months agoMerge tag 'clk-fixes-for-linus' of git://
Linus Torvalds [Sun, 24 Jul 2022 16:33:13 +0000 (09:33 -0700)]
Merge tag 'clk-fixes-for-linus' of git://git./linux/kernel/git/clk/linux

Pull clk fix from Stephen Boyd:
 "One more fix to set the correct IO mapping for a clk gate in the
  lan966x driver"

* tag 'clk-fixes-for-linus' of git://
  clk: lan966x: Fix the lan966x clock gate register address

4 months agoMerge tag 'for-linus' of git://
Linus Torvalds [Sat, 23 Jul 2022 17:22:26 +0000 (10:22 -0700)]
Merge tag 'for-linus' of git://git./virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:

 - Check for invalid flags to KVM_CAP_X86_USER_SPACE_MSR

 - Fix use of sched_setaffinity in selftests

 - Sync kernel headers to tools


* tag 'for-linus' of git://
  KVM: x86: Protect the unused bits in MSR exiting flags
  tools headers UAPI: Sync linux/kvm.h with the kernel sources
  KVM: selftests: Fix target thread to be migrated in rseq_test
  KVM: stats: Fix value for KVM_STATS_UNIT_MAX for boolean stats

4 months agox86/speculation: Make all RETbleed mitigations 64-bit only
Ben Hutchings [Sat, 23 Jul 2022 15:22:47 +0000 (17:22 +0200)]
x86/speculation: Make all RETbleed mitigations 64-bit only

The mitigations for RETBleed are currently ineffective on x86_32 since
entry_32.S does not use the required macros.  However, for an x86_32
target, the kconfig symbols for them are still enabled by default and
/sys/devices/system/cpu/vulnerabilities/retbleed will wrongly report
that mitigations are in place.

Make all of these symbols depend on X86_64, and only enable RETHUNK by
default on X86_64.

Fixes: f43b9876e857 ("x86/retbleed: Add fine grained Kconfig knobs")
Signed-off-by: Ben Hutchings <>
Signed-off-by: Borislav Petkov <>
Cc: <>
4 months agoMerge tag 'spi-fix-v5.19-rc7' of git://
Linus Torvalds [Fri, 22 Jul 2022 23:40:03 +0000 (16:40 -0700)]
Merge tag 'spi-fix-v5.19-rc7' of git://git./linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "A few more small driver specific fixes"

* tag 'spi-fix-v5.19-rc7' of git://
  spi: spi-rspi: Fix PIO fallback on RZ platforms
  spi: spi-cadence: Fix SPI NO Slave Select macro definition
  spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers

4 months agoMerge tag 'riscv-for-linus-5.19-rc8' of git://
Linus Torvalds [Fri, 22 Jul 2022 20:02:05 +0000 (13:02 -0700)]
Merge tag 'riscv-for-linus-5.19-rc8' of git://git./linux/kernel/git/riscv/linux

Pull RISC-V fixes from Palmer Dabbelt:

 - Two kexec-related build fixes

 - A DTS update to make the GPIO nodes match the upcoming dtschema

 - A fix that passes -mno-relax directly to the assembler when building
   modules, to work around compilers that fail to do so

* tag 'riscv-for-linus-5.19-rc8' of git://
  riscv: add as-options for modules with assembly compontents
  riscv: dts: align gpio-key node names with dtschema
  RISC-V: kexec: Fix build error without CONFIG_KEXEC
  RISCV: kexec: Fix build error without CONFIG_MODULES

4 months agoMerge tag 'acpi-5.19-rc8' of git://
Linus Torvalds [Fri, 22 Jul 2022 19:56:49 +0000 (12:56 -0700)]
Merge tag 'acpi-5.19-rc8' of git://git./linux/kernel/git/rafael/linux-pm

Pull ACPI fix from Rafael Wysocki:
 "Fix yet another piece of ACPI CPPC changes fallout on AMD platforms
  (Mario Limonciello)"

* tag 'acpi-5.19-rc8' of git://
  ACPI: CPPC: Don't require flexible address space if X86_FEATURE_CPPC is supported

4 months agoMerge tag 'io_uring-5.19-2022-07-21' of git://
Linus Torvalds [Fri, 22 Jul 2022 19:47:09 +0000 (12:47 -0700)]
Merge tag 'io_uring-5.19-2022-07-21' of git://

Pull io_uring fixes from Jens Axboe:
 "Fix for a bad kfree() introduced in this cycle, and a quick fix for
  disabling buffer recycling for IORING_OP_READV.

  The latter will get reworked for 5.20, but it gets the job done for

* tag 'io_uring-5.19-2022-07-21' of git://
  io_uring: do not recycle buffer in READV
  io_uring: fix free of unallocated buffer list

4 months agoMerge tag 'block-5.19-2022-07-21' of git://
Linus Torvalds [Fri, 22 Jul 2022 19:41:14 +0000 (12:41 -0700)]
Merge tag 'block-5.19-2022-07-21' of git://

Pull block fix from Jens Axboe:
 "Just a single fix for missing error propagation for an allocation
  failure in raid5"

* tag 'block-5.19-2022-07-21' of git://
  md/raid5: missing error code in setup_conf()

4 months agoMerge tag 'i2c-for-5.19-rc8' of git://
Linus Torvalds [Fri, 22 Jul 2022 19:36:59 +0000 (12:36 -0700)]
Merge tag 'i2c-for-5.19-rc8' of git://git./linux/kernel/git/wsa/linux

Pull i2c fixes from Wolfram Sang:
 "Two driver bugfixes and a typo fix"

* tag 'i2c-for-5.19-rc8' of git://
  i2c: cadence: Change large transfer count reset logic to be unconditional
  i2c: imx: fix typo in comment
  i2c: mlxcpld: Fix register setting for 400KHz frequency

4 months agoMerge tag 'gpio-fixes-for-v5.19-rc8' of git://
Linus Torvalds [Fri, 22 Jul 2022 19:28:47 +0000 (12:28 -0700)]
Merge tag 'gpio-fixes-for-v5.19-rc8' of git://git./linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:

 - fix several regmap usage issues in gpio-pca953x

 - fix out-of-tree build for GPIO selftests

 - fix integer overflow in gpio-xilinx

* tag 'gpio-fixes-for-v5.19-rc8' of git://
  gpio: gpio-xilinx: Fix integer overflow
  selftests: gpio: fix include path to kernel headers for out of tree builds
  gpio: pca953x: use the correct register address when regcache sync during init
  gpio: pca953x: use the correct range when do regmap sync
  gpio: pca953x: only use single read/write for No AI mode

4 months agoMerge tag 'pinctrl-v5.19-3' of git://
Linus Torvalds [Fri, 22 Jul 2022 19:24:04 +0000 (12:24 -0700)]
Merge tag 'pinctrl-v5.19-3' of git://git./linux/kernel/git/linusw/linux-pinctrl

Pull pin control fixes from Linus Walleij:
 "Only driver fixes:

   - NULL check for the ralink and sunplus drivers

   - Add Jacky Bai as maintainer for the Freescale pin controllers

   - Fix pin config ops for the Ocelot LAN966x and SparX5

   - Disallow AMD pin control to be a module: the GPIO lines need to be
     active in early boot, so no can do

   - Fix the Armada 37xx to use raw spinlocks in the interrupt handler
     path to avoid wait context"

* tag 'pinctrl-v5.19-3' of git://
  pinctrl: armada-37xx: use raw spinlocks for regmap to avoid invalid wait context
  pinctrl: armada-37xx: make irq_lock a raw spinlock to avoid invalid wait context
  pinctrl: Don't allow PINCTRL_AMD to be a module
  pinctrl: ocelot: Fix pincfg
  pinctrl: ocelot: Fix pincfg for lan966x
  MAINTAINERS: Update freescale pin controllers maintainer
  pinctrl: sunplus: Add check for kcalloc
  pinctrl: ralink: Check for null return of devm_kcalloc

4 months agoMerge tag 'sound-5.19-rc8' of git://
Linus Torvalds [Fri, 22 Jul 2022 19:19:02 +0000 (12:19 -0700)]
Merge tag 'sound-5.19-rc8' of git://git./linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "Only undoes the Rockchip BCLK changes to address a regression"

* tag 'sound-5.19-rc8' of git://
  ASoC: rockchip-i2s: Undo BCLK pinctrl changes
  ASoC: rockchip: i2s: Fix NULL pointer dereference when pinctrl is not found

4 months agoMerge tag 'mmc-v5.19-rc6' of git://
Linus Torvalds [Fri, 22 Jul 2022 19:14:13 +0000 (12:14 -0700)]
Merge tag 'mmc-v5.19-rc6' of git://git./linux/kernel/git/ulfh/mmc

Pull MMC fix from Ulf Hansson:

 - sdhci-omap: Fix a lockdep warning while probing

* tag 'mmc-v5.19-rc6' of git://
  mmc: sdhci-omap: Fix a lockdep warning for PM runtime init

4 months agoMerge tag 'drm-fixes-2022-07-22' of git://
Linus Torvalds [Fri, 22 Jul 2022 19:03:19 +0000 (12:03 -0700)]
Merge tag 'drm-fixes-2022-07-22' of git://

Pull drm fixes from Dave Airlie:
 "Fixes for this week.

  The main one is the i915 firmware fix for the phoronix reported issue.
  I've written some firmware guidelines as a result, should land in
  -next soon. Otherwise a few amdgpu fixes, a scheduler fix, ttm fix and
  two other minor ones.

   - scheduling while atomic fix

   - locking fix

   - variable typo fix

   - add back support for v69 firmware on ADL-P

   - Drop redundant buffer cleanup that can lead to a segfault
   - Add a bo_list mutex to avoid possible list corruption in CS
   - dmub notification fix

   - fix error path"

* tag 'drm-fixes-2022-07-22' of git://
  drm/amdgpu: Protect the amdgpu_bo_list list with a mutex v2
  drm/imx/dcss: Add missing of_node_put() in fail path
  drm/i915/guc: support v69 in parallel to v70
  drm/i915/guc: Support programming the EU priority in the GuC descriptor
  drm/panel-edp: Fix variable typo when saving hpd absent delay from DT
  drm/amdgpu: Remove one duplicated ef removal
  drm/ttm: fix locking in vmap/vunmap TTM GEM helpers
  drm/scheduler: Don't kill jobs in interrupt context
  drm/amd/display: Fix new dmub notification enabling in DM

4 months agoMerge tag 'rcu-urgent.2022.07.21a' of git://
Linus Torvalds [Fri, 22 Jul 2022 17:01:20 +0000 (10:01 -0700)]
Merge tag 'rcu-urgent.2022.07.21a' of git://git./linux/kernel/git/paulmck/linux-rcu

Pull RCU fix from Paul McKenney:
 "This contains a pair of commits that fix 282d8998e997 ("srcu: Prevent
  expedited GPs and blocking readers from consuming CPU"), which was
  itself a fix to an SRCU expedited grace-period problem that could
  prevent kernel live patching (KLP) from completing.

  That SRCU fix for KLP introduced large (as in minutes) boot-time
  delays to embedded Linux kernels running on qemu/KVM. These delays
  were due to the emulation of certain MMIO operations controlling
  memory layout, which were emulated with one expedited grace period per
  access. Common configurations required thousands of boot-time MMIO
  accesses, and thus thousands of boot-time expedited SRCU grace

  In these configurations, the occasional sleeps that allowed KLP to
  proceed caused excessive boot delays. These commits preserve enough
  sleeps to permit KLP to proceed, but few enough that the virtual
  embedded kernels still boot reasonably quickly.

  This represents a regression introduced in the v5.19 merge window, and
  the bug is causing significant inconvenience"

* tag 'rcu-urgent.2022.07.21a' of git://
  srcu: Make expedited RCU grace periods block even less frequently
  srcu: Block less aggressively for expedited grace periods

4 months agommu_gather: fix the CONFIG_MMU_GATHER_NO_RANGE case
Linus Torvalds [Fri, 22 Jul 2022 16:28:34 +0000 (09:28 -0700)]
mmu_gather: fix the CONFIG_MMU_GATHER_NO_RANGE case

Sudip reports that alpha doesn't build properly, with errors like

  include/asm-generic/tlb.h:401:1: error: redefinition of 'tlb_update_vma_flags'
    401 | tlb_update_vma_flags(struct mmu_gather *tlb, struct vm_area_struct *vma)
        | ^~~~~~~~~~~~~~~~~~~~
  include/asm-generic/tlb.h:372:1: note: previous definition of 'tlb_update_vma_flags' with type 'void(struct mmu_gather *, struct vm_area_struct *)'
    372 | tlb_update_vma_flags(struct mmu_gather *tlb, struct vm_area_struct *vma) { }

the cause being that We have this odd situation where some architectures
were never converted to the newer TLB flushing interfaces that have a
range for the flush.  Instead people left them alone, and we have them
select the MMU_GATHER_NO_RANGE config option to make the tlb header
files account for this.

Peter Zijlstra cleaned some of these nasty header file games up in

  1e9fdf21a433 ("mmu_gather: Remove per arch tlb_{start,end}_vma()")
  18ba064e42df ("mmu_gather: Let there be one tlb_{start,end}_vma() implementation")

but tlb_update_vma_flags() was left alone, and then commit b67fbebd4cf9
("mmu_gather: Force tlb-flush VM_PFNMAP vmas") ended up removing only
_one_ of the two stale duplicate dummy inline functions.

This removes the other stale one.

Somebody braver than me should try to remove MMU_GATHER_NO_RANGE
entirely, but it requires fixing up the oddball architectures that use
it: alpha, m68k, microblaze, nios2 and openrisc.

The fixups should be fairly straightforward ("fix the build errors it
exposes by adding the appropriate range arguments"), but the reason this
wasn't done in the first place is that so few people end up working on
those architectures.  But it could be done one architecture at a time,
hint, hint.

Reported-by: Sudip Mukherjee (Codethink) <>
Fixes: b67fbebd4cf9 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas")
Cc: Peter Zijlstra <>
Cc: Will Deacon <>
Cc: "Aneesh Kumar K.V" <>
Cc: Andrew Morton <>
Cc: Nick Piggin <>
Cc: Arnd Bergmann <>
Signed-off-by: Linus Torvalds <>
4 months agogpio: gpio-xilinx: Fix integer overflow
Srinivas Neeli [Thu, 21 Jul 2022 07:39:09 +0000 (13:09 +0530)]
gpio: gpio-xilinx: Fix integer overflow

Current implementation is not able to configure more than 32 pins
due to incorrect data type. So type casting with unsigned long
to avoid it.

Fixes: 02b3f84d9080 ("xilinx: Switch to use bitmap APIs")
Signed-off-by: Srinivas Neeli <>
Signed-off-by: Bartosz Golaszewski <>
4 months agoMerge tag 'drm-misc-fixes-2022-07-21' of git://
Dave Airlie [Fri, 22 Jul 2022 02:16:15 +0000 (12:16 +1000)]
Merge tag 'drm-misc-fixes-2022-07-21' of git:// into drm-fixes

A scheduling-while-atomic fix for drm/scheduler, a locking fix for TTM,
a typo fix for panel-edp and a resource removal fix for imx/dcss

Signed-off-by: Dave Airlie <>
From: Maxime Ripard <>
4 months agoriscv: add as-options for modules with assembly compontents
Ben Dooks [Sun, 29 May 2022 15:22:00 +0000 (16:22 +0100)]
riscv: add as-options for modules with assembly compontents

When trying to load modules built for RISC-V which include assembly files
the kernel loader errors with "unexpected relocation type 'R_RISCV_ALIGN'"
due to R_RISCV_ALIGN relocations being generated by the assembler.

The R_RISCV_ALIGN relocations can be removed at the expense of code space
by adding -mno-relax to gcc and as.  In commit 7a8e7da42250138
("RISC-V: Fixes to module loading") -mno-relax is added to the build
variable KBUILD_CFLAGS_MODULE. See [1] for more info.

The issue is that when kbuild builds a .S file, it invokes gcc with
the -mno-relax flag, but this is not being passed through to the
assembler. Adding -Wa,-mno-relax to KBUILD_AFLAGS_MODULE ensures that
the assembler is invoked correctly. This may have now been fixed in
gcc[2] and this addition should not stop newer gcc and as from working.


Signed-off-by: Ben Dooks <>
Reviewed-by: Bin Meng <>
Fixes: ab1ef68e5401 ("RISC-V: Add sections of PLT and GOT for kernel module")
Signed-off-by: Palmer Dabbelt <>
4 months agoMerge tag 'mtd/fixes-for-5.19-final' of git://
Linus Torvalds [Thu, 21 Jul 2022 18:28:26 +0000 (11:28 -0700)]
Merge tag 'mtd/fixes-for-5.19-final' of git://git./linux/kernel/git/mtd/linux

Pull MTD fix from Richard Weinberger:
 "A aingle NAND controller fix:

   - gpmi: Fix busy timeout setting (wrong calculation, yes again)"

* tag 'mtd/fixes-for-5.19-final' of git://
  mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times

4 months agoMerge tag 'net-5.19-rc8' of git://
Linus Torvalds [Thu, 21 Jul 2022 18:08:35 +0000 (11:08 -0700)]
Merge tag 'net-5.19-rc8' of git://git./linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from can.

  Still no major regressions, most of the changes are still due to data
  races fixes, plus the usual bunch of drivers fixes.

  Previous releases - regressions:

   - tcp/udp: make early_demux back namespacified.

   - dsa: fix issues with vlan_filtering_is_global

  Previous releases - always broken:

   - ip: fix data-races around ipv4_net_table (round 2, 3 & 4)

   - amt: fix validation and synchronization bugs

   - can: fix detection of mcp251863

   - eth: iavf: fix handling of dummy receive descriptors

   - eth: lan966x: fix issues with MAC table

   - eth: stmmac: dwmac-mediatek: fix clock issue


   - dsa: update documentation"

* tag 'net-5.19-rc8' of git:// (107 commits)
  mlxsw: spectrum_router: Fix IPv4 nexthop gateway indication
  net/sched: cls_api: Fix flow action initialization
  tcp: Fix data-races around sysctl_tcp_max_reordering.
  tcp: Fix a data-race around sysctl_tcp_abort_on_overflow.
  tcp: Fix a data-race around sysctl_tcp_rfc1337.
  tcp: Fix a data-race around sysctl_tcp_stdurg.
  tcp: Fix a data-race around sysctl_tcp_retrans_collapse.
  tcp: Fix data-races around sysctl_tcp_slow_start_after_idle.
  tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.
  tcp: Fix data-races around sysctl_tcp_recovery.
  tcp: Fix a data-race around sysctl_tcp_early_retrans.
  tcp: Fix data-races around sysctl knobs related to SYN option.
  udp: Fix a data-race around sysctl_udp_l3mdev_accept.
  ip: Fix data-races around sysctl_ip_prot_sock.
  ipv4: Fix data-races around sysctl_fib_multipath_hash_fields.
  ipv4: Fix data-races around sysctl_fib_multipath_hash_policy.
  ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh.
  can: rcar_canfd: Add missing of_node_put() in rcar_canfd_probe()
  can: mcp251xfd: fix detection of mcp251863
  Documentation: fix udp_wmem_min in ip-sysctl.rst

4 months agommu_gather: Force tlb-flush VM_PFNMAP vmas
Peter Zijlstra [Fri, 8 Jul 2022 07:18:06 +0000 (09:18 +0200)]
mmu_gather: Force tlb-flush VM_PFNMAP vmas

Jann reported a race between munmap() and unmap_mapping_range(), where
unmap_mapping_range() will no-op once unmap_vmas() has unlinked the
VMA; however munmap() will not yet have invalidated the TLBs.

Therefore unmap_mapping_range() will complete while there are still
(stale) TLB entries for the specified range.

Mitigate this by force flushing TLBs for VM_PFNMAP ranges.

Signed-off-by: Peter Zijlstra (Intel) <>
Acked-by: Will Deacon <>
Signed-off-by: Linus Torvalds <>
4 months agommu_gather: Let there be one tlb_{start,end}_vma() implementation
Peter Zijlstra [Fri, 8 Jul 2022 07:18:05 +0000 (09:18 +0200)]
mmu_gather: Let there be one tlb_{start,end}_vma() implementation

Now that architectures are no longer allowed to override
tlb_{start,end}_vma() re-arrange code so that there is only one
implementation for each of these functions.

This much simplifies trying to figure out what they actually do.

Signed-off-by: Peter Zijlstra (Intel) <>
Acked-by: Will Deacon <>
Signed-off-by: Linus Torvalds <>
4 months agocsky/tlb: Remove tlb_flush() define
Peter Zijlstra [Fri, 8 Jul 2022 07:18:04 +0000 (09:18 +0200)]
csky/tlb: Remove tlb_flush() define

The previous patch removed the tlb_flush_end() implementation which
used tlb_flush_range(). This means:

 - csky did double invalidates, a range invalidate per vma and a full
   invalidate at the end

 - csky actually has range invalidates and as such the generic
   tlb_flush implementation is more efficient for it.

Signed-off-by: Peter Zijlstra (Intel) <>
Acked-by: Will Deacon <>
Tested-by: Guo Ren <>
Signed-off-by: Linus Torvalds <>
4 months agommu_gather: Remove per arch tlb_{start,end}_vma()
Peter Zijlstra [Fri, 8 Jul 2022 07:18:03 +0000 (09:18 +0200)]
mmu_gather: Remove per arch tlb_{start,end}_vma()

Scattered across the archs are 3 basic forms of tlb_{start,end}_vma().
Provide two new MMU_GATHER_knobs to enumerate them and remove the per
arch tlb_{start,end}_vma() implementations.

 - MMU_GATHER_NO_FLUSH_CACHE indicates the arch has flush_cache_range()
   but does *NOT* want to call it for each VMA.

 - MMU_GATHER_MERGE_VMAS indicates the arch wants to merge the
   invalidate across multiple VMAs if possible.

With these it is possible to capture the three forms:

  1) empty stubs;

  2) start: flush_cache_range(), end: empty;

  3) start: flush_cache_range(), end: flush_tlb_range();

Obviously, if the architecture does not have flush_cache_range() then
it also doesn't need to select MMU_GATHER_NO_FLUSH_CACHE.

Signed-off-by: Peter Zijlstra (Intel) <>
Acked-by: Will Deacon <>
Cc: David Miller <>
Signed-off-by: Linus Torvalds <>
4 months agoscripts/gdb: Fix gdb 'lx-symbols' command
Khalid Masum [Thu, 21 Jul 2022 09:30:42 +0000 (15:30 +0600)]
scripts/gdb: Fix gdb 'lx-symbols' command

Currently the command 'lx-symbols' in gdb exits with the error`Function
"do_init_module" not defined in "kernel/module.c"`. This occurs because
the file kernel/module.c was moved to kernel/module/main.c.

Fix this breakage by changing the path to "kernel/module/main.c" in

Signed-off-by: Khalid Masum <>
Acked-by: Luis Chamberlain <>
Fixes: cfc1d277891e ("module: Move all into module/")
Reviewed-by: Douglas Anderson <>
Signed-off-by: Linus Torvalds <>
4 months agowatch-queue: remove spurious double semicolon
Linus Torvalds [Thu, 21 Jul 2022 17:30:14 +0000 (10:30 -0700)]
watch-queue: remove spurious double semicolon

Sedat Dilek noticed that I had an extraneous semicolon at the end of a
line in the previous patch.

It's harmless, but unintentional, and while compilers just treat it as
an extra empty statement, for all I know some other tooling might warn
about it. So clean it up before other people notice too ;)

Fixes: 353f7988dd84 ("watchqueue: make sure to serialize 'wqueue->defunct' properly")
Reported-by: Sedat Dilek <>
Signed-off-by: Linus Torvalds <>
Reported-by: Sedat Dilek <>
4 months agospi: spi-rspi: Fix PIO fallback on RZ platforms
Biju Das [Thu, 21 Jul 2022 14:34:49 +0000 (15:34 +0100)]
spi: spi-rspi: Fix PIO fallback on RZ platforms

RSPI IP on RZ/{A, G2L} SoC's has the same signal for both interrupt
and DMA transfer request. Setting DMARS register for DMA transfer
makes the signal to work as a DMA transfer request signal and
subsequent interrupt requests to the interrupt controller
are masked.

PIO fallback does not work as interrupt signal is disabled.

This patch fixes this issue by re-enabling the interrupts by
calling dmaengine_synchronize().

Signed-off-by: Biju Das <>
Reviewed-by: Geert Uytterhoeven <>
Signed-off-by: Mark Brown <>
4 months agoio_uring: do not recycle buffer in READV
Dylan Yudaken [Thu, 21 Jul 2022 13:13:25 +0000 (06:13 -0700)]
io_uring: do not recycle buffer in READV

READV cannot recycle buffers as it would lose some of the data required to
reimport that buffer.

Reported-by: Ammar Faizi <>
Fixes: b66e65f41426 ("io_uring: never call io_buffer_select() for a buffer re-select")
Signed-off-by: Dylan Yudaken <>
Signed-off-by: Jens Axboe <>
4 months agoio_uring: fix free of unallocated buffer list
Dylan Yudaken [Thu, 21 Jul 2022 11:01:15 +0000 (04:01 -0700)]
io_uring: fix free of unallocated buffer list

in the error path of io_register_pbuf_ring, only free bl if it was

Reported-by: Dipanjan Das <>
Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers")
Signed-off-by: Dylan Yudaken <>
Reviewed-by: Pavel Begunkov <>
Signed-off-by: Jens Axboe <>
4 months agosched/deadline: Fix BUG_ON condition for deboosted tasks
Juri Lelli [Thu, 14 Jul 2022 15:19:08 +0000 (17:19 +0200)]
sched/deadline: Fix BUG_ON condition for deboosted tasks

Tasks the are being deboosted from SCHED_DEADLINE might enter
enqueue_task_dl() one last time and hit an erroneous BUG_ON condition:
since they are not boosted anymore, the if (is_dl_boosted()) branch is
not taken, but the else if (!dl_prio) is and inside this one we
BUG_ON(!is_dl_boosted), which is of course false (BUG_ON triggered)
otherwise we had entered the if branch above. Long story short, the
current condition doesn't make sense and always leads to triggering of a

Fix this by only checking enqueue flags, properly: ENQUEUE_REPLENISH has
to be present, but additional flags are not a problem.

Fixes: 64be6f1f5f71 ("sched/deadline: Don't replenish from a !SCHED_DEADLINE entity")
Signed-off-by: Juri Lelli <>
Signed-off-by: Peter Zijlstra (Intel) <>
4 months agoMerge tag 'amd-drm-fixes-5.19-2022-07-20' of
Dave Airlie [Thu, 21 Jul 2022 03:22:39 +0000 (13:22 +1000)]
Merge tag 'amd-drm-fixes-5.19-2022-07-20' of into drm-fixes


- Drop redundant buffer cleanup that can lead to a segfault
- Add a bo_list mutex to avoid possible list corruption in CS

Signed-off-by: Dave Airlie <>
From: Alex Deucher <>
4 months agoMerge tag 'drm-intel-fixes-2022-07-20-1' of git://
Dave Airlie [Thu, 21 Jul 2022 03:21:58 +0000 (13:21 +1000)]
Merge tag 'drm-intel-fixes-2022-07-20-1' of git:// into drm-fixes

- Fix the regression caused by the lack of GuC v70.
  Let's accept the fallback to v69.

Signed-off-by: Dave Airlie <>
From: Rodrigo Vivi <>
4 months agodrm/amdgpu: Protect the amdgpu_bo_list list with a mutex v2
Luben Tuikov [Wed, 20 Jul 2022 19:04:18 +0000 (15:04 -0400)]
drm/amdgpu: Protect the amdgpu_bo_list list with a mutex v2

Protect the struct amdgpu_bo_list with a mutex. This is used during command
submission in order to avoid buffer object corruption as recorded in
the link below.

v2 (chk): Keep the mutex looked for the whole CS to avoid using the
  list from multiple CS threads at the same time.

Suggested-by: Christian König <>
Cc: Alex Deucher <>
Cc: Andrey Grodzovsky <>
Cc: Vitaly Prosyak <>
Signed-off-by: Luben Tuikov <>
Signed-off-by: Christian König <>
Tested-by: Luben Tuikov <>
Reviewed-by: Alex Deucher <>
Signed-off-by: Alex Deucher <>
4 months agowatchqueue: make sure to serialize 'wqueue->defunct' properly
Linus Torvalds [Tue, 19 Jul 2022 18:09:01 +0000 (11:09 -0700)]
watchqueue: make sure to serialize 'wqueue->defunct' properly

When the pipe is closed, we mark the associated watchqueue defunct by
calling watch_queue_clear().  However, while that is protected by the
watchqueue lock, new watchqueue entries aren't actually added under that
lock at all: they use the pipe->rd_wait.lock instead, and looking up
that pipe happens without any locking.

The watchqueue code uses the RCU read-side section to make sure that the
wqueue entry itself hasn't disappeared, but that does not protect the
pipe_info in any way.

So make sure to actually hold the wqueue lock when posting watch events,
properly serializing against the pipe being torn down.

Reported-by: Noam Rathaus <>
Cc: Greg KH <>
Cc: David Howells <>
Signed-off-by: Linus Torvalds <>
4 months agospi: spi-cadence: Fix SPI NO Slave Select macro definition
Sai Krishna Potthuri [Wed, 13 Jul 2022 16:45:29 +0000 (22:15 +0530)]
spi: spi-cadence: Fix SPI NO Slave Select macro definition

Fix SPI NO Slave Select macro definition, when all the SPI CS bits
are high which means no slave is selected.

Fixes: 21b511ddee09 ("spi: spi-cadence: Fix SPI CS gets toggling sporadically")
Signed-off-by: Sai Krishna Potthuri <>
Signed-off-by: Amit Kumar Mahapatra <>
Signed-off-by: Mark Brown <>
4 months agoperf/x86/intel/lbr: Fix unchecked MSR access error on HSW
Kan Liang [Thu, 14 Jul 2022 18:26:30 +0000 (11:26 -0700)]
perf/x86/intel/lbr: Fix unchecked MSR access error on HSW

The fuzzer triggers the below trace.

[ 7763.384369] unchecked MSR access error: WRMSR to 0x689
(tried to write 0x1fffffff8101349e) at rIP: 0xffffffff810704a4
[ 7763.397420] Call Trace:
[ 7763.399881]  <TASK>
[ 7763.401994]  intel_pmu_lbr_restore+0x9a/0x1f0
[ 7763.406363]  intel_pmu_lbr_sched_task+0x91/0x1c0
[ 7763.410992]  __perf_event_task_sched_in+0x1cd/0x240

On a machine with the LBR format LBR_FORMAT_EIP_FLAGS2, when the TSX is
disabled, a TSX quirk is required to access LBR from registers.
The lbr_from_signext_quirk_needed() is introduced to determine whether
the TSX quirk should be applied. However, the
lbr_from_signext_quirk_needed() is invoked before the
intel_pmu_lbr_init(), which parses the LBR format information. Without
the correct LBR format information, the TSX quirk never be applied.

Move the lbr_from_signext_quirk_needed() into the intel_pmu_lbr_init().
Checking x86_pmu.lbr_has_tsx in the lbr_from_signext_quirk_needed() is
not required anymore.

only the LBR_FORMAT_EIP_FLAGS2 requirs the quirk. Update the comments

Fixes: 1ac7fd8159a8 ("perf/x86/intel/lbr: Support LBR format V7")
Reported-by: Vince Weaver <>
Signed-off-by: Kan Liang <>
Signed-off-by: Peter Zijlstra (Intel) <>
4 months agolkdtm: Disable return thunks in rodata.c
Josh Poimboeuf [Mon, 18 Jul 2022 14:50:25 +0000 (07:50 -0700)]
lkdtm: Disable return thunks in rodata.c

The following warning was seen:

  WARNING: CPU: 0 PID: 0 at arch/x86/kernel/alternative.c:557 apply_returns (arch/x86/kernel/alternative.c:557 (discriminator 1))
  Modules linked in:
  CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc4-00008-gee88d363d156 #1
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014
  RIP: 0010:apply_returns (arch/x86/kernel/alternative.c:557 (discriminator 1))
  Code: ff ff 74 cb 48 83 c5 04 49 39 ee 0f 87 81 fe ff ff e9 22 ff ff ff 0f 0b 48 83 c5 04 49 39 ee 0f 87 6d fe ff ff e9 0e ff ff ff <0f> 0b 48 83 c5 04 49 39 ee 0f 87 59 fe ff ff e9 fa fe ff ff 48 89

The warning happened when apply_returns() failed to convert "JMP
__x86_return_thunk" to RET.  It was instead a JMP to nowhere, due to the
thunk relocation not getting resolved.

That rodata.o code is objcopy'd to .rodata, and later memcpy'd, so
relocations don't work (and are apparently silently ignored).

LKDTM is only used for testing, so the naked RET should be fine.  So
just disable return thunks for that file.

While at it, disable objtool and KCSAN for the file.

Fixes: 0b53c374b9ef ("x86/retpoline: Use -mfunction-return")
Reported-by: kernel test robot <>
Debugged-by: Peter Zijlstra <>
Signed-off-by: Josh Poimboeuf <>
Signed-off-by: Peter Zijlstra (Intel) <>
4 months agox86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts
Pawan Gupta [Thu, 14 Jul 2022 23:15:35 +0000 (16:15 -0700)]
x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts

IBRS mitigation for spectre_v2 forces write to MSR_IA32_SPEC_CTRL at
every kernel entry/exit. On Enhanced IBRS parts setting
MSR_IA32_SPEC_CTRL[IBRS] only once at boot is sufficient. MSR writes at
every kernel entry/exit incur unnecessary performance loss.

When Enhanced IBRS feature is present, print a warning about this
unnecessary performance loss.

Signed-off-by: Pawan Gupta <>
Signed-off-by: Peter Zijlstra (Intel) <>
Reviewed-by: Thadeu Lima de Souza Cascardo <>
4 months agox86/alternative: Report missing return thunk details
Kees Cook [Wed, 13 Jul 2022 21:38:19 +0000 (14:38 -0700)]
x86/alternative: Report missing return thunk details

Debugging missing return thunks is easier if we can see where they're

Suggested-by: Peter Zijlstra <>
Signed-off-by: Kees Cook <>
Signed-off-by: Peter Zijlstra (Intel) <>
4 months agolockdown: Fix kexec lockdown bypass with ima policy
Eric Snowberg [Wed, 20 Jul 2022 16:40:27 +0000 (12:40 -0400)]
lockdown: Fix kexec lockdown bypass with ima policy

The lockdown LSM is primarily used in conjunction with UEFI Secure Boot.
This LSM may also be used on machines without UEFI.  It can also be
enabled when UEFI Secure Boot is disabled.  One of lockdown's features
is to prevent kexec from loading untrusted kernels.  Lockdown can be
enabled through a bootparam or after the kernel has booted through

If IMA appraisal is used with the "ima_appraise=log" boot param,
lockdown can be defeated with kexec on any machine when Secure Boot is
disabled or unavailable.  IMA prevents setting "ima_appraise=log" from
the boot param when Secure Boot is enabled, but this does not cover
cases where lockdown is used without Secure Boot.

To defeat lockdown, boot without Secure Boot and add ima_appraise=log to
the kernel command line; then:

  $ echo "integrity" > /sys/kernel/security/lockdown
  $ echo "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig" > \
  $ kexec -ls unsigned-kernel

Add a call to verify ima appraisal is set to "enforce" whenever lockdown
is enabled.  This fixes CVE-2022-21505.

Fixes: 29d3c1c8dfe7 ("kexec: Allow kexec_file() with appropriate IMA policy when locked down")
Signed-off-by: Eric Snowberg <>
Acked-by: Mimi Zohar <>
Reviewed-by: John Haxby <>
Signed-off-by: Linus Torvalds <>
4 months agospi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers
Marc Kleine-Budde [Tue, 19 Jul 2022 07:22:35 +0000 (09:22 +0200)]
spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers

In case a IRQ based transfer times out the bcm2835_spi_handle_err()
function is called. Since commit 1513ceee70f2 ("spi: bcm2835: Drop
dma_pending flag") the TX and RX DMA transfers are unconditionally
canceled, leading to NULL pointer derefs if ctlr->dma_tx or
ctlr->dma_rx are not set.

Fix the NULL pointer deref by checking that ctlr->dma_tx and
ctlr->dma_rx are valid pointers before accessing them.

Fixes: 1513ceee70f2 ("spi: bcm2835: Drop dma_pending flag")
Cc: Lukas Wunner <>
Signed-off-by: Marc Kleine-Budde <>
Signed-off-by: Mark Brown <>
4 months agoselftests: gpio: fix include path to kernel headers for out of tree builds
Kent Gibson [Tue, 19 Jul 2022 11:06:01 +0000 (19:06 +0800)]
selftests: gpio: fix include path to kernel headers for out of tree builds

When building selftests out of the kernel tree the gpio.h the include
path is incorrect and the build falls back to the system includes
which may be outdated.

Add the KHDR_INCLUDES to the CFLAGS to include the gpio.h from the
build tree.

Fixes: 4f4d0af7b2d9 ("selftests: gpio: restore CFLAGS options")
Reported-by: kernel test robot <>
Signed-off-by: Kent Gibson <>
Signed-off-by: Bartosz Golaszewski <>
4 months agoMerge tag 'linux-can-fixes-for-5.19-20220720' of git://
David S. Miller [Wed, 20 Jul 2022 10:13:54 +0000 (11:13 +0100)]
Merge tag 'linux-can-fixes-for-5.19-20220720' of git://git./linux/kernel/git/mkl/linux-can

Marc Kleine-Budde says:

this is a pull request of 2 patches for net/master.

The first patch is by me and fixes the detection of the mcp251863 in
the mcp251xfd driver.

The last patch is by Liang He and adds a missing of_node_put() in the
rcar_canfd driver.

Signed-off-by: David S. Miller <>
4 months agomlxsw: spectrum_router: Fix IPv4 nexthop gateway indication
Ido Schimmel [Tue, 19 Jul 2022 12:26:26 +0000 (15:26 +0300)]
mlxsw: spectrum_router: Fix IPv4 nexthop gateway indication

mlxsw needs to distinguish nexthops with a gateway from connected
nexthops in order to write the former to the adjacency table of the
device. The check used to rely on the fact that nexthops with a gateway
have a 'link' scope whereas connected nexthops have a 'host' scope. This
is no longer correct after commit 747c14307214 ("ip: fix dflt addr
selection for connected nexthop").

Fix that by instead checking the address family of the gateway IP. This
is a more direct way and also consistent with the IPv6 counterpart in

Fixes: 747c14307214 ("ip: fix dflt addr selection for connected nexthop")
Fixes: 597cfe4fc339 ("nexthop: Add support for IPv4 nexthops")
Signed-off-by: Ido Schimmel <>
Reviewed-by: Amit Cohen <>
Reviewed-by: Nicolas Dichtel <>
Reviewed-by: David Ahern <>
Signed-off-by: David S. Miller <>
4 months agonet/sched: cls_api: Fix flow action initialization
Oz Shlomo [Tue, 19 Jul 2022 12:24:09 +0000 (15:24 +0300)]
net/sched: cls_api: Fix flow action initialization

The cited commit refactored the flow action initialization sequence to
use an interface method when translating tc action instances to flow
offload objects. The refactored version skips the initialization of the
generic flow action attributes for tc actions, such as pedit, that allocate
more than one offload entry. This can cause potential issues for drivers
mapping flow action ids.

Populate the generic flow action fields for all the flow action entries.

Fixes: c54e1d920f04 ("flow_offload: add ops to tc_action_ops for flow action setup")
Signed-off-by: Oz Shlomo <>
Reviewed-by: Roi Dayan <>
v1 -> v2:
 - coalese the generic flow action fields initialization to a single loop
Reviewed-by: Baowen Zheng <>
Signed-off-by: David S. Miller <>
4 months agoMerge branch 'net-sysctl-races-round-4'
David S. Miller [Wed, 20 Jul 2022 09:14:50 +0000 (10:14 +0100)]
Merge branch 'net-sysctl-races-round-4'

Kuniyuki Iwashima says:

sysctl: Fix data-races around ipv4_net_table (Round 4).

This series fixes data-races around 17 knobs after fib_multipath_use_neigh
in ipv4_net_table.

tcp_fack was skipped because it's obsolete and there's no readers.

So, round 5 will start with tcp_dsack, 2 rounds left for 27 knobs.

Signed-off-by: David S. Miller <>
4 months agotcp: Fix data-races around sysctl_tcp_max_reordering.
Kuniyuki Iwashima [Mon, 18 Jul 2022 17:26:53 +0000 (10:26 -0700)]
tcp: Fix data-races around sysctl_tcp_max_reordering.

While reading sysctl_tcp_max_reordering, it can be changed
concurrently.  Thus, we need to add READ_ONCE() to its readers.

Fixes: dca145ffaa8d ("tcp: allow for bigger reordering level")
Signed-off-by: Kuniyuki Iwashima <>
Signed-off-by: David S. Miller <>
4 months agotcp: Fix a data-race around sysctl_tcp_abort_on_overflow.
Kuniyuki Iwashima [Mon, 18 Jul 2022 17:26:52 +0000 (10:26 -0700)]
tcp: Fix a data-race around sysctl_tcp_abort_on_overflow.

While reading sysctl_tcp_abort_on_overflow, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its reader.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima <>
Signed-off-by: David S. Miller <>
4 months agotcp: Fix a data-race around sysctl_tcp_rfc1337.
Kuniyuki Iwashima [Mon, 18 Jul 2022 17:26:51 +0000 (10:26 -0700)]
tcp: Fix a data-race around sysctl_tcp_rfc1337.

While reading sysctl_tcp_rfc1337, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its reader.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima <>
Signed-off-by: David S. Miller <>
4 months agotcp: Fix a data-race around sysctl_tcp_stdurg.
Kuniyuki Iwashima [Mon, 18 Jul 2022 17:26:50 +0000 (10:26 -0700)]
tcp: Fix a data-race around sysctl_tcp_stdurg.

While reading sysctl_tcp_stdurg, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its reader.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima <>
Signed-off-by: David S. Miller <>
4 months agotcp: Fix a data-race around sysctl_tcp_retrans_collapse.
Kuniyuki Iwashima [Mon, 18 Jul 2022 17:26:49 +0000 (10:26 -0700)]
tcp: Fix a data-race around sysctl_tcp_retrans_collapse.

While reading sysctl_tcp_retrans_collapse, it can be changed
concurrently.  Thus, we need to add READ_ONCE() to its reader.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima <>
Signed-off-by: David S. Miller <>
4 months agotcp: Fix data-races around sysctl_tcp_slow_start_after_idle.
Kuniyuki Iwashima [Mon, 18 Jul 2022 17:26:48 +0000 (10:26 -0700)]
tcp: Fix data-races around sysctl_tcp_slow_start_after_idle.

While reading sysctl_tcp_slow_start_after_idle, it can be changed
concurrently.  Thus, we need to add READ_ONCE() to its readers.

Fixes: 35089bb203f4 ("[TCP]: Add tcp_slow_start_after_idle sysctl.")
Signed-off-by: Kuniyuki Iwashima <>
Signed-off-by: David S. Miller <>
4 months agotcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.
Kuniyuki Iwashima [Mon, 18 Jul 2022 17:26:47 +0000 (10:26 -0700)]
tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.

While reading sysctl_tcp_thin_linear_timeouts, it can be changed
concurrently.  Thus, we need to add READ_ONCE() to its reader.

Fixes: 36e31b0af587 ("net: TCP thin linear timeouts")
Signed-off-by: Kuniyuki Iwashima <>
Signed-off-by: David S. Miller <>
4 months agotcp: Fix data-races around sysctl_tcp_recovery.
Kuniyuki Iwashima [Mon, 18 Jul 2022 17:26:46 +0000 (10:26 -0700)]
tcp: Fix data-races around sysctl_tcp_recovery.

While reading sysctl_tcp_recovery, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its readers.

Fixes: 4f41b1c58a32 ("tcp: use RACK to detect losses")
Signed-off-by: Kuniyuki Iwashima <>
Signed-off-by: David S. Miller <>
4 months agotcp: Fix a data-race around sysctl_tcp_early_retrans.
Kuniyuki Iwashima [Mon, 18 Jul 2022 17:26:45 +0000 (10:26 -0700)]
tcp: Fix a data-race around sysctl_tcp_early_retrans.

While reading sysctl_tcp_early_retrans, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its reader.

Fixes: eed530b6c676 ("tcp: early retransmit")
Signed-off-by: Kuniyuki Iwashima <>
Signed-off-by: David S. Miller <>
4 months agotcp: Fix data-races around sysctl knobs related to SYN option.
Kuniyuki Iwashima [Mon, 18 Jul 2022 17:26:44 +0000 (10:26 -0700)]
tcp: Fix data-races around sysctl knobs related to SYN option.

While reading these knobs, they can be changed concurrently.
Thus, we need to add READ_ONCE() to their readers.

  - tcp_sack
  - tcp_window_scaling
  - tcp_timestamps

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima <>
Signed-off-by: David S. Miller <>
4 months agoudp: Fix a data-race around sysctl_udp_l3mdev_accept.
Kuniyuki Iwashima [Mon, 18 Jul 2022 17:26:43 +0000 (10:26 -0700)]
udp: Fix a data-race around sysctl_udp_l3mdev_accept.

While reading sysctl_udp_l3mdev_accept, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its reader.

Fixes: 63a6fff353d0 ("net: Avoid receiving packets with an l3mdev on unbound UDP sockets")
Signed-off-by: Kuniyuki Iwashima <>
Signed-off-by: David S. Miller <>
4 months agoip: Fix data-races around sysctl_ip_prot_sock.
Kuniyuki Iwashima [Mon, 18 Jul 2022 17:26:42 +0000 (10:26 -0700)]
ip: Fix data-races around sysctl_ip_prot_sock.

sysctl_ip_prot_sock is accessed concurrently, and there is always a chance
of data-race.  So, all readers and writers need some basic protection to
avoid load/store-tearing.

Fixes: 4548b683b781 ("Introduce a sysctl that modifies the value of PROT_SOCK.")
Signed-off-by: Kuniyuki Iwashima <>
Signed-off-by: David S. Miller <>
4 months agoipv4: Fix data-races around sysctl_fib_multipath_hash_fields.
Kuniyuki Iwashima [Mon, 18 Jul 2022 17:26:41 +0000 (10:26 -0700)]
ipv4: Fix data-races around sysctl_fib_multipath_hash_fields.

While reading sysctl_fib_multipath_hash_fields, it can be changed
concurrently.  Thus, we need to add READ_ONCE() to its readers.

Fixes: ce5c9c20d364 ("ipv4: Add a sysctl to control multipath hash fields")
Signed-off-by: Kuniyuki Iwashima <>
Reviewed-by: Ido Schimmel <>
Signed-off-by: David S. Miller <>
4 months agoipv4: Fix data-races around sysctl_fib_multipath_hash_policy.
Kuniyuki Iwashima [Mon, 18 Jul 2022 17:26:40 +0000 (10:26 -0700)]
ipv4: Fix data-races around sysctl_fib_multipath_hash_policy.

While reading sysctl_fib_multipath_hash_policy, it can be changed
concurrently.  Thus, we need to add READ_ONCE() to its readers.

Fixes: bf4e0a3db97e ("net: ipv4: add support for ECMP hash policy choice")
Signed-off-by: Kuniyuki Iwashima <>
Signed-off-by: David S. Miller <>
4 months agoipv4: Fix a data-race around sysctl_fib_multipath_use_neigh.
Kuniyuki Iwashima [Mon, 18 Jul 2022 17:26:39 +0000 (10:26 -0700)]
ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh.

While reading sysctl_fib_multipath_use_neigh, it can be changed
concurrently.  Thus, we need to add READ_ONCE() to its reader.

Fixes: a6db4494d218 ("net: ipv4: Consider failed nexthops in multipath routes")
Signed-off-by: Kuniyuki Iwashima <>
Signed-off-by: David S. Miller <>
4 months agoMerge branch 'master' of git://
David S. Miller [Wed, 20 Jul 2022 09:11:58 +0000 (10:11 +0100)]
Merge branch 'master' of git://git./linux/kernel/git/klassert/ipsec

Steffen Klassert says:

pull request (net): ipsec 2022-07-20

1) Fix a policy refcount imbalance in xfrm_bundle_lookup.
   From Hangyu Hua.

2) Fix some clang -Wformat warnings.
   Justin Stitt

Signed-off-by: David S. Miller <>
4 months agocan: rcar_canfd: Add missing of_node_put() in rcar_canfd_probe()
Liang He [Tue, 12 Jul 2022 09:56:23 +0000 (17:56 +0800)]
can: rcar_canfd: Add missing of_node_put() in rcar_canfd_probe()

We should use of_node_put() for the reference returned by
of_get_child_by_name() which has increased the refcount.

Fixes: 45721c406dcf ("can: rcar_canfd: Add support for r8a779a0 SoC")
Signed-off-by: Liang He <>
Signed-off-by: Marc Kleine-Budde <>
4 months agocan: mcp251xfd: fix detection of mcp251863
Marc Kleine-Budde [Tue, 5 Jul 2022 19:30:38 +0000 (21:30 +0200)]
can: mcp251xfd: fix detection of mcp251863

In commit c6f2a617a0a8 ("can: mcp251xfd: add support for mcp251863")
support for the mcp251863 was added. However it was not taken into
account that the auto detection of the chip model cannot distinguish
between mcp2518fd and mcp251863 and would lead to a warning message if
the firmware specifies a mcp251863.

Fix auto detection: If a mcp2518fd compatible chip is found, keep the
mcp251863 if specified by firmware, use mcp2518fd instead.

Fixes: c6f2a617a0a8 ("can: mcp251xfd: add support for mcp251863")
Signed-off-by: Marc Kleine-Budde <>
4 months agodrm/imx/dcss: Add missing of_node_put() in fail path
Liang He [Thu, 14 Jul 2022 08:13:37 +0000 (16:13 +0800)]
drm/imx/dcss: Add missing of_node_put() in fail path

In dcss_dev_create() and dcss_dev_destroy(), we should call of_node_put()
in fail path or before the dcss's destroy as of_graph_get_port_by_id() has
increased the refcount.

Fixes: 9021c317b770 ("drm/imx: Add initial support for DCSS on iMX8MQ")
Signed-off-by: Liang He <>
Reviewed-by: Laurentiu Palcu <>
Signed-off-by: Laurentiu Palcu <>
4 months agodrm/i915/guc: support v69 in parallel to v70
Daniele Ceraolo Spurio [Mon, 18 Jul 2022 23:07:32 +0000 (16:07 -0700)]
drm/i915/guc: support v69 in parallel to v70

This patch re-introduces support for GuC v69 in parallel to v70. As this
is a quick fix, v69 has been re-introduced as the single "fallback" guc
version in case v70 is not available on disk and only for platforms that
are out of force_probe and require the GuC by default. All v69 specific
code has been labeled as such for easy identification, and the same was
done for all v70 functions for which there is a separate v69 version,
to avoid accidentally calling the wrong version via the unlabeled name.

When the fallback mode kicks in, a drm_notice message is printed in
dmesg to inform the user of the required update. The existing
logging of the fetch function has also been updated so that we no
longer complain immediately if we can't find a fw and we only throw an
error if the fetch of both the base and fallback blobs fails.

The plan is to follow this up with a more complex rework to allow for
multiple different GuC versions to be supported at the same time.

v2: reduce the fallback to platform that require it, switch to
firmware_request_nowarn(), improve logs.

Fixes: 2584b3549f4c ("drm/i915/guc: Update to GuC version 70.1.1")
Signed-off-by: Daniele Ceraolo Spurio <>
Cc: John Harrison <>
Cc: Matthew Brost <>
Cc: Matt Roper <>
Cc: Dave Airlie <>
Cc: Michal Wajdeczko <>
Acked-by: Rodrigo Vivi <>
Reviewed-by: John Harrison <>
(cherry picked from commit 774ce1510e6ccb9c0752d4aa7a9ff3624b3db3f3)
Signed-off-by: Rodrigo Vivi <>
4 months agodrm/i915/guc: Support programming the EU priority in the GuC descriptor
Matthew Brost [Wed, 4 May 2022 23:46:36 +0000 (16:46 -0700)]
drm/i915/guc: Support programming the EU priority in the GuC descriptor

In GuC submission mode the EU priority must be updated by the GuC rather
than the driver as the GuC owns the programming of the context descriptor.

Given that the GuC code uses the GuC priorities, we can't use a generic
function using i915 priorities for both execlists and GuC submission.
The existing function has therefore been pushed to the execlists
back-end while a new one has been added for GuC.

v2: correctly use the GuC prio.

Cc: John Harrison <>
Cc: Matt Roper <>
Signed-off-by: Matthew Brost <>
Signed-off-by: Aravind Iddamsetty <>
Signed-off-by: Daniele Ceraolo Spurio <>
Reviewed-by: John Harrison <>
(cherry picked from commit a5c89f7c43c12c592a882a0ec2a15e9df0011e80)
Signed-off-by: Rodrigo Vivi <>
4 months agoMerge branch '40GbE' of git://
Jakub Kicinski [Wed, 20 Jul 2022 00:43:02 +0000 (17:43 -0700)]
Merge branch '40GbE' of git://git./linux/kernel/git/tnguy/net-queue

Tony Nguyen says:

Intel Wired LAN Driver Updates 2022-07-18

This series contains updates to iavf driver only.

Przemyslaw fixes handling of multiple VLAN requests to account for
individual errors instead of rejecting them all. He removes incorrect
implementations of ETHTOOL_COALESCE_MAX_FRAMES and

He also corrects an issue with NULL pointer caused by improper handling of
dummy receive descriptors. Finally, he corrects debug prints reporting an
unknown state.

* '40GbE' of git://
  iavf: Fix missing state logs
  iavf: Fix handling of dummy receive descriptors
  iavf: Disallow changing rx/tx-frames and rx/tx-frames-irq
  iavf: Fix VLAN_V2 addition/rejection

Signed-off-by: Jakub Kicinski <>
4 months agoDocumentation: fix udp_wmem_min in ip-sysctl.rst
Xin Long [Mon, 18 Jul 2022 17:56:59 +0000 (13:56 -0400)]
Documentation: fix udp_wmem_min in ip-sysctl.rst

UDP doesn't support tx memory accounting, and sysctl udp_wmem_min
is not really used anywhere. So we should fix the description in
ip-sysctl.rst accordingly.

Fixes: 95766fff6b9a ("[UDP]: Add memory accounting.")
Signed-off-by: Xin Long <>
Signed-off-by: Jakub Kicinski <>
4 months agonet: ethernet: mtk_ppe: fix possible NULL pointer dereference in mtk_flow_get_wdma_info
Lorenzo Bianconi [Mon, 18 Jul 2022 09:51:53 +0000 (11:51 +0200)]
net: ethernet: mtk_ppe: fix possible NULL pointer dereference in mtk_flow_get_wdma_info

odev pointer can be NULL in mtk_flow_offload_replace routine according
to the flower action rules. Fix possible NULL pointer dereference in

Fixes: a333215e10cb5 ("net: ethernet: mtk_eth_soc: implement flow offloading to WED devices")
Signed-off-by: Lorenzo Bianconi <>
Signed-off-by: Jakub Kicinski <>
4 months agor8152: fix a WOL issue
Hayes Wang [Mon, 18 Jul 2022 08:21:20 +0000 (16:21 +0800)]
r8152: fix a WOL issue

This fixes that the platform is waked by an unexpected packet. The
size and range of FIFO is different when the device enters S3 state,
so it is necessary to correct some settings when suspending.

Regardless of jumbo frame, set RMS to 1522 and MTPS to MTPS_DEFAULT.
Besides, enable MCU_BORW_EN to update the method of calculating the
pointer of data. Then, the hardware could get the correct data.

Fixes: 195aae321c82 ("r8152: support new chips")
Signed-off-by: Hayes Wang <>
Signed-off-by: Jakub Kicinski <>
4 months agodrm/panel-edp: Fix variable typo when saving hpd absent delay from DT
Nícolas F. R. A. Prado [Tue, 19 Jul 2022 20:38:56 +0000 (16:38 -0400)]
drm/panel-edp: Fix variable typo when saving hpd absent delay from DT

The value read from the "hpd-absent-delay-ms" property in DT was being
saved to the wrong variable, overriding the hpd_reliable delay. Fix the

Fixes: 5540cf8f3e8d ("drm/panel-edp: Implement generic "edp-panel"s probed by EDID")
Signed-off-by: Nícolas F. R. A. Prado <>
Reviewed-by: André Almeida <>
Reviewed-by: Douglas Anderson <>
Signed-off-by: Douglas Anderson <>
4 months agovirt: sev-guest: Pass the appropriate argument type to iounmap()
Tom Lendacky [Tue, 19 Jul 2022 17:12:52 +0000 (12:12 -0500)]
virt: sev-guest: Pass the appropriate argument type to iounmap()

Fix a sparse warning in sev_guest_probe() where the wrong argument type is
provided to iounmap().

Fixes: fce96cf04430 ("virt: Add SEV-SNP guest driver")
Reported-by: kernel test robot <>
Signed-off-by: Tom Lendacky <>
Signed-off-by: Borislav Petkov <>
4 months agoMerge branch 'md-fixes' of
Jens Axboe [Tue, 19 Jul 2022 18:42:33 +0000 (12:42 -0600)]
Merge branch 'md-fixes' of https://git./linux/kernel/git/song/md into block-5.19

Pull MD fix from Song.

* 'md-fixes' of
  md/raid5: missing error code in setup_conf()

4 months agosrcu: Make expedited RCU grace periods block even less frequently
Neeraj Upadhyay [Fri, 1 Jul 2022 03:15:45 +0000 (08:45 +0530)]
srcu: Make expedited RCU grace periods block even less frequently

The purpose of commit 282d8998e997 ("srcu: Prevent expedited GPs
and blocking readers from consuming CPU") was to prevent a long
series of never-blocking expedited SRCU grace periods from blocking
kernel-live-patching (KLP) progress.  Although it was successful, it also
resulted in excessive boot times on certain embedded workloads running
under qemu with the "-bios QEMU_EFI.fd" command line.  Here "excessive"
means increasing the boot time up into the three-to-four minute range.
This increase in boot time was due to the more than 6000 back-to-back
invocations of synchronize_rcu_expedited() within the KVM host OS, which
in turn resulted from qemu's emulation of a long series of MMIO accesses.

Commit 640a7d37c3f4 ("srcu: Block less aggressively for expedited grace
periods") did not significantly help this particular use case.

Zhangfei Gao and Shameerali Kolothum Thodi did experiments varying the
value of SRCU_MAX_NODELAY_PHASE with HZ=250 and with various values
of non-sleeping per phase counts on a system with preemption enabled,
and observed the following boot times:

| SRCU_MAX_NODELAY_PHASE   | Boot time (s)  |
| 100                      | 30.053         |
| 150                      | 25.151         |
| 200                      | 20.704         |
| 250                      | 15.748         |
| 500                      | 11.401         |
| 1000                     | 11.443         |
| 10000                    | 11.258         |
1000000                  | 11.154         |

Analysis on the experiment results show additional improvements with
CPU-bound delays approaching one jiffy in duration. This improvement was
also seen when number of per-phase iterations were scaled to one jiffy.

This commit therefore scales per-grace-period phase number of non-sleeping
polls so that non-sleeping polls extend for about one jiffy. In addition,
the delay-calculation call to srcu_get_delay() in srcu_gp_end() is
replaced with a simple check for an expedited grace period.  This change
schedules callback invocation immediately after expedited grace periods
complete, which results in greatly improved boot times.  Testing done
by Marc and Zhangfei confirms that this change recovers most of the
performance degradation in boottime; for CONFIG_HZ_250 configuration,
specifically, boot times improve from 3m50s to 41s on Marc's setup;
and from 2m40s to ~9.7s on Zhangfei's setup.

In addition to the changes to default per phase delays, this
change adds 3 new kernel parameters - srcutree.srcu_max_nodelay,
srcutree.srcu_max_nodelay_phase, and srcutree.srcu_retry_check_delay.
This allows users to configure the srcu grace period scanning delays in
order to more quickly react to additional use cases.

Fixes: 640a7d37c3f4 ("srcu: Block less aggressively for expedited grace periods")
Fixes: 282d8998e997 ("srcu: Prevent expedited GPs and blocking readers from consuming CPU")
Reported-by: Zhangfei Gao <>
Reported-by: yueluck <>
Signed-off-by: Neeraj Upadhyay <>
Tested-by: Marc Zyngier <>
Tested-by: Zhangfei Gao <>
Signed-off-by: Paul E. McKenney <>
4 months agosrcu: Block less aggressively for expedited grace periods
Paul E. McKenney [Sun, 12 Jun 2022 22:00:06 +0000 (15:00 -0700)]
srcu: Block less aggressively for expedited grace periods

Commit 282d8998e997 ("srcu: Prevent expedited GPs and blocking readers
from consuming CPU") fixed a problem where a long-running expedited SRCU
grace period could block kernel live patching.  It did so by giving up
on expediting once a given SRCU expedited grace period grew too old.

Unfortunately, this added excessive delays to boots of virtual embedded
systems specifying "-bios QEMU_EFI.fd" to qemu.  This commit therefore
makes the transition away from expediting less aggressive, increasing
the per-grace-period phase number of non-sleeping polls of readers from
one to three and increasing the required grace-period age from one jiffy
(actually from zero to one jiffies) to two jiffies (actually from one
to two jiffies).

Fixes: 282d8998e997 ("srcu: Prevent expedited GPs and blocking readers from consuming CPU")
Signed-off-by: Paul E. McKenney <>
Reported-by: Zhangfei Gao <>
Reported-by: chenxiang (M)" <>
Cc: Shameerali Kolothum Thodi <>
Cc: Paolo Bonzini <>
Reviewed-by: Neeraj Upadhyay <>
4 months agoKVM: x86: Protect the unused bits in MSR exiting flags
Aaron Lewis [Thu, 14 Jul 2022 16:13:15 +0000 (16:13 +0000)]
KVM: x86: Protect the unused bits in MSR exiting flags

have no protection for their unused bits.  Without protection, future
development for these features will be difficult.  Add the protection
needed to make it possible to extend these features in the future.

Signed-off-by: Aaron Lewis <>
Message-Id: <>
Signed-off-by: Paolo Bonzini <>
4 months agomd/raid5: missing error code in setup_conf()
Dan Carpenter [Tue, 19 Jul 2022 09:48:01 +0000 (12:48 +0300)]
md/raid5: missing error code in setup_conf()

Return -ENOMEM if the allocation fails.  Don't return success.

Fixes: 8fbcba6b999b ("md/raid5: Cleanup setup_conf() error returns")
Signed-off-by: Dan Carpenter <>
Reviewed-by: Logan Gunthorpe <>
Signed-off-by: Song Liu <>
4 months agotools headers UAPI: Sync linux/kvm.h with the kernel sources
Paolo Bonzini [Tue, 19 Jul 2022 13:16:53 +0000 (09:16 -0400)]
tools headers UAPI: Sync linux/kvm.h with the kernel sources

Silence this perf build warning:

  Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h'
  diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h

Reported-by: Arnaldo Carvalho de Melo <>
Cc: Adrian Hunter <>
Cc: Ian Rogers <>
Cc: Jiri Olsa <>
Cc: Namhyung Kim <>
Signed-off-by: Paolo Bonzini <>
4 months agoKVM: selftests: Fix target thread to be migrated in rseq_test
Gavin Shan [Tue, 19 Jul 2022 02:08:30 +0000 (10:08 +0800)]
KVM: selftests: Fix target thread to be migrated in rseq_test

In rseq_test, there are two threads, which are vCPU thread and migration
worker separately. Unfortunately, the test has the wrong PID passed to
sched_setaffinity() in the migration worker. It forces migration on the
migration worker because zeroed PID represents the calling thread, which
is the migration worker itself. It means the vCPU thread is never enforced
to migration and it can migrate at any time, which eventually leads to
failure as the following logs show.

  host# uname -r
  host# # cat /proc/cpuinfo | grep processor | tail -n 1
  processor    : 223
  host# pwd
  host# for i in `seq 1 100`; do \
        echo "--------> $i"; ./rseq_test; done
  --------> 1
  --------> 2
  --------> 3
  --------> 4
  --------> 5
  --------> 6
  ==== Test Assertion Failure ====
    rseq_test.c:265: rseq_cpu == cpu
    pid=3925 tid=3925 errno=4 - Interrupted system call
       1  0x0000000000401963: main at rseq_test.c:265 (discriminator 2)
       2  0x0000ffffb044affb: ?? ??:0
       3  0x0000ffffb044b0c7: ?? ??:0
       4  0x0000000000401a6f: _start at ??:?
    rseq CPU = 4, sched CPU = 27

Fix the issue by passing correct parameter, TID of the vCPU thread, to
sched_setaffinity() in the migration worker.

Fixes: 61e52f1630f5 ("KVM: selftests: Add a test for KVM_RUN+rseq to detect task migration bugs")
Suggested-by: Sean Christopherson <>
Signed-off-by: Gavin Shan <>
Reviewed-by: Oliver Upton <>
Message-Id: <>
Reviewed-by: Andrew Jones <>
Signed-off-by: Paolo Bonzini <>
4 months agoKVM: stats: Fix value for KVM_STATS_UNIT_MAX for boolean stats
Oliver Upton [Tue, 19 Jul 2022 12:52:29 +0000 (12:52 +0000)]
KVM: stats: Fix value for KVM_STATS_UNIT_MAX for boolean stats

commit 1b870fa5573e ("kvm: stats: tell userspace which values are
boolean") added a new stat unit (boolean) but failed to raise

Fix by pointing UNIT_MAX at the new max value of UNIT_BOOLEAN.

Fixes: 1b870fa5573e ("kvm: stats: tell userspace which values are boolean")
Reported-by: Janis Schoetterl-Glausch <>
Signed-off-by: Oliver Upton <>
Message-Id: <>
Signed-off-by: Paolo Bonzini <>
4 months agoMerge branch 'amt-fix-validation-and-synchronization-bugs'
Paolo Abeni [Tue, 19 Jul 2022 10:37:04 +0000 (12:37 +0200)]
Merge branch 'amt-fix-validation-and-synchronization-bugs'

Taehee Yoo says:

amt: fix validation and synchronization bugs

There are some synchronization issues in the amt module.
Especially, an amt gateway doesn't well synchronize its own variables
and status(amt->status).
It tries to use a workqueue for handles in a single thread.
A global lock is also good, but it would occur complex locking complex.

In this patchset, only the gateway uses workqueue.
The reason why only gateway interface uses workqueue is that gateway
should manage its own states and variables a little bit statefully.
But relay doesn't need to manage tunnels statefully, stateless is okay.
So, relay side message handlers are okay to be called concurrently.
But it doesn't mean that no lock is needed.

Only amt multicast data message type will not be processed by the work
queue because It contains actual multicast data.
So, it should be processed immediately.

When any amt gateway events are triggered(sending discovery message by
delayed_work, sending request message by delayed_work and receiving
messages), it stores event and skb into the event queue(amt->events[16]).
Then, workqueue processes these events one by one.

The first patch is to use the work queue.

The second patch is to remove unnecessary lock due to a previous patch.

The third patch is to use READ_ONCE() in the amt module.
Even if the amt module uses a single thread, some variables (ready4,
ready6, amt->status) can be accessed concurrently.

The fourth patch is to add missing nonce generation logic when it sends a
new request message.

The fifth patch is to drop unexpected advertisement messages.
advertisement message should be received only after the gateway sends
a discovery message first.
So, the gateway should drop advertisement messages if it has never
sent a discovery message and it also should drop duplicate advertisement
Using nonce is good to distinguish whether a received message is an
expected message or not.

The sixth patch is to drop unexpected query messages.
This is the same behavior as the fourth patch.
Query messages should be received only after the gateway sends a request
message first.
The nonce variable is used to distinguish whether it is a reply to a
previous request message or not.
amt->ready4 and amt->ready6 are used to distinguish duplicate messages.

The seventh patch is to drop unexpected multicast data.
AMT gateway should not receive multicast data message type before
establish between gateway and relay.
In order to drop unexpected multicast data messages, it checks amt->status.

The last patch is to fix a locking problem on the relay side.
amt->nr_tunnels variable is protected by amt->lock.
But amt_request_handler() doesn't protect this variable.

 - Use local_bh_disable() instead of rcu_read_lock_bh() in
 - Fix using uninitialized variables.
 - Fix unexpectedly start the event_wq after stopping.
 - Fix possible deadlock in amt_event_work().
 - Add a limit variable in amt_event_work() to prevent infinite working.
 - Rename amt_queue_events() to amt_queue_event().

Signed-off-by: Paolo Abeni <>
4 months agoamt: do not use amt->nr_tunnels outside of lock
Taehee Yoo [Sun, 17 Jul 2022 16:09:10 +0000 (16:09 +0000)]
amt: do not use amt->nr_tunnels outside of lock

amt->nr_tunnels is protected by amt->lock.
But, amt_request_handler() has been using this variable without the
So, it expands context of amt->lock in the amt_request_handler() to
protect amt->nr_tunnels variable.

Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
Signed-off-by: Taehee Yoo <>
Signed-off-by: Paolo Abeni <>
4 months agoamt: drop unexpected multicast data
Taehee Yoo [Sun, 17 Jul 2022 16:09:09 +0000 (16:09 +0000)]
amt: drop unexpected multicast data

AMT gateway interface should not receive unexpected multicast data.
Multicast data message type should be received after sending an update
message, which means all establishment between gateway and relay is
So, amt_multicast_data_handler() checks amt->status.

Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
Signed-off-by: Taehee Yoo <>
Signed-off-by: Paolo Abeni <>
4 months agoamt: drop unexpected query message
Taehee Yoo [Sun, 17 Jul 2022 16:09:08 +0000 (16:09 +0000)]
amt: drop unexpected query message

AMT gateway interface should not receive unexpected query messages.
In order to drop unexpected query messages, it checks nonce.
And it also checks ready4 and ready6 variables to drop duplicated messages.

Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
Signed-off-by: Taehee Yoo <>
Signed-off-by: Paolo Abeni <>
4 months agoamt: drop unexpected advertisement message
Taehee Yoo [Sun, 17 Jul 2022 16:09:07 +0000 (16:09 +0000)]
amt: drop unexpected advertisement message

AMT gateway interface should not receive unexpected advertisement messages.
In order to drop these packets, it should check nonce and amt->status.

Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
Signed-off-by: Taehee Yoo <>
Signed-off-by: Paolo Abeni <>
4 months agoamt: add missing regeneration nonce logic in request logic
Taehee Yoo [Sun, 17 Jul 2022 16:09:06 +0000 (16:09 +0000)]
amt: add missing regeneration nonce logic in request logic

When AMT gateway starts sending a new request message, it should
regenerate the nonce variable.

Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
Signed-off-by: Taehee Yoo <>
Signed-off-by: Paolo Abeni <>
4 months agoamt: use READ_ONCE() in amt module
Taehee Yoo [Sun, 17 Jul 2022 16:09:05 +0000 (16:09 +0000)]
amt: use READ_ONCE() in amt module

There are some data races in the amt module.
amt->ready4, amt->ready6, and amt->status can be accessed concurrently
without locks.
So, it uses READ_ONCE() and WRITE_ONCE().

Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
Signed-off-by: Taehee Yoo <>
Signed-off-by: Paolo Abeni <>
4 months agoamt: remove unnecessary locks
Taehee Yoo [Sun, 17 Jul 2022 16:09:04 +0000 (16:09 +0000)]
amt: remove unnecessary locks

By the previous patch, amt gateway handlers are changed to worked by
a single thread.
So, most locks for gateway are not needed.
So, it removes.

Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
Signed-off-by: Taehee Yoo <>
Signed-off-by: Paolo Abeni <>
4 months agoamt: use workqueue for gateway side message handling
Taehee Yoo [Sun, 17 Jul 2022 16:09:03 +0000 (16:09 +0000)]
amt: use workqueue for gateway side message handling

There are some synchronization issues(amt->status, amt->req_cnt, etc)
if the interface is in gateway mode because gateway message handlers
are processed concurrently.
This applies a work queue for processing these messages instead of
expanding the locking context.

So, the purposes of this patch are to fix exist race conditions and to make
gateway to be able to validate a gateway status more correctly.

When the AMT gateway interface is created, it tries to establish to relay.
The establishment step looks stateless, but it should be managed well.
In order to handle messages in the gateway, it saves the current
status(i.e. AMT_STATUS_XXX).
This patch makes gateway code to be worked with a single thread.

Now, all messages except the multicast are triggered(received or
delay expired), and these messages will be stored in the event
Then, the single worker processes stored messages asynchronously one
by one.
The multicast data message type will be still processed immediately.

Now, amt->lock is only needed to access the event queue(amt->events)
if an interface is the gateway mode.

Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
Signed-off-by: Taehee Yoo <>
Signed-off-by: Paolo Abeni <>
4 months agonet: dsa: vitesse-vsc73xx: silent spi_device_id warnings
Oleksij Rempel [Sun, 17 Jul 2022 13:58:31 +0000 (15:58 +0200)]
net: dsa: vitesse-vsc73xx: silent spi_device_id warnings

Add spi_device_id entries to silent SPI warnings.

Fixes: 5fa6863ba692 ("spi: Check we have a spi_device_id for each DT compatible")
Signed-off-by: Oleksij Rempel <>
Reviewed-by: Vladimir Oltean <>
Signed-off-by: Paolo Abeni <>
4 months agonet: dsa: sja1105: silent spi_device_id warnings
Oleksij Rempel [Sun, 17 Jul 2022 13:58:30 +0000 (15:58 +0200)]
net: dsa: sja1105: silent spi_device_id warnings

Add spi_device_id entries to silent following warnings:
 SPI driver sja1105 has no spi_device_id for nxp,sja1105e
 SPI driver sja1105 has no spi_device_id for nxp,sja1105t
 SPI driver sja1105 has no spi_device_id for nxp,sja1105p
 SPI driver sja1105 has no spi_device_id for nxp,sja1105q
 SPI driver sja1105 has no spi_device_id for nxp,sja1105r
 SPI driver sja1105 has no spi_device_id for nxp,sja1105s
 SPI driver sja1105 has no spi_device_id for nxp,sja1110a
 SPI driver sja1105 has no spi_device_id for nxp,sja1110b
 SPI driver sja1105 has no spi_device_id for nxp,sja1110c
 SPI driver sja1105 has no spi_device_id for nxp,sja1110d

Fixes: 5fa6863ba692 ("spi: Check we have a spi_device_id for each DT compatible")
Signed-off-by: Oleksij Rempel <>
Reviewed-by: Vladimir Oltean <>
Reviewed-by: Florian Fainelli <>
Signed-off-by: Paolo Abeni <>
4 months agobe2net: Fix buffer overflow in be_get_module_eeprom
Hristo Venev [Sat, 16 Jul 2022 08:51:34 +0000 (11:51 +0300)]
be2net: Fix buffer overflow in be_get_module_eeprom

be_cmd_read_port_transceiver_data assumes that it is given a buffer that
is at least PAGE_DATA_LEN long, or twice that if the module supports SFF
8472. However, this is not always the case.

Fix this by passing the desired offset and length to
be_cmd_read_port_transceiver_data so that we only copy the bytes once.

Fixes: e36edd9d26cf ("be2net: add ethtool "-m" option support")
Signed-off-by: Hristo Venev <>
Signed-off-by: Paolo Abeni <>
4 months agogpio: pca953x: use the correct register address when regcache sync during init
Haibo Chen [Mon, 18 Jul 2022 08:31:43 +0000 (16:31 +0800)]
gpio: pca953x: use the correct register address when regcache sync during init

For regcache_sync_region, we need to use pca953x_recalc_addr() to get
the real register address.

Fixes: ec82d1eba346 ("gpio: pca953x: Zap ad-hoc reg_output cache")
Fixes: 0f25fda840a9 ("gpio: pca953x: Zap ad-hoc reg_direction cache")
Signed-off-by: Haibo Chen <>
Reviewed-by: Andy Shevchenko <>
Signed-off-by: Bartosz Golaszewski <>