--- /dev/null
+From 80826867f0a12dd309b0dfb77828a5fd8a91cb3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Dec 2022 14:18:54 -0800
+Subject: bpf: keep a reference to the mm, in case the task is dead.
+
+From: Kui-Feng Lee <kuifeng@meta.com>
+
+[ Upstream commit 7ff94f276f8ea05df82eb115225e9b26f47a3347 ]
+
+Fix the system crash that happens when a task iterator travel through
+vma of tasks.
+
+In task iterators, we used to access mm by following the pointer on
+the task_struct; however, the death of a task will clear the pointer,
+even though we still hold the task_struct. That can cause an
+unexpected crash for a null pointer when an iterator is visiting a
+task that dies during the visit. Keeping a reference of mm on the
+iterator ensures we always have a valid pointer to mm.
+
+Co-developed-by: Song Liu <song@kernel.org>
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Kui-Feng Lee <kuifeng@meta.com>
+Reported-by: Nathan Slingerland <slinger@meta.com>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/r/20221216221855.4122288-2-kuifeng@meta.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/task_iter.c | 39 +++++++++++++++++++++++++++------------
+ 1 file changed, 27 insertions(+), 12 deletions(-)
+
+diff --git a/kernel/bpf/task_iter.c b/kernel/bpf/task_iter.c
+index c2a2182ce570..c4ab9d6cdbe9 100644
+--- a/kernel/bpf/task_iter.c
++++ b/kernel/bpf/task_iter.c
+@@ -438,6 +438,7 @@ struct bpf_iter_seq_task_vma_info {
+ */
+ struct bpf_iter_seq_task_common common;
+ struct task_struct *task;
++ struct mm_struct *mm;
+ struct vm_area_struct *vma;
+ u32 tid;
+ unsigned long prev_vm_start;
+@@ -456,16 +457,19 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info)
+ enum bpf_task_vma_iter_find_op op;
+ struct vm_area_struct *curr_vma;
+ struct task_struct *curr_task;
++ struct mm_struct *curr_mm;
+ u32 saved_tid = info->tid;
+
+ /* If this function returns a non-NULL vma, it holds a reference to
+- * the task_struct, and holds read lock on vma->mm->mmap_lock.
++ * the task_struct, holds a refcount on mm->mm_users, and holds
++ * read lock on vma->mm->mmap_lock.
+ * If this function returns NULL, it does not hold any reference or
+ * lock.
+ */
+ if (info->task) {
+ curr_task = info->task;
+ curr_vma = info->vma;
++ curr_mm = info->mm;
+ /* In case of lock contention, drop mmap_lock to unblock
+ * the writer.
+ *
+@@ -504,13 +508,15 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info)
+ * 4.2) VMA2 and VMA2' covers different ranges, process
+ * VMA2'.
+ */
+- if (mmap_lock_is_contended(curr_task->mm)) {
++ if (mmap_lock_is_contended(curr_mm)) {
+ info->prev_vm_start = curr_vma->vm_start;
+ info->prev_vm_end = curr_vma->vm_end;
+ op = task_vma_iter_find_vma;
+- mmap_read_unlock(curr_task->mm);
+- if (mmap_read_lock_killable(curr_task->mm))
++ mmap_read_unlock(curr_mm);
++ if (mmap_read_lock_killable(curr_mm)) {
++ mmput(curr_mm);
+ goto finish;
++ }
+ } else {
+ op = task_vma_iter_next_vma;
+ }
+@@ -535,42 +541,47 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info)
+ op = task_vma_iter_find_vma;
+ }
+
+- if (!curr_task->mm)
++ curr_mm = get_task_mm(curr_task);
++ if (!curr_mm)
+ goto next_task;
+
+- if (mmap_read_lock_killable(curr_task->mm))
++ if (mmap_read_lock_killable(curr_mm)) {
++ mmput(curr_mm);
+ goto finish;
++ }
+ }
+
+ switch (op) {
+ case task_vma_iter_first_vma:
+- curr_vma = find_vma(curr_task->mm, 0);
++ curr_vma = find_vma(curr_mm, 0);
+ break;
+ case task_vma_iter_next_vma:
+- curr_vma = find_vma(curr_task->mm, curr_vma->vm_end);
++ curr_vma = find_vma(curr_mm, curr_vma->vm_end);
+ break;
+ case task_vma_iter_find_vma:
+ /* We dropped mmap_lock so it is necessary to use find_vma
+ * to find the next vma. This is similar to the mechanism
+ * in show_smaps_rollup().
+ */
+- curr_vma = find_vma(curr_task->mm, info->prev_vm_end - 1);
++ curr_vma = find_vma(curr_mm, info->prev_vm_end - 1);
+ /* case 1) and 4.2) above just use curr_vma */
+
+ /* check for case 2) or case 4.1) above */
+ if (curr_vma &&
+ curr_vma->vm_start == info->prev_vm_start &&
+ curr_vma->vm_end == info->prev_vm_end)
+- curr_vma = find_vma(curr_task->mm, curr_vma->vm_end);
++ curr_vma = find_vma(curr_mm, curr_vma->vm_end);
+ break;
+ }
+ if (!curr_vma) {
+ /* case 3) above, or case 2) 4.1) with vma->next == NULL */
+- mmap_read_unlock(curr_task->mm);
++ mmap_read_unlock(curr_mm);
++ mmput(curr_mm);
+ goto next_task;
+ }
+ info->task = curr_task;
+ info->vma = curr_vma;
++ info->mm = curr_mm;
+ return curr_vma;
+
+ next_task:
+@@ -579,6 +590,7 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info)
+
+ put_task_struct(curr_task);
+ info->task = NULL;
++ info->mm = NULL;
+ info->tid++;
+ goto again;
+
+@@ -587,6 +599,7 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info)
+ put_task_struct(curr_task);
+ info->task = NULL;
+ info->vma = NULL;
++ info->mm = NULL;
+ return NULL;
+ }
+
+@@ -658,7 +671,9 @@ static void task_vma_seq_stop(struct seq_file *seq, void *v)
+ */
+ info->prev_vm_start = ~0UL;
+ info->prev_vm_end = info->vma->vm_end;
+- mmap_read_unlock(info->task->mm);
++ mmap_read_unlock(info->mm);
++ mmput(info->mm);
++ info->mm = NULL;
+ put_task_struct(info->task);
+ info->task = NULL;
+ }
+--
+2.35.1
+
--- /dev/null
+From ac03a244327e889fdceabf059448e453c6585ddb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Dec 2022 09:00:40 +0800
+Subject: btrfs: always report error in run_one_delayed_ref()
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 39f501d68ec1ed5cd5c66ac6ec2a7131c517bb92 ]
+
+Currently we have a btrfs_debug() for run_one_delayed_ref() failure, but
+if end users hit such problem, there will be no chance that
+btrfs_debug() is enabled. This can lead to very little useful info for
+debugging.
+
+This patch will:
+
+- Add extra info for error reporting
+ Including:
+ * logical bytenr
+ * num_bytes
+ * type
+ * action
+ * ref_mod
+
+- Replace the btrfs_debug() with btrfs_err()
+
+- Move the error reporting into run_one_delayed_ref()
+ This is to avoid use-after-free, the @node can be freed in the caller.
+
+This error should only be triggered at most once.
+
+As if run_one_delayed_ref() failed, we trigger the error message, then
+causing the call chain to error out:
+
+btrfs_run_delayed_refs()
+`- btrfs_run_delayed_refs()
+ `- btrfs_run_delayed_refs_for_head()
+ `- run_one_delayed_ref()
+
+And we will abort the current transaction in btrfs_run_delayed_refs().
+If we have to run delayed refs for the abort transaction,
+run_one_delayed_ref() will just cleanup the refs and do nothing, thus no
+new error messages would be output.
+
+Reviewed-by: Anand Jain <anand.jain@oracle.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent-tree.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 2801c991814f..571fcc5ae4dc 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -1706,6 +1706,11 @@ static int run_one_delayed_ref(struct btrfs_trans_handle *trans,
+ BUG();
+ if (ret && insert_reserved)
+ btrfs_pin_extent(trans, node->bytenr, node->num_bytes, 1);
++ if (ret < 0)
++ btrfs_err(trans->fs_info,
++"failed to run delayed ref for logical %llu num_bytes %llu type %u action %u ref_mod %d: %d",
++ node->bytenr, node->num_bytes, node->type,
++ node->action, node->ref_mod, ret);
+ return ret;
+ }
+
+@@ -1947,8 +1952,6 @@ static int btrfs_run_delayed_refs_for_head(struct btrfs_trans_handle *trans,
+ if (ret) {
+ unselect_delayed_ref_head(delayed_refs, locked_ref);
+ btrfs_put_delayed_ref(ref);
+- btrfs_debug(fs_info, "run_one_delayed_ref returned %d",
+- ret);
+ return ret;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 711dc0a456d2310d665e0aa952056afad88e7277 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Dec 2022 11:06:07 +0900
+Subject: btrfs: fix trace event name typo for FLUSH_DELAYED_REFS
+
+From: Naohiro Aota <naohiro.aota@wdc.com>
+
+[ Upstream commit 0a3212de8ab3e2ce5808c6265855e528d4a6767b ]
+
+Fix a typo of printing FLUSH_DELAYED_REFS event in flush_space() as
+FLUSH_ELAYED_REFS.
+
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/btrfs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h
+index ed50e81174bf..5e10b5b1d16c 100644
+--- a/include/trace/events/btrfs.h
++++ b/include/trace/events/btrfs.h
+@@ -98,7 +98,7 @@ struct raid56_bio_trace_info;
+ EM( FLUSH_DELALLOC_WAIT, "FLUSH_DELALLOC_WAIT") \
+ EM( FLUSH_DELALLOC_FULL, "FLUSH_DELALLOC_FULL") \
+ EM( FLUSH_DELAYED_REFS_NR, "FLUSH_DELAYED_REFS_NR") \
+- EM( FLUSH_DELAYED_REFS, "FLUSH_ELAYED_REFS") \
++ EM( FLUSH_DELAYED_REFS, "FLUSH_DELAYED_REFS") \
+ EM( ALLOC_CHUNK, "ALLOC_CHUNK") \
+ EM( ALLOC_CHUNK_FORCE, "ALLOC_CHUNK_FORCE") \
+ EM( RUN_DELAYED_IPUTS, "RUN_DELAYED_IPUTS") \
+--
+2.35.1
+
--- /dev/null
+From 9e515a6de7ac33b3a690f91be2849500c2c82a7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Dec 2022 12:33:56 -0300
+Subject: cifs: fix race in assemble_neg_contexts()
+
+From: Paulo Alcantara <pc@cjr.nz>
+
+[ Upstream commit 775e44d6d86dca400d614cbda5dab4def4951fe7 ]
+
+Serialise access of TCP_Server_Info::hostname in
+assemble_neg_contexts() by holding the server's mutex otherwise it
+might end up accessing an already-freed hostname pointer from
+cifs_reconnect() or cifs_resolve_server().
+
+Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Reviewed-by: Enzo Matsumiya <ematsumiya@suse.de>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2pdu.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 4ac5b1bfaf78..727f16b426be 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -541,9 +541,10 @@ static void
+ assemble_neg_contexts(struct smb2_negotiate_req *req,
+ struct TCP_Server_Info *server, unsigned int *total_len)
+ {
+- char *pneg_ctxt;
+- char *hostname = NULL;
+ unsigned int ctxt_len, neg_context_count;
++ struct TCP_Server_Info *pserver;
++ char *pneg_ctxt;
++ char *hostname;
+
+ if (*total_len > 200) {
+ /* In case length corrupted don't want to overrun smb buffer */
+@@ -574,8 +575,9 @@ assemble_neg_contexts(struct smb2_negotiate_req *req,
+ * secondary channels don't have the hostname field populated
+ * use the hostname field in the primary channel instead
+ */
+- hostname = CIFS_SERVER_IS_CHAN(server) ?
+- server->primary_server->hostname : server->hostname;
++ pserver = CIFS_SERVER_IS_CHAN(server) ? server->primary_server : server;
++ cifs_server_lock(pserver);
++ hostname = pserver->hostname;
+ if (hostname && (hostname[0] != 0)) {
+ ctxt_len = build_netname_ctxt((struct smb2_netname_neg_context *)pneg_ctxt,
+ hostname);
+@@ -584,6 +586,7 @@ assemble_neg_contexts(struct smb2_negotiate_req *req,
+ neg_context_count = 3;
+ } else
+ neg_context_count = 2;
++ cifs_server_unlock(pserver);
+
+ build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt);
+ *total_len += sizeof(struct smb2_posix_neg_context);
+--
+2.35.1
+
--- /dev/null
+From ca4d1ac4d0f4e64f284cb8e26fb070c5abb61f5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Dec 2022 14:07:49 +0100
+Subject: dma-buf: fix dma_buf_export init order v2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit f728a5ea27c92133893590e731ce10f6561ced87 ]
+
+The init order and resulting error handling in dma_buf_export
+was pretty messy.
+
+Subordinate objects like the file and the sysfs kernel objects
+were initializing and wiring itself up with the object in the
+wrong order resulting not only in complicating and partially
+incorrect error handling, but also in publishing only halve
+initialized DMA-buf objects.
+
+Clean this up thoughtfully by allocating the file independent
+of the DMA-buf object. Then allocate and initialize the DMA-buf
+object itself, before publishing it through sysfs. If everything
+works as expected the file is then connected with the DMA-buf
+object and publish it through debugfs.
+
+Also adds the missing dma_resv_fini() into the error handling.
+
+v2: add some missing changes to dma_bug_getfile() and a missing NULL
+ check in dma_buf_file_release()
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
+Reviewed-by: T.J. Mercier <tjmercier@google.com>
+Acked-by: Sumit Semwal <sumit.semwal@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221209071535.933698-1-christian.koenig@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/dma-buf-sysfs-stats.c | 7 +--
+ drivers/dma-buf/dma-buf-sysfs-stats.h | 4 +-
+ drivers/dma-buf/dma-buf.c | 84 +++++++++++++--------------
+ 3 files changed, 43 insertions(+), 52 deletions(-)
+
+diff --git a/drivers/dma-buf/dma-buf-sysfs-stats.c b/drivers/dma-buf/dma-buf-sysfs-stats.c
+index 2bba0babcb62..4b680e10c15a 100644
+--- a/drivers/dma-buf/dma-buf-sysfs-stats.c
++++ b/drivers/dma-buf/dma-buf-sysfs-stats.c
+@@ -168,14 +168,11 @@ void dma_buf_uninit_sysfs_statistics(void)
+ kset_unregister(dma_buf_stats_kset);
+ }
+
+-int dma_buf_stats_setup(struct dma_buf *dmabuf)
++int dma_buf_stats_setup(struct dma_buf *dmabuf, struct file *file)
+ {
+ struct dma_buf_sysfs_entry *sysfs_entry;
+ int ret;
+
+- if (!dmabuf || !dmabuf->file)
+- return -EINVAL;
+-
+ if (!dmabuf->exp_name) {
+ pr_err("exporter name must not be empty if stats needed\n");
+ return -EINVAL;
+@@ -192,7 +189,7 @@ int dma_buf_stats_setup(struct dma_buf *dmabuf)
+
+ /* create the directory for buffer stats */
+ ret = kobject_init_and_add(&sysfs_entry->kobj, &dma_buf_ktype, NULL,
+- "%lu", file_inode(dmabuf->file)->i_ino);
++ "%lu", file_inode(file)->i_ino);
+ if (ret)
+ goto err_sysfs_dmabuf;
+
+diff --git a/drivers/dma-buf/dma-buf-sysfs-stats.h b/drivers/dma-buf/dma-buf-sysfs-stats.h
+index a49c6e2650cc..7a8a995b75ba 100644
+--- a/drivers/dma-buf/dma-buf-sysfs-stats.h
++++ b/drivers/dma-buf/dma-buf-sysfs-stats.h
+@@ -13,7 +13,7 @@
+ int dma_buf_init_sysfs_statistics(void);
+ void dma_buf_uninit_sysfs_statistics(void);
+
+-int dma_buf_stats_setup(struct dma_buf *dmabuf);
++int dma_buf_stats_setup(struct dma_buf *dmabuf, struct file *file);
+
+ void dma_buf_stats_teardown(struct dma_buf *dmabuf);
+ #else
+@@ -25,7 +25,7 @@ static inline int dma_buf_init_sysfs_statistics(void)
+
+ static inline void dma_buf_uninit_sysfs_statistics(void) {}
+
+-static inline int dma_buf_stats_setup(struct dma_buf *dmabuf)
++static inline int dma_buf_stats_setup(struct dma_buf *dmabuf, struct file *file)
+ {
+ return 0;
+ }
+diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
+index e6f36c014c4c..eb6b59363c4f 100644
+--- a/drivers/dma-buf/dma-buf.c
++++ b/drivers/dma-buf/dma-buf.c
+@@ -95,10 +95,11 @@ static int dma_buf_file_release(struct inode *inode, struct file *file)
+ return -EINVAL;
+
+ dmabuf = file->private_data;
+-
+- mutex_lock(&db_list.lock);
+- list_del(&dmabuf->list_node);
+- mutex_unlock(&db_list.lock);
++ if (dmabuf) {
++ mutex_lock(&db_list.lock);
++ list_del(&dmabuf->list_node);
++ mutex_unlock(&db_list.lock);
++ }
+
+ return 0;
+ }
+@@ -523,17 +524,17 @@ static inline int is_dma_buf_file(struct file *file)
+ return file->f_op == &dma_buf_fops;
+ }
+
+-static struct file *dma_buf_getfile(struct dma_buf *dmabuf, int flags)
++static struct file *dma_buf_getfile(size_t size, int flags)
+ {
+ static atomic64_t dmabuf_inode = ATOMIC64_INIT(0);
+- struct file *file;
+ struct inode *inode = alloc_anon_inode(dma_buf_mnt->mnt_sb);
++ struct file *file;
+
+ if (IS_ERR(inode))
+ return ERR_CAST(inode);
+
+- inode->i_size = dmabuf->size;
+- inode_set_bytes(inode, dmabuf->size);
++ inode->i_size = size;
++ inode_set_bytes(inode, size);
+
+ /*
+ * The ->i_ino acquired from get_next_ino() is not unique thus
+@@ -547,8 +548,6 @@ static struct file *dma_buf_getfile(struct dma_buf *dmabuf, int flags)
+ flags, &dma_buf_fops);
+ if (IS_ERR(file))
+ goto err_alloc_file;
+- file->private_data = dmabuf;
+- file->f_path.dentry->d_fsdata = dmabuf;
+
+ return file;
+
+@@ -614,19 +613,11 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)
+ size_t alloc_size = sizeof(struct dma_buf);
+ int ret;
+
+- if (!exp_info->resv)
+- alloc_size += sizeof(struct dma_resv);
+- else
+- /* prevent &dma_buf[1] == dma_buf->resv */
+- alloc_size += 1;
+-
+- if (WARN_ON(!exp_info->priv
+- || !exp_info->ops
+- || !exp_info->ops->map_dma_buf
+- || !exp_info->ops->unmap_dma_buf
+- || !exp_info->ops->release)) {
++ if (WARN_ON(!exp_info->priv || !exp_info->ops
++ || !exp_info->ops->map_dma_buf
++ || !exp_info->ops->unmap_dma_buf
++ || !exp_info->ops->release))
+ return ERR_PTR(-EINVAL);
+- }
+
+ if (WARN_ON(exp_info->ops->cache_sgt_mapping &&
+ (exp_info->ops->pin || exp_info->ops->unpin)))
+@@ -638,10 +629,21 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)
+ if (!try_module_get(exp_info->owner))
+ return ERR_PTR(-ENOENT);
+
++ file = dma_buf_getfile(exp_info->size, exp_info->flags);
++ if (IS_ERR(file)) {
++ ret = PTR_ERR(file);
++ goto err_module;
++ }
++
++ if (!exp_info->resv)
++ alloc_size += sizeof(struct dma_resv);
++ else
++ /* prevent &dma_buf[1] == dma_buf->resv */
++ alloc_size += 1;
+ dmabuf = kzalloc(alloc_size, GFP_KERNEL);
+ if (!dmabuf) {
+ ret = -ENOMEM;
+- goto err_module;
++ goto err_file;
+ }
+
+ dmabuf->priv = exp_info->priv;
+@@ -653,44 +655,36 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)
+ init_waitqueue_head(&dmabuf->poll);
+ dmabuf->cb_in.poll = dmabuf->cb_out.poll = &dmabuf->poll;
+ dmabuf->cb_in.active = dmabuf->cb_out.active = 0;
++ mutex_init(&dmabuf->lock);
++ INIT_LIST_HEAD(&dmabuf->attachments);
+
+ if (!resv) {
+- resv = (struct dma_resv *)&dmabuf[1];
+- dma_resv_init(resv);
++ dmabuf->resv = (struct dma_resv *)&dmabuf[1];
++ dma_resv_init(dmabuf->resv);
++ } else {
++ dmabuf->resv = resv;
+ }
+- dmabuf->resv = resv;
+
+- file = dma_buf_getfile(dmabuf, exp_info->flags);
+- if (IS_ERR(file)) {
+- ret = PTR_ERR(file);
++ ret = dma_buf_stats_setup(dmabuf, file);
++ if (ret)
+ goto err_dmabuf;
+- }
+
++ file->private_data = dmabuf;
++ file->f_path.dentry->d_fsdata = dmabuf;
+ dmabuf->file = file;
+
+- mutex_init(&dmabuf->lock);
+- INIT_LIST_HEAD(&dmabuf->attachments);
+-
+ mutex_lock(&db_list.lock);
+ list_add(&dmabuf->list_node, &db_list.head);
+ mutex_unlock(&db_list.lock);
+
+- ret = dma_buf_stats_setup(dmabuf);
+- if (ret)
+- goto err_sysfs;
+-
+ return dmabuf;
+
+-err_sysfs:
+- /*
+- * Set file->f_path.dentry->d_fsdata to NULL so that when
+- * dma_buf_release() gets invoked by dentry_ops, it exits
+- * early before calling the release() dma_buf op.
+- */
+- file->f_path.dentry->d_fsdata = NULL;
+- fput(file);
+ err_dmabuf:
++ if (!resv)
++ dma_resv_fini(dmabuf->resv);
+ kfree(dmabuf);
++err_file:
++ fput(file);
+ err_module:
+ module_put(exp_info->owner);
+ return ERR_PTR(ret);
+--
+2.35.1
+
--- /dev/null
+From dea073062d1fbd07486a19cef1859928c67c9ad5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Dec 2022 16:14:10 -0800
+Subject: f2fs: let's avoid panic if extent_tree is not created
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit df9d44b645b83fffccfb4e28c1f93376585fdec8 ]
+
+This patch avoids the below panic.
+
+pc : __lookup_extent_tree+0xd8/0x760
+lr : f2fs_do_write_data_page+0x104/0x87c
+sp : ffffffc010cbb3c0
+x29: ffffffc010cbb3e0 x28: 0000000000000000
+x27: ffffff8803e7f020 x26: ffffff8803e7ed40
+x25: ffffff8803e7f020 x24: ffffffc010cbb460
+x23: ffffffc010cbb480 x22: 0000000000000000
+x21: 0000000000000000 x20: ffffffff22e90900
+x19: 0000000000000000 x18: ffffffc010c5d080
+x17: 0000000000000000 x16: 0000000000000020
+x15: ffffffdb1acdbb88 x14: ffffff888759e2b0
+x13: 0000000000000000 x12: ffffff802da49000
+x11: 000000000a001200 x10: ffffff8803e7ed40
+x9 : ffffff8023195800 x8 : ffffff802da49078
+x7 : 0000000000000001 x6 : 0000000000000000
+x5 : 0000000000000006 x4 : ffffffc010cbba28
+x3 : 0000000000000000 x2 : ffffffc010cbb480
+x1 : 0000000000000000 x0 : ffffff8803e7ed40
+Call trace:
+ __lookup_extent_tree+0xd8/0x760
+ f2fs_do_write_data_page+0x104/0x87c
+ f2fs_write_single_data_page+0x420/0xb60
+ f2fs_write_cache_pages+0x418/0xb1c
+ __f2fs_write_data_pages+0x428/0x58c
+ f2fs_write_data_pages+0x30/0x40
+ do_writepages+0x88/0x190
+ __writeback_single_inode+0x48/0x448
+ writeback_sb_inodes+0x468/0x9e8
+ __writeback_inodes_wb+0xb8/0x2a4
+ wb_writeback+0x33c/0x740
+ wb_do_writeback+0x2b4/0x400
+ wb_workfn+0xe4/0x34c
+ process_one_work+0x24c/0x5bc
+ worker_thread+0x3e8/0xa50
+ kthread+0x150/0x1b4
+
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/extent_cache.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c
+index 932c070173b9..6c9e6f78a3e3 100644
+--- a/fs/f2fs/extent_cache.c
++++ b/fs/f2fs/extent_cache.c
+@@ -415,7 +415,8 @@ static bool f2fs_lookup_extent_tree(struct inode *inode, pgoff_t pgofs,
+ struct extent_node *en;
+ bool ret = false;
+
+- f2fs_bug_on(sbi, !et);
++ if (!et)
++ return false;
+
+ trace_f2fs_lookup_extent_tree_start(inode, pgofs);
+
+--
+2.35.1
+
--- /dev/null
+From ddf5b49b11897751c7e916833aecdb2cecfbc187 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Dec 2022 18:02:28 +0100
+Subject: fbdev: omapfb: avoid stack overflow warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 634cf6ead93988b0da9ac054521ab63a3ba189db ]
+
+The dsi_irq_stats structure is a little too big to fit on the
+stack of a 32-bit task, depending on the specific gcc options:
+
+fbdev/omap2/omapfb/dss/dsi.c: In function 'dsi_dump_dsidev_irqs':
+fbdev/omap2/omapfb/dss/dsi.c:1621:1: error: the frame size of 1064 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
+
+Since this is only a debugfs file, performance is not critical,
+so just dynamically allocate it, and print an error message
+in there in place of a failure code when the allocation fails.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/omap2/omapfb/dss/dsi.c | 28 ++++++++++++++--------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
+index 54b0f034c2ed..7cddb7b8ae34 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
+@@ -1536,22 +1536,28 @@ static void dsi_dump_dsidev_irqs(struct platform_device *dsidev,
+ {
+ struct dsi_data *dsi = dsi_get_dsidrv_data(dsidev);
+ unsigned long flags;
+- struct dsi_irq_stats stats;
++ struct dsi_irq_stats *stats;
++
++ stats = kzalloc(sizeof(*stats), GFP_KERNEL);
++ if (!stats) {
++ seq_printf(s, "out of memory\n");
++ return;
++ }
+
+ spin_lock_irqsave(&dsi->irq_stats_lock, flags);
+
+- stats = dsi->irq_stats;
++ *stats = dsi->irq_stats;
+ memset(&dsi->irq_stats, 0, sizeof(dsi->irq_stats));
+ dsi->irq_stats.last_reset = jiffies;
+
+ spin_unlock_irqrestore(&dsi->irq_stats_lock, flags);
+
+ seq_printf(s, "period %u ms\n",
+- jiffies_to_msecs(jiffies - stats.last_reset));
++ jiffies_to_msecs(jiffies - stats->last_reset));
+
+- seq_printf(s, "irqs %d\n", stats.irq_count);
++ seq_printf(s, "irqs %d\n", stats->irq_count);
+ #define PIS(x) \
+- seq_printf(s, "%-20s %10d\n", #x, stats.dsi_irqs[ffs(DSI_IRQ_##x)-1])
++ seq_printf(s, "%-20s %10d\n", #x, stats->dsi_irqs[ffs(DSI_IRQ_##x)-1])
+
+ seq_printf(s, "-- DSI%d interrupts --\n", dsi->module_id + 1);
+ PIS(VC0);
+@@ -1575,10 +1581,10 @@ static void dsi_dump_dsidev_irqs(struct platform_device *dsidev,
+
+ #define PIS(x) \
+ seq_printf(s, "%-20s %10d %10d %10d %10d\n", #x, \
+- stats.vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \
+- stats.vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \
+- stats.vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \
+- stats.vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]);
++ stats->vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \
++ stats->vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \
++ stats->vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \
++ stats->vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]);
+
+ seq_printf(s, "-- VC interrupts --\n");
+ PIS(CS);
+@@ -1594,7 +1600,7 @@ static void dsi_dump_dsidev_irqs(struct platform_device *dsidev,
+
+ #define PIS(x) \
+ seq_printf(s, "%-20s %10d\n", #x, \
+- stats.cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]);
++ stats->cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]);
+
+ seq_printf(s, "-- CIO interrupts --\n");
+ PIS(ERRSYNCESC1);
+@@ -1618,6 +1624,8 @@ static void dsi_dump_dsidev_irqs(struct platform_device *dsidev,
+ PIS(ULPSACTIVENOT_ALL0);
+ PIS(ULPSACTIVENOT_ALL1);
+ #undef PIS
++
++ kfree(stats);
+ }
+
+ static void dsi1_dump_irqs(struct seq_file *s)
+--
+2.35.1
+
--- /dev/null
+From 1f678048ff4c793fa93f82093d4001824ed994ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jan 2023 10:07:37 +0000
+Subject: memblock tests: Fix compilation error.
+
+From: Aaron Thompson <dev@aaront.org>
+
+[ Upstream commit 340726747336716350eb5a928b860a29db955f05 ]
+
+Commit cf4694be2b2cf ("tools: Add atomic_test_and_set_bit()") changed
+tools/arch/x86/include/asm/atomic.h to include <asm/asm.h>, which causes
+'make -C tools/testing/memblock' to fail with:
+
+In file included from ../../include/asm/atomic.h:6,
+ from ../../include/linux/atomic.h:5,
+ from ./linux/mmzone.h:5,
+ from ../../include/linux/mm.h:5,
+ from ../../include/linux/pfn.h:5,
+ from ./linux/memory_hotplug.h:6,
+ from ./linux/init.h:7,
+ from ./linux/memblock.h:11,
+ from tests/common.h:8,
+ from tests/basic_api.h:5,
+ from main.c:2:
+../../include/asm/../../arch/x86/include/asm/atomic.h:11:10: fatal error: asm/asm.h: No such file or directory
+ 11 | #include <asm/asm.h>
+ | ^~~~~~~~~~~
+
+Create a symlink to asm/asm.h in the same manner as the existing one to
+asm/cmpxchg.h.
+
+Signed-off-by: Aaron Thompson <dev@aaront.org>
+Link: https://lore.kernel.org/r/010101857c402765-96e2dbc6-b82b-47e2-a437-4834dbe0b96b-000000@us-west-2.amazonses.com
+Signed-off-by: Mike Rapoport (IBM) <rppt@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/memblock/.gitignore | 1 +
+ tools/testing/memblock/Makefile | 3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/memblock/.gitignore b/tools/testing/memblock/.gitignore
+index 654338e0be52..4cc7cd5aac2b 100644
+--- a/tools/testing/memblock/.gitignore
++++ b/tools/testing/memblock/.gitignore
+@@ -1,4 +1,5 @@
+ main
+ memblock.c
+ linux/memblock.h
++asm/asm.h
+ asm/cmpxchg.h
+diff --git a/tools/testing/memblock/Makefile b/tools/testing/memblock/Makefile
+index 246f7ac8489b..575e98fddc21 100644
+--- a/tools/testing/memblock/Makefile
++++ b/tools/testing/memblock/Makefile
+@@ -29,13 +29,14 @@ include: ../../../include/linux/memblock.h ../../include/linux/*.h \
+
+ @mkdir -p linux
+ test -L linux/memblock.h || ln -s ../../../../include/linux/memblock.h linux/memblock.h
++ test -L asm/asm.h || ln -s ../../../arch/x86/include/asm/asm.h asm/asm.h
+ test -L asm/cmpxchg.h || ln -s ../../../arch/x86/include/asm/cmpxchg.h asm/cmpxchg.h
+
+ memblock.c: $(EXTR_SRC)
+ test -L memblock.c || ln -s $(EXTR_SRC) memblock.c
+
+ clean:
+- $(RM) $(TARGETS) $(OFILES) linux/memblock.h memblock.c asm/cmpxchg.h
++ $(RM) $(TARGETS) $(OFILES) linux/memblock.h memblock.c asm/asm.h asm/cmpxchg.h
+
+ help:
+ @echo 'Memblock simulator'
+--
+2.35.1
+
--- /dev/null
+From faf3cdc22620031f5c6c4d4cb2e22dde2efcfda7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Dec 2022 23:12:22 +0530
+Subject: net: ethernet: marvell: octeontx2: Fix uninitialized variable warning
+
+From: Anuradha Weeraman <anuradha@debian.org>
+
+[ Upstream commit d3805695fe1e7383517903715cefc9bbdcffdc90 ]
+
+Fix for uninitialized variable warning.
+
+Addresses-Coverity: ("Uninitialized scalar variable")
+Signed-off-by: Anuradha Weeraman <anuradha@debian.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c b/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c
+index fa8029a94068..eb25e458266c 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c
+@@ -589,7 +589,7 @@ int rvu_mbox_handler_mcs_free_resources(struct rvu *rvu,
+ u16 pcifunc = req->hdr.pcifunc;
+ struct mcs_rsrc_map *map;
+ struct mcs *mcs;
+- int rc;
++ int rc = 0;
+
+ if (req->mcs_id >= rvu->mcs_blk_cnt)
+ return MCS_AF_ERR_INVALID_MCSID;
+--
+2.35.1
+
--- /dev/null
+From 312b6f6c789376523ee1aecd97e66e35827a721c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Dec 2022 14:48:23 +0300
+Subject: net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats
+
+From: Daniil Tatianin <d-tatianin@yandex-team.ru>
+
+[ Upstream commit 9deb1e9fb88b1120a908676fa33bdf9e2eeaefce ]
+
+It's not very useful to copy back an empty ethtool_stats struct and
+return 0 if we didn't actually have any stats. This also allows for
+further simplification of this function in the future commits.
+
+Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ethtool/ioctl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c
+index 81fe2422fe58..038398d41a93 100644
+--- a/net/ethtool/ioctl.c
++++ b/net/ethtool/ioctl.c
+@@ -2094,7 +2094,8 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr)
+ return n_stats;
+ if (n_stats > S32_MAX / sizeof(u64))
+ return -ENOMEM;
+- WARN_ON_ONCE(!n_stats);
++ if (WARN_ON_ONCE(!n_stats))
++ return -EOPNOTSUPP;
+
+ if (copy_from_user(&stats, useraddr, sizeof(stats)))
+ return -EFAULT;
+--
+2.35.1
+
--- /dev/null
+From 5eece547bd36776908d82ffb3ce1120ad84408d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 12:00:32 -0600
+Subject: of: fdt: Honor CONFIG_CMDLINE* even without /chosen node, take 2
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 064e32dc5b03114d0767893fecdaf7b5dfd8c286 ]
+
+I do not read a strict requirement on /chosen node in either ePAPR or in
+Documentation/devicetree. Help text for CONFIG_CMDLINE and
+CONFIG_CMDLINE_EXTEND doesn't make their behavior explicitly dependent on
+the presence of /chosen or the presense of /chosen/bootargs.
+
+However the early check for /chosen and bailing out in
+early_init_dt_scan_chosen() skips CONFIG_CMDLINE handling which is not
+really related to /chosen node or the particular method of passing cmdline
+from bootloader.
+
+This leads to counterintuitive combinations (assuming
+CONFIG_CMDLINE_EXTEND=y):
+
+a) bootargs="foo", CONFIG_CMDLINE="bar" => cmdline=="foo bar"
+b) /chosen missing, CONFIG_CMDLINE="bar" => cmdline==""
+c) bootargs="", CONFIG_CMDLINE="bar" => cmdline==" bar"
+
+Rework early_init_dt_scan_chosen() so that the cmdline config options are
+always handled.
+
+[commit msg written by Alexander Sverdlin]
+
+Cc: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Tested-by: Geoff Levand <geoff@infradead.org>
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+Link: https://lore.kernel.org/r/20230103-dt-cmdline-fix-v1-2-7038e88b18b6@kernel.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/fdt.c | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
+index 4f88e8bbdd27..f08b25195ae7 100644
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -1163,18 +1163,32 @@ int __init early_init_dt_scan_chosen(char *cmdline)
+ if (node < 0)
+ node = fdt_path_offset(fdt, "/chosen@0");
+ if (node < 0)
+- return -ENOENT;
++ /* Handle the cmdline config options even if no /chosen node */
++ goto handle_cmdline;
+
+ chosen_node_offset = node;
+
+ early_init_dt_check_for_initrd(node);
+ early_init_dt_check_for_elfcorehdr(node);
+
++ rng_seed = of_get_flat_dt_prop(node, "rng-seed", &l);
++ if (rng_seed && l > 0) {
++ add_bootloader_randomness(rng_seed, l);
++
++ /* try to clear seed so it won't be found. */
++ fdt_nop_property(initial_boot_params, node, "rng-seed");
++
++ /* update CRC check value */
++ of_fdt_crc32 = crc32_be(~0, initial_boot_params,
++ fdt_totalsize(initial_boot_params));
++ }
++
+ /* Retrieve command line */
+ p = of_get_flat_dt_prop(node, "bootargs", &l);
+ if (p != NULL && l > 0)
+ strscpy(cmdline, p, min(l, COMMAND_LINE_SIZE));
+
++handle_cmdline:
+ /*
+ * CONFIG_CMDLINE is meant to be a default in case nothing else
+ * managed to set the command line, unless CONFIG_CMDLINE_FORCE
+@@ -1195,18 +1209,6 @@ int __init early_init_dt_scan_chosen(char *cmdline)
+
+ pr_debug("Command line is: %s\n", (char *)cmdline);
+
+- rng_seed = of_get_flat_dt_prop(node, "rng-seed", &l);
+- if (rng_seed && l > 0) {
+- add_bootloader_randomness(rng_seed, l);
+-
+- /* try to clear seed so it won't be found. */
+- fdt_nop_property(initial_boot_params, node, "rng-seed");
+-
+- /* update CRC check value */
+- of_fdt_crc32 = crc32_be(~0, initial_boot_params,
+- fdt_totalsize(initial_boot_params));
+- }
+-
+ return 0;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 4e51f778400868af70ee31a813900e2656196786 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jan 2023 22:58:31 +0800
+Subject: perf/x86/rapl: Add support for Intel Emerald Rapids
+
+From: Zhang Rui <rui.zhang@intel.com>
+
+[ Upstream commit 57512b57dcfaf63c52d8ad2fb35321328cde31b0 ]
+
+Emerald Rapids RAPL support is the same as previous Sapphire Rapids.
+Add Emerald Rapids model for RAPL.
+
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20230104145831.25498-2-rui.zhang@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/rapl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c
+index 589c6885560d..52e6e7ed4f78 100644
+--- a/arch/x86/events/rapl.c
++++ b/arch/x86/events/rapl.c
+@@ -806,6 +806,7 @@ static const struct x86_cpu_id rapl_model_match[] __initconst = {
+ X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L, &model_skl),
+ X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_N, &model_skl),
+ X86_MATCH_INTEL_FAM6_MODEL(SAPPHIRERAPIDS_X, &model_spr),
++ X86_MATCH_INTEL_FAM6_MODEL(EMERALDRAPIDS_X, &model_spr),
+ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE, &model_skl),
+ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, &model_skl),
+ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, &model_skl),
+--
+2.35.1
+
--- /dev/null
+From e284fed3abf13a15dae77ffefa508290ce767ff1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jan 2023 22:58:30 +0800
+Subject: perf/x86/rapl: Add support for Intel Meteor Lake
+
+From: Zhang Rui <rui.zhang@intel.com>
+
+[ Upstream commit f52853a668bfeddd79f319d536a506f68cc2b478 ]
+
+Meteor Lake RAPL support is the same as previous Sky Lake.
+Add Meteor Lake model for RAPL.
+
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20230104145831.25498-1-rui.zhang@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/rapl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c
+index ae5779ea4417..589c6885560d 100644
+--- a/arch/x86/events/rapl.c
++++ b/arch/x86/events/rapl.c
+@@ -809,6 +809,8 @@ static const struct x86_cpu_id rapl_model_match[] __initconst = {
+ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE, &model_skl),
+ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, &model_skl),
+ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, &model_skl),
++ X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE, &model_skl),
++ X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE_L, &model_skl),
+ {},
+ };
+ MODULE_DEVICE_TABLE(x86cpu, rapl_model_match);
+--
+2.35.1
+
--- /dev/null
+From 95271ea8da60dd0540f256a6d1cded1b53eb1181 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Dec 2022 06:34:54 -0500
+Subject: perf/x86/rapl: Treat Tigerlake like Icelake
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+[ Upstream commit c07311b5509f6035f1dd828db3e90ff4859cf3b9 ]
+
+Since Tigerlake seems to have inherited its cstates and other RAPL power
+caps from Icelake, assume it also follows Icelake for its RAPL events.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Zhang Rui <rui.zhang@intel.com>
+Link: https://lore.kernel.org/r/20221228113454.1199118-1-rodrigo.vivi@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/rapl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c
+index a829492bca4c..ae5779ea4417 100644
+--- a/arch/x86/events/rapl.c
++++ b/arch/x86/events/rapl.c
+@@ -800,6 +800,8 @@ static const struct x86_cpu_id rapl_model_match[] __initconst = {
+ X86_MATCH_INTEL_FAM6_MODEL(ICELAKE_X, &model_hsx),
+ X86_MATCH_INTEL_FAM6_MODEL(COMETLAKE_L, &model_skl),
+ X86_MATCH_INTEL_FAM6_MODEL(COMETLAKE, &model_skl),
++ X86_MATCH_INTEL_FAM6_MODEL(TIGERLAKE_L, &model_skl),
++ X86_MATCH_INTEL_FAM6_MODEL(TIGERLAKE, &model_skl),
+ X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE, &model_skl),
+ X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L, &model_skl),
+ X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_N, &model_skl),
+--
+2.35.1
+
--- /dev/null
+From a0a7a85641baa8225e12d174aa1b7200559786c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Dec 2022 12:31:29 -0500
+Subject: pNFS/filelayout: Fix coalescing test for single DS
+
+From: Olga Kornievskaia <olga.kornievskaia@gmail.com>
+
+[ Upstream commit a6b9d2fa0024e7e399c26facd0fb466b7396e2b9 ]
+
+When there is a single DS no striping constraints need to be placed on
+the IO. When such constraint is applied then buffered reads don't
+coalesce to the DS's rsize.
+
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/filelayout/filelayout.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
+index ad34a33b0737..4974cd18ca46 100644
+--- a/fs/nfs/filelayout/filelayout.c
++++ b/fs/nfs/filelayout/filelayout.c
+@@ -783,6 +783,12 @@ filelayout_alloc_lseg(struct pnfs_layout_hdr *layoutid,
+ return &fl->generic_hdr;
+ }
+
++static bool
++filelayout_lseg_is_striped(const struct nfs4_filelayout_segment *flseg)
++{
++ return flseg->num_fh > 1;
++}
++
+ /*
+ * filelayout_pg_test(). Called by nfs_can_coalesce_requests()
+ *
+@@ -803,6 +809,8 @@ filelayout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
+ size = pnfs_generic_pg_test(pgio, prev, req);
+ if (!size)
+ return 0;
++ else if (!filelayout_lseg_is_striped(FILELAYOUT_LSEG(pgio->pg_lseg)))
++ return size;
+
+ /* see if req and prev are in the same stripe */
+ if (prev) {
+--
+2.35.1
+
--- /dev/null
+From c6ea76e761a8f7999985eda5e62f2dfcf4c41afe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Dec 2022 20:31:53 +0800
+Subject: r8169: fix dmar pte write access is not set error
+
+From: Chunhao Lin <hau@realtek.com>
+
+[ Upstream commit bb41c13c05c23d9bc46b4e37d8914078c6a40e3a ]
+
+When close device, if wol is enabled, rx will be enabled. When open
+device it will cause rx packet to be dma to the wrong memory address
+after pci_set_master() and system log will show blow messages.
+
+DMAR: DRHD: handling fault status reg 3
+DMAR: [DMA Write] Request device [02:00.0] PASID ffffffff fault addr
+ffdd4000 [fault reason 05] PTE Write access is not set
+
+In this patch, driver disable tx/rx when close device. If wol is
+enabled, only enable rx filter and disable rxdv_gate(if support) to
+let hardware only receive packet to fifo but not to dma it.
+
+Signed-off-by: Chunhao Lin <hau@realtek.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 316c925c956f..cabed1b7b45e 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -2435,6 +2435,9 @@ static void rtl_wol_enable_rx(struct rtl8169_private *tp)
+ if (tp->mac_version >= RTL_GIGA_MAC_VER_25)
+ RTL_W32(tp, RxConfig, RTL_R32(tp, RxConfig) |
+ AcceptBroadcast | AcceptMulticast | AcceptMyPhys);
++
++ if (tp->mac_version >= RTL_GIGA_MAC_VER_40)
++ rtl_disable_rxdvgate(tp);
+ }
+
+ static void rtl_prepare_power_down(struct rtl8169_private *tp)
+@@ -3869,7 +3872,7 @@ static void rtl8169_tx_clear(struct rtl8169_private *tp)
+ netdev_reset_queue(tp->dev);
+ }
+
+-static void rtl8169_cleanup(struct rtl8169_private *tp, bool going_down)
++static void rtl8169_cleanup(struct rtl8169_private *tp)
+ {
+ napi_disable(&tp->napi);
+
+@@ -3881,9 +3884,6 @@ static void rtl8169_cleanup(struct rtl8169_private *tp, bool going_down)
+
+ rtl_rx_close(tp);
+
+- if (going_down && tp->dev->wol_enabled)
+- goto no_reset;
+-
+ switch (tp->mac_version) {
+ case RTL_GIGA_MAC_VER_28:
+ case RTL_GIGA_MAC_VER_31:
+@@ -3904,7 +3904,7 @@ static void rtl8169_cleanup(struct rtl8169_private *tp, bool going_down)
+ }
+
+ rtl_hw_reset(tp);
+-no_reset:
++
+ rtl8169_tx_clear(tp);
+ rtl8169_init_ring_indexes(tp);
+ }
+@@ -3915,7 +3915,7 @@ static void rtl_reset_work(struct rtl8169_private *tp)
+
+ netif_stop_queue(tp->dev);
+
+- rtl8169_cleanup(tp, false);
++ rtl8169_cleanup(tp);
+
+ for (i = 0; i < NUM_RX_DESC; i++)
+ rtl8169_mark_to_asic(tp->RxDescArray + i);
+@@ -4601,7 +4601,7 @@ static void rtl8169_down(struct rtl8169_private *tp)
+ pci_clear_master(tp->pci_dev);
+ rtl_pci_commit(tp);
+
+- rtl8169_cleanup(tp, true);
++ rtl8169_cleanup(tp);
+ rtl_disable_exit_l1(tp);
+ rtl_prepare_power_down(tp);
+ }
+--
+2.35.1
+
--- /dev/null
+From 9bf8c6abd9ac56dff989679accc36aaeea4f2fe3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Dec 2022 20:31:52 +0800
+Subject: r8169: move rtl_wol_enable_rx() and rtl_prepare_power_down()
+
+From: Chunhao Lin <hau@realtek.com>
+
+[ Upstream commit ad425666a1f05d9b215a84cf010c3789b2ea8206 ]
+
+There is no functional change. Moving these two functions for following
+patch "r8169: fix dmar pte write access is not set error".
+
+Signed-off-by: Chunhao Lin <hau@realtek.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 44 +++++++++++------------
+ 1 file changed, 22 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index fe8dc8e0522b..316c925c956f 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -2207,28 +2207,6 @@ static int rtl_set_mac_address(struct net_device *dev, void *p)
+ return 0;
+ }
+
+-static void rtl_wol_enable_rx(struct rtl8169_private *tp)
+-{
+- if (tp->mac_version >= RTL_GIGA_MAC_VER_25)
+- RTL_W32(tp, RxConfig, RTL_R32(tp, RxConfig) |
+- AcceptBroadcast | AcceptMulticast | AcceptMyPhys);
+-}
+-
+-static void rtl_prepare_power_down(struct rtl8169_private *tp)
+-{
+- if (tp->dash_type != RTL_DASH_NONE)
+- return;
+-
+- if (tp->mac_version == RTL_GIGA_MAC_VER_32 ||
+- tp->mac_version == RTL_GIGA_MAC_VER_33)
+- rtl_ephy_write(tp, 0x19, 0xff64);
+-
+- if (device_may_wakeup(tp_to_dev(tp))) {
+- phy_speed_down(tp->phydev, false);
+- rtl_wol_enable_rx(tp);
+- }
+-}
+-
+ static void rtl_init_rxcfg(struct rtl8169_private *tp)
+ {
+ switch (tp->mac_version) {
+@@ -2452,6 +2430,28 @@ static void rtl_enable_rxdvgate(struct rtl8169_private *tp)
+ rtl_wait_txrx_fifo_empty(tp);
+ }
+
++static void rtl_wol_enable_rx(struct rtl8169_private *tp)
++{
++ if (tp->mac_version >= RTL_GIGA_MAC_VER_25)
++ RTL_W32(tp, RxConfig, RTL_R32(tp, RxConfig) |
++ AcceptBroadcast | AcceptMulticast | AcceptMyPhys);
++}
++
++static void rtl_prepare_power_down(struct rtl8169_private *tp)
++{
++ if (tp->dash_type != RTL_DASH_NONE)
++ return;
++
++ if (tp->mac_version == RTL_GIGA_MAC_VER_32 ||
++ tp->mac_version == RTL_GIGA_MAC_VER_33)
++ rtl_ephy_write(tp, 0x19, 0xff64);
++
++ if (device_may_wakeup(tp_to_dev(tp))) {
++ phy_speed_down(tp->phydev, false);
++ rtl_wol_enable_rx(tp);
++ }
++}
++
+ static void rtl_set_tx_config_registers(struct rtl8169_private *tp)
+ {
+ u32 val = TX_DMA_BURST << TxDMAShift |
+--
+2.35.1
+
--- /dev/null
+From 103d189f794d78bcbdd54664c5ebbbba998ccef4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Dec 2022 13:04:11 +0100
+Subject: RDMA/srp: Move large values to a new enum for gcc13
+
+From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+
+[ Upstream commit 56c5dab20a6391604df9521f812c01d1e3fe1bd0 ]
+
+Since gcc13, each member of an enum has the same type as the enum [1]. And
+that is inherited from its members. Provided these two:
+ SRP_TAG_NO_REQ = ~0U,
+ SRP_TAG_TSK_MGMT = 1U << 31
+all other members are unsigned ints.
+
+Esp. with SRP_MAX_SGE and SRP_TSK_MGMT_SQ_SIZE and their use in min(),
+this results in the following warnings:
+ include/linux/minmax.h:20:35: error: comparison of distinct pointer types lacks a cast
+ drivers/infiniband/ulp/srp/ib_srp.c:563:42: note: in expansion of macro 'min'
+
+ include/linux/minmax.h:20:35: error: comparison of distinct pointer types lacks a cast
+ drivers/infiniband/ulp/srp/ib_srp.c:2369:27: note: in expansion of macro 'min'
+
+So move the large values away to a separate enum, so that they don't
+affect other members.
+
+[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=36113
+
+Link: https://lore.kernel.org/r/20221212120411.13750-1-jirislaby@kernel.org
+Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srp/ib_srp.h | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/srp/ib_srp.h
+index 00b0068fda20..5d94db453df3 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.h
++++ b/drivers/infiniband/ulp/srp/ib_srp.h
+@@ -62,9 +62,6 @@ enum {
+ SRP_DEFAULT_CMD_SQ_SIZE = SRP_DEFAULT_QUEUE_SIZE - SRP_RSP_SQ_SIZE -
+ SRP_TSK_MGMT_SQ_SIZE,
+
+- SRP_TAG_NO_REQ = ~0U,
+- SRP_TAG_TSK_MGMT = 1U << 31,
+-
+ SRP_MAX_PAGES_PER_MR = 512,
+
+ SRP_MAX_ADD_CDB_LEN = 16,
+@@ -79,6 +76,11 @@ enum {
+ sizeof(struct srp_imm_buf),
+ };
+
++enum {
++ SRP_TAG_NO_REQ = ~0U,
++ SRP_TAG_TSK_MGMT = BIT(31),
++};
++
+ enum srp_target_state {
+ SRP_TARGET_SCANNING,
+ SRP_TARGET_LIVE,
+--
+2.35.1
+
--- /dev/null
+From bdf08cc55a0f56dd745bf59354af0d37739486ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Dec 2022 10:44:14 +0800
+Subject: selftests/bpf: check null propagation only neither reg is
+ PTR_TO_BTF_ID
+
+From: Hao Sun <sunhao.th@gmail.com>
+
+[ Upstream commit cedebd74cf3883f0384af9ec26b4e6f8f1964dd4 ]
+
+Verify that nullness information is not porpagated in the branches
+of register to register JEQ and JNE operations if one of them is
+PTR_TO_BTF_ID. Implement this in C level so we can use CO-RE.
+
+Signed-off-by: Hao Sun <sunhao.th@gmail.com>
+Suggested-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://lore.kernel.org/r/20221222024414.29539-2-sunhao.th@gmail.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../bpf/prog_tests/jeq_infer_not_null.c | 9 ++++
+ .../bpf/progs/jeq_infer_not_null_fail.c | 42 +++++++++++++++++++
+ 2 files changed, 51 insertions(+)
+ create mode 100644 tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c
+ create mode 100644 tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c b/tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c
+new file mode 100644
+index 000000000000..3add34df5767
+--- /dev/null
++++ b/tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c
+@@ -0,0 +1,9 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <test_progs.h>
++#include "jeq_infer_not_null_fail.skel.h"
++
++void test_jeq_infer_not_null(void)
++{
++ RUN_TESTS(jeq_infer_not_null_fail);
++}
+diff --git a/tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c b/tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c
+new file mode 100644
+index 000000000000..f46965053acb
+--- /dev/null
++++ b/tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c
+@@ -0,0 +1,42 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include "vmlinux.h"
++#include <bpf/bpf_helpers.h>
++#include "bpf_misc.h"
++
++char _license[] SEC("license") = "GPL";
++
++struct {
++ __uint(type, BPF_MAP_TYPE_HASH);
++ __uint(max_entries, 1);
++ __type(key, u64);
++ __type(value, u64);
++} m_hash SEC(".maps");
++
++SEC("?raw_tp")
++__failure __msg("R8 invalid mem access 'map_value_or_null")
++int jeq_infer_not_null_ptr_to_btfid(void *ctx)
++{
++ struct bpf_map *map = (struct bpf_map *)&m_hash;
++ struct bpf_map *inner_map = map->inner_map_meta;
++ u64 key = 0, ret = 0, *val;
++
++ val = bpf_map_lookup_elem(map, &key);
++ /* Do not mark ptr as non-null if one of them is
++ * PTR_TO_BTF_ID (R9), reject because of invalid
++ * access to map value (R8).
++ *
++ * Here, we need to inline those insns to access
++ * R8 directly, since compiler may use other reg
++ * once it figures out val==inner_map.
++ */
++ asm volatile("r8 = %[val];\n"
++ "r9 = %[inner_map];\n"
++ "if r8 != r9 goto +1;\n"
++ "%[ret] = *(u64 *)(r8 +0);\n"
++ : [ret] "+r"(ret)
++ : [inner_map] "r"(inner_map), [val] "r"(val)
++ : "r8", "r9");
++
++ return ret;
++}
+--
+2.35.1
+
--- /dev/null
+From d22fe71f51e00493f497bf767926ffd1018980d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Dec 2022 13:41:06 +0800
+Subject: selftests: net: fix cmsg_so_mark.sh test hang
+
+From: Po-Hsu Lin <po-hsu.lin@canonical.com>
+
+[ Upstream commit 1573c6882018f69991aead951d09423ce978adac ]
+
+This cmsg_so_mark.sh test will hang on non-amd64 systems because of the
+infinity loop for argument parsing in cmsg_sender.
+
+Variable "o" in cs_parse_args() for taking getopt() should be an int,
+otherwise it will be 255 when getopt() returns -1 on non-amd64 system
+and thus causing infinity loop.
+
+Link: https://lore.kernel.org/lkml/CA+G9fYsM2k7mrF7W4V_TrZ-qDauWM394=8yEJ=-t1oUg8_40YA@mail.gmail.com/t/
+Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/cmsg_sender.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/cmsg_sender.c b/tools/testing/selftests/net/cmsg_sender.c
+index 75dd83e39207..24b21b15ed3f 100644
+--- a/tools/testing/selftests/net/cmsg_sender.c
++++ b/tools/testing/selftests/net/cmsg_sender.c
+@@ -110,7 +110,7 @@ static void __attribute__((noreturn)) cs_usage(const char *bin)
+
+ static void cs_parse_args(int argc, char *argv[])
+ {
+- char o;
++ int o;
+
+ while ((o = getopt(argc, argv, "46sS:p:m:M:d:tf:F:c:C:l:L:H:")) != -1) {
+ switch (o) {
+--
+2.35.1
+
--- /dev/null
+dma-buf-fix-dma_buf_export-init-order-v2.patch
+btrfs-fix-trace-event-name-typo-for-flush_delayed_re.patch
+wifi-iwlwifi-fw-skip-ppag-for-jf.patch
+pnfs-filelayout-fix-coalescing-test-for-single-ds.patch
+selftests-bpf-check-null-propagation-only-neither-re.patch
+net-ethernet-marvell-octeontx2-fix-uninitialized-var.patch
+tools-virtio-initialize-spinlocks-in-vring_test.c.patch
+vdpa-mlx5-return-error-on-vlan-ctrl-commands-if-not-.patch
+vdpa-mlx5-avoid-using-reslock-in-event_handler.patch
+vdpa-mlx5-avoid-overwriting-cvq-iotlb.patch
+virtio_pci-modify-enoent-to-einval.patch
+vduse-validate-vq_num-in-vduse_validate_config.patch
+vdpa_sim_net-should-not-drop-the-multicast-broadcast.patch
+net-ethtool-ioctl-return-eopnotsupp-if-we-have-no-ph.patch
+r8169-move-rtl_wol_enable_rx-and-rtl_prepare_power_d.patch
+r8169-fix-dmar-pte-write-access-is-not-set-error.patch
+bpf-keep-a-reference-to-the-mm-in-case-the-task-is-d.patch
+rdma-srp-move-large-values-to-a-new-enum-for-gcc13.patch
+selftests-net-fix-cmsg_so_mark.sh-test-hang.patch
+btrfs-always-report-error-in-run_one_delayed_ref.patch
+x86-asm-fix-an-assembler-warning-with-current-binuti.patch
+f2fs-let-s-avoid-panic-if-extent_tree-is-not-created.patch
+perf-x86-rapl-treat-tigerlake-like-icelake.patch
+cifs-fix-race-in-assemble_neg_contexts.patch
+memblock-tests-fix-compilation-error.patch
+perf-x86-rapl-add-support-for-intel-meteor-lake.patch
+perf-x86-rapl-add-support-for-intel-emerald-rapids.patch
+of-fdt-honor-config_cmdline-even-without-chosen-node.patch
+fbdev-omapfb-avoid-stack-overflow-warning.patch
--- /dev/null
+From 7372f8867b1066f405c3f9c50cd60f2856ae1907 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Oct 2022 08:29:49 +0200
+Subject: tools/virtio: initialize spinlocks in vring_test.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo Cañuelo <ricardo.canuelo@collabora.com>
+
+[ Upstream commit c262f75cb6bb5a63828e72ce3b8fe808e5029479 ]
+
+The virtio_device vqs_list spinlocks must be initialized before use to
+prevent functions that manipulate the device virtualqueues, such as
+vring_new_virtqueue(), from blocking indefinitely.
+
+Signed-off-by: Ricardo Cañuelo <ricardo.canuelo@collabora.com>
+Message-Id: <20221012062949.1526176-1-ricardo.canuelo@collabora.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/virtio/vringh_test.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/virtio/vringh_test.c b/tools/virtio/vringh_test.c
+index fa87b58bd5fa..98ff808d6f0c 100644
+--- a/tools/virtio/vringh_test.c
++++ b/tools/virtio/vringh_test.c
+@@ -308,6 +308,7 @@ static int parallel_test(u64 features,
+
+ gvdev.vdev.features = features;
+ INIT_LIST_HEAD(&gvdev.vdev.vqs);
++ spin_lock_init(&gvdev.vdev.vqs_list_lock);
+ gvdev.to_host_fd = to_host[1];
+ gvdev.notifies = 0;
+
+@@ -455,6 +456,7 @@ int main(int argc, char *argv[])
+ getrange = getrange_iov;
+ vdev.features = 0;
+ INIT_LIST_HEAD(&vdev.vqs);
++ spin_lock_init(&vdev.vqs_list_lock);
+
+ while (argv[1]) {
+ if (strcmp(argv[1], "--indirect") == 0)
+--
+2.35.1
+
--- /dev/null
+From fb1282bad1af1b75d79bfff427a158538bbb72ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 15:17:56 +0200
+Subject: vdpa/mlx5: Avoid overwriting CVQ iotlb
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Eli Cohen <elic@nvidia.com>
+
+[ Upstream commit 38fc462f57ef4e5dc722bab6824854b105de8aa2 ]
+
+When qemu uses different address spaces for data and control virtqueues,
+the current code would overwrite the control virtqueue iotlb through the
+dup_iotlb call. Fix this by referring to the address space identifier
+and the group to asid mapping to determine which mapping needs to be
+updated. We also move the address space logic from mlx5 net to core
+directory.
+
+Reported-by: Eugenio Pérez <eperezma@redhat.com>
+Signed-off-by: Eli Cohen <elic@nvidia.com>
+Message-Id: <20221114131759.57883-6-elic@nvidia.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Eugenio Pérez <eperezma@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/mlx5/core/mlx5_vdpa.h | 5 +--
+ drivers/vdpa/mlx5/core/mr.c | 44 ++++++++++++++++-----------
+ drivers/vdpa/mlx5/net/mlx5_vnet.c | 49 ++++++------------------------
+ 3 files changed, 39 insertions(+), 59 deletions(-)
+
+diff --git a/drivers/vdpa/mlx5/core/mlx5_vdpa.h b/drivers/vdpa/mlx5/core/mlx5_vdpa.h
+index 6af9fdbb86b7..058fbe28107e 100644
+--- a/drivers/vdpa/mlx5/core/mlx5_vdpa.h
++++ b/drivers/vdpa/mlx5/core/mlx5_vdpa.h
+@@ -116,8 +116,9 @@ int mlx5_vdpa_create_mkey(struct mlx5_vdpa_dev *mvdev, u32 *mkey, u32 *in,
+ int inlen);
+ int mlx5_vdpa_destroy_mkey(struct mlx5_vdpa_dev *mvdev, u32 mkey);
+ int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb,
+- bool *change_map);
+-int mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb);
++ bool *change_map, unsigned int asid);
++int mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb,
++ unsigned int asid);
+ void mlx5_vdpa_destroy_mr(struct mlx5_vdpa_dev *mvdev);
+
+ #define mlx5_vdpa_warn(__dev, format, ...) \
+diff --git a/drivers/vdpa/mlx5/core/mr.c b/drivers/vdpa/mlx5/core/mr.c
+index a639b9208d41..a4d7ee2339fa 100644
+--- a/drivers/vdpa/mlx5/core/mr.c
++++ b/drivers/vdpa/mlx5/core/mr.c
+@@ -511,7 +511,8 @@ void mlx5_vdpa_destroy_mr(struct mlx5_vdpa_dev *mvdev)
+ mutex_unlock(&mr->mkey_mtx);
+ }
+
+-static int _mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb)
++static int _mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev,
++ struct vhost_iotlb *iotlb, unsigned int asid)
+ {
+ struct mlx5_vdpa_mr *mr = &mvdev->mr;
+ int err;
+@@ -519,42 +520,49 @@ static int _mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb
+ if (mr->initialized)
+ return 0;
+
+- if (iotlb)
+- err = create_user_mr(mvdev, iotlb);
+- else
+- err = create_dma_mr(mvdev, mr);
++ if (mvdev->group2asid[MLX5_VDPA_DATAVQ_GROUP] == asid) {
++ if (iotlb)
++ err = create_user_mr(mvdev, iotlb);
++ else
++ err = create_dma_mr(mvdev, mr);
+
+- if (err)
+- return err;
++ if (err)
++ return err;
++ }
+
+- err = dup_iotlb(mvdev, iotlb);
+- if (err)
+- goto out_err;
++ if (mvdev->group2asid[MLX5_VDPA_CVQ_GROUP] == asid) {
++ err = dup_iotlb(mvdev, iotlb);
++ if (err)
++ goto out_err;
++ }
+
+ mr->initialized = true;
+ return 0;
+
+ out_err:
+- if (iotlb)
+- destroy_user_mr(mvdev, mr);
+- else
+- destroy_dma_mr(mvdev, mr);
++ if (mvdev->group2asid[MLX5_VDPA_DATAVQ_GROUP] == asid) {
++ if (iotlb)
++ destroy_user_mr(mvdev, mr);
++ else
++ destroy_dma_mr(mvdev, mr);
++ }
+
+ return err;
+ }
+
+-int mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb)
++int mlx5_vdpa_create_mr(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb,
++ unsigned int asid)
+ {
+ int err;
+
+ mutex_lock(&mvdev->mr.mkey_mtx);
+- err = _mlx5_vdpa_create_mr(mvdev, iotlb);
++ err = _mlx5_vdpa_create_mr(mvdev, iotlb, asid);
+ mutex_unlock(&mvdev->mr.mkey_mtx);
+ return err;
+ }
+
+ int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb,
+- bool *change_map)
++ bool *change_map, unsigned int asid)
+ {
+ struct mlx5_vdpa_mr *mr = &mvdev->mr;
+ int err = 0;
+@@ -566,7 +574,7 @@ int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *io
+ *change_map = true;
+ }
+ if (!*change_map)
+- err = _mlx5_vdpa_create_mr(mvdev, iotlb);
++ err = _mlx5_vdpa_create_mr(mvdev, iotlb, asid);
+ mutex_unlock(&mr->mkey_mtx);
+
+ return err;
+diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+index 98dd8ce8af26..3a6dbbc6440d 100644
+--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+@@ -2394,7 +2394,8 @@ static void restore_channels_info(struct mlx5_vdpa_net *ndev)
+ }
+ }
+
+-static int mlx5_vdpa_change_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb)
++static int mlx5_vdpa_change_map(struct mlx5_vdpa_dev *mvdev,
++ struct vhost_iotlb *iotlb, unsigned int asid)
+ {
+ struct mlx5_vdpa_net *ndev = to_mlx5_vdpa_ndev(mvdev);
+ int err;
+@@ -2406,7 +2407,7 @@ static int mlx5_vdpa_change_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb
+
+ teardown_driver(ndev);
+ mlx5_vdpa_destroy_mr(mvdev);
+- err = mlx5_vdpa_create_mr(mvdev, iotlb);
++ err = mlx5_vdpa_create_mr(mvdev, iotlb, asid);
+ if (err)
+ goto err_mr;
+
+@@ -2587,7 +2588,7 @@ static int mlx5_vdpa_reset(struct vdpa_device *vdev)
+ ++mvdev->generation;
+
+ if (MLX5_CAP_GEN(mvdev->mdev, umem_uid_0)) {
+- if (mlx5_vdpa_create_mr(mvdev, NULL))
++ if (mlx5_vdpa_create_mr(mvdev, NULL, 0))
+ mlx5_vdpa_warn(mvdev, "create MR failed\n");
+ }
+ up_write(&ndev->reslock);
+@@ -2623,41 +2624,20 @@ static u32 mlx5_vdpa_get_generation(struct vdpa_device *vdev)
+ return mvdev->generation;
+ }
+
+-static int set_map_control(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb)
+-{
+- u64 start = 0ULL, last = 0ULL - 1;
+- struct vhost_iotlb_map *map;
+- int err = 0;
+-
+- spin_lock(&mvdev->cvq.iommu_lock);
+- vhost_iotlb_reset(mvdev->cvq.iotlb);
+-
+- for (map = vhost_iotlb_itree_first(iotlb, start, last); map;
+- map = vhost_iotlb_itree_next(map, start, last)) {
+- err = vhost_iotlb_add_range(mvdev->cvq.iotlb, map->start,
+- map->last, map->addr, map->perm);
+- if (err)
+- goto out;
+- }
+-
+-out:
+- spin_unlock(&mvdev->cvq.iommu_lock);
+- return err;
+-}
+-
+-static int set_map_data(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb)
++static int set_map_data(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb,
++ unsigned int asid)
+ {
+ bool change_map;
+ int err;
+
+- err = mlx5_vdpa_handle_set_map(mvdev, iotlb, &change_map);
++ err = mlx5_vdpa_handle_set_map(mvdev, iotlb, &change_map, asid);
+ if (err) {
+ mlx5_vdpa_warn(mvdev, "set map failed(%d)\n", err);
+ return err;
+ }
+
+ if (change_map)
+- err = mlx5_vdpa_change_map(mvdev, iotlb);
++ err = mlx5_vdpa_change_map(mvdev, iotlb, asid);
+
+ return err;
+ }
+@@ -2670,16 +2650,7 @@ static int mlx5_vdpa_set_map(struct vdpa_device *vdev, unsigned int asid,
+ int err = -EINVAL;
+
+ down_write(&ndev->reslock);
+- if (mvdev->group2asid[MLX5_VDPA_DATAVQ_GROUP] == asid) {
+- err = set_map_data(mvdev, iotlb);
+- if (err)
+- goto out;
+- }
+-
+- if (mvdev->group2asid[MLX5_VDPA_CVQ_GROUP] == asid)
+- err = set_map_control(mvdev, iotlb);
+-
+-out:
++ err = set_map_data(mvdev, iotlb, asid);
+ up_write(&ndev->reslock);
+ return err;
+ }
+@@ -3182,7 +3153,7 @@ static int mlx5_vdpa_dev_add(struct vdpa_mgmt_dev *v_mdev, const char *name,
+ goto err_mpfs;
+
+ if (MLX5_CAP_GEN(mvdev->mdev, umem_uid_0)) {
+- err = mlx5_vdpa_create_mr(mvdev, NULL);
++ err = mlx5_vdpa_create_mr(mvdev, NULL, 0);
+ if (err)
+ goto err_res;
+ }
+--
+2.35.1
+
--- /dev/null
+From b586e508c75ae01b0a17e2166683552a05a74373 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 15:17:55 +0200
+Subject: vdpa/mlx5: Avoid using reslock in event_handler
+
+From: Eli Cohen <elic@nvidia.com>
+
+[ Upstream commit 0dbc1b4ae07d003b2e88ba9d4142846320f8e349 ]
+
+event_handler runs under atomic context and may not acquire reslock. We
+can still guarantee that the handler won't be called after suspend by
+clearing nb_registered, unregistering the handler and flushing the
+workqueue.
+
+Signed-off-by: Eli Cohen <elic@nvidia.com>
+Message-Id: <20221114131759.57883-5-elic@nvidia.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/mlx5/net/mlx5_vnet.c | 16 ++++------------
+ 1 file changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+index b06260a37680..98dd8ce8af26 100644
+--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+@@ -2845,8 +2845,8 @@ static int mlx5_vdpa_suspend(struct vdpa_device *vdev)
+ int i;
+
+ down_write(&ndev->reslock);
+- mlx5_notifier_unregister(mvdev->mdev, &ndev->nb);
+ ndev->nb_registered = false;
++ mlx5_notifier_unregister(mvdev->mdev, &ndev->nb);
+ flush_workqueue(ndev->mvdev.wq);
+ for (i = 0; i < ndev->cur_num_vqs; i++) {
+ mvq = &ndev->vqs[i];
+@@ -3024,7 +3024,7 @@ static void update_carrier(struct work_struct *work)
+ else
+ ndev->config.status &= cpu_to_mlx5vdpa16(mvdev, ~VIRTIO_NET_S_LINK_UP);
+
+- if (ndev->config_cb.callback)
++ if (ndev->nb_registered && ndev->config_cb.callback)
+ ndev->config_cb.callback(ndev->config_cb.private);
+
+ kfree(wqent);
+@@ -3041,21 +3041,13 @@ static int event_handler(struct notifier_block *nb, unsigned long event, void *p
+ switch (eqe->sub_type) {
+ case MLX5_PORT_CHANGE_SUBTYPE_DOWN:
+ case MLX5_PORT_CHANGE_SUBTYPE_ACTIVE:
+- down_read(&ndev->reslock);
+- if (!ndev->nb_registered) {
+- up_read(&ndev->reslock);
+- return NOTIFY_DONE;
+- }
+ wqent = kzalloc(sizeof(*wqent), GFP_ATOMIC);
+- if (!wqent) {
+- up_read(&ndev->reslock);
++ if (!wqent)
+ return NOTIFY_DONE;
+- }
+
+ wqent->mvdev = &ndev->mvdev;
+ INIT_WORK(&wqent->work, update_carrier);
+ queue_work(ndev->mvdev.wq, &wqent->work);
+- up_read(&ndev->reslock);
+ ret = NOTIFY_OK;
+ break;
+ default:
+@@ -3242,8 +3234,8 @@ static void mlx5_vdpa_dev_del(struct vdpa_mgmt_dev *v_mdev, struct vdpa_device *
+ struct workqueue_struct *wq;
+
+ if (ndev->nb_registered) {
+- mlx5_notifier_unregister(mvdev->mdev, &ndev->nb);
+ ndev->nb_registered = false;
++ mlx5_notifier_unregister(mvdev->mdev, &ndev->nb);
+ }
+ wq = mvdev->wq;
+ mvdev->wq = NULL;
+--
+2.35.1
+
--- /dev/null
+From 3be151026554b12d30251aafbb3e19bc620d82bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 15:17:53 +0200
+Subject: vdpa/mlx5: Return error on vlan ctrl commands if not supported
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Eli Cohen <elic@nvidia.com>
+
+[ Upstream commit 5aec804936bbff182081f1cdc271fcb76af1a4ff ]
+
+Check if VIRTIO_NET_F_CTRL_VLAN is negotiated and return error if
+control VQ command is received.
+
+Signed-off-by: Eli Cohen <elic@nvidia.com>
+Message-Id: <20221114131759.57883-3-elic@nvidia.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Eugenio Pérez <eperezma@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/mlx5/net/mlx5_vnet.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+index 444d6572b2d0..b06260a37680 100644
+--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+@@ -1823,6 +1823,9 @@ static virtio_net_ctrl_ack handle_ctrl_vlan(struct mlx5_vdpa_dev *mvdev, u8 cmd)
+ size_t read;
+ u16 id;
+
++ if (!(ndev->mvdev.actual_features & BIT_ULL(VIRTIO_NET_F_CTRL_VLAN)))
++ return status;
++
+ switch (cmd) {
+ case VIRTIO_NET_CTRL_VLAN_ADD:
+ read = vringh_iov_pull_iotlb(&cvq->vring, &cvq->riov, &vlan, sizeof(vlan));
+--
+2.35.1
+
--- /dev/null
+From 5e2bf956726c15969b22225412b4c9d51d8bb747 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Dec 2022 13:43:06 +0800
+Subject: vdpa_sim_net: should not drop the multicast/broadcast packet
+
+From: Cindy Lu <lulu@redhat.com>
+
+[ Upstream commit 72455a1142527e607e1d69439f3ffa2ef6d09e26 ]
+
+In the receive_filter(), should not drop the packet with the
+broadcast/multicast address. Add the check for this
+
+Signed-off-by: Cindy Lu <lulu@redhat.com>
+Message-Id: <20221214054306.24145-1-lulu@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/vdpa_sim/vdpa_sim_net.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim_net.c b/drivers/vdpa/vdpa_sim/vdpa_sim_net.c
+index 11f5a121df24..584b975a98a7 100644
+--- a/drivers/vdpa/vdpa_sim/vdpa_sim_net.c
++++ b/drivers/vdpa/vdpa_sim/vdpa_sim_net.c
+@@ -62,6 +62,9 @@ static bool receive_filter(struct vdpasim *vdpasim, size_t len)
+ if (len < ETH_ALEN + hdr_len)
+ return false;
+
++ if (is_broadcast_ether_addr(vdpasim->buffer + hdr_len) ||
++ is_multicast_ether_addr(vdpasim->buffer + hdr_len))
++ return true;
+ if (!strncmp(vdpasim->buffer + hdr_len, vio_config->mac, ETH_ALEN))
+ return true;
+
+--
+2.35.1
+
--- /dev/null
+From a3b24fb7a17fd90fe95277f2882a66d26cfee806 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Nov 2022 07:57:15 -0800
+Subject: vduse: Validate vq_num in vduse_validate_config()
+
+From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+
+[ Upstream commit 937c783aa3d8d77963ec91918d3298edb45b9161 ]
+
+Add a limit to 'config->vq_num' which is user controlled data which
+comes from an vduse_ioctl to prevent large memory allocations.
+
+Micheal says - This limit is somewhat arbitrary.
+However, currently virtio pci and ccw are limited to a 16 bit vq number.
+While MMIO isn't it is also isn't used with lots of VQs due to
+current lack of support for per-vq interrupts.
+Thus, the 0xffff limit on number of VQs corresponding
+to a 16-bit VQ number seems sufficient for now.
+
+This is found using static analysis with smatch.
+
+Suggested-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Message-Id: <20221128155717.2579992-1-harshit.m.mogalapalli@oracle.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/vdpa_user/vduse_dev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c
+index 35dceee3ed56..31017ebc4d7c 100644
+--- a/drivers/vdpa/vdpa_user/vduse_dev.c
++++ b/drivers/vdpa/vdpa_user/vduse_dev.c
+@@ -1440,6 +1440,9 @@ static bool vduse_validate_config(struct vduse_dev_config *config)
+ if (config->config_size > PAGE_SIZE)
+ return false;
+
++ if (config->vq_num > 0xffff)
++ return false;
++
+ if (!device_is_allowed(config->device_id))
+ return false;
+
+--
+2.35.1
+
--- /dev/null
+From b97590a31aa3757a945883c5593ece254fc8b055 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Nov 2022 19:16:54 +0800
+Subject: virtio_pci: modify ENOENT to EINVAL
+
+From: Angus Chen <angus.chen@jaguarmicro.com>
+
+[ Upstream commit b66ead2d0ecac00c3a06a6218af5411cb5fcb5d5 ]
+
+Virtio_crypto use max_data_queues+1 to setup vqs,
+we use vp_modern_get_num_queues to protect the vq range in setup_vq.
+We could enter index >= vp_modern_get_num_queues(mdev) in setup_vq
+if common->num_queues is not set well,and it return -ENOENT.
+It is better to use -EINVAL instead.
+
+Signed-off-by: Angus Chen <angus.chen@jaguarmicro.com>
+Message-Id: <20221101111655.1947-1-angus.chen@jaguarmicro.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_pci_modern.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c
+index c3b9f2761849..edf2e18014cd 100644
+--- a/drivers/virtio/virtio_pci_modern.c
++++ b/drivers/virtio/virtio_pci_modern.c
+@@ -303,7 +303,7 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
+ int err;
+
+ if (index >= vp_modern_get_num_queues(mdev))
+- return ERR_PTR(-ENOENT);
++ return ERR_PTR(-EINVAL);
+
+ /* Check if queue is either not available or already active. */
+ num = vp_modern_get_queue_size(mdev, index);
+--
+2.35.1
+
--- /dev/null
+From 5b16c1aaae72edd3f895da027a532ee6a740df7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Dec 2022 23:15:04 +0200
+Subject: wifi: iwlwifi: fw: skip PPAG for JF
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 1c4c0b28b517d778d37900deedfe91088839f07a ]
+
+For JF RFs we don't support PPAG, but many firmware
+images lie about it. Always skip support for JF to
+avoid firmware errors when sending the command.
+
+Reported-and-tested-by: Íñigo Huguet <ihuguet@redhat.com>
+Link: https://lore.kernel.org/linux-wireless/CACT4oufQsqHGp6bah2c4+jPn2wG1oZqY=UKa_TmPx=F6Lxng8Q@mail.gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20221213225723.2a43415d8990.I9ac210740a45b41f1b2e15274e1daf4284f2808a@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+index e6d64152c81a..a02e5a67b706 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+@@ -1106,6 +1106,11 @@ int iwl_read_ppag_table(struct iwl_fw_runtime *fwrt, union iwl_ppag_table_cmd *c
+ int i, j, num_sub_bands;
+ s8 *gain;
+
++ /* many firmware images for JF lie about this */
++ if (CSR_HW_RFID_TYPE(fwrt->trans->hw_rf_id) ==
++ CSR_HW_RFID_TYPE(CSR_HW_RF_ID_TYPE_JF))
++ return -EOPNOTSUPP;
++
+ if (!fw_has_capa(&fwrt->fw->ucode_capa, IWL_UCODE_TLV_CAPA_SET_PPAG)) {
+ IWL_DEBUG_RADIO(fwrt,
+ "PPAG capability not supported by FW, command not sent.\n");
+--
+2.35.1
+
--- /dev/null
+From b4093d2c81cfbc6e4eff5f0c573f6af83126b6f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jan 2023 10:24:11 -0500
+Subject: x86/asm: Fix an assembler warning with current binutils
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 55d235361fccef573990dfa5724ab453866e7816 ]
+
+Fix a warning: "found `movsd'; assuming `movsl' was meant"
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/lib/iomap_copy_64.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/lib/iomap_copy_64.S b/arch/x86/lib/iomap_copy_64.S
+index a1f9416bf67a..6ff2f56cb0f7 100644
+--- a/arch/x86/lib/iomap_copy_64.S
++++ b/arch/x86/lib/iomap_copy_64.S
+@@ -10,6 +10,6 @@
+ */
+ SYM_FUNC_START(__iowrite32_copy)
+ movl %edx,%ecx
+- rep movsd
++ rep movsl
+ RET
+ SYM_FUNC_END(__iowrite32_copy)
+--
+2.35.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
