1. 10 May, 2022 7 commits
  2. 29 Apr, 2022 7 commits
    • Naoya Horiguchi's avatar
      mm/hwpoison: use pr_err() instead of dump_page() in get_any_page() · 1825b93b
      Naoya Horiguchi authored
      The following VM_BUG_ON_FOLIO() is triggered when memory error event
      happens on the (thp/folio) pages which are about to be freed:
      
        [ 1160.232771] page:00000000b36a8a0f refcount:1 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x16a000
        [ 1160.236916] page:00000000b36a8a0f refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x16a000
        [ 1160.240684] flags: 0x57ffffc0800000(hwpoison|node=1|zone=2|lastcpupid=0x1fffff)
        [ 1160.243458] raw: 0057ffffc0800000 dead000000000100 dead000000000122 0000000000000000
        [ 1160.246268] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
        [ 1160.249197] page dumped because: VM_BUG_ON_FOLIO(!folio_test_large(folio))
        [ 1160.251815] ------------[ cut here ]------------
        [ 1160.253438] kernel BUG at include/linux/mm.h:788!
        [ 1160.256162] invalid opcode: 0000 [#1] PREEMPT SMP PTI
        [ 1160.258172] CPU: 2 PID: 115368 Comm: mceinj.sh Tainted: G            E     5.18.0-rc1-v5.18-rc1-220404-2353-005-g83111+ #3
        [ 1160.262049] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35 04/01/2014
        [ 1160.265103] RIP: 0010:dump_page.cold+0x27e/0x2bd
        [ 1160.266757] Code: fe ff ff 48 c7 c6 81 f1 5a 98 e9 4c fe ff ff 48 c7 c6 a1 95 59 98 e9 40 fe ff ff 48 c7 c6 50 bf 5a 98 48 89 ef e8 9d 04 6d ff <0f> 0b 41 f7 c4 ff 0f 00 00 0f 85 9f fd ff ff 49 8b 04 24 a9 00 00
        [ 1160.273180] RSP: 0018:ffffaa2c4d59fd18 EFLAGS: 00010292
        [ 1160.274969] RAX: 000000000000003e RBX: 0000000000000001 RCX: 0000000000000000
        [ 1160.277263] RDX: 0000000000000001 RSI: ffffffff985995a1 RDI: 00000000ffffffff
        [ 1160.279571] RBP: ffffdc9c45a80000 R08: 0000000000000000 R09: 00000000ffffdfff
        [ 1160.281794] R10: ffffaa2c4d59fb08 R11: ffffffff98940d08 R12: ffffdc9c45a80000
        [ 1160.283920] R13: ffffffff985b6f94 R14: 0000000000000000 R15: ffffdc9c45a80000
        [ 1160.286641] FS:  00007eff54ce1740(0000) GS:ffff99c67bd00000(0000) knlGS:0000000000000000
        [ 1160.289498] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        [ 1160.291106] CR2: 00005628381a5f68 CR3: 0000000104712003 CR4: 0000000000170ee0
        [ 1160.293031] Call Trace:
        [ 1160.293724]  <TASK>
        [ 1160.294334]  get_hwpoison_page+0x47d/0x570
        [ 1160.295474]  memory_failure+0x106/0xaa0
        [ 1160.296474]  ? security_capable+0x36/0x50
        [ 1160.297524]  hard_offline_page_store+0x43/0x80
        [ 1160.298684]  kernfs_fop_write_iter+0x11c/0x1b0
        [ 1160.299829]  new_sync_write+0xf9/0x160
        [ 1160.300810]  vfs_write+0x209/0x290
        [ 1160.301835]  ksys_write+0x4f/0xc0
        [ 1160.302718]  do_syscall_64+0x3b/0x90
        [ 1160.303664]  entry_SYSCALL_64_after_hwframe+0x44/0xae
        [ 1160.304981] RIP: 0033:0x7eff54b018b7
      
      As shown in the RIP address, this VM_BUG_ON in folio_entire_mapcount() is
      called from dump_page("hwpoison: unhandlable page") in get_any_page().
      The below explains the mechanism of the race:
      
        CPU 0                                       CPU 1
      
          memory_failure
            get_hwpoison_page
              get_any_page
                dump_page
                  compound = PageCompound
                                                      free_pages_prepare
                                                        page->flags &= ~PAGE_FLAGS_CHECK_AT_PREP
                  folio_entire_mapcount
                    VM_BUG_ON_FOLIO(!folio_test_large(folio))
      
      So replace dump_page() with safer one, pr_err().
      
      Link: https://lkml.kernel.org/r/20220427053220.719866-1-naoya.horiguchi@linux.dev
      Fixes: 74e8ee47 ("mm: Turn head_compound_mapcount() into folio_entire_mapcount()")
      Signed-off-by: default avatarNaoya Horiguchi <naoya.horiguchi@nec.com>
      Reviewed-by: default avatarJohn Hubbard <jhubbard@nvidia.com>
      Reviewed-by: default avatarMiaohe Lin <linmiaohe@huawei.com>
      Cc: Matthew Wilcox <willy@infradead.org>
      Cc: Christoph Hellwig <hch@infradead.org>
      Cc: Jason Gunthorpe <jgg@nvidia.com>
      Cc: William Kucharski <william.kucharski@oracle.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      1825b93b
    • Xu Yu's avatar
      mm/huge_memory: do not overkill when splitting huge_zero_page · 478d134e
      Xu Yu authored
      Kernel panic when injecting memory_failure for the global huge_zero_page,
      when CONFIG_DEBUG_VM is enabled, as follows.
      
        Injecting memory failure for pfn 0x109ff9 at process virtual address 0x20ff9000
        page:00000000fb053fc3 refcount:2 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109e00
        head:00000000fb053fc3 order:9 compound_mapcount:0 compound_pincount:0
        flags: 0x17fffc000010001(locked|head|node=0|zone=2|lastcpupid=0x1ffff)
        raw: 017fffc000010001 0000000000000000 dead000000000122 0000000000000000
        raw: 0000000000000000 0000000000000000 00000002ffffffff 0000000000000000
        page dumped because: VM_BUG_ON_PAGE(is_huge_zero_page(head))
        ------------[ cut here ]------------
        kernel BUG at mm/huge_memory.c:2499!
        invalid opcode: 0000 [#1] PREEMPT SMP PTI
        CPU: 6 PID: 553 Comm: split_bug Not tainted 5.18.0-rc1+ #11
        Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 3288b3c 04/01/2014
        RIP: 0010:split_huge_page_to_list+0x66a/0x880
        Code: 84 9b fb ff ff 48 8b 7c 24 08 31 f6 e8 9f 5d 2a 00 b8 b8 02 00 00 e9 e8 fb ff ff 48 c7 c6 e8 47 3c 82 4c b
        RSP: 0018:ffffc90000dcbdf8 EFLAGS: 00010246
        RAX: 000000000000003c RBX: 0000000000000001 RCX: 0000000000000000
        RDX: 0000000000000000 RSI: ffffffff823e4c4f RDI: 00000000ffffffff
        RBP: ffff88843fffdb40 R08: 0000000000000000 R09: 00000000fffeffff
        R10: ffffc90000dcbc48 R11: ffffffff82d68448 R12: ffffea0004278000
        R13: ffffffff823c6203 R14: 0000000000109ff9 R15: ffffea000427fe40
        FS:  00007fc375a26740(0000) GS:ffff88842fd80000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 00007fc3757c9290 CR3: 0000000102174006 CR4: 00000000003706e0
        DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
        DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
        Call Trace:
        try_to_split_thp_page+0x3a/0x130
        memory_failure+0x128/0x800
        madvise_inject_error.cold+0x8b/0xa1
        __x64_sys_madvise+0x54/0x60
        do_syscall_64+0x35/0x80
        entry_SYSCALL_64_after_hwframe+0x44/0xae
        RIP: 0033:0x7fc3754f8bf9
        Code: 01 00 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 8
        RSP: 002b:00007ffeda93a1d8 EFLAGS: 00000217 ORIG_RAX: 000000000000001c
        RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc3754f8bf9
        RDX: 0000000000000064 RSI: 0000000000003000 RDI: 0000000020ff9000
        RBP: 00007ffeda93a200 R08: 0000000000000000 R09: 0000000000000000
        R10: 00000000ffffffff R11: 0000000000000217 R12: 0000000000400490
        R13: 00007ffeda93a2e0 R14: 0000000000000000 R15: 0000000000000000
      
      We think that raising BUG is overkilling for splitting huge_zero_page, the
      huge_zero_page can't be met from normal paths other than memory failure,
      but memory failure is a valid caller.  So we tend to replace the BUG to
      WARN + returning -EBUSY, and thus the panic above won't happen again.
      
      Link: https://lkml.kernel.org/r/f35f8b97377d5d3ede1bc5ac3114da888c57cbce.1651052574.git.xuyu@linux.alibaba.com
      Fixes: d173d541 ("mm/memory-failure.c: skip huge_zero_page in memory_failure()")
      Fixes: 6a46079c ("HWPOISON: The high level memory error handler in the VM v7")
      Signed-off-by: default avatarXu Yu <xuyu@linux.alibaba.com>
      Suggested-by: default avatarYang Shi <shy828301@gmail.com>
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Reviewed-by: default avatarNaoya Horiguchi <naoya.horiguchi@nec.com>
      Reviewed-by: default avatarYang Shi <shy828301@gmail.com>
      Reviewed-by: default avatarMiaohe Lin <linmiaohe@huawei.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      478d134e
    • Xu Yu's avatar
      Revert "mm/memory-failure.c: skip huge_zero_page in memory_failure()" · b4e61fc0
      Xu Yu authored
      Patch series "mm/memory-failure: rework fix on huge_zero_page splitting".
      
      
      This patch (of 2):
      
      This reverts commit d173d541.
      
      The commit d173d541 ("mm/memory-failure.c: skip huge_zero_page in
      memory_failure()") explicitly skips huge_zero_page in memory_failure(), in
      order to avoid triggering VM_BUG_ON_PAGE on huge_zero_page in
      split_huge_page_to_list().
      
      This works, but Yang Shi thinks that,
      
          Raising BUG is overkilling for splitting huge_zero_page. The
          huge_zero_page can't be met from normal paths other than memory
          failure, but memory failure is a valid caller. So I tend to replace
          the BUG to WARN + returning -EBUSY. If we don't care about the
          reason code in memory failure, we don't have to touch memory
          failure.
      
      And for the issue that huge_zero_page will be set PG_has_hwpoisoned,
      Yang Shi comments that,
      
          The anonymous page fault doesn't check if the page is poisoned or
          not since it typically gets a fresh allocated page and assumes the
          poisoned page (isolated successfully) can't be reallocated again.
          But huge zero page and base zero page are reused every time. So no
          matter what fix we pick, the issue is always there.
      
      Finally, Yang, David, Anshuman and Naoya all agree to fix the bug, i.e.,
      to split huge_zero_page, in split_huge_page_to_list().
      
      This reverts the commit d173d541 ("mm/memory-failure.c: skip
      huge_zero_page in memory_failure()"), and the original bug will be fixed
      by the next patch.
      
      Link: https://lkml.kernel.org/r/872cefb182ba1dd686b0e7db1e6b2ebe5a4fff87.1651039624.git.xuyu@linux.alibaba.com
      Fixes: d173d541 ("mm/memory-failure.c: skip huge_zero_page in memory_failure()")
      Fixes: 6a46079c ("HWPOISON: The high level memory error handler in the VM v7")
      Signed-off-by: default avatarXu Yu <xuyu@linux.alibaba.com>
      Suggested-by: default avatarYang Shi <shy828301@gmail.com>
      Reviewed-by: default avatarYang Shi <shy828301@gmail.com>
      Reviewed-by: default avatarMiaohe Lin <linmiaohe@huawei.com>
      Cc: Naoya Horiguchi <naoya.horiguchi@nec.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      b4e61fc0
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2022-04-29' of git://anongit.freedesktop.org/drm/drm · 38d741cb
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Another relatively quiet week, amdgpu leads the way, some i915 display
        fixes, and a single sunxi fix.
      
        amdgpu:
         - Runtime pm fix
         - DCN memory leak fix in error path
         - SI DPM deadlock fix
         - S0ix fix
      
        amdkfd:
         - GWS fix
         - GWS support for CRIU
      
        i915:
         - Fix #5284: Backlight control regression on XMG Core 15 e21
         - Fix black display plane on Acer One AO532h
         - Two smaller display fixes
      
        sunxi:
         - Single fix removing applying PHYS_OFFSET twice"
      
      * tag 'drm-fixes-2022-04-29' of git://anongit.freedesktop.org/drm/drm:
        drm/amdgpu: keep mmhub clock gating being enabled during s2idle suspend
        drm/amd/pm: fix the deadlock issue observed on SI
        drm/amd/display: Fix memory leak in dcn21_clock_source_create
        drm/amdgpu: don't runtime suspend if there are displays attached (v3)
        drm/amdkfd: CRIU add support for GWS queues
        drm/amdkfd: Fix GWS queue count
        drm/sun4i: Remove obsolete references to PHYS_OFFSET
        drm/i915/fbc: Consult hw.crtc instead of uapi.crtc
        drm/i915: Fix SEL_FETCH_PLANE_*(PIPE_B+) register addresses
        drm/i915: Check EDID for HDR static metadata when choosing blc
        drm/i915: Fix DISP_POS_Y and DISP_HEIGHT defines
      38d741cb
    • Dave Airlie's avatar
      Merge tag 'amd-drm-fixes-5.18-2022-04-27' of... · 9d9f7207
      Dave Airlie authored
      Merge tag 'amd-drm-fixes-5.18-2022-04-27' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes
      
      amd-drm-fixes-5.18-2022-04-27:
      
      amdgpu:
      - Runtime pm fix
      - DCN memory leak fix in error path
      - SI DPM deadlock fix
      - S0ix fix
      
      amdkfd:
      - GWS fix
      - GWS support for CRIU
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexander.deucher@amd.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20220428023232.5794-1-alexander.deucher@amd.com
      9d9f7207
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2022-04-28' of... · 22c73ba4
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2022-04-28' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
      
      - Fix #5284: Backlight control regression on XMG Core 15 e21
      - Fix black display plane on Acer One AO532h
      - Two smaller display fixes
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/Ymotel5VfZUrJahf@jlahtine-mobl.ger.corp.intel.com
      22c73ba4
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2022-04-27' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes · 43f2c104
      Dave Airlie authored
      drm-misc-fixes for v5.18-rc5:
      - Single fix removing applying PHYS_OFFSET twice in sunxi.
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/f692bb62-5620-1868-91b7-dffb8d6f9175@linux.intel.com
      43f2c104
  3. 28 Apr, 2022 21 commits
    • Linus Torvalds's avatar
      Merge tag 'net-5.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 249aca0d
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "Including fixes from bluetooth, bpf and netfilter.
      
        Current release - new code bugs:
      
         - bridge: switchdev: check br_vlan_group() return value
      
         - use this_cpu_inc() to increment net->core_stats, fix preempt-rt
      
        Previous releases - regressions:
      
         - eth: stmmac: fix write to sgmii_adapter_base
      
        Previous releases - always broken:
      
         - netfilter: nf_conntrack_tcp: re-init for syn packets only,
           resolving issues with TCP fastopen
      
         - tcp: md5: fix incorrect tcp_header_len for incoming connections
      
         - tcp: fix F-RTO may not work correctly when receiving DSACK
      
         - tcp: ensure use of most recently sent skb when filling rate samples
      
         - tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT
      
         - virtio_net: fix wrong buf address calculation when using xdp
      
         - xsk: fix forwarding when combining copy mode with busy poll
      
         - xsk: fix possible crash when multiple sockets are created
      
         - bpf: lwt: fix crash when using bpf_skb_set_tunnel_key() from
           bpf_xmit lwt hook
      
         - sctp: null-check asoc strreset_chunk in sctp_generate_reconf_event
      
         - wireguard: device: check for metadata_dst with skb_valid_dst()
      
         - netfilter: update ip6_route_me_harder to consider L3 domain
      
         - gre: make o_seqno start from 0 in native mode
      
         - gre: switch o_seqno to atomic to prevent races in collect_md mode
      
        Misc:
      
         - add Eric Dumazet to networking maintainers
      
         - dt: dsa: realtek: remove realtek,rtl8367s string
      
         - netfilter: flowtable: Remove the empty file"
      
      * tag 'net-5.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (65 commits)
        tcp: fix F-RTO may not work correctly when receiving DSACK
        Revert "ibmvnic: Add ethtool private flag for driver-defined queue limits"
        net: enetc: allow tc-etf offload even with NETIF_F_CSUM_MASK
        ixgbe: ensure IPsec VF<->PF compatibility
        MAINTAINERS: Update BNXT entry with firmware files
        netfilter: nft_socket: only do sk lookups when indev is available
        net: fec: add missing of_node_put() in fec_enet_init_stop_mode()
        bnx2x: fix napi API usage sequence
        tls: Skip tls_append_frag on zero copy size
        Add Eric Dumazet to networking maintainers
        netfilter: conntrack: fix udp offload timeout sysctl
        netfilter: nf_conntrack_tcp: re-init for syn packets only
        net: dsa: lantiq_gswip: Don't set GSWIP_MII_CFG_RMII_CLK
        net: Use this_cpu_inc() to increment net->core_stats
        Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted
        Bluetooth: hci_event: Fix creating hci_conn object on error status
        Bluetooth: hci_event: Fix checking for invalid handle on error status
        ice: fix use-after-free when deinitializing mailbox snapshot
        ice: wait 5 s for EMP reset after firmware flash
        ice: Protect vf_state check by cfg_lock in ice_vc_process_vf_msg()
        ...
      249aca0d
    • Linus Torvalds's avatar
      Merge tag 'thermal-5.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 3c76fe74
      Linus Torvalds authored
      Pull thermal control fixes from Rafael Wysocki:
       "These take back recent chages that started to confuse users and fix up
        an attr.show callback prototype in a driver.
      
        Specifics:
      
         - Stop warning about deprecation of the userspace thermal governor
           and cooling device status interface, because there are cases in
           which user space has to drive thermal management with the help of
           them (Daniel Lezcano)
      
         - Fix attr.show callback prototype in the int340x thermal driver
           (Kees Cook)"
      
      * tag 'thermal-5.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        thermal/governor: Remove deprecated information
        Revert "thermal/core: Deprecate changing cooling device state from userspace"
        thermal: int340x: Fix attr.show callback prototype
      3c76fe74
    • Linus Torvalds's avatar
      Merge tag 'pm-5.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 659ed6e2
      Linus Torvalds authored
      Pull power management fixes from Rafael Wysocki:
       "These fix up recent intel_idle driver changes and fix some ARM cpufreq
        driver issues.
      
        Specifics:
      
         - Fix issues with the Qualcomm's cpufreq driver (Dmitry Baryshkov,
           Vladimir Zapolskiy).
      
         - Fix memory leak with the Sun501 driver (Xiaobing Luo).
      
         - Make intel_idle enable C1E promotion on all CPUs when C1E is
           preferred to C1 (Artem Bityutskiy).
      
         - Make C6 optimization on Sapphire Rapids added recently work as
           expected if both C1E and C1 are "preferred" (Artem Bityutskiy)"
      
      * tag 'pm-5.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        intel_idle: Fix SPR C6 optimization
        intel_idle: Fix the 'preferred_cstates' module parameter
        cpufreq: qcom-cpufreq-hw: Clear dcvs interrupts
        cpufreq: fix memory leak in sun50i_cpufreq_nvmem_probe
        cpufreq: qcom-cpufreq-hw: Fix throttle frequency value on EPSS platforms
        cpufreq: qcom-hw: provide online/offline operations
        cpufreq: qcom-hw: fix the opp entries refcounting
        cpufreq: qcom-hw: fix the race between LMH worker and cpuhp
        cpufreq: qcom-hw: drop affinity hint before freeing the IRQ
      659ed6e2
    • Linus Torvalds's avatar
      Merge tag 'acpi-5.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · f12d31c0
      Linus Torvalds authored
      Pull ACPI fixes from Rafael WysockiL
       "These fix up the ACPI processor driver after a change made during the
        5.16 cycle that inadvertently broke falling back to shallower C-states
        when C3 cannot be used.
      
        Specifics:
      
         - Make the ACPI processor driver avoid falling back to C3 type of
           C-states when C3 cannot be requested (Ville Syrjälä)
      
         - Revert a quirk that is not necessary any more after fixing the
           underlying issue properly (Ville Syrjälä)"
      
      * tag 'acpi-5.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        Revert "ACPI: processor: idle: fix lockup regression on 32-bit ThinkPad T40"
        ACPI: processor: idle: Avoid falling back to C3 type C-states
      f12d31c0
    • Linus Torvalds's avatar
      Merge tag 'platform-drivers-x86-v5.18-3' of... · 259b897e
      Linus Torvalds authored
      Merge tag 'platform-drivers-x86-v5.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
      
      Pull x86 platform driver fixes from Hans de Goede:
       "Highlights:
      
         - asus-wmi bug-fixes
      
         - intel-sdsu bug-fixes
      
         - build (warning) fixes
      
         - couple of hw-id additions"
      
      * tag 'platform-drivers-x86-v5.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:
        platform/x86/intel: pmc/core: change pmc_lpm_modes to static
        platform/x86/intel/sdsi: Fix bug in multi packet reads
        platform/x86/intel/sdsi: Poll on ready bit for writes
        platform/x86/intel/sdsi: Handle leaky bucket
        platform/x86: intel-uncore-freq: Prevent driver loading in guests
        platform/x86: gigabyte-wmi: added support for B660 GAMING X DDR4 motherboard
        platform/x86: dell-laptop: Add quirk entry for Latitude 7520
        platform/x86: asus-wmi: Fix driver not binding when fan curve control probe fails
        platform/x86: asus-wmi: Potential buffer overflow in asus_wmi_evaluate_method_buf()
        tools/power/x86/intel-speed-select: fix build failure when using -Wl,--as-needed
      259b897e
    • Linus Torvalds's avatar
      Merge tag 'regulator-fix-v5.18-rc4' of... · fd5a4c7d
      Linus Torvalds authored
      Merge tag 'regulator-fix-v5.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
      
      Pull regulator fix from Mark Brown:
       "A minor fix for the DT binding documentation of the rt5190a driver"
      
      * tag 'regulator-fix-v5.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
        regulator: dt-bindings: Revise the rt5190a buck/ldo description
      fd5a4c7d
    • Pengcheng Yang's avatar
      tcp: fix F-RTO may not work correctly when receiving DSACK · d9157f68
      Pengcheng Yang authored
      Currently DSACK is regarded as a dupack, which may cause
      F-RTO to incorrectly enter "loss was real" when receiving
      DSACK.
      
      Packetdrill to demonstrate:
      
      // Enable F-RTO and TLP
          0 `sysctl -q net.ipv4.tcp_frto=2`
          0 `sysctl -q net.ipv4.tcp_early_retrans=3`
          0 `sysctl -q net.ipv4.tcp_congestion_control=cubic`
      
      // Establish a connection
         +0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
         +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
         +0 bind(3, ..., ...) = 0
         +0 listen(3, 1) = 0
      
      // RTT 10ms, RTO 210ms
        +.1 < S 0:0(0) win 32792 <mss 1000,sackOK,nop,nop,nop,wscale 7>
         +0 > S. 0:0(0) ack 1 <...>
       +.01 < . 1:1(0) ack 1 win 257
         +0 accept(3, ..., ...) = 4
      
      // Send 2 data segments
         +0 write(4, ..., 2000) = 2000
         +0 > P. 1:2001(2000) ack 1
      
      // TLP
      +.022 > P. 1001:2001(1000) ack 1
      
      // Continue to send 8 data segments
         +0 write(4, ..., 10000) = 10000
         +0 > P. 2001:10001(8000) ack 1
      
      // RTO
      +.188 > . 1:1001(1000) ack 1
      
      // The original data is acked and new data is sent(F-RTO step 2.b)
         +0 < . 1:1(0) ack 2001 win 257
         +0 > P. 10001:12001(2000) ack 1
      
      // D-SACK caused by TLP is regarded as a dupack, this results in
      // the incorrect judgment of "loss was real"(F-RTO step 3.a)
      +.022 < . 1:1(0) ack 2001 win 257 <sack 1001:2001,nop,nop>
      
      // Never-retransmitted data(3001:4001) are acked and
      // expect to switch to open state(F-RTO step 3.b)
         +0 < . 1:1(0) ack 4001 win 257
      +0 %{ assert tcpi_ca_state == 0, tcpi_ca_state }%
      
      Fixes: e33099f9 ("tcp: implement RFC5682 F-RTO")
      Signed-off-by: default avatarPengcheng Yang <yangpc@wangsu.com>
      Acked-by: default avatarNeal Cardwell <ncardwell@google.com>
      Tested-by: default avatarNeal Cardwell <ncardwell@google.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Link: https://lore.kernel.org/r/1650967419-2150-1-git-send-email-yangpc@wangsu.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      d9157f68
    • Jakub Kicinski's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf · c26d0d98
      Jakub Kicinski authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      1) Fix incorrect TCP connection tracking window reset for non-syn
         packets, from Florian Westphal.
      
      2) Incorrect dependency on CONFIG_NFT_FLOW_OFFLOAD, from Volodymyr Mytnyk.
      
      3) Fix nft_socket from the output path, from Florian Westphal.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
        netfilter: nft_socket: only do sk lookups when indev is available
        netfilter: conntrack: fix udp offload timeout sysctl
        netfilter: nf_conntrack_tcp: re-init for syn packets only
      ====================
      
      Link: https://lore.kernel.org/r/20220428142109.38726-1-pablo@netfilter.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      c26d0d98
    • Linus Torvalds's avatar
      Merge tag 'gfs2-v5.18-rc4-fix2' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 · 4a2316a1
      Linus Torvalds authored
      Pull gfs2 fix from Andreas Gruenbacher:
      
       - No short reads or writes upon glock contention
      
      * tag 'gfs2-v5.18-rc4-fix2' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2:
        gfs2: No short reads or writes upon glock contention
      4a2316a1
    • Dany Madden's avatar
      Revert "ibmvnic: Add ethtool private flag for driver-defined queue limits" · aeaf59b7
      Dany Madden authored
      This reverts commit 723ad916
      
      When client requests channel or ring size larger than what the server
      can support the server will cap the request to the supported max. So,
      the client would not be able to successfully request resources that
      exceed the server limit.
      
      Fixes: 723ad916 ("ibmvnic: Add ethtool private flag for driver-defined queue limits")
      Signed-off-by: default avatarDany Madden <drt@linux.ibm.com>
      Link: https://lore.kernel.org/r/20220427235146.23189-1-drt@linux.ibm.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      aeaf59b7
    • Vladimir Oltean's avatar
      net: enetc: allow tc-etf offload even with NETIF_F_CSUM_MASK · 66a2f5ef
      Vladimir Oltean authored
      The Time-Specified Departure feature is indeed mutually exclusive with
      TX IP checksumming in ENETC, but TX checksumming in itself is broken and
      was removed from this driver in commit 82728b91 ("enetc: Remove Tx
      checksumming offload code").
      
      The blamed commit declared NETIF_F_HW_CSUM in dev->features to comply
      with software TSO's expectations, and still did the checksumming in
      software by calling skb_checksum_help(). So there isn't any restriction
      for the Time-Specified Departure feature.
      
      However, enetc_setup_tc_txtime() doesn't understand that, and blindly
      looks for NETIF_F_CSUM_MASK.
      
      Instead of checking for things which can literally never happen in the
      current code base, just remove the check and let the driver offload
      tc-etf qdiscs.
      
      Fixes: acede3c5 ("net: enetc: declare NETIF_F_HW_CSUM and do it in software")
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Link: https://lore.kernel.org/r/20220427203017.1291634-1-vladimir.oltean@nxp.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      66a2f5ef
    • Leon Romanovsky's avatar
      ixgbe: ensure IPsec VF<->PF compatibility · f049efc7
      Leon Romanovsky authored
      The VF driver can forward any IPsec flags and such makes the function
      is not extendable and prone to backward/forward incompatibility.
      
      If new software runs on VF, it won't know that PF configured something
      completely different as it "knows" only XFRM_OFFLOAD_INBOUND flag.
      
      Fixes: eda0333a ("ixgbe: add VF IPsec management")
      Reviewed-by: default avatarRaed Salem <raeds@nvidia.com>
      Signed-off-by: default avatarLeon Romanovsky <leonro@nvidia.com>
      Reviewed-by: default avatarShannon Nelson <snelson@pensando.io>
      Tested-by: default avatarKonrad Jankowski <konrad0.jankowski@intel.com>
      Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      Link: https://lore.kernel.org/r/20220427173152.443102-1-anthony.l.nguyen@intel.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      f049efc7
    • Linus Torvalds's avatar
      Merge tag 'xfs-5.18-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · 8061e16e
      Linus Torvalds authored
      Pull xfs fixes from Dave Chinner:
      
       - define buffer bit flags as unsigned to fix gcc-5 + c11 warnings
      
       - remove redundant XFS fields from MAINTAINERS
      
       - fix inode buffer locking order regression
      
      * tag 'xfs-5.18-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: reorder iunlink remove operation in xfs_ifree
        MAINTAINERS: update IOMAP FILESYSTEM LIBRARY and XFS FILESYSTEM
        xfs: convert buffer flags to unsigned.
      8061e16e
    • Florian Fainelli's avatar
      MAINTAINERS: Update BNXT entry with firmware files · 126858db
      Florian Fainelli authored
      There appears to be a maintainer gap for BNXT TEE firmware files which
      causes some patches to be missed. Update the entry for the BNXT Ethernet
      controller with its companion firmware files.
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Reviewed-by: default avatarMichael Chan <michael.chan@broadcom.com>
      Link: https://lore.kernel.org/r/20220427163606.126154-1-f.fainelli@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      126858db
    • Rafael J. Wysocki's avatar
      Merge branch 'thermal-int340x' · a12475f9
      Rafael J. Wysocki authored
      Merge a fix for the attr.show callback prototype in the int340x thermal
      driver (Kees Cook).
      
      * thermal-int340x:
        thermal: int340x: Fix attr.show callback prototype
      a12475f9
    • Florian Westphal's avatar
      netfilter: nft_socket: only do sk lookups when indev is available · 743b83f1
      Florian Westphal authored
      Check if the incoming interface is available and NFT_BREAK
      in case neither skb->sk nor input device are set.
      
      Because nf_sk_lookup_slow*() assume packet headers are in the
      'in' direction, use in postrouting is not going to yield a meaningful
      result.  Same is true for the forward chain, so restrict the use
      to prerouting, input and output.
      
      Use in output work if a socket is already attached to the skb.
      
      Fixes: 554ced0a ("netfilter: nf_tables: add support for native socket matching")
      Reported-and-tested-by: default avatarTopi Miettinen <toiwoton@gmail.com>
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      743b83f1
    • Rafael J. Wysocki's avatar
      Merge branch 'pm-cpuidle' · edbd9772
      Rafael J. Wysocki authored
      Merge cpuidle fixes for 5.18-rc5:
      
       - Make intel_idle enable C1E promotion on all CPUs when C1E is
         preferred to C1 (Artem Bityutskiy).
      
       - Make C6 optimization on Sapphire Rapids added recently work as
         expected if both C1E and C1 are "preferred" (Artem Bityutskiy).
      
      * pm-cpuidle:
        intel_idle: Fix SPR C6 optimization
        intel_idle: Fix the 'preferred_cstates' module parameter
      edbd9772
    • Andreas Gruenbacher's avatar
      gfs2: No short reads or writes upon glock contention · 296abc0d
      Andreas Gruenbacher authored
      Commit 00bfe02f ("gfs2: Fix mmap + page fault deadlocks for buffered
      I/O") changed gfs2_file_read_iter() and gfs2_file_buffered_write() to
      allow dropping the inode glock while faulting in user buffers.  When the
      lock was dropped, a short result was returned to indicate that the
      operation was interrupted.
      
      As pointed out by Linus (see the link below), this behavior is broken
      and the operations should always re-acquire the inode glock and resume
      the operation instead.
      
      Link: https://lore.kernel.org/lkml/CAHk-=whaz-g_nOOoo8RRiWNjnv2R+h6_xk2F1J4TuSRxk1MtLw@mail.gmail.com/
      Fixes: 00bfe02f ("gfs2: Fix mmap + page fault deadlocks for buffered I/O")
      Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
      296abc0d
    • Paolo Abeni's avatar
      Merge tag 'for-net-2022-04-27' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth · febb2d2f
      Paolo Abeni authored
      Luiz Augusto von Dentz says:
      
      ====================
      bluetooth pull request for net:
      
       - Fix regression causing some HCI events to be discarded when they
         shouldn't.
      
      * tag 'for-net-2022-04-27' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
        Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted
        Bluetooth: hci_event: Fix creating hci_conn object on error status
        Bluetooth: hci_event: Fix checking for invalid handle on error status
      ====================
      
      Link: https://lore.kernel.org/r/20220427234031.1257281-1-luiz.dentz@gmail.comSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      febb2d2f
    • Yang Yingliang's avatar
      net: fec: add missing of_node_put() in fec_enet_init_stop_mode() · d2b52ec0
      Yang Yingliang authored
      Put device node in error path in fec_enet_init_stop_mode().
      
      Fixes: 8a448bf8 ("net: ethernet: fec: move GPR register offset and bit into DT")
      Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
      Link: https://lore.kernel.org/r/20220426125231.375688-1-yangyingliang@huawei.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      d2b52ec0
    • Manish Chopra's avatar
      bnx2x: fix napi API usage sequence · af68656d
      Manish Chopra authored
      While handling PCI errors (AER flow) driver tries to
      disable NAPI [napi_disable()] after NAPI is deleted
      [__netif_napi_del()] which causes unexpected system
      hang/crash.
      
      System message log shows the following:
      =======================================
      [ 3222.537510] EEH: Detected PCI bus error on PHB#384-PE#800000 [ 3222.537511] EEH: This PCI device has failed 2 times in the last hour and will be permanently disabled after 5 failures.
      [ 3222.537512] EEH: Notify device drivers to shutdown [ 3222.537513] EEH: Beginning: 'error_detected(IO frozen)'
      [ 3222.537514] EEH: PE#800000 (PCI 0384:80:00.0): Invoking
      bnx2x->error_detected(IO frozen)
      [ 3222.537516] bnx2x: [bnx2x_io_error_detected:14236(eth14)]IO error detected [ 3222.537650] EEH: PE#800000 (PCI 0384:80:00.0): bnx2x driver reports:
      'need reset'
      [ 3222.537651] EEH: PE#800000 (PCI 0384:80:00.1): Invoking
      bnx2x->error_detected(IO frozen)
      [ 3222.537651] bnx2x: [bnx2x_io_error_detected:14236(eth13)]IO error detected [ 3222.537729] EEH: PE#800000 (PCI 0384:80:00.1): bnx2x driver reports:
      'need reset'
      [ 3222.537729] EEH: Finished:'error_detected(IO frozen)' with aggregate recovery state:'need reset'
      [ 3222.537890] EEH: Collect temporary log [ 3222.583481] EEH: of node=0384:80:00.0 [ 3222.583519] EEH: PCI device/vendor: 168e14e4 [ 3222.583557] EEH: PCI cmd/status register: 00100140 [ 3222.583557] EEH: PCI-E capabilities and status follow:
      [ 3222.583744] EEH: PCI-E 00: 00020010 012c8da2 00095d5e 00455c82 [ 3222.583892] EEH: PCI-E 10: 10820000 00000000 00000000 00000000 [ 3222.583893] EEH: PCI-E 20: 00000000 [ 3222.583893] EEH: PCI-E AER capability register set follows:
      [ 3222.584079] EEH: PCI-E AER 00: 13c10001 00000000 00000000 00062030 [ 3222.584230] EEH: PCI-E AER 10: 00002000 000031c0 000001e0 00000000 [ 3222.584378] EEH: PCI-E AER 20: 00000000 00000000 00000000 00000000 [ 3222.584416] EEH: PCI-E AER 30: 00000000 00000000 [ 3222.584416] EEH: of node=0384:80:00.1 [ 3222.584454] EEH: PCI device/vendor: 168e14e4 [ 3222.584491] EEH: PCI cmd/status register: 00100140 [ 3222.584492] EEH: PCI-E capabilities and status follow:
      [ 3222.584677] EEH: PCI-E 00: 00020010 012c8da2 00095d5e 00455c82 [ 3222.584825] EEH: PCI-E 10: 10820000 00000000 00000000 00000000 [ 3222.584826] EEH: PCI-E 20: 00000000 [ 3222.584826] EEH: PCI-E AER capability register set follows:
      [ 3222.585011] EEH: PCI-E AER 00: 13c10001 00000000 00000000 00062030 [ 3222.585160] EEH: PCI-E AER 10: 00002000 000031c0 000001e0 00000000 [ 3222.585309] EEH: PCI-E AER 20: 00000000 00000000 00000000 00000000 [ 3222.585347] EEH: PCI-E AER 30: 00000000 00000000 [ 3222.586872] RTAS: event: 5, Type: Platform Error (224), Severity: 2 [ 3222.586873] EEH: Reset without hotplug activity [ 3224.762767] EEH: Beginning: 'slot_reset'
      [ 3224.762770] EEH: PE#800000 (PCI 0384:80:00.0): Invoking
      bnx2x->slot_reset()
      [ 3224.762771] bnx2x: [bnx2x_io_slot_reset:14271(eth14)]IO slot reset initializing...
      [ 3224.762887] bnx2x 0384:80:00.0: enabling device (0140 -> 0142) [ 3224.768157] bnx2x: [bnx2x_io_slot_reset:14287(eth14)]IO slot reset
      --> driver unload
      
      Uninterruptible tasks
      =====================
      crash> ps | grep UN
           213      2  11  c000000004c89e00  UN   0.0       0      0  [eehd]
           215      2   0  c000000004c80000  UN   0.0       0      0
      [kworker/0:2]
          2196      1  28  c000000004504f00  UN   0.1   15936  11136  wickedd
          4287      1   9  c00000020d076800  UN   0.0    4032   3008  agetty
          4289      1  20  c00000020d056680  UN   0.0    7232   3840  agetty
         32423      2  26  c00000020038c580  UN   0.0       0      0
      [kworker/26:3]
         32871   4241  27  c0000002609ddd00  UN   0.1   18624  11648  sshd
         32920  10130  16  c00000027284a100  UN   0.1   48512  12608  sendmail
         33092  32987   0  c000000205218b00  UN   0.1   48512  12608  sendmail
         33154   4567  16  c000000260e51780  UN   0.1   48832  12864  pickup
         33209   4241  36  c000000270cb6500  UN   0.1   18624  11712  sshd
         33473  33283   0  c000000205211480  UN   0.1   48512  12672  sendmail
         33531   4241  37  c00000023c902780  UN   0.1   18624  11648  sshd
      
      EEH handler hung while bnx2x sleeping and holding RTNL lock
      ===========================================================
      crash> bt 213
      PID: 213    TASK: c000000004c89e00  CPU: 11  COMMAND: "eehd"
        #0 [c000000004d477e0] __schedule at c000000000c70808
        #1 [c000000004d478b0] schedule at c000000000c70ee0
        #2 [c000000004d478e0] schedule_timeout at c000000000c76dec
        #3 [c000000004d479c0] msleep at c0000000002120cc
        #4 [c000000004d479f0] napi_disable at c000000000a06448
                                              ^^^^^^^^^^^^^^^^
        #5 [c000000004d47a30] bnx2x_netif_stop at c0080000018dba94 [bnx2x]
        #6 [c000000004d47a60] bnx2x_io_slot_reset at c0080000018a551c [bnx2x]
        #7 [c000000004d47b20] eeh_report_reset at c00000000004c9bc
        #8 [c000000004d47b90] eeh_pe_report at c00000000004d1a8
        #9 [c000000004d47c40] eeh_handle_normal_event at c00000000004da64
      
      And the sleeping source code
      ============================
      crash> dis -ls c000000000a06448
      FILE: ../net/core/dev.c
      LINE: 6702
      
         6697  {
         6698          might_sleep();
         6699          set_bit(NAPI_STATE_DISABLE, &n->state);
         6700
         6701          while (test_and_set_bit(NAPI_STATE_SCHED, &n->state))
      * 6702                  msleep(1);
         6703          while (test_and_set_bit(NAPI_STATE_NPSVC, &n->state))
         6704                  msleep(1);
         6705
         6706          hrtimer_cancel(&n->timer);
         6707
         6708          clear_bit(NAPI_STATE_DISABLE, &n->state);
         6709  }
      
      EEH calls into bnx2x twice based on the system log above, first through
      bnx2x_io_error_detected() and then bnx2x_io_slot_reset(), and executes
      the following call chains:
      
      bnx2x_io_error_detected()
        +-> bnx2x_eeh_nic_unload()
             +-> bnx2x_del_all_napi()
                  +-> __netif_napi_del()
      
      bnx2x_io_slot_reset()
        +-> bnx2x_netif_stop()
             +-> bnx2x_napi_disable()
                  +->napi_disable()
      
      Fix this by correcting the sequence of NAPI APIs usage,
      that is delete the NAPI after disabling it.
      
      Fixes: 7fa6f340 ("bnx2x: AER revised")
      Reported-by: default avatarDavid Christensen <drc@linux.vnet.ibm.com>
      Tested-by: default avatarDavid Christensen <drc@linux.vnet.ibm.com>
      Signed-off-by: default avatarManish Chopra <manishc@marvell.com>
      Signed-off-by: default avatarAriel Elior <aelior@marvell.com>
      Link: https://lore.kernel.org/r/20220426153913.6966-1-manishc@marvell.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      af68656d
  4. 27 Apr, 2022 5 commits