Commit Graph

1145362 Commits

Author SHA1 Message Date
Elliot Berman
14d004d5b5 ANDROID: qki: Add hidden config option for RCUTORTURE
Add hidden configuration for RCUTORTURE module so they can be
enabled through GKI_HIDDEN configurations required for some debug
related defconfigs.

Bug: 191628908
Change-Id: I3f0056fa22b01902ff2b0a6d2edae4fafbc8aa86
Signed-off-by: Elliot Berman <eberman@codeaurora.org>
Signed-off-by: Jeevan Shriram <jshriram@codeaurora.org>
Signed-off-by: Huang Yiwei <quic_hyiwei@quicinc.com>
2023-02-07 23:34:11 -08:00
jianzhou
943727b7db ANDROID: qki: Migrate consolidate.fragment
Migrate consolidate.fragment changes to new branch to keep
alignment.

Bug: 188690367
Change-Id: Ife5aca7ce5cefa4cc1f06d6fdbf0b73c2604d8a8
Signed-off-by: jianzhou <quic_jianzhou@quicinc.com>
2023-02-06 19:45:11 +00:00
John Moon
55b5da9d31 ANDROID: bazel: Updatate consolidate GKI module list
Currently, the list of implicit module outputs for the consolidate
build is hard-coded.

Instead, use the common GKI module list provided by upstream.

Bug: 263151264
Change-Id: I5b6418d10dd31e60c3e577f900add1ab7aae485b
Signed-off-by: John Moon <quic_johmoo@quicinc.com>
2023-02-02 04:13:31 -08:00
John Moon
7a0536d5a0 ANDROID: bazel: add GKI consolidate Bazel build
Adds //common:kernel_aarch64_consolidate Bazel build target.

Bug: 255878221
Change-Id: I76b44a2764d461d6267ff217e8914298fe560544
Signed-off-by: John Moon <quic_johmoo@quicinc.com>
2023-02-01 18:44:25 -08:00
Jeevan Shriram
02b7e8655b ANDROID: qki: Add consolidate config
Add a "consolidate" defconfig fragment to enable further debug options
of the GKI kernel. The "consolidate" name has a storied history, but
it's effectively a "debug" kernel.

The options enabled in the consolidate.fragment have been found to have
a good balance of additional debug features versus performance impact.
For instance, SLUB_DEBUG is not enabled due to large performance impact.

Bug: 188690367
Change-Id: I8fcbda0f9b47b3b33636a594797f97e86d2a6778
Signed-off-by: Elliot Berman <eberman@codeaurora.org>
Signed-off-by: Jeevan Shriram <jshriram@codeaurora.org>
(cherry picked from commit 6d87cd0e27)
2023-02-01 18:30:05 -08:00
keystone-kernel-automerger
a6e438855e Merge remote-tracking branch into HEAD
* keystone/mirror-android14-6.1:
  ANDROID: hung_task: Add vendor hook for hung task detect

Change-Id: Iadef057ac0d6bb25bcbdeb96aeef6c83559612ea
Signed-off-by: keystone-kernel-automerger <keystone-kernel-automerger@google.com>
2023-01-31 16:56:40 +00:00
keystone-kernel-automerger
0b2aaf757d Merge remote-tracking branch into HEAD
* keystone/mirror-android14-6.1: (215 commits)
  ANDROID: GKI: defconfig: enable BTF debug info
  ANDROID: kbuild: fix build for DEBUG_INFO_BTF_MODULES
  ANDROID: KVM: arm64: Add EL2 wakeup cause hyp events
  ANDROID: KVM: arm64: Add format file for nVHE hyp events
  ANDROID: KVM: arm64: add support for early enablement nVHE hyp events
  ANDROID: KVM: arm64: RAW interface to the nVHE hyp tracing
  ANDROID: KVM: arm64: Add support for nVHE hyp events
  ANDROID: KVM: arm64: Add host support for the nVHE hyp tracing
  ANDROID: KVM: arm64: Add tracing support for the nVHE hyp
  ANDROID: KVM: arm64: Add clock support in the nVHE hyp
  ANDROID: timekeeping: Export the boot clock in snapshots
  ANDROID: ring-buffer: Introducing external writer support
  ANDROID: ring-buffer: Expose buffer_data_page material
  UPSTREAM: usb: gadget: uvc: Rename bmInterfaceFlags -> bmInterlaceFlags
  UPSTREAM: usb: gadget: uvc: default the ctrl request interface offsets
  ANDROID: KVM: arm64: Restore host FP state before SMCs
  ANDROID: KVM: arm64: Finalise EL2 state from pKVM PSCI relay
  ANDROID: KVM: arm64: Use sanitized values in __check_override in nVHE
  ANDROID: KVM: arm64: Introduce finalise_el2_state macro
  ANDROID: KVM: arm64: Provide sanitized SYS_ID_AA64SMFR0_EL1 to nVHE
  ...

Change-Id: Iaab72a684060d893f154a39fe51e983fc5033030
Signed-off-by: keystone-kernel-automerger <keystone-kernel-automerger@google.com>
2023-01-30 07:21:49 +00:00
Huang Yiwei
3e4fa5265c ANDROID: hung_task: Add vendor hook for hung task detect
Add vendor hook for hung task detect, so we can decide which
threads need to check, avoiding false alarms. And the NULL
tracehook is used to indicate one check cycle is finished, so
additional checks can be done after one hung task check cycle.

Bug: 188684133
Change-Id: I5d7dfeb071cbfda8121134c38a458202aaa3a8c6
Signed-off-by: Huang Yiwei <quic_hyiwei@quicinc.com>
2023-01-30 11:14:35 +08:00
Connor O'Brien
b5a5282ca9 ANDROID: GKI: defconfig: enable BTF debug info
Build BTF type info into the kernel to enable use of BPF-based tools
such as BCC's libbpf-tools.
By default, modules whose split BTF is inconsistent with vmlinux BTF
will fail to load, which can prevent loading compatible but separately
built modules. Instead, enable MODULE_ALLOW_BTF_MISMATCH to ignore
such modules' BTF rather than refusing to load the module.

Bug: 203823368
Bug: 218515241
Test: build
Signed-off-by: Connor O'Brien <connoro@google.com>
Change-Id: I8efaab5f1a5c6ad6e9e6ccf1e78088d81a880480
2023-01-27 17:49:15 +00:00
Carlos Llamas
f57409877f ANDROID: kbuild: fix build for DEBUG_INFO_BTF_MODULES
Upstream commit f73edc8951 ("kbuild: unify two modpost invocations")
adds 'vmlinux' as a Makefile rule dependency for the target 'modules'.
This rule is conditional on DEBUG_INFO_BTF_MODULES like so:

  ifdef CONFIG_DEBUG_INFO_BTF_MODULES
  modules: vmlinux
  endif

However, setting this option breaks android's mixed builds as an
out-of-tree patch skips the definition of the 'vmlinux' rule whenever
KBUILD_MIXED_TREE is set. For details on this approach see commit
ee1b16e80d ("ANDROID: Kbuild: Add support for KBUILD_MIXED_TREE").

Since kbuild is unable to find the 'vmlinux' binary or a rule to
generate it in this case, we hit the following build error:

  $ ./scripts/config -e DEBUG_INFO_BTF
  $ make olddefconfig
  $ KBUILD_MIXED_TREE=${path} make modules
  make[1]: *** No rule to make target 'vmlinux', needed by 'modules'.  Stop.
  make[1]: *** Waiting for unfinished jobs....

In order to fix this issue, lets pass the appropiate path to vmlinux by
prepending mixed-build-prefix. If KBUILD_MIXED_TREE is set, kbuild will
find the previously built 'vmlinux' and won't require a rule for it.

Bug: 266874587
Change-Id: I2290502b557f454187313a563e5477b05d37f3c4
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2023-01-27 17:49:15 +00:00
Vincent Donnefort
508af69a74 ANDROID: KVM: arm64: Add EL2 wakeup cause hyp events
To bring some visibility to what is causing the hypervisor to wakeup,
bring 3 new hypervisor events:

  * host issued HVC64 (host_hcall)
  * host issued SMC (host_smc)
  * host mem abort (host_mem_abort)

Bug: 229972309
Change-Id: I920ff7efa59b12b63bea4637ddd91b7cba614854
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-01-27 09:00:12 +00:00
Vincent Donnefort
72aaadc081 ANDROID: KVM: arm64: Add format file for nVHE hyp events
This format files is a copy paste of the one generated by host events in
order to keep the compatibility for userspace trace tools.

Bug: 229972309
Change-Id: I209e4b2780c104d64af6442bd7968c86b54819ae
Co-authored-By: Nikita Ioffe <ioffe@google.com>
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Nikita Ioffe <ioffe@google.com>
2023-01-27 09:00:12 +00:00
Vincent Donnefort
605d8f6940 ANDROID: KVM: arm64: add support for early enablement nVHE hyp events
Set hyp_event="event1,event2" in the commandline to start tracing as
soon as possible the nVHE hypervisor.

Bug: 229972309
Change-Id: I878e342a8758a78a01d6ddf26355020945b2df33
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-01-27 09:00:12 +00:00
Vincent Donnefort
346f750327 ANDROID: KVM: arm64: RAW interface to the nVHE hyp tracing
This interface intends to be used by userspace tools to store raw
version of events. In such case, the kernel does not decode anything.

Bug: 229972309
Change-Id: Ib1fca21a34a308ad1361240ef598033ecab3b4ad
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-01-27 09:00:12 +00:00
Vincent Donnefort
09014fb1f2 ANDROID: KVM: arm64: Add support for nVHE hyp events
Following the introduction of tracing buffers for the nVHE hypervisor,
add the support to declare in-hypervisor events.

Hypervisor events are declared into kvm_hypevents.h and can be called
with trace_<event_name>().

hyp_enter and hyp_exit events are provided as an example.

Bug: 229972309
Co-authored-By: Nikita Ioffe <ioffe@google.com>
Change-Id: I42d110fece793112d30530154aab49049b7fa520
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Nikita Ioffe <ioffe@google.com>
2023-01-27 09:00:12 +00:00
Vincent Donnefort
34305ad4b1 ANDROID: KVM: arm64: Add host support for the nVHE hyp tracing
Now the nVHE hypervisor can write into a ring buffer. Add some support
to start the tracing and stop it.

This comes with a simple userspace interface tracing_on and per-CPU:

  - trace.X: non-consuming read of the ring buffer.
  - trace_pipe.X: consuming read of the ring buffer.

The hypervisor support to declare and decode hyp events will be
introduced later.

Bug: 229972309
Change-Id: I803b1fae8aaa5920d24adc547a9b5cc1c83d77f1
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-01-27 09:00:12 +00:00
Vincent Donnefort
4c095252cf ANDROID: KVM: arm64: Add tracing support for the nVHE hyp
Running at EL2, the host has very close to no way to know what's
happening in the hypervisor, which is great from a security point of
view, a bit less when it turns to debug it. With the introduction of the
protected mode, this piece of code is getting more responsibilities,
which we would like to debug and profile, hence the need to trace
"things" that are happening in the hypervisor.

There's no way the hypervisor could log things directly into the host
tracing interface. So instead let's use a separated per-CPU ring buffer
compliant with the host so the latter can decode the events.

The tracing interface is composed of 4 HVCs:

 __pkvm_start_tracing: Gets a hyp_trace_pack describing the ring
buffers, the backing storage that'll support the internal structures and
some clock init values.

 __pkvm_stop_tracing: Disable writing to the ring buffers and teardown.

 __pkvm_rb_swap_reader_page: Request the writer to swap the head with
the reader page. This enables consuming read of the read buffer. See
kernel/ring_buffer.c (*ext_writer_swap_reader)() callback.

 __pkvm_rb_update_footers: Request the writer to update the pages
footers.  Those informations are then used to update the reader view on
the ring buffer. See kernel/ring_buffer.c (*ext_writer_update_footers)()
callback.

Bug: 229972309
Change-Id: I0e32223795de435aee8546af368672f0e67637b3
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-01-27 09:00:12 +00:00
Vincent Donnefort
022b2198fc ANDROID: KVM: arm64: Add clock support in the nVHE hyp
By default, the arm64 host kernel is using the arch timer as a source
for sched_clock. Conveniently, EL2 has access to that same counter,
allowing to generate clock values that are synchronized.

The clock needs nonetheless to be setup with the same slope values as
the kernel. Introducing at the same time trace_clock() which is expected
to be later configured by the hypervisor tracing.

Bug: 229972309
Change-Id: Icc560124e6b0879c8085b2eeb0b6123da907a7ae
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-01-27 09:00:12 +00:00
Vincent Donnefort
9b99000d9b ANDROID: timekeeping: Export the boot clock in snapshots
The boot clock is interesting for tracing purpose as it doesn't stop on
device suspend. Exporting it intends to let the nVHE hypervisor for the
arm64 architecture to "replicate" that clock and allow event
synchronization with the host. Replicating implies to know the current
slope.

Bug: 229972309
Change-Id: Iefb6ffc433dac82297401f9acdff9758cc1b6a89
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-01-27 09:00:12 +00:00
Vincent Donnefort
5ecbcb61e1 ANDROID: ring-buffer: Introducing external writer support
The ring buffer is convenient: it has a page granularity and its format
is already supported by userspace tools such as trace-cmd. It is a
natural solution to store events that would come from outside the kernel
such as a hypervisor.

In that case, where a writer is external to the kernel, the latter would
only be responsible for the allocation and to read back the ring buffer.

The allocation is done with the newly introduced function which just
needs a size and a set of callbacks (notice only the overwrite mode is
supported at the moment):

  ring_buffer_alloc_ext(unsigned long size,
                        struct ring_buffer_ext_cb *cb)

The callbacks given to this allocator enables communication with the
external writer:

  (*swap_reader)(int cpu):    Ask the writer to swap the current reader
                              page with the head.

  (*update_footers)(int cpu): Ask the writer to update material in the
                              page footers.

Each page from the ring buffer has indeed a footer in which statistics
and page status can be retrieved. This allows the kernel to update its
view on the ring buffer, following a reader page swap or a footers
update.

After the trace_buffer is allocated, a helper serializes the relevant
information into a structure that can be easily sent to the external
writer:

  trace_buffer_pack(struct trace_buffer *trace_buffer,
                    struct trace_buffer_pack *pack)

The footer and pack description can be found in the newly introduced
header file include/linux/ring_buffer_ext.h.

When the kernel is writing to the ring buffer, it can wake up quite
easily the reader. That's not the case when the writer is external. A
new function allows polling for reading the ring buffer:

  ring_buffer_poke(struct trace_buffer *buffer, int cpu)

A ring-buffer allocated for an external writer will forbid any writing
(the whole design of the ring buffer mandates a single writer) and will
also prevent extending or extracting pages.

When I presented this work to the tracingsummit, rosted@ told me he saw
some overlapping with an idea he had to enable him to map the tracing
buffers in userspace. We designed together a solution that would enable
both features. Problem now, if on one hand, the development of the new
design has started already... it would nonetheless impose a significant
revamp of this patchset, which wouldn't make it to Android14. Nothing
technically wrong with anything here, but sending it to LKML wouldn't
make sense, as I know already this isn't as "reusable" as the version
agreed upon.

Bug: 229972309
Change-Id: Iafcc1e2683a7460c94de3db116878c303601df64
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-01-27 09:00:12 +00:00
Vincent Donnefort
54c734c8ed ANDROID: ring-buffer: Expose buffer_data_page material
In preparation for allowing the write of ring-buffer compliant pages
outside of ring_buffer.c move to the header, struct buffer_data_page and
timestamp encoding functions.

When I presented this work to the tracingsummit, rosted@ told me he saw
some overlapping with an idea he had to enable him to map the tracing
buffers in userspace. We designed together a solution that would enable
both features. Problem now, if on one hand, the development of the new
design has started already... it would nonetheless impose a significant
revamp of this patchset, which wouldn't make it to Android14. Nothing
technically wrong with anything here, but sending it to LKML wouldn't
make sense, as I know already this isn't as "reusable" as the version
agreed upon.

Bug: 229972309
Change-Id: Icf3329bd899a3dd91279d1bbadaf2dc4e243455c
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-01-27 09:00:12 +00:00
Daniel Scally
2d1a2452a6 UPSTREAM: usb: gadget: uvc: Rename bmInterfaceFlags -> bmInterlaceFlags
In the specification documents for the Uncompressed and MJPEG USB
Video Payloads, the field name is bmInterlaceFlags - it has been
misnamed within the kernel.

Although renaming the field does break the kernel's interface to
userspace it should be low-risk in this instance. The field is read
only and hardcoded to 0, so there was never any value in anyone
reading it. A search of the uvc-gadget application and all the
forks that I could find for it did not reveal any users either.

Fixes: cdda479f15 ("USB gadget: video class function driver")
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com>
Link: https://lore.kernel.org/r/20221206161203.1562827-1-dan.scally@ideasonboard.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit 81c25247a2a03a0f97e4805d7aff7541ccff6baa)
Bug: 259171206
Change-Id: I95ad86d0c0ab097b215e1ef655beea80c2cdb570
Signed-off-by: Avichal Rakesh <arakesh@google.com>
(cherry picked from commit 4d8c2d84cbd51aa0ef6e1ec096a760ab8124092d)
2023-01-26 13:38:58 -08:00
Michael Grzeschik
4485bb8ca7 UPSTREAM: usb: gadget: uvc: default the ctrl request interface offsets
For the userspace it is needed to distinguish between requests for the
control or streaming interface. The userspace would have to parse the
configfs to know which interface index it has to compare the ctrl
requests against. Since the interface numbers are not fixed, e.g. for
composite gadgets, the interface offset depends on the setup.

The kernel has this information when handing over the ctrl request to
the userspace. This patch removes the offset from the interface numbers
and expose the default interface defines in the uapi g_uvc.h.

Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Link: https://lore.kernel.org/r/20221011075348.1786897-1-m.grzeschik@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit d182bf156c4cb8b08ce4a75e82b3357b14a4382d)
Bug: 259171206
Change-Id: Ie5978ef268731e67ca72940ce6fbc7f980cb4419
Signed-off-by: Avichal Rakesh <arakesh@google.com>
(cherry picked from commit 044c3865c6cdd5ae9e10e7c39ceea726e568a884)
2023-01-26 13:38:57 -08:00
Quentin Perret
b7d8bdc3bf ANDROID: KVM: arm64: Restore host FP state before SMCs
Nothing currently prevents a CPU suspend/resume cycle (for example)
while a vCPU is loaded under pKVM. The resume path will disable FP/SVE
traps, which may corrupt the guest FP state if it was in use when
suspend was issued.

To fix this issue and all related problems, proactively restore the host
FP state prior to handling SMCs form the host.

Bug: 266405428
Bug: 265901597
Change-Id: I75f7d18f81f17dfa323d3128d2c66769ef19c591
Signed-off-by: Quentin Perret <qperret@google.com>
2023-01-26 16:07:43 +00:00
Quentin Perret
2a74ce9201 ANDROID: KVM: arm64: Finalise EL2 state from pKVM PSCI relay
The EL2 state is not initialised correctly when a CPU comes out of
CPU_{SUSPEND,OFF} as the finalise_el2 function is not being called.
Let's directly call finalise_el2_state from this path to solve the
issue.

Bug: 266405428
Bug: 265901597
Change-Id: I60dfdc59b5ac54630308dd42c6a330aca20c0d3c
Signed-off-by: Quentin Perret <qperret@google.com>
2023-01-26 16:07:43 +00:00
Quentin Perret
df602cf027 ANDROID: KVM: arm64: Use sanitized values in __check_override in nVHE
The nVHE EL2 code has access to sanitized values of certain idregs, so
use them directly from __check_override instead of the *_override
variants.

Bug: 266405428
Bug: 265901597
Change-Id: Ib2655d3bca805b6ff5825d04e0094df6b7ff4ced
Signed-off-by: Quentin Perret <qperret@google.com>
2023-01-26 16:07:43 +00:00
Quentin Perret
aa60a2611e ANDROID: KVM: arm64: Introduce finalise_el2_state macro
Factor out the first half of the finalise_el2 function into a macro to
allow its reuse from the nVHE PSCI relay code. While at it, make the
register allocation parametric for the check_override macros as they are
now more widely exposed.

No functional changes intended.

Bug: 266405428
Bug: 265901597
Change-Id: I77cb9e7c54a8a2c130a173f1e30ba4b317262858
Signed-off-by: Quentin Perret <qperret@google.com>
2023-01-26 16:07:43 +00:00
Quentin Perret
6bf3e067a8 ANDROID: KVM: arm64: Provide sanitized SYS_ID_AA64SMFR0_EL1 to nVHE
We will need a sanitized copy of SYS_ID_AA64SMFR0_EL1 from the nVHE EL2
code shortly, so make sure to provide it with a copy.

Bug: 266405428
Bug: 265901597
Change-Id: Ief25545c8d79bf2913eb2a6f8302bbbc35bef8b0
Signed-off-by: Quentin Perret <qperret@google.com>
2023-01-26 16:07:43 +00:00
Greg Kroah-Hartman
ee921ef7b4 Merge 6.1.8 into android14-6.1
Changes in 6.1.8
	dma-buf: fix dma_buf_export init order v2
	btrfs: fix trace event name typo for FLUSH_DELAYED_REFS
	wifi: iwlwifi: fw: skip PPAG for JF
	pNFS/filelayout: Fix coalescing test for single DS
	selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID
	net: ethernet: marvell: octeontx2: Fix uninitialized variable warning
	tools/virtio: initialize spinlocks in vring_test.c
	vdpa/mlx5: Return error on vlan ctrl commands if not supported
	vdpa/mlx5: Avoid using reslock in event_handler
	vdpa/mlx5: Avoid overwriting CVQ iotlb
	virtio_pci: modify ENOENT to EINVAL
	vduse: Validate vq_num in vduse_validate_config()
	vdpa_sim_net: should not drop the multicast/broadcast packet
	net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats
	r8169: move rtl_wol_enable_rx() and rtl_prepare_power_down()
	r8169: fix dmar pte write access is not set error
	bpf: keep a reference to the mm, in case the task is dead.
	RDMA/srp: Move large values to a new enum for gcc13
	selftests: net: fix cmsg_so_mark.sh test hang
	btrfs: always report error in run_one_delayed_ref()
	x86/asm: Fix an assembler warning with current binutils
	f2fs: let's avoid panic if extent_tree is not created
	perf/x86/rapl: Treat Tigerlake like Icelake
	cifs: fix race in assemble_neg_contexts()
	memblock tests: Fix compilation error.
	perf/x86/rapl: Add support for Intel Meteor Lake
	perf/x86/rapl: Add support for Intel Emerald Rapids
	of: fdt: Honor CONFIG_CMDLINE* even without /chosen node, take 2
	fbdev: omapfb: avoid stack overflow warning
	Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2
	Bluetooth: hci_qca: Fix driver shutdown on closed serdev
	wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices
	wifi: mac80211: fix MLO + AP_VLAN check
	wifi: mac80211: reset multiple BSSID options in stop_ap()
	wifi: mac80211: sdata can be NULL during AMPDU start
	wifi: mac80211: fix initialization of rx->link and rx->link_sta
	nommu: fix memory leak in do_mmap() error path
	nommu: fix do_munmap() error path
	nommu: fix split_vma() map_count error
	proc: fix PIE proc-empty-vm, proc-pid-vm tests
	Add exception protection processing for vd in axi_chan_handle_err function
	LoongArch: Add HWCAP_LOONGARCH_CPUCFG to elf_hwcap
	zonefs: Detect append writes at invalid locations
	nilfs2: fix general protection fault in nilfs_btree_insert()
	mm/shmem: restore SHMEM_HUGE_DENY precedence over MADV_COLLAPSE
	hugetlb: unshare some PMDs when splitting VMAs
	mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma
	serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler
	Revert "serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler"
	xhci-pci: set the dma max_seg_size
	usb: xhci: Check endpoint is valid before dereferencing it
	xhci: Fix null pointer dereference when host dies
	xhci: Add update_hub_device override for PCI xHCI hosts
	xhci: Add a flag to disable USB3 lpm on a xhci root port level.
	usb: acpi: add helper to check port lpm capability using acpi _DSM
	xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables
	prlimit: do_prlimit needs to have a speculation check
	USB: serial: option: add Quectel EM05-G (GR) modem
	USB: serial: option: add Quectel EM05-G (CS) modem
	USB: serial: option: add Quectel EM05-G (RS) modem
	USB: serial: option: add Quectel EC200U modem
	USB: serial: option: add Quectel EM05CN (SG) modem
	USB: serial: option: add Quectel EM05CN modem
	staging: vchiq_arm: fix enum vchiq_status return types
	USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100
	usb: misc: onboard_hub: Invert driver registration order
	usb: misc: onboard_hub: Move 'attach' work to the driver
	misc: fastrpc: Fix use-after-free and race in fastrpc_map_find
	misc: fastrpc: Don't remove map on creater_process and device_release
	misc: fastrpc: Fix use-after-free race condition for maps
	usb: core: hub: disable autosuspend for TI TUSB8041
	comedi: adv_pci1760: Fix PWM instruction handling
	ACPI: PRM: Check whether EFI runtime is available
	mmc: sunxi-mmc: Fix clock refcount imbalance during unbind
	mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting
	mm/hugetlb: fix PTE marker handling in hugetlb_change_protection()
	mm/hugetlb: fix uffd-wp handling for migration entries in hugetlb_change_protection()
	mm/hugetlb: pre-allocate pgtable pages for uffd wr-protects
	mm/userfaultfd: enable writenotify while userfaultfd-wp is enabled for a VMA
	mm/MADV_COLLAPSE: don't expand collapse when vm_end is past requested end
	btrfs: add extra error messages to cover non-ENOMEM errors from device_add_list()
	btrfs: fix missing error handling when logging directory items
	btrfs: fix directory logging due to race with concurrent index key deletion
	btrfs: add missing setup of log for full commit at add_conflicting_inode()
	btrfs: do not abort transaction on failure to write log tree when syncing log
	btrfs: do not abort transaction on failure to update log root
	btrfs: qgroup: do not warn on record without old_roots populated
	btrfs: fix invalid leaf access due to inline extent during lseek
	btrfs: fix race between quota rescan and disable leading to NULL pointer deref
	cifs: do not include page data when checking signature
	thunderbolt: Disable XDomain lane 1 only in software connection manager
	thunderbolt: Use correct function to calculate maximum USB3 link rate
	thunderbolt: Do not report errors if on-board retimers are found
	thunderbolt: Do not call PM runtime functions in tb_retimer_scan()
	riscv: dts: sifive: fu740: fix size of pcie 32bit memory
	bpf: restore the ebpf program ID for BPF_AUDIT_UNLOAD and PERF_BPF_EVENT_PROG_UNLOAD
	tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
	tty: fix possible null-ptr-defer in spk_ttyio_release
	pktcdvd: check for NULL returna fter calling bio_split_to_limits()
	io_uring/poll: don't reissue in case of poll race on multishot request
	mptcp: explicitly specify sock family at subflow creation time
	mptcp: netlink: respect v4/v6-only sockets
	selftests: mptcp: userspace: validate v4-v6 subflows mix
	USB: gadgetfs: Fix race between mounting and unmounting
	USB: serial: cp210x: add SCALANCE LPE-9000 device id
	usb: cdns3: remove fetched trb from cache before dequeuing
	usb: host: ehci-fsl: Fix module alias
	usb: musb: fix error return code in omap2430_probe()
	usb: typec: tcpm: Fix altmode re-registration causes sysfs create fail
	usb: typec: altmodes/displayport: Add pin assignment helper
	usb: typec: altmodes/displayport: Fix pin assignment calculation
	usb: gadget: g_webcam: Send color matching descriptor per frame
	USB: gadget: Add ID numbers to configfs-gadget driver names
	usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
	usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210
	arm64: dts: imx8mp: correct usb clocks
	dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation
	dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation
	serial: pch_uart: Pass correct sg to dma_unmap_sg()
	dmaengine: lgm: Move DT parsing after initialization
	dmaengine: tegra210-adma: fix global intr clear
	dmaengine: idxd: Let probe fail when workqueue cannot be enabled
	dmaengine: idxd: Prevent use after free on completion memory
	dmaengine: idxd: Do not call DMX TX callbacks during workqueue disable
	serial: amba-pl011: fix high priority character transmission in rs486 mode
	serial: atmel: fix incorrect baudrate setup
	serial: exar: Add support for Sealevel 7xxxC serial cards
	gsmi: fix null-deref in gsmi_get_variable
	mei: bus: fix unlink on bus in error path
	mei: me: add meteor lake point M DID
	VMCI: Use threaded irqs instead of tasklets
	ARM: dts: qcom: apq8084-ifc6540: fix overriding SDHCI
	ARM: omap1: fix !ARCH_OMAP1_ANY link failures
	drm/amdgpu: fix amdgpu_job_free_resources v2
	drm/amdgpu: allow multipipe policy on ASICs with one MEC
	drm/amdgpu: Correct the power calcultion for Renior/Cezanne.
	drm/i915: re-disable RC6p on Sandy Bridge
	drm/i915/display: Check source height is > 0
	drm/i915: Allow switching away via vga-switcheroo if uninitialized
	drm/i915: Remove unused variable
	drm/amd/display: Fix set scaling doesn's work
	drm/amd/display: Calculate output_color_space after pixel encoding adjustment
	drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix
	drm/amd/display: disable S/G display on DCN 3.1.5
	drm/amd/display: disable S/G display on DCN 3.1.4
	cifs: reduce roundtrips on create/qinfo requests
	fs/ntfs3: Fix attr_punch_hole() null pointer derenference
	arm64: efi: Execute runtime services from a dedicated stack
	efi: rt-wrapper: Add missing include
	panic: Separate sysctl logic from CONFIG_SMP
	exit: Put an upper limit on how often we can oops
	exit: Expose "oops_count" to sysfs
	exit: Allow oops_limit to be disabled
	panic: Consolidate open-coded panic_on_warn checks
	panic: Introduce warn_limit
	panic: Expose "warn_count" to sysfs
	docs: Fix path paste-o for /sys/kernel/warn_count
	exit: Use READ_ONCE() for all oops/warn limit reads
	x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN
	drm/amdgpu/discovery: enable soc21 common for GC 11.0.4
	drm/amdgpu/discovery: enable gmc v11 for GC 11.0.4
	drm/amdgpu/discovery: enable gfx v11 for GC 11.0.4
	drm/amdgpu/discovery: enable mes support for GC v11.0.4
	drm/amdgpu: set GC 11.0.4 family
	drm/amdgpu/discovery: set the APU flag for GC 11.0.4
	drm/amdgpu: add gfx support for GC 11.0.4
	drm/amdgpu: add gmc v11 support for GC 11.0.4
	drm/amdgpu/discovery: add PSP IP v13.0.11 support
	drm/amdgpu/pm: enable swsmu for SMU IP v13.0.11
	drm/amdgpu: add smu 13 support for smu 13.0.11
	drm/amdgpu/pm: add GFXOFF control IP version check for SMU IP v13.0.11
	drm/amdgpu/soc21: add mode2 asic reset for SMU IP v13.0.11
	drm/amdgpu/pm: use the specific mailbox registers only for SMU IP v13.0.4
	drm/amdgpu/discovery: enable nbio support for NBIO v7.7.1
	drm/amdgpu: enable PSP IP v13.0.11 support
	drm/amdgpu: enable GFX IP v11.0.4 CG support
	drm/amdgpu: enable GFX Power Gating for GC IP v11.0.4
	drm/amdgpu: enable GFX Clock Gating control for GC IP v11.0.4
	drm/amdgpu: add tmz support for GC 11.0.1
	drm/amdgpu: add tmz support for GC IP v11.0.4
	drm/amdgpu: correct MEC number for gfx11 APUs
	octeontx2-pf: Avoid use of GFP_KERNEL in atomic context
	net/ulp: use consistent error code when blocking ULP
	octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt
	net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work()
	block: mq-deadline: Rename deadline_is_seq_writes()
	Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()"
	soc: qcom: apr: Make qcom,protection-domain optional again
	Linux 6.1.8

Change-Id: I35d5b5a1ed4822eddb2fc8b29b323b36f7d11926
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-01-26 12:13:04 +00:00
Vincent Donnefort
39176c9df0 ANDROID: KVM: arm64: Fix PKVM_PAGE_RESTRICTED_PROT conflict
Currently, PKVM_PAGE_RESTRICTED_PROT == __PKVM_PAGE_RESERVED + 2, i.e.
BIT(55) | BIT(56) | BIT(1). IOW, It is not possible to distinguish
RESTRICTED from ownership.

Make PKVM_PAGE_RESTRICTED_PROT the second bit of pkvm_page_state so it
can be combined with the ownership status.

Bug: 244543039
Bug: 244373730
Change-Id: Iee9b84d4f07fca323b35e2d7da54f3657ae2cff9
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-01-26 10:20:18 +00:00
Yu-Li Lin
94b7bd9337 ANDROID: gki_defconfig: disable various x86 and hw flags
merge in various disabled flags from arcvm defconfig: CONFIG_MTRR_SANITIZER,
CONFIG_MICROCODE, CONFIG_UID16, CONFIG_PCSPKR_PLATFORM, CONFIG_ACPI_AC,
CONFIG_ACPI_BATTERY, CONFIG_ACPI_FAN, CONFIG_ACPI_THERMAL, CONFIG_X86_PM_TIMER,
CONFIG_X86_5LEVEL, CONFIG_HW_RANDOM_VIA, CONFIG_RTC_HCTOSYS

Bug: 266251235
Change-Id: Id818e385a8c5a6d58854bf16a8444b1fd959c24e
Signed-off-by: Yu-Li Lin <yulilin@google.com>
2023-01-25 21:22:26 +00:00
Keir Fraser
63a0caecc9 Revert "ANDROID: arm64: Register earlycon fixmap with the MMIO guard"
Reason for revert:
MMIO guard is initialised too late for earlycon, so the fixup is
a waste of time.

Signed-off-by: Keir Fraser <keirf@google.com>
Bug: 259645922
Change-Id: Iace214f7140baf073cfa5cef1ee65fca9e4a76d0
2023-01-25 11:38:05 +00:00
Keir Fraser
f71661a707 ANDROID: KVM: arm64: Include MMIO guard and memory relinquish in top-level hypercalls doc
This introduces a description of the MEM_RELINQUISH hypercall. MMIO
guard hypercalls are already described in another file, which we now
link to.

Signed-off-by: Keir Fraser <keirf@google.com>
Bug: 265943840
Change-Id: Iaffde3419f6432d76598e48c9bab53f672430b7a
2023-01-25 07:52:02 +00:00
Keir Fraser
eaebecf53e ANDROID: KVM: arm64: Fix MMIO guard documentation
Firstly, the hypercall IDs have been renumbered but that was not
reflected in the documentation. Secondly, the argument registers r1-r3
are checked to be zero when calling
ARM_SMCCC_KVM_FUNC_MMIO_GUARD_INFO.

Signed-off-by: Keir Fraser <keirf@google.com>
Bug: 265943840
Change-Id: I9684d1e71af7d8627d079cfd89d437cfc28be09f
2023-01-25 07:52:02 +00:00
Keir Fraser
dc6c680327 ANDROID: KVM: arm64: Consistent hypercall naming in documentation
Change a few uses of ARM_SMCCC_VENDOR_HYP_KVM_FOO_FUNC_ID to
ARM_SMCCC_KVM_FUNC_FOO.

Signed-off-by: Keir Fraser <keirf@google.com>
Bug: 265943840
Change-Id: Id1642243ca4105a23e808cf28d13bfb81d9a5ac2
2023-01-25 07:52:02 +00:00
keystone-kernel-automerger
99ead56aa3 Merge remote-tracking branch into HEAD
* keystone/mirror-android14-6.1:
  ANDROID: gki_defconfig: sample large page_alloc allocations with HW_TAGS KASAN
  FROMLIST: kasan: reset page tags properly with sampling
  FROMGIT: kasan: allow sampling page_alloc allocations for HW_TAGS
  Revert "FROMLIST: kasan: allow sampling page_alloc allocations for HW_TAGS"
  Revert "ANDROID: gki_defconfig: sample large page_alloc allocations with HW_TAGS KASAN"

Change-Id: Ibd436c19d66bab471e684cfa5827f777d592fbf8
Signed-off-by: keystone-kernel-automerger <keystone-kernel-automerger@google.com>
2023-01-25 07:21:28 +00:00
Andrey Konovalov
5749a9d6ba ANDROID: gki_defconfig: sample large page_alloc allocations with HW_TAGS KASAN
Add kasan.page_alloc.sample=10 to CONFIG_CMDLINE in gki_defconfig to make
Hardware Tag-Based (MTE) KASAN tag only one out of every 10 page_alloc
allocations with the order equal or larger than 3, which the omitted
default value for the kasan.page_alloc.sample.order parameter.

As Hardware Tag-Based KASAN is intended to be used in production, its
performance impact is crucial. As page_alloc allocations tend to be big,
tagging and checking all such allocations can introduce a significant
slowdown.

When running a local loopback test on a testing MTE-enabled device in sync
mode, enabling Hardware Tag-Based KASAN introduces a ~50% slowdown.
Setting kasan.page_alloc.sampling to a value higher than 1 allows to lower
the slowdown. The performance improvement saturates around the sampling
interval value of 10 with the default sampling page order of 3, see
b/238286329. This lowers the slowdown to ~20%.  The slowdown in real
scenarios involving the network will likely be better.

Enabling page_alloc sampling has a downside: KASAN misses bad accesses to
a page_alloc allocation that has not been tagged. This lowers the value
of KASAN as a security mitigation.

However, based on measuring the number of page_alloc allocations of
different orders during boot in a test build, sampling with the default
kasan.page_alloc.sample.order value affects only ~7% of allocations. The
rest ~93% of allocations are still checked deterministically.

Bug: 238286329
Bug: 264310057
Change-Id: Id361822b8bbf929378cabbe0350b658d6120e840
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
2023-01-25 00:07:35 +01:00
Andrey Konovalov
9f7f5a25f3 FROMLIST: kasan: reset page tags properly with sampling
[The patch is in the mm-unstable tree.]

The implementation of page_alloc poisoning sampling assumed that
tag_clear_highpage resets page tags for __GFP_ZEROTAGS allocations.
However, this is no longer the case since commit 70c248aca9
("mm: kasan: Skip unpoisoning of user pages").

This leads to kernel crashes when MTE-enabled userspace mappings are
used with Hardware Tag-Based KASAN enabled.

Reset page tags for __GFP_ZEROTAGS allocations in post_alloc_hook().

Also clarify and fix related comments.

Fixes: 44383cef54c0 ("kasan: allow sampling page_alloc allocations for HW_TAGS")
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reported-by: Peter Collingbourne <pcc@google.com>
Tested-by: Peter Collingbourne <pcc@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Marco Elver <elver@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Bug: 238286329
Bug: 264310057
Link: https://lore.kernel.org/all/5dbd866714b4839069e2d8469ac45b60953db290.1674592780.git.andreyknvl@google.com/
Change-Id: Iea4234bcf7e35337c8063827b07039583bca9c66
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
2023-01-25 00:06:38 +01:00
Andrey Konovalov
5b43ea3757 FROMGIT: kasan: allow sampling page_alloc allocations for HW_TAGS
[The patch is in mm-stable tree.]

As Hardware Tag-Based KASAN is intended to be used in production, its
performance impact is crucial.  As page_alloc allocations tend to be big,
tagging and checking all such allocations can introduce a significant
slowdown.

Add two new boot parameters that allow to alleviate that slowdown:

- kasan.page_alloc.sample, which makes Hardware Tag-Based KASAN tag only
  every Nth page_alloc allocation with the order configured by the second
  added parameter (default: tag every such allocation).

- kasan.page_alloc.sample.order, which makes sampling enabled by the first
  parameter only affect page_alloc allocations with the order equal or
  greater than the specified value (default: 3, see below).

The exact performance improvement caused by using the new parameters
depends on their values and the applied workload.

The chosen default value for kasan.page_alloc.sample.order is 3, which
matches both PAGE_ALLOC_COSTLY_ORDER and SKB_FRAG_PAGE_ORDER.  This is
done for two reasons:

1. PAGE_ALLOC_COSTLY_ORDER is "the order at which allocations are deemed
   costly to service", which corresponds to the idea that only large and
   thus costly allocations are supposed to sampled.

2. One of the workloads targeted by this patch is a benchmark that sends
   a large amount of data over a local loopback connection. Most multi-page
   data allocations in the networking subsystem have the order of
   SKB_FRAG_PAGE_ORDER (or PAGE_ALLOC_COSTLY_ORDER).

When running a local loopback test on a testing MTE-enabled device in sync
mode, enabling Hardware Tag-Based KASAN introduces a ~50% slowdown.
Applying this patch and setting kasan.page_alloc.sampling to a value
higher than 1 allows to lower the slowdown.  The performance improvement
saturates around the sampling interval value of 10 with the default
sampling page order of 3.  This lowers the slowdown to ~20%.  The slowdown
in real scenarios involving the network will likely be better.

Enabling page_alloc sampling has a downside: KASAN misses bad accesses to
a page_alloc allocation that has not been tagged.  This lowers the value
of KASAN as a security mitigation.

However, based on measuring the number of page_alloc allocations of
different orders during boot in a test build, sampling with the default
kasan.page_alloc.sample.order value affects only ~7% of allocations.  The
rest ~93% of allocations are still checked deterministically.

Link: https://lkml.kernel.org/r/129da0614123bb85ed4dd61ae30842b2dd7c903f.1671471846.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Marco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Jann Horn <jannh@google.com>
Cc: Mark Brand <markbrand@google.com>
Cc: Peter Collingbourne <pcc@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Bug: 238286329
Bug: 264310057
(cherry picked from commit 44383cef54c0ce1201f884d83cc2b367bc5aa4f7 git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-stable)
Change-Id: I85f9eb4e93eeddff8f8d06238f433226affca177
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
2023-01-25 00:06:37 +01:00
Greg Kroah-Hartman
93f875a852 Linux 6.1.8
Link: https://lore.kernel.org/r/20230122150246.321043584@linuxfoundation.org
Tested-by: Ronald Warsow <rwarsow@gmx.de>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
Tested-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Tested-by: Rudi Heitbaum <rudi@heitbaum.com>
Tested-by: Conor Dooley <conor.dooley@microchip.com>
Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
Tested-by: Fenil Jain <fkjainco@gmail.com>
Tested-by: Ron Economos <re@w6rz.net>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Link: https://lore.kernel.org/r/20230123094931.568794202@linuxfoundation.org
Tested-by: Rudi Heitbaum <rudi@heitbaum.com>
Tested-by: Ronald Warsow <rwarsow@gmx.de>
Tested-by: Allen Pais <apais@linux.microsoft.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
Tested-by: Kelsey Steele <kelseysteele@linux.microsoft.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-24 07:24:44 +01:00
Stephan Gerhold
ebb677d219 soc: qcom: apr: Make qcom,protection-domain optional again
commit 599d41fb8ea8bd2a99ca9525dd69405020e43dda upstream.

APR should not fail if the service device tree node does not have
the qcom,protection-domain property, since this functionality does
not exist on older platforms such as MSM8916 and MSM8996.

Ignore -EINVAL (returned when the property does not exist) to fix
a regression on 6.2-rc1 that prevents audio from working:

  qcom,apr remoteproc0:smd-edge.apr_audio_svc.-1.-1:
    Failed to read second value of qcom,protection-domain
  qcom,apr remoteproc0:smd-edge.apr_audio_svc.-1.-1:
    Failed to add apr 3 svc

Fixes: 6d7860f5750d ("soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index")
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221229151648.19839-3-stephan@gerhold.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-24 07:24:44 +01:00
Eric Dumazet
effecd8d11 Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()"
commit 80f8a66dede0a4b4e9e846765a97809c6fe49ce5 upstream.

This reverts commit 13e5afd3d773c6fc6ca2b89027befaaaa1ea7293.

ieee80211_if_free() is already called from free_netdev(ndev)
because ndev->priv_destructor == ieee80211_if_free

syzbot reported:

general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
CPU: 0 PID: 10041 Comm: syz-executor.0 Not tainted 6.2.0-rc2-syzkaller-00388-g55b98837e37d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:pcpu_get_page_chunk mm/percpu.c:262 [inline]
RIP: 0010:pcpu_chunk_addr_search mm/percpu.c:1619 [inline]
RIP: 0010:free_percpu mm/percpu.c:2271 [inline]
RIP: 0010:free_percpu+0x186/0x10f0 mm/percpu.c:2254
Code: 80 3c 02 00 0f 85 f5 0e 00 00 48 8b 3b 48 01 ef e8 cf b3 0b 00 48 ba 00 00 00 00 00 fc ff df 48 8d 78 20 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 3b 0e 00 00 48 8b 58 20 48 b8 00 00 00 00 00 fc
RSP: 0018:ffffc90004ba7068 EFLAGS: 00010002
RAX: 0000000000000000 RBX: ffff88823ffe2b80 RCX: 0000000000000004
RDX: dffffc0000000000 RSI: ffffffff81c1f4e7 RDI: 0000000000000020
RBP: ffffe8fffe8fc220 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 1ffffffff2179ab2 R12: ffff8880b983d000
R13: 0000000000000003 R14: 0000607f450fc220 R15: ffff88823ffe2988
FS: 00007fcb349de700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32220000 CR3: 000000004914f000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
netdev_run_todo+0x6bf/0x1100 net/core/dev.c:10352
ieee80211_register_hw+0x2663/0x4040 net/mac80211/main.c:1411
mac80211_hwsim_new_radio+0x2537/0x4d80 drivers/net/wireless/mac80211_hwsim.c:4583
hwsim_new_radio_nl+0xa09/0x10f0 drivers/net/wireless/mac80211_hwsim.c:5176
genl_family_rcv_msg_doit.isra.0+0x1e6/0x2d0 net/netlink/genetlink.c:968
genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
genl_rcv_msg+0x4ff/0x7e0 net/netlink/genetlink.c:1065
netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2564
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline]
netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1356
netlink_sendmsg+0x91b/0xe10 net/netlink/af_netlink.c:1932
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xd3/0x120 net/socket.c:734
____sys_sendmsg+0x712/0x8c0 net/socket.c:2476
___sys_sendmsg+0x110/0x1b0 net/socket.c:2530
__sys_sendmsg+0xf7/0x1c0 net/socket.c:2559
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Reported-by: syzbot <syzkaller@googlegroups.com>
Fixes: 13e5afd3d773 ("wifi: mac80211: fix memory leak in ieee80211_if_add()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Zhengchao Shao <shaozhengchao@huawei.com>
Cc: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230113124326.3533978-1-edumazet@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-24 07:24:44 +01:00
Damien Le Moal
fa6357de7c block: mq-deadline: Rename deadline_is_seq_writes()
commit 3692fec8bb476e8583e559ff5783a6adef306cf2 upstream.

Rename deadline_is_seq_writes() to deadline_is_seq_write() (remove the
"s" plural) to more correctly reflect the fact that this function tests
a single request, not multiple requests.

Fixes: 015d02f48537 ("block: mq-deadline: Do not break sequential write streams to zoned HDDs")
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Link: https://lore.kernel.org/r/20221126025550.967914-2-damien.lemoal@opensource.wdc.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-24 07:24:44 +01:00
Yang Yingliang
5a69eccf56 net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work()
commit 90e7cb78b81543998217b0eb446c067ce2191a79 upstream.

Add missing mutex_unlock() before returning from
mlx5_fw_fatal_reporter_err_work().

Fixes: 9078e843efec ("net/mlx5: Avoid recovery in probe flows")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Shay Drory <shayd@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-24 07:24:44 +01:00
Kevin Hao
659518e013 octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt
commit 55ba18dc62deff5910c0fa64486dea1ff20832ff upstream.

The commit 4af1b64f80fb ("octeontx2-pf: Fix lmtst ID used in aura
free") uses the get/put_cpu() to protect the usage of percpu pointer
in ->aura_freeptr() callback, but it also unnecessarily disable the
preemption for the blockable memory allocation. The commit 87b93b678e95
("octeontx2-pf: Avoid use of GFP_KERNEL in atomic context") tried to
fix these sleep inside atomic warnings. But it only fix the one for
the non-rt kernel. For the rt kernel, we still get the similar warnings
like below.
  BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46
  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0
  preempt_count: 1, expected: 0
  RCU nest depth: 0, expected: 0
  3 locks held by swapper/0/1:
   #0: ffff800009fc5fe8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x24/0x30
   #1: ffff000100c276c0 (&mbox->lock){+.+.}-{3:3}, at: otx2_init_hw_resources+0x8c/0x3a4
   #2: ffffffbfef6537e0 (&cpu_rcache->lock){+.+.}-{2:2}, at: alloc_iova_fast+0x1ac/0x2ac
  Preemption disabled at:
  [<ffff800008b1908c>] otx2_rq_aura_pool_init+0x14c/0x284
  CPU: 20 PID: 1 Comm: swapper/0 Tainted: G        W          6.2.0-rc3-rt1-yocto-preempt-rt #1
  Hardware name: Marvell OcteonTX CN96XX board (DT)
  Call trace:
   dump_backtrace.part.0+0xe8/0xf4
   show_stack+0x20/0x30
   dump_stack_lvl+0x9c/0xd8
   dump_stack+0x18/0x34
   __might_resched+0x188/0x224
   rt_spin_lock+0x64/0x110
   alloc_iova_fast+0x1ac/0x2ac
   iommu_dma_alloc_iova+0xd4/0x110
   __iommu_dma_map+0x80/0x144
   iommu_dma_map_page+0xe8/0x260
   dma_map_page_attrs+0xb4/0xc0
   __otx2_alloc_rbuf+0x90/0x150
   otx2_rq_aura_pool_init+0x1c8/0x284
   otx2_init_hw_resources+0xe4/0x3a4
   otx2_open+0xf0/0x610
   __dev_open+0x104/0x224
   __dev_change_flags+0x1e4/0x274
   dev_change_flags+0x2c/0x7c
   ic_open_devs+0x124/0x2f8
   ip_auto_config+0x180/0x42c
   do_one_initcall+0x90/0x4dc
   do_basic_setup+0x10c/0x14c
   kernel_init_freeable+0x10c/0x13c
   kernel_init+0x2c/0x140
   ret_from_fork+0x10/0x20

Of course, we can shuffle the get/put_cpu() to only wrap the invocation
of ->aura_freeptr() as what commit 87b93b678e95 does. But there are only
two ->aura_freeptr() callbacks, otx2_aura_freeptr() and
cn10k_aura_freeptr(). There is no usage of perpcu variable in the
otx2_aura_freeptr() at all, so the get/put_cpu() seems redundant to it.
We can move the get/put_cpu() into the corresponding callback which
really has the percpu variable usage and avoid the sprinkling of
get/put_cpu() in several places.

Fixes: 4af1b64f80fb ("octeontx2-pf: Fix lmtst ID used in aura free")
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Link: https://lore.kernel.org/r/20230118071300.3271125-1-haokexin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-24 07:24:43 +01:00
Paolo Abeni
ddb98087bd net/ulp: use consistent error code when blocking ULP
commit 8ccc99362b60c6f27bb46f36fdaaccf4ef0303de upstream.

The referenced commit changed the error code returned by the kernel
when preventing a non-established socket from attaching the ktls
ULP. Before to such a commit, the user-space got ENOTCONN instead
of EINVAL.

The existing self-tests depend on such error code, and the change
caused a failure:

  RUN           global.non_established ...
 tls.c:1673:non_established:Expected errno (22) == ENOTCONN (107)
 non_established: Test failed at step #3
          FAIL  global.non_established

In the unlikely event existing applications do the same, address
the issue by restoring the prior error code in the above scenario.

Note that the only other ULP performing similar checks at init
time - smc_ulp_ops - also fails with ENOTCONN when trying to attach
the ULP to a non-established socket.

Reported-by: Sabrina Dubroca <sd@queasysnail.net>
Fixes: 2c02d41d71f9 ("net/ulp: prevent ULP without clone op from entering the LISTEN status")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://lore.kernel.org/r/7bb199e7a93317fb6f8bf8b9b2dc71c18f337cde.1674042685.git.pabeni@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-24 07:24:43 +01:00
Geetha sowjanya
1eb57b87f1 octeontx2-pf: Avoid use of GFP_KERNEL in atomic context
commit 87b93b678e95c7d93fe6a55b0e0fbda26d8c7760 upstream.

Using GFP_KERNEL in preemption disable context, causing below warning
when CONFIG_DEBUG_ATOMIC_SLEEP is enabled.

[   32.542271] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274
[   32.550883] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0
[   32.558707] preempt_count: 1, expected: 0
[   32.562710] RCU nest depth: 0, expected: 0
[   32.566800] CPU: 3 PID: 1 Comm: swapper/0 Tainted: G        W          6.2.0-rc2-00269-gae9dcb91c606 #7
[   32.576188] Hardware name: Marvell CN106XX board (DT)
[   32.581232] Call trace:
[   32.583670]  dump_backtrace.part.0+0xe0/0xf0
[   32.587937]  show_stack+0x18/0x30
[   32.591245]  dump_stack_lvl+0x68/0x84
[   32.594900]  dump_stack+0x18/0x34
[   32.598206]  __might_resched+0x12c/0x160
[   32.602122]  __might_sleep+0x48/0xa0
[   32.605689]  __kmem_cache_alloc_node+0x2b8/0x2e0
[   32.610301]  __kmalloc+0x58/0x190
[   32.613610]  otx2_sq_aura_pool_init+0x1a8/0x314
[   32.618134]  otx2_open+0x1d4/0x9d0

To avoid use of GFP_ATOMIC for memory allocation, disable preemption
after all memory allocation is done.

Fixes: 4af1b64f80fb ("octeontx2-pf: Fix lmtst ID used in aura free")
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
Signed-off-by: Sunil Kovvuri Goutham <sgoutham@marvell.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-24 07:24:43 +01:00
Lang Yu
6da17ac15e drm/amdgpu: correct MEC number for gfx11 APUs
commit 0ddadc3a2208aedb1b27dbb76d0b4e722b5b527a upstream.

There is only one MEC on these APUs.

Signed-off-by: Lang Yu <Lang.Yu@amd.com>
Reviewed-by: Aaron Liu <aaron.liu@amd.com>
Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org # 6.1.x
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-24 07:24:43 +01:00
Tim Huang
40a66b6ca4 drm/amdgpu: add tmz support for GC IP v11.0.4
commit 2aecbe492a3c0bf4c21f78c099a6f6c205fab0c7 upstream.

Add tmz support for GC 11.0.4.

Signed-off-by: Tim Huang <tim.huang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-24 07:24:43 +01:00
Yifan Zhang
a63bd0539b drm/amdgpu: add tmz support for GC 11.0.1
commit 97074216917b4188f0af3e52cc5b3f2b277bbbca upstream.

this patch to add tmz support for GC 11.0.1.

Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Tim Huang <Tim.Huang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <Mario.Limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-24 07:24:43 +01:00