Linux/linux 5f9e832. Makefile

Linus 5.3-rc1
+2-21 files

Linux/linux c7bf0a0Documentation/devicetree/bindings/iio/adc adi,ad7124.yaml avia-hx711.yaml, Documentation/devicetree/bindings/pinctrl aspeed,ast2500-pinctrl.yaml st,stm32-pinctrl.yaml

Merge tag 'devicetree-fixes-for-5.3' of 

Pull Devicetree fixes from Rob Herring:
 "Fix several warnings/errors in validation of binding schemas"

* tag 'devicetree-fixes-for-5.3' of 
  dt-bindings: pinctrl: stm32: Fix missing 'clocks' property in examples
  dt-bindings: iio: ad7124: Fix dtc warnings in example
  dt-bindings: iio: avia-hx711: Fix avdd-supply typo in example
  dt-bindings: pinctrl: aspeed: Fix AST2500 example errors
  dt-bindings: pinctrl: aspeed: Fix 'compatible' schema errors
  dt-bindings: riscv: Limit cpus schema to only check RiscV 'cpu' nodes
  dt-bindings: Ensure child nodes are of type 'object'

Linux/linux d6788ebDocumentation/filesystems porting

Merge branch 'work.misc' of git://

Pull vfs documentation typo fix from Al Viro.

* 'work.misc' of git://
  typo fix: it's d_make_root, not d_make_inode...

Linux/linux 91962d0fs/cifs smb2ops.c smb2pdu.c

Merge tag '5.3-smb3-fixes' of git://

Pull cifs fixes from Steve French:
 "Two fixes for stable, one that had dependency on earlier patch in this
  merge window and can now go in, and a perf improvement in SMB3 open"

* tag '5.3-smb3-fixes' of git://
  cifs: update internal module number
  cifs: flush before set-info if we have writeable handles
  smb3: optimize open to not send query file internal info
  cifs: copy_file_range needs to strip setuid bits and update timestamps
  CIFS: fix deadlock in cached root handling

Linux/linux 8cf6650drivers/iommu amd_iommu.c

iommu/amd: fix a crash in iova_magazine_free_pfns

The commit b3aa14f02254 ("iommu: remove the mapping_error dma_map_ops
method") incorrectly changed the checking from dma_ops_alloc_iova() in
map_sg() causes a crash under memory pressure as dma_ops_alloc_iova()
never return DMA_MAPPING_ERROR on failure but 0, so the error handling
is all wrong.

   kernel BUG at drivers/iommu/iova.c:801!
    Workqueue: kblockd blk_mq_run_work_fn
    RIP: 0010:iova_magazine_free_pfns+0x7d/0xc0
    Call Trace:
     pqi_aio_submit_io+0x1f6/0x440 [smartpqi]
     pqi_scsi_queue_command+0x90c/0xdd0 [smartpqi]

    [8 lines not shown]

Linux/linux 618381farch/hexagon/include/asm pgalloc.h

hexagon: switch to generic version of pte allocation

The hexagon implementation pte_alloc_one(), pte_alloc_one_kernel(),
pte_free_kernel() and pte_free() is identical to the generic except of
lack of __GFP_ACCOUNT for the user PTEs allocation.

Switch hexagon to use generic version of these functions.

Signed-off-by: Mike Rapoport <rppt at>
Signed-off-by: Linus Torvalds <torvalds at>

Linux/linux bec5545drivers/ntb msi.c core.c, drivers/ntb/test ntb_msi_test.c

Merge tag 'ntb-5.3' of git://

Pull NTB updates from Jon Mason:
 "New feature to add support for NTB virtual MSI interrupts, the ability
  to test and use this feature in the NTB transport layer.

  Also, bug fixes for the AMD and Switchtec drivers, as well as some
  general patches"

* tag 'ntb-5.3' of git:// (22 commits)
  NTB: Describe the ntb_msi_test client in the documentation.
  NTB: Add MSI interrupt support to ntb_transport
  NTB: Add ntb_msi_test support to ntb_test
  NTB: Introduce NTB MSI Test Client
  NTB: Introduce MSI library
  NTB: Rename ntb.c to support multiple source files in the module
  NTB: Introduce functions to calculate multi-port resource index
  NTB: Introduce helper functions to calculate logical port number
  PCI/switchtec: Add module parameter to request more interrupts
  PCI/MSI: Support allocating virtual MSI interrupts
  ntb_hw_switchtec: Fix setup MW with failure bug
  ntb_hw_switchtec: Skip unnecessary re-setup of shared memory window for crosslink case
  ntb_hw_switchtec: Remove redundant steps of switchtec_ntb_reinit_peer() function
  NTB: correct ntb_dev_ops and ntb_dev comment typos
  NTB: amd: Silence shift wrapping warning in amd_ntb_db_vector_mask()

    [6 lines not shown]

Linux/linux 1b03bc5Documentation/filesystems porting

typo fix: it's d_make_root, not d_make_inode...

Signed-off-by: Al Viro <viro at>

Linux/linux e2297f7Documentation/devicetree/bindings/pinctrl st,stm32-pinctrl.yaml

dt-bindings: pinctrl: stm32: Fix missing 'clocks' property in examples

Now that examples are validated against the DT schema, an error with
required 'clocks' property missing is exposed:

Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.example.dt.yaml: \
pinctrl at 40020000: gpio at 0: 'clocks' is a required property
Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.example.dt.yaml: \
pinctrl at 50020000: gpio at 1000: 'clocks' is a required property
Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.example.dt.yaml: \
pinctrl at 50020000: gpio at 2000: 'clocks' is a required property

Add the missing 'clocks' properties to the examples to fix the errors.

Fixes: 2c9239c125f0 ("dt-bindings: pinctrl: Convert stm32 pinctrl bindings to 
Cc: Linus Walleij <linus.walleij at>
Cc: Maxime Coquelin <mcoquelin.stm32 at>
Cc: linux-gpio at
Cc: linux-stm32 at
Acked-by: Alexandre TORGUE <alexandre.torgue at>
Signed-off-by: Rob Herring <robh at>

Linux/linux fcbe7e3Documentation/devicetree/bindings/pinctrl aspeed,ast2500-pinctrl.yaml

dt-bindings: pinctrl: aspeed: Fix AST2500 example errors

The schema examples are now validated against the schema itself. The
AST2500 pinctrl schema has a couple of errors:

Documentation/devicetree/bindings/pinctrl/aspeed,ast2500-pinctrl.example.dt.yaml: \
example-0: $nodename:0: 'example-0' does not match '^(bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$'
Documentation/devicetree/bindings/pinctrl/aspeed,ast2500-pinctrl.example.dt.yaml: \
pinctrl: aspeed,external-nodes: [[1, 2]] is too short

Fixes: 0a617de16730 ("dt-bindings: pinctrl: aspeed: Convert AST2500 bindings to 
Cc: Andrew Jeffery <andrew at>
Cc: Linus Walleij <linus.walleij at>
Cc: Joel Stanley <joel at>
Cc: linux-aspeed at
Cc: linux-gpio at
Cc: linux-arm-kernel at
Acked-by: Andrew Jeffery <andrew at>
Signed-off-by: Rob Herring <robh at>

Linux/linux ad21a4cDocumentation/devicetree/bindings/pinctrl aspeed,ast2500-pinctrl.yaml aspeed,ast2400-pinctrl.yaml

dt-bindings: pinctrl: aspeed: Fix 'compatible' schema errors

The Aspeed pinctl schema have errors in the 'compatible' schema:

Documentation/devicetree/bindings/pinctrl/aspeed,ast2400-pinctrl.yaml: \
properties:compatible:enum: ['aspeed', 'ast2400-pinctrl', 'aspeed', 'g4-pinctrl'] has 
non-unique elements
Documentation/devicetree/bindings/pinctrl/aspeed,ast2500-pinctrl.yaml: \
properties:compatible:enum: ['aspeed', 'ast2500-pinctrl', 'aspeed', 'g5-pinctrl'] has 
non-unique elements

Flow style sequences have to be quoted if the vales contain ','. Fix
this by using the more common one line per entry formatting.

Fixes: 0a617de16730 ("dt-bindings: pinctrl: aspeed: Convert AST2500 bindings to 
Fixes: 07457937bb5c ("dt-bindings: pinctrl: aspeed: Convert AST2400 bindings to 
Cc: Andrew Jeffery <andrew at>
Cc: Linus Walleij <linus.walleij at>
Cc: Joel Stanley <joel at>
Cc: linux-aspeed at
Cc: linux-gpio at
Cc: linux-arm-kernel at
Acked-by: Andrew Jeffery <andrew at>
Signed-off-by: Rob Herring <robh at>

Linux/linux fbbf2b6Documentation/devicetree/bindings/iio/adc avia-hx711.yaml

dt-bindings: iio: avia-hx711: Fix avdd-supply typo in example

Now that examples are validated against the DT schema, a typo in
avia-hx711 example generates a warning:

Documentation/devicetree/bindings/iio/adc/avia-hx711.example.dt.yaml: weight: 
'avdd-supply' is a required property

Fix the typo.

Fixes: 5150ec3fe125 ("avia-hx711.yaml: transform DT binding to YAML")
Cc: Andreas Klinger <ak at>
Cc: Jonathan Cameron <jic23 at>
Cc: linux-iio at
Signed-off-by: Rob Herring <robh at>

Linux/linux 7d9ef7fDocumentation/devicetree/bindings/riscv cpus.yaml

dt-bindings: riscv: Limit cpus schema to only check RiscV 'cpu' nodes

Matching on the 'cpus' node was a bad choice because the schema is
incorrectly applied to non-RiscV cpus nodes. As we now have a common cpus
schema which checks the general structure, it is also redundant to do so
in the Risc-V CPU schema.

The downside is one could conceivably mix different architecture's cpu
nodes or have typos in the compatible string. The latter problem pretty
much exists for every schema.

Acked-by: Paul Walmsley <paul.walmsley at>
Signed-off-by: Rob Herring <robh at>

Linux/linux 20051f5Documentation/devicetree/bindings/iio/adc adi,ad7124.yaml

dt-bindings: iio: ad7124: Fix dtc warnings in example

With the conversion to DT schema, the examples are now compiled with
dtc. The ad7124 binding example has the following warning:

Documentation/devicetree/bindings/iio/adc/adi,ad7124.example.dts:19.11-21: \
Warning (reg_format): /example-0/adc at 0:reg: property has invalid length (4 bytes) 
(#address-cells == 1, #size-cells == 1)

There's a default #size-cells and #address-cells values of 1 for
examples. For examples needing different values such as this one on a
SPI bus, they need to provide a SPI bus parent node.

Fixes: 26ae15e62d3c ("Convert AD7124 bindings documentation to YAML format.")

Cc: Jonathan Cameron <jic23 at>
Cc: linux-iio at
Signed-off-by: Rob Herring <robh at>

Linux/linux 15ffef1Documentation/devicetree/bindings/bus allwinner,sun8i-a23-rsb.yaml, Documentation/devicetree/bindings/mtd nand-controller.yaml allwinner,sun4i-a10-nand.yaml

dt-bindings: Ensure child nodes are of type 'object'

Properties which are child node definitions need to have an explict
type. Otherwise, a matching (DT) property can silently match when an
error is desired. Fix this up tree-wide. Once this is fixed, the
meta-schema will enforce this on any child node definitions.

Cc: Chen-Yu Tsai <wens at>
Cc: David Woodhouse <dwmw2 at>
Cc: Brian Norris <computersforpeace at>
Cc: Marek Vasut <marek.vasut at>
Cc: Richard Weinberger <richard at>
Cc: Vignesh Raghavendra <vigneshr at>
Cc: Linus Walleij <linus.walleij at>
Cc: Maxime Coquelin <mcoquelin.stm32 at>
Cc: linux-mtd at
Cc: linux-gpio at
Cc: linux-stm32 at
Cc: linux-spi at
Acked-by: Miquel Raynal <miquel.raynal at>
Acked-by: Maxime Ripard <maxime.ripard at>
Acked-by: Mark Brown <broonie at>
Acked-by: Alexandre TORGUE <alexandre.torgue at>
Signed-off-by: Rob Herring <robh at>

Linux/linux f1a3b43drivers/input/keyboard applespi.c applespi_trace.h, drivers/input/mouse alps.c

Merge branch 'for-linus' of git://

Pull more input updates from Dmitry Torokhov:

 - Apple SPI keyboard and trackpad driver for newer Macs

 - ALPS driver will ignore trackpoint-only devices to give the
   trackpoint driver a chance to handle them properly

 - another Lenovo is switched over to SMbus from PS/2

 - assorted driver fixups.

* 'for-linus' of git://
  Input: alps - fix a mismatch between a condition check and its comment
  Input: psmouse - fix build error of multiple definition
  Input: applespi - remove set but not used variables 'sts'
  Input: add Apple SPI keyboard and trackpad driver
  Input: alps - don't handle ALPS cs19 trackpoint-only device
  Input: hyperv-keyboard - remove dependencies on PAGE_SIZE for ring buffer
  Input: adp5589 - initialize GPIO controller parent device
  Input: iforce - remove empty multiline comments
  Input: synaptics - fix misuse of strlcpy
  Input: auo-pixcir-ts - switch to using  devm_add_action_or_reset()
  Input: gtco - bounds check collection indent level

    [3 lines not shown]

Linux/linux ac60602arch/s390/mm init.c, arch/x86/mm mem_encrypt.c

Merge tag 'dma-mapping-5.3-1' of git://

Pull dma-mapping fixes from Christoph Hellwig:
 "Fix various regressions:

   - force unencrypted dma-coherent buffers if encryption bit can't fit
     into the dma coherent mask (Tom Lendacky)

   - avoid limiting request size if swiotlb is not used (me)

   - fix swiotlb handling in dma_direct_sync_sg_for_cpu/device (Fugang

* tag 'dma-mapping-5.3-1' of git://
  dma-direct: correct the physical addr in dma_direct_sync_sg_for_cpu/device
  dma-direct: only limit the mapping size if swiotlb could be used
  dma-mapping: add a dma_addressing_limited helper
  dma-direct: Force unencrypted DMA under SME for certain DMA masks

Linux/linux c6dd78farch/x86/entry entry_64.S entry_32.S, arch/x86/include/asm paravirt.h

Merge branch 'x86-urgent-for-linus' of 

Pull x86 fixes from Thomas Gleixner:
 "A set of x86 specific fixes and updates:

   - The CR2 corruption fixes which store CR2 early in the entry code
     and hand the stored address to the fault handlers.

   - Revert a forgotten leftover of the dropped FSGSBASE series.

   - Plug a memory leak in the boot code.

   - Make the Hyper-V assist functionality robust by zeroing the shadow

   - Remove a useless check for dead processes with LDT

   - Update paravirt and VMware maintainers entries.

   - A few cleanup patches addressing various compiler warnings"

* 'x86-urgent-for-linus' of git://
  x86/entry/64: Prevent clobbering of saved CR2 value
  x86/hyper-v: Zero out the VP ASSIST PAGE on allocation

    [16 lines not shown]

Linux/linux 46f5c0ctools/perf/pmu-events/arch/s390/cf_m8561 extended.json crypto.json, tools/perf/scripts/python

Merge branch 'perf-urgent-for-linus' of 

Pull perf tooling updates from Thomas Gleixner:
 "A set of perf improvements and fixes:

  perf db-export:
   - Improvements in how COMM details are exported to databases for post
     processing and use in the UI.

   - Export switch events to the database.

   - Bump rlimit(MEMLOCK) for 'perf test bpf' and 'perf trace', just
     like selftests/bpf/bpf_rlimit.h do, which makes errors due to
     exhaustion of this limit, which are kinda cryptic (EPERM sometimes)
     less frequent.

  perf version:
   - Fix segfault due to missing OPT_END(), noticed on PowerPC.

  perf vendor events:
   - Add JSON files for IBM s/390 machine type 8561.

  perf cs-etm (ARM):

    [26 lines not shown]

Linux/linux e6023adarch/x86/include/asm kvm_host.h, arch/x86/kvm emulate.c

Merge branch 'core-urgent-for-linus' of 

Pull core fixes from Thomas Gleixner:

 - A collection of objtool fixes which address recent fallout partially
   exposed by newer toolchains, clang, BPF and general code changes.

 - Force USER_DS for user stack traces

[ Note: the "objtool fixes" are not all to objtool itself, but for
  kernel code that triggers objtool warnings.

  Things like missing function size annotations, or code that confuses
  the unwinder etc.   - Linus]

* 'core-urgent-for-linus' of git:// (27 
  objtool: Support conditional retpolines
  objtool: Convert insn type to enum
  objtool: Fix seg fault on bad switch table entry
  objtool: Support repeated uses of the same C jump table
  objtool: Refactor jump table code
  objtool: Refactor sibling call detection logic
  objtool: Do frame pointer check before dead end check

    [14 lines not shown]

Linux/linux 4b01f5akernel smp.c

Merge branch 'smp-urgent-for-linus' of 

Pull smp fix from Thomas Gleixner:
 "Add warnings to the smp function calls so callers from wrong contexts
  get detected"

* 'smp-urgent-for-linus' of git://
  smp: Warn on function calls from softirq context
+16-01 files

Linux/linux 70e6e1barch Kconfig, kernel Kconfig.preempt

Merge branch 'sched-urgent-for-linus' of 

Pull CONFIG_PREEMPT_RT stub config from Thomas Gleixner:
 "The real-time preemption patch set exists for almost 15 years now and
  while the vast majority of infrastructure and enhancements have found
  their way into the mainline kernel, the final integration of RT is
  still missing.

  Over the course of the last few years, we have worked on reducing the
  intrusivenness of the RT patches by refactoring kernel infrastructure
  to be more real-time friendly. Almost all of these changes were
  benefitial to the mainline kernel on their own, so there was no
  objection to integrate them.

  Though except for the still ongoing printk refactoring, the remaining
  changes which are required to make RT a first class mainline citizen
  are not longer arguable as immediately beneficial for the mainline
  kernel. Most of them are either reordering code flows or adding RT
  specific functionality.

  But this now has hit a wall and turned into a classic hen and egg

     Maintainers are rightfully wary vs. these changes as they make only

    [33 lines not shown]

Linux/linux 07ab9d5arch/x86/kvm lapic.c svm.c, tools/testing/selftests/kvm kvm_create_max_vcpus.c

Merge tag 'for-linus' of git://

Pull more KVM updates from Paolo Bonzini:
 "Mostly bugfixes, but also:

   - s390 support for KVM selftests

   - LAPIC timer offloading to housekeeping CPUs

   - Extend an s390 optimization for overcommitted hosts to all

   - Debugging cleanups and improvements"

* tag 'for-linus' of git:// (25 commits)
  KVM: x86: Add fixed counters to PMU filter
  KVM: nVMX: do not use dangling shadow VMCS after guest reset
  KVM: VMX: dump VMCS on failed entry
  KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed
  KVM: s390: Use kvm_vcpu_wake_up in kvm_s390_vcpu_wakeup
  KVM: Boost vCPUs that are delivering interrupts
  KVM: selftests: Remove superfluous define from vmx.c
  KVM: SVM: Fix detection of AMD Errata 1096
  KVM: LAPIC: Inject timer interrupt via posted interrupt
  KVM: LAPIC: Make lapic timer unpinned

    [11 lines not shown]

Linux/linux f65420ddrivers/infiniband/ulp/iser iscsi_iser.c, drivers/infiniband/ulp/srp ib_srp.c

Merge tag 'scsi-fixes' of git://

Pull SCSI fixes from James Bottomley:
 "This is the final round of mostly small fixes in our initial submit.

  It's mostly minor fixes and driver updates. The only change of note is
  adding a virt_boundary_mask to the SCSI host and host template to
  parametrise this for NVMe devices instead of having them do a call in
  slave_alloc. It's a fairly straightforward conversion except in the
  two NVMe handling drivers that didn't set it who now have a virtual
  infinity parameter added"

* tag 'scsi-fixes' of git:// (24 
  scsi: megaraid_sas: set an unlimited max_segment_size
  scsi: mpt3sas: set an unlimited max_segment_size for SAS 3.0 HBAs
  scsi: IB/srp: set virt_boundary_mask in the scsi host
  scsi: IB/iser: set virt_boundary_mask in the scsi host
  scsi: storvsc: set virt_boundary_mask in the scsi host template
  scsi: ufshcd: set max_segment_size in the scsi host template
  scsi: core: take the DMA max mapping size into account
  scsi: core: add a host / host template field for the virt boundary
  scsi: core: Fix race on creating sense cache
  scsi: sd_zbc: Fix compilation warning
  scsi: libfc: fix null pointer dereference on a null lport

    [10 lines not shown]

Linux/linux 168c799. Makefile, include Kbuild

Merge tag 'kbuild-v5.3-2' of 

Pull more Kbuild updates from Masahiro Yamada:

 - match the directory structure of the linux-libc-dev package to that
   of Debian-based distributions

 - fix incorrect include/config/auto.conf generation when Kconfig
   creates it along with the .config file

 - remove misleading $(AS) from documents

 - clean up precious tag files by distclean instead of mrproper

 - add a new coccinelle patch for devm_platform_ioremap_resource

 - refactor module-related scripts to read modules.order instead of
   $(MODVERDIR)/*.mod files to get the list of created modules

 - remove MODVERDIR

 - update list of header compile-test

    [28 lines not shown]

Linux/linux 18253e0fs namespace.c dcache.c, fs/nfs super.c

Merge branch 'work.dcache2' of git://

Pull dcache and mountpoint updates from Al Viro:
 "Saner handling of refcounts to mountpoints.

  Transfer the counting reference from struct mount ->mnt_mountpoint
  over to struct mountpoint ->m_dentry. That allows us to get rid of the
  convoluted games with ordering of mount shutdowns.

  The cost is in teaching shrink_dcache_{parent,for_umount} to cope with
  mixed-filesystem shrink lists, which we'll also need for the Slab
  Movable Objects patchset"

* 'work.dcache2' of git://
  switch the remnants of releasing the mountpoint away from fs_pin
  get rid of detach_mnt()
  make struct mountpoint bear the dentry reference to mountpoint, not struct mount
  Teach shrink_dcache_parent() to cope with mixed-filesystem shrink lists
  fs/namespace.c: shift put_mountpoint() to callers of unhash_mnt()
  __detach_mounts(): lookup_mountpoint() can't return ERR_PTR() anymore
  nfs: dget_parent() never returns NULL
  ceph: don't open-code the check for dead lockref

Linux/linux 6879298arch/x86/entry entry_64.S

x86/entry/64: Prevent clobbering of saved CR2 value

The recent fix for CR2 corruption introduced a new way to reliably corrupt
the saved CR2 value.

CR2 is saved early in the entry code in RDX, which is the third argument to
the fault handling functions. But it missed that between saving and
invoking the fault handler enter_from_user_mode() can be called. RDX is a
caller saved register so the invoked function can freely clobber it with
the obvious consequences.

The TRACE_IRQS_OFF call is safe as it calls through the thunk which
preserves RDX, but TRACE_IRQS_OFF_DEBUG is not because it also calls into
C-code outside of the thunk.

Store CR2 in R12 instead which is a callee saved register and move R12 to
RDX just before calling the fault handler.

Fixes: a0d14b8909de ("x86/mm, tracing: Fix CR2 corruption")
Reported-by: Sean Christopherson <sean.j.christopherson at>
Signed-off-by: Thomas Gleixner <tglx at>
Acked-by: Peter Zijlstra (Intel) <peterz at>
Link: at

Linux/linux 19dbdcbkernel smp.c

smp: Warn on function calls from softirq context

It's clearly documented that smp function calls cannot be invoked from
softirq handling context. Unfortunately nothing enforces that or emits a

A single function call can be invoked from softirq context only via

The only legit context is task context, so add a warning to that effect.

Reported-by: luferry <luferry at>
Signed-off-by: Peter Zijlstra <peterz at>
Signed-off-by: Thomas Gleixner <tglx at>
Link: at
+16-01 files

Linux/linux 30cd860Documentation/virtual/kvm api.txt, arch/x86/include/uapi/asm kvm.h

KVM: x86: Add fixed counters to PMU filter

Updates KVM_CAP_PMU_EVENT_FILTER so it can also whitelist or blacklist
fixed counters.

Signed-off-by: Eric Hankland <ehankland at>
[No need to check padding fields for zero. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini at>

Linux/linux 3b20e03arch/x86/kvm/vmx vmx.c

KVM: VMX: dump VMCS on failed entry

This is useful for debugging, and is ratelimited nowadays.

Signed-off-by: Paolo Bonzini <pbonzini at>

Linux/linux 88dddc1arch/x86/kvm/vmx nested.c

KVM: nVMX: do not use dangling shadow VMCS after guest reset

If a KVM guest is reset while running a nested guest, free_nested will
disable the shadow VMCS execution control in the vmcs01.  However,
on the next KVM_RUN vmx_vcpu_run would nevertheless try to sync
the VMCS12 to the shadow VMCS which has since been freed.

This causes a vmptrld of a NULL pointer on my machime, but Jan reports
the host to hang altogether.  Let's see how much this trivial patch fixes.

Reported-by: Jan Kiszka <jan.kiszka at>
Cc: Liran Alon <liran.alon at>
Cc: stable at
Signed-off-by: Paolo Bonzini <pbonzini at>

Linux/linux 6fc3977arch/x86/kvm pmu.c

KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed

If a perf_event creation fails due to any reason of the host perf
subsystem, it has no chance to log the corresponding event for guest
which may cause abnormal sampling data in guest result. In debug mode,
this message helps to understand the state of vPMC and we may not
limit the number of occurrences but not in a spamming style.

Suggested-by: Joe Perches <joe at>
Signed-off-by: Like Xu <like.xu at>
Cc: stable at
Signed-off-by: Paolo Bonzini <pbonzini at>
+2-21 files

Linux/linux d984740arch/s390/kvm interrupt.c

KVM: s390: Use kvm_vcpu_wake_up in kvm_s390_vcpu_wakeup

Use kvm_vcpu_wake_up() in kvm_s390_vcpu_wakeup().

Suggested-by: Paolo Bonzini <pbonzini at>
Cc: Paolo Bonzini <pbonzini at>
Cc: Radim Krčmář <rkrcmar at>
Cc: Christian Borntraeger <borntraeger at>
Signed-off-by: Wanpeng Li <wanpengli at>
Signed-off-by: Paolo Bonzini <pbonzini at>

Linux/linux d73eb57arch/s390/kvm interrupt.c, include/linux kvm_host.h

KVM: Boost vCPUs that are delivering interrupts

Inspired by commit 9cac38dd5d (KVM/s390: Set preempted flag during
vcpu wakeup and interrupt delivery), we want to also boost not just
lock holders but also vCPUs that are delivering interrupts. Most
smp_call_function_many calls are synchronous, so the IPI target vCPUs
are also good yield candidates.  This patch introduces vcpu->ready to
boost vCPUs during wakeup and interrupt delivery time; unlike s390 we do
not reuse vcpu->preempted so that voluntarily preempted vCPUs are taken
into account by kvm_vcpu_on_spin, but vmx_vcpu_pi_put is not affected
(VT-d PI handles voluntary preemption separately, in pi_pre_block).

Testing on 80 HT 2 socket Xeon Skylake server, with 80 vCPUs VM 80GB RAM:
ebizzy -M

            vanilla     boosting    improved
1VM          21443       23520         9%
2VM           2800        8000       180%
3VM           1800        3100        72%

Testing on my Haswell desktop 8 HT, with 8 vCPUs VM 8GB RAM, two VMs,
one running ebizzy -M, the other running 'stress --cpu 2':

w/ boosting + w/o pv sched yield(vanilla)

    [28 lines not shown]

Linux/linux 118154barch/x86/kvm svm.c

KVM: SVM: Fix detection of AMD Errata 1096

When CPU raise #NPF on guest data access and guest CR4.SMAP=1, it is
possible that CPU microcode implementing DecodeAssist will fail
to read bytes of instruction which caused #NPF. This is AMD errata
1096 and it happens because CPU microcode reading instruction bytes
incorrectly attempts to read code as implicit supervisor-mode data
accesses (that is, just like it would read e.g. a TSS), which are
susceptible to SMAP faults. The microcode reads CS:RIP and if it is
a user-mode address according to the page tables, the processor
gives up and returns no instruction bytes.  In this case,
GuestIntrBytes field of the VMCB on a VMEXIT will incorrectly
return 0 instead of the correct guest instruction bytes.

Current KVM code attemps to detect and workaround this errata, but it
has multiple issues:

1) It mistakenly checks if guest CR4.SMAP=0 instead of guest CR4.SMAP=1,
which is required for encountering a SMAP fault.

2) It assumes SMAP faults can only occur when guest CPL==3.
However, in case guest CR4.SMEP=0, the guest can execute an instruction
which reside in a user-accessible page with CPL<3 priviledge. If this
instruction raise a #NPF on it's data access, then CPU DecodeAssist
microcode will still encounter a SMAP violation.  Even though no sane

    [22 lines not shown]
+35-71 files

Linux/linux 2417c87tools/testing/selftests/kvm/lib/x86_64 vmx.c

KVM: selftests: Remove superfluous define from vmx.c

The code in vmx.c does not use "program_invocation_name", so there
is no need to "#define _GNU_SOURCE" here.

Signed-off-by: Thomas Huth <thuth at>
Signed-off-by: Paolo Bonzini <pbonzini at>

Linux/linux 0c5f81darch/x86/kvm lapic.c x86.c, arch/x86/kvm/vmx vmx.c

KVM: LAPIC: Inject timer interrupt via posted interrupt

Dedicated instances are currently disturbed by unnecessary jitter due
to the emulated lapic timers firing on the same pCPUs where the
vCPUs reside.  There is no hardware virtual timer on Intel for guest
like ARM, so both programming timer in guest and the emulated timer fires
incur vmexits.  This patch tries to avoid vmexit when the emulated timer
fires, at least in dedicated instance scenario when nohz_full is enabled.

In that case, the emulated timers can be offload to the nearest busy
housekeeping cpus since APICv has been found for several years in server
processors. The guest timer interrupt can then be injected via posted interrupts,
which are delivered by the housekeeping cpu once the emulated timer fires.

The host should tuned so that vCPUs are placed on isolated physical
processors, and with several pCPUs surplus for busy housekeeping.
If disabled mwait/hlt/pause vmexits keep the vCPUs in non-root mode,
~3% redis performance benefit can be observed on Skylake server, and the
number of external interrupt vmexits drops substantially.  Without patch

            VM-EXIT  Samples  Samples%  Time%   Min Time  Max Time   Avg time
EXTERNAL_INTERRUPT    42916    49.43%   39.30%   0.47us   106.09us   0.71us ( +-   1.09% )

While with patch:

    [8 lines not shown]

Linux/linux c39f2d9drivers/net/wireless/realtek/rtw88 rtw8822b_table.c rtw8822c_table.c, drivers/staging/rtlwifi/btcoexist halbtc8822b1ant.c

Merge branch 'next' into for-linus

Prepare second round of input updates for 5.3 merge window.

Linux/linux 29be86d. Makefile

kbuild: add -fcf-protection=none when using retpoline flags

The gcc -fcf-protection=branch option is not compatible with
-mindirect-branch=thunk-extern. The latter is used when
CONFIG_RETPOLINE is selected, and this will fail to build with
a gcc which has -fcf-protection=branch enabled by default. Adding
-fcf-protection=none when building with retpoline enabled
prevents such build failures.

Signed-off-by: Seth Forshee <seth.forshee at>
Signed-off-by: Masahiro Yamada <yamada.masahiro at>
+6-01 files

Linux/linux 67bf474include Kbuild, usr/include Makefile

kbuild: update compile-test header list for v5.3-rc1

 - Some headers graduated from the blacklist

 - hyperv_timer.h joined the header-test when CONFIG_X86=y

 - nf_tables*.h joined the header-test when CONFIG_NF_TABLES is

 - The entry for nf_tables_offload.h was added to fix build error for
   the combination of CONFIG_NF_TABLES=n and CONFIG_KERNEL_HEADER_TEST=y.

 - The entry for iomap.h was added because this header is supposed to
   be included only when CONFIG_BLOCK=y

Signed-off-by: Masahiro Yamada <yamada.masahiro at>

Linux/linux abdfd52arch/arm/configs exynos_defconfig mini2440_defconfig, arch/arm64/configs defconfig

Merge tag 'armsoc-defconfig' of git://

Pull ARM SoC defconfig updates from Olof Johansson:
 "We keep this in a separate branch to avoid cross-branch conflicts, but
  most of the material here is fairly boring -- some new drivers turned
  on for hardware since they were merged, and some refreshed files due
  to time having moved a lot of entries around"

* tag 'armsoc-defconfig' of git:// (47 
  ARM: configs: multi_v5: Remove duplicate ASPEED options
  arm64: defconfig: Enable CONFIG_KEYBOARD_SNVS_PWRKEY as module
  ARM: imx_v6_v7_defconfig: Enable CONFIG_ARM_IMX_CPUFREQ_DT
  defconfig: arm64: enable i.MX8 SCU octop driver
  arm64: defconfig: Add i.MX SCU SoC info driver
  arm64: defconfig: Enable CONFIG_QORIQ_THERMAL
  ARM: imx_v6_v7_defconfig: Select CONFIG_NVMEM_SNVS_LPGPR
  arm64: defconfig: ARM_IMX_CPUFREQ_DT=m
  ARM: imx_v6_v7_defconfig: Add TPM PWM support by default
  ARM: imx_v6_v7_defconfig: Enable the OV2680 camera driver
  ARM: imx_v6_v7_defconfig: Enable CONFIG_THERMAL_STATISTICS
  arm64: defconfig: NVMEM_IMX_OCOTP=y for imx8m
  ARM: multi_v7_defconfig: enable STMFX pinctrl support
  arm64 defconfig: enable LVM support
  ARM: configs: multi_v5: Add more ASPEED devices

    [6 lines not shown]

Linux/linux af6af87arch/arm/boot/dts aspeed-bmc-opp-swift.dts aspeed-bmc-inspur-fp5280g2.dts, arch/arm64/boot/dts/amlogic meson-g12a.dtsi

Merge tag 'armsoc-dt' of git://

Pull ARM Devicetree updates from Olof Johansson:
 "We continue to see a lot of new material. I've highlighted some of it
  below, but there's been more beyond that as well.

  One of the sweeping changes is that many boards have seen their ARM
  Mali GPU devices added to device trees, since the DRM drivers have now
  been merged.

  So, with the caveat that I have surely missed several great
  contributions, here's a collection of the material this time around:

  New SoCs:

   - Mediatek mt8183 (4x Cortex-A73 + 4x Cortex-A53)

   - TI J721E (2x Cortex-A72 + 3x Cortex-R5F + 3 DSPs + MMA)

   - Amlogic G12B (4x Cortex-A73 + 2x Cortex-A53)

  New Boards / platforms:

   - Aspeed BMC support for a number of new server platforms

    [51 lines not shown]

Linux/linux 8362fd6drivers/bus ti-sysc.c, drivers/firmware ti_sci.c ti_sci.h

Merge tag 'armsoc-drivers' of git://

Pull ARM SoC-related driver updates from Olof Johansson:
 "Various driver updates for platforms and a couple of the small driver
  subsystems we merge through our tree:

   - A driver for SCU (system control) on NXP i.MX8QXP

   - Qualcomm Always-on Subsystem messaging driver (AOSS QMP)

   - Qualcomm PM support for MSM8998

   - Support for a newer version of DRAM PHY driver for Broadcom (DPFE)

   - Reset controller support for Bitmain BM1880

   - TI SCI (System Control Interface) support for CPU control on AM654

   - More TI sysc refactoring and rework"

* tag 'armsoc-drivers' of git:// (84 
  reset: remove redundant null check on pointer dev
  soc: rockchip: work around clang warning

    [19 lines not shown]

Linux/linux 24e4491arch/arm/mach-rpc irq.c dma.c, arch/arm/mach-sa1100 clock.c neponset.c

Merge tag 'armsoc-soc' of git://

Pull ARM SoC platform updates from Olof Johansson:
 "SoC platform changes. Main theme this merge window:

   - The Netx platform (Netx 100/500) platform is removed by Linus
     Walleij-- the SoC doesn't have active maintainers with hardware,
     and in discussions with the vendor the agreement was that it's OK
     to remove.

   - Russell King has a series of patches that cleans up and refactors
     SA1101 and RiscPC support"

* tag 'armsoc-soc' of git:// (47 commits)
  ARM: stm32: use "depends on" instead of "if" after prompt
  ARM: sa1100: convert to common clock framework
  ARM: exynos: Cleanup cppcheck shifting warning
  ARM: pxa/lubbock: remove lubbock_set_misc_wr() from global view
  ARM: exynos: Only build MCPM support if used
  arm: add missing include platform-data/atmel.h
  ARM: davinci: Use GPIO lookup table for DA850 LEDs
  ARM: OMAP2: drop explicit assembler architecture
  ARM: use arch_extension directive instead of arch argument
  ARM: imx: Switch imx7d to imx-cpufreq-dt for speed-grading

    [10 lines not shown]

Linux/linux 31cc088drivers/gpu/drm/amd/display/amdgpu_dm amdgpu_dm.c, drivers/gpu/drm/amd/powerplay amdgpu_smu.c navi10_ppt.c

Merge tag 'drm-next-2019-07-19' of git://

Pull drm fixes from Daniel Vetter:
 "Dave is back in shape, but now family got it so I'm doing the pull.
  Two things worthy of note:

   - nouveau feature pull was way too late, Dave&me decided to not take
     that, so Ben spun up a pull with just the fixes.

   - after some chatting with the arm display maintainers we decided to
     change a bit how that's maintained, for more oversight/review and
     cross vendor collab.

  More details below:

   - bugfixes
   - TU116 enabling (minor iteration) :w

   - large pile of fixes for new hw support this release (navi, vega20)
   - audio hotplug fix
   - bunch of corner cases and small fixes all over for amdgpu/kfd


    [32 lines not shown]

Linux/linux dd4542ddrivers/crypto/amcc crypto4xx_trng.c, drivers/crypto/ccp psp-dev.c ccp-ops.c

Merge branch 'linus' of git://

Pull crypto fixes from Herbert Xu:

 - Fix missed wake-up race in padata

 - Use crypto_memneq in ccp

 - Fix version check in ccp

 - Fix fuzz test failure in ccp

 - Fix potential double free in crypto4xx

 - Fix compile warning in stm32

* 'linus' of git://
  padata: use smp_mb in padata_reorder to avoid orphaned padata jobs
  crypto: ccp/gcm - use const time tag comparison.
  crypto: ccp - memset structure fields to zero before reuse
  crypto: crypto4xx - fix a potential double free in ppc4xx_trng_probe
  crypto: stm32/hash - Fix incorrect printk modifier for size_t

Linux/linux 40ef768. CREDITS, Documentation/dev-tools sparse.rst

Remove references to dead website.

This fell into disrepair a while ago, and the majority of hits to the
snapshots were from bots, so it's more trouble to keep running than it's worth.

Signed-off-by: Dave Jones <davej at>
Signed-off-by: Linus Torvalds <torvalds at>

Linux/linux 41ba485kernel/trace trace_output.c

Merge tag 'trace-v5.3-2' of 

Pull tracing fix from Steven Rostedt:
 "Eiichi Tsukata found a small bug from the fixup of the stack code

  Removing ULONG_MAX as the marker for the user stack trace end, made
  the tracing code not know where the end is. The end is now marked with
  a zero (NULL) pointer. Eiichi fixed this in the tracing code"

* tag 'trace-v5.3-2' of git://
  tracing: Fix user stack trace "??" output

Linux/linux a84d2d2arch/csky/include/asm mmu_context.h asid.h, arch/csky/kernel perf_event.c

Merge tag 'csky-for-linus-5.3-rc1' of git://

Pull arch/csky pupdates from Guo Ren:
 "This round of csky subsystem gives two features (ASID algorithm
  update, Perf pmu record support) and some fixups.

  ASID updates:
   - Revert mmu ASID mechanism
   - Add new asid lib code from arm
   - Use generic asid algorithm to implement switch_mm
   - Improve tlb operation with help of asid

  Perf pmu record support:
   - Init pmu as a device
   - Add count-width property for csky pmu
   - Add pmu interrupt support
   - Fix perf record in kernel/user space
   - dt-bindings: Add csky PMU bindings

   - Fixup no panic in kernel for some traps
   - Fixup some error count in 810 & 860.
   - Fixup abiv1 memset error"

* tag 'csky-for-linus-5.3-rc1' of git://

    [14 lines not shown]

Linux/linux b5d72ddDocumentation/admin-guide kernel-parameters.txt, arch/x86/kernel/cpu hypervisor.c

Merge tag 'for-linus-5.3a-rc1-tag' of 

Pull xen updates from Juergen Gross:
 "Fixes and features:

   - A series to introduce a common command line parameter for disabling
     paravirtual extensions when running as a guest in virtualized

   - A fix for int3 handling in Xen pv guests

   - Removal of the Xen-specific tmem driver as support of tmem in Xen
     has been dropped (and it was experimental only)

   - A security fix for running as Xen dom0 (XSA-300)

   - A fix for IRQ handling when offlining cpus in Xen guests

   - Some small cleanups"

* tag 'for-linus-5.3a-rc1-tag' of git://
  xen: let alloc_xenballooned_pages() fail if not enough memory free
  xen/pv: Fix a boot up hang revealed by int3 self test
  x86/xen: Add "nopv" support for HVM guest

    [7 lines not shown]