Starting with Arch Perfmon v5, the anythread filter on generic counters may be
deprecated. The current kernel was exporting the any filter without checking.
On Icelake, it means you could do cpu/event=0x3c,any/ even though the filter
does not exist. This patch corrects the problem by relying on the CPUID 0xa leaf
function to determine if anythread is supported or not as described in the
Intel SDM Vol3b 18.2.5.1 AnyThread Deprecation section.
Signed-off-by: Stephane Eranian <eranian@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20201028194247.3160610-1-eranian@google.com

Currently perf_event_attr::exclusive can be used to ensure an
event(group) is the sole group scheduled on the PMU. One consequence
is that when you have a pinned event (say the watchdog) you can no
longer have regular exclusive event(group)s.

Inspired by the fact that !pinned events are considered less strict,
allow !pinned,exclusive events to share the PMU with pinned,!exclusive
events.

Pinned,exclusive is still fully exclusive.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20201029162902.105962225@infradead.org

Commit 9e630205 ("perf: Use hrtimers for event multiplexing")
placed the hrtimer (re)start call in the wrong place.  Instead of
capturing all scheduling failures, it only considered the PMU failure.

The result is that groups using perf_event_attr::exclusive are no
longer rotated.

Fixes: 9e630205 ("perf: Use hrtimers for event multiplexing")
Reported-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20201029162902.038667689@infradead.org

Collate the error paths. Code duplication only leads to divergence and
extra bugs.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20201029162901.972161394@infradead.org

Since event_sched_out() clears cpuctx->exclusive upon removal of an
exclusive event (and only group leaders can be exclusive), there is no
point in group_sched_out() trying to do it too. It is impossible for
cpuctx->exclusive to still be set here.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20201029162901.904060564@infradead.org

Having pt_regs on-stack is unfortunate, it's 168 bytes. Since it isn't
actually used, make it a static variable. This both gets if off the
stack and ensures it gets 0 initialized, just in case someone does
look at it.
Reported-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20201030151955.324273677@infradead.org

struct perf_sample_data lives on-stack, we should be careful about it's
size. Furthermore, the pt_regs copy in there is only because x86_64 is a
trainwreck, solve it differently.
Reported-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Steven Rostedt <rostedt@goodmis.org>
Link: https://lkml.kernel.org/r/20201030151955.258178461@infradead.org

  "Look ma, no branches!"
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
Link: https://lkml.kernel.org/r/20201030151955.187580298@infradead.org

One should use in_serving_softirq() to detect SoftIRQ context.

Fixes: 96f6d444 ("perf_counter: avoid recursion")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20201030151955.120572175@infradead.org

intel_pmu_drain_pebs_*() is typically called from handle_pmi_common(),
both have an on-stack struct perf_sample_data, which is *big*. Rewire
things so that drain_pebs() can use the one handle_pmi_common() has.
Reported-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20201030151955.054099690@infradead.org

__perf_output_begin() has an on-stack struct perf_sample_data in the
unlikely case it needs to generate a LOST record. However, every call
to perf_output_begin() must already have a perf_sample_data on-stack.
Reported-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20201030151954.985416146@infradead.org

As shown through runtime testing, the "filename" allocation is not
always freed in perf_event_parse_addr_filter().

There are three possible ways that this could happen:

 - It could be allocated twice on subsequent iterations through the loop,
 - or leaked on the success path,
 - or on the failure path.

Clean up the code flow to make it obvious that 'filename' is always
freed in the reallocation path and in the two return paths as well.

We rely on the fact that kfree(NULL) is NOP and filename is initialized
with NULL.

This fixes the leak. No other side effects expected.

[ Dan Carpenter: cleaned up the code flow & added a changelog. ]
[ Ingo Molnar: updated the changelog some more. ]

Fixes: 375637bc ("perf/core: Introduce address range filtering")
Signed-off-by: "kiyin(尹亮)" <kiyin@tencent.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: "Srivatsa S. Bhat" <srivatsa@csail.mit.edu>
Cc: Anthony Liguori <aliguori@amazon.com>
--
 kernel/events/core.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

Pull ceph fix from Ilya Dryomov:
 "A fix for a potential stall on umount caused by the MDS dropping our
  REQUEST_CLOSE message. The code that handled this case was
  inadvertently disabled in 5.9, this patch removes it entirely and
  fixes the problem in a way that is consistent with ceph-fuse"

* tag 'ceph-for-5.10-rc3' of git://github.com/ceph/ceph-client:
  ceph: check session state after bumping session->s_seq

Merge tag 'linux-kselftest-fixes-5.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

Pull Kselftest fixes from Shuah Khan:
 "Fixes to the ftrace test and several fixes from Tommi Rantala for
  various other tests"

* tag 'linux-kselftest-fixes-5.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  selftests: binderfs: use SKIP instead of XFAIL
  selftests: clone3: use SKIP instead of XFAIL
  selftests: core: use SKIP instead of XFAIL in close_range_test.c
  selftests: proc: fix warning: _GNU_SOURCE redefined
  selftests: pidfd: drop needless linux/kcmp.h inclusion in pidfd_setns_test.c
  selftests: pidfd: add CONFIG_CHECKPOINT_RESTORE=y to config
  selftests: pidfd: skip test on kcmp() ENOSYS
  selftests: pidfd: use ksft_test_result_skip() when skipping test
  selftests/harness: prettify SKIP message whitespace again
  selftests: pidfd: fix compilation errors due to wait.h
  selftests: filter kselftest headers from command in lib.mk
  selftests/ftrace: check for do_sys_openat2 in user-memory test
  selftests/ftrace: Use $FUNCTION_FORK to reference kernel fork function

Pull SCSI fixes from James Bottomley:
 "Three driver fixes. Two (alua and hpsa) are in hard to trigger
  attach/detach situations but the mp3sas one involves a polled to
  interrupt switch over that could trigger in any high IOPS situation"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: mpt3sas: Fix timeouts observed while reenabling IRQ
  scsi: scsi_dh_alua: Avoid crash during alua_bus_detach()
  scsi: hpsa: Fix memory leak in hpsa_init_one()

Pull mtd fixes from Miquel Raynal.

* 'mtd/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
  mtd: rawnand: stm32_fmc2: fix broken ECC
  mtd: spi-nor: Fix address width on flash chips > 16MB
  mtd: spi-nor: Don't copy self-pointing struct around
  mtd: rawnand: ifc: Move the ECC engine initialization to the right place
  mtd: rawnand: mxc: Move the ECC engine initialization to the right place

Pull spi fix from Mark Brown:
 "This is an additional fix on top of 5e31ba0c ('spi: bcm2835: fix
  gpio cs level inversion') - when sending my prior pull request I had
  misremembred the status of that patch, apologies for the noise here"

* tag 'spi-fix-v5.10-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: bcm2835: remove use of uninitialized gpio flags variable

Pull sound fixes from Takashi Iwai:
 "Quite a bunch of small fixes that have been gathered since the last
  pull, including changes like below:

   - HD-audio runtime PM fixes and refactoring

   - HD-audio and USB-audio quirks

   - SOF warning fix

   - Various ASoC device-specific fixes for Intel, Qualcomm, etc"

* tag 'sound-5.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (26 commits)
  ALSA: usb-audio: Add implicit feedback quirk for Qu-16
  ASoC: mchp-spdiftx: Do not set Validity bit(s)
  ALSA: usb-audio: Add implicit feedback quirk for MODX
  ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices
  ALSA: hda/realtek - Enable headphone for ASUS TM420
  ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link()
  ASoC: qcom: lpass-cpu: Fix clock disable failure
  ASoC: qcom: lpass-sc7180: Fix MI2S bitwidth field bit positions
  ASoC: codecs: wcd9335: Set digital gain range correctly
  ASoC: codecs: wcd934x: Set digital gain range correctly
  ALSA: hda: Reinstate runtime_allow() for all hda controllers
  ALSA: hda: Separate runtime and system suspend
  ALSA: hda: Refactor codec PM to use direct-complete optimization
  ALSA: hda/realtek - Fixed HP headset Mic can't be detected
  ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2
  ALSA: make snd_kcontrol_new name a normal string
  ALSA: fix kernel-doc markups
  ASoC: SOF: loader: handle all SOF_IPC_EXT types
  ASoC: cs42l51: manage mclk shutdown delay
  ASoC: qcom: sdm845: set driver name correctly
  ...

Pull drm fixes from Dave Airlie:
 "It's Friday here so that means another installment of drm fixes to
  distract you from the counting process.

  Changes all over the place, the amdgpu changes contain support for a
  new GPU that is close to current one already in the tree (Green
  Sardine) so it shouldn't have much side effects.

  Otherwise imx has a few cleanup patches and fixes, amdgpu and i915
  have around the usual smattering of fixes, fonts got constified, and
  vc4/panfrost has some minor fixes. All in all a fairly regular rc3.

  We have an outstanding nouveau regression, but the author is looking
  into the fix, so should be here next week.

  I now return you to counting.

  fonts:
   - constify font structures.

  MAINTAINERS:
   - Fix path for amdgpu power management

  amdgpu:
   - Add support for more navi1x SKUs
   - Fix for suspend on CI dGPUs
   - VCN DPG fix for Picasso
   - Sienna Cichlid fixes
   - Polaris DPM fix
   - Add support for Green Sardine

  amdkfd:
   - Fix an allocation failure check

  i915:
   - Fix set domain's cache coherency
   - Fixes around breadcrumbs
   - Fix encoder lookup during PSR atomic
   - Hold onto an explicit ref to i915_vma_work.pinned
   - gvt: HWSP reset handling fix
   - gvt: flush workaround
   - gvt: vGPU context pin/unpin
   - gvt: mmio cmd access fix for bxt/apl

  imx:
   - drop unused functions and callbacks
   - reuse imx_drm_encoder_parse_of
   - spinlock rework
   - memory leak fix
   - minor cleanups

  vc4:
   - resource cleanup fix

  panfrost:
   - madvise/shrinker fix"

* tag 'drm-fixes-2020-11-06-1' of git://anongit.freedesktop.org/drm/drm: (55 commits)
  drm/amdgpu/display: remove DRM_AMD_DC_GREEN_SARDINE
  drm/amd/display: Add green_sardine support to DM
  drm/amd/display: Add green_sardine support to DC
  drm/amdgpu: enable vcn support for green_sardine (v2)
  drm/amdgpu: enable green_sardine_asd.bin loading (v2)
  drm/amdgpu/sdma: add sdma engine support for green_sardine (v2)
  drm/amdgpu: add gfx support for green_sardine (v2)
  drm/amdgpu: add soc15 common ip block support for green_sardine (v3)
  drm/amdgpu: add green_sardine support for gpu_info and ip block setting (v2)
  drm/amdgpu: add Green_Sardine APU flag
  drm/amdgpu: resolved ASD loading issue on sienna
  amdkfd: Check kvmalloc return before memcpy
  drm/amdgpu: update golden setting for sienna_cichlid
  amd/amdgpu: Disable VCN DPG mode for Picasso
  drm/amdgpu/swsmu: remove duplicate call to smu_set_default_dpm_table
  drm/i915: Hold onto an explicit ref to i915_vma_work.pinned
  drm/i915/gt: Flush xcs before tgl breadcrumbs
  drm/i915/gt: Expose more parameters for emitting writes into the ring
  drm/i915: Fix encoder lookup during PSR atomic check
  drm/i915/gt: Use the local HWSP offset during submission
  ...

Merge tag 'tpmdd-next-v5.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd

Pull tpm fixes from Jarkko Sakkinen:
 "Two critical tpm driver bug fixes"

* tag 'tpmdd-next-v5.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
  tpm: efi: Don't create binary_bios_measurements file for an empty log
  tpm_tis: Disable interrupts on ThinkPad T490s

Pull iommu fixes from Joerg Roedel:

 - Fix a NULL-ptr dereference in the Intel VT-d driver

 - Two fixes for Intel SVM support

 - Increase IRQ remapping table size in the AMD IOMMU driver. The old
   number of 128 turned out to be too low for some recent devices.

 - Fix a mask check in generic IOMMU code

* tag 'iommu-fixes-v5.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
  iommu: Fix a check in iommu_check_bind_data()
  iommu/vt-d: Fix a bug for PDP check in prq_event_thread
  iommu/vt-d: Fix sid not set issue in intel_svm_bind_gpasid()
  iommu/vt-d: Fix kernel NULL pointer dereference in find_domain()
  iommu/amd: Increase interrupt remapping table limit to 512 entries

Pull VFIO fixes from Alex Williamson:

 - Remove code by using existing helper (Zenghui Yu)

 - fsl-mc copy-user return and underflow fixes (Dan Carpenter)

 - fsl-mc static function declaration (Diana Craciun)

 - Fix ioeventfd sleeping under spinlock (Alex Williamson)

 - Fix pm reference count leak in vfio-platform (Zhang Qilong)

 - Allow opening IGD device w/o OpRegion support (Fred Gao)

* tag 'vfio-v5.10-rc3' of git://github.com/awilliam/linux-vfio:
  vfio/pci: Bypass IGD init in case of -ENODEV
  vfio: platform: fix reference leak in vfio_platform_open
  vfio/pci: Implement ioeventfd thread handler for contended memory lock
  vfio/fsl-mc: Make vfio_fsl_mc_irqs_allocate static
  vfio/fsl-mc: prevent underflow in vfio_fsl_mc_mmap()
  vfio/fsl-mc: return -EFAULT if copy_to_user() fails
  vfio/type1: Use the new helper to find vfio_group

Pull arm64 fixes from Will Deacon:
 "Here's the weekly batch of fixes for arm64. Not an awful lot here, but
  there are still a few unresolved issues relating to CPU hotplug, RCU
  and IRQ tracing that I hope to queue fixes for next week.

  Summary:

   - Fix early use of kprobes

   - Fix kernel placement in kexec_file_load()

   - Bump maximum number of NUMA nodes"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: kexec_file: try more regions if loading segments fails
  arm64: kprobes: Use BRK instead of single-step when executing instructions out-of-line
  arm64: NUMA: Kconfig: Increase NODES_SHIFT to 4

Pull ARC fixes from Vineet Gupta:

 - Unbork HSDKv1 platform (won't boot) due to memory map issue

 - Prevent stack unwinder from infinite looping

* tag 'arc-5.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
  ARC: [plat-hsdk] Remap CCMs super early in asm boot trampoline
  ARC: stack unwinding: avoid indefinite looping

Pull s390 fixes from Heiko Carstens:

 - fix reference counting for ap devices

 - fix paes selftest

 - fix pmd_deref()/pud_deref() so they can also handle large pages

 - remove unused vdso file and defines

 - update defconfigs

 - call rcu_cpu_starting() early in smp init code to avoid lockdep
   warnings

 - fix hotplug of PCI function missing bus

* tag 's390-5.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/pci: fix hot-plug of PCI function missing bus
  s390/smp: move rcu_cpu_starting() earlier
  s390/pkey: fix paes selftest failure with paes and pkey static build
  s390: update defconfigs
  s390/vdso: remove unused constants
  s390/vdso: remove empty unused file
  s390/mm: make pmd/pud_deref() large page aware
  s390/ap: fix ap devices reference counting

Pull networking fixes from Jakub Kicinski:
 "Networking fixes for 5.10-rc3, including fixes from wireless, can, and
  netfilter subtrees.

  Current merge window - bugs in new features:

   - can: isotp: isotp_rcv_cf(): enable RX timeout handling in
     listen-only mode

  Previous releases - regressions:

   - mac80211:
      - don't require VHT elements for HE on 2.4 GHz
      - fix regression where EAPOL frames were sent in plaintext

   - netfilter:
      - ipset: Update byte and packet counters regardless of whether
        they match

   - ip_tunnel: fix over-mtu packet send by allowing fragmenting even if
     inner packet has IP_DF (don't fragment) set in its header (when
     TUNNEL_DONT_FRAGMENT flag is not set on the tunnel dev)

   - net: fec: fix MDIO probing for some FEC hardware blocks

   - ip6_tunnel: set inner ipproto before ip6_tnl_encap to un-break gso
     support

   - sctp: Fix COMM_LOST/CANT_STR_ASSOC err reporting on big-endian
     platforms, sparse-related fix used the wrong integer size

  Previous releases - always broken:

   - netfilter: use actual socket sk rather than skb sk when routing
     harder

   - r8169: work around short packet hw bug on RTL8125 by padding frames

   - net: ethernet: ti: cpsw: disable PTPv1 hw timestamping
     advertisement, the hardware does not support it

   - chelsio/chtls: fix always leaking ctrl_skb and another leak caused
     by a race condition

   - fix drivers incorrectly writing into skbs on TX:
      - cadence: force nonlinear buffers to be cloned
      - gianfar: Account for Tx PTP timestamp in the skb headroom
      - gianfar: Replace skb_realloc_headroom with skb_cow_head for PTP

   - can: flexcan:
      - remove FLEXCAN_QUIRK_DISABLE_MECR quirk for LS1021A
      - add ECC initialization for VF610 and LX2160A
      - flexcan_remove(): disable wakeup completely

   - can: fix packet echo functionality:
      - peak_canfd: fix echo management when loopback is on
      - make sure skbs are not freed in IRQ context in case they need to
        be dropped
      - always clone the skbs to make sure they have a reference on the
        socket, and prevent it from disappearing
      - fix real payload length return value for RTR frames

   - can: j1939: return failure on bind if netdev is down, rather than
     waiting indefinitely

  Misc:

   - IPv6: reply ICMP error if the first fragment don't include all
     headers to improve compliance with RFC 8200"

* tag 'net-5.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (66 commits)
  ionic: check port ptr before use
  r8169: work around short packet hw bug on RTL8125
  net: openvswitch: silence suspicious RCU usage warning
  chelsio/chtls: fix always leaking ctrl_skb
  chelsio/chtls: fix memory leaks caused by a race
  can: flexcan: flexcan_remove(): disable wakeup completely
  can: flexcan: add ECC initialization for VF610
  can: flexcan: add ECC initialization for LX2160A
  can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for LS1021A
  can: mcp251xfd: remove unneeded break
  can: mcp251xfd: mcp251xfd_regmap_nocrc_read(): fix semicolon.cocci warnings
  can: mcp251xfd: mcp251xfd_regmap_crc_read(): increase severity of CRC read error messages
  can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on
  can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping
  can: peak_usb: add range checking in decode operations
  can: xilinx_can: handle failure cases of pm_runtime_get_sync
  can: ti_hecc: ti_hecc_probe(): add missed clk_disable_unprepare() in error path
  can: isotp: padlen(): make const array static, makes object smaller
  can: isotp: isotp_rcv_cf(): enable RX timeout handling in listen-only mode
  can: isotp: Explain PDU in CAN_ISOTP help text
  ...

Mimic the pre-existing ACPI and Device Tree event log behavior by not
creating the binary_bios_measurements file when the EFI TPM event log is
empty.

This fixes the following NULL pointer dereference that can occur when
reading /sys/kernel/security/tpm0/binary_bios_measurements after the
kernel received an empty event log from the firmware:

 BUG: kernel NULL pointer dereference, address: 000000000000002c
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: 0000 [#1] SMP PTI
 CPU: 2 PID: 3932 Comm: fwupdtpmevlog Not tainted 5.9.0-00003-g629990edad62 #17
 Hardware name: LENOVO 20LCS03L00/20LCS03L00, BIOS N27ET38W (1.24 ) 11/28/2019
 RIP: 0010:tpm2_bios_measurements_start+0x3a/0x550
 Code: 54 53 48 83 ec 68 48 8b 57 70 48 8b 1e 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 48 8b 82 c0 06 00 00 48 8b 8a c8 06 00 00 <44> 8b 60 1c 48 89 4d a0 4c 89 e2 49 83 c4 20 48 83 fb 00 75 2a 49
 RSP: 0018:ffffa9c901203db0 EFLAGS: 00010246
 RAX: 0000000000000010 RBX: 0000000000000000 RCX: 0000000000000010
 RDX: ffff8ba1eb99c000 RSI: ffff8ba1e4ce8280 RDI: ffff8ba1e4ce8258
 RBP: ffffa9c901203e40 R08: ffffa9c901203dd8 R09: ffff8ba1ec443300
 R10: ffffa9c901203e50 R11: 0000000000000000 R12: ffff8ba1e4ce8280
 R13: ffffa9c901203ef0 R14: ffffa9c901203ef0 R15: ffff8ba1e4ce8258
 FS:  00007f6595460880(0000) GS:ffff8ba1ef880000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 000000000000002c CR3: 00000007d8d18003 CR4: 00000000003706e0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 Call Trace:
  ? __kmalloc_node+0x113/0x320
  ? kvmalloc_node+0x31/0x80
  seq_read+0x94/0x420
  vfs_read+0xa7/0x190
  ksys_read+0xa7/0xe0
  __x64_sys_read+0x1a/0x20
  do_syscall_64+0x37/0x80
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

In this situation, the bios_event_log pointer in the tpm_bios_log struct
was not NULL but was equal to the ZERO_SIZE_PTR (0x10) value. This was
due to the following kmemdup() in tpm_read_log_efi():

int tpm_read_log_efi(struct tpm_chip *chip)
{
...
	/* malloc EventLog space */
	log->bios_event_log = kmemdup(log_tbl->log, log_size, GFP_KERNEL);
	if (!log->bios_event_log) {
		ret = -ENOMEM;
		goto out;
	}
...
}

When log_size is zero, due to an empty event log from firmware,
ZERO_SIZE_PTR is returned from kmemdup(). Upon a read of the
binary_bios_measurements file, the tpm2_bios_measurements_start()
function does not perform a ZERO_OR_NULL_PTR() check on the
bios_event_log pointer before dereferencing it.

Rather than add a ZERO_OR_NULL_PTR() check in functions that make use of
the bios_event_log pointer, simply avoid creating the
binary_bios_measurements_file as is done in other event log retrieval
backends.

Explicitly ignore all of the events in the final event log when the main
event log is empty. The list of events in the final event log cannot be
accurately parsed without referring to the first event in the main event
log (the event log header) so the final event log is useless in such a
situation.

Fixes: 58cc1e4f ("tpm: parse TPM event logs based on EFI table")
Link: https://lore.kernel.org/linux-integrity/E1FDCCCB-CA51-4AEE-AC83-9CDE995EAE52@canonical.com/Reported-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Reported-by: Kenneth R. Crudup <kenny@panix.com>
Reported-by: Mimi Zohar <zohar@linux.ibm.com>
Cc: Thiébaud Weksteen <tweek@google.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

There is a misconfiguration in the bios of the gpio pin used for the
interrupt in the T490s. When interrupts are enabled in the tpm_tis
driver code this results in an interrupt storm. This was initially
reported when we attempted to enable the interrupt code in the tpm_tis
driver, which previously wasn't setting a flag to enable it. Due to
the reports of the interrupt storm that code was reverted and we went back
to polling instead of using interrupts. Now that we know the T490s problem
is a firmware issue, add code to check if the system is a T490s and
disable interrupts if that is the case. This will allow us to enable
interrupts for everyone else. If the user has a fixed bios they can
force the enabling of interrupts with tpm_tis.interrupts=1 on the
kernel command line.

Cc: Peter Huewe <peterhuewe@gmx.de>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
Reviewed-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

Removing the duplicate gpio chip select level handling in
bcm2835_spi_setup() left the lflags variable uninitialized. Avoid trhe
use of such variable by passing default flags to
gpiochip_request_own_desc().

Fixes: 5e31ba0c ("spi: bcm2835: fix gpio cs level inversion")
Signed-off-by: Martin Hundebøll <martin@geanix.com>
Link: https://lore.kernel.org/r/20201105090615.620315-1-martin@geanix.comSigned-off-by: Mark Brown <broonie@kernel.org>

Some patches for vc4 to fix some resources cleanup issues, two fixes for
panfrost for madvise and the shrinker and a constification of fonts
structure
Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/20201105101354.socyu26jwyns7lfj@gilmour.lan

Merge tag 'amd-drm-fixes-5.10-2020-11-04' of git://people.freedesktop.org/~agd5f/linux into drm-fixes

amd-drm-fixes-5.10-2020-11-04:

amdgpu:
- Add support for more navi1x SKUs
- Fix for suspend on CI dGPUs
- VCN DPG fix for Picasso
- Sienna Cichlid fixes
- Polaris DPM fix
- Add support for Green Sardine

amdkfd:
- Fix an allocation failure check

MAINTAINERS:
- Fix path for amdgpu power management
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Alex Deucher <alexdeucher@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201104205741.4100-1-alexander.deucher@amd.com

Merge tag 'drm-intel-fixes-2020-11-05' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes

- GVT fixes including vGPU suspend/resume fixes and workaround for APL guest GPU hang.
- Fix set domain's cache coherency (Chris)
- Fixes around breadcrumbs (Chris)
- Fix encoder lookup during PSR atomic (Imre)
- Hold onto an explicit ref to i915_vma_work.pinned (Chris)
Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201105173026.GA858446@intel.com

drm/imx: fixes and cleanups

Remove unused functions and empty callbacks, let the dw_hdmi-imx driver
reuse imx_drm_encoder_parse_of() instead of reimplementing it, replace
the custom register spinlock with the regmap default spinlock and remove
redundant tracking of enabled state in imx-tve, drop the explicit
drm_mode_config_cleanup() call in imx-drm-core, reduce the scope of edid
length variables that are not otherwise used in imx-ldb and
parallel-display, fix a memory leak in the parallel-display bind error
path, and drop an extraneous type qualifier from of_get_tve_mode().
Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Philipp Zabel <p.zabel@pengutronix.de>
Link: https://patchwork.freedesktop.org/patch/msgid/7e4af582027bbec269364b95f6978d061b48271a.camel@pengutronix.de

It's possible that the first region picked for the new kernel will make
it impossible to fit the other segments in the required 32GB window,
especially if we have a very large initrd.

Instead of giving up, we can keep testing other regions for the kernel
until we find one that works.
Suggested-by: Ryan O'Leary <ryanoleary@google.com>
Signed-off-by: Benjamin Gwin <bgwin@google.com>
Link: https://lore.kernel.org/r/20201103201106.2397844-1-bgwin@google.comSigned-off-by: Will Deacon <will@kernel.org>

Merge tag 'linux-kselftest-kunit-fixes-5.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

Pull Kunit fixes from Shuah Khan:
 "Several kunit_tool and documentation fixes"

* tag 'linux-kselftest-kunit-fixes-5.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  kunit: tools: fix kunit_tool tests for parsing test plans
  Documentation: kunit: Update Kconfig parts for KUNIT's module support
  kunit: test: fix remaining kernel-doc warnings
  kunit: Don't fail test suites if one of them is empty
  kunit: Fix kunit.py --raw_output option

Pull tracing fixes from Steven Rostedt:

 - Fix off-by-one error in retrieving the context buffer for
   trace_printk()

 - Fix off-by-one error in stack nesting limit

 - Fix recursion to not make all NMI code false positive as recursing

 - Stop losing events in function tracing when transitioning between irq
   context

 - Stop losing events in ring buffer when transitioning between irq
   context

 - Fix return code of error pointer in parse_synth_field() to prevent
   NULL pointer dereference.

 - Fix false positive of NMI recursion in kprobe event handling

* tag 'trace-v5.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
  kprobes: Tell lockdep about kprobe nesting
  tracing: Make -ENOMEM the default error for parse_synth_field()
  ring-buffer: Fix recursion protection transitions between interrupt context
  tracing: Fix the checking of stackidx in __ftrace_trace_stack
  ftrace: Handle tracing when switching between context
  ftrace: Fix recursion check for NMI test
  tracing: Fix out of bounds write in get_trace_buf

Pull hyperv fixes from Wei Liu:

 - clarify a comment (Michael Kelley)

 - change a pr_warn() to pr_info() (Olaf Hering)

* tag 'hyperv-fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
  x86/hyperv: Clarify comment on x2apic mode
  hv_balloon: disable warning when floor reached

Pull rdma fixes from Jason Gunthorpe:
 "A few more merge window regressions that didn't make rc1:

   - New validation in the DMA layer triggers wrong use of the DMA layer
     in rxe, siw and rdmavt

   - Accidental change of a hypervisor facing ABI when widening the port
     speed u8 to u16 in vmw_pvrdma

   - Memory leak on error unwind in SRP target"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/srpt: Fix typo in srpt_unregister_mad_agent docstring
  RDMA/vmw_pvrdma: Fix the active_speed and phys_state value
  IB/srpt: Fix memory leak in srpt_add_one
  RDMA: Fix software RDMA drivers for dma mapping error

Pull spi fixes from Mark Brown:
 "A small collection of driver specific fixes that have come in since
  the merge window, nothing too major here but all good to have"

* tag 'spi-fix-v5.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: fsl-dspi: fix wrong pointer in suspend/resume
  spi: bcm2835: fix gpio cs level inversion
  spi: imx: fix runtime pm support for !CONFIG_PM

Merge tag 'regulator-fix-v5.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator fixes from Mark Brown:
 "An addition to MAINTAINERS plus a fix for a nasty bootstrapping
  problem which caused problems when we need to read the voltage of a
  regulator that is not yet available during initialization, we were not
  correctly distinguishing between this case and the case where a
  regulator is put into a bypass mode"

* tag 'regulator-fix-v5.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: defer probe when trying to get voltage from unresolved supply
  MAINTAINERS: Add entry for Qualcomm IPQ4019 VQMMC regulator