Host stage-2 optimisations from Quentin Perret

* kvm-arm64/mmu/reduce-vmemmap-overhead:
  KVM: arm64: Use less bits for hyp_page refcount
  KVM: arm64: Use less bits for hyp_page order
  KVM: arm64: Remove hyp_pool pointer from struct hyp_page
  KVM: arm64: Unify MMIO and mem host stage-2 pools
  KVM: arm64: Remove list_head from hyp_page
  KVM: arm64: Use refcount at hyp to check page availability
  KVM: arm64: Move hyp_pool locking out of refcount helpers

The hyp_page refcount is currently encoded on 4 bytes even though we
never need to count that many objects in a page. Make it 2 bytes to save
some space in the vmemmap.

As overflows are more likely to happen as well, make sure to catch those
with a BUG in the increment function.
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210608114518.748712-8-qperret@google.com

The hyp_page order is currently encoded on 4 bytes even though it is
guaranteed to be smaller than this. Make it 2 bytes to reduce the hyp
vmemmap overhead.
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210608114518.748712-7-qperret@google.com

Each struct hyp_page currently contains a pointer to a hyp_pool struct
where the page should be freed if its refcount reaches 0. However, this
information can always be inferred from the context in the EL2 code, so
drop the pointer to save a few bytes in the vmemmap.
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210608114518.748712-6-qperret@google.com

We currently maintain two separate memory pools for the host stage-2,
one for pages used in the page-table when mapping memory regions, and
the other to map MMIO regions. The former is large enough to map all of
memory with page granularity and the latter can cover an arbitrary
portion of IPA space, but allows to 'recycle' pages.

However, this split makes accounting difficult to manage as pages at
intermediate levels of the page-table may be used to map both memory and
MMIO regions. Simplify the scheme by merging both pools into one. This
means we can now hit the -ENOMEM case in the memory abort path, but
we're still guaranteed forward-progress in the worst case by unmapping
MMIO regions. On the plus side this also means we can usually map a lot
more MMIO space at once if memory ranges happen to be mapped with block
mappings.
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210608114518.748712-5-qperret@google.com

The list_head member of struct hyp_page is only needed when the page is
attached to a free-list, which by definition implies the page is free.
As such, nothing prevents us from using the page itself to store the
list_head, hence reducing the size of the vmemmap.
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210608114518.748712-4-qperret@google.com

The hyp buddy allocator currently checks the struct hyp_page list node
to see if a page is available for allocation or not when trying to
coalesce memory. Now that decrementing the refcount and attaching to
the buddy tree is done in the same critical section, we can rely on the
refcount of the buddy page to be in sync, which allows to replace the
list node check by a refcount check. This will ease removing the list
node from struct hyp_page later on.
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210608114518.748712-3-qperret@google.com

The hyp_page refcount helpers currently rely on the hyp_pool lock for
serialization. However, this means the refcounts can't be changed from
the buddy allocator core as it already holds the lock, which means pages
have to go through odd transient states.

For example, when a page is freed, its refcount is set to 0, and the
lock is transiently released before the page can be attached to a free
list in the buddy tree. This is currently harmless as the allocator
checks the list node of each page to see if it is available for
allocation or not, but it means the page refcount can't be trusted to
represent the state of the page even if the pool lock is held.

In order to fix this, remove the pool locking from the refcount helpers,
and move all the logic to the buddy allocator. This will simplify the
removal of the list node from struct hyp_page in a later patch.
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210608114518.748712-2-qperret@google.com

MMIO block mapping support from Keqian Zhu, allowing larger
(and lazy) mappings for devices assigned to guests.

* kvm-arm64/mmu/MMIO-block-mapping:
  KVM: arm64: Try stage2 block mapping for host device MMIO
  KVM: arm64: Remove the creation time's mapping of MMIO regions

Rework the KVM GIC and timer to cope with lesser HW such as
the Apple M1 SoC.

* kvm-arm64/m1:
  irqchip/apple-aic: Advertise some level of vGICv3 compatibility
  KVM: arm64: timer: Add support for SW-based deactivation
  KVM: arm64: timer: Refactor IRQ configuration
  KVM: arm64: vgic: Implement SW-driven deactivation
  KVM: arm64: vgic: move irq->get_input_level into an ops structure
  KVM: arm64: vgic: Let an interrupt controller advertise lack of HW deactivation
  KVM: arm64: vgic: Be tolerant to the lack of maintenance interrupt masking
  KVM: arm64: Handle physical FIQ as an IRQ while running a guest
  irqchip/gic: Split vGIC probing information from the GIC code

The MMIO region of a device maybe huge (GB level), try to use
block mapping in stage2 to speedup both map and unmap.

Compared to normal memory mapping, we should consider two more
points when try block mapping for MMIO region:

1. For normal memory mapping, the PA(host physical address) and
HVA have same alignment within PUD_SIZE or PMD_SIZE when we use
the HVA to request hugepage, so we don't need to consider PA
alignment when verifing block mapping. But for device memory
mapping, the PA and HVA may have different alignment.

2. For normal memory mapping, we are sure hugepage size properly
fit into vma, so we don't check whether the mapping size exceeds
the boundary of vma. But for device memory mapping, we should pay
attention to this.

This adds get_vma_page_shift() to get page shift for both normal
memory and device MMIO region, and check these two points when
selecting block mapping size for MMIO region.
Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210507110322.23348-3-zhukeqian1@huawei.com

The MMIO regions may be unmapped for many reasons and can be remapped
by stage2 fault path. Map MMIO regions at creation time becomes a
minor optimization and makes these two mapping path hard to sync.

Remove the mapping code while keep the useful sanity check.
Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210507110322.23348-2-zhukeqian1@huawei.com

The CPUs in the Apple M1 SoC partially implement a virtual GICv3
CPU interface, although one that is incapable of HW deactivation
of interrupts, nor masking the maintenance interrupt.

Advertise the support to KVM.
Signed-off-by: Marc Zyngier <maz@kernel.org>

In order to deal with the lack of active state, we need to use
the mask/unmask primitives (after all, the active state is just an
additional mask on top of the normal one).

To avoid adding a bunch of ugly conditionals in the timer and vgic
code, let's use a timer-specific irqdomain to deal with the state
conversion. Yes, this is an unexpected use of irqdomains, but
there is no reason not to be just as creative as the designers
of the HW...

This involves overloading the vcpu_affinity, set_irqchip_state
and eoi callbacks so that the rest of the KVM code can continue
ignoring the oddities of the underlying platform.
Signed-off-by: Marc Zyngier <maz@kernel.org>

As we are about to add some more things to the timer IRQ
configuration, move this code out of the main timer init code
into its own set of functions.

No functional changes.
Signed-off-by: Marc Zyngier <maz@kernel.org>

In order to deal with these systems that do not offer HW-based
deactivation of interrupts, let implement a SW-based approach:

- When the irq is queued into a LR, treat it as a pure virtual
  interrupt and set the EOI flag in the LR.

- When the interrupt state is read back from the LR, force a
  deactivation when the state is invalid (neither active nor
  pending)

Interrupts requiring such treatment get the VGIC_SW_RESAMPLE flag.
Signed-off-by: Marc Zyngier <maz@kernel.org>

We already have the option to attach a callback to an interrupt
to retrieve its pending state. As we are planning to expand this
facility, move this callback into its own data structure.

This will limit the size of individual interrupts as the ops
structures can be shared across multiple interrupts.
Signed-off-by: Marc Zyngier <maz@kernel.org>

The vGIC, as architected by ARM, allows a virtual interrupt to
trigger the deactivation of a physical interrupt. This allows
the following interrupt to be delivered without requiring an exit.

However, some implementations have choosen not to implement this,
meaning that we will need some unsavoury workarounds to deal with this.

On detecting such a case, taint the kernel and spit a nastygram.
We'll deal with this in later patches.
Signed-off-by: Marc Zyngier <maz@kernel.org>

As it turns out, not all the interrupt controllers are able to
expose a vGIC maintenance interrupt that can be independently
enabled/disabled.

And to be fair, it doesn't really matter as all we require is
for the interrupt to kick us out of guest mode out way or another.

To that effect, add gic_kvm_info.no_maint_irq_mask for an interrupt
controller to advertise the lack of masking.
Signed-off-by: Marc Zyngier <maz@kernel.org>

As we we now entertain the possibility of FIQ being used on the host,
treat the signalling of a FIQ while running a guest as an IRQ,
causing an exit instead of a HYP panic.
Reviewed-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>

The vGIC advertising code is unsurprisingly very much tied to
the GIC implementations. However, we are about to extend the
support to lesser implementations.

Let's dissociate the vgic registration from the GIC code and
move it into KVM, where it makes a bit more sense. This also
allows us to mark the gic_kvm_info structures as __initdata.
Reviewed-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>

Pull i2c fixes from Wolfram Sang:
 "This is a bit larger than usual at rc4 time. The reason is due to
  Lee's work of fixing newly reported build warnings.

  The rest is fixes as usual"

* 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (22 commits)
  MAINTAINERS: adjust to removing i2c designware platform data
  i2c: s3c2410: fix possible NULL pointer deref on read message after write
  i2c: mediatek: Disable i2c start_en and clear intr_stat brfore reset
  i2c: i801: Don't generate an interrupt on bus reset
  i2c: mpc: implement erratum A-004447 workaround
  powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 i2c controllers
  powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c controllers
  dt-bindings: i2c: mpc: Add fsl,i2c-erratum-a004447 flag
  i2c: busses: i2c-stm32f4: Remove incorrectly placed ' ' from function name
  i2c: busses: i2c-st: Fix copy/paste function misnaming issues
  i2c: busses: i2c-pnx: Provide descriptions for 'alg_data' data structure
  i2c: busses: i2c-ocores: Place the expected function names into the documentation headers
  i2c: busses: i2c-eg20t: Fix 'bad line' issue and provide description for 'msgs' param
  i2c: busses: i2c-designware-master: Fix misnaming of 'i2c_dw_init_master()'
  i2c: busses: i2c-cadence: Fix incorrectly documented 'enum cdns_i2c_slave_mode'
  i2c: busses: i2c-ali1563: File headers are not good candidates for kernel-doc
  i2c: muxes: i2c-arb-gpio-challenge: Demote non-conformant kernel-doc headers
  i2c: busses: i2c-nomadik: Fix formatting issue pertaining to 'timeout'
  i2c: sh_mobile: Use new clock calculation formulas for RZ/G2E
  i2c: I2C_HISI should depend on ACPI
  ...

Pull seccomp fixes from Kees Cook:
 "This fixes a hard-to-hit race condition in the addfd user_notif
  feature of seccomp, visible since v5.9.

  And a small documentation fix"

* tag 'seccomp-fixes-v5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  seccomp: Refactor notification handler to prepare for new semantics
  Documentation: seccomp: Fix user notification documentation

Pull RISC-V fixes from Palmer Dabbelt:
 "A handful of RISC-V related fixes:

   - avoid errors when the stack tracing code is tracing itself.

   - resurrect the memtest= kernel command line argument on RISC-V,
     which was briefly enabled during the merge window before a
     refactoring disabled it.

   - build fix and some warning cleanups"

* tag 'riscv-for-linus-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  riscv: kexec: Fix W=1 build warnings
  riscv: kprobes: Fix build error when MMU=n
  riscv: Select ARCH_USE_MEMTEST
  riscv: stacktrace: fix the riscv stacktrace when CONFIG_FRAME_POINTER enabled

Pull xfs fixes from Darrick Wong:
 "This week's pile mitigates some decades-old problems in how extent
  size hints interact with realtime volumes, fixes some failures in
  online shrink, and fixes a problem where directory and symlink
  shrinking on extremely fragmented filesystems could fail.

  The most user-notable change here is to point users at our (new) IRC
  channel on OFTC. Freedom isn't free, it costs folks like you and me;
  and if you don't kowtow, they'll expel everyone and take over your
  channel. (Ok, ok, that didn't fit the song lyrics...)

  Summary:

   - Fix a bug where unmapping operations end earlier than expected,
     which can cause chaos on multi-block directory and symlink shrink
     operations.

   - Fix an erroneous assert that can trigger if we try to transition a
     bmap structure from btree format to extents format with zero
     extents. This was exposed by xfs/538"

* tag 'xfs-5.13-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: bunmapi has unnecessary AG lock ordering issues
  xfs: btree format inode forks can have zero extents
  xfs: add new IRC channel to MAINTAINERS
  xfs: validate extsz hints against rt extent size when rtinherit is set
  xfs: standardize extent size hint validation
  xfs: check free AG space when making per-AG reservations

This refactors the user notification code to have a do / while loop around
the completion condition. This has a small change in semantic, in that
previously we ignored addfd calls upon wakeup if the notification had been
responded to, but instead with the new change we check for an outstanding
addfd calls prior to returning to userspace.

Rodrigo Campos also identified a bug that can result in addfd causing
an early return, when the supervisor didn't actually handle the
syscall [1].

[1]: https://lore.kernel.org/lkml/20210413160151.3301-1-rodrigo@kinvolk.io/

Fixes: 7cf97b12 ("seccomp: Introduce addfd ioctl to seccomp user notifier")
Signed-off-by: Sargun Dhillon <sargun@sargun.me>
Acked-by: Tycho Andersen <tycho@tycho.pizza>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Tested-by: Rodrigo Campos <rodrigo@kinvolk.io>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210517193908.3113-3-sargun@sargun.me

Pull thermal fixes from Daniel Lezcano:

 - Fix uninitialized error code value for the SPMI adc driver (Yang
   Yingliang)

 - Fix kernel doc warning (Yang Li)

 - Fix wrong read-write thermal trip point initialization (Srinivas
   Pandruvada)

* tag 'thermal-v5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux:
  thermal/drivers/qcom: Fix error code in adc_tm5_get_dt_channel_data()
  thermal/ti-soc-thermal: Fix kernel-doc
  thermal/drivers/intel: Initialize RW trip to THERMAL_TEMP_INVALID

Pull char/misc driver fixes from Greg KH:
 "Here are some tiny char/misc driver fixes for 5.13-rc4.

  Nothing huge here, just some tiny fixes for reported issues:

   - two interconnect driver fixes

   - kgdb build warning fix for gcc-11

   - hgafb regression fix

   - soundwire driver fix

   - mei driver fix

  All have been in linux-next with no reported issues"

* tag 'char-misc-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  mei: request autosuspend after sending rx flow control
  kgdb: fix gcc-11 warnings harder
  video: hgafb: correctly handle card detect failure during probe
  soundwire: qcom: fix handling of qcom,ports-block-pack-mode
  interconnect: qcom: Add missing MODULE_DEVICE_TABLE
  interconnect: qcom: bcm-voter: add a missing of_node_put()

Merge tag 'driver-core-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

Pull driver core fixes from Greg KH:
 "Here are three small driver core / debugfs fixes for 5.13-rc4:

   - debugfs fix for incorrect "lockdown" mode for selinux accesses

   - two device link changes, one bugfix and one cleanup

  All of these have been in linux-next for over a week with no reported
  problems"

* tag 'driver-core-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
  drivers: base: Reduce device link removal code duplication
  drivers: base: Fix device link removal
  debugfs: fix security_locked_down() call for SELinux

Pull staging and IIO driver fixes from Greg KH:
 "Here are some small IIO and staging driver fixes for reported issues
  for 5.13-rc4.

  Nothing major here, tiny changes for reported problems, full details
  are in the shortlog if people are curious.

  All have been in linux-next for a while with no reported problems"

* tag 'staging-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  iio: adc: ad7793: Add missing error code in ad7793_setup()
  iio: adc: ad7923: Fix undersized rx buffer.
  iio: adc: ad7768-1: Fix too small buffer passed to iio_push_to_buffers_with_timestamp()
  iio: dac: ad5770r: Put fwnode in error case during ->probe()
  iio: gyro: fxas21002c: balance runtime power in error path
  staging: emxx_udc: fix loop in _nbu2ss_nuke()
  staging: iio: cdc: ad7746: avoid overwrite of num_channels
  iio: adc: ad7192: handle regulator voltage error first
  iio: adc: ad7192: Avoid disabling a clock that was never enabled.
  iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers
  iio: adc: ad7124: Fix missbalanced regulator enable / disable on error.

Pull tty / serial driver fixes from Greg KH:
 "Here are some small fixes for reported problems for tty and serial
  drivers for 5.13-rc4.

  They consist of:

   - 8250 bugfixes and new device support

   - lockdown security mode fixup

   - syzbot found problems fixed

   - 8250_omap fix for interrupt storm

   - revert of 8250_omap driver fix as it caused worse problem than the
     original issue

  All but the last patch have been in linux-next for a while, the last
  one is a revert of a problem found in linux-next with the 8250_omap
  driver change"

* tag 'tty-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  Revert "serial: 8250: 8250_omap: Fix possible interrupt storm"
  serial: 8250_pci: handle FL_NOIRQ board flag
  serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'
  serial: 8250_pci: Add support for new HPE serial device
  serial: 8250: 8250_omap: Fix possible interrupt storm
  serial: 8250: Use BIT(x) for UART_{CAP,BUG}_*
  serial: 8250: Add UART_BUG_TXRACE workaround for Aspeed VUART
  serial: 8250_dw: Add device HID for new AMD UART controller
  serial: sh-sci: Fix off-by-one error in FIFO threshold register setting
  serial: core: fix suspicious security_locked_down() call
  serial: tegra: Fix a mask operation that is always true

Pull USB / Thunderbolt fixes from Greg KH:
 "Here are a number of tiny USB and Thunderbolt driver fixes for
  5.13-rc4.

  They consist of:

   - thunderbolt fixes for some NVM bound issues

   - xhci fixes for reported problems

   - control-request fixups

   - documentation build warning fixes

   - new usb-serial driver device ids

   - typec bugfixes for reported issues

   - usbfs warning fixups (could be triggered from userspace)

   - other tiny fixes for reported problems.

  All of these have been in linux-next with no reported issues"

* tag 'usb-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (22 commits)
  xhci: Fix 5.12 regression of missing xHC cache clearing command after a Stall
  xhci: fix giving back URB with incorrect status regression in 5.12
  usb: gadget: udc: renesas_usb3: Fix a race in usb3_start_pipen()
  usb: typec: tcpm: Respond Not_Supported if no snk_vdo
  usb: typec: tcpm: Properly interrupt VDM AMS
  USB: trancevibrator: fix control-request direction
  usb: Restore the usb_header label
  usb: typec: tcpm: Use LE to CPU conversion when accessing msg->header
  usb: typec: ucsi: Clear pending after acking connector change
  usb: typec: mux: Fix matching with typec_altmode_desc
  misc/uss720: fix memory leak in uss720_probe
  usb: dwc3: gadget: Properly track pending and queued SG
  USB: usbfs: Don't WARN about excessively large memory allocations
  thunderbolt: usb4: Fix NVM read buffer bounds and offset issue
  thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue
  usb: chipidea: udc: assign interrupt number to USB gadget structure
  usb: cdnsp: Fix lack of removing request from pending list.
  usb: cdns3: Fix runtime PM imbalance on error
  USB: serial: pl2303: add device id for ADLINK ND-6530 GC
  USB: serial: ti_usb_3410_5052: add startech.com device id
  ...

Pull KVM fixes from Paolo Bonzini:
 "ARM fixes:

   - Another state update on exit to userspace fix

   - Prevent the creation of mixed 32/64 VMs

   - Fix regression with irqbypass not restarting the guest on failed
     connect

   - Fix regression with debug register decoding resulting in
     overlapping access

   - Commit exception state on exit to usrspace

   - Fix the MMU notifier return values

   - Add missing 'static' qualifiers in the new host stage-2 code

  x86 fixes:

   - fix guest missed wakeup with assigned devices

   - fix WARN reported by syzkaller

   - do not use BIT() in UAPI headers

   - make the kvm_amd.avic parameter bool

  PPC fixes:

   - make halt polling heuristics consistent with other architectures

  selftests:

   - various fixes

   - new performance selftest memslot_perf_test

   - test UFFD minor faults in demand_paging_test"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (44 commits)
  selftests: kvm: fix overlapping addresses in memslot_perf_test
  KVM: X86: Kill off ctxt->ud
  KVM: X86: Fix warning caused by stale emulation context
  KVM: X86: Use kvm_get_linear_rip() in single-step and #DB/#BP interception
  KVM: x86/mmu: Fix comment mentioning skip_4k
  KVM: VMX: update vcpu posted-interrupt descriptor when assigning device
  KVM: rename KVM_REQ_PENDING_TIMER to KVM_REQ_UNBLOCK
  KVM: x86: add start_assignment hook to kvm_x86_ops
  KVM: LAPIC: Narrow the timer latency between wait_lapic_expire and world switch
  selftests: kvm: do only 1 memslot_perf_test run by default
  KVM: X86: Use _BITUL() macro in UAPI headers
  KVM: selftests: add shared hugetlbfs backing source type
  KVM: selftests: allow using UFFD minor faults for demand paging
  KVM: selftests: create alias mappings when using shared memory
  KVM: selftests: add shmem backing source type
  KVM: selftests: refactor vm_mem_backing_src_type flags
  KVM: selftests: allow different backing source types
  KVM: selftests: compute correct demand paging size
  KVM: selftests: simplify setup_demand_paging error handling
  KVM: selftests: Print a message if /dev/kvm is missing
  ...

Pull s390 fixes from Vasily Gorbik:
 "Fix races in vfio-ccw request handling"

* tag 's390-5.13-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  vfio-ccw: Serialize FSM IDLE state with I/O completion
  vfio-ccw: Reset FSM state to IDLE inside FSM
  vfio-ccw: Check initialized flag in cp_init()

vm_create allocates memory and maps it close to GPA.  This memory
is separate from what is allocated in subsequent calls to
vm_userspace_mem_region_add, so it is incorrect to pass the
test memory size to vm_create_default.  Just pass a small
fixed amount of memory which can be used later for page table,
otherwise GPAs are already allocated at MEM_GPA and the
test aborts.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Pull SCSI fixes from James Bottomley:
 "Ten small fixes, all in drivers"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal
  scsi: hisi_sas: Drop free_irq() of devm_request_irq() allocated irq
  scsi: vmw_pvscsi: Set correct residual data length
  scsi: bnx2fc: Return failure if io_req is already in ABTS processing
  scsi: aic7xxx: Remove multiple definition of globals
  scsi: aic7xxx: Restore several defines for aic7xxx firmware build
  scsi: target: iblock: Fix smp_processor_id() BUG messages
  scsi: libsas: Use _safe() loop in sas_resume_port()
  scsi: target: tcmu: Fix xarray RCU warning
  scsi: target: core: Avoid smp_processor_id() in preemptible code

Pull block fixes from Jens Axboe:

 - NVMe pull request (Christoph):
      - fix a memory leak in nvme_cdev_add (Guoqing Jiang)
      - fix inline data size comparison in nvmet_tcp_queue_response (Hou
        Pu)
      - fix false keep-alive timeout when a controller is torn down
        (Sagi Grimberg)
      - fix a nvme-tcp Kconfig dependency (Sagi Grimberg)
      - short-circuit reconnect retries for FC (Hannes Reinecke)
      - decode host pathing error for connect (Hannes Reinecke)

 - MD pull request (Song):
      - Fix incorrect chunk boundary assert (Christoph)

 - Fix s390/dasd verification panic (Stefan)

* tag 'block-5.13-2021-05-28' of git://git.kernel.dk/linux-block:
  nvmet: fix false keep-alive timeout when a controller is torn down
  nvmet-tcp: fix inline data size comparison in nvmet_tcp_queue_response
  nvme-tcp: remove incorrect Kconfig dep in BLK_DEV_NVME
  md/raid5: remove an incorrect assert in in_chunk_boundary
  s390/dasd: add missing discipline function
  nvme-fabrics: decode host pathing error for connect
  nvme-fc: short-circuit reconnect retries
  nvme: fix potential memory leaks in nvme_cdev_add

Pull io_uring fixes from Jens Axboe:
 "A few minor fixes:

   - Fix an issue with hashed wait removal on exit (Zqiang, Pavel)

   - Fix a recent data race introduced in this series (Marco)"

* tag 'io_uring-5.13-2021-05-28' of git://git.kernel.dk/linux-block:
  io_uring: fix data race to avoid potential NULL-deref
  io-wq: Fix UAF when wakeup wqe in hash waitqueue
  io_uring/io-wq: close io-wq full-stop gap

Pull drm fixes from Dave Airlie:
 "Pretty quiet this week, couple of amdgpu, one i915, and a few misc otherwise.

  ttm:
   - prevent irrelevant swapout

  amdgpu:
   - MultiGPU fan fix
   - VCN powergating fixes

  amdkfd:
   - Fix SDMA register offset error

  meson:
   - fix shutdown crash

  i915:
   - Re-enable LTTPR non-transparent LT mode for DPCD_REV < 1.4"

* tag 'drm-fixes-2021-05-29' of git://anongit.freedesktop.org/drm/drm:
  drm/ttm: Skip swapout if ttm object is not populated
  drm/i915: Reenable LTTPR non-transparent LT mode for DPCD_REV<1.4
  drm/meson: fix shutdown crash when component not probed
  drm/amdgpu/jpeg3: add cancel_delayed_work_sync before power gate
  drm/amdgpu/jpeg2.5: add cancel_delayed_work_sync before power gate
  drm/amdgpu/jpeg2.0: add cancel_delayed_work_sync before power gate
  drm/amdgpu/vcn3: add cancel_delayed_work_sync before power gate
  drm/amdgpu/vcn2.5: add cancel_delayed_work_sync before power gate
  drm/amdgpu/vcn2.0: add cancel_delayed_work_sync before power gate
  drm/amdgpu/vcn1: add cancel_delayed_work_sync before power gate
  drm/amdkfd: correct sienna_cichlid SDMA RLC register offset error
  drm/amd/pm: correct MGpuFanBoost setting