Commit Graph

1059871 Commits

Author SHA1 Message Date
Jakub Kicinski
f884a34262 selftests: tls: test for correct proto_ops
Previous patch fixes overriding callbacks incorrectly. Triggering
the crash in sendpage_locked would be more spectacular but it's
hard to get to, so take the easier path of proving this is broken
and call getname. We're currently getting IPv4 socket info on an
IPv6 socket.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-25 19:28:17 -08:00
Jakub Kicinski
f3911f73f5 tls: fix replacing proto_ops
We replace proto_ops whenever TLS is configured for RX. But our
replacement also overrides sendpage_locked, which will crash
unless TX is also configured. Similarly we plug both of those
in for TLS_HW (NIC crypto offload) even tho TLS_HW has a completely
different implementation for TX.

Last but not least we always plug in something based on inet_stream_ops
even though a few of the callbacks differ for IPv6 (getname, release,
bind).

Use a callback building method similar to what we do for struct proto.

Fixes: c46234ebb4 ("tls: RX path for ktls")
Fixes: d4ffb02dee ("net/tls: enable sk_msg redirect to tls socket egress")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-25 19:28:16 -08:00
Jakub Kicinski
274af0f9e2 selftests: tls: test splicing decrypted records
Add tests for half-received and peeked records.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-25 19:28:16 -08:00
Jakub Kicinski
e062fe99cc tls: splice_read: fix accessing pre-processed records
recvmsg() will put peek()ed and partially read records onto the rx_list.
splice_read() needs to consult that list otherwise it may miss data.
Align with recvmsg() and also put partially-read records onto rx_list.
tls_sw_advance_skb() is pretty pointless now and will be removed in
net-next.

Fixes: 692d7b5d1f ("tls: Fix recvmsg() to be able to peek across multiple records")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-25 19:28:16 -08:00
Jakub Kicinski
d87d67fd61 selftests: tls: test splicing cmsgs
Make sure we correctly reject splicing non-data records.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-25 19:28:16 -08:00
Jakub Kicinski
520493f66f tls: splice_read: fix record type check
We don't support splicing control records. TLS 1.3 changes moved
the record type check into the decrypt if(). The skb may already
be decrypted and still be an alert.

Note that decrypt_skb_update() is idempotent and updates ctx->decrypted
so the if() is pointless.

Reorder the check for decryption errors with the content type check
while touching them. This part is not really a bug, because if
decryption failed in TLS 1.3 content type will be DATA, and for
TLS 1.2 it will be correct. Nevertheless its strange to touch output
before checking if the function has failed.

Fixes: fedf201e12 ("net: tls: Refactor control message handling on recv")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-25 19:28:16 -08:00
Jakub Kicinski
ef0fc0b3cc selftests: tls: add tests for handling of bad records
Test broken records.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-25 19:28:15 -08:00
Jakub Kicinski
31180adb0b selftests: tls: factor out cmsg send/receive
Add helpers for sending and receiving special record types.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-25 19:28:15 -08:00
Jakub Kicinski
a125f91fe7 selftests: tls: add helper for creating sock pairs
We have the same code 3 times, about to add a fourth copy.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-25 19:28:15 -08:00
Corey Minyard
c03a487a83 ipmi:ipmb: Fix unknown command response
More missed changes, the response back to another system sending a
command that had no user to handle it wasn't formatted properly.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-11-25 21:17:55 -06:00
Corey Minyard
d2c12f56fa ipmi: fix IPMI_SMI_MSG_TYPE_IPMB_DIRECT response length checking
A couple of issues:

The tested data sizes are wrong; during the design that changed and this
got missed.

The formatting of the reponse couldn't use the normal one, it has to be
an IPMB formatted response.

Reported-by: Jakub Kicinski <kuba@kernel.org>
Fixes: 059747c245 ("ipmi: Add support for IPMB direct messages")
Signed-off-by: Corey Minyard <cminyard@mvista.com>
2021-11-25 21:17:55 -06:00
Linus Torvalds
a4849f6000 drm fixes for 5.16-rc3
amdgpu:
 - SRIOV fixes
 - dma-buf double free fix
 - Display fixes for GPU resets
 - Fix DSC powergating regression
 - GPU TSC fixes
 - Interrupt handler overflow fixes
 - Endian fix in IP discovery table handling
 - Aldebaran ASPM fix
 - Fix overclocking regression on older asics
 - Backlight/ACPI fix
 
 amdkfd:
 - SVM fixes
 - VMA removal race fix
 
 hyperv:
 - removal fix
 
 aspeed:
 - vga_pw sysfs file fix
 
 vc4:
 - error checking fix
 
 nouveau:
 - support GA106
 - fix a few error checks
 
 i915:
 - fix wakeref handling around PXP suspend
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmGgLvEACgkQDHTzWXnE
 hr7uYQ//WaR0AyCTMUnvUJ1/QhMw3BH3F2EJEWLuw+NEugYgE41SvXaF9dtJD2ex
 xokyFENHP2QhrUdMiUL9E7oto2jfDf5R2SZTp7oyR60P/cVXlVpOFRxr904hp7pS
 pTV4jMX029ajlvzGriRSykq5ceEXfTj0garTdNZUw4EzarhDEC+dBkmA+7TuI3Mz
 uT/CgU4QU7f0tDZ4SiMv5I342wU24rKjT04I3Uhg9uW9Ce7CvGIhiQrYA6v6VVL9
 Q26EkLDi88u9kPlsBug/tSVu71NN+c2sM/aOfnIrGGa4cY2H9acgjW/qZ9/9NNbS
 RevHy7K905Z8i4op8XNtrBzpTGTu2TXbE6XvnynyC5AeCTcf0Gou/7JWraCaHyYV
 6T+U35dbkEJ0lCKphB1azZPLaKihliZZDPZJ2rUsO0ED3fBzEwUl6gisFk41eXCr
 5W45q5eXOuZBrBEwyuxSbihXlseVOepgG7NqVucxVqEUKh8BvwHeeg4OFz1WtkTK
 NICNXnF4dLhpLLSCgIfvshWAavq+Nr6uqP/krGKs6Gb8FvF+gjDxBvXfNZCC12Ms
 8bAfda6Jau9k1J2/DdAJYMB5pmwmuioz8/n60Eq7/FyEs4e3VrahSZHuDRxRqKeN
 h9wiIdRBJ3O/DwA4impiPyk5yOBP3TVdh4xbf502vdDW9U5uCEY=
 =twr7
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2021-11-26' of git://anongit.freedesktop.org/drm/drm

Pull drm fixes from Dave Airlie:
 "No idea if turkey comes before pull request processing, but here's the
  regular week's fixes. A bunch for amdgpu, nouveau adds support for a
  new GPU (like a PCI ID addition), and a scattering of fixes across
  i915/hyperv/aspeed/vc4.

  Specifics:

  amdgpu:
   - SRIOV fixes
   - dma-buf double free fix
   - Display fixes for GPU resets
   - Fix DSC powergating regression
   - GPU TSC fixes
   - Interrupt handler overflow fixes
   - Endian fix in IP discovery table handling
   - Aldebaran ASPM fix
   - Fix overclocking regression on older asics
   - Backlight/ACPI fix

  amdkfd:
   - SVM fixes
   - VMA removal race fix

  hyperv:
   - removal fix

  aspeed:
   - vga_pw sysfs file fix

  vc4:
   - error checking fix

  nouveau:
   - support GA106
   - fix a few error checks

  i915:
   - fix wakeref handling around PXP suspend"

* tag 'drm-fixes-2021-11-26' of git://anongit.freedesktop.org/drm/drm: (25 commits)
  drm/amd/display: update bios scratch when setting backlight
  drm/amdgpu/pm: fix powerplay OD interface
  drm/amdgpu: Skip ASPM programming on aldebaran
  drm/amdgpu: fix byteorder error in amdgpu discovery
  drm/amdgpu: enable Navi retry fault wptr overflow
  drm/amdgpu: enable Navi 48-bit IH timestamp counter
  drm/amdkfd: simplify drain retry fault
  drm/amdkfd: handle VMA remove race
  drm/amdkfd: process exit and retry fault race
  drm/amdgpu: IH process reset count when restart
  drm/amdgpu/gfx9: switch to golden tsc registers for renoir+
  drm/amdgpu/gfx10: add wraparound gpu counter check for APUs as well
  drm/amdgpu: move kfd post_reset out of reset_sriov function
  drm/amd/display: Fixed DSC would not PG after removing DSC stream
  drm/amd/display: Reset link encoder assignments for GPU reset
  drm/amd/display: Set plane update flags for all planes in reset
  drm/amd/display: Fix DPIA outbox timeout after GPU reset
  drm/amdgpu: Fix double free of dmabuf
  drm/amdgpu: Fix MMIO HDP flush on SRIOV
  drm/i915/gt: Hold RPM wakelock during PXP suspend
  ...
2021-11-25 18:21:20 -08:00
Dave Airlie
fc026c8b92 Fix wakeref handling of PXP suspend.
-----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmGeuT8ACgkQ+mJfZA7r
 E8ogZAgAizhmm8eFCRDMA2f+8CCLC6OTVsg5UFyWsLgrN/R8+Mx7xsvwMOsLp01+
 0afbQixuTDP0zlQ1EqNTBlgVw58PBaZ5ts+ns8k3ZDDvJh6/zknrWafPEvMHrVHK
 0dTrJcGU6k021n/UFnCfHdXKg+Kt8w0O1XC8NacCrGrZNG1WxTlgU1wdJLgVh0PF
 T38QNPdrqq8zNwzW36ZVTToRCeaGzbiiGxRxWxO34S2YhlPbKsE/ZMj/jYri0afP
 W82U1yep/Qo0zWUwyWDlEQqixinaqMwblNGjlTztiNo95DweeJx0Zc2j2jstLYnZ
 XAq4YaEM9ngRbywMrlL9M7bnwJe6Sg==
 =IeEU
 -----END PGP SIGNATURE-----

Merge tag 'drm-intel-fixes-2021-11-24' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes

Fix wakeref handling of PXP suspend.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/YZ65bsPOK+6JLv0d@intel.com
2021-11-26 10:36:33 +10:00
Dave Airlie
7798a73692 One removal fix for hyperv, one fix in aspeed for the vga_pw sysfs file
content, one error-checking fix for vc4 and two fixes for nouveau, one
 to support a new device and another one to properly check for errors.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRcEzekXsqa64kGDp7j7w1vZxhRxQUCYZ9i1AAKCRDj7w1vZxhR
 xXHHAQDvEFEECNh1xBH7/b2VFrWnJjN+b+WF2Kxu8GGs3xhtlwEAv/mx8IrXZe9y
 8W5v3QzIBveZjkp0rORkbe8rpPNGGwE=
 =daCZ
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2021-11-25' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes

One removal fix for hyperv, one fix in aspeed for the vga_pw sysfs file
content, one error-checking fix for vc4 and two fixes for nouveau, one
to support a new device and another one to properly check for errors.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/20211125101819.ynu7zgbs7yfwedri@houat
2021-11-26 10:11:36 +10:00
Dave Airlie
f3caa22643 Merge tag 'amd-drm-fixes-5.16-2021-11-24' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes
amd-drm-fixes-5.16-2021-11-24:

amdgpu:
- SRIOV fixes
- dma-buf double free fix
- Display fixes for GPU resets
- Fix DSC powergating regression
- GPU TSC fixes
- Interrupt handler overflow fixes
- Endian fix in IP discovery table handling
- Aldebaran ASPM fix
- Fix overclocking regression on older asics
- Backlight/ACPI fix

amdkfd:
- SVM fixes
- VMA removal race fix

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20211124212056.6327-1-alexander.deucher@amd.com
2021-11-26 09:24:15 +10:00
Linus Torvalds
8ced7ca357 block-5.16-2021-11-25
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmGfuqoQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpgYlD/wPqQJ+DuJc6jgK/F0gVIwcxjAemIilItqD
 LMyUfOeYWSINAL7iCPc8J2lLYt/JjlCZ/AcHpnaaqtLBC7YDf8GQxX6ocMSFRJxg
 aEwaNO63ngauW/aMuTmWBQ1i1Vzt57EgH/TGp8XX7Yee1h7O9rPrSWFpEdV/cbk3
 R7mQAzpGgDIDYhMU/odaGitLDVLKoiNmsIoP4QuUXharLChJ6oApJNcFFeTiX6Wz
 5ttwvJmNlZ2ZQMchz2upxM1k2ftGhh7PNi47GEeMuxJBBkOLxkjx8lxtFFQwjgcz
 7fL0ctQWzwA60JD9hifMacOpcVVcx7Nqk6NxFnPybxXPd2VRtuPS8G3OEN6AIM7N
 Vgbd0q0auS8DTBHkCWg+zXJ55uGBM7kZW/H8Urk/prO3qhYRf8cDaP6tBVBRkAPM
 WmrrhgohUpjo0FxCByfyHSFoUdRwM4znyMkF2DhKHoCO44qrAW2b4ucJx/pJG9mU
 mZoGVETtM9dabiQwoTfArBqcWppE8KAFMc+a3We8NHEZO4xBaJz6+1tuh+hSriAm
 rsR1zm/SuJS+66mgCjp4ECzpo8NDx7u328kSddM3dWnT/Fywrz9AZg4PJoC1V9lD
 tz2DF8dSRZFLce5NQroow8BPWpdHTDKJqqi0WY51i8eODWm6pOjGS9XDmqUN/fjH
 mZo7WlJiZA==
 =76bB
 -----END PGP SIGNATURE-----

Merge tag 'block-5.16-2021-11-25' of git://git.kernel.dk/linux-block

Pull block fixes from Jens Axboe:

 - NVMe pull request via Christoph:
      - Add a NO APST quirk for a Kioxia device (Enzo Matsumiya)
      - Fix write zeroes pi (Klaus Jensen)
      - Various TCP transport fixes (Maurizio Lombardi and Varun
        Prakash)
      - Ignore invalid fast_io_fail_tmo values (Maurizio Lombardi)
      - Use IOCB_NOWAIT only if the filesystem supports it (Maurizio
        Lombardi)

 - Module loading fix (Ming)

 - Kerneldoc warning fix (Yang)

* tag 'block-5.16-2021-11-25' of git://git.kernel.dk/linux-block:
  block: fix parameter not described warning
  nvmet: use IOCB_NOWAIT only if the filesystem supports it
  nvme: fix write zeroes pi
  nvme-fabrics: ignore invalid fast_io_fail_tmo values
  nvme-pci: add NO APST quirk for Kioxia device
  nvme-tcp: fix memory leak when freeing a queue
  nvme-tcp: validate R2T PDU in nvme_tcp_handle_r2t()
  nvmet-tcp: fix incomplete data digest send
  nvmet-tcp: fix memory leak when performing a controller reset
  nvmet-tcp: add an helper to free the cmd buffers
  nvmet-tcp: fix a race condition between release_queue and io_work
  block: avoid to touch unloaded module instance when opening bdev
2021-11-25 11:06:05 -08:00
Linus Torvalds
de4444f596 io_uring-5.16-2021-11-25
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmGfuAQQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpmBbD/9yy8RHZAFfPLhjuyVaUak6/KlLe39UEhqu
 75tqBNyWkN/mBon34tIxoUJdDCw15GZXW3G+xDgHOP2+RgpsqZX97Oj7f1m/0L+Z
 XpYHKc8j1GmNiXU22nWt7GGSAKFiGZtlW0ppe2BX75xVcqPCiPxge20Ev0wTZAcr
 Vrm0r2XKZQ+WI1qLXoKIOxO+bNBzlzhZ/sV2W/6akz6lQIeztFqk6PhovERbBBwi
 /UlyWJ4z+ZKQYjpomKA8f41IvVrh3MrQlILYFOHQFj83Wa1OrBM4mD8i1ZAJf907
 wWEBgh0Em5GRLzQijXQo/vz3RNgklzX1sP4C5j6njlukgCklEOLhhunEFkk+qtps
 Vbc+Hm+jAP2VJjHfMmsttMKCqlJYtR85j71dip+j3JXheaGirUxf97RDHWOFtCFO
 +AFbVu7S7H2GI9LJb/WEr66EmbE5RlzCKSeyrBZb96Y7PYdfTwq8TgjzDPSZEm3B
 tPvYQgXPXoiFjzlaCgN372YJJIfJhpVOhBTu0hJ5oyPW/Rsy/vGyrhOWEfoc+nGh
 RY8ou7qOnnspVwa8PVknjk01BWTvSNgvqVp82WywqZHqQFxEj5YCeEwg2EVuHQt7
 owXNO7dtJ+W1SNJDD3KfQx+cwNv8Alf1G02A4dl8xzTgETiHsng+R/t0IQGb7mrf
 68hXzT+qSQ==
 =y8h2
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-5.16-2021-11-25' of git://git.kernel.dk/linux-block

Pull io_uring fixes from Jens Axboe:
 "A locking fix for link traversal, and fixing up an outdated function
  name in a comment"

* tag 'io_uring-5.16-2021-11-25' of git://git.kernel.dk/linux-block:
  io_uring: correct link-list traversal locking
  io_uring: fix missed comment from *task_file rename
2021-11-25 10:57:45 -08:00
Linus Torvalds
8ef4678f2f 4 small cifs/smb3 fixes, 2 related to multichannel
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmGfEPEACgkQiiy9cAdy
 T1F7Ogv+J9/ODordrHKl5AQWwtFfcWAVCv2K9hJHoaYbj4fpQVzreyBwuSFqryxe
 udO8msORq/KySIOMATvPkse8+ZZ+0ZMFF+n4I5kKMaoJL3UZHqjJopUL+zv61817
 Qwyd8KCwnrskpZ+q8OfbHDOvKxHpBt/YVP6RdE6R9DBtBIY0zJB8dcD3srYkfDi+
 yWjab3cCFoe2p9dzs9PG6eWmmDMM/AcO3m5WEI12hBE30NS+n8CACVFbjImC/ZVV
 8SokX33X4CvCZWn2BGdJBE1OFb4Nviz6QChbRd18Z0JOGiWAtlBWclxykedvMGcn
 FR/pUFF+7RhXFFK4lTkzJwqj34FoovTiS9X81fLo7lCCXTT0Ki0yp+mKtoNQAaBj
 YTDoISjG5+ZQfes12zy1NwARzpKWEwFAR6A8mHlj3QUVP7wkClNlKqZSw9bzRDE7
 yOd+4PoH8Hy0ZiprmgTnV92s7+HiD5vucFkzurvBM7hqQAC9LcW1CEix925jMOw0
 71Oow+aE
 =sMmj
 -----END PGP SIGNATURE-----

Merge tag '5.16-rc2-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull cifs fixes from Steve French:
 "Four small cifs/smb3 fixes:

   - two multichannel fixes

   - fix problem noted by kernel test robot

   - update internal version number"

* tag '5.16-rc2-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: update internal version number
  smb2: clarify rc initialization in smb2_reconnect
  cifs: populate server_hostname for extra channels
  cifs: nosharesock should be set on new server
2021-11-25 10:48:14 -08:00
Linus Torvalds
b501b85957 asm-generic: syscall table updates
André Almeida sends an update for the newly added futex_waitv
 syscall that was initially only added to a few architectures.
 
 Some additional ones have since made it through architecture
 maintainer trees, this finishes the remaining ones.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmGfrmIACgkQmmx57+YA
 GNl0eg/9Eu2iliGxiQPzPw93a3DCYr7eiylbhHbgzvCbUtDL4cTE/0fcFGCYUoVu
 k5UT/5ja3Q4z8wE+MUbxXf6igr+ANKJNwomKksTJV1Q6wKF23k5vUEd2ZXGyvrSk
 F+2X0bpB0wZzmMBh98L6dWsEaDJ//8iRZNW4ErmPR4mp25iDqhzZ1k2RoRg9mYoM
 /Lw6u5zlBiqAw5nnMc6BxPo8gJGwgcKDu4VDngpGDVGlvBHgd7Kf1AKi1+aBumml
 WzVXEEdUp3LTj7O/8oU3dKPuZMhl+k/mKUvHn/cieG00FxfMpOnxj0gdaUGgG0O4
 imhQquXtPueq/W3Uod+MhVulKR6AziEOsPhJayMGopLReE0spKDxcplC/OSbMhGj
 0iA6auLdHpHBCg3KWZDj0Sjf2NwL9UCFVDrk8XAQQo7bY2U5LQbcbr0PS7iLlpzN
 gIb+r2k3Azwk/Iqnvl2/SR1cZTx5KxfxCydT03vXaYQXhc5l+u4RvjOZcSGgZXqd
 gzC78vd6fJGKyVeaL2xb6/w7qmA4DFd6sQAbgMlVFRRS6AIJrIdDEZAQztSJ+uYK
 p9A2qzeXz+ftzonySbPHmV4RBGjSVVecUBjRmmDfKNbqmFUjjnCwCv+LeDXh4IS6
 mjmSA/9liYdkHUaujwCLhOEskuCx9ZPeAsqmzXMER0BDzReVlH4=
 =Vy2A
 -----END PGP SIGNATURE-----

Merge tag 'asm-generic-5.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic

Pull asm-generic syscall table update from Arnd Bergmann:
 "André Almeida sends an update for the newly added futex_waitv syscall
  that was initially only added to a few architectures.

  Some additional ones have since made it through architecture
  maintainer trees, this finishes the remaining ones"

* tag 'asm-generic-5.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic:
  futex: Wireup futex_waitv syscall
2021-11-25 10:41:28 -08:00
Linus Torvalds
6ef9d23121 ARM: SoC fixes for v5.16, part 2
There are only a few devicetree fixes this time:
 
  - one outdated devicetree property that slipped into the
    newly added ExynosAutov9 support
 
  - three changes to Broadcom SoCs that had incorrect
    number values for interrupts or irqchips.
 
 In the MAINTAINERS file, Nishanth Menon gets listed for TI K3 SoCs,
 while Taichi Sugaya and Takao Orito take ownership of the Socionext
 Milbeaut platform.
 
 All other changes are for SoC specific drivers, fixing:
 
  - A missing NULL pointer check in the mediatek memory driver
 
  - An integer overflow issue in the Arm smccc firwmare interface
 
  - A false-positive fortify-source check
 
  - Error handling fixes for optee and smci
 
  - Incorrect message format in one SCMI call
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmGfraEACgkQmmx57+YA
 GNkj/g//QjXBksfNpCxGlghRga3pUPEVowij08spYeEIKYpkCnzyns4pLJUYFafX
 PlMB32NnObhJ7QO8/V1sUgdlm/1rhDw99AEcdj4l4o3OCcczc8Mnf3mVIJmPhJUX
 Rdu/Rwk8ajTt3msHud2PPZtHVYGQTCDQQOgAWjA3ZjlKad69H0s6jYeBdTvcBcge
 GmdUIxsHcw/aCcNQZ5LB4RdcGrh+9IwhqXVaDQvMUNC+BVeSKz49/EUPfOTsNH4b
 zVDiGo8DmG0Y4eZww/KB2g4qxc3fewF+IacnrPFyjb0ft9Szk8r/0HSFVpz2N8TM
 tWpo5hEKh/V9cgQn+vxDjujEbghyRm06mAPgxiiKtSLBp2ASG2io0o6LcQnToK7Q
 t27nGembpSRKi/I743Xpt3AjM47LBB45j0Dmdp5oWy3FJAuWa7mlCIvMcfVWDgpf
 aDzmjiMn7bzyHHXMDlDo3AdHOJrnKBaPylMjWXUkiiNiFhmGZ6787o3hN0yIc+Ck
 jwyIm+5Tp8agpgMIqI0cpn7e9QeNc2F8jJPmKdDmEN5Ny9xQKCpxzc2CbBWLNZnu
 bOLhpbKxRDVgXm46eLhTwJypgZWli/2GCFpfjXdDI8lOB5Sq6uf6P0eJfDkJBv7k
 upj309dHgl60KP6jJI7foIoY6WVxjWOAZXgslco//leH8fdj5M4=
 =veH6
 -----END PGP SIGNATURE-----

Merge tag 'arm-fixes-5.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull ARM SoC fixes from Arnd Bergmann:
 "There are only a few devicetree fixes this time:

   - one outdated devicetree property that slipped into the newly added
     ExynosAutov9 support

   - three changes to Broadcom SoCs that had incorrect number values for
     interrupts or irqchips.

  In the MAINTAINERS file, Nishanth Menon gets listed for TI K3 SoCs,
  while Taichi Sugaya and Takao Orito take ownership of the Socionext
  Milbeaut platform.

  All other changes are for SoC specific drivers, fixing:

   - A missing NULL pointer check in the mediatek memory driver

   - An integer overflow issue in the Arm smccc firwmare interface

   - A false-positive fortify-source check

   - Error handling fixes for optee and smci

   - Incorrect message format in one SCMI call"

* tag 'arm-fixes-5.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  memory: mtk-smi: Fix a null dereference for the ostd
  arm64: dts: exynos: drop samsung,ufs-shareability-reg-offset in ExynosAutov9
  MAINTAINERS: Update maintainer entry for keystone platforms
  MAINTAINERS: Add entry to MAINTAINERS for Milbeaut
  firmware: smccc: Fix check for ARCH_SOC_ID not implemented
  ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE
  firmware: arm_scmi: Fix type error assignment in voltage protocol
  firmware: arm_scmi: Fix type error in sensor protocol
  firmware: arm_scmi: pm: Propagate return value to caller
  firmware: arm_scmi: Fix base agent discover response
  optee: fix kfree NULL pointer
  ARM: dts: bcm2711: Fix PCIe interrupts
  ARM: dts: BCM5301X: Add interrupt properties to GPIO node
  ARM: dts: BCM5301X: Fix I2C controller interrupt
  firmware: arm_scmi: Fix null de-reference on error path
2021-11-25 10:31:37 -08:00
Linus Torvalds
79941493ff Fixes for 5.16 folios:
- Fix compilation warnings on csky and sparc
  - Rename multipage folios to large folios
  - Rename AS_THP_SUPPORT and FS_THP_SUPPORT
  - Add functions to zero portions of a folio
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEejHryeLBw/spnjHrDpNsjXcpgj4FAmGem6wACgkQDpNsjXcp
 gj7uvwgAjNqDWOVgwYU98daN6nKQQf5Vv35f0bzeKcKcHIOEWZ2+MUeXkI55h8TD
 ss5L3O86sPtQmpKUQJJChZC4AhpIPRyjPA0JW6vYqXQd912M331WpGgFFyX5eI+3
 OxfKLRULmopeWP1RjWmkWqlhYQHL5OLgAMC4VaBSfDHd1UMRf+F9JNm9qR7GCp9Q
 Vb0qcmBMaQYt/K5sWRQyPUACVTF+27RLKAs+Om37NGekv1UqgOPMzi9nAyi9RjCi
 rRY6oGupNgC+Y41jzlpaNoL71RPS92H769FBh/Fe4qu55VSPjfcN77qAnVhX5Ykn
 4RhzZcEUoqlx9xG9xynk0mmbx2Bf4g==
 =kvqM
 -----END PGP SIGNATURE-----

Merge tag 'folio-5.16b' of git://git.infradead.org/users/willy/pagecache

Pull folio fixes from Matthew Wilcox:
 "In the course of preparing the folio changes for iomap for next merge
  window, we discovered some problems that would be nice to address now:

   - Renaming multi-page folios to large folios.

     mapping_multi_page_folio_support() is just a little too long, so we
     settled on mapping_large_folio_support(). That meant renaming, eg
     folio_test_multi() to folio_test_large().

     Rename AS_THP_SUPPORT to match

   - I hadn't included folio wrappers for zero_user_segments(), etc.
     Also, multi-page^W^W large folio support is now independent of
     CONFIG_TRANSPARENT_HUGEPAGE, so machines with HIGHMEM always need
     to fall back to the out-of-line zero_user_segments().

     Remove FS_THP_SUPPORT to match

   - The build bots finally got round to telling me that I missed a
     couple of architectures when adding flush_dcache_folio(). Christoph
     suggested that we just add linux/cacheflush.h and not rely on
     asm-generic/cacheflush.h"

* tag 'folio-5.16b' of git://git.infradead.org/users/willy/pagecache:
  mm: Add functions to zero portions of a folio
  fs: Rename AS_THP_SUPPORT and mapping_thp_support
  fs: Remove FS_THP_SUPPORT
  mm: Remove folio_test_single
  mm: Rename folio_test_multi to folio_test_large
  Add linux/cacheflush.h
2021-11-25 10:13:56 -08:00
Jay Dolan
bb1201d4b3 serial: 8250_pci: rewrite pericom_do_set_divisor()
Have pericom_do_set_divisor() use the uartclk instead of a hard coded
value to work with different speed crystals. Tested with 14.7456 and 24
MHz crystals.

Have pericom_do_set_divisor() always calculate the divisor rather than
call serial8250_do_set_divisor() for rates below baud_base.

Do not write registers or call serial8250_do_set_divisor() if valid
divisors could not be found.

Fixes: 6bf4e42f1d ("serial: 8250: Add support for higher baud rates to Pericom chips")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Jay Dolan <jay.dolan@accesio.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20211122120604.3909-3-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 18:42:15 +01:00
Jay Dolan
c525c5d243 serial: 8250_pci: Fix ACCES entries in pci_serial_quirks array
Fix error in table for PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S that caused it
and PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4 to be missing their fourth port.

Fixes: 78d3820b9b ("serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup()")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Jay Dolan <jay.dolan@accesio.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20211122120604.3909-2-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 18:42:10 +01:00
Lukas Wunner
f85e04503f serial: 8250: Fix RTS modem control while in rs485 mode
Commit f45709df77 ("serial: 8250: Don't touch RTS modem control while
in rs485 mode") sought to prevent user space from interfering with rs485
communication by ignoring a TIOCMSET ioctl() which changes RTS polarity.

It did so in serial8250_do_set_mctrl(), which turns out to be too deep
in the call stack:  When a uart_port is opened, RTS polarity is set by
the rs485-aware function uart_port_dtr_rts().  It calls down to
serial8250_do_set_mctrl() and that particular RTS polarity change should
*not* be ignored.

The user-visible result is that on 8250_omap ports which use rs485 with
inverse polarity (RTS bit in MCR register is 1 to receive, 0 to send),
a newly opened port initially sets up RTS for sending instead of
receiving.  That's because omap_8250_startup() sets the cached value
up->mcr to 0 and omap_8250_restore_regs() subsequently writes it to the
MCR register.  Due to the commit, serial8250_do_set_mctrl() preserves
that incorrect register value:

do_sys_openat2
  do_filp_open
    path_openat
      vfs_open
        do_dentry_open
	  chrdev_open
	    tty_open
	      uart_open
	        tty_port_open
		  uart_port_activate
		    uart_startup
		      uart_port_startup
		        serial8250_startup
			  omap_8250_startup # up->mcr = 0
			uart_change_speed
			  serial8250_set_termios
			    omap_8250_set_termios
			      omap_8250_restore_regs
			        serial8250_out_MCR # up->mcr written
		  tty_port_block_til_ready
		    uart_dtr_rts
		      uart_port_dtr_rts
		        serial8250_set_mctrl
			  omap8250_set_mctrl
			    serial8250_do_set_mctrl # mcr[1] = 1 ignored

Fix by intercepting RTS changes from user space in uart_tiocmset()
instead.

Link: https://lore.kernel.org/linux-serial/20211027111644.1996921-1-baocheng.su@siemens.com/
Fixes: f45709df77 ("serial: 8250: Don't touch RTS modem control while in rs485 mode")
Cc: Chao Zeng <chao.zeng@siemens.com>
Cc: stable@vger.kernel.org # v5.7+
Reported-by: Su Bao Cheng <baocheng.su@siemens.com>
Reported-by: Jan Kiszka <jan.kiszka@siemens.com>
Tested-by: Su Bao Cheng <baocheng.su@siemens.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Link: https://lore.kernel.org/r/21170e622a1aaf842a50b32146008b5374b3dd1d.1637596432.git.lukas@wunner.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 18:41:09 +01:00
Alexander Stein
4e9679738a Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP"
Revert commit b4b844930f ("tty: serial: fsl_lpuart: drop earlycon entry
for i.MX8QXP"), because this breaks earlycon support on imx8qm/imx8qxp.
While it is true that for earlycon there is no difference between
i.MX8QXP and i.MX7ULP (for now at least), there are differences
regarding clocks and fixups for wakeup support. For that reason it was
deemed unacceptable to add the imx7ulp compatible to device tree in
order to get earlycon working again.

Reviewed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Link: https://lore.kernel.org/r/20211124073109.805088-1-alexander.stein@ew.tq-group.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 18:27:44 +01:00
Patrik John
b40de7469e serial: tegra: Change lower tolerance baud rate limit for tegra20 and tegra30
The current implementation uses 0 as lower limit for the baud rate
tolerance for tegra20 and tegra30 chips which causes isses on UART
initialization as soon as baud rate clock is lower than required even
when within the standard UART tolerance of +/- 4%.

This fix aligns the implementation with the initial commit description
of +/- 4% tolerance for tegra chips other than tegra186 and
tegra194.

Fixes: d781ec21ba ("serial: tegra: report clk rate errors")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Patrik John <patrik.john@u-blox.com>
Link: https://lore.kernel.org/r/sig.19614244f8.20211123132737.88341-1-patrik.john@u-blox.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 18:26:32 +01:00
Johan Hovold
0b993fc1fe serial: liteuart: relax compile-test dependencies
The LITEX symbol is neither a build or runtime dependency for the
liteuart serial driver.

LITEX is selected by the "LiteX SoC Controller" driver, which does a
probe-time register-access sanity check and panics if the SoC has not
been configured correctly. That driver's Kconfig entry asserts that any
LiteX driver using the LiteX register accessors should depend on LITEX,
but currently only the serial driver complies.

Relax this LITEX "dependency" in order to make it easier to compile test
the driver.

Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211117100512.5058-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 18:25:49 +01:00
Johan Hovold
dd5e90b16c serial: liteuart: fix minor-number leak on probe errors
Make sure to release the allocated minor number before returning on
probe errors.

Fixes: 1da81e5562 ("drivers/tty/serial: add LiteUART driver")
Cc: stable@vger.kernel.org      # 5.11
Cc: Filip Kokosinski <fkokosinski@antmicro.com>
Cc: Mateusz Holenko <mholenko@antmicro.com>
Reviewed-by: Stafford Horne <shorne@gmail.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211117100512.5058-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 18:25:49 +01:00
Johan Hovold
05f929b395 serial: liteuart: fix use-after-free and memleak on unbind
Deregister the port when unbinding the driver to prevent it from being
used after releasing the driver data and leaking memory allocated by
serial core.

Fixes: 1da81e5562 ("drivers/tty/serial: add LiteUART driver")
Cc: stable@vger.kernel.org      # 5.11
Cc: Filip Kokosinski <fkokosinski@antmicro.com>
Cc: Mateusz Holenko <mholenko@antmicro.com>
Reviewed-by: Stafford Horne <shorne@gmail.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211117100512.5058-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 18:25:49 +01:00
Ilia Sergachev
0f55f89d98 serial: liteuart: Fix NULL pointer dereference in ->remove()
drvdata has to be set in _probe() - otherwise platform_get_drvdata()
causes null pointer dereference BUG in _remove().

Fixes: 1da81e5562 ("drivers/tty/serial: add LiteUART driver")
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ilia Sergachev <silia@ethz.ch>
Link: https://lore.kernel.org/r/20211115224944.23f8c12b@dtkw
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 18:25:24 +01:00
Maciej W. Rozycki
3dfac26e2e vgacon: Propagate console boot parameters before calling `vc_resize'
Fix a division by zero in `vgacon_resize' with a backtrace like:

vgacon_resize
vc_do_resize
vgacon_init
do_bind_con_driver
do_unbind_con_driver
fbcon_fb_unbind
do_unregister_framebuffer
do_register_framebuffer
register_framebuffer
__drm_fb_helper_initial_config_and_unlock
drm_helper_hpd_irq_event
dw_hdmi_irq
irq_thread
kthread

caused by `c->vc_cell_height' not having been initialized.  This has
only started to trigger with commit 860dafa902 ("vt: Fix character
height handling with VT_RESIZEX"), however the ultimate offender is
commit 50ec42edd9 ("[PATCH] Detaching fbcon: fix vgacon to allow
retaking of the console").

Said commit has added a call to `vc_resize' whenever `vgacon_init' is
called with the `init' argument set to 0, which did not happen before.
And the call is made before a key vgacon boot parameter retrieved in
`vgacon_startup' has been propagated in `vgacon_init' for `vc_resize' to
use to the console structure being worked on.  Previously the parameter
was `c->vc_font.height' and now it is `c->vc_cell_height'.

In this particular scenario the registration of fbcon has failed and vt
resorts to vgacon.  Now fbcon does have initialized `c->vc_font.height'
somehow, unlike `c->vc_cell_height', which is why this code did not
crash before, but either way the boot parameters should have been copied
to the console structure ahead of the call to `vc_resize' rather than
afterwards, so that first the call has a chance to use them and second
they do not change the console structure to something possibly different
from what was used by `vc_resize'.

Move the propagation of the vgacon boot parameters ahead of the call to
`vc_resize' then.  Adjust the comment accordingly.

Fixes: 50ec42edd9 ("[PATCH] Detaching fbcon: fix vgacon to allow retaking of the console")
Cc: stable@vger.kernel.org # v2.6.18+
Reported-by: Wim Osterholt <wim@djo.tudelft.nl>
Reported-by: Pavel V. Panteleev <panteleev_p@mcst.ru>
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Link: https://lore.kernel.org/r/alpine.DEB.2.21.2110252317110.58149@angie.orcam.me.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 18:23:57 +01:00
Sven Eckelmann
7492ffc90f tty: serial: msm_serial: Deactivate RX DMA for polling support
The CONSOLE_POLLING mode is used for tools like k(g)db. In this kind of
setup, it is often sharing a serial device with the normal system console.
This is usually no problem because the polling helpers can consume input
values directly (when in kgdb context) and the normal Linux handlers can
only consume new input values after kgdb switched back.

This is not true anymore when RX DMA is enabled for UARTDM controllers.
Single input values can no longer be received correctly. Instead following
seems to happen:

* on 1. input, some old input is read (continuously)
* on 2. input, two old inputs are read (continuously)
* on 3. input, three old input values are read (continuously)
* on 4. input, 4 previous inputs are received

This repeats then for each group of 4 input values.

This behavior changes slightly depending on what state the controller was
when the first input was received. But this makes working with kgdb
basically impossible because control messages are always corrupted when
kgdboc tries to parse them.

RX DMA should therefore be off when CONSOLE_POLLING is enabled to avoid
these kind of problems. No such problem was noticed for TX DMA.

Fixes: 9969394501 ("tty: serial: msm: Add RX DMA support")
Cc: stable@vger.kernel.org
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Link: https://lore.kernel.org/r/20211113121050.7266-1-sven@narfation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 18:23:34 +01:00
Pierre Gondois
ac442a077a serial: pl011: Add ACPI SBSA UART match id
The document 'ACPI for Arm Components 1.0' defines the following
_HID mappings:
-'Prime cell UART (PL011)': ARMH0011
-'SBSA UART': ARMHB000

Use the sbsa-uart driver when a device is described with
the 'ARMHB000' _HID.

Note:
PL011 devices currently use the sbsa-uart driver instead of the
uart-pl011 driver. Indeed, PL011 devices are not bound to a clock
in ACPI. It is not possible to change their baudrate.

Cc: <stable@vger.kernel.org>
Signed-off-by: Pierre Gondois <Pierre.Gondois@arm.com>
Link: https://lore.kernel.org/r/20211109172248.19061-1-Pierre.Gondois@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 18:23:28 +01:00
Johan Hovold
00de977f9e serial: core: fix transmit-buffer reset and memleak
Commit 761ed4a945 ("tty: serial_core: convert uart_close to use
tty_port_close") converted serial core to use tty_port_close() but
failed to notice that the transmit buffer still needs to be freed on
final close.

Not freeing the transmit buffer means that the buffer is no longer
cleared on next open so that any ioctl() waiting for the buffer to drain
might wait indefinitely (e.g. on termios changes) or that stale data can
end up being transmitted in case tx is restarted.

Furthermore, the buffer of any port that has been opened would leak on
driver unbind.

Note that the port lock is held when clearing the buffer pointer due to
the ldisc race worked around by commit a5ba1d95e4 ("uart: fix race
between uart_put_char() and uart_shutdown()").

Also note that the tty-port shutdown() callback is not called for
console ports so it is not strictly necessary to free the buffer page
after releasing the lock (cf. d72402145a ("tty/serial: do not free
trasnmit buffer page under port lock")).

Link: https://lore.kernel.org/r/319321886d97c456203d5c6a576a5480d07c3478.1635781688.git.baruch@tkos.co.il
Fixes: 761ed4a945 ("tty: serial_core: convert uart_close to use tty_port_close")
Cc: stable@vger.kernel.org      # 4.9
Cc: Rob Herring <robh@kernel.org>
Reported-by: Baruch Siach <baruch@tkos.co.il>
Tested-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211108085431.12637-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 18:23:08 +01:00
Yangyang Li
b0969f8389 RDMA/hns: Do not destroy QP resources in the hw resetting phase
When hns_roce_v2_destroy_qp() is called, the brief calling process of the
driver is as follows:

 ......
 hns_roce_v2_destroy_qp
 hns_roce_v2_qp_modify
	   hns_roce_cmd_mbox
 hns_roce_qp_destroy

If hns_roce_cmd_mbox() detects that the hardware is being reset during the
execution of the hns_roce_cmd_mbox(), the driver will not be able to get
the return value from the hardware (the firmware cannot respond to the
driver's mailbox during the hardware reset phase).

The driver needs to wait for the hardware reset to complete before
continuing to execute hns_roce_qp_destroy(), otherwise it may happen that
the driver releases the resources but the hardware is still accessing. In
order to fix this problem, HNS RoCE needs to add a piece of code to wait
for the hardware reset to complete.

The original interface get_hw_reset_stat() is the instantaneous state of
the hardware reset, which cannot accurately reflect whether the hardware
reset is completed, so it needs to be replaced with the ae_dev_reset_cnt
interface.

The sign that the hardware reset is complete is that the return value of
the ae_dev_reset_cnt interface is greater than the original value
reset_cnt recorded by the driver.

Fixes: 6a04aed6af ("RDMA/hns: Fix the chip hanging caused by sending mailbox&CMQ during reset")
Link: https://lore.kernel.org/r/20211123142402.26936-1-liangwenpeng@huawei.com
Signed-off-by: Yangyang Li <liyangyang20@huawei.com>
Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2021-11-25 13:20:24 -04:00
Yangyang Li
52414e27d6 RDMA/hns: Do not halt commands during reset until later
is_reset is used to indicate whether the hardware starts to reset. When
hns_roce_hw_v2_reset_notify_down() is called, the hardware has not yet
started to reset. If is_reset is set at this time, all mailbox operations
of resource destroy actions will be intercepted by driver. When the driver
cleans up resources, but the hardware is still accessed, the following
errors will appear:

  arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received:
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x0000350100000010
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x000002088000003f
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x00000000a50e0800
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x0000000000000000
  arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received:
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x0000350100000010
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x000002088000043e
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x00000000a50a0800
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x0000000000000000
  arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received:
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x0000350100000010
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x0000020880000436
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x00000000a50a0880
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x0000000000000000
  arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received:
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x0000350100000010
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x000002088000043a
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x00000000a50e0840
  hns3 0000:35:00.0: INT status: CMDQ(0x0) HW errors(0x0) other(0x0)
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x0000000000000000
  hns3 0000:35:00.0: received unknown or unhandled event of vector0
  arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received:
  arm-smmu-v3 arm-smmu-v3.2.auto: 	0x0000350100000010
  {34}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 7

is_reset will be set correctly in check_aedev_reset_status(), so the
setting in hns_roce_hw_v2_reset_notify_down() should be deleted.

Fixes: 726be12f5c ("RDMA/hns: Set reset flag when hw resetting")
Link: https://lore.kernel.org/r/20211123084809.37318-1-liangwenpeng@huawei.com
Signed-off-by: Yangyang Li <liyangyang20@huawei.com>
Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2021-11-25 13:20:07 -04:00
Doug Ledford
c4a6f9cd10 Remove Doug Ledford from MAINTAINERS
Moving on to other things

Link: https://lore.kernel.org/r/12fe41e3d0a515e4fcf5c9e62ac88c39e09c1639.1637616139.git.dledford@redhat.com
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2021-11-25 13:18:09 -04:00
Alaa Hleihel
f0ae4afe3d RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow
For the case of IB_MR_TYPE_DM the mr does doesn't have a umem, even though
it is a user MR. This causes function mlx5_free_priv_descs() to think that
it is a kernel MR, leading to wrongly accessing mr->descs that will get
wrong values in the union which leads to attempt to release resources that
were not allocated in the first place.

For example:
 DMA-API: mlx5_core 0000:08:00.1: device driver tries to free DMA memory it has not allocated [device address=0x0000000000000000] [size=0 bytes]
 WARNING: CPU: 8 PID: 1021 at kernel/dma/debug.c:961 check_unmap+0x54f/0x8b0
 RIP: 0010:check_unmap+0x54f/0x8b0
 Call Trace:
  debug_dma_unmap_page+0x57/0x60
  mlx5_free_priv_descs+0x57/0x70 [mlx5_ib]
  mlx5_ib_dereg_mr+0x1fb/0x3d0 [mlx5_ib]
  ib_dereg_mr_user+0x60/0x140 [ib_core]
  uverbs_destroy_uobject+0x59/0x210 [ib_uverbs]
  uobj_destroy+0x3f/0x80 [ib_uverbs]
  ib_uverbs_cmd_verbs+0x435/0xd10 [ib_uverbs]
  ? uverbs_finalize_object+0x50/0x50 [ib_uverbs]
  ? lock_acquire+0xc4/0x2e0
  ? lock_acquired+0x12/0x380
  ? lock_acquire+0xc4/0x2e0
  ? lock_acquire+0xc4/0x2e0
  ? ib_uverbs_ioctl+0x7c/0x140 [ib_uverbs]
  ? lock_release+0x28a/0x400
  ib_uverbs_ioctl+0xc0/0x140 [ib_uverbs]
  ? ib_uverbs_ioctl+0x7c/0x140 [ib_uverbs]
  __x64_sys_ioctl+0x7f/0xb0
  do_syscall_64+0x38/0x90

Fix it by reorganizing the dereg flow and mlx5_ib_mr structure:
 - Move the ib_umem field into the user MRs structure in the union as it's
   applicable only there.
 - Function mlx5_ib_dereg_mr() will now call mlx5_free_priv_descs() only
   in case there isn't udata, which indicates that this isn't a user MR.

Fixes: f18ec42231 ("RDMA/mlx5: Use a union inside mlx5_ib_mr")
Link: https://lore.kernel.org/r/66bb1dd253c1fd7ceaa9fc411061eefa457b86fb.1637581144.git.leonro@nvidia.com
Signed-off-by: Alaa Hleihel <alaa@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2021-11-25 13:16:39 -04:00
Pavel Skripkin
84b01721e8 RDMA: Fix use-after-free in rxe_queue_cleanup
On error handling path in rxe_qp_from_init() qp->sq.queue is freed and
then rxe_create_qp() will drop last reference to this object. qp clean up
function will try to free this queue one time and it causes UAF bug.

Fix it by zeroing queue pointer after freeing queue in rxe_qp_from_init().

Fixes: 514aee660d ("RDMA: Globally allocate and release QP memory")
Link: https://lore.kernel.org/r/20211121202239.3129-1-paskripkin@gmail.com
Reported-by: syzbot+aab53008a5adf26abe91@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Reviewed-by: Zhu Yanjun <zyjzyj2000@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2021-11-25 13:15:59 -04:00
Geert Uytterhoeven
357a9c4b79 irqchip/mips-gic: Use bitfield helpers
Use the FIELD_GET() helper, instead of open-coding the same operation.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/all/74f9d126961a90d3e311b92a54870eaac5b3ae57.1637593297.git.geert+renesas@glider.be
2021-11-25 16:55:40 +00:00
Arnaud Pouliquen
b3483994b3 MAINTAINERS: Add rpmsg tty driver maintainer
Adding myself as rpmsg tty maintainer and also adding remoteproc
mailing list to inform about changes in the driver.

Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Link: https://lore.kernel.org/r/20211102123817.19874-1-arnaud.pouliquen@foss.st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 17:51:25 +01:00
Billy Tsai
8958389681 irqchip/aspeed-scu: Replace update_bits with write_bits.
The interrupt status bits are cleared by writing 1, we should force a
write to clear the interrupt without checking if the value has changed.

Fixes: 04f605906f ("irqchip: Add Aspeed SCU interrupt controller")
Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211124094348.11621-1-billy_tsai@aspeedtech.com
Cc: stable@vger.kernel.org
2021-11-25 16:50:44 +00:00
Pali Rohár
d0a553502e irqchip/armada-370-xp: Fix support for Multi-MSI interrupts
irq-armada-370-xp driver already sets MSI_FLAG_MULTI_PCI_MSI flag into
msi_domain_info structure. But allocated interrupt numbers for Multi-MSI
needs to be properly aligned otherwise devices send MSI interrupt with
wrong number.

Fix this issue by using function bitmap_find_free_region() instead of
bitmap_find_next_zero_area() to allocate aligned interrupt numbers.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: a71b9412c9 ("irqchip/armada-370-xp: Allow allocation of multiple MSIs")
Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211125130057.26705-2-pali@kernel.org
2021-11-25 16:49:50 +00:00
Pali Rohár
ce20eff573 irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc()
IRQ domain alloc function should return zero on success. Non-zero value
indicates failure.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: fcc392d501 ("irqchip/armada-370-xp: Use the generic MSI infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211125130057.26705-1-pali@kernel.org
2021-11-25 16:49:38 +00:00
Yang Guang
e30028ace8 block: fix parameter not described warning
The build warning:
block/blk-core.c:968: warning: Function parameter or member 'iob'
not described in 'bio_poll'.

Fixes: 5a72e899ce ("block: add a struct io_comp_batch argument to fops->iopoll()")
Reported-by: Zeal Robot <zealci@zte.com.cn>
Signed-off-by: Yang Guang <yang.guang5@zte.com.cn>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2021-11-25 09:32:19 -07:00
Huang Pei
41ce097f71 MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48
It hangup when booting Loongson 3A1000 with BOTH
CONFIG_PAGE_SIZE_64KB and CONFIG_MIPS_VA_BITS_48, that it turn
out to use 2-level pgtable instead of 3-level. 64KB page size
with 2-level pgtable only cover 42 bits VA, use 3-level pgtable
to cover all 48 bits VA(55 bits)

Fixes: 1e321fa917 ("MIPS64: Support of at least 48 bits of SEGBITS)
Signed-off-by: Huang Pei <huangpei@loongson.cn>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2021-11-25 16:52:11 +01:00
Catalin Marinas
1f80d15020 KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 to 1
Having a signed (1 << 31) constant for TCR_EL2_RES1 and CPTR_EL2_TCPAC
causes the upper 32-bit to be set to 1 when assigning them to a 64-bit
variable. Bit 32 in TCR_EL2 is no longer RES0 in ARMv8.7: with FEAT_LPA2
it changes the meaning of bits 49:48 and 9:8 in the stage 1 EL2 page
table entries. As a result of the sign-extension, a non-VHE kernel can
no longer boot on a model with ARMv8.7 enabled.

CPTR_EL2 still has the top 32 bits RES0 but we should preempt any future
problems

Make these top bit constants unsigned as per commit df655b75c4
("arm64: KVM: Avoid setting the upper 32 bits of VTCR_EL2 to 1").

Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Reported-by: Chris January <Chris.January@arm.com>
Cc: <stable@vger.kernel.org>
Cc: Will Deacon <will@kernel.org>
Cc: Marc Zyngier <maz@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211125152014.2806582-1-catalin.marinas@arm.com
2021-11-25 15:51:25 +00:00
Huang Pei
7db5e9e9e5 MIPS: loongson64: fix FTLB configuration
It turns out that 'decode_configs' -> 'set_ftlb_enable' is called under
c->cputype unset, which leaves FTLB disabled on BOTH 3A2000 and 3A3000

Fix it by calling "decode_configs" after c->cputype is initialized

Fixes: da1bd29742 ("MIPS: Loongson64: Probe CPU features via CPUCFG")
Signed-off-by: Huang Pei <huangpei@loongson.cn>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2021-11-25 16:46:31 +01:00
Tiezhu Yang
1cab5bd69e MIPS: Fix using smp_processor_id() in preemptible in show_cpuinfo()
There exists the following issue under DEBUG_PREEMPT:

 BUG: using smp_processor_id() in preemptible [00000000] code: systemd/1
 caller is show_cpuinfo+0x460/0xea0
 ...
 Call Trace:
 [<ffffffff8020f0dc>] show_stack+0x94/0x128
 [<ffffffff80e6cab4>] dump_stack_lvl+0x94/0xd8
 [<ffffffff80e74c5c>] check_preemption_disabled+0x104/0x110
 [<ffffffff802209c8>] show_cpuinfo+0x460/0xea0
 [<ffffffff80539d54>] seq_read_iter+0xfc/0x4f8
 [<ffffffff804fcc10>] new_sync_read+0x110/0x1b8
 [<ffffffff804ff57c>] vfs_read+0x1b4/0x1d0
 [<ffffffff804ffb18>] ksys_read+0xd0/0x110
 [<ffffffff8021c090>] syscall_common+0x34/0x58

We can see the following call trace:
 show_cpuinfo()
   cpu_has_fpu
     current_cpu_data
       smp_processor_id()

 $ addr2line -f -e vmlinux 0xffffffff802209c8
 show_cpuinfo
 arch/mips/kernel/proc.c:188

 $ head -188 arch/mips/kernel/proc.c | tail -1
	 if (cpu_has_fpu)

 arch/mips/include/asm/cpu-features.h
 #  define cpu_has_fpu		(current_cpu_data.options & MIPS_CPU_FPU)

 arch/mips/include/asm/cpu-info.h
 #define current_cpu_data cpu_data[smp_processor_id()]

Based on the above analysis, fix the issue by using raw_cpu_has_fpu
which calls raw_smp_processor_id() in show_cpuinfo().

Fixes: 626bfa0372 ("MIPS: kernel: proc: add CPU option reporting")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2021-11-25 16:45:58 +01:00
Dylan Hung
9dbe33cf37 mdio: aspeed: Fix "Link is Down" issue
The issue happened randomly in runtime.  The message "Link is Down" is
popped but soon it recovered to "Link is Up".

The "Link is Down" results from the incorrect read data for reading the
PHY register via MDIO bus.  The correct sequence for reading the data
shall be:
1. fire the command
2. wait for command done (this step was missing)
3. wait for data idle
4. read data from data register

Cc: stable@vger.kernel.org
Fixes: f160e99462 ("net: phy: Add mdio-aspeed")
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Dylan Hung <dylan_hung@aspeedtech.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://lore.kernel.org/r/20211125024432.15809-1-dylan_hung@aspeedtech.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-25 07:44:42 -08:00