20 Jan, 2021

40 commits

  • [ Upstream commit feb889fb40fafc6933339cf1cca8f770126819fb ]

    So technically there is nothing wrong with adding a pinned page to the
    swap cache, but the pinning obviously means that the page can't actually
    be free'd right now anyway, so it's a bit pointless.

    However, the real problem is not with it being a bit pointless: the real
    issue is that after we've added it to the swap cache, we'll try to unmap
    the page. That will succeed, because the code in mm/rmap.c doesn't know
    or care about pinned pages.

    Even the unmapping isn't fatal per se, since the page will stay around
    in memory due to the pinning, and we do hold the connection to it using
    the swap cache. But when we then touch it next and take a page fault,
    the logic in do_swap_page() will map it back into the process as a
    possibly read-only page, and we'll then break the page association on
    the next COW fault.

    Honestly, this issue could have been fixed in any of those other places:
    (a) we could refuse to unmap a pinned page (which makes conceptual
    sense), or (b) we could make sure to re-map a pinned page writably in
    do_swap_page(), or (c) we could just make do_wp_page() not COW the
    pinned page (which was what we historically did before that "mm:
    do_wp_page() simplification" commit).

    But while all of them are equally valid models for breaking this chain,
    not putting pinned pages into the swap cache in the first place is the
    simplest one by far.

    It's also the safest one: the reason why do_wp_page() was changed in the
    first place was that getting the "can I re-use this page" wrong is so
    fraught with errors. If you do it wrong, you end up with an incorrectly
    shared page.

    As a result, using "page_maybe_dma_pinned()" in either do_wp_page() or
    do_swap_page() would be a serious bug since it is only a (very good)
    heuristic. Re-using the page requires a hard black-and-white rule with
    no room for ambiguity.

    In contrast, saying "this page is very likely dma pinned, so let's not
    add it to the swap cache and try to unmap it" is an obviously safe thing
    to do, and if the heuristic might very rarely be a false positive, no
    harm is done.

    Fixes: 09854ba94c6a ("mm: do_wp_page() simplification")
    Reported-and-tested-by: Martin Raiber
    Cc: Pavel Begunkov
    Cc: Jens Axboe
    Cc: Peter Xu
    Signed-off-by: Linus Torvalds
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Linus Torvalds
     
  • [ Upstream commit 9348b73c2e1bfea74ccd4a44fb4ccc7276ab9623 ]

    Turning a pinned page read-only breaks the pinning after COW. Don't do it.

    The whole "track page soft dirty" state doesn't work with pinned pages
    anyway, since the page might be dirtied by the pinning entity without
    ever being noticed in the page tables.

    Signed-off-by: Linus Torvalds
    Signed-off-by: Sasha Levin

    Linus Torvalds
     
  • [ Upstream commit 29a951dfb3c3263c3a0f3bd9f7f2c2cfde4baedb ]

    Turning page table entries read-only requires the mmap_sem held for
    writing.

    So stop doing the odd games with turning things from read locks to write
    locks and back. Just get the write lock.

    Signed-off-by: Linus Torvalds
    Signed-off-by: Sasha Levin

    Linus Torvalds
     
  • [ Upstream commit 02f938e9fed1681791605ca8b96c2d9da9355f6a ]

    Showing the hctx flags for when BLK_MQ_F_TAG_HCTX_SHARED is set gives
    something like:

    root@debian:/home/john# more /sys/kernel/debug/block/sda/hctx0/flags
    alloc_policy=FIFO SHOULD_MERGE|TAG_QUEUE_SHARED|3

    Add the decoding for that flag.

    Fixes: 32bc15afed04b ("blk-mq: Facilitate a shared sbitmap per tagset")
    Signed-off-by: John Garry
    Signed-off-by: Jens Axboe
    Signed-off-by: Sasha Levin

    John Garry
     
  • [ Upstream commit 25c904b59aaf4816337acd415514b0c47715f604 ]

    Adding vf VLANID for the first time, or after having cleared previously
    defined VLANID works fine, however, attempting to change an existing vf
    VLANID clears the rules on the firmware, but does not add new rules for
    the new vf VLANID.

    Fix this by changing the logic in function esw_acl_egress_lgcy_setup()
    so that it will always configure egress rules.

    Fixes: ea651a86d468 ("net/mlx5: E-Switch, Refactor eswitch egress acl codes")
    Signed-off-by: Alaa Hleihel
    Signed-off-by: Saeed Mahameed
    Signed-off-by: Sasha Levin

    Alaa Hleihel
     
  • [ Upstream commit 0c4accc41cb56e527c8c049f5495af9f3d6bef7e ]

    Fix smatch warnings:

    drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c:105 esw_acl_egress_lgcy_setup() warn: passing zero to 'PTR_ERR'
    drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_ofld.c:177 esw_acl_egress_ofld_setup() warn: passing zero to 'PTR_ERR'
    drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c:184 esw_acl_ingress_lgcy_setup() warn: passing zero to 'PTR_ERR'
    drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_ofld.c:262 esw_acl_ingress_ofld_setup() warn: passing zero to 'PTR_ERR'

    esw_acl_table_create() never returns NULL, so
    NULL test should be removed.

    Signed-off-by: YueHaibing
    Signed-off-by: Saeed Mahameed
    Signed-off-by: Sasha Levin

    YueHaibing
     
  • [ Upstream commit eed38eeee734756596e2cc163bdc7dac3be501b1 ]

    Connection counters may be shared for both directions when the counter
    is used for connection aging purposes. However, if TC flow
    accounting is enabled then a unique counter is required per direction.

    Instantiate a unique counter per direction if the conntrack accounting
    extension is enabled. Use a shared counter when the connection accounting
    extension is disabled.

    Fixes: 1edae2335adf ("net/mlx5e: CT: Use the same counter for both directions")
    Signed-off-by: Oz Shlomo
    Reported-by: Marcelo Ricardo Leitner
    Reviewed-by: Roi Dayan
    Reviewed-by: Paul Blakey
    Signed-off-by: Saeed Mahameed
    Signed-off-by: Sasha Levin

    Oz Shlomo
     
  • [ Upstream commit c062db039f40e868c371c36afe8d0fac64305b5d ]

    The iommu-dma constrains IOVA allocation based on the domain geometry
    that the driver reports. Update domain geometry everytime a domain is
    attached to or detached from a device.

    Signed-off-by: Lu Baolu
    Tested-by: Logan Gunthorpe
    Link: https://lore.kernel.org/r/20201124082057.2614359-6-baolu.lu@linux.intel.com
    Signed-off-by: Will Deacon
    Signed-off-by: Sasha Levin

    Lu Baolu
     
  • [ Upstream commit 19fce0470f05031e6af36e49ce222d0f0050d432 ]

    Recent patches changed calling sequences. nvme_fc_abort_outstanding_ios
    used to be called from a timeout or work context. Now it is being called
    in an io completion context, which can be an interrupt handler.
    Unfortunately, the abort outstanding ios routine attempts to stop nvme
    queues and nested routines that may try to sleep, which is in conflict
    with the interrupt handler.

    Correct replacing the direct call with a work element scheduling, and the
    abort outstanding ios routine will be called in the work element.

    Fixes: 95ced8a2c72d ("nvme-fc: eliminate terminate_io use by nvme_fc_error_recovery")
    Signed-off-by: James Smart
    Reported-by: Daniel Wagner
    Tested-by: Daniel Wagner
    Signed-off-by: Christoph Hellwig
    Signed-off-by: Sasha Levin

    James Smart
     
  • [ Upstream commit 152a8a6c017bfdeda7f6d052fbc6e151891bd9b6 ]

    Without crc32 support, this fails to link:

    arm-linux-gnueabi-ld: net/wireless/scan.o: in function `cfg80211_scan_6ghz':
    scan.c:(.text+0x928): undefined reference to `crc32_le'

    Fixes: c8cb5b854b40 ("nl80211/cfg80211: support 6 GHz scanning")
    Signed-off-by: Arnd Bergmann
    Signed-off-by: David S. Miller
    Signed-off-by: Sasha Levin

    Arnd Bergmann
     
  • [ Upstream commit a8f7e08a81708920a928664a865208fdf451c49f ]

    The IN and OUT instructions with port address as an immediate operand
    only use an 8-bit immediate (imm8). The current VC handler uses the
    entire 32-bit immediate value but these instructions only set the first
    bytes.

    Cast the operand to an u8 for that.

    [ bp: Massage commit message. ]

    Fixes: 25189d08e5168 ("x86/sev-es: Add support for handling IOIO exceptions")
    Signed-off-by: Peter Gonda
    Signed-off-by: Borislav Petkov
    Acked-by: David Rientjes
    Link: https://lkml.kernel.org/r/20210105163311.221490-1-pgonda@google.com
    Signed-off-by: Sasha Levin

    Peter Gonda
     
  • [ Upstream commit 69ca310f34168eae0ada434796bfc22fb4a0fa26 ]

    On some systems, some variant of the following splat is
    repeatedly seen. The common factor in all traces seems
    to be the entry point to task_file_seq_next(). With the
    patch, all warnings go away.

    rcu: INFO: rcu_sched self-detected stall on CPU
    rcu: \x0926-....: (20992 ticks this GP) idle=d7e/1/0x4000000000000002 softirq=81556231/81556231 fqs=4876
    \x09(t=21033 jiffies g=159148529 q=223125)
    NMI backtrace for cpu 26
    CPU: 26 PID: 2015853 Comm: bpftool Kdump: loaded Not tainted 5.6.13-0_fbk4_3876_gd8d1f9bf80bb #1
    Hardware name: Quanta Twin Lakes MP/Twin Lakes Passive MP, BIOS F09_3A12 10/08/2018
    Call Trace:

    dump_stack+0x50/0x70
    nmi_cpu_backtrace.cold.6+0x13/0x50
    ? lapic_can_unplug_cpu.cold.30+0x40/0x40
    nmi_trigger_cpumask_backtrace+0xba/0xca
    rcu_dump_cpu_stacks+0x99/0xc7
    rcu_sched_clock_irq.cold.90+0x1b4/0x3aa
    ? tick_sched_do_timer+0x60/0x60
    update_process_times+0x24/0x50
    tick_sched_timer+0x37/0x70
    __hrtimer_run_queues+0xfe/0x270
    hrtimer_interrupt+0xf4/0x210
    smp_apic_timer_interrupt+0x5e/0x120
    apic_timer_interrupt+0xf/0x20

    RIP: 0010:get_pid_task+0x38/0x80
    Code: 89 f6 48 8d 44 f7 08 48 8b 00 48 85 c0 74 2b 48 83 c6 55 48 c1 e6 04 48 29 f0 74 19 48 8d 78 20 ba 01 00 00 00 f0 0f c1 50 20 d2 74 27 78 11 83 c2 01 78 0c 48 83 c4 08 c3 31 c0 48 83 c4 08
    RSP: 0018:ffffc9000d293dc8 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13
    RAX: ffff888637c05600 RBX: ffffc9000d293e0c RCX: 0000000000000000
    RDX: 0000000000000001 RSI: 0000000000000550 RDI: ffff888637c05620
    RBP: ffffffff8284eb80 R08: ffff88831341d300 R09: ffff88822ffd8248
    R10: ffff88822ffd82d0 R11: 00000000003a93c0 R12: 0000000000000001
    R13: 00000000ffffffff R14: ffff88831341d300 R15: 0000000000000000
    ? find_ge_pid+0x1b/0x20
    task_seq_get_next+0x52/0xc0
    task_file_seq_get_next+0x159/0x220
    task_file_seq_next+0x4f/0xa0
    bpf_seq_read+0x159/0x390
    vfs_read+0x8a/0x140
    ksys_read+0x59/0xd0
    do_syscall_64+0x42/0x110
    entry_SYSCALL_64_after_hwframe+0x44/0xa9
    RIP: 0033:0x7f95ae73e76e
    Code: Bad RIP value.
    RSP: 002b:00007ffc02c1dbf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
    RAX: ffffffffffffffda RBX: 000000000170faa0 RCX: 00007f95ae73e76e
    RDX: 0000000000001000 RSI: 00007ffc02c1dc30 RDI: 0000000000000007
    RBP: 00007ffc02c1ec70 R08: 0000000000000005 R09: 0000000000000006
    R10: fffffffffffff20b R11: 0000000000000246 R12: 00000000019112a0
    R13: 0000000000000000 R14: 0000000000000007 R15: 00000000004283c0

    If unable to obtain the file structure for the current task,
    proceed to the next task number after the one returned from
    task_seq_get_next(), instead of the next task number from the
    original iterator.

    Also, save the stopping task number from task_seq_get_next()
    on failure in case of restarts.

    Fixes: eaaacd23910f ("bpf: Add task and task/file iterator targets")
    Signed-off-by: Jonathan Lemon
    Signed-off-by: Daniel Borkmann
    Acked-by: Andrii Nakryiko
    Link: https://lore.kernel.org/bpf/20201218185032.2464558-2-jonathan.lemon@gmail.com
    Signed-off-by: Sasha Levin

    Jonathan Lemon
     
  • [ Upstream commit 91b2db27d3ff9ad29e8b3108dfbf1e2f49fe9bd3 ]

    Simplify task_file_seq_get_next() by removing two in/out arguments: task
    and fstruct. Use info->task and info->files instead.

    Signed-off-by: Song Liu
    Signed-off-by: Daniel Borkmann
    Acked-by: Yonghong Song
    Link: https://lore.kernel.org/bpf/20201120002833.2481110-1-songliubraving@fb.com
    Signed-off-by: Sasha Levin

    Song Liu
     
  • [ Upstream commit 1b04fa9900263b4e217ca2509fd778b32c2b4eb2 ]

    PowerPC testing encountered boot failures due to RCU Tasks not being
    fully initialized until core_initcall() time. This commit therefore
    initializes RCU Tasks (along with Rude RCU and RCU Tasks Trace) just
    before early_initcall() time, thus allowing waiting on RCU Tasks grace
    periods from early_initcall() handlers.

    Link: https://lore.kernel.org/rcu/87eekfh80a.fsf@dja-thinkpad.axtens.net/
    Fixes: 36dadef23fcc ("kprobes: Init kprobes in early_initcall")
    Tested-by: Daniel Axtens
    Signed-off-by: Uladzislau Rezki (Sony)
    Signed-off-by: Paul E. McKenney
    Signed-off-by: Sasha Levin

    Uladzislau Rezki (Sony)
     
  • [ Upstream commit ef0ba05538299f1391cbe097de36895bb36ecfe6 ]

    The kernel test robot reported a -5.8% performance regression on the
    "poll2" test of will-it-scale, and bisected it to commit d55564cfc222
    ("x86: Make __put_user() generate an out-of-line call").

    I didn't expect an out-of-line __put_user() to matter, because no normal
    core code should use that non-checking legacy version of user access any
    more. But I had overlooked the very odd poll() usage, which does a
    __put_user() to update the 'revents' values of the poll array.

    Now, Al Viro correctly points out that instead of updating just the
    'revents' field, it would be much simpler to just copy the _whole_
    pollfd entry, and then we could just use "copy_to_user()" on the whole
    array of entries, the same way we use "copy_from_user()" a few lines
    earlier to get the original values.

    But that is not what we've traditionally done, and I worry that threaded
    applications might be concurrently modifying the other fields of the
    pollfd array. So while Al's suggestion is simpler - and perhaps worth
    trying in the future - this instead keeps the "just update revents"
    model.

    To fix the performance regression, use the modern "unsafe_put_user()"
    instead of __put_user(), with the proper "user_write_access_begin()"
    guarding in place. This improves code generation enormously.

    Link: https://lore.kernel.org/lkml/20210107134723.GA28532@xsang-OptiPlex-9020/
    Reported-by: kernel test robot
    Tested-by: Oliver Sang
    Cc: Al Viro
    Cc: David Laight
    Cc: Peter Zijlstra
    Signed-off-by: Linus Torvalds
    Signed-off-by: Sasha Levin

    Linus Torvalds
     
  • [ Upstream commit bac717171971176b78c72d15a8b6961764ab197f ]

    dtc points out that the interrupts for some devices are not parsable:

    picoxcell-pc3x2.dtsi:45.19-49.5: Warning (interrupts_property): /paxi/gem@30000: Missing interrupt-parent
    picoxcell-pc3x2.dtsi:51.21-55.5: Warning (interrupts_property): /paxi/dmac@40000: Missing interrupt-parent
    picoxcell-pc3x2.dtsi:57.21-61.5: Warning (interrupts_property): /paxi/dmac@50000: Missing interrupt-parent
    picoxcell-pc3x2.dtsi:233.21-237.5: Warning (interrupts_property): /rwid-axi/axi2pico@c0000000: Missing interrupt-parent

    There are two VIC instances, so it's not clear which one needs to be
    used. I found the BSP sources that reference VIC0, so use that:

    https://github.com/r1mikey/meta-picoxcell/blob/master/recipes-kernel/linux/linux-picochip-3.0/0001-picoxcell-support-for-Picochip-picoXcell-SoC.patch

    Acked-by: Jamie Iles
    Link: https://lore.kernel.org/r/20201230152010.3914962-1-arnd@kernel.org'
    Signed-off-by: Arnd Bergmann
    Signed-off-by: Sasha Levin

    Arnd Bergmann
     
  • [ Upstream commit d863f0c7b536288e2bd40cbc01c10465dd226b11 ]

    vram.size is needed when binding a gpu without an iommu and is defined
    in msm_init_vram(), so run that before binding it.

    Signed-off-by: Craig Tatlor
    Reviewed-by: Brian Masney
    Tested-by: Alexey Minnekhanov
    Signed-off-by: Rob Clark
    Signed-off-by: Sasha Levin

    Craig Tatlor
     
  • [ Upstream commit ee61cfd955a64a58ed35cbcfc54068fcbd486945 ]

    It adds a stub acpi_create_platform_device() for !CONFIG_ACPI build, so
    that caller doesn't have to deal with !CONFIG_ACPI build issue.

    Reported-by: kernel test robot
    Signed-off-by: Shawn Guo
    Signed-off-by: Rafael J. Wysocki
    Signed-off-by: Sasha Levin

    Shawn Guo
     
  • [ Upstream commit 420d42f6f9db27d88bc4f83e3e668fcdacbf7e29 ]

    Lock(&iommu->lock) without disabling irq causes lockdep warnings.

    ========================================================
    WARNING: possible irq lock inversion dependency detected
    5.11.0-rc1+ #828 Not tainted
    --------------------------------------------------------
    kworker/0:1H/120 just changed the state of lock:
    ffffffffad9ea1b8 (device_domain_lock){..-.}-{2:2}, at:
    iommu_flush_dev_iotlb.part.0+0x32/0x120
    but this lock took another, SOFTIRQ-unsafe lock in the past:
    (&iommu->lock){+.+.}-{2:2}

    and interrupts could create inverse lock ordering between them.

    other info that might help us debug this:
    Possible interrupt unsafe locking scenario:

    CPU0 CPU1
    ---- ----
    lock(&iommu->lock);
    local_irq_disable();
    lock(device_domain_lock);
    lock(&iommu->lock);

    lock(device_domain_lock);

    *** DEADLOCK ***

    Signed-off-by: Lu Baolu
    Link: https://lore.kernel.org/r/20201231005323.2178523-5-baolu.lu@linux.intel.com
    Signed-off-by: Will Deacon
    Signed-off-by: Sasha Levin

    Lu Baolu
     
  • [ Upstream commit 41952a66015466c3208aac96b14ffd92e0943589 ]

    The name of the module for the NVIDIA alt-mode is incorrect as it
    looks to be a copy-paste error from the entry above, update it to
    the correct typec_nvidia module name.

    Cc: Ajay Gupta
    Cc: Heikki Krogerus
    Signed-off-by: Peter Robinson
    Link: https://lore.kernel.org/r/20210106001605.167917-1-pbrobinson@gmail.com
    Signed-off-by: Greg Kroah-Hartman
    Signed-off-by: Sasha Levin

    Peter Robinson
     
  • [ Upstream commit e6d5c64efaa34aae3815a9afeb1314a976142e83 ]

    Navi12 HDCP & DTM deinitialization needs continue to free bo if already
    created though initialized flag is not set.

    Reviewed-by: Alex Deucher
    Signed-off-by: Jiawei Gu
    Signed-off-by: Alex Deucher
    Signed-off-by: Sasha Levin

    Jiawei Gu
     
  • [ Upstream commit 44cb39e19a05ca711bcb6e776e0a4399223204a0 ]

    This patch is to fix the failure when change power profile to
    "profile_peak" for renoir.

    Signed-off-by: Xiaojian Du
    Reviewed-by: Huang Rui
    Signed-off-by: Alex Deucher
    Signed-off-by: Sasha Levin

    Xiaojian Du
     
  • [ Upstream commit 88e21af1b3f887d217f2fb14fc7e7d3cd87ebf57 ]

    When GFXOFF is enabled and GPU is idle, driver will fail to access some
    registers. Therefore change to disable power gating before all access
    registers with MMIO.

    Dmesg log is as following:
    amdgpu 0000:03:00.0: amdgpu: amdgpu: finishing device.
    amdgpu: cp queue pipe 4 queue 0 preemption failed
    amdgpu 0000:03:00.0: amdgpu: failed to write reg 2890 wait reg 28a2
    amdgpu 0000:03:00.0: amdgpu: failed to write reg 1a6f4 wait reg 1a706
    amdgpu 0000:03:00.0: amdgpu: failed to write reg 2890 wait reg 28a2
    amdgpu 0000:03:00.0: amdgpu: failed to write reg 1a6f4 wait reg 1a706

    Signed-off-by: Dennis Li
    Reviewed-by: Hawking Zhang
    Signed-off-by: Alex Deucher
    Signed-off-by: Sasha Levin

    Dennis Li
     
  • [ Upstream commit a7b5d9dd57298333e6e9f4c167f01385d922bbfb ]

    fix NULL pointer issue when read sysfs amdgpu_current_backlight_pwm sysfs node.

    Call Trace:
    [ 248.273833] BUG: kernel NULL pointer dereference, address: 0000000000000130
    [ 248.273930] #PF: supervisor read access in kernel mode
    [ 248.273993] #PF: error_code(0x0000) - not-present page
    [ 248.274054] PGD 0 P4D 0
    [ 248.274092] Oops: 0000 [#1] SMP PTI
    [ 248.274138] CPU: 2 PID: 1377 Comm: cat Tainted: G OE 5.9.0-rc5-drm-next-5.9+ #1
    [ 248.274233] Hardware name: System manufacturer System Product Name/Z170-A, BIOS 3802 03/15/2018
    [ 248.274641] RIP: 0010:dc_link_get_backlight_level+0x5/0x70 [amdgpu]
    [ 248.274718] Code: 67 ff ff ff 41 b9 03 00 00 00 e9 45 ff ff ff d1 ea e9 55 ff ff ff 0f 1f 44 00 00 66 2e
    0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 8b 87 30 01 00 00 48 8b 00 48 8b 88 88 03 00 00 48 8d 81 e8 01
    [ 248.274919] RSP: 0018:ffffb5ad809b3df0 EFLAGS: 00010203
    [ 248.274982] RAX: ffffa0f77d1c0010 RBX: ffffa0f793ae9168 RCX: 0000000000000001
    [ 248.275064] RDX: ffffa0f79753db00 RSI: 0000000000000001 RDI: 0000000000000000
    [ 248.275145] RBP: ffffb5ad809b3e00 R08: ffffb5ad809b3da0 R09: 0000000000000000
    [ 248.275225] R10: ffffb5ad809b3e68 R11: 0000000000000000 R12: ffffa0f793ae9190
    [ 248.275306] R13: ffffb5ad809b3ef0 R14: 0000000000000001 R15: ffffa0f793ae9168
    [ 248.275388] FS: 00007f5f1ec4d540(0000) GS:ffffa0f79ec80000(0000) knlGS:0000000000000000
    [ 248.275480] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [ 248.275547] CR2: 0000000000000130 CR3: 000000042a03c005 CR4: 00000000003706e0
    [ 248.275628] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [ 248.275708] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    [ 248.275789] Call Trace:
    [ 248.276124] ? current_backlight_read+0x24/0x40 [amdgpu]
    [ 248.276194] seq_read+0xc3/0x3f0
    [ 248.276240] full_proxy_read+0x5c/0x90
    [ 248.276290] vfs_read+0xa7/0x190
    [ 248.276334] ksys_read+0xa7/0xe0
    [ 248.276379] __x64_sys_read+0x1a/0x20
    [ 248.276429] do_syscall_64+0x37/0x80
    [ 248.276477] entry_SYSCALL_64_after_hwframe+0x44/0xa9
    [ 248.276538] RIP: 0033:0x7f5f1e75c191
    [ 248.276585] Code: fe ff ff 48 8d 3d b7 9d 0a 00 48 83 ec 08 e8 46 4d 02 00 66 0f 1f 44 00 00 48 8d 05 71 07
    2e 00 8b 00 85 c0 75 13 31 c0 0f 05 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 41 54 55 49 89 d4 53Hw
    [ 248.276784] RSP: 002b:00007ffcb1fc3f38 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
    [ 248.276872] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5f1e75c191
    [ 248.276953] RDX: 0000000000020000 RSI: 00007f5f1ec2b000 RDI: 0000000000000003
    [ 248.277034] RBP: 0000000000020000 R08: 00000000ffffffff R09: 0000000000000000
    [ 248.277115] R10: 0000000000000022 R11: 0000000000000246 R12: 00007f5f1ec2b000
    [ 248.277195] R13: 0000000000000003 R14: 00007f5f1ec2b00f R15: 0000000000020000
    [ 248.277279] Modules linked in: amdgpu(OE) iommu_v2 gpu_sched ttm(OE) drm_kms_helper cec drm
    i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs
    lockd grace fscache nls_iso8859_1 snd_hda_codec_realtek snd_hda_codec_hdmi snd_hda_codec_generic
    ledtrig_audio intel_rapl_msr intel_rapl_common snd_hda_intel snd_intel_dspcfg x86_pkg_temp_thermal
    intel_powerclamp snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_seq_midi snd_seq_midi_event mei_hdcp
    coretemp snd_rawmidi snd_seq kvm_intel kvm snd_seq_device snd_timer irqbypass joydev snd input_leds soundcore
    crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper rapl intel_cstate
    mac_hid mei_me serio_raw mei eeepc_wmi wmi_bmof asus_wmi mxm_wmi intel_wmi_thunderbolt acpi_pad sparse_keymap
    efi_pstore sch_fq_codel parport_pc ppdev lp parport sunrpc ip_tables x_tables autofs4 hid_logitech_hidpp
    hid_logitech_dj hid_generic usbhid hid e1000e psmouse ahci libahci wmi video
    [ 248.278211] CR2: 0000000000000130
    [ 248.278221] ---[ end trace 1fbe72fe6f91091d ]---
    [ 248.357226] RIP: 0010:dc_link_get_backlight_level+0x5/0x70 [amdgpu]
    [ 248.357272] Code: 67 ff ff ff 41 b9 03 00 00 00 e9 45 ff ff ff d1 ea e9 55 ff ff ff 0f 1f 44 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 8b 87 30 01 00 00 48 8b 00 48 8b 88 88 03 00 00 48 8d 81 e8 01

    Signed-off-by: Kevin Wang
    Acked-by: Alex Deucher
    Signed-off-by: Alex Deucher
    Signed-off-by: Sasha Levin

    Kevin Wang
     
  • [ Upstream commit 9ceb7863537748c67fa43ac4f2f565819bbd36e4 ]

    When a queue is in NVMET_RDMA_Q_CONNECTING state, it may has some
    requests at rsp_wait_list. In case a disconnect occurs at this
    state, no one will empty this list and will return the requests to
    free_rsps list. Normally nvmet_rdma_queue_established() free those
    requests after moving the queue to NVMET_RDMA_Q_LIVE state, but in
    this case __nvmet_rdma_queue_disconnect() is called before. The
    crash happens at nvmet_rdma_free_rsps() when calling
    list_del(&rsp->free_list), because the request exists only at
    the wait list. To fix the issue, simply clear rsp_wait_list when
    destroying the queue.

    Signed-off-by: Israel Rukshin
    Reviewed-by: Max Gurtovoy
    Signed-off-by: Christoph Hellwig
    Signed-off-by: Sasha Levin

    Israel Rukshin
     
  • [ Upstream commit 62df80165d7f197c9c0652e7416164f294a96661 ]

    While handling the completion queue, keep a local copy of the command id
    from the DMA-accessible completion entry. This silences a time-of-check
    to time-of-use (TOCTOU) warning from KF/x[1], with respect to a
    Thunderclap[2] vulnerability analysis. The double-read impact appears
    benign.

    There may be a theoretical window for @command_id to be used as an
    adversary-controlled array-index-value for mounting a speculative
    execution attack, but that mitigation is saved for a potential follow-on.
    A man-in-the-middle attack on the data payload is out of scope for this
    analysis and is hopefully mitigated by filesystem integrity mechanisms.

    [1] https://github.com/intel/kernel-fuzzer-for-xen-project
    [2] http://thunderclap.io/thunderclap-paper-ndss2019.pdf
    Signed-off-by: Lalithambika Krishna Kumar
    Signed-off-by: Christoph Hellwig
    Signed-off-by: Sasha Levin

    Lalithambika Krishnakumar
     
  • [ Upstream commit 7ee5c78ca3895d44e918c38332921983ed678be0 ]

    A system with more than one of these SSDs will only have one usable.
    Hence the kernel fails to detect nvme devices due to duplicate cntlids.

    [ 6.274554] nvme nvme1: Duplicate cntlid 33 with nvme0, rejecting
    [ 6.274566] nvme nvme1: Removing after probe failure status: -22

    Adding the NVME_QUIRK_IGNORE_DEV_SUBNQN quirk to resolves the issue.

    Signed-off-by: Gopal Tiwari
    Signed-off-by: Christoph Hellwig
    Signed-off-by: Sasha Levin

    Gopal Tiwari
     
  • [ Upstream commit 3503ee6c0bec5f173d606359e6384a5ef85492fb ]

    The udpgro.sh will always return 0 (unless the bpf selftest was not
    build first) even if there are some failed sub test-cases.

    Therefore the kselftest framework will report this case is OK.

    Check and return the exit status of each test to make it easier to
    spot real failures.

    Signed-off-by: Po-Hsu Lin
    Signed-off-by: David S. Miller
    Signed-off-by: Sasha Levin

    Po-Hsu Lin
     
  • [ Upstream commit 445c6198fe7be03b7d38e66fe8d4b3187bc251d4 ]

    Since commit 1d6cd3929360 ("modpost: turn missing MODULE_LICENSE()
    into error") the ppc32_allmodconfig build fails with:

    ERROR: modpost: missing MODULE_LICENSE() in drivers/net/ethernet/freescale/fs_enet/mii-fec.o
    ERROR: modpost: missing MODULE_LICENSE() in drivers/net/ethernet/freescale/fs_enet/mii-bitbang.o

    Add the missing MODULE_LICENSEs to fix the build. Both files include a
    copyright header indicating they are GPL v2.

    Signed-off-by: Michael Ellerman
    Reviewed-by: Andrew Lunn
    Signed-off-by: David S. Miller
    Signed-off-by: Sasha Levin

    Michael Ellerman
     
  • [ Upstream commit 51049bd903a81307f751babe15a1df8d197884e8 ]

    Without this, we run into a link error

    arm-linux-gnueabi-ld: drivers/isdn/mISDN/dsp_audio.o: in function `dsp_audio_generate_law_tables':
    (.text+0x30c): undefined reference to `byte_rev_table'
    arm-linux-gnueabi-ld: drivers/isdn/mISDN/dsp_audio.o:(.text+0x5e4): more undefined references to `byte_rev_table' follow

    Signed-off-by: Arnd Bergmann
    Signed-off-by: David S. Miller
    Signed-off-by: Sasha Levin

    Arnd Bergmann
     
  • [ Upstream commit 8a48c0a3360bf2bf4f40c980d0ec216e770e58ee ]

    fs/dax.c uses copy_user_page() but ARC does not provide that interface,
    resulting in a build error.

    Provide copy_user_page() in .

    ../fs/dax.c: In function 'copy_cow_page_dax':
    ../fs/dax.c:702:2: error: implicit declaration of function 'copy_user_page'; did you mean 'copy_to_user_page'? [-Werror=implicit-function-declaration]

    Reported-by: kernel test robot
    Signed-off-by: Randy Dunlap
    Cc: Vineet Gupta
    Cc: linux-snps-arc@lists.infradead.org
    Cc: Dan Williams
    #Acked-by: Vineet Gupta # v1
    Cc: Andrew Morton
    Cc: Matthew Wilcox
    Cc: Jan Kara
    Cc: linux-fsdevel@vger.kernel.org
    Cc: linux-nvdimm@lists.01.org
    #Reviewed-by: Ira Weiny # v2
    Signed-off-by: Vineet Gupta
    Signed-off-by: Sasha Levin

    Randy Dunlap
     
  • [ Upstream commit 6d4d273588378c65915acaf7b2ee74e9dd9c130a ]

    BFQ computes number of tags it allows to be allocated for each request type
    based on tag bitmap. However it uses 1 << bitmap.shift as number of
    available tags which is wrong. 'shift' is just an internal bitmap value
    containing logarithm of how many bits bitmap uses in each bitmap word.
    Thus number of tags allowed for some request types can be far to low.
    Use proper bitmap.depth which has the number of tags instead.

    Signed-off-by: Jan Kara
    Signed-off-by: Jens Axboe
    Signed-off-by: Sasha Levin

    Jan Kara
     
  • [ Upstream commit de7f1d9e99d8b99e4e494ad8fcd91f0c4c5c9357 ]

    io_uring fds marked O_CLOEXEC and we explicitly cancel all requests
    before going through exec, so we don't want to leave task's file
    references to not our anymore io_uring instances.

    Signed-off-by: Pavel Begunkov
    Signed-off-by: Jens Axboe
    Signed-off-by: Sasha Levin

    Pavel Begunkov
     
  • [ Upstream commit 6170d077bf92c5b3dfbe1021688d3c0404f7c9e9 ]

    The xfer waiting time is the result of xfer->len / xfer->speed_hz. This
    patch makes the assumption of 100khz xfer speed if the xfer->speed_hz is
    not assigned and stays 0. This avoids the divide by 0 issue and ensures
    a reasonable tolerant waiting time.

    Signed-off-by: Xu Yilun
    Link: https://lore.kernel.org/r/1609723749-3557-1-git-send-email-yilun.xu@intel.com
    Signed-off-by: Mark Brown
    Signed-off-by: Sasha Levin

    Xu Yilun
     
  • [ Upstream commit 9bba03d4473df0b707224d4d2067b62d1e1e2a77 ]

    Linux 5.10 is out. Remove the 'kvmconfig' and 'xenconfig' shorthands
    as previously announced.

    Signed-off-by: Masahiro Yamada
    Signed-off-by: Sasha Levin

    Masahiro Yamada
     
  • [ Upstream commit 0c36d88cff4d72149f94809303c5180b6f716d39 ]

    Older versions of BSD awk are fussy about the order of '-v' and '-f'
    flags, and require a space after the flag name. This causes build
    failures on platforms with an old awk, such as macOS and NetBSD.

    Since GNU awk and modern versions of BSD awk (distributed with
    FreeBSD/OpenBSD) are fine with either form, the definition of
    'cmd_unroll' can be trivially tweaked to let the lib/raid6 Makefile
    work with both old and new awk flag dialects.

    Signed-off-by: John Millikin
    Signed-off-by: Masahiro Yamada
    Signed-off-by: Sasha Levin

    John Millikin
     
  • [ Upstream commit 1eda52334e6d13eb1a85f713ce06dd39342b5020 ]

    With MAX_PWM being defined to 255 the code

    unsigned long period;
    ...
    period = ctx->pwm->args.period;
    state.duty_cycle = DIV_ROUND_UP(pwm * (period - 1), MAX_PWM);

    calculates a too small value for duty_cycle if the configured period is
    big (either by discarding the 64 bit value ctx->pwm->args.period or by
    overflowing the multiplication). As this results in a too slow fan and
    so maybe an overheating machine better be safe than sorry and error out
    in .probe.

    Signed-off-by: Uwe Kleine-König
    Link: https://lore.kernel.org/r/20201215092031.152243-1-u.kleine-koenig@pengutronix.de
    Signed-off-by: Guenter Roeck
    Signed-off-by: Sasha Levin

    Uwe Kleine-König
     
  • [ Upstream commit b000700d6db50c933ce8b661154e26cf4ad06dba ]

    When kzalloc() fails, we should execute hl_mmu_fini()
    to release the MMU module. It's the same when
    hl_ctx_init() fails.

    Signed-off-by: Dinghao Liu
    Reviewed-by: Oded Gabbay
    Signed-off-by: Oded Gabbay
    Signed-off-by: Sasha Levin

    Dinghao Liu
     
  • [ Upstream commit ede090f5a438e97d0586f64067bbb956e30a2a31 ]

    This patch fixes the return value for altera_spi_txrx. It should return
    1 for interrupt transfer mode, and return 0 for polling transfer mode.

    The altera_spi_txrx() implements the spi_controller.transfer_one
    callback. According to the spi-summary.rst, the transfer_one should
    return 0 when transfer is finished, return 1 when transfer is still in
    progress.

    Signed-off-by: Xu Yilun
    Link: https://lore.kernel.org/r/1609219662-27057-2-git-send-email-yilun.xu@intel.com
    Signed-off-by: Mark Brown
    Signed-off-by: Sasha Levin

    Xu Yilun
     
  • [ Upstream commit 12b38ea040b3bb2a30eb9cd488376df5be7ea81f ]

    IN the probe function, if an error occurs after calling
    'spmi_controller_alloc()', it must be undone by a corresponding
    'spmi_controller_put() call.

    In the remove function, use 'spmi_controller_put(ctrl)' instead of
    'kfree(ctrl)'.

    While a it fix an error message
    (s/spmi_add_controller/spmi_controller_add/)

    Signed-off-by: Christophe JAILLET
    Link: https://lore.kernel.org/r/20201213151105.137731-1-christophe.jaillet@wanadoo.fr
    Signed-off-by: Greg Kroah-Hartman
    Signed-off-by: Sasha Levin

    Christophe JAILLET