From: Sasha Levin Date: Mon, 31 Aug 2020 01:27:33 +0000 (-0400) Subject: Fixes for 5.8 X-Git-Tag: v4.4.235~55 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3f5186e8350b84d4e794839f011a91eae2d17229;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.8 Signed-off-by: Sasha Levin --- diff --git a/queue-5.8/alsa-hda-realtek-add-model-alc298-samsung-headphone.patch b/queue-5.8/alsa-hda-realtek-add-model-alc298-samsung-headphone.patch new file mode 100644 index 00000000000..91e8c207431 --- /dev/null +++ b/queue-5.8/alsa-hda-realtek-add-model-alc298-samsung-headphone.patch @@ -0,0 +1,37 @@ +From 5da6bd182471c2371594859e65871bc8e3f78d77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Aug 2020 21:32:17 -0700 +Subject: ALSA: hda/realtek: Add model alc298-samsung-headphone + +From: Mike Pozulp + +[ Upstream commit 23dc958689449be85e39351a8c809c3d344b155b ] + +The very quiet and distorted headphone output bug that afflicted my +Samsung Notebook 9 is appearing in many other Samsung laptops. Expose +the quirk which fixed my laptop as a model so other users can try it. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207423 +Signed-off-by: Mike Pozulp +Link: https://lore.kernel.org/r/20200817043219.458889-1-pozulp.kernel@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index b767d8fce828e..da23c2d4ca51e 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7969,6 +7969,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC299_FIXUP_PREDATOR_SPK, .name = "predator-spk"}, + {.id = ALC298_FIXUP_HUAWEI_MBX_STEREO, .name = "huawei-mbx-stereo"}, + {.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"}, ++ {.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"}, + {} + }; + #define ALC225_STANDARD_PINS \ +-- +2.25.1 + diff --git a/queue-5.8/alsa-usb-audio-ignore-broken-processing-extension-un.patch b/queue-5.8/alsa-usb-audio-ignore-broken-processing-extension-un.patch new file mode 100644 index 00000000000..bd4864bd294 --- /dev/null +++ b/queue-5.8/alsa-usb-audio-ignore-broken-processing-extension-un.patch @@ -0,0 +1,51 @@ +From 084eba58f9b8f3af2ebf49efb48b3183516a3deb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 01:20:11 +0800 +Subject: ALSA: usb-audio: ignore broken processing/extension unit + +From: Tom Yan + +[ Upstream commit d8d0db7bb358ef65d60726a61bfcd08eccff0bc0 ] + +Some devices have broken extension unit where getting current value +doesn't work. Attempt that once when creating mixer control for it. If +it fails, just ignore it, so that it won't cripple the device entirely +(and/or make the error floods). + +Signed-off-by: Tom Yan +Link: https://lore.kernel.org/r/5f3abc52.1c69fb81.9cf2.fe91@mx.google.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index eab0fd4fd7c33..e0b7174c10430 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -2367,7 +2367,7 @@ static int build_audio_procunit(struct mixer_build *state, int unitid, + int num_ins; + struct usb_mixer_elem_info *cval; + struct snd_kcontrol *kctl; +- int i, err, nameid, type, len; ++ int i, err, nameid, type, len, val; + const struct procunit_info *info; + const struct procunit_value_info *valinfo; + const struct usbmix_name_map *map; +@@ -2470,6 +2470,12 @@ static int build_audio_procunit(struct mixer_build *state, int unitid, + break; + } + ++ err = get_cur_ctl_value(cval, cval->control << 8, &val); ++ if (err < 0) { ++ usb_mixer_elem_info_free(cval); ++ return -EINVAL; ++ } ++ + kctl = snd_ctl_new1(&mixer_procunit_ctl, cval); + if (!kctl) { + usb_mixer_elem_info_free(cval); +-- +2.25.1 + diff --git a/queue-5.8/arm64-allow-booting-of-late-cpus-affected-by-erratum.patch b/queue-5.8/arm64-allow-booting-of-late-cpus-affected-by-erratum.patch new file mode 100644 index 00000000000..6719f848c8b --- /dev/null +++ b/queue-5.8/arm64-allow-booting-of-late-cpus-affected-by-erratum.patch @@ -0,0 +1,41 @@ +From 6fb9aa4e7c835007152ed40ac8b64c2ae60c1ad2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jul 2020 18:38:24 +0100 +Subject: arm64: Allow booting of late CPUs affected by erratum 1418040 + +From: Marc Zyngier + +[ Upstream commit bf87bb0881d0f59181fe3bbcf29c609f36483ff8 ] + +As we can now switch from a system that isn't affected by 1418040 +to a system that globally is affected, let's allow affected CPUs +to come in at a later time. + +Signed-off-by: Marc Zyngier +Tested-by: Sai Prakash Ranjan +Reviewed-by: Stephen Boyd +Reviewed-by: Suzuki K Poulose +Acked-by: Will Deacon +Link: https://lore.kernel.org/r/20200731173824.107480-3-maz@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/cpu_errata.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index 79728bfb5351f..2c0b82db825ba 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -910,6 +910,8 @@ const struct arm64_cpu_capabilities arm64_errata[] = { + .desc = "ARM erratum 1418040", + .capability = ARM64_WORKAROUND_1418040, + ERRATA_MIDR_RANGE_LIST(erratum_1418040_list), ++ .type = (ARM64_CPUCAP_SCOPE_LOCAL_CPU | ++ ARM64_CPUCAP_PERMITTED_FOR_LATE_CPU), + }, + #endif + #ifdef CONFIG_ARM64_WORKAROUND_SPECULATIVE_AT +-- +2.25.1 + diff --git a/queue-5.8/arm64-move-handling-of-erratum-1418040-into-c-code.patch b/queue-5.8/arm64-move-handling-of-erratum-1418040-into-c-code.patch new file mode 100644 index 00000000000..81c605d4a80 --- /dev/null +++ b/queue-5.8/arm64-move-handling-of-erratum-1418040-into-c-code.patch @@ -0,0 +1,124 @@ +From e78241b27fcaa911b44179d6f705aef93bc9f830 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jul 2020 18:38:23 +0100 +Subject: arm64: Move handling of erratum 1418040 into C code + +From: Marc Zyngier + +[ Upstream commit d49f7d7376d0c0daf8680984a37bd07581ac7d38 ] + +Instead of dealing with erratum 1418040 on each entry and exit, +let's move the handling to __switch_to() instead, which has +several advantages: + +- It can be applied when it matters (switching between 32 and 64 + bit tasks). +- It is written in C (yay!) +- It can rely on static keys rather than alternatives + +Signed-off-by: Marc Zyngier +Tested-by: Sai Prakash Ranjan +Reviewed-by: Stephen Boyd +Acked-by: Will Deacon +Link: https://lore.kernel.org/r/20200731173824.107480-2-maz@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/entry.S | 21 --------------------- + arch/arm64/kernel/process.c | 34 ++++++++++++++++++++++++++++++++++ + 2 files changed, 34 insertions(+), 21 deletions(-) + +diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S +index 35de8ba60e3d5..44445d471442d 100644 +--- a/arch/arm64/kernel/entry.S ++++ b/arch/arm64/kernel/entry.S +@@ -169,19 +169,6 @@ alternative_cb_end + stp x28, x29, [sp, #16 * 14] + + .if \el == 0 +- .if \regsize == 32 +- /* +- * If we're returning from a 32-bit task on a system affected by +- * 1418040 then re-enable userspace access to the virtual counter. +- */ +-#ifdef CONFIG_ARM64_ERRATUM_1418040 +-alternative_if ARM64_WORKAROUND_1418040 +- mrs x0, cntkctl_el1 +- orr x0, x0, #2 // ARCH_TIMER_USR_VCT_ACCESS_EN +- msr cntkctl_el1, x0 +-alternative_else_nop_endif +-#endif +- .endif + clear_gp_regs + mrs x21, sp_el0 + ldr_this_cpu tsk, __entry_task, x20 +@@ -337,14 +324,6 @@ alternative_else_nop_endif + tst x22, #PSR_MODE32_BIT // native task? + b.eq 3f + +-#ifdef CONFIG_ARM64_ERRATUM_1418040 +-alternative_if ARM64_WORKAROUND_1418040 +- mrs x0, cntkctl_el1 +- bic x0, x0, #2 // ARCH_TIMER_USR_VCT_ACCESS_EN +- msr cntkctl_el1, x0 +-alternative_else_nop_endif +-#endif +- + #ifdef CONFIG_ARM64_ERRATUM_845719 + alternative_if ARM64_WORKAROUND_845719 + #ifdef CONFIG_PID_IN_CONTEXTIDR +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index 6089638c7d43f..d8a10cf28f827 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -515,6 +515,39 @@ static void entry_task_switch(struct task_struct *next) + __this_cpu_write(__entry_task, next); + } + ++/* ++ * ARM erratum 1418040 handling, affecting the 32bit view of CNTVCT. ++ * Assuming the virtual counter is enabled at the beginning of times: ++ * ++ * - disable access when switching from a 64bit task to a 32bit task ++ * - enable access when switching from a 32bit task to a 64bit task ++ */ ++static void erratum_1418040_thread_switch(struct task_struct *prev, ++ struct task_struct *next) ++{ ++ bool prev32, next32; ++ u64 val; ++ ++ if (!(IS_ENABLED(CONFIG_ARM64_ERRATUM_1418040) && ++ cpus_have_const_cap(ARM64_WORKAROUND_1418040))) ++ return; ++ ++ prev32 = is_compat_thread(task_thread_info(prev)); ++ next32 = is_compat_thread(task_thread_info(next)); ++ ++ if (prev32 == next32) ++ return; ++ ++ val = read_sysreg(cntkctl_el1); ++ ++ if (!next32) ++ val |= ARCH_TIMER_USR_VCT_ACCESS_EN; ++ else ++ val &= ~ARCH_TIMER_USR_VCT_ACCESS_EN; ++ ++ write_sysreg(val, cntkctl_el1); ++} ++ + /* + * Thread switching. + */ +@@ -530,6 +563,7 @@ __notrace_funcgraph struct task_struct *__switch_to(struct task_struct *prev, + entry_task_switch(next); + uao_thread_switch(next); + ssbs_thread_switch(next); ++ erratum_1418040_thread_switch(prev, next); + + /* + * Complete any pending TLB or cache maintenance on this CPU in case +-- +2.25.1 + diff --git a/queue-5.8/asoc-wm8994-avoid-attempts-to-read-unreadable-regist.patch b/queue-5.8/asoc-wm8994-avoid-attempts-to-read-unreadable-regist.patch new file mode 100644 index 00000000000..dd404a781fd --- /dev/null +++ b/queue-5.8/asoc-wm8994-avoid-attempts-to-read-unreadable-regist.patch @@ -0,0 +1,52 @@ +From 8971bdd057002dd9f10ac70f07fd6636927bd082 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jul 2020 19:38:34 +0200 +Subject: ASoC: wm8994: Avoid attempts to read unreadable registers + +From: Sylwester Nawrocki + +[ Upstream commit f082bb59b72039a2326ec1a44496899fb8aa6d0e ] + +The driver supports WM1811, WM8994, WM8958 devices but according to +documentation and the regmap definitions the WM8958_DSP2_* registers +are only available on WM8958. In current code these registers are +being accessed as if they were available on all the three chips. + +When starting playback on WM1811 CODEC multiple errors like: +"wm8994-codec wm8994-codec: ASoC: error at soc_component_read_no_lock on wm8994-codec: -5" +can be seen, which is caused by attempts to read an unavailable +WM8958_DSP2_PROGRAM register. The issue has been uncovered by recent +commit "e2329ee ASoC: soc-component: add soc_component_err()". + +This patch adds a check in wm8958_aif_ev() callback so the DSP2 handling +is only done for WM8958. + +Signed-off-by: Sylwester Nawrocki +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20200731173834.23832-1-s.nawrocki@samsung.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8958-dsp2.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c +index ca42445b649d4..b471892d84778 100644 +--- a/sound/soc/codecs/wm8958-dsp2.c ++++ b/sound/soc/codecs/wm8958-dsp2.c +@@ -412,8 +412,12 @@ int wm8958_aif_ev(struct snd_soc_dapm_widget *w, + struct snd_kcontrol *kcontrol, int event) + { + struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); ++ struct wm8994 *control = dev_get_drvdata(component->dev->parent); + int i; + ++ if (control->type != WM8958) ++ return 0; ++ + switch (event) { + case SND_SOC_DAPM_POST_PMU: + case SND_SOC_DAPM_PRE_PMU: +-- +2.25.1 + diff --git a/queue-5.8/bfq-fix-blkio-cgroup-leakage-v4.patch b/queue-5.8/bfq-fix-blkio-cgroup-leakage-v4.patch new file mode 100644 index 00000000000..12cfbed4ad2 --- /dev/null +++ b/queue-5.8/bfq-fix-blkio-cgroup-leakage-v4.patch @@ -0,0 +1,155 @@ +From 03fc22c71dac02d2ea51c25627819d3c7e6e46ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 06:43:40 +0000 +Subject: bfq: fix blkio cgroup leakage v4 + +From: Dmitry Monakhov + +[ Upstream commit 2de791ab4918969d8108f15238a701968375f235 ] + +Changes from v1: + - update commit description with proper ref-accounting justification + +commit db37a34c563b ("block, bfq: get a ref to a group when adding it to a service tree") +introduce leak forbfq_group and blkcg_gq objects because of get/put +imbalance. +In fact whole idea of original commit is wrong because bfq_group entity +can not dissapear under us because it is referenced by child bfq_queue's +entities from here: + -> bfq_init_entity() + ->bfqg_and_blkg_get(bfqg); + ->entity->parent = bfqg->my_entity + + -> bfq_put_queue(bfqq) + FINAL_PUT + ->bfqg_and_blkg_put(bfqq_group(bfqq)) + ->kmem_cache_free(bfq_pool, bfqq); + +So parent entity can not disappear while child entity is in tree, +and child entities already has proper protection. +This patch revert commit db37a34c563b ("block, bfq: get a ref to a group when adding it to a service tree") + +bfq_group leak trace caused by bad commit: +-> blkg_alloc + -> bfq_pq_alloc + -> bfqg_get (+1) +->bfq_activate_bfqq + ->bfq_activate_requeue_entity + -> __bfq_activate_entity + ->bfq_get_entity + ->bfqg_and_blkg_get (+1) <==== : Note1 +->bfq_del_bfqq_busy + ->bfq_deactivate_entity+0x53/0xc0 [bfq] + ->__bfq_deactivate_entity+0x1b8/0x210 [bfq] + -> bfq_forget_entity(is_in_service = true) + entity->on_st_or_in_serv = false <=== :Note2 + if (is_in_service) + return; ==> do not touch reference +-> blkcg_css_offline + -> blkcg_destroy_blkgs + -> blkg_destroy + -> bfq_pd_offline + -> __bfq_deactivate_entity + if (!entity->on_st_or_in_serv) /* true, because (Note2) + return false; + -> bfq_pd_free + -> bfqg_put() (-1, byt bfqg->ref == 2) because of (Note2) +So bfq_group and blkcg_gq will leak forever, see test-case below. + +##TESTCASE_BEGIN: +#!/bin/bash + +max_iters=${1:-100} +#prep cgroup mounts +mount -t tmpfs cgroup_root /sys/fs/cgroup +mkdir /sys/fs/cgroup/blkio +mount -t cgroup -o blkio none /sys/fs/cgroup/blkio + +# Prepare blkdev +grep blkio /proc/cgroups +truncate -s 1M img +losetup /dev/loop0 img +echo bfq > /sys/block/loop0/queue/scheduler + +grep blkio /proc/cgroups +for ((i=0;i /sys/fs/cgroup/blkio/a/cgroup.procs + dd if=/dev/loop0 bs=4k count=1 of=/dev/null iflag=direct 2> /dev/null + echo 0 > /sys/fs/cgroup/blkio/cgroup.procs + rmdir /sys/fs/cgroup/blkio/a + grep blkio /proc/cgroups +done +##TESTCASE_END: + +Fixes: db37a34c563b ("block, bfq: get a ref to a group when adding it to a service tree") +Tested-by: Oleksandr Natalenko +Signed-off-by: Dmitry Monakhov +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-cgroup.c | 2 +- + block/bfq-iosched.h | 1 - + block/bfq-wf2q.c | 12 ++---------- + 3 files changed, 3 insertions(+), 12 deletions(-) + +diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c +index 68882b9b8f11f..b791e2041e49b 100644 +--- a/block/bfq-cgroup.c ++++ b/block/bfq-cgroup.c +@@ -332,7 +332,7 @@ static void bfqg_put(struct bfq_group *bfqg) + kfree(bfqg); + } + +-void bfqg_and_blkg_get(struct bfq_group *bfqg) ++static void bfqg_and_blkg_get(struct bfq_group *bfqg) + { + /* see comments in bfq_bic_update_cgroup for why refcounting bfqg */ + bfqg_get(bfqg); +diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h +index cd224aaf9f52a..703895224562c 100644 +--- a/block/bfq-iosched.h ++++ b/block/bfq-iosched.h +@@ -986,7 +986,6 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd, + struct blkcg_gq *bfqg_to_blkg(struct bfq_group *bfqg); + struct bfq_group *bfqq_group(struct bfq_queue *bfqq); + struct bfq_group *bfq_create_group_hierarchy(struct bfq_data *bfqd, int node); +-void bfqg_and_blkg_get(struct bfq_group *bfqg); + void bfqg_and_blkg_put(struct bfq_group *bfqg); + + #ifdef CONFIG_BFQ_GROUP_IOSCHED +diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c +index eb0e2a6daabe6..26776bdbdf360 100644 +--- a/block/bfq-wf2q.c ++++ b/block/bfq-wf2q.c +@@ -533,9 +533,7 @@ static void bfq_get_entity(struct bfq_entity *entity) + bfqq->ref++; + bfq_log_bfqq(bfqq->bfqd, bfqq, "get_entity: %p %d", + bfqq, bfqq->ref); +- } else +- bfqg_and_blkg_get(container_of(entity, struct bfq_group, +- entity)); ++ } + } + + /** +@@ -649,14 +647,8 @@ static void bfq_forget_entity(struct bfq_service_tree *st, + + entity->on_st_or_in_serv = false; + st->wsum -= entity->weight; +- if (is_in_service) +- return; +- +- if (bfqq) ++ if (bfqq && !is_in_service) + bfq_put_queue(bfqq); +- else +- bfqg_and_blkg_put(container_of(entity, struct bfq_group, +- entity)); + } + + /** +-- +2.25.1 + diff --git a/queue-5.8/blk-mq-insert-request-not-through-queue_rq-into-sw-s.patch b/queue-5.8/blk-mq-insert-request-not-through-queue_rq-into-sw-s.patch new file mode 100644 index 00000000000..e63215f497e --- /dev/null +++ b/queue-5.8/blk-mq-insert-request-not-through-queue_rq-into-sw-s.patch @@ -0,0 +1,51 @@ +From e061367f4b90fecb16ae550c569962145575fe00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 17:07:28 +0800 +Subject: blk-mq: insert request not through ->queue_rq into sw/scheduler queue + +From: Ming Lei + +[ Upstream commit db03f88fae8a2c8007caafa70287798817df2875 ] + +c616cbee97ae ("blk-mq: punt failed direct issue to dispatch list") supposed +to add request which has been through ->queue_rq() to the hw queue dispatch +list, however it adds request running out of budget or driver tag to hw queue +too. This way basically bypasses request merge, and causes too many request +dispatched to LLD, and system% is unnecessary increased. + +Fixes this issue by adding request not through ->queue_rq into sw/scheduler +queue, and this way is safe because no ->queue_rq is called on this request +yet. + +High %system can be observed on Azure storvsc device, and even soft lock +is observed. This patch reduces %system during heavy sequential IO, +meantime decreases soft lockup risk. + +Fixes: c616cbee97ae ("blk-mq: punt failed direct issue to dispatch list") +Signed-off-by: Ming Lei +Cc: Christoph Hellwig +Cc: Bart Van Assche +Cc: Mike Snitzer +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 4e0d173beaa35..e86ccfe377779 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1909,7 +1909,8 @@ insert: + if (bypass_insert) + return BLK_STS_RESOURCE; + +- blk_mq_request_bypass_insert(rq, false, run_queue); ++ blk_mq_sched_insert_request(rq, false, run_queue, false); ++ + return BLK_STS_OK; + } + +-- +2.25.1 + diff --git a/queue-5.8/blkcg-fix-memleak-for-iolatency.patch b/queue-5.8/blkcg-fix-memleak-for-iolatency.patch new file mode 100644 index 00000000000..7ea478a3ce9 --- /dev/null +++ b/queue-5.8/blkcg-fix-memleak-for-iolatency.patch @@ -0,0 +1,48 @@ +From f62bdb60b12d88f70c591c7306c7f0e926c52b93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 22:21:16 -0400 +Subject: blkcg: fix memleak for iolatency + +From: Yufen Yu + +[ Upstream commit 27029b4b18aa5d3b060f0bf2c26dae254132cfce ] + +Normally, blkcg_iolatency_exit() will free related memory in iolatency +when cleanup queue. But if blk_throtl_init() return error and queue init +fail, blkcg_iolatency_exit() will not do that for us. Then it cause +memory leak. + +Fixes: d70675121546 ("block: introduce blk-iolatency io controller") +Signed-off-by: Yufen Yu +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 0ecc897b225c9..6e8f5e60b0982 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -1056,13 +1056,15 @@ int blkcg_init_queue(struct request_queue *q) + if (preloaded) + radix_tree_preload_end(); + +- ret = blk_iolatency_init(q); ++ ret = blk_throtl_init(q); + if (ret) + goto err_destroy_all; + +- ret = blk_throtl_init(q); +- if (ret) ++ ret = blk_iolatency_init(q); ++ if (ret) { ++ blk_throtl_exit(q); + goto err_destroy_all; ++ } + return 0; + + err_destroy_all: +-- +2.25.1 + diff --git a/queue-5.8/block-fix-page_is_mergeable-for-compound-pages.patch b/queue-5.8/block-fix-page_is_mergeable-for-compound-pages.patch new file mode 100644 index 00000000000..3d2f828f59e --- /dev/null +++ b/queue-5.8/block-fix-page_is_mergeable-for-compound-pages.patch @@ -0,0 +1,54 @@ +From 701dcb0f3f87ec60d43da34d9b298ef9a2785fa7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 20:52:06 +0100 +Subject: block: Fix page_is_mergeable() for compound pages + +From: Matthew Wilcox (Oracle) + +[ Upstream commit d81665198b83e55a28339d1f3e4890ed8a434556 ] + +If we pass in an offset which is larger than PAGE_SIZE, then +page_is_mergeable() thinks it's not mergeable with the previous bio_vec, +leading to a large number of bio_vecs being used. Use a slightly more +obvious test that the two pages are compatible with each other. + +Fixes: 52d52d1c98a9 ("block: only allow contiguous page structs in a bio_vec") +Signed-off-by: Matthew Wilcox (Oracle) +Reviewed-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bio.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/block/bio.c b/block/bio.c +index a7366c02c9b57..b1883adc8f154 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -738,8 +738,8 @@ static inline bool page_is_mergeable(const struct bio_vec *bv, + struct page *page, unsigned int len, unsigned int off, + bool *same_page) + { +- phys_addr_t vec_end_addr = page_to_phys(bv->bv_page) + +- bv->bv_offset + bv->bv_len - 1; ++ size_t bv_end = bv->bv_offset + bv->bv_len; ++ phys_addr_t vec_end_addr = page_to_phys(bv->bv_page) + bv_end - 1; + phys_addr_t page_addr = page_to_phys(page); + + if (vec_end_addr + 1 != page_addr + off) +@@ -748,9 +748,9 @@ static inline bool page_is_mergeable(const struct bio_vec *bv, + return false; + + *same_page = ((vec_end_addr & PAGE_MASK) == page_addr); +- if (!*same_page && pfn_to_page(PFN_DOWN(vec_end_addr)) + 1 != page) +- return false; +- return true; ++ if (*same_page) ++ return true; ++ return (bv->bv_page + bv_end / PAGE_SIZE) == (page + off / PAGE_SIZE); + } + + /* +-- +2.25.1 + diff --git a/queue-5.8/block-respect-queue-limit-of-max-discard-segment.patch b/queue-5.8/block-respect-queue-limit-of-max-discard-segment.patch new file mode 100644 index 00000000000..58d7f6c93c8 --- /dev/null +++ b/queue-5.8/block-respect-queue-limit-of-max-discard-segment.patch @@ -0,0 +1,64 @@ +From cc797dd7742c1cee85ef42d6c89186c10c75f4fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 17:52:39 +0800 +Subject: block: respect queue limit of max discard segment + +From: Ming Lei + +[ Upstream commit 943b40c832beb71115e38a1c4d99b640b5342738 ] + +When queue_max_discard_segments(q) is 1, blk_discard_mergable() will +return false for discard request, then normal request merge is applied. +However, only queue_max_segments() is checked, so max discard segment +limit isn't respected. + +Check max discard segment limit in the request merge code for fixing +the issue. + +Discard request failure of virtio_blk is fixed. + +Fixes: 69840466086d ("block: fix the DISCARD request merge") +Signed-off-by: Ming Lei +Reviewed-by: Christoph Hellwig +Cc: Stefano Garzarella +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-merge.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/block/blk-merge.c b/block/blk-merge.c +index f0b0bae075a0c..0b590907676af 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -534,10 +534,17 @@ int __blk_rq_map_sg(struct request_queue *q, struct request *rq, + } + EXPORT_SYMBOL(__blk_rq_map_sg); + ++static inline unsigned int blk_rq_get_max_segments(struct request *rq) ++{ ++ if (req_op(rq) == REQ_OP_DISCARD) ++ return queue_max_discard_segments(rq->q); ++ return queue_max_segments(rq->q); ++} ++ + static inline int ll_new_hw_segment(struct request *req, struct bio *bio, + unsigned int nr_phys_segs) + { +- if (req->nr_phys_segments + nr_phys_segs > queue_max_segments(req->q)) ++ if (req->nr_phys_segments + nr_phys_segs > blk_rq_get_max_segments(req)) + goto no_merge; + + if (blk_integrity_merge_bio(req->q, req, bio) == false) +@@ -625,7 +632,7 @@ static int ll_merge_requests_fn(struct request_queue *q, struct request *req, + return 0; + + total_phys_segments = req->nr_phys_segments + next->nr_phys_segments; +- if (total_phys_segments > queue_max_segments(q)) ++ if (total_phys_segments > blk_rq_get_max_segments(req)) + return 0; + + if (blk_integrity_merge_rq(q, req, next) == false) +-- +2.25.1 + diff --git a/queue-5.8/block-virtio_blk-fix-handling-single-range-discard-r.patch b/queue-5.8/block-virtio_blk-fix-handling-single-range-discard-r.patch new file mode 100644 index 00000000000..bd670433ecf --- /dev/null +++ b/queue-5.8/block-virtio_blk-fix-handling-single-range-discard-r.patch @@ -0,0 +1,82 @@ +From ada8a136cebd4bc70bf800dddd7b005772446f4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 17:52:40 +0800 +Subject: block: virtio_blk: fix handling single range discard request + +From: Ming Lei + +[ Upstream commit af822aa68fbdf0a480a17462ed70232998127453 ] + +1f23816b8eb8 ("virtio_blk: add discard and write zeroes support") starts +to support multi-range discard for virtio-blk. However, the virtio-blk +disk may report max discard segment as 1, at least that is exactly what +qemu is doing. + +So far, block layer switches to normal request merge if max discard segment +limit is 1, and multiple bios can be merged to single segment. This way may +cause memory corruption in virtblk_setup_discard_write_zeroes(). + +Fix the issue by handling single max discard segment in straightforward +way. + +Fixes: 1f23816b8eb8 ("virtio_blk: add discard and write zeroes support") +Signed-off-by: Ming Lei +Reviewed-by: Christoph Hellwig +Cc: Changpeng Liu +Cc: Daniel Verkamp +Cc: Michael S. Tsirkin +Cc: Stefan Hajnoczi +Cc: Stefano Garzarella +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/virtio_blk.c | 31 +++++++++++++++++++++++-------- + 1 file changed, 23 insertions(+), 8 deletions(-) + +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 980df853ee497..99991b6a6f0ed 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -126,16 +126,31 @@ static int virtblk_setup_discard_write_zeroes(struct request *req, bool unmap) + if (!range) + return -ENOMEM; + +- __rq_for_each_bio(bio, req) { +- u64 sector = bio->bi_iter.bi_sector; +- u32 num_sectors = bio->bi_iter.bi_size >> SECTOR_SHIFT; +- +- range[n].flags = cpu_to_le32(flags); +- range[n].num_sectors = cpu_to_le32(num_sectors); +- range[n].sector = cpu_to_le64(sector); +- n++; ++ /* ++ * Single max discard segment means multi-range discard isn't ++ * supported, and block layer only runs contiguity merge like ++ * normal RW request. So we can't reply on bio for retrieving ++ * each range info. ++ */ ++ if (queue_max_discard_segments(req->q) == 1) { ++ range[0].flags = cpu_to_le32(flags); ++ range[0].num_sectors = cpu_to_le32(blk_rq_sectors(req)); ++ range[0].sector = cpu_to_le64(blk_rq_pos(req)); ++ n = 1; ++ } else { ++ __rq_for_each_bio(bio, req) { ++ u64 sector = bio->bi_iter.bi_sector; ++ u32 num_sectors = bio->bi_iter.bi_size >> SECTOR_SHIFT; ++ ++ range[n].flags = cpu_to_le32(flags); ++ range[n].num_sectors = cpu_to_le32(num_sectors); ++ range[n].sector = cpu_to_le64(sector); ++ n++; ++ } + } + ++ WARN_ON_ONCE(n != segments); ++ + req->special_vec.bv_page = virt_to_page(range); + req->special_vec.bv_offset = offset_in_page(range); + req->special_vec.bv_len = sizeof(*range) * segments; +-- +2.25.1 + diff --git a/queue-5.8/bpf-avoid-visit-same-object-multiple-times.patch b/queue-5.8/bpf-avoid-visit-same-object-multiple-times.patch new file mode 100644 index 00000000000..d1e45abcfaf --- /dev/null +++ b/queue-5.8/bpf-avoid-visit-same-object-multiple-times.patch @@ -0,0 +1,45 @@ +From 0b71087651754bc5f2d6f2f1edecc4d12f12132c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 15:23:10 -0700 +Subject: bpf: Avoid visit same object multiple times + +From: Yonghong Song + +[ Upstream commit e60572b8d4c39572be6857d1ec91fdf979f8775f ] + +Currently when traversing all tasks, the next tid +is always increased by one. This may result in +visiting the same task multiple times in a +pid namespace. + +This patch fixed the issue by seting the next +tid as pid_nr_ns(pid, ns) + 1, similar to +funciton next_tgid(). + +Signed-off-by: Yonghong Song +Signed-off-by: Alexei Starovoitov +Cc: Rik van Riel +Link: https://lore.kernel.org/bpf/20200818222310.2181500-1-yhs@fb.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/task_iter.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/bpf/task_iter.c b/kernel/bpf/task_iter.c +index a4a0fb4f94cc1..323def936be24 100644 +--- a/kernel/bpf/task_iter.c ++++ b/kernel/bpf/task_iter.c +@@ -28,8 +28,9 @@ static struct task_struct *task_seq_get_next(struct pid_namespace *ns, + + rcu_read_lock(); + retry: +- pid = idr_get_next(&ns->idr, tid); ++ pid = find_ge_pid(*tid, ns); + if (pid) { ++ *tid = pid_nr_ns(pid, ns); + task = get_pid_task(pid, PIDTYPE_PID); + if (!task) { + ++*tid; +-- +2.25.1 + diff --git a/queue-5.8/bpf-fix-a-rcu_sched-stall-issue-with-bpf-task-task_f.patch b/queue-5.8/bpf-fix-a-rcu_sched-stall-issue-with-bpf-task-task_f.patch new file mode 100644 index 00000000000..da6f2ed8ec7 --- /dev/null +++ b/queue-5.8/bpf-fix-a-rcu_sched-stall-issue-with-bpf-task-task_f.patch @@ -0,0 +1,143 @@ +From 3e75330684248e9490cd578040e1346bc7e21ea6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 15:23:09 -0700 +Subject: bpf: Fix a rcu_sched stall issue with bpf task/task_file iterator + +From: Yonghong Song + +[ Upstream commit e679654a704e5bd676ea6446fa7b764cbabf168a ] + +In our production system, we observed rcu stalls when +'bpftool prog` is running. + rcu: INFO: rcu_sched self-detected stall on CPU + rcu: \x097-....: (20999 ticks this GP) idle=302/1/0x4000000000000000 softirq=1508852/1508852 fqs=4913 + \x09(t=21031 jiffies g=2534773 q=179750) + NMI backtrace for cpu 7 + CPU: 7 PID: 184195 Comm: bpftool Kdump: loaded Tainted: G W 5.8.0-00004-g68bfc7f8c1b4 #6 + Hardware name: Quanta Twin Lakes MP/Twin Lakes Passive MP, BIOS F09_3A17 05/03/2019 + Call Trace: + + dump_stack+0x57/0x70 + nmi_cpu_backtrace.cold+0x14/0x53 + ? lapic_can_unplug_cpu.cold+0x39/0x39 + nmi_trigger_cpumask_backtrace+0xb7/0xc7 + rcu_dump_cpu_stacks+0xa2/0xd0 + rcu_sched_clock_irq.cold+0x1ff/0x3d9 + ? tick_nohz_handler+0x100/0x100 + update_process_times+0x5b/0x90 + tick_sched_timer+0x5e/0xf0 + __hrtimer_run_queues+0x12a/0x2a0 + hrtimer_interrupt+0x10e/0x280 + __sysvec_apic_timer_interrupt+0x51/0xe0 + asm_call_on_stack+0xf/0x20 + + sysvec_apic_timer_interrupt+0x6f/0x80 + asm_sysvec_apic_timer_interrupt+0x12/0x20 + RIP: 0010:task_file_seq_get_next+0x71/0x220 + Code: 00 00 8b 53 1c 49 8b 7d 00 89 d6 48 8b 47 20 44 8b 18 41 39 d3 76 75 48 8b 4f 20 8b 01 39 d0 76 61 41 89 d1 49 39 c1 48 19 c0 <48> 8b 49 08 21 d0 48 8d 04 c1 4c 8b 08 4d 85 c9 74 46 49 8b 41 38 + RSP: 0018:ffffc90006223e10 EFLAGS: 00000297 + RAX: ffffffffffffffff RBX: ffff888f0d172388 RCX: ffff888c8c07c1c0 + RDX: 00000000000f017b RSI: 00000000000f017b RDI: ffff888c254702c0 + RBP: ffffc90006223e68 R08: ffff888be2a1c140 R09: 00000000000f017b + R10: 0000000000000002 R11: 0000000000100000 R12: ffff888f23c24118 + R13: ffffc90006223e60 R14: ffffffff828509a0 R15: 00000000ffffffff + task_file_seq_next+0x52/0xa0 + bpf_seq_read+0xb9/0x320 + vfs_read+0x9d/0x180 + ksys_read+0x5f/0xe0 + do_syscall_64+0x38/0x60 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + RIP: 0033:0x7f8815f4f76e + Code: c0 e9 f6 fe ff ff 55 48 8d 3d 76 70 0a 00 48 89 e5 e8 36 06 02 00 66 0f 1f 44 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 52 c3 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 + RSP: 002b:00007fff8f9df578 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 + RAX: ffffffffffffffda RBX: 000000000170b9c0 RCX: 00007f8815f4f76e + RDX: 0000000000001000 RSI: 00007fff8f9df5b0 RDI: 0000000000000007 + RBP: 00007fff8f9e05f0 R08: 0000000000000049 R09: 0000000000000010 + R10: 00007f881601fa40 R11: 0000000000000246 R12: 00007fff8f9e05a8 + R13: 00007fff8f9e05a8 R14: 0000000001917f90 R15: 000000000000e22e + +Note that `bpftool prog` actually calls a task_file bpf iterator +program to establish an association between prog/map/link/btf anon +files and processes. + +In the case where the above rcu stall occured, we had a process +having 1587 tasks and each task having roughly 81305 files. +This implied 129 million bpf prog invocations. Unfortunwtely none of +these files are prog/map/link/btf files so bpf iterator/prog needs +to traverse all these files and not able to return to user space +since there are no seq_file buffer overflow. + +This patch fixed the issue in bpf_seq_read() to limit the number +of visited objects. If the maximum number of visited objects is +reached, no more objects will be visited in the current syscall. +If there is nothing written in the seq_file buffer, -EAGAIN will +return to the user so user can try again. + +The maximum number of visited objects is set at 1 million. +In our Intel Xeon D-2191 2.3GHZ 18-core server, bpf_seq_read() +visiting 1 million files takes around 0.18 seconds. + +We did not use cond_resched() since for some iterators, e.g., +netlink iterator, where rcu read_lock critical section spans between +consecutive seq_ops->next(), which makes impossible to do cond_resched() +in the key while loop of function bpf_seq_read(). + +Signed-off-by: Yonghong Song +Signed-off-by: Alexei Starovoitov +Cc: Paul E. McKenney +Link: https://lore.kernel.org/bpf/20200818222309.2181348-1-yhs@fb.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/bpf_iter.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/kernel/bpf/bpf_iter.c b/kernel/bpf/bpf_iter.c +index dd612b80b9fea..3c18090cd73dc 100644 +--- a/kernel/bpf/bpf_iter.c ++++ b/kernel/bpf/bpf_iter.c +@@ -64,6 +64,9 @@ static void bpf_iter_done_stop(struct seq_file *seq) + iter_priv->done_stop = true; + } + ++/* maximum visited objects before bailing out */ ++#define MAX_ITER_OBJECTS 1000000 ++ + /* bpf_seq_read, a customized and simpler version for bpf iterator. + * no_llseek is assumed for this file. + * The following are differences from seq_read(): +@@ -76,7 +79,7 @@ static ssize_t bpf_seq_read(struct file *file, char __user *buf, size_t size, + { + struct seq_file *seq = file->private_data; + size_t n, offs, copied = 0; +- int err = 0; ++ int err = 0, num_objs = 0; + void *p; + + mutex_lock(&seq->lock); +@@ -132,6 +135,7 @@ static ssize_t bpf_seq_read(struct file *file, char __user *buf, size_t size, + while (1) { + loff_t pos = seq->index; + ++ num_objs++; + offs = seq->count; + p = seq->op->next(seq, p, &seq->index); + if (pos == seq->index) { +@@ -150,6 +154,15 @@ static ssize_t bpf_seq_read(struct file *file, char __user *buf, size_t size, + if (seq->count >= size) + break; + ++ if (num_objs >= MAX_ITER_OBJECTS) { ++ if (offs == 0) { ++ err = -EAGAIN; ++ seq->op->stop(seq, p); ++ goto done; ++ } ++ break; ++ } ++ + err = seq->op->show(seq, p); + if (err > 0) { + bpf_iter_dec_seq_num(seq); +-- +2.25.1 + diff --git a/queue-5.8/bpf-selftests-global_funcs-check-err_str-before-strs.patch b/queue-5.8/bpf-selftests-global_funcs-check-err_str-before-strs.patch new file mode 100644 index 00000000000..001321cec9b --- /dev/null +++ b/queue-5.8/bpf-selftests-global_funcs-check-err_str-before-strs.patch @@ -0,0 +1,44 @@ +From a9dd3e08dd0228414e4bac95d10d2d1bc140e6d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 14:58:43 +0300 +Subject: bpf: selftests: global_funcs: Check err_str before strstr + +From: Yauheni Kaliuta + +[ Upstream commit c210773d6c6f595f5922d56b7391fe343bc7310e ] + +The error path in libbpf.c:load_program() has calls to pr_warn() +which ends up for global_funcs tests to +test_global_funcs.c:libbpf_debug_print(). + +For the tests with no struct test_def::err_str initialized with a +string, it causes call of strstr() with NULL as the second argument +and it segfaults. + +Fix it by calling strstr() only for non-NULL err_str. + +Signed-off-by: Yauheni Kaliuta +Signed-off-by: Alexei Starovoitov +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20200820115843.39454-1-yauheni.kaliuta@redhat.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/test_global_funcs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/test_global_funcs.c b/tools/testing/selftests/bpf/prog_tests/test_global_funcs.c +index 25b068591e9a4..193002b14d7f6 100644 +--- a/tools/testing/selftests/bpf/prog_tests/test_global_funcs.c ++++ b/tools/testing/selftests/bpf/prog_tests/test_global_funcs.c +@@ -19,7 +19,7 @@ static int libbpf_debug_print(enum libbpf_print_level level, + log_buf = va_arg(args, char *); + if (!log_buf) + goto out; +- if (strstr(log_buf, err_str) == 0) ++ if (err_str && strstr(log_buf, err_str) == 0) + found = true; + out: + printf(format, log_buf); +-- +2.25.1 + diff --git a/queue-5.8/can-j1939-transport-j1939_xtp_rx_dat_one-compare-own.patch b/queue-5.8/can-j1939-transport-j1939_xtp_rx_dat_one-compare-own.patch new file mode 100644 index 00000000000..ab935727935 --- /dev/null +++ b/queue-5.8/can-j1939-transport-j1939_xtp_rx_dat_one-compare-own.patch @@ -0,0 +1,57 @@ +From 93efed3f3bddc4323648509c89d2f45bb3c16f4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Aug 2020 12:52:00 +0200 +Subject: can: j1939: transport: j1939_xtp_rx_dat_one(): compare own packets to + detect corruptions + +From: Oleksij Rempel + +[ Upstream commit e052d0540298bfe0f6cbbecdc7e2ea9b859575b2 ] + +Since the stack relays on receiving own packets, it was overwriting own +transmit buffer from received packets. + +At least theoretically, the received echo buffer can be corrupt or +changed and the session partner can request to resend previous data. In +this case we will re-send bad data. + +With this patch we will stop to overwrite own TX buffer and use it for +sanity checking. + +Signed-off-by: Oleksij Rempel +Link: https://lore.kernel.org/r/20200807105200.26441-6-o.rempel@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/j1939/transport.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c +index dbd215cbc53d8..a8dd956b5e8e1 100644 +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -1803,7 +1803,20 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session, + } + + tpdat = se_skb->data; +- memcpy(&tpdat[offset], &dat[1], nbytes); ++ if (!session->transmission) { ++ memcpy(&tpdat[offset], &dat[1], nbytes); ++ } else { ++ int err; ++ ++ err = memcmp(&tpdat[offset], &dat[1], nbytes); ++ if (err) ++ netdev_err_once(priv->ndev, ++ "%s: 0x%p: Data of RX-looped back packet (%*ph) doesn't match TX data (%*ph)!\n", ++ __func__, session, ++ nbytes, &dat[1], ++ nbytes, &tpdat[offset]); ++ } ++ + if (packet == session->pkt.rx) + session->pkt.rx++; + +-- +2.25.1 + diff --git a/queue-5.8/dma-pool-fix-coherent-pool-allocations-for-iommu-map.patch b/queue-5.8/dma-pool-fix-coherent-pool-allocations-for-iommu-map.patch new file mode 100644 index 00000000000..abf11a04d1b --- /dev/null +++ b/queue-5.8/dma-pool-fix-coherent-pool-allocations-for-iommu-map.patch @@ -0,0 +1,257 @@ +From 92d1ebfa3f104c1067d387ec05f5d9782f6cba05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Aug 2020 12:26:24 +0200 +Subject: dma-pool: fix coherent pool allocations for IOMMU mappings + +From: Christoph Hellwig + +[ Upstream commit 9420139f516d7fbc248ce17f35275cb005ed98ea ] + +When allocating coherent pool memory for an IOMMU mapping we don't care +about the DMA mask. Move the guess for the initial GFP mask into the +dma_direct_alloc_pages and pass dma_coherent_ok as a function pointer +argument so that it doesn't get applied to the IOMMU case. + +Signed-off-by: Christoph Hellwig +Tested-by: Amit Pundir +Signed-off-by: Sasha Levin +--- + drivers/iommu/dma-iommu.c | 4 +- + include/linux/dma-direct.h | 3 - + include/linux/dma-mapping.h | 5 +- + kernel/dma/direct.c | 13 ++-- + kernel/dma/pool.c | 114 +++++++++++++++--------------------- + 5 files changed, 62 insertions(+), 77 deletions(-) + +diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c +index 4959f5df21bd0..5141d49a046ba 100644 +--- a/drivers/iommu/dma-iommu.c ++++ b/drivers/iommu/dma-iommu.c +@@ -1035,8 +1035,8 @@ static void *iommu_dma_alloc(struct device *dev, size_t size, + + if (IS_ENABLED(CONFIG_DMA_DIRECT_REMAP) && + !gfpflags_allow_blocking(gfp) && !coherent) +- cpu_addr = dma_alloc_from_pool(dev, PAGE_ALIGN(size), &page, +- gfp); ++ page = dma_alloc_from_pool(dev, PAGE_ALIGN(size), &cpu_addr, ++ gfp, NULL); + else + cpu_addr = iommu_dma_alloc_pages(dev, size, &page, gfp, attrs); + if (!cpu_addr) +diff --git a/include/linux/dma-direct.h b/include/linux/dma-direct.h +index ab2e20cba9514..ba22952c24e24 100644 +--- a/include/linux/dma-direct.h ++++ b/include/linux/dma-direct.h +@@ -67,9 +67,6 @@ static inline bool dma_capable(struct device *dev, dma_addr_t addr, size_t size, + } + + u64 dma_direct_get_required_mask(struct device *dev); +-gfp_t dma_direct_optimal_gfp_mask(struct device *dev, u64 dma_mask, +- u64 *phys_mask); +-bool dma_coherent_ok(struct device *dev, phys_addr_t phys, size_t size); + void *dma_direct_alloc(struct device *dev, size_t size, dma_addr_t *dma_handle, + gfp_t gfp, unsigned long attrs); + void dma_direct_free(struct device *dev, size_t size, void *cpu_addr, +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index a33ed3954ed46..0dc08701d7b7e 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -715,8 +715,9 @@ void *dma_common_pages_remap(struct page **pages, size_t size, + pgprot_t prot, const void *caller); + void dma_common_free_remap(void *cpu_addr, size_t size); + +-void *dma_alloc_from_pool(struct device *dev, size_t size, +- struct page **ret_page, gfp_t flags); ++struct page *dma_alloc_from_pool(struct device *dev, size_t size, ++ void **cpu_addr, gfp_t flags, ++ bool (*phys_addr_ok)(struct device *, phys_addr_t, size_t)); + bool dma_free_from_pool(struct device *dev, void *start, size_t size); + + int +diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c +index 67f060b86a73f..f17aec9d01f0c 100644 +--- a/kernel/dma/direct.c ++++ b/kernel/dma/direct.c +@@ -45,7 +45,7 @@ u64 dma_direct_get_required_mask(struct device *dev) + return (1ULL << (fls64(max_dma) - 1)) * 2 - 1; + } + +-gfp_t dma_direct_optimal_gfp_mask(struct device *dev, u64 dma_mask, ++static gfp_t dma_direct_optimal_gfp_mask(struct device *dev, u64 dma_mask, + u64 *phys_limit) + { + u64 dma_limit = min_not_zero(dma_mask, dev->bus_dma_limit); +@@ -70,7 +70,7 @@ gfp_t dma_direct_optimal_gfp_mask(struct device *dev, u64 dma_mask, + return 0; + } + +-bool dma_coherent_ok(struct device *dev, phys_addr_t phys, size_t size) ++static bool dma_coherent_ok(struct device *dev, phys_addr_t phys, size_t size) + { + return phys_to_dma_direct(dev, phys) + size - 1 <= + min_not_zero(dev->coherent_dma_mask, dev->bus_dma_limit); +@@ -163,8 +163,13 @@ void *dma_direct_alloc_pages(struct device *dev, size_t size, + size = PAGE_ALIGN(size); + + if (dma_should_alloc_from_pool(dev, gfp, attrs)) { +- ret = dma_alloc_from_pool(dev, size, &page, gfp); +- if (!ret) ++ u64 phys_mask; ++ ++ gfp |= dma_direct_optimal_gfp_mask(dev, dev->coherent_dma_mask, ++ &phys_mask); ++ page = dma_alloc_from_pool(dev, size, &ret, gfp, ++ dma_coherent_ok); ++ if (!page) + return NULL; + goto done; + } +diff --git a/kernel/dma/pool.c b/kernel/dma/pool.c +index 6bc74a2d51273..5d071d4a3cbaa 100644 +--- a/kernel/dma/pool.c ++++ b/kernel/dma/pool.c +@@ -196,93 +196,75 @@ static int __init dma_atomic_pool_init(void) + } + postcore_initcall(dma_atomic_pool_init); + +-static inline struct gen_pool *dma_guess_pool_from_device(struct device *dev) ++static inline struct gen_pool *dma_guess_pool(struct gen_pool *prev, gfp_t gfp) + { +- u64 phys_mask; +- gfp_t gfp; +- +- gfp = dma_direct_optimal_gfp_mask(dev, dev->coherent_dma_mask, +- &phys_mask); +- if (IS_ENABLED(CONFIG_ZONE_DMA) && gfp == GFP_DMA) ++ if (prev == NULL) { ++ if (IS_ENABLED(CONFIG_ZONE_DMA32) && (gfp & GFP_DMA32)) ++ return atomic_pool_dma32; ++ if (IS_ENABLED(CONFIG_ZONE_DMA) && (gfp & GFP_DMA)) ++ return atomic_pool_dma; ++ return atomic_pool_kernel; ++ } ++ if (prev == atomic_pool_kernel) ++ return atomic_pool_dma32 ? atomic_pool_dma32 : atomic_pool_dma; ++ if (prev == atomic_pool_dma32) + return atomic_pool_dma; +- if (IS_ENABLED(CONFIG_ZONE_DMA32) && gfp == GFP_DMA32) +- return atomic_pool_dma32; +- return atomic_pool_kernel; ++ return NULL; + } + +-static inline struct gen_pool *dma_get_safer_pool(struct gen_pool *bad_pool) ++static struct page *__dma_alloc_from_pool(struct device *dev, size_t size, ++ struct gen_pool *pool, void **cpu_addr, ++ bool (*phys_addr_ok)(struct device *, phys_addr_t, size_t)) + { +- if (bad_pool == atomic_pool_kernel) +- return atomic_pool_dma32 ? : atomic_pool_dma; ++ unsigned long addr; ++ phys_addr_t phys; + +- if (bad_pool == atomic_pool_dma32) +- return atomic_pool_dma; ++ addr = gen_pool_alloc(pool, size); ++ if (!addr) ++ return NULL; + +- return NULL; +-} ++ phys = gen_pool_virt_to_phys(pool, addr); ++ if (phys_addr_ok && !phys_addr_ok(dev, phys, size)) { ++ gen_pool_free(pool, addr, size); ++ return NULL; ++ } + +-static inline struct gen_pool *dma_guess_pool(struct device *dev, +- struct gen_pool *bad_pool) +-{ +- if (bad_pool) +- return dma_get_safer_pool(bad_pool); ++ if (gen_pool_avail(pool) < atomic_pool_size) ++ schedule_work(&atomic_pool_work); + +- return dma_guess_pool_from_device(dev); ++ *cpu_addr = (void *)addr; ++ memset(*cpu_addr, 0, size); ++ return pfn_to_page(__phys_to_pfn(phys)); + } + +-void *dma_alloc_from_pool(struct device *dev, size_t size, +- struct page **ret_page, gfp_t flags) ++struct page *dma_alloc_from_pool(struct device *dev, size_t size, ++ void **cpu_addr, gfp_t gfp, ++ bool (*phys_addr_ok)(struct device *, phys_addr_t, size_t)) + { + struct gen_pool *pool = NULL; +- unsigned long val = 0; +- void *ptr = NULL; +- phys_addr_t phys; +- +- while (1) { +- pool = dma_guess_pool(dev, pool); +- if (!pool) { +- WARN(1, "Failed to get suitable pool for %s\n", +- dev_name(dev)); +- break; +- } +- +- val = gen_pool_alloc(pool, size); +- if (!val) +- continue; +- +- phys = gen_pool_virt_to_phys(pool, val); +- if (dma_coherent_ok(dev, phys, size)) +- break; +- +- gen_pool_free(pool, val, size); +- val = 0; +- } +- +- +- if (val) { +- *ret_page = pfn_to_page(__phys_to_pfn(phys)); +- ptr = (void *)val; +- memset(ptr, 0, size); ++ struct page *page; + +- if (gen_pool_avail(pool) < atomic_pool_size) +- schedule_work(&atomic_pool_work); ++ while ((pool = dma_guess_pool(pool, gfp))) { ++ page = __dma_alloc_from_pool(dev, size, pool, cpu_addr, ++ phys_addr_ok); ++ if (page) ++ return page; + } + +- return ptr; ++ WARN(1, "Failed to get suitable pool for %s\n", dev_name(dev)); ++ return NULL; + } + + bool dma_free_from_pool(struct device *dev, void *start, size_t size) + { + struct gen_pool *pool = NULL; + +- while (1) { +- pool = dma_guess_pool(dev, pool); +- if (!pool) +- return false; +- +- if (gen_pool_has_addr(pool, (unsigned long)start, size)) { +- gen_pool_free(pool, (unsigned long)start, size); +- return true; +- } ++ while ((pool = dma_guess_pool(pool, 0))) { ++ if (!gen_pool_has_addr(pool, (unsigned long)start, size)) ++ continue; ++ gen_pool_free(pool, (unsigned long)start, size); ++ return true; + } ++ ++ return false; + } +-- +2.25.1 + diff --git a/queue-5.8/dma-pool-only-allocate-from-cma-when-in-same-memory-.patch b/queue-5.8/dma-pool-only-allocate-from-cma-when-in-same-memory-.patch new file mode 100644 index 00000000000..5349321ac07 --- /dev/null +++ b/queue-5.8/dma-pool-only-allocate-from-cma-when-in-same-memory-.patch @@ -0,0 +1,81 @@ +From 42c2a6965cb415c3a593d02152827e42bbc6474a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Aug 2020 12:26:23 +0200 +Subject: dma-pool: Only allocate from CMA when in same memory zone + +From: Nicolas Saenz Julienne + +[ Upstream commit d7e673ec2c8e0ea39c4c70fc490d67d7fbda869d ] + +There is no guarantee to CMA's placement, so allocating a zone specific +atomic pool from CMA might return memory from a completely different +memory zone. To get around this double check CMA's placement before +allocating from it. + +Signed-off-by: Nicolas Saenz Julienne +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/pool.c | 31 ++++++++++++++++++++++++++++++- + 1 file changed, 30 insertions(+), 1 deletion(-) + +diff --git a/kernel/dma/pool.c b/kernel/dma/pool.c +index 5d071d4a3cbaa..06582b488e317 100644 +--- a/kernel/dma/pool.c ++++ b/kernel/dma/pool.c +@@ -3,7 +3,9 @@ + * Copyright (C) 2012 ARM Ltd. + * Copyright (C) 2020 Google LLC + */ ++#include + #include ++#include + #include + #include + #include +@@ -55,6 +57,29 @@ static void dma_atomic_pool_size_add(gfp_t gfp, size_t size) + pool_size_kernel += size; + } + ++static bool cma_in_zone(gfp_t gfp) ++{ ++ unsigned long size; ++ phys_addr_t end; ++ struct cma *cma; ++ ++ cma = dev_get_cma_area(NULL); ++ if (!cma) ++ return false; ++ ++ size = cma_get_size(cma); ++ if (!size) ++ return false; ++ ++ /* CMA can't cross zone boundaries, see cma_activate_area() */ ++ end = cma_get_base(cma) + size - 1; ++ if (IS_ENABLED(CONFIG_ZONE_DMA) && (gfp & GFP_DMA)) ++ return end <= DMA_BIT_MASK(zone_dma_bits); ++ if (IS_ENABLED(CONFIG_ZONE_DMA32) && (gfp & GFP_DMA32)) ++ return end <= DMA_BIT_MASK(32); ++ return true; ++} ++ + static int atomic_pool_expand(struct gen_pool *pool, size_t pool_size, + gfp_t gfp) + { +@@ -68,7 +93,11 @@ static int atomic_pool_expand(struct gen_pool *pool, size_t pool_size, + + do { + pool_size = 1 << (PAGE_SHIFT + order); +- page = alloc_pages(gfp, order); ++ if (cma_in_zone(gfp)) ++ page = dma_alloc_from_contiguous(NULL, 1 << order, ++ order, false); ++ if (!page) ++ page = alloc_pages(gfp, order); + } while (!page && order-- > 0); + if (!page) + goto out; +-- +2.25.1 + diff --git a/queue-5.8/drivers-net-wan-hdlc_x25-added-needed_headroom-and-a.patch b/queue-5.8/drivers-net-wan-hdlc_x25-added-needed_headroom-and-a.patch new file mode 100644 index 00000000000..1fba26e326c --- /dev/null +++ b/queue-5.8/drivers-net-wan-hdlc_x25-added-needed_headroom-and-a.patch @@ -0,0 +1,108 @@ +From 57abd1743ba1c69742d4ad9d991dcc2cf68dcf2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Aug 2020 11:17:04 -0700 +Subject: drivers/net/wan/hdlc_x25: Added needed_headroom and a skb->len check + +From: Xie He + +[ Upstream commit 77b981c82c1df7c7ad32a046f17f007450b46954 ] + +1. Added a skb->len check + +This driver expects upper layers to include a pseudo header of 1 byte +when passing down a skb for transmission. This driver will read this +1-byte header. This patch added a skb->len check before reading the +header to make sure the header exists. + +2. Added needed_headroom and set hard_header_len to 0 + +When this driver transmits data, + first this driver will remove a pseudo header of 1 byte, + then the lapb module will prepend the LAPB header of 2 or 3 bytes. +So the value of needed_headroom in this driver should be 3 - 1. + +Because this driver has no header_ops, according to the logic of +af_packet.c, the value of hard_header_len should be 0. + +Reason of setting needed_headroom and hard_header_len at this place: + +This driver is written using the API of the hdlc module, the hdlc +module enables this driver (the protocol driver) to run on any hardware +that has a driver (the hardware driver) written using the API of the +hdlc module. + +Two other hdlc protocol drivers - hdlc_ppp and hdlc_raw_eth, also set +things like hard_header_len at this place. In hdlc_ppp, it sets +hard_header_len after attach_hdlc_protocol and before setting dev->type. +In hdlc_raw_eth, it sets hard_header_len by calling ether_setup after +attach_hdlc_protocol and after memcpy the settings. + +3. Reset needed_headroom when detaching protocols (in hdlc.c) + +When detaching a protocol from a hardware device, the hdlc module will +reset various parameters of the device (including hard_header_len) to +the default values. We add needed_headroom here so that needed_headroom +will also be reset. + +Cc: Willem de Bruijn +Cc: Martin Schiller +Cc: Andrew Hendry +Signed-off-by: Xie He +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wan/hdlc.c | 1 + + drivers/net/wan/hdlc_x25.c | 17 ++++++++++++++++- + 2 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wan/hdlc.c b/drivers/net/wan/hdlc.c +index dfc16770458d8..386ed2aa31fd9 100644 +--- a/drivers/net/wan/hdlc.c ++++ b/drivers/net/wan/hdlc.c +@@ -230,6 +230,7 @@ static void hdlc_setup_dev(struct net_device *dev) + dev->max_mtu = HDLC_MAX_MTU; + dev->type = ARPHRD_RAWHDLC; + dev->hard_header_len = 16; ++ dev->needed_headroom = 0; + dev->addr_len = 0; + dev->header_ops = &hdlc_null_ops; + } +diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c +index f70336bb6f524..f52b9fed05931 100644 +--- a/drivers/net/wan/hdlc_x25.c ++++ b/drivers/net/wan/hdlc_x25.c +@@ -107,8 +107,14 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev) + { + int result; + ++ /* There should be a pseudo header of 1 byte added by upper layers. ++ * Check to make sure it is there before reading it. ++ */ ++ if (skb->len < 1) { ++ kfree_skb(skb); ++ return NETDEV_TX_OK; ++ } + +- /* X.25 to LAPB */ + switch (skb->data[0]) { + case X25_IFACE_DATA: /* Data to be transmitted */ + skb_pull(skb, 1); +@@ -294,6 +300,15 @@ static int x25_ioctl(struct net_device *dev, struct ifreq *ifr) + return result; + + memcpy(&state(hdlc)->settings, &new_settings, size); ++ ++ /* There's no header_ops so hard_header_len should be 0. */ ++ dev->hard_header_len = 0; ++ /* When transmitting data: ++ * first we'll remove a pseudo header of 1 byte, ++ * then we'll prepend an LAPB header of at most 3 bytes. ++ */ ++ dev->needed_headroom = 3 - 1; ++ + dev->type = ARPHRD_X25; + call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev); + netif_dormant_off(dev); +-- +2.25.1 + diff --git a/queue-5.8/drm-amd-display-fix-lfc-multiplier-changing-erratica.patch b/queue-5.8/drm-amd-display-fix-lfc-multiplier-changing-erratica.patch new file mode 100644 index 00000000000..bd16fa46f05 --- /dev/null +++ b/queue-5.8/drm-amd-display-fix-lfc-multiplier-changing-erratica.patch @@ -0,0 +1,90 @@ +From 8b1c49415d13de3a5e99bce548c9ab388b7802e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jul 2020 17:33:27 -0400 +Subject: drm/amd/display: Fix LFC multiplier changing erratically + +From: Anthony Koo + +[ Upstream commit e4ed4dbbc8383d42a197da8fe7ca6434b0f14def ] + +[Why] +1. There is a calculation that is using frame_time_in_us instead of +last_render_time_in_us to calculate whether choosing an LFC multiplier +would cause the inserted frame duration to be outside of range. + +2. We do not handle unsigned integer subtraction correctly and it underflows +to a really large value, which causes some logic errors. + +[How] +1. Fix logic to calculate 'within range' using last_render_time_in_us +2. Split out delta_from_mid_point_delta_in_us calculation to ensure +we don't underflow and wrap around + +Signed-off-by: Anthony Koo +Reviewed-by: Aric Cyr +Acked-by: Qingqing Zhuo +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/modules/freesync/freesync.c | 36 +++++++++++++++---- + 1 file changed, 29 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c +index eb7421e83b865..23a7fa8447e24 100644 +--- a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c ++++ b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c +@@ -324,22 +324,44 @@ static void apply_below_the_range(struct core_freesync *core_freesync, + + /* Choose number of frames to insert based on how close it + * can get to the mid point of the variable range. ++ * - Delta for CEIL: delta_from_mid_point_in_us_1 ++ * - Delta for FLOOR: delta_from_mid_point_in_us_2 + */ +- if ((frame_time_in_us / mid_point_frames_ceil) > in_out_vrr->min_duration_in_us && +- (delta_from_mid_point_in_us_1 < delta_from_mid_point_in_us_2 || +- mid_point_frames_floor < 2)) { ++ if ((last_render_time_in_us / mid_point_frames_ceil) < in_out_vrr->min_duration_in_us) { ++ /* Check for out of range. ++ * If using CEIL produces a value that is out of range, ++ * then we are forced to use FLOOR. ++ */ ++ frames_to_insert = mid_point_frames_floor; ++ } else if (mid_point_frames_floor < 2) { ++ /* Check if FLOOR would result in non-LFC. In this case ++ * choose to use CEIL ++ */ ++ frames_to_insert = mid_point_frames_ceil; ++ } else if (delta_from_mid_point_in_us_1 < delta_from_mid_point_in_us_2) { ++ /* If choosing CEIL results in a frame duration that is ++ * closer to the mid point of the range. ++ * Choose CEIL ++ */ + frames_to_insert = mid_point_frames_ceil; +- delta_from_mid_point_delta_in_us = delta_from_mid_point_in_us_2 - +- delta_from_mid_point_in_us_1; + } else { ++ /* If choosing FLOOR results in a frame duration that is ++ * closer to the mid point of the range. ++ * Choose FLOOR ++ */ + frames_to_insert = mid_point_frames_floor; +- delta_from_mid_point_delta_in_us = delta_from_mid_point_in_us_1 - +- delta_from_mid_point_in_us_2; + } + + /* Prefer current frame multiplier when BTR is enabled unless it drifts + * too far from the midpoint + */ ++ if (delta_from_mid_point_in_us_1 < delta_from_mid_point_in_us_2) { ++ delta_from_mid_point_delta_in_us = delta_from_mid_point_in_us_2 - ++ delta_from_mid_point_in_us_1; ++ } else { ++ delta_from_mid_point_delta_in_us = delta_from_mid_point_in_us_1 - ++ delta_from_mid_point_in_us_2; ++ } + if (in_out_vrr->btr.frames_to_insert != 0 && + delta_from_mid_point_delta_in_us < BTR_DRIFT_MARGIN) { + if (((last_render_time_in_us / in_out_vrr->btr.frames_to_insert) < +-- +2.25.1 + diff --git a/queue-5.8/drm-amd-display-switch-to-immediate-mode-for-updatin.patch b/queue-5.8/drm-amd-display-switch-to-immediate-mode-for-updatin.patch new file mode 100644 index 00000000000..4a4ee308c23 --- /dev/null +++ b/queue-5.8/drm-amd-display-switch-to-immediate-mode-for-updatin.patch @@ -0,0 +1,114 @@ +From 0b84a2970e3ba6a83cbbc41c87d3e6b4671224df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jul 2020 17:43:10 -0400 +Subject: drm/amd/display: Switch to immediate mode for updating infopackets + +From: Anthony Koo + +[ Upstream commit abba907c7a20032c2d504fd5afe3af7d440a09d0 ] + +[Why] +Using FRAME_UPDATE will result in infopacket to be potentially updated +one frame late. +In commit stream scenarios for previously active stream, some stale +infopacket data from previous config might be erroneously sent out on +initial frame after stream is re-enabled. + +[How] +Switch to using IMMEDIATE_UPDATE mode + +Signed-off-by: Anthony Koo +Reviewed-by: Ashley Thomas +Acked-by: Qingqing Zhuo +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/dcn10/dcn10_stream_encoder.c | 16 ++++++++-------- + .../amd/display/dc/dcn10/dcn10_stream_encoder.h | 14 ++++++++++++++ + 2 files changed, 22 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c +index 07b2f9399671d..842abb4c475bc 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c +@@ -121,35 +121,35 @@ void enc1_update_generic_info_packet( + switch (packet_index) { + case 0: + REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, +- AFMT_GENERIC0_FRAME_UPDATE, 1); ++ AFMT_GENERIC0_IMMEDIATE_UPDATE, 1); + break; + case 1: + REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, +- AFMT_GENERIC1_FRAME_UPDATE, 1); ++ AFMT_GENERIC1_IMMEDIATE_UPDATE, 1); + break; + case 2: + REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, +- AFMT_GENERIC2_FRAME_UPDATE, 1); ++ AFMT_GENERIC2_IMMEDIATE_UPDATE, 1); + break; + case 3: + REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, +- AFMT_GENERIC3_FRAME_UPDATE, 1); ++ AFMT_GENERIC3_IMMEDIATE_UPDATE, 1); + break; + case 4: + REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, +- AFMT_GENERIC4_FRAME_UPDATE, 1); ++ AFMT_GENERIC4_IMMEDIATE_UPDATE, 1); + break; + case 5: + REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, +- AFMT_GENERIC5_FRAME_UPDATE, 1); ++ AFMT_GENERIC5_IMMEDIATE_UPDATE, 1); + break; + case 6: + REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, +- AFMT_GENERIC6_FRAME_UPDATE, 1); ++ AFMT_GENERIC6_IMMEDIATE_UPDATE, 1); + break; + case 7: + REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, +- AFMT_GENERIC7_FRAME_UPDATE, 1); ++ AFMT_GENERIC7_IMMEDIATE_UPDATE, 1); + break; + default: + break; +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h +index f9b9e221c698b..7507000a99ac4 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h +@@ -273,7 +273,14 @@ struct dcn10_stream_enc_registers { + SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC2_FRAME_UPDATE, mask_sh),\ + SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC3_FRAME_UPDATE, mask_sh),\ + SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC4_FRAME_UPDATE, mask_sh),\ ++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC0_IMMEDIATE_UPDATE, mask_sh),\ ++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC1_IMMEDIATE_UPDATE, mask_sh),\ ++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC2_IMMEDIATE_UPDATE, mask_sh),\ ++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC3_IMMEDIATE_UPDATE, mask_sh),\ + SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC4_IMMEDIATE_UPDATE, mask_sh),\ ++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC5_IMMEDIATE_UPDATE, mask_sh),\ ++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC6_IMMEDIATE_UPDATE, mask_sh),\ ++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC7_IMMEDIATE_UPDATE, mask_sh),\ + SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC5_FRAME_UPDATE, mask_sh),\ + SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC6_FRAME_UPDATE, mask_sh),\ + SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC7_FRAME_UPDATE, mask_sh),\ +@@ -337,7 +344,14 @@ struct dcn10_stream_enc_registers { + type AFMT_GENERIC2_FRAME_UPDATE;\ + type AFMT_GENERIC3_FRAME_UPDATE;\ + type AFMT_GENERIC4_FRAME_UPDATE;\ ++ type AFMT_GENERIC0_IMMEDIATE_UPDATE;\ ++ type AFMT_GENERIC1_IMMEDIATE_UPDATE;\ ++ type AFMT_GENERIC2_IMMEDIATE_UPDATE;\ ++ type AFMT_GENERIC3_IMMEDIATE_UPDATE;\ + type AFMT_GENERIC4_IMMEDIATE_UPDATE;\ ++ type AFMT_GENERIC5_IMMEDIATE_UPDATE;\ ++ type AFMT_GENERIC6_IMMEDIATE_UPDATE;\ ++ type AFMT_GENERIC7_IMMEDIATE_UPDATE;\ + type AFMT_GENERIC5_FRAME_UPDATE;\ + type AFMT_GENERIC6_FRAME_UPDATE;\ + type AFMT_GENERIC7_FRAME_UPDATE;\ +-- +2.25.1 + diff --git a/queue-5.8/drm-amd-powerplay-correct-uvd-vce-pg-state-on-custom.patch b/queue-5.8/drm-amd-powerplay-correct-uvd-vce-pg-state-on-custom.patch new file mode 100644 index 00000000000..a292d5644e4 --- /dev/null +++ b/queue-5.8/drm-amd-powerplay-correct-uvd-vce-pg-state-on-custom.patch @@ -0,0 +1,41 @@ +From 310fd85dfb8e981b10f38ff865240f14fa0927e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Aug 2020 17:01:47 +0800 +Subject: drm/amd/powerplay: correct UVD/VCE PG state on custom pptable + uploading + +From: Evan Quan + +[ Upstream commit 2c5b8080d810d98e3e59617680218499b17c84a1 ] + +The UVD/VCE PG state is managed by UVD and VCE IP. It's error-prone to +assume the bootup state in SMU based on the dpm status. + +Signed-off-by: Evan Quan +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c +index b7f3f8b62c2ac..9bd2874a122b4 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c +@@ -1640,12 +1640,6 @@ static void vega20_init_powergate_state(struct pp_hwmgr *hwmgr) + + data->uvd_power_gated = true; + data->vce_power_gated = true; +- +- if (data->smu_features[GNLD_DPM_UVD].enabled) +- data->uvd_power_gated = false; +- +- if (data->smu_features[GNLD_DPM_VCE].enabled) +- data->vce_power_gated = false; + } + + static int vega20_enable_dpm_tasks(struct pp_hwmgr *hwmgr) +-- +2.25.1 + diff --git a/queue-5.8/drm-amd-powerplay-correct-vega20-cached-smu-feature-.patch b/queue-5.8/drm-amd-powerplay-correct-vega20-cached-smu-feature-.patch new file mode 100644 index 00000000000..05e1556c31c --- /dev/null +++ b/queue-5.8/drm-amd-powerplay-correct-vega20-cached-smu-feature-.patch @@ -0,0 +1,93 @@ +From 869a64fb5e173d8143115f6c38234bf55b71ac8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Aug 2020 15:03:40 +0800 +Subject: drm/amd/powerplay: correct Vega20 cached smu feature state + +From: Evan Quan + +[ Upstream commit 266d81d9eed30f4994d76a2b237c63ece062eefe ] + +Correct the cached smu feature state on pp_features sysfs +setting. + +Signed-off-by: Evan Quan +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/powerplay/hwmgr/vega20_hwmgr.c | 38 +++++++++---------- + 1 file changed, 19 insertions(+), 19 deletions(-) + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c +index 9ff470f1b826c..b7f3f8b62c2ac 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c +@@ -979,10 +979,7 @@ static int vega20_disable_all_smu_features(struct pp_hwmgr *hwmgr) + { + struct vega20_hwmgr *data = + (struct vega20_hwmgr *)(hwmgr->backend); +- uint64_t features_enabled; +- int i; +- bool enabled; +- int ret = 0; ++ int i, ret = 0; + + PP_ASSERT_WITH_CODE((ret = smum_send_msg_to_smc(hwmgr, + PPSMC_MSG_DisableAllSmuFeatures, +@@ -990,17 +987,8 @@ static int vega20_disable_all_smu_features(struct pp_hwmgr *hwmgr) + "[DisableAllSMUFeatures] Failed to disable all smu features!", + return ret); + +- ret = vega20_get_enabled_smc_features(hwmgr, &features_enabled); +- PP_ASSERT_WITH_CODE(!ret, +- "[DisableAllSMUFeatures] Failed to get enabled smc features!", +- return ret); +- +- for (i = 0; i < GNLD_FEATURES_MAX; i++) { +- enabled = (features_enabled & data->smu_features[i].smu_feature_bitmap) ? +- true : false; +- data->smu_features[i].enabled = enabled; +- data->smu_features[i].supported = enabled; +- } ++ for (i = 0; i < GNLD_FEATURES_MAX; i++) ++ data->smu_features[i].enabled = 0; + + return 0; + } +@@ -3230,10 +3218,11 @@ static int vega20_get_ppfeature_status(struct pp_hwmgr *hwmgr, char *buf) + + static int vega20_set_ppfeature_status(struct pp_hwmgr *hwmgr, uint64_t new_ppfeature_masks) + { +- uint64_t features_enabled; +- uint64_t features_to_enable; +- uint64_t features_to_disable; +- int ret = 0; ++ struct vega20_hwmgr *data = ++ (struct vega20_hwmgr *)(hwmgr->backend); ++ uint64_t features_enabled, features_to_enable, features_to_disable; ++ int i, ret = 0; ++ bool enabled; + + if (new_ppfeature_masks >= (1ULL << GNLD_FEATURES_MAX)) + return -EINVAL; +@@ -3262,6 +3251,17 @@ static int vega20_set_ppfeature_status(struct pp_hwmgr *hwmgr, uint64_t new_ppfe + return ret; + } + ++ /* Update the cached feature enablement state */ ++ ret = vega20_get_enabled_smc_features(hwmgr, &features_enabled); ++ if (ret) ++ return ret; ++ ++ for (i = 0; i < GNLD_FEATURES_MAX; i++) { ++ enabled = (features_enabled & data->smu_features[i].smu_feature_bitmap) ? ++ true : false; ++ data->smu_features[i].enabled = enabled; ++ } ++ + return 0; + } + +-- +2.25.1 + diff --git a/queue-5.8/drm-amdgpu-fix-null-pointer-access-issue-when-unload.patch b/queue-5.8/drm-amdgpu-fix-null-pointer-access-issue-when-unload.patch new file mode 100644 index 00000000000..30f9412cf3d --- /dev/null +++ b/queue-5.8/drm-amdgpu-fix-null-pointer-access-issue-when-unload.patch @@ -0,0 +1,84 @@ +From 2ba111192632987ebcaa308797230abe2644a816 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Aug 2020 14:35:35 +0800 +Subject: drm/amdgpu: fix NULL pointer access issue when unloading driver + +From: Guchun Chen + +[ Upstream commit 1a68d96f81b8e7eb2a121fbf9abf9e5974e58832 ] + +When unloading driver by "modprobe -r amdgpu", one NULL pointer +dereference bug occurs in ras debugfs releasing. The cause is the +duplicated debugfs_remove, as drm debugfs_root dir has been cleaned +up already by drm_minor_unregister. + +BUG: kernel NULL pointer dereference, address: 00000000000000a0 +PGD 0 P4D 0 +Oops: 0002 [#1] SMP PTI +CPU: 11 PID: 1526 Comm: modprobe Tainted: G OE 5.6.0-guchchen #1 +Hardware name: System manufacturer System Product Name/TUF Z370-PLUS GAMING II, BIOS 0411 09/21/2018 +RIP: 0010:down_write+0x15/0x40 +Code: eb de e8 7e 17 72 ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc 0f 1f 44 00 00 53 48 89 fb e8 92 +d8 ff ff 31 c0 ba 01 00 00 00 48 0f b1 13 75 0f 65 48 8b 04 25 c0 8b 01 00 48 89 43 08 5b c3 +RSP: 0018:ffffb1590386fcd0 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: 00000000000000a0 RCX: 0000000000000000 +RDX: 0000000000000001 RSI: ffffffff85b2fcc2 RDI: 00000000000000a0 +RBP: ffffb1590386fd30 R08: ffffffff85b2fcc2 R09: 000000000002b3c0 +R10: ffff97a330618c40 R11: 00000000000005f6 R12: ffff97a3481beb40 +R13: 00000000000000a0 R14: ffff97a3481beb40 R15: 0000000000000000 +FS: 00007fb11a717540(0000) GS:ffff97a376cc0000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00000000000000a0 CR3: 00000004066d6006 CR4: 00000000003606e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + simple_recursive_removal+0x63/0x370 + ? debugfs_remove+0x60/0x60 + debugfs_remove+0x40/0x60 + amdgpu_ras_fini+0x82/0x230 [amdgpu] + ? __kernfs_remove.part.17+0x101/0x1f0 + ? kernfs_name_hash+0x12/0x80 + amdgpu_device_fini+0x1c0/0x580 [amdgpu] + amdgpu_driver_unload_kms+0x3e/0x70 [amdgpu] + amdgpu_pci_remove+0x36/0x60 [amdgpu] + pci_device_remove+0x3b/0xb0 + device_release_driver_internal+0xe5/0x1c0 + driver_detach+0x46/0x90 + bus_remove_driver+0x58/0xd0 + pci_unregister_driver+0x29/0x90 + amdgpu_exit+0x11/0x25 [amdgpu] + __x64_sys_delete_module+0x13d/0x210 + do_syscall_64+0x5f/0x250 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Signed-off-by: Guchun Chen +Reviewed-by: Tao Zhou +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +index 20a7d75b2eb88..3f47f35eedff1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +@@ -1240,7 +1240,6 @@ void amdgpu_ras_debugfs_remove(struct amdgpu_device *adev, + if (!obj || !obj->ent) + return; + +- debugfs_remove(obj->ent); + obj->ent = NULL; + put_obj(obj); + } +@@ -1254,7 +1253,6 @@ static void amdgpu_ras_debugfs_remove_all(struct amdgpu_device *adev) + amdgpu_ras_debugfs_remove(adev, &obj->head); + } + +- debugfs_remove_recursive(con->dir); + con->dir = NULL; + } + /* debugfs end */ +-- +2.25.1 + diff --git a/queue-5.8/drm-amdkfd-fix-the-wrong-sdma-instance-query-for-ren.patch b/queue-5.8/drm-amdkfd-fix-the-wrong-sdma-instance-query-for-ren.patch new file mode 100644 index 00000000000..08986f25c26 --- /dev/null +++ b/queue-5.8/drm-amdkfd-fix-the-wrong-sdma-instance-query-for-ren.patch @@ -0,0 +1,70 @@ +From 016cb05c607a436834d7a34a2585e9f416f94bac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 13:54:56 +0800 +Subject: drm/amdkfd: fix the wrong sdma instance query for renoir + +From: Huang Rui + +[ Upstream commit 34174b89bfa495bed9cddcc504fb38feca90fab7 ] + +Renoir only has one sdma instance, it will get failed once query the +sdma1 registers. So use switch-case instead of static register array. + +Signed-off-by: Huang Rui +Reviewed-by: Alex Deucher +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c | 31 +++++++++++++------ + 1 file changed, 22 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c +index c7fd0c47b2545..1102de76d8767 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c +@@ -195,19 +195,32 @@ static uint32_t get_sdma_rlc_reg_offset(struct amdgpu_device *adev, + unsigned int engine_id, + unsigned int queue_id) + { +- uint32_t sdma_engine_reg_base[2] = { +- SOC15_REG_OFFSET(SDMA0, 0, +- mmSDMA0_RLC0_RB_CNTL) - mmSDMA0_RLC0_RB_CNTL, +- SOC15_REG_OFFSET(SDMA1, 0, +- mmSDMA1_RLC0_RB_CNTL) - mmSDMA1_RLC0_RB_CNTL +- }; +- uint32_t retval = sdma_engine_reg_base[engine_id] ++ uint32_t sdma_engine_reg_base = 0; ++ uint32_t sdma_rlc_reg_offset; ++ ++ switch (engine_id) { ++ default: ++ dev_warn(adev->dev, ++ "Invalid sdma engine id (%d), using engine id 0\n", ++ engine_id); ++ fallthrough; ++ case 0: ++ sdma_engine_reg_base = SOC15_REG_OFFSET(SDMA0, 0, ++ mmSDMA0_RLC0_RB_CNTL) - mmSDMA0_RLC0_RB_CNTL; ++ break; ++ case 1: ++ sdma_engine_reg_base = SOC15_REG_OFFSET(SDMA1, 0, ++ mmSDMA1_RLC0_RB_CNTL) - mmSDMA0_RLC0_RB_CNTL; ++ break; ++ } ++ ++ sdma_rlc_reg_offset = sdma_engine_reg_base + + queue_id * (mmSDMA0_RLC1_RB_CNTL - mmSDMA0_RLC0_RB_CNTL); + + pr_debug("RLC register offset for SDMA%d RLC%d: 0x%x\n", engine_id, +- queue_id, retval); ++ queue_id, sdma_rlc_reg_offset); + +- return retval; ++ return sdma_rlc_reg_offset; + } + + static inline struct v9_mqd *get_mqd(void *mqd) +-- +2.25.1 + diff --git a/queue-5.8/drm-etnaviv-always-start-stop-scheduler-in-timeout-p.patch b/queue-5.8/drm-etnaviv-always-start-stop-scheduler-in-timeout-p.patch new file mode 100644 index 00000000000..36d9ebcc00c --- /dev/null +++ b/queue-5.8/drm-etnaviv-always-start-stop-scheduler-in-timeout-p.patch @@ -0,0 +1,74 @@ +From f0f5cada61eec8d3b1832975153f8c63c1010500 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 12:55:37 +0200 +Subject: drm/etnaviv: always start/stop scheduler in timeout processing + +From: Lucas Stach + +[ Upstream commit 50248a3ec0f5e5debd18033eb2a29f0b793a7000 ] + +The drm scheduler currently expects that the stop/start sequence is always +executed in the timeout handling, as the job at the head of the hardware +execution list is always removed from the ring mirror before the driver +function is called and only inserted back into the list when starting the +scheduler. + +This adds some unnecessary overhead if the timeout handler determines +that the GPU is still executing jobs normally and just wished to extend +the timeout, but a better solution requires a major rearchitecture of the +scheduler, which is not applicable as a fix. + +Fixes: 135517d3565b ("drm/scheduler: Avoid accessing freed bad job.") +Signed-off-by: Lucas Stach +Tested-by: Russell King +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_sched.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_sched.c b/drivers/gpu/drm/etnaviv/etnaviv_sched.c +index 4e3e95dce6d87..cd46c882269cc 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_sched.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_sched.c +@@ -89,12 +89,15 @@ static void etnaviv_sched_timedout_job(struct drm_sched_job *sched_job) + u32 dma_addr; + int change; + ++ /* block scheduler */ ++ drm_sched_stop(&gpu->sched, sched_job); ++ + /* + * If the GPU managed to complete this jobs fence, the timout is + * spurious. Bail out. + */ + if (dma_fence_is_signaled(submit->out_fence)) +- return; ++ goto out_no_timeout; + + /* + * If the GPU is still making forward progress on the front-end (which +@@ -105,12 +108,9 @@ static void etnaviv_sched_timedout_job(struct drm_sched_job *sched_job) + change = dma_addr - gpu->hangcheck_dma_addr; + if (change < 0 || change > 16) { + gpu->hangcheck_dma_addr = dma_addr; +- return; ++ goto out_no_timeout; + } + +- /* block scheduler */ +- drm_sched_stop(&gpu->sched, sched_job); +- + if(sched_job) + drm_sched_increase_karma(sched_job); + +@@ -120,6 +120,7 @@ static void etnaviv_sched_timedout_job(struct drm_sched_job *sched_job) + + drm_sched_resubmit_jobs(&gpu->sched); + ++out_no_timeout: + /* restart scheduler after GPU is usable again */ + drm_sched_start(&gpu->sched, true); + } +-- +2.25.1 + diff --git a/queue-5.8/drm-msm-adreno-fix-updating-ring-fence.patch b/queue-5.8/drm-msm-adreno-fix-updating-ring-fence.patch new file mode 100644 index 00000000000..2ac1a3d9991 --- /dev/null +++ b/queue-5.8/drm-msm-adreno-fix-updating-ring-fence.patch @@ -0,0 +1,42 @@ +From 174c4ed8523aa6b23207b17a2fe1dc1f94835af8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Aug 2020 17:03:09 -0700 +Subject: drm/msm/adreno: fix updating ring fence + +From: Rob Clark + +[ Upstream commit f228af11dfa1d1616bc67f3a4119ab77c36181f1 ] + +We need to set it to the most recent completed fence, not the most +recent submitted. Otherwise we have races where we think we can retire +submits that the GPU is not finished with, if the GPU doesn't manage to +overwrite the seqno before we look at it. + +This can show up with hang recovery if one of the submits after the +crashing submit also hangs after it is replayed. + +Fixes: f97decac5f4c ("drm/msm: Support multiple ringbuffers") +Signed-off-by: Rob Clark +Reviewed-by: Jordan Crouse +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +index 5db06b5909438..e7b39f3ca33dc 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -396,7 +396,7 @@ int adreno_hw_init(struct msm_gpu *gpu) + ring->next = ring->start; + + /* reset completed fence seqno: */ +- ring->memptrs->fence = ring->seqno; ++ ring->memptrs->fence = ring->fctx->completed_fence; + ring->memptrs->rptr = 0; + } + +-- +2.25.1 + diff --git a/queue-5.8/drm-virtio-fix-memory-leak-in-virtio_gpu_cleanup_obj.patch b/queue-5.8/drm-virtio-fix-memory-leak-in-virtio_gpu_cleanup_obj.patch new file mode 100644 index 00000000000..e0974522e04 --- /dev/null +++ b/queue-5.8/drm-virtio-fix-memory-leak-in-virtio_gpu_cleanup_obj.patch @@ -0,0 +1,36 @@ +From aecf92ff68b6db87223fe9647f09f26adb66165a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jul 2020 13:18:51 +0800 +Subject: drm/virtio: fix memory leak in virtio_gpu_cleanup_object() + +From: Xin He + +[ Upstream commit 836b194d65782aaec4485a07d2aab52d3f698505 ] + +Before setting shmem->pages to NULL, kfree() should +be called. + +Signed-off-by: Xin He +Reviewed-by: Qi Liu +Link: http://patchwork.freedesktop.org/patch/msgid/20200722051851.72662-1-hexin.op@bytedance.com +Signed-off-by: Gerd Hoffmann +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/virtio/virtgpu_object.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c +index 6ccbd01cd888c..703b5cd517519 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_object.c ++++ b/drivers/gpu/drm/virtio/virtgpu_object.c +@@ -79,6 +79,7 @@ void virtio_gpu_cleanup_object(struct virtio_gpu_object *bo) + } + + sg_free_table(shmem->pages); ++ kfree(shmem->pages); + shmem->pages = NULL; + drm_gem_shmem_unpin(&bo->base.base); + } +-- +2.25.1 + diff --git a/queue-5.8/ext4-abort-the-filesystem-if-failed-to-async-write-m.patch b/queue-5.8/ext4-abort-the-filesystem-if-failed-to-async-write-m.patch new file mode 100644 index 00000000000..080cc0ccd7f --- /dev/null +++ b/queue-5.8/ext4-abort-the-filesystem-if-failed-to-async-write-m.patch @@ -0,0 +1,131 @@ +From 2de6950a1e7b220b7a949eee8b25c3f73a4e7805 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Jun 2020 10:54:23 +0800 +Subject: ext4: abort the filesystem if failed to async write metadata buffer + +From: zhangyi (F) + +[ Upstream commit bc71726c725767205757821df364acff87f92ac5 ] + +There is a risk of filesystem inconsistency if we failed to async write +back metadata buffer in the background. Because of current buffer's end +io procedure is handled by end_buffer_async_write() in the block layer, +and it only clear the buffer's uptodate flag and mark the write_io_error +flag, so ext4 cannot detect such failure immediately. In most cases of +getting metadata buffer (e.g. ext4_read_inode_bitmap()), although the +buffer's data is actually uptodate, it may still read data from disk +because the buffer's uptodate flag has been cleared. Finally, it may +lead to on-disk filesystem inconsistency if reading old data from the +disk successfully and write them out again. + +This patch detect bdev mapping->wb_err when getting journal's write +access and mark the filesystem error if bdev's mapping->wb_err was +increased, this could prevent further writing and potential +inconsistency. + +Signed-off-by: zhangyi (F) +Suggested-by: Jan Kara +Link: https://lore.kernel.org/r/20200620025427.1756360-2-yi.zhang@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/ext4.h | 3 +++ + fs/ext4/ext4_jbd2.c | 25 +++++++++++++++++++++++++ + fs/ext4/super.c | 17 +++++++++++++++++ + 3 files changed, 45 insertions(+) + +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index 42815304902b8..eec5c03534d05 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -1585,6 +1585,9 @@ struct ext4_sb_info { + #ifdef CONFIG_EXT4_DEBUG + unsigned long s_simulate_fail; + #endif ++ /* Record the errseq of the backing block device */ ++ errseq_t s_bdev_wb_err; ++ spinlock_t s_bdev_wb_lock; + }; + + static inline struct ext4_sb_info *EXT4_SB(struct super_block *sb) +diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c +index 0c76cdd44d90d..760b9ee49dc00 100644 +--- a/fs/ext4/ext4_jbd2.c ++++ b/fs/ext4/ext4_jbd2.c +@@ -195,6 +195,28 @@ static void ext4_journal_abort_handle(const char *caller, unsigned int line, + jbd2_journal_abort_handle(handle); + } + ++static void ext4_check_bdev_write_error(struct super_block *sb) ++{ ++ struct address_space *mapping = sb->s_bdev->bd_inode->i_mapping; ++ struct ext4_sb_info *sbi = EXT4_SB(sb); ++ int err; ++ ++ /* ++ * If the block device has write error flag, it may have failed to ++ * async write out metadata buffers in the background. In this case, ++ * we could read old data from disk and write it out again, which ++ * may lead to on-disk filesystem inconsistency. ++ */ ++ if (errseq_check(&mapping->wb_err, READ_ONCE(sbi->s_bdev_wb_err))) { ++ spin_lock(&sbi->s_bdev_wb_lock); ++ err = errseq_check_and_advance(&mapping->wb_err, &sbi->s_bdev_wb_err); ++ spin_unlock(&sbi->s_bdev_wb_lock); ++ if (err) ++ ext4_error_err(sb, -err, ++ "Error while async write back metadata"); ++ } ++} ++ + int __ext4_journal_get_write_access(const char *where, unsigned int line, + handle_t *handle, struct buffer_head *bh) + { +@@ -202,6 +224,9 @@ int __ext4_journal_get_write_access(const char *where, unsigned int line, + + might_sleep(); + ++ if (bh->b_bdev->bd_super) ++ ext4_check_bdev_write_error(bh->b_bdev->bd_super); ++ + if (ext4_handle_valid(handle)) { + err = jbd2_journal_get_write_access(handle, bh); + if (err) +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index dda967efcbc2c..c77b10257b36a 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4765,6 +4765,15 @@ no_journal: + } + #endif /* CONFIG_QUOTA */ + ++ /* ++ * Save the original bdev mapping's wb_err value which could be ++ * used to detect the metadata async write error. ++ */ ++ spin_lock_init(&sbi->s_bdev_wb_lock); ++ if (!sb_rdonly(sb)) ++ errseq_check_and_advance(&sb->s_bdev->bd_inode->i_mapping->wb_err, ++ &sbi->s_bdev_wb_err); ++ sb->s_bdev->bd_super = sb; + EXT4_SB(sb)->s_mount_state |= EXT4_ORPHAN_FS; + ext4_orphan_cleanup(sb, es); + EXT4_SB(sb)->s_mount_state &= ~EXT4_ORPHAN_FS; +@@ -5654,6 +5663,14 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + goto restore_opts; + } + ++ /* ++ * Update the original bdev mapping's wb_err value ++ * which could be used to detect the metadata async ++ * write error. ++ */ ++ errseq_check_and_advance(&sb->s_bdev->bd_inode->i_mapping->wb_err, ++ &sbi->s_bdev_wb_err); ++ + /* + * Mounting a RDONLY partition read-write, so reread + * and store the current valid flag. (It may have +-- +2.25.1 + diff --git a/queue-5.8/ext4-correctly-restore-system-zone-info-when-remount.patch b/queue-5.8/ext4-correctly-restore-system-zone-info-when-remount.patch new file mode 100644 index 00000000000..ee469ed66c3 --- /dev/null +++ b/queue-5.8/ext4-correctly-restore-system-zone-info-when-remount.patch @@ -0,0 +1,110 @@ +From f2d6553b6410313609ab1a1ca8f487b1cc827252 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jul 2020 15:04:37 +0200 +Subject: ext4: correctly restore system zone info when remount fails + +From: Jan Kara + +[ Upstream commit 0f5bde1db174f6c471f0bd27198575719dabe3e5 ] + +When remounting filesystem fails late during remount handling and +block_validity mount option is also changed during the remount, we fail +to restore system zone information to a state matching the mount option. +This is mostly harmless, just the block validity checking will not match +the situation described by the mount option. Make sure these two are always +consistent. + +Reported-by: Lukas Czerner +Reviewed-by: Lukas Czerner +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20200728130437.7804-7-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/block_validity.c | 8 -------- + fs/ext4/super.c | 29 +++++++++++++++++++++-------- + 2 files changed, 21 insertions(+), 16 deletions(-) + +diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c +index e830a9d4e10d3..11aa37693e436 100644 +--- a/fs/ext4/block_validity.c ++++ b/fs/ext4/block_validity.c +@@ -254,14 +254,6 @@ int ext4_setup_system_zone(struct super_block *sb) + int flex_size = ext4_flex_bg_size(sbi); + int ret; + +- if (!test_opt(sb, BLOCK_VALIDITY)) { +- if (sbi->system_blks) +- ext4_release_system_zone(sb); +- return 0; +- } +- if (sbi->system_blks) +- return 0; +- + system_blks = kzalloc(sizeof(*system_blks), GFP_KERNEL); + if (!system_blks) + return -ENOMEM; +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 54d1c09329e55..4c8253188d8df 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4698,11 +4698,13 @@ no_journal: + + ext4_set_resv_clusters(sb); + +- err = ext4_setup_system_zone(sb); +- if (err) { +- ext4_msg(sb, KERN_ERR, "failed to initialize system " +- "zone (%d)", err); +- goto failed_mount4a; ++ if (test_opt(sb, BLOCK_VALIDITY)) { ++ err = ext4_setup_system_zone(sb); ++ if (err) { ++ ext4_msg(sb, KERN_ERR, "failed to initialize system " ++ "zone (%d)", err); ++ goto failed_mount4a; ++ } + } + + ext4_ext_init(sb); +@@ -5716,9 +5718,16 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + ext4_register_li_request(sb, first_not_zeroed); + } + +- err = ext4_setup_system_zone(sb); +- if (err) +- goto restore_opts; ++ /* ++ * Handle creation of system zone data early because it can fail. ++ * Releasing of existing data is done when we are sure remount will ++ * succeed. ++ */ ++ if (test_opt(sb, BLOCK_VALIDITY) && !sbi->system_blks) { ++ err = ext4_setup_system_zone(sb); ++ if (err) ++ goto restore_opts; ++ } + + if (sbi->s_journal == NULL && !(old_sb_flags & SB_RDONLY)) { + err = ext4_commit_super(sb, 1); +@@ -5740,6 +5749,8 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + } + } + #endif ++ if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks) ++ ext4_release_system_zone(sb); + + /* + * Some options can be enabled by ext4 and/or by VFS mount flag +@@ -5761,6 +5772,8 @@ restore_opts: + sbi->s_commit_interval = old_opts.s_commit_interval; + sbi->s_min_batch_time = old_opts.s_min_batch_time; + sbi->s_max_batch_time = old_opts.s_max_batch_time; ++ if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks) ++ ext4_release_system_zone(sb); + #ifdef CONFIG_QUOTA + sbi->s_jquota_fmt = old_opts.s_jquota_fmt; + for (i = 0; i < EXT4_MAXQUOTAS; i++) { +-- +2.25.1 + diff --git a/queue-5.8/ext4-don-t-bug-on-inconsistent-journal-feature.patch b/queue-5.8/ext4-don-t-bug-on-inconsistent-journal-feature.patch new file mode 100644 index 00000000000..47246d2a117 --- /dev/null +++ b/queue-5.8/ext4-don-t-bug-on-inconsistent-journal-feature.patch @@ -0,0 +1,212 @@ +From f15f198341684ef6558d3e395aa16d8a9b4476b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jul 2020 16:07:59 +0200 +Subject: ext4: don't BUG on inconsistent journal feature + +From: Jan Kara + +[ Upstream commit 11215630aada28307ba555a43138db6ac54fa825 ] + +A customer has reported a BUG_ON in ext4_clear_journal_err() hitting +during an LTP testing. Either this has been caused by a test setup +issue where the filesystem was being overwritten while LTP was mounting +it or the journal replay has overwritten the superblock with invalid +data. In either case it is preferable we don't take the machine down +with a BUG_ON. So handle the situation of unexpectedly missing +has_journal feature more gracefully. We issue warning and fail the mount +in the cases where the race window is narrow and the failed check is +most likely a programming error. In cases where fs corruption is more +likely, we do full ext4_error() handling before failing mount / remount. + +Reviewed-by: Lukas Czerner +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20200710140759.18031-1-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 68 ++++++++++++++++++++++++++++++++++--------------- + 1 file changed, 47 insertions(+), 21 deletions(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 330957ed1f05c..9fdad843b30ef 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -66,10 +66,10 @@ static int ext4_load_journal(struct super_block *, struct ext4_super_block *, + unsigned long journal_devnum); + static int ext4_show_options(struct seq_file *seq, struct dentry *root); + static int ext4_commit_super(struct super_block *sb, int sync); +-static void ext4_mark_recovery_complete(struct super_block *sb, ++static int ext4_mark_recovery_complete(struct super_block *sb, + struct ext4_super_block *es); +-static void ext4_clear_journal_err(struct super_block *sb, +- struct ext4_super_block *es); ++static int ext4_clear_journal_err(struct super_block *sb, ++ struct ext4_super_block *es); + static int ext4_sync_fs(struct super_block *sb, int wait); + static int ext4_remount(struct super_block *sb, int *flags, char *data); + static int ext4_statfs(struct dentry *dentry, struct kstatfs *buf); +@@ -4770,7 +4770,9 @@ no_journal: + EXT4_SB(sb)->s_mount_state &= ~EXT4_ORPHAN_FS; + if (needs_recovery) { + ext4_msg(sb, KERN_INFO, "recovery complete"); +- ext4_mark_recovery_complete(sb, es); ++ err = ext4_mark_recovery_complete(sb, es); ++ if (err) ++ goto failed_mount8; + } + if (EXT4_SB(sb)->s_journal) { + if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) +@@ -4813,10 +4815,8 @@ cantfind_ext4: + ext4_msg(sb, KERN_ERR, "VFS: Can't find ext4 filesystem"); + goto failed_mount; + +-#ifdef CONFIG_QUOTA + failed_mount8: + ext4_unregister_sysfs(sb); +-#endif + failed_mount7: + ext4_unregister_li_request(sb); + failed_mount6: +@@ -4956,7 +4956,8 @@ static journal_t *ext4_get_journal(struct super_block *sb, + struct inode *journal_inode; + journal_t *journal; + +- BUG_ON(!ext4_has_feature_journal(sb)); ++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) ++ return NULL; + + journal_inode = ext4_get_journal_inode(sb, journal_inum); + if (!journal_inode) +@@ -4986,7 +4987,8 @@ static journal_t *ext4_get_dev_journal(struct super_block *sb, + struct ext4_super_block *es; + struct block_device *bdev; + +- BUG_ON(!ext4_has_feature_journal(sb)); ++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) ++ return NULL; + + bdev = ext4_blkdev_get(j_dev, sb); + if (bdev == NULL) +@@ -5078,7 +5080,8 @@ static int ext4_load_journal(struct super_block *sb, + int err = 0; + int really_read_only; + +- BUG_ON(!ext4_has_feature_journal(sb)); ++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) ++ return -EFSCORRUPTED; + + if (journal_devnum && + journal_devnum != le32_to_cpu(es->s_journal_dev)) { +@@ -5148,7 +5151,12 @@ static int ext4_load_journal(struct super_block *sb, + } + + EXT4_SB(sb)->s_journal = journal; +- ext4_clear_journal_err(sb, es); ++ err = ext4_clear_journal_err(sb, es); ++ if (err) { ++ EXT4_SB(sb)->s_journal = NULL; ++ jbd2_journal_destroy(journal); ++ return err; ++ } + + if (!really_read_only && journal_devnum && + journal_devnum != le32_to_cpu(es->s_journal_dev)) { +@@ -5244,26 +5252,32 @@ static int ext4_commit_super(struct super_block *sb, int sync) + * remounting) the filesystem readonly, then we will end up with a + * consistent fs on disk. Record that fact. + */ +-static void ext4_mark_recovery_complete(struct super_block *sb, +- struct ext4_super_block *es) ++static int ext4_mark_recovery_complete(struct super_block *sb, ++ struct ext4_super_block *es) + { ++ int err; + journal_t *journal = EXT4_SB(sb)->s_journal; + + if (!ext4_has_feature_journal(sb)) { +- BUG_ON(journal != NULL); +- return; ++ if (journal != NULL) { ++ ext4_error(sb, "Journal got removed while the fs was " ++ "mounted!"); ++ return -EFSCORRUPTED; ++ } ++ return 0; + } + jbd2_journal_lock_updates(journal); +- if (jbd2_journal_flush(journal) < 0) ++ err = jbd2_journal_flush(journal); ++ if (err < 0) + goto out; + + if (ext4_has_feature_journal_needs_recovery(sb) && sb_rdonly(sb)) { + ext4_clear_feature_journal_needs_recovery(sb); + ext4_commit_super(sb, 1); + } +- + out: + jbd2_journal_unlock_updates(journal); ++ return err; + } + + /* +@@ -5271,14 +5285,17 @@ out: + * has recorded an error from a previous lifetime, move that error to the + * main filesystem now. + */ +-static void ext4_clear_journal_err(struct super_block *sb, ++static int ext4_clear_journal_err(struct super_block *sb, + struct ext4_super_block *es) + { + journal_t *journal; + int j_errno; + const char *errstr; + +- BUG_ON(!ext4_has_feature_journal(sb)); ++ if (!ext4_has_feature_journal(sb)) { ++ ext4_error(sb, "Journal got removed while the fs was mounted!"); ++ return -EFSCORRUPTED; ++ } + + journal = EXT4_SB(sb)->s_journal; + +@@ -5303,6 +5320,7 @@ static void ext4_clear_journal_err(struct super_block *sb, + jbd2_journal_clear_err(journal); + jbd2_journal_update_sb_errno(journal); + } ++ return 0; + } + + /* +@@ -5573,8 +5591,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + (sbi->s_mount_state & EXT4_VALID_FS)) + es->s_state = cpu_to_le16(sbi->s_mount_state); + +- if (sbi->s_journal) ++ if (sbi->s_journal) { ++ /* ++ * We let remount-ro finish even if marking fs ++ * as clean failed... ++ */ + ext4_mark_recovery_complete(sb, es); ++ } + if (sbi->s_mmp_tsk) + kthread_stop(sbi->s_mmp_tsk); + } else { +@@ -5622,8 +5645,11 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + * been changed by e2fsck since we originally mounted + * the partition.) + */ +- if (sbi->s_journal) +- ext4_clear_journal_err(sb, es); ++ if (sbi->s_journal) { ++ err = ext4_clear_journal_err(sb, es); ++ if (err) ++ goto restore_opts; ++ } + sbi->s_mount_state = le16_to_cpu(es->s_state); + + err = ext4_setup_super(sb, es, 0); +-- +2.25.1 + diff --git a/queue-5.8/ext4-handle-error-of-ext4_setup_system_zone-on-remou.patch b/queue-5.8/ext4-handle-error-of-ext4_setup_system_zone-on-remou.patch new file mode 100644 index 00000000000..c13a4e959d2 --- /dev/null +++ b/queue-5.8/ext4-handle-error-of-ext4_setup_system_zone-on-remou.patch @@ -0,0 +1,39 @@ +From e9c1b749f8ff50ad1c6a0021bb70474773ebf1d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jul 2020 15:04:32 +0200 +Subject: ext4: handle error of ext4_setup_system_zone() on remount + +From: Jan Kara + +[ Upstream commit d176b1f62f242ab259ff665a26fbac69db1aecba ] + +ext4_setup_system_zone() can fail. Handle the failure in ext4_remount(). + +Reviewed-by: Lukas Czerner +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20200728130437.7804-2-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 85849e5b31b28..54d1c09329e55 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -5716,7 +5716,10 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + ext4_register_li_request(sb, first_not_zeroed); + } + +- ext4_setup_system_zone(sb); ++ err = ext4_setup_system_zone(sb); ++ if (err) ++ goto restore_opts; ++ + if (sbi->s_journal == NULL && !(old_sb_flags & SB_RDONLY)) { + err = ext4_commit_super(sb, 1); + if (err) +-- +2.25.1 + diff --git a/queue-5.8/ext4-handle-option-set-by-mount-flags-correctly.patch b/queue-5.8/ext4-handle-option-set-by-mount-flags-correctly.patch new file mode 100644 index 00000000000..98f94ce73bf --- /dev/null +++ b/queue-5.8/ext4-handle-option-set-by-mount-flags-correctly.patch @@ -0,0 +1,98 @@ +From d2dc27f8fa6acb0a6e34ea4e276b6364be046016 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 17:05:26 +0200 +Subject: ext4: handle option set by mount flags correctly + +From: Lukas Czerner + +[ Upstream commit f25391ebb475d3ffb3aa61bb90e3594c841749ef ] + +Currently there is a problem with mount options that can be both set by +vfs using mount flags or by a string parsing in ext4. + +i_version/iversion options gets lost after remount, for example + +$ mount -o i_version /dev/pmem0 /mnt +$ grep pmem0 /proc/self/mountinfo | grep i_version +310 95 259:0 / /mnt rw,relatime shared:163 - ext4 /dev/pmem0 rw,seclabel,i_version +$ mount -o remount,ro /mnt +$ grep pmem0 /proc/self/mountinfo | grep i_version + +nolazytime gets ignored by ext4 on remount, for example + +$ mount -o lazytime /dev/pmem0 /mnt +$ grep pmem0 /proc/self/mountinfo | grep lazytime +310 95 259:0 / /mnt rw,relatime shared:163 - ext4 /dev/pmem0 rw,lazytime,seclabel +$ mount -o remount,nolazytime /mnt +$ grep pmem0 /proc/self/mountinfo | grep lazytime +310 95 259:0 / /mnt rw,relatime shared:163 - ext4 /dev/pmem0 rw,lazytime,seclabel + +Fix it by applying the SB_LAZYTIME and SB_I_VERSION flags from *flags to +s_flags before we parse the option and use the resulting state of the +same flags in *flags at the end of successful remount. + +Signed-off-by: Lukas Czerner +Reviewed-by: Ritesh Harjani +Link: https://lore.kernel.org/r/20200723150526.19931-1-lczerner@redhat.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index c77b10257b36a..85849e5b31b28 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -5487,7 +5487,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + { + struct ext4_super_block *es; + struct ext4_sb_info *sbi = EXT4_SB(sb); +- unsigned long old_sb_flags; ++ unsigned long old_sb_flags, vfs_flags; + struct ext4_mount_options old_opts; + int enable_quota = 0; + ext4_group_t g; +@@ -5530,6 +5530,14 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + if (sbi->s_journal && sbi->s_journal->j_task->io_context) + journal_ioprio = sbi->s_journal->j_task->io_context->ioprio; + ++ /* ++ * Some options can be enabled by ext4 and/or by VFS mount flag ++ * either way we need to make sure it matches in both *flags and ++ * s_flags. Copy those selected flags from *flags to s_flags ++ */ ++ vfs_flags = SB_LAZYTIME | SB_I_VERSION; ++ sb->s_flags = (sb->s_flags & ~vfs_flags) | (*flags & vfs_flags); ++ + if (!parse_options(data, sb, NULL, &journal_ioprio, 1)) { + err = -EINVAL; + goto restore_opts; +@@ -5583,9 +5591,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + set_task_ioprio(sbi->s_journal->j_task, journal_ioprio); + } + +- if (*flags & SB_LAZYTIME) +- sb->s_flags |= SB_LAZYTIME; +- + if ((bool)(*flags & SB_RDONLY) != sb_rdonly(sb)) { + if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED) { + err = -EROFS; +@@ -5733,7 +5738,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + } + #endif + +- *flags = (*flags & ~SB_LAZYTIME) | (sb->s_flags & SB_LAZYTIME); ++ /* ++ * Some options can be enabled by ext4 and/or by VFS mount flag ++ * either way we need to make sure it matches in both *flags and ++ * s_flags. Copy those selected flags from s_flags to *flags ++ */ ++ *flags = (*flags & ~vfs_flags) | (sb->s_flags & vfs_flags); ++ + ext4_msg(sb, KERN_INFO, "re-mounted. Opts: %s", orig_data); + kfree(orig_data); + return 0; +-- +2.25.1 + diff --git a/queue-5.8/ext4-handle-read-only-external-journal-device.patch b/queue-5.8/ext4-handle-read-only-external-journal-device.patch new file mode 100644 index 00000000000..7bbfa9ab8f9 --- /dev/null +++ b/queue-5.8/ext4-handle-read-only-external-journal-device.patch @@ -0,0 +1,183 @@ +From c35e48a0babf8db4dd8aa578fc9194354d79d2b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jul 2020 11:06:05 +0200 +Subject: ext4: handle read only external journal device + +From: Lukas Czerner + +[ Upstream commit 273108fa5015eeffc4bacfa5ce272af3434b96e4 ] + +Ext4 uses blkdev_get_by_dev() to get the block_device for journal device +which does check to see if the read-only block device was opened +read-only. + +As a result ext4 will hapily proceed mounting the file system with +external journal on read-only device. This is bad as we would not be +able to use the journal leading to errors later on. + +Instead of simply failing to mount file system in this case, treat it in +a similar way we treat internal journal on read-only device. Allow to +mount with -o noload in read-only mode. + +This can be reproduced easily like this: + +mke2fs -F -O journal_dev $JOURNAL_DEV 100M +mkfs.$FSTYPE -F -J device=$JOURNAL_DEV $FS_DEV +blockdev --setro $JOURNAL_DEV +mount $FS_DEV $MNT +touch $MNT/file +umount $MNT + +leading to error like this + +[ 1307.318713] ------------[ cut here ]------------ +[ 1307.323362] generic_make_request: Trying to write to read-only block-device dm-2 (partno 0) +[ 1307.331741] WARNING: CPU: 36 PID: 3224 at block/blk-core.c:855 generic_make_request_checks+0x2c3/0x580 +[ 1307.341041] Modules linked in: ext4 mbcache jbd2 rfkill intel_rapl_msr intel_rapl_common isst_if_commd +[ 1307.419445] CPU: 36 PID: 3224 Comm: jbd2/dm-2 Tainted: G W I 5.8.0-rc5 #2 +[ 1307.427359] Hardware name: Dell Inc. PowerEdge R740/01KPX8, BIOS 2.3.10 08/15/2019 +[ 1307.434932] RIP: 0010:generic_make_request_checks+0x2c3/0x580 +[ 1307.440676] Code: 94 03 00 00 48 89 df 48 8d 74 24 08 c6 05 cf 2b 18 01 01 e8 7f a4 ff ff 48 c7 c7 50e +[ 1307.459420] RSP: 0018:ffffc0d70eb5fb48 EFLAGS: 00010286 +[ 1307.464646] RAX: 0000000000000000 RBX: ffff9b33b2978300 RCX: 0000000000000000 +[ 1307.471780] RDX: ffff9b33e12a81e0 RSI: ffff9b33e1298000 RDI: ffff9b33e1298000 +[ 1307.478913] RBP: ffff9b7b9679e0c0 R08: 0000000000000837 R09: 0000000000000024 +[ 1307.486044] R10: 0000000000000000 R11: ffffc0d70eb5f9f0 R12: 0000000000000400 +[ 1307.493177] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 +[ 1307.500308] FS: 0000000000000000(0000) GS:ffff9b33e1280000(0000) knlGS:0000000000000000 +[ 1307.508396] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 1307.514142] CR2: 000055eaf4109000 CR3: 0000003dee40a006 CR4: 00000000007606e0 +[ 1307.521273] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 1307.528407] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 1307.535538] PKRU: 55555554 +[ 1307.538250] Call Trace: +[ 1307.540708] generic_make_request+0x30/0x340 +[ 1307.544985] submit_bio+0x43/0x190 +[ 1307.548393] ? bio_add_page+0x62/0x90 +[ 1307.552068] submit_bh_wbc+0x16a/0x190 +[ 1307.555833] jbd2_write_superblock+0xec/0x200 [jbd2] +[ 1307.560803] jbd2_journal_update_sb_log_tail+0x65/0xc0 [jbd2] +[ 1307.566557] jbd2_journal_commit_transaction+0x2ae/0x1860 [jbd2] +[ 1307.572566] ? check_preempt_curr+0x7a/0x90 +[ 1307.576756] ? update_curr+0xe1/0x1d0 +[ 1307.580421] ? account_entity_dequeue+0x7b/0xb0 +[ 1307.584955] ? newidle_balance+0x231/0x3d0 +[ 1307.589056] ? __switch_to_asm+0x42/0x70 +[ 1307.592986] ? __switch_to_asm+0x36/0x70 +[ 1307.596918] ? lock_timer_base+0x67/0x80 +[ 1307.600851] kjournald2+0xbd/0x270 [jbd2] +[ 1307.604873] ? finish_wait+0x80/0x80 +[ 1307.608460] ? commit_timeout+0x10/0x10 [jbd2] +[ 1307.612915] kthread+0x114/0x130 +[ 1307.616152] ? kthread_park+0x80/0x80 +[ 1307.619816] ret_from_fork+0x22/0x30 +[ 1307.623400] ---[ end trace 27490236265b1630 ]--- + +Signed-off-by: Lukas Czerner +Reviewed-by: Andreas Dilger +Link: https://lore.kernel.org/r/20200717090605.2612-1-lczerner@redhat.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 51 ++++++++++++++++++++++++++++++++----------------- + 1 file changed, 33 insertions(+), 18 deletions(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 9fdad843b30ef..dda967efcbc2c 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -5079,6 +5079,7 @@ static int ext4_load_journal(struct super_block *sb, + dev_t journal_dev; + int err = 0; + int really_read_only; ++ int journal_dev_ro; + + if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) + return -EFSCORRUPTED; +@@ -5091,7 +5092,31 @@ static int ext4_load_journal(struct super_block *sb, + } else + journal_dev = new_decode_dev(le32_to_cpu(es->s_journal_dev)); + +- really_read_only = bdev_read_only(sb->s_bdev); ++ if (journal_inum && journal_dev) { ++ ext4_msg(sb, KERN_ERR, ++ "filesystem has both journal inode and journal device!"); ++ return -EINVAL; ++ } ++ ++ if (journal_inum) { ++ journal = ext4_get_journal(sb, journal_inum); ++ if (!journal) ++ return -EINVAL; ++ } else { ++ journal = ext4_get_dev_journal(sb, journal_dev); ++ if (!journal) ++ return -EINVAL; ++ } ++ ++ journal_dev_ro = bdev_read_only(journal->j_dev); ++ really_read_only = bdev_read_only(sb->s_bdev) | journal_dev_ro; ++ ++ if (journal_dev_ro && !sb_rdonly(sb)) { ++ ext4_msg(sb, KERN_ERR, ++ "journal device read-only, try mounting with '-o ro'"); ++ err = -EROFS; ++ goto err_out; ++ } + + /* + * Are we loading a blank journal or performing recovery after a +@@ -5106,27 +5131,14 @@ static int ext4_load_journal(struct super_block *sb, + ext4_msg(sb, KERN_ERR, "write access " + "unavailable, cannot proceed " + "(try mounting with noload)"); +- return -EROFS; ++ err = -EROFS; ++ goto err_out; + } + ext4_msg(sb, KERN_INFO, "write access will " + "be enabled during recovery"); + } + } + +- if (journal_inum && journal_dev) { +- ext4_msg(sb, KERN_ERR, "filesystem has both journal " +- "and inode journals!"); +- return -EINVAL; +- } +- +- if (journal_inum) { +- if (!(journal = ext4_get_journal(sb, journal_inum))) +- return -EINVAL; +- } else { +- if (!(journal = ext4_get_dev_journal(sb, journal_dev))) +- return -EINVAL; +- } +- + if (!(journal->j_flags & JBD2_BARRIER)) + ext4_msg(sb, KERN_INFO, "barriers disabled"); + +@@ -5146,8 +5158,7 @@ static int ext4_load_journal(struct super_block *sb, + + if (err) { + ext4_msg(sb, KERN_ERR, "error loading journal"); +- jbd2_journal_destroy(journal); +- return err; ++ goto err_out; + } + + EXT4_SB(sb)->s_journal = journal; +@@ -5167,6 +5178,10 @@ static int ext4_load_journal(struct super_block *sb, + } + + return 0; ++ ++err_out: ++ jbd2_journal_destroy(journal); ++ return err; + } + + static int ext4_commit_super(struct super_block *sb, int sync) +-- +2.25.1 + diff --git a/queue-5.8/ext4-limit-the-length-of-per-inode-prealloc-list.patch b/queue-5.8/ext4-limit-the-length-of-per-inode-prealloc-list.patch new file mode 100644 index 00000000000..2b41f83bd5f --- /dev/null +++ b/queue-5.8/ext4-limit-the-length-of-per-inode-prealloc-list.patch @@ -0,0 +1,506 @@ +From c942966aba06efba2bb0acf56b222f30b7ddbe56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 15:36:15 +0800 +Subject: ext4: limit the length of per-inode prealloc list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: brookxu + +[ Upstream commit 27bc446e2def38db3244a6eb4bb1d6312936610a ] + +In the scenario of writing sparse files, the per-inode prealloc list may +be very long, resulting in high overhead for ext4_mb_use_preallocated(). +To circumvent this problem, we limit the maximum length of per-inode +prealloc list to 512 and allow users to modify it. + +After patching, we observed that the sys ratio of cpu has dropped, and +the system throughput has increased significantly. We created a process +to write the sparse file, and the running time of the process on the +fixed kernel was significantly reduced, as follows: + +Running time on unfixed kernel： +[root@TENCENT64 ~]# time taskset 0x01 ./sparse /data1/sparce.dat +real 0m2.051s +user 0m0.008s +sys 0m2.026s + +Running time on fixed kernel： +[root@TENCENT64 ~]# time taskset 0x01 ./sparse /data1/sparce.dat +real 0m0.471s +user 0m0.004s +sys 0m0.395s + +Signed-off-by: Chunguang Xu +Link: https://lore.kernel.org/r/d7a98178-056b-6db5-6bce-4ead23f4a257@gmail.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + Documentation/admin-guide/ext4.rst | 3 ++ + fs/ext4/ext4.h | 4 +- + fs/ext4/extents.c | 10 ++-- + fs/ext4/file.c | 2 +- + fs/ext4/indirect.c | 2 +- + fs/ext4/inode.c | 6 +-- + fs/ext4/ioctl.c | 2 +- + fs/ext4/mballoc.c | 74 ++++++++++++++++++++++++++---- + fs/ext4/mballoc.h | 4 ++ + fs/ext4/move_extent.c | 4 +- + fs/ext4/super.c | 3 +- + fs/ext4/sysfs.c | 2 + + include/trace/events/ext4.h | 17 ++++--- + 13 files changed, 104 insertions(+), 29 deletions(-) + +diff --git a/Documentation/admin-guide/ext4.rst b/Documentation/admin-guide/ext4.rst +index 9443fcef18760..f37d0743fd668 100644 +--- a/Documentation/admin-guide/ext4.rst ++++ b/Documentation/admin-guide/ext4.rst +@@ -482,6 +482,9 @@ Files in /sys/fs/ext4/: + multiple of this tuning parameter if the stripe size is not set in the + ext4 superblock + ++ mb_max_inode_prealloc ++ The maximum length of per-inode ext4_prealloc_space list. ++ + mb_max_to_scan + The maximum number of extents the multiblock allocator will search to + find the best extent. +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index eec5c03534d05..ff46defc65683 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -1054,6 +1054,7 @@ struct ext4_inode_info { + struct timespec64 i_crtime; + + /* mballoc */ ++ atomic_t i_prealloc_active; + struct list_head i_prealloc_list; + spinlock_t i_prealloc_lock; + +@@ -1501,6 +1502,7 @@ struct ext4_sb_info { + unsigned int s_mb_stats; + unsigned int s_mb_order2_reqs; + unsigned int s_mb_group_prealloc; ++ unsigned int s_mb_max_inode_prealloc; + unsigned int s_max_dir_size_kb; + /* where last allocation was done - for stream allocation */ + unsigned long s_mb_last_group; +@@ -2654,7 +2656,7 @@ extern int ext4_mb_release(struct super_block *); + extern ext4_fsblk_t ext4_mb_new_blocks(handle_t *, + struct ext4_allocation_request *, int *); + extern int ext4_mb_reserve_blocks(struct super_block *, int); +-extern void ext4_discard_preallocations(struct inode *); ++extern void ext4_discard_preallocations(struct inode *, unsigned int); + extern int __init ext4_init_mballoc(void); + extern void ext4_exit_mballoc(void); + extern void ext4_free_blocks(handle_t *handle, struct inode *inode, +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index d75054570e44c..11a321dd11e7e 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -100,7 +100,7 @@ static int ext4_ext_trunc_restart_fn(struct inode *inode, int *dropped) + * i_mutex. So we can safely drop the i_data_sem here. + */ + BUG_ON(EXT4_JOURNAL(inode) == NULL); +- ext4_discard_preallocations(inode); ++ ext4_discard_preallocations(inode, 0); + up_write(&EXT4_I(inode)->i_data_sem); + *dropped = 1; + return 0; +@@ -4268,7 +4268,7 @@ got_allocated_blocks: + * not a good idea to call discard here directly, + * but otherwise we'd need to call it every free(). + */ +- ext4_discard_preallocations(inode); ++ ext4_discard_preallocations(inode, 0); + if (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE) + fb_flags = EXT4_FREE_BLOCKS_NO_QUOT_UPDATE; + ext4_free_blocks(handle, inode, NULL, newblock, +@@ -5295,7 +5295,7 @@ static int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) + } + + down_write(&EXT4_I(inode)->i_data_sem); +- ext4_discard_preallocations(inode); ++ ext4_discard_preallocations(inode, 0); + + ret = ext4_es_remove_extent(inode, punch_start, + EXT_MAX_BLOCKS - punch_start); +@@ -5309,7 +5309,7 @@ static int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) + up_write(&EXT4_I(inode)->i_data_sem); + goto out_stop; + } +- ext4_discard_preallocations(inode); ++ ext4_discard_preallocations(inode, 0); + + ret = ext4_ext_shift_extents(inode, handle, punch_stop, + punch_stop - punch_start, SHIFT_LEFT); +@@ -5441,7 +5441,7 @@ static int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len) + goto out_stop; + + down_write(&EXT4_I(inode)->i_data_sem); +- ext4_discard_preallocations(inode); ++ ext4_discard_preallocations(inode, 0); + + path = ext4_find_extent(inode, offset_lblk, NULL, 0); + if (IS_ERR(path)) { +diff --git a/fs/ext4/file.c b/fs/ext4/file.c +index 8f742b53f1d40..4ee9a4dc01a88 100644 +--- a/fs/ext4/file.c ++++ b/fs/ext4/file.c +@@ -148,7 +148,7 @@ static int ext4_release_file(struct inode *inode, struct file *filp) + !EXT4_I(inode)->i_reserved_data_blocks) + { + down_write(&EXT4_I(inode)->i_data_sem); +- ext4_discard_preallocations(inode); ++ ext4_discard_preallocations(inode, 0); + up_write(&EXT4_I(inode)->i_data_sem); + } + if (is_dx(inode) && filp->private_data) +diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c +index 4026418257121..e8ca405673923 100644 +--- a/fs/ext4/indirect.c ++++ b/fs/ext4/indirect.c +@@ -696,7 +696,7 @@ static int ext4_ind_trunc_restart_fn(handle_t *handle, struct inode *inode, + * i_mutex. So we can safely drop the i_data_sem here. + */ + BUG_ON(EXT4_JOURNAL(inode) == NULL); +- ext4_discard_preallocations(inode); ++ ext4_discard_preallocations(inode, 0); + up_write(&EXT4_I(inode)->i_data_sem); + *dropped = 1; + return 0; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 92573f8540ab7..9c0629ffb4261 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -383,7 +383,7 @@ void ext4_da_update_reserve_space(struct inode *inode, + */ + if ((ei->i_reserved_data_blocks == 0) && + !inode_is_open_for_write(inode)) +- ext4_discard_preallocations(inode); ++ ext4_discard_preallocations(inode, 0); + } + + static int __check_block_validity(struct inode *inode, const char *func, +@@ -4055,7 +4055,7 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) + if (stop_block > first_block) { + + down_write(&EXT4_I(inode)->i_data_sem); +- ext4_discard_preallocations(inode); ++ ext4_discard_preallocations(inode, 0); + + ret = ext4_es_remove_extent(inode, first_block, + stop_block - first_block); +@@ -4210,7 +4210,7 @@ int ext4_truncate(struct inode *inode) + + down_write(&EXT4_I(inode)->i_data_sem); + +- ext4_discard_preallocations(inode); ++ ext4_discard_preallocations(inode, 0); + + if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) + err = ext4_ext_truncate(handle, inode); +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index 999cf6add39c6..a5fcc238c6693 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -202,7 +202,7 @@ static long swap_inode_boot_loader(struct super_block *sb, + reset_inode_seed(inode); + reset_inode_seed(inode_bl); + +- ext4_discard_preallocations(inode); ++ ext4_discard_preallocations(inode, 0); + + err = ext4_mark_inode_dirty(handle, inode); + if (err < 0) { +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index ba5371b35b09e..e88eff999bd15 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -2755,6 +2755,7 @@ int ext4_mb_init(struct super_block *sb) + sbi->s_mb_stats = MB_DEFAULT_STATS; + sbi->s_mb_stream_request = MB_DEFAULT_STREAM_THRESHOLD; + sbi->s_mb_order2_reqs = MB_DEFAULT_ORDER2_REQS; ++ sbi->s_mb_max_inode_prealloc = MB_DEFAULT_MAX_INODE_PREALLOC; + /* + * The default group preallocation is 512, which for 4k block + * sizes translates to 2 megabytes. However for bigalloc file +@@ -3693,6 +3694,26 @@ void ext4_mb_generate_from_pa(struct super_block *sb, void *bitmap, + mb_debug(sb, "preallocated %d for group %u\n", preallocated, group); + } + ++static void ext4_mb_mark_pa_deleted(struct super_block *sb, ++ struct ext4_prealloc_space *pa) ++{ ++ struct ext4_inode_info *ei; ++ ++ if (pa->pa_deleted) { ++ ext4_warning(sb, "deleted pa, type:%d, pblk:%llu, lblk:%u, len:%d\n", ++ pa->pa_type, pa->pa_pstart, pa->pa_lstart, ++ pa->pa_len); ++ return; ++ } ++ ++ pa->pa_deleted = 1; ++ ++ if (pa->pa_type == MB_INODE_PA) { ++ ei = EXT4_I(pa->pa_inode); ++ atomic_dec(&ei->i_prealloc_active); ++ } ++} ++ + static void ext4_mb_pa_callback(struct rcu_head *head) + { + struct ext4_prealloc_space *pa; +@@ -3725,7 +3746,7 @@ static void ext4_mb_put_pa(struct ext4_allocation_context *ac, + return; + } + +- pa->pa_deleted = 1; ++ ext4_mb_mark_pa_deleted(sb, pa); + spin_unlock(&pa->pa_lock); + + grp_blk = pa->pa_pstart; +@@ -3849,6 +3870,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac) + spin_lock(pa->pa_obj_lock); + list_add_rcu(&pa->pa_inode_list, &ei->i_prealloc_list); + spin_unlock(pa->pa_obj_lock); ++ atomic_inc(&ei->i_prealloc_active); + } + + /* +@@ -4059,7 +4081,7 @@ repeat: + } + + /* seems this one can be freed ... */ +- pa->pa_deleted = 1; ++ ext4_mb_mark_pa_deleted(sb, pa); + + /* we can trust pa_free ... */ + free += pa->pa_free; +@@ -4122,7 +4144,7 @@ out_dbg: + * + * FIXME!! Make sure it is valid at all the call sites + */ +-void ext4_discard_preallocations(struct inode *inode) ++void ext4_discard_preallocations(struct inode *inode, unsigned int needed) + { + struct ext4_inode_info *ei = EXT4_I(inode); + struct super_block *sb = inode->i_sb; +@@ -4140,15 +4162,19 @@ void ext4_discard_preallocations(struct inode *inode) + + mb_debug(sb, "discard preallocation for inode %lu\n", + inode->i_ino); +- trace_ext4_discard_preallocations(inode); ++ trace_ext4_discard_preallocations(inode, ++ atomic_read(&ei->i_prealloc_active), needed); + + INIT_LIST_HEAD(&list); + ++ if (needed == 0) ++ needed = UINT_MAX; ++ + repeat: + /* first, collect all pa's in the inode */ + spin_lock(&ei->i_prealloc_lock); +- while (!list_empty(&ei->i_prealloc_list)) { +- pa = list_entry(ei->i_prealloc_list.next, ++ while (!list_empty(&ei->i_prealloc_list) && needed) { ++ pa = list_entry(ei->i_prealloc_list.prev, + struct ext4_prealloc_space, pa_inode_list); + BUG_ON(pa->pa_obj_lock != &ei->i_prealloc_lock); + spin_lock(&pa->pa_lock); +@@ -4165,10 +4191,11 @@ repeat: + + } + if (pa->pa_deleted == 0) { +- pa->pa_deleted = 1; ++ ext4_mb_mark_pa_deleted(sb, pa); + spin_unlock(&pa->pa_lock); + list_del_rcu(&pa->pa_inode_list); + list_add(&pa->u.pa_tmp_list, &list); ++ needed--; + continue; + } + +@@ -4469,7 +4496,7 @@ ext4_mb_discard_lg_preallocations(struct super_block *sb, + BUG_ON(pa->pa_type != MB_GROUP_PA); + + /* seems this one can be freed ... */ +- pa->pa_deleted = 1; ++ ext4_mb_mark_pa_deleted(sb, pa); + spin_unlock(&pa->pa_lock); + + list_del_rcu(&pa->pa_inode_list); +@@ -4567,11 +4594,30 @@ static void ext4_mb_add_n_trim(struct ext4_allocation_context *ac) + return ; + } + ++/* ++ * if per-inode prealloc list is too long, trim some PA ++ */ ++static void ext4_mb_trim_inode_pa(struct inode *inode) ++{ ++ struct ext4_inode_info *ei = EXT4_I(inode); ++ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); ++ int count, delta; ++ ++ count = atomic_read(&ei->i_prealloc_active); ++ delta = (sbi->s_mb_max_inode_prealloc >> 2) + 1; ++ if (count > sbi->s_mb_max_inode_prealloc + delta) { ++ count -= sbi->s_mb_max_inode_prealloc; ++ ext4_discard_preallocations(inode, count); ++ } ++} ++ + /* + * release all resource we used in allocation + */ + static int ext4_mb_release_context(struct ext4_allocation_context *ac) + { ++ struct inode *inode = ac->ac_inode; ++ struct ext4_inode_info *ei = EXT4_I(inode); + struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb); + struct ext4_prealloc_space *pa = ac->ac_pa; + if (pa) { +@@ -4598,6 +4644,17 @@ static int ext4_mb_release_context(struct ext4_allocation_context *ac) + spin_unlock(pa->pa_obj_lock); + ext4_mb_add_n_trim(ac); + } ++ ++ if (pa->pa_type == MB_INODE_PA) { ++ /* ++ * treat per-inode prealloc list as a lru list, then try ++ * to trim the least recently used PA. ++ */ ++ spin_lock(pa->pa_obj_lock); ++ list_move(&pa->pa_inode_list, &ei->i_prealloc_list); ++ spin_unlock(pa->pa_obj_lock); ++ } ++ + ext4_mb_put_pa(ac, ac->ac_sb, pa); + } + if (ac->ac_bitmap_page) +@@ -4607,6 +4664,7 @@ static int ext4_mb_release_context(struct ext4_allocation_context *ac) + if (ac->ac_flags & EXT4_MB_HINT_GROUP_ALLOC) + mutex_unlock(&ac->ac_lg->lg_mutex); + ext4_mb_collect_stats(ac); ++ ext4_mb_trim_inode_pa(inode); + return 0; + } + +diff --git a/fs/ext4/mballoc.h b/fs/ext4/mballoc.h +index 6b4d17c2935d6..e75b4749aa1c2 100644 +--- a/fs/ext4/mballoc.h ++++ b/fs/ext4/mballoc.h +@@ -73,6 +73,10 @@ + */ + #define MB_DEFAULT_GROUP_PREALLOC 512 + ++/* ++ * maximum length of inode prealloc list ++ */ ++#define MB_DEFAULT_MAX_INODE_PREALLOC 512 + + struct ext4_free_data { + /* this links the free block information from sb_info */ +diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c +index 1ed86fb6c3026..0d601b8228753 100644 +--- a/fs/ext4/move_extent.c ++++ b/fs/ext4/move_extent.c +@@ -686,8 +686,8 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk, + + out: + if (*moved_len) { +- ext4_discard_preallocations(orig_inode); +- ext4_discard_preallocations(donor_inode); ++ ext4_discard_preallocations(orig_inode, 0); ++ ext4_discard_preallocations(donor_inode, 0); + } + + ext4_ext_drop_refs(path); +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index f3614299ffd09..0b38bf29c07e0 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -1123,6 +1123,7 @@ static struct inode *ext4_alloc_inode(struct super_block *sb) + inode_set_iversion(&ei->vfs_inode, 1); + spin_lock_init(&ei->i_raw_lock); + INIT_LIST_HEAD(&ei->i_prealloc_list); ++ atomic_set(&ei->i_prealloc_active, 0); + spin_lock_init(&ei->i_prealloc_lock); + ext4_es_init_tree(&ei->i_es_tree); + rwlock_init(&ei->i_es_lock); +@@ -1216,7 +1217,7 @@ void ext4_clear_inode(struct inode *inode) + { + invalidate_inode_buffers(inode); + clear_inode(inode); +- ext4_discard_preallocations(inode); ++ ext4_discard_preallocations(inode, 0); + ext4_es_remove_extent(inode, 0, EXT_MAX_BLOCKS); + dquot_drop(inode); + if (EXT4_I(inode)->jinode) { +diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c +index 6c9fc9e21c138..92f04e9e94413 100644 +--- a/fs/ext4/sysfs.c ++++ b/fs/ext4/sysfs.c +@@ -215,6 +215,7 @@ EXT4_RW_ATTR_SBI_UI(mb_min_to_scan, s_mb_min_to_scan); + EXT4_RW_ATTR_SBI_UI(mb_order2_req, s_mb_order2_reqs); + EXT4_RW_ATTR_SBI_UI(mb_stream_req, s_mb_stream_request); + EXT4_RW_ATTR_SBI_UI(mb_group_prealloc, s_mb_group_prealloc); ++EXT4_RW_ATTR_SBI_UI(mb_max_inode_prealloc, s_mb_max_inode_prealloc); + EXT4_RW_ATTR_SBI_UI(extent_max_zeroout_kb, s_extent_max_zeroout_kb); + EXT4_ATTR(trigger_fs_error, 0200, trigger_test_error); + EXT4_RW_ATTR_SBI_UI(err_ratelimit_interval_ms, s_err_ratelimit_state.interval); +@@ -257,6 +258,7 @@ static struct attribute *ext4_attrs[] = { + ATTR_LIST(mb_order2_req), + ATTR_LIST(mb_stream_req), + ATTR_LIST(mb_group_prealloc), ++ ATTR_LIST(mb_max_inode_prealloc), + ATTR_LIST(max_writeback_mb_bump), + ATTR_LIST(extent_max_zeroout_kb), + ATTR_LIST(trigger_fs_error), +diff --git a/include/trace/events/ext4.h b/include/trace/events/ext4.h +index cc41d692ae8ed..628db6a07fda0 100644 +--- a/include/trace/events/ext4.h ++++ b/include/trace/events/ext4.h +@@ -746,24 +746,29 @@ TRACE_EVENT(ext4_mb_release_group_pa, + ); + + TRACE_EVENT(ext4_discard_preallocations, +- TP_PROTO(struct inode *inode), ++ TP_PROTO(struct inode *inode, unsigned int len, unsigned int needed), + +- TP_ARGS(inode), ++ TP_ARGS(inode, len, needed), + + TP_STRUCT__entry( +- __field( dev_t, dev ) +- __field( ino_t, ino ) ++ __field( dev_t, dev ) ++ __field( ino_t, ino ) ++ __field( unsigned int, len ) ++ __field( unsigned int, needed ) + + ), + + TP_fast_assign( + __entry->dev = inode->i_sb->s_dev; + __entry->ino = inode->i_ino; ++ __entry->len = len; ++ __entry->needed = needed; + ), + +- TP_printk("dev %d,%d ino %lu", ++ TP_printk("dev %d,%d ino %lu len: %u needed %u", + MAJOR(__entry->dev), MINOR(__entry->dev), +- (unsigned long) __entry->ino) ++ (unsigned long) __entry->ino, __entry->len, ++ __entry->needed) + ); + + TRACE_EVENT(ext4_mb_discard_preallocations, +-- +2.25.1 + diff --git a/queue-5.8/ext4-skip-non-loaded-groups-at-cr-0-1-when-scanning-.patch b/queue-5.8/ext4-skip-non-loaded-groups-at-cr-0-1-when-scanning-.patch new file mode 100644 index 00000000000..0518a30400a --- /dev/null +++ b/queue-5.8/ext4-skip-non-loaded-groups-at-cr-0-1-when-scanning-.patch @@ -0,0 +1,76 @@ +From 0b4218e04f611ac5aa132b8e69fc6251d013c1e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jun 2020 22:08:56 -0400 +Subject: ext4: skip non-loaded groups at cr=0/1 when scanning for good groups + +From: Alex Zhuravlev + +[ Upstream commit c1d2c7d47e15482bb23cda83a5021e60f624a09c ] + +cr=0 is supposed to be an optimization to save CPU cycles, but if +buddy data (in memory) is not initialized then all this makes no sense +as we have to do sync IO taking a lot of cycles. Also, at cr=0 +mballoc doesn't choose any available chunk. cr=1 also skips groups +using heuristic based on avg. fragment size. It's more useful to skip +such groups and switch to cr=2 where groups will be scanned for +available chunks. However, we always read the first block group in a +flex_bg so metadata blocks will get read into the first flex_bg if +possible. + +Using sparse image and dm-slow virtual device of 120TB was +simulated, then the image was formatted and filled using debugfs to +mark ~85% of available space as busy. mount process w/o the patch +couldn't complete in half an hour (according to vmstat it would take +~10-11 hours). With the patch applied mount took ~20 seconds. + +Lustre-bug-id: https://jira.whamcloud.com/browse/LU-12988 +Signed-off-by: Alex Zhuravlev +Reviewed-by: Andreas Dilger +Reviewed-by: Artem Blagodarenko +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 21 ++++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 38719c156573c..ba5371b35b09e 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -2177,6 +2177,7 @@ static int ext4_mb_good_group_nolock(struct ext4_allocation_context *ac, + { + struct ext4_group_info *grp = ext4_get_group_info(ac->ac_sb, group); + struct super_block *sb = ac->ac_sb; ++ struct ext4_sb_info *sbi = EXT4_SB(sb); + bool should_lock = ac->ac_flags & EXT4_MB_STRICT_CHECK; + ext4_grpblk_t free; + int ret = 0; +@@ -2195,7 +2196,25 @@ static int ext4_mb_good_group_nolock(struct ext4_allocation_context *ac, + + /* We only do this if the grp has never been initialized */ + if (unlikely(EXT4_MB_GRP_NEED_INIT(grp))) { +- ret = ext4_mb_init_group(ac->ac_sb, group, GFP_NOFS); ++ struct ext4_group_desc *gdp = ++ ext4_get_group_desc(sb, group, NULL); ++ int ret; ++ ++ /* cr=0/1 is a very optimistic search to find large ++ * good chunks almost for free. If buddy data is not ++ * ready, then this optimization makes no sense. But ++ * we never skip the first block group in a flex_bg, ++ * since this gets used for metadata block allocation, ++ * and we want to make sure we locate metadata blocks ++ * in the first block group in the flex_bg if possible. ++ */ ++ if (cr < 2 && ++ (!sbi->s_log_groups_per_flex || ++ ((group & ((1 << sbi->s_log_groups_per_flex) - 1)) != 0)) && ++ !(ext4_has_group_desc_csum(sb) && ++ (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)))) ++ return 0; ++ ret = ext4_mb_init_group(sb, group, GFP_NOFS); + if (ret) + return ret; + } +-- +2.25.1 + diff --git a/queue-5.8/fs-prevent-bug_on-in-submit_bh_wbc.patch b/queue-5.8/fs-prevent-bug_on-in-submit_bh_wbc.patch new file mode 100644 index 00000000000..fa0b2574c15 --- /dev/null +++ b/queue-5.8/fs-prevent-bug_on-in-submit_bh_wbc.patch @@ -0,0 +1,131 @@ +From 210597e4f50ed3240f899f8a0c102323567d92f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jul 2020 12:10:25 -0400 +Subject: fs: prevent BUG_ON in submit_bh_wbc() + +From: Xianting Tian + +[ Upstream commit 377254b2cd2252c7c3151b113cbdf93a7736c2e9 ] + +If a device is hot-removed --- for example, when a physical device is +unplugged from pcie slot or a nbd device's network is shutdown --- +this can result in a BUG_ON() crash in submit_bh_wbc(). This is +because the when the block device dies, the buffer heads will have +their Buffer_Mapped flag get cleared, leading to the crash in +submit_bh_wbc. + +We had attempted to work around this problem in commit a17712c8 +("ext4: check superblock mapped prior to committing"). Unfortunately, +it's still possible to hit the BUG_ON(!buffer_mapped(bh)) if the +device dies between when the work-around check in ext4_commit_super() +and when submit_bh_wbh() is finally called: + +Code path: +ext4_commit_super + judge if 'buffer_mapped(sbh)' is false, return <== commit a17712c8 + lock_buffer(sbh) + ... + unlock_buffer(sbh) + __sync_dirty_buffer(sbh,... + lock_buffer(sbh) + judge if 'buffer_mapped(sbh))' is false, return <== added by this patch + submit_bh(...,sbh) + submit_bh_wbc(...,sbh,...) + +[100722.966497] kernel BUG at fs/buffer.c:3095! <== BUG_ON(!buffer_mapped(bh))' in submit_bh_wbc() +[100722.966503] invalid opcode: 0000 [#1] SMP +[100722.966566] task: ffff8817e15a9e40 task.stack: ffffc90024744000 +[100722.966574] RIP: 0010:submit_bh_wbc+0x180/0x190 +[100722.966575] RSP: 0018:ffffc90024747a90 EFLAGS: 00010246 +[100722.966576] RAX: 0000000000620005 RBX: ffff8818a80603a8 RCX: 0000000000000000 +[100722.966576] RDX: ffff8818a80603a8 RSI: 0000000000020800 RDI: 0000000000000001 +[100722.966577] RBP: ffffc90024747ac0 R08: 0000000000000000 R09: ffff88207f94170d +[100722.966578] R10: 00000000000437c8 R11: 0000000000000001 R12: 0000000000020800 +[100722.966578] R13: 0000000000000001 R14: 000000000bf9a438 R15: ffff88195f333000 +[100722.966580] FS: 00007fa2eee27700(0000) GS:ffff88203d840000(0000) knlGS:0000000000000000 +[100722.966580] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[100722.966581] CR2: 0000000000f0b008 CR3: 000000201a622003 CR4: 00000000007606e0 +[100722.966582] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[100722.966583] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[100722.966583] PKRU: 55555554 +[100722.966583] Call Trace: +[100722.966588] __sync_dirty_buffer+0x6e/0xd0 +[100722.966614] ext4_commit_super+0x1d8/0x290 [ext4] +[100722.966626] __ext4_std_error+0x78/0x100 [ext4] +[100722.966635] ? __ext4_journal_get_write_access+0xca/0x120 [ext4] +[100722.966646] ext4_reserve_inode_write+0x58/0xb0 [ext4] +[100722.966655] ? ext4_dirty_inode+0x48/0x70 [ext4] +[100722.966663] ext4_mark_inode_dirty+0x53/0x1e0 [ext4] +[100722.966671] ? __ext4_journal_start_sb+0x6d/0xf0 [ext4] +[100722.966679] ext4_dirty_inode+0x48/0x70 [ext4] +[100722.966682] __mark_inode_dirty+0x17f/0x350 +[100722.966686] generic_update_time+0x87/0xd0 +[100722.966687] touch_atime+0xa9/0xd0 +[100722.966690] generic_file_read_iter+0xa09/0xcd0 +[100722.966694] ? page_cache_tree_insert+0xb0/0xb0 +[100722.966704] ext4_file_read_iter+0x4a/0x100 [ext4] +[100722.966707] ? __inode_security_revalidate+0x4f/0x60 +[100722.966709] __vfs_read+0xec/0x160 +[100722.966711] vfs_read+0x8c/0x130 +[100722.966712] SyS_pread64+0x87/0xb0 +[100722.966716] do_syscall_64+0x67/0x1b0 +[100722.966719] entry_SYSCALL64_slow_path+0x25/0x25 + +To address this, add the check of 'buffer_mapped(bh)' to +__sync_dirty_buffer(). This also has the benefit of fixing this for +other file systems. + +With this addition, we can drop the workaround in ext4_commit_supper(). + +[ Commit description rewritten by tytso. ] + +Signed-off-by: Xianting Tian +Link: https://lore.kernel.org/r/1596211825-8750-1-git-send-email-xianting_tian@126.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/buffer.c | 9 +++++++++ + fs/ext4/super.c | 7 ------- + 2 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/fs/buffer.c b/fs/buffer.c +index 64fe82ec65ff1..75a8849abb5d2 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -3160,6 +3160,15 @@ int __sync_dirty_buffer(struct buffer_head *bh, int op_flags) + WARN_ON(atomic_read(&bh->b_count) < 1); + lock_buffer(bh); + if (test_clear_buffer_dirty(bh)) { ++ /* ++ * The bh should be mapped, but it might not be if the ++ * device was hot-removed. Not much we can do but fail the I/O. ++ */ ++ if (!buffer_mapped(bh)) { ++ unlock_buffer(bh); ++ return -EIO; ++ } ++ + get_bh(bh); + bh->b_end_io = end_buffer_write_sync; + ret = submit_bh(REQ_OP_WRITE, op_flags, bh); +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 4c8253188d8df..f3614299ffd09 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -5204,13 +5204,6 @@ static int ext4_commit_super(struct super_block *sb, int sync) + if (!sbh || block_device_ejected(sb)) + return error; + +- /* +- * The superblock bh should be mapped, but it might not be if the +- * device was hot-removed. Not much we can do but fail the I/O. +- */ +- if (!buffer_mapped(sbh)) +- return error; +- + /* + * If the file system is mounted read-only, don't update the + * superblock write time. This avoids updating the superblock +-- +2.25.1 + diff --git a/queue-5.8/habanalabs-fix-memory-corruption-in-debugfs.patch b/queue-5.8/habanalabs-fix-memory-corruption-in-debugfs.patch new file mode 100644 index 00000000000..1c2d91debf9 --- /dev/null +++ b/queue-5.8/habanalabs-fix-memory-corruption-in-debugfs.patch @@ -0,0 +1,64 @@ +From e6f558a30ca0caa3452deb76c01547cea2dd7c43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Aug 2020 17:36:36 +0300 +Subject: habanalabs: Fix memory corruption in debugfs + +From: Dan Carpenter + +[ Upstream commit eeec23cd325ad4d83927b8ee162693579cf3813f ] + +This has to be a long instead of a u32 because we write a long value. +On 64 bit systems, this will cause memory corruption. + +Fixes: c216477363a3 ("habanalabs: add debugfs support") +Signed-off-by: Dan Carpenter +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/misc/habanalabs/debugfs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/misc/habanalabs/debugfs.c b/drivers/misc/habanalabs/debugfs.c +index 0bc036e01ee8d..6c2b9cf45e831 100644 +--- a/drivers/misc/habanalabs/debugfs.c ++++ b/drivers/misc/habanalabs/debugfs.c +@@ -19,7 +19,7 @@ + static struct dentry *hl_debug_root; + + static int hl_debugfs_i2c_read(struct hl_device *hdev, u8 i2c_bus, u8 i2c_addr, +- u8 i2c_reg, u32 *val) ++ u8 i2c_reg, long *val) + { + struct armcp_packet pkt; + int rc; +@@ -36,7 +36,7 @@ static int hl_debugfs_i2c_read(struct hl_device *hdev, u8 i2c_bus, u8 i2c_addr, + pkt.i2c_reg = i2c_reg; + + rc = hdev->asic_funcs->send_cpu_message(hdev, (u32 *) &pkt, sizeof(pkt), +- 0, (long *) val); ++ 0, val); + + if (rc) + dev_err(hdev->dev, "Failed to read from I2C, error %d\n", rc); +@@ -827,7 +827,7 @@ static ssize_t hl_i2c_data_read(struct file *f, char __user *buf, + struct hl_dbg_device_entry *entry = file_inode(f)->i_private; + struct hl_device *hdev = entry->hdev; + char tmp_buf[32]; +- u32 val; ++ long val; + ssize_t rc; + + if (*ppos) +@@ -842,7 +842,7 @@ static ssize_t hl_i2c_data_read(struct file *f, char __user *buf, + return rc; + } + +- sprintf(tmp_buf, "0x%02x\n", val); ++ sprintf(tmp_buf, "0x%02lx\n", val); + rc = simple_read_from_buffer(buf, count, ppos, tmp_buf, + strlen(tmp_buf)); + +-- +2.25.1 + diff --git a/queue-5.8/hwmon-nct7904-correct-divide-by-0.patch b/queue-5.8/hwmon-nct7904-correct-divide-by-0.patch new file mode 100644 index 00000000000..f49401c6efe --- /dev/null +++ b/queue-5.8/hwmon-nct7904-correct-divide-by-0.patch @@ -0,0 +1,63 @@ +From 4d7b4d288cade7c7f58f13346cbfd4d2aaa0d9f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 12:20:14 -0400 +Subject: hwmon: (nct7904) Correct divide by 0 + +From: Jason Baron + +[ Upstream commit 8aebbbb2d573d0b4afc08b90ac7d73dba2d9da97 ] + +We hit a kernel panic due to a divide by 0 in nct7904_read_fan() for +the hwmon_fan_min case. Extend the check to hwmon_fan_input case as well +for safety. + +[ 1656.545650] divide error: 0000 [#1] SMP PTI +[ 1656.545779] CPU: 12 PID: 18010 Comm: sensors Not tainted 5.4.47 #1 +[ 1656.546065] RIP: 0010:nct7904_read+0x1e9/0x510 [nct7904] +... +[ 1656.546549] RAX: 0000000000149970 RBX: ffffbd6b86bcbe08 RCX: 0000000000000000 +... +[ 1656.547548] Call Trace: +[ 1656.547665] hwmon_attr_show+0x32/0xd0 [hwmon] +[ 1656.547783] dev_attr_show+0x18/0x50 +[ 1656.547898] sysfs_kf_seq_show+0x99/0x120 +[ 1656.548013] seq_read+0xd8/0x3e0 +[ 1656.548127] vfs_read+0x89/0x130 +[ 1656.548234] ksys_read+0x7d/0xb0 +[ 1656.548342] do_syscall_64+0x48/0x110 +[ 1656.548451] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fixes: d65a5102a99f5 ("hwmon: (nct7904) Convert to use new hwmon registration API") +Signed-off-by: Jason Baron +Link: https://lore.kernel.org/r/1598026814-2604-1-git-send-email-jbaron@akamai.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/nct7904.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/nct7904.c b/drivers/hwmon/nct7904.c +index b0425694f7022..242ff8bee78dd 100644 +--- a/drivers/hwmon/nct7904.c ++++ b/drivers/hwmon/nct7904.c +@@ -231,7 +231,7 @@ static int nct7904_read_fan(struct device *dev, u32 attr, int channel, + if (ret < 0) + return ret; + cnt = ((ret & 0xff00) >> 3) | (ret & 0x1f); +- if (cnt == 0x1fff) ++ if (cnt == 0 || cnt == 0x1fff) + rpm = 0; + else + rpm = 1350000 / cnt; +@@ -243,7 +243,7 @@ static int nct7904_read_fan(struct device *dev, u32 attr, int channel, + if (ret < 0) + return ret; + cnt = ((ret & 0xff00) >> 3) | (ret & 0x1f); +- if (cnt == 0x1fff) ++ if (cnt == 0 || cnt == 0x1fff) + rpm = 0; + else + rpm = 1350000 / cnt; +-- +2.25.1 + diff --git a/queue-5.8/i2c-core-don-t-fail-prp0001-enumeration-when-no-id-t.patch b/queue-5.8/i2c-core-don-t-fail-prp0001-enumeration-when-no-id-t.patch new file mode 100644 index 00000000000..f2075365a5e --- /dev/null +++ b/queue-5.8/i2c-core-don-t-fail-prp0001-enumeration-when-no-id-t.patch @@ -0,0 +1,47 @@ +From b92603b86c4e3ed68a699dc13e6d4de6ff5728c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 20:03:33 +0300 +Subject: i2c: core: Don't fail PRP0001 enumeration when no ID table exist +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Shevchenko + +[ Upstream commit e3cb82c6d6f6c27ab754e13ae29bdd6b949982e2 ] + +When commit c64ffff7a9d1 ("i2c: core: Allow empty id_table in ACPI case +as well") fixed the enumeration of I²C devices on ACPI enabled platforms +when driver has no ID table, it missed the PRP0001 support. + +i2c_device_match() and i2c_acpi_match_device() differently match +driver against given device. Use acpi_driver_match_device(), that is used +in the former, in i2c_device_probe() and don't fail PRP0001 enumeration +when no ID table exist. + +Fixes: c64ffff7a9d1 ("i2c: core: Allow empty id_table in ACPI case as well") +BugLink: https://stackoverflow.com/q/63519678/2511795 +Signed-off-by: Andy Shevchenko +Reviewed-by: Mika Westerberg +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-core-base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c +index 26f03a14a4781..4f09d4c318287 100644 +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -354,7 +354,7 @@ static int i2c_device_probe(struct device *dev) + * or ACPI ID table is supplied for the probing device. + */ + if (!driver->id_table && +- !i2c_acpi_match_device(dev->driver->acpi_match_table, client) && ++ !acpi_driver_match_device(dev, dev->driver) && + !i2c_of_match_device(dev->driver->of_match_table, client)) { + status = -ENODEV; + goto put_sync_adapter; +-- +2.25.1 + diff --git a/queue-5.8/i2c-rcar-in-slave-mode-clear-nack-earlier.patch b/queue-5.8/i2c-rcar-in-slave-mode-clear-nack-earlier.patch new file mode 100644 index 00000000000..1834684d913 --- /dev/null +++ b/queue-5.8/i2c-rcar-in-slave-mode-clear-nack-earlier.patch @@ -0,0 +1,38 @@ +From 0ca52cf2847e44fb9dcafec224a178cb0e0bcd03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 14:19:30 +0200 +Subject: i2c: rcar: in slave mode, clear NACK earlier + +From: Wolfram Sang + +[ Upstream commit 914a7b3563b8fb92f976619bbd0fa3a4a708baae ] + +Currently, a NACK in slave mode is set/cleared when SCL is held low by +the IP core right before the bit is about to be pushed out. This is too +late for clearing and then a NACK from the previous byte is still used +for the current one. Now, let's clear the NACK right after we detected +the STOP condition following the NACK. + +Fixes: de20d1857dd6 ("i2c: rcar: add slave support") +Signed-off-by: Wolfram Sang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 9e883474db8ce..c7c543483b08c 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -590,6 +590,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + /* master sent stop */ + if (ssr_filtered & SSR) { + i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); ++ rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */ + rcar_i2c_write(priv, ICSIER, SAR); + rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); + } +-- +2.25.1 + diff --git a/queue-5.8/jbd2-abort-journal-if-free-a-async-write-error-metad.patch b/queue-5.8/jbd2-abort-journal-if-free-a-async-write-error-metad.patch new file mode 100644 index 00000000000..3b8ba21abcc --- /dev/null +++ b/queue-5.8/jbd2-abort-journal-if-free-a-async-write-error-metad.patch @@ -0,0 +1,66 @@ +From b4b0cb6240a6e1973db3f3205f81c33d3277cad8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Jun 2020 10:54:26 +0800 +Subject: jbd2: abort journal if free a async write error metadata buffer + +From: zhangyi (F) + +[ Upstream commit c044f3d8360d2ecf831ba2cc9f08cf9fb2c699fb ] + +If we free a metadata buffer which has been failed to async write out +in the background, the jbd2 checkpoint procedure will not detect this +failure in jbd2_log_do_checkpoint(), so it may lead to filesystem +inconsistency after cleanup journal tail. This patch abort the journal +if free a buffer has write_io_error flag to prevent potential further +inconsistency. + +Signed-off-by: zhangyi (F) +Link: https://lore.kernel.org/r/20200620025427.1756360-5-yi.zhang@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/transaction.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index e65e0aca28261..6250c9faa4cbe 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -2120,6 +2120,7 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, + { + struct buffer_head *head; + struct buffer_head *bh; ++ bool has_write_io_error = false; + int ret = 0; + + J_ASSERT(PageLocked(page)); +@@ -2144,11 +2145,26 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, + jbd2_journal_put_journal_head(jh); + if (buffer_jbd(bh)) + goto busy; ++ ++ /* ++ * If we free a metadata buffer which has been failed to ++ * write out, the jbd2 checkpoint procedure will not detect ++ * this failure and may lead to filesystem inconsistency ++ * after cleanup journal tail. ++ */ ++ if (buffer_write_io_error(bh)) { ++ pr_err("JBD2: Error while async write back metadata bh %llu.", ++ (unsigned long long)bh->b_blocknr); ++ has_write_io_error = true; ++ } + } while ((bh = bh->b_this_page) != head); + + ret = try_to_free_buffers(page); + + busy: ++ if (has_write_io_error) ++ jbd2_journal_abort(journal, -EIO); ++ + return ret; + } + +-- +2.25.1 + diff --git a/queue-5.8/jbd2-make-sure-jh-have-b_transaction-set-in-refile-u.patch b/queue-5.8/jbd2-make-sure-jh-have-b_transaction-set-in-refile-u.patch new file mode 100644 index 00000000000..fd7a1e669ae --- /dev/null +++ b/queue-5.8/jbd2-make-sure-jh-have-b_transaction-set-in-refile-u.patch @@ -0,0 +1,62 @@ +From 978725ff0ee3754485d589001655ea2812657d9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 11:25:49 +0200 +Subject: jbd2: make sure jh have b_transaction set in refile/unfile_buffer + +From: Lukas Czerner + +[ Upstream commit 24dc9864914eb5813173cfa53313fcd02e4aea7d ] + +Callers of __jbd2_journal_unfile_buffer() and +__jbd2_journal_refile_buffer() assume that the b_transaction is set. In +fact if it's not, we can end up with journal_head refcounting errors +leading to crash much later that might be very hard to track down. Add +asserts to make sure that is the case. + +We also make sure that b_next_transaction is NULL in +__jbd2_journal_unfile_buffer() since the callers expect that as well and +we should not get into that stage in this state anyway, leading to +problems later on if we do. + +Tested with fstests. + +Signed-off-by: Lukas Czerner +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20200617092549.6712-1-lczerner@redhat.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/transaction.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index e91aad3637a23..e65e0aca28261 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -2026,6 +2026,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh) + */ + static void __jbd2_journal_unfile_buffer(struct journal_head *jh) + { ++ J_ASSERT_JH(jh, jh->b_transaction != NULL); ++ J_ASSERT_JH(jh, jh->b_next_transaction == NULL); ++ + __jbd2_journal_temp_unlink_buffer(jh); + jh->b_transaction = NULL; + } +@@ -2572,6 +2575,13 @@ bool __jbd2_journal_refile_buffer(struct journal_head *jh) + + was_dirty = test_clear_buffer_jbddirty(bh); + __jbd2_journal_temp_unlink_buffer(jh); ++ ++ /* ++ * b_transaction must be set, otherwise the new b_transaction won't ++ * be holding jh reference ++ */ ++ J_ASSERT_JH(jh, jh->b_transaction != NULL); ++ + /* + * We set b_transaction here because b_next_transaction will inherit + * our jh reference and thus __jbd2_journal_file_buffer() must not +-- +2.25.1 + diff --git a/queue-5.8/libbpf-fix-map-index-used-in-error-message.patch b/queue-5.8/libbpf-fix-map-index-used-in-error-message.patch new file mode 100644 index 00000000000..ecda64bed7b --- /dev/null +++ b/queue-5.8/libbpf-fix-map-index-used-in-error-message.patch @@ -0,0 +1,40 @@ +From db9940e83d34f1d40f255b1c6197719862aac7b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 13:05:34 +0200 +Subject: libbpf: Fix map index used in error message +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 1e891e513e16c145cc9b45b1fdb8bf4a4f2f9557 ] + +The error message emitted by bpf_object__init_user_btf_maps() was using the +wrong section ID. + +Signed-off-by: Toke Høiland-Jørgensen +Signed-off-by: Daniel Borkmann +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20200819110534.9058-1-toke@redhat.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index e0b88f0013b74..3ac0094706b81 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -2237,7 +2237,7 @@ static int bpf_object__init_user_btf_maps(struct bpf_object *obj, bool strict, + data = elf_getdata(scn, NULL); + if (!scn || !data) { + pr_warn("failed to get Elf_Data from map section %d (%s)\n", +- obj->efile.maps_shndx, MAPS_ELF_SEC); ++ obj->efile.btf_maps_shndx, MAPS_ELF_SEC); + return -EINVAL; + } + +-- +2.25.1 + diff --git a/queue-5.8/libbpf-handle-gcc-built-in-types-for-arm-neon.patch b/queue-5.8/libbpf-handle-gcc-built-in-types-for-arm-neon.patch new file mode 100644 index 00000000000..7b1284a97b0 --- /dev/null +++ b/queue-5.8/libbpf-handle-gcc-built-in-types-for-arm-neon.patch @@ -0,0 +1,115 @@ +From 168c6f37311efaf29d9a789ce4e8249a362a1bd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Aug 2020 16:39:10 +0200 +Subject: libbpf: Handle GCC built-in types for Arm NEON + +From: Jean-Philippe Brucker + +[ Upstream commit 702eddc77a905782083b14ccd05b23840675fd18 ] + +When building Arm NEON (SIMD) code from lib/raid6/neon.uc, GCC emits +DWARF information using a base type "__Poly8_t", which is internal to +GCC and not recognized by Clang. This causes build failures when +building with Clang a vmlinux.h generated from an arm64 kernel that was +built with GCC. + + vmlinux.h:47284:9: error: unknown type name '__Poly8_t' + typedef __Poly8_t poly8x16_t[16]; + ^~~~~~~~~ + +The polyX_t types are defined as unsigned integers in the "Arm C +Language Extension" document (101028_Q220_00_en). Emit typedefs based on +standard integer types for the GCC internal types, similar to those +emitted by Clang. + +Including linux/kernel.h to use ARRAY_SIZE() incidentally redefined +max(), causing a build bug due to different types, hence the seemingly +unrelated change. + +Reported-by: Jakov Petrina +Signed-off-by: Jean-Philippe Brucker +Signed-off-by: Alexei Starovoitov +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20200812143909.3293280-1-jean-philippe@linaro.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/btf_dump.c | 35 ++++++++++++++++++++++++++++++++++- + 1 file changed, 34 insertions(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c +index bbb4303172606..4edf76c5a7101 100644 +--- a/tools/lib/bpf/btf_dump.c ++++ b/tools/lib/bpf/btf_dump.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include "btf.h" + #include "hashmap.h" + #include "libbpf.h" +@@ -548,6 +549,9 @@ static int btf_dump_order_type(struct btf_dump *d, __u32 id, bool through_ptr) + } + } + ++static void btf_dump_emit_missing_aliases(struct btf_dump *d, __u32 id, ++ const struct btf_type *t); ++ + static void btf_dump_emit_struct_fwd(struct btf_dump *d, __u32 id, + const struct btf_type *t); + static void btf_dump_emit_struct_def(struct btf_dump *d, __u32 id, +@@ -670,6 +674,9 @@ static void btf_dump_emit_type(struct btf_dump *d, __u32 id, __u32 cont_id) + + switch (kind) { + case BTF_KIND_INT: ++ /* Emit type alias definitions if necessary */ ++ btf_dump_emit_missing_aliases(d, id, t); ++ + tstate->emit_state = EMITTED; + break; + case BTF_KIND_ENUM: +@@ -869,7 +876,7 @@ static void btf_dump_emit_struct_def(struct btf_dump *d, + btf_dump_printf(d, ": %d", m_sz); + off = m_off + m_sz; + } else { +- m_sz = max(0, btf__resolve_size(d->btf, m->type)); ++ m_sz = max(0LL, btf__resolve_size(d->btf, m->type)); + off = m_off + m_sz * 8; + } + btf_dump_printf(d, ";"); +@@ -889,6 +896,32 @@ static void btf_dump_emit_struct_def(struct btf_dump *d, + btf_dump_printf(d, " __attribute__((packed))"); + } + ++static const char *missing_base_types[][2] = { ++ /* ++ * GCC emits typedefs to its internal __PolyX_t types when compiling Arm ++ * SIMD intrinsics. Alias them to standard base types. ++ */ ++ { "__Poly8_t", "unsigned char" }, ++ { "__Poly16_t", "unsigned short" }, ++ { "__Poly64_t", "unsigned long long" }, ++ { "__Poly128_t", "unsigned __int128" }, ++}; ++ ++static void btf_dump_emit_missing_aliases(struct btf_dump *d, __u32 id, ++ const struct btf_type *t) ++{ ++ const char *name = btf_dump_type_name(d, id); ++ int i; ++ ++ for (i = 0; i < ARRAY_SIZE(missing_base_types); i++) { ++ if (strcmp(name, missing_base_types[i][0]) == 0) { ++ btf_dump_printf(d, "typedef %s %s;\n\n", ++ missing_base_types[i][1], name); ++ break; ++ } ++ } ++} ++ + static void btf_dump_emit_enum_fwd(struct btf_dump *d, __u32 id, + const struct btf_type *t) + { +-- +2.25.1 + diff --git a/queue-5.8/libbpf-prevent-overriding-errno-when-logging-errors.patch b/queue-5.8/libbpf-prevent-overriding-errno-when-logging-errors.patch new file mode 100644 index 00000000000..31eb2f8e081 --- /dev/null +++ b/queue-5.8/libbpf-prevent-overriding-errno-when-logging-errors.patch @@ -0,0 +1,60 @@ +From 391a03461ada510c5c97b01a50027da1c54b4d01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Aug 2020 16:29:05 +0200 +Subject: libbpf: Prevent overriding errno when logging errors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 23ab656be263813acc3c20623757d3cd1496d9e1 ] + +Turns out there were a few more instances where libbpf didn't save the +errno before writing an error message, causing errno to be overridden by +the printf() return and the error disappearing if logging is enabled. + +Signed-off-by: Toke Høiland-Jørgensen +Signed-off-by: Daniel Borkmann +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20200813142905.160381-1-toke@redhat.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index e7642a6e39f9e..e0b88f0013b74 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -3319,10 +3319,11 @@ bpf_object__probe_global_data(struct bpf_object *obj) + + map = bpf_create_map_xattr(&map_attr); + if (map < 0) { +- cp = libbpf_strerror_r(errno, errmsg, sizeof(errmsg)); ++ ret = -errno; ++ cp = libbpf_strerror_r(ret, errmsg, sizeof(errmsg)); + pr_warn("Error in %s():%s(%d). Couldn't create simple array map.\n", +- __func__, cp, errno); +- return -errno; ++ __func__, cp, -ret); ++ return ret; + } + + insns[0].imm = map; +@@ -5779,9 +5780,10 @@ int bpf_program__pin_instance(struct bpf_program *prog, const char *path, + } + + if (bpf_obj_pin(prog->instances.fds[instance], path)) { +- cp = libbpf_strerror_r(errno, errmsg, sizeof(errmsg)); ++ err = -errno; ++ cp = libbpf_strerror_r(err, errmsg, sizeof(errmsg)); + pr_warn("failed to pin program: %s\n", cp); +- return -errno; ++ return err; + } + pr_debug("pinned program '%s'\n", path); + +-- +2.25.1 + diff --git a/queue-5.8/macvlan-validate-setting-of-multiple-remote-source-m.patch b/queue-5.8/macvlan-validate-setting-of-multiple-remote-source-m.patch new file mode 100644 index 00000000000..4d8dd235fab --- /dev/null +++ b/queue-5.8/macvlan-validate-setting-of-multiple-remote-source-m.patch @@ -0,0 +1,91 @@ +From d0558f7c8b64a8df5975dda46189a9041d0c4d65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 10:51:34 +0200 +Subject: macvlan: validate setting of multiple remote source MAC addresses +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alvin Šipraga + +[ Upstream commit 8b61fba503904acae24aeb2bd5569b4d6544d48f ] + +Remote source MAC addresses can be set on a 'source mode' macvlan +interface via the IFLA_MACVLAN_MACADDR_DATA attribute. This commit +tightens the validation of these MAC addresses to match the validation +already performed when setting or adding a single MAC address via the +IFLA_MACVLAN_MACADDR attribute. + +iproute2 uses IFLA_MACVLAN_MACADDR_DATA for its 'macvlan macaddr set' +command, and IFLA_MACVLAN_MACADDR for its 'macvlan macaddr add' command, +which demonstrates the inconsistent behaviour that this commit +addresses: + + # ip link add link eth0 name macvlan0 type macvlan mode source + # ip link set link dev macvlan0 type macvlan macaddr add 01:00:00:00:00:00 + RTNETLINK answers: Cannot assign requested address + # ip link set link dev macvlan0 type macvlan macaddr set 01:00:00:00:00:00 + # ip -d link show macvlan0 + 5: macvlan0@eth0: mtu 1500 ... + link/ether 2e:ac:fd:2d:69:f8 brd ff:ff:ff:ff:ff:ff promiscuity 0 + macvlan mode source remotes (1) 01:00:00:00:00:00 numtxqueues 1 ... + +With this change, the 'set' command will (rightly) fail in the same way +as the 'add' command. + +Signed-off-by: Alvin Šipraga +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/macvlan.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 4942f6112e51f..5da04e9979894 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -1269,6 +1269,9 @@ static void macvlan_port_destroy(struct net_device *dev) + static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[], + struct netlink_ext_ack *extack) + { ++ struct nlattr *nla, *head; ++ int rem, len; ++ + if (tb[IFLA_ADDRESS]) { + if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN) + return -EINVAL; +@@ -1316,6 +1319,20 @@ static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[], + return -EADDRNOTAVAIL; + } + ++ if (data[IFLA_MACVLAN_MACADDR_DATA]) { ++ head = nla_data(data[IFLA_MACVLAN_MACADDR_DATA]); ++ len = nla_len(data[IFLA_MACVLAN_MACADDR_DATA]); ++ ++ nla_for_each_attr(nla, head, len, rem) { ++ if (nla_type(nla) != IFLA_MACVLAN_MACADDR || ++ nla_len(nla) != ETH_ALEN) ++ return -EINVAL; ++ ++ if (!is_valid_ether_addr(nla_data(nla))) ++ return -EADDRNOTAVAIL; ++ } ++ } ++ + if (data[IFLA_MACVLAN_MACADDR_COUNT]) + return -EINVAL; + +@@ -1372,10 +1389,6 @@ static int macvlan_changelink_sources(struct macvlan_dev *vlan, u32 mode, + len = nla_len(data[IFLA_MACVLAN_MACADDR_DATA]); + + nla_for_each_attr(nla, head, len, rem) { +- if (nla_type(nla) != IFLA_MACVLAN_MACADDR || +- nla_len(nla) != ETH_ALEN) +- continue; +- + addr = nla_data(nla); + ret = macvlan_hash_add_source(vlan, addr); + if (ret) +-- +2.25.1 + diff --git a/queue-5.8/net-gianfar-add-of_node_put-before-goto-statement.patch b/queue-5.8/net-gianfar-add-of_node_put-before-goto-statement.patch new file mode 100644 index 00000000000..bafa5a504fd --- /dev/null +++ b/queue-5.8/net-gianfar-add-of_node_put-before-goto-statement.patch @@ -0,0 +1,46 @@ +From c342ceb0fb775302026fe876afafc7c7cbc8e2a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 00:22:41 +0530 +Subject: net: gianfar: Add of_node_put() before goto statement + +From: Sumera Priyadarsini + +[ Upstream commit 989e4da042ca4a56bbaca9223d1a93639ad11e17 ] + +Every iteration of for_each_available_child_of_node() decrements +reference count of the previous node, however when control +is transferred from the middle of the loop, as in the case of +a return or break or goto, there is no decrement thus ultimately +resulting in a memory leak. + +Fix a potential memory leak in gianfar.c by inserting of_node_put() +before the goto statement. + +Issue found with Coccinelle. + +Signed-off-by: Sumera Priyadarsini +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/gianfar.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c +index b513b8c5c3b5e..41dd3d0f34524 100644 +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -750,8 +750,10 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev) + continue; + + err = gfar_parse_group(child, priv, model); +- if (err) ++ if (err) { ++ of_node_put(child); + goto err_grp_init; ++ } + } + } else { /* SQ_SG_MODE */ + err = gfar_parse_group(np, priv, model); +-- +2.25.1 + diff --git a/queue-5.8/netfilter-avoid-ipv6-nf_defrag_ipv6-module-dependenc.patch b/queue-5.8/netfilter-avoid-ipv6-nf_defrag_ipv6-module-dependenc.patch new file mode 100644 index 00000000000..2ace29b089e --- /dev/null +++ b/queue-5.8/netfilter-avoid-ipv6-nf_defrag_ipv6-module-dependenc.patch @@ -0,0 +1,119 @@ +From 4cdee1d8276a5f236079fd1a550112fae242ad59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 13:52:15 +0200 +Subject: netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency + +From: Florian Westphal + +[ Upstream commit 2404b73c3f1a5f15726c6ecd226b56f6f992767f ] + +nf_ct_frag6_gather is part of nf_defrag_ipv6.ko, not ipv6 core. + +The current use of the netfilter ipv6 stub indirections causes a module +dependency between ipv6 and nf_defrag_ipv6. + +This prevents nf_defrag_ipv6 module from being removed because ipv6 can't +be unloaded. + +Remove the indirection and always use a direct call. This creates a +depency from nf_conntrack_bridge to nf_defrag_ipv6 instead: + +modinfo nf_conntrack +depends: nf_conntrack,nf_defrag_ipv6,bridge + +.. and nf_conntrack already depends on nf_defrag_ipv6 anyway. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter_ipv6.h | 18 ------------------ + net/bridge/netfilter/nf_conntrack_bridge.c | 8 ++++++-- + net/ipv6/netfilter.c | 3 --- + 3 files changed, 6 insertions(+), 23 deletions(-) + +diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h +index aac42c28fe62d..9b67394471e1c 100644 +--- a/include/linux/netfilter_ipv6.h ++++ b/include/linux/netfilter_ipv6.h +@@ -58,7 +58,6 @@ struct nf_ipv6_ops { + int (*output)(struct net *, struct sock *, struct sk_buff *)); + int (*reroute)(struct sk_buff *skb, const struct nf_queue_entry *entry); + #if IS_MODULE(CONFIG_IPV6) +- int (*br_defrag)(struct net *net, struct sk_buff *skb, u32 user); + int (*br_fragment)(struct net *net, struct sock *sk, + struct sk_buff *skb, + struct nf_bridge_frag_data *data, +@@ -117,23 +116,6 @@ static inline int nf_ip6_route(struct net *net, struct dst_entry **dst, + + #include + +-static inline int nf_ipv6_br_defrag(struct net *net, struct sk_buff *skb, +- u32 user) +-{ +-#if IS_MODULE(CONFIG_IPV6) +- const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops(); +- +- if (!v6_ops) +- return 1; +- +- return v6_ops->br_defrag(net, skb, user); +-#elif IS_BUILTIN(CONFIG_IPV6) +- return nf_ct_frag6_gather(net, skb, user); +-#else +- return 1; +-#endif +-} +- + int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, + struct nf_bridge_frag_data *data, + int (*output)(struct net *, struct sock *sk, +diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c +index 8096732223828..8d033a75a766e 100644 +--- a/net/bridge/netfilter/nf_conntrack_bridge.c ++++ b/net/bridge/netfilter/nf_conntrack_bridge.c +@@ -168,6 +168,7 @@ static unsigned int nf_ct_br_defrag4(struct sk_buff *skb, + static unsigned int nf_ct_br_defrag6(struct sk_buff *skb, + const struct nf_hook_state *state) + { ++#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) + u16 zone_id = NF_CT_DEFAULT_ZONE_ID; + enum ip_conntrack_info ctinfo; + struct br_input_skb_cb cb; +@@ -180,14 +181,17 @@ static unsigned int nf_ct_br_defrag6(struct sk_buff *skb, + + br_skb_cb_save(skb, &cb, sizeof(struct inet6_skb_parm)); + +- err = nf_ipv6_br_defrag(state->net, skb, +- IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id); ++ err = nf_ct_frag6_gather(state->net, skb, ++ IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id); + /* queued */ + if (err == -EINPROGRESS) + return NF_STOLEN; + + br_skb_cb_restore(skb, &cb, IP6CB(skb)->frag_max_size); + return err == 0 ? NF_ACCEPT : NF_DROP; ++#else ++ return NF_ACCEPT; ++#endif + } + + static int nf_ct_br_ip_check(const struct sk_buff *skb) +diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c +index 409e79b84a830..6d0e942d082d4 100644 +--- a/net/ipv6/netfilter.c ++++ b/net/ipv6/netfilter.c +@@ -245,9 +245,6 @@ static const struct nf_ipv6_ops ipv6ops = { + .route_input = ip6_route_input, + .fragment = ip6_fragment, + .reroute = nf_ip6_reroute, +-#if IS_MODULE(CONFIG_IPV6) && IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) +- .br_defrag = nf_ct_frag6_gather, +-#endif + #if IS_MODULE(CONFIG_IPV6) + .br_fragment = br_ip6_fragment, + #endif +-- +2.25.1 + diff --git a/queue-5.8/nfsd-fix-oops-on-mixed-nfsv4-nfsv3-client-access.patch b/queue-5.8/nfsd-fix-oops-on-mixed-nfsv4-nfsv3-client-access.patch new file mode 100644 index 00000000000..724805bef60 --- /dev/null +++ b/queue-5.8/nfsd-fix-oops-on-mixed-nfsv4-nfsv3-client-access.patch @@ -0,0 +1,45 @@ +From 682c09b640b921bdb379b74bdf2df042771de11d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Aug 2020 15:10:11 -0400 +Subject: nfsd: fix oops on mixed NFSv4/NFSv3 client access + +From: J. Bruce Fields + +[ Upstream commit 34b09af4f54e6485e28f138ccad159611a240cc1 ] + +If an NFSv2/v3 client breaks an NFSv4 client's delegation, it will hit a +NULL dereference in nfsd_breaker_owns_lease(). + +Easily reproduceable with for example + + mount -overs=4.2 server:/export /mnt/ + sleep 1h +Fixes: 28df3d1539de50 ("nfsd: clients don't need to break their own delegations") +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208807 +Signed-off-by: J. Bruce Fields +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index c9056316a0b35..cea682ce8aa12 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -4597,6 +4597,8 @@ static bool nfsd_breaker_owns_lease(struct file_lock *fl) + if (!i_am_nfsd()) + return NULL; + rqst = kthread_data(current); ++ if (!rqst->rq_lease_breaker) ++ return NULL; + clp = *(rqst->rq_lease_breaker); + return dl->dl_stid.sc_client == clp; + } +-- +2.25.1 + diff --git a/queue-5.8/null_blk-fix-passing-of-req_fua-flag-in-null_handle_.patch b/queue-5.8/null_blk-fix-passing-of-req_fua-flag-in-null_handle_.patch new file mode 100644 index 00000000000..3d398e6dfbf --- /dev/null +++ b/queue-5.8/null_blk-fix-passing-of-req_fua-flag-in-null_handle_.patch @@ -0,0 +1,35 @@ +From ffbd18080f2dfc75585e8804be4b98b01f9ef90c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 04:34:42 -0400 +Subject: null_blk: fix passing of REQ_FUA flag in null_handle_rq + +From: Hou Pu + +[ Upstream commit 2d62e6b038e729c3e4bfbfcfbd44800ef0883680 ] + +REQ_FUA should be checked using rq->cmd_flags instead of req_op(). + +Fixes: deb78b419dfda ("nullb: emulate cache") +Signed-off-by: Hou Pu +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c +index 87b31f9ca362e..8cf13ea11cd2c 100644 +--- a/drivers/block/null_blk_main.c ++++ b/drivers/block/null_blk_main.c +@@ -1139,7 +1139,7 @@ static int null_handle_rq(struct nullb_cmd *cmd) + len = bvec.bv_len; + err = null_transfer(nullb, bvec.bv_page, len, bvec.bv_offset, + op_is_write(req_op(rq)), sector, +- req_op(rq) & REQ_FUA); ++ rq->cmd_flags & REQ_FUA); + if (err) { + spin_unlock_irq(&nullb->lock); + return err; +-- +2.25.1 + diff --git a/queue-5.8/nvme-fc-fix-wrong-return-value-in-__nvme_fc_init_req.patch b/queue-5.8/nvme-fc-fix-wrong-return-value-in-__nvme_fc_init_req.patch new file mode 100644 index 00000000000..3a93a5be276 --- /dev/null +++ b/queue-5.8/nvme-fc-fix-wrong-return-value-in-__nvme_fc_init_req.patch @@ -0,0 +1,49 @@ +From 27e10bb8ef20d84f1e4c917050998b84b0813e49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Aug 2020 19:15:45 +0800 +Subject: nvme-fc: Fix wrong return value in __nvme_fc_init_request() + +From: Tianjia Zhang + +[ Upstream commit f34448cd0dc697723fb5f4118f8431d9233b370d ] + +On an error exit path, a negative error code should be returned +instead of a positive return value. + +Fixes: e399441de9115 ("nvme-fabrics: Add host support for FC transport") +Cc: James Smart +Signed-off-by: Tianjia Zhang +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Christoph Hellwig +Signed-off-by: Sagi Grimberg +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 549f5b0fb0b4b..1a2b6910509ca 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -2076,7 +2076,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl, + if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.cmddma)) { + dev_err(ctrl->dev, + "FCP Op failed - cmdiu dma mapping failed.\n"); +- ret = EFAULT; ++ ret = -EFAULT; + goto out_on_error; + } + +@@ -2086,7 +2086,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl, + if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.rspdma)) { + dev_err(ctrl->dev, + "FCP Op failed - rspiu dma mapping failed.\n"); +- ret = EFAULT; ++ ret = -EFAULT; + } + + atomic_set(&op->state, FCPOP_STATE_IDLE); +-- +2.25.1 + diff --git a/queue-5.8/nvme-multipath-round-robin-fix-single-non-optimized-.patch b/queue-5.8/nvme-multipath-round-robin-fix-single-non-optimized-.patch new file mode 100644 index 00000000000..5341a11850a --- /dev/null +++ b/queue-5.8/nvme-multipath-round-robin-fix-single-non-optimized-.patch @@ -0,0 +1,55 @@ +From 40b5cda3f18ad2cffc3efcf3ae5169e7869813df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 15:19:31 +0200 +Subject: nvme: multipath: round-robin: fix single non-optimized path case + +From: Martin Wilck + +[ Upstream commit 93eb0381e13d249a18ed4aae203291ff977e7ffb ] + +If there's only one usable, non-optimized path, nvme_round_robin_path() +returns NULL, which is wrong. Fix it by falling back to "old", like in +the single optimized path case. Also, if the active path isn't changed, +there's no need to re-assign the pointer. + +Fixes: 3f6e3246db0e ("nvme-multipath: fix logic for non-optimized paths") +Signed-off-by: Martin Wilck +Signed-off-by: Martin George +Reviewed-by: Keith Busch +Signed-off-by: Sagi Grimberg +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/multipath.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 2672953233434..041a755f936a6 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -255,12 +255,17 @@ static struct nvme_ns *nvme_round_robin_path(struct nvme_ns_head *head, + fallback = ns; + } + +- /* No optimized path found, re-check the current path */ ++ /* ++ * The loop above skips the current path for round-robin semantics. ++ * Fall back to the current path if either: ++ * - no other optimized path found and current is optimized, ++ * - no other usable path found and current is usable. ++ */ + if (!nvme_path_is_disabled(old) && +- old->ana_state == NVME_ANA_OPTIMIZED) { +- found = old; +- goto out; +- } ++ (old->ana_state == NVME_ANA_OPTIMIZED || ++ (!fallback && old->ana_state == NVME_ANA_NONOPTIMIZED))) ++ return old; ++ + if (!fallback) + return NULL; + found = fallback; +-- +2.25.1 + diff --git a/queue-5.8/nvmet-fix-a-memory-leak.patch b/queue-5.8/nvmet-fix-a-memory-leak.patch new file mode 100644 index 00000000000..cbbaaad95c8 --- /dev/null +++ b/queue-5.8/nvmet-fix-a-memory-leak.patch @@ -0,0 +1,35 @@ +From 65c3b90a82c18b91e7a6bc1e510f67efe114d368 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jul 2020 11:51:00 -0700 +Subject: nvmet: fix a memory leak + +From: Sagi Grimberg + +[ Upstream commit 382fee1a8b623e2546a3e15e80517389e0e0673e ] + +We forgot to free new_model_number + +Fixes: 013b7ebe5a0d ("nvmet: make ctrl model configurable") +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Sagi Grimberg +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/configfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c +index 419e0d4ce79b1..d84b935704a3d 100644 +--- a/drivers/nvme/target/configfs.c ++++ b/drivers/nvme/target/configfs.c +@@ -1035,6 +1035,7 @@ static ssize_t nvmet_subsys_attr_model_store(struct config_item *item, + up_write(&nvmet_config_sem); + + kfree_rcu(new_model, rcuhead); ++ kfree(new_model_number); + + return count; + } +-- +2.25.1 + diff --git a/queue-5.8/powerpc-perf-fix-soft-lockups-due-to-missed-interrup.patch b/queue-5.8/powerpc-perf-fix-soft-lockups-due-to-missed-interrup.patch new file mode 100644 index 00000000000..1d497128864 --- /dev/null +++ b/queue-5.8/powerpc-perf-fix-soft-lockups-due-to-missed-interrup.patch @@ -0,0 +1,56 @@ +From de6b93a85a90bc005b3f8d87373ed824f72f16e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 08:46:32 -0400 +Subject: powerpc/perf: Fix soft lockups due to missed interrupt accounting + +From: Athira Rajeev + +[ Upstream commit 17899eaf88d689529b866371344c8f269ba79b5f ] + +Performance monitor interrupt handler checks if any counter has +overflown and calls record_and_restart() in core-book3s which invokes +perf_event_overflow() to record the sample information. Apart from +creating sample, perf_event_overflow() also does the interrupt and +period checks via perf_event_account_interrupt(). + +Currently we record information only if the SIAR (Sampled Instruction +Address Register) valid bit is set (using siar_valid() check) and +hence the interrupt check. + +But it is possible that we do sampling for some events that are not +generating valid SIAR, and hence there is no chance to disable the +event if interrupts are more than max_samples_per_tick. This leads to +soft lockup. + +Fix this by adding perf_event_account_interrupt() in the invalid SIAR +code path for a sampling event. ie if SIAR is invalid, just do +interrupt check and don't record the sample information. + +Reported-by: Alexey Kardashevskiy +Signed-off-by: Athira Rajeev +Tested-by: Alexey Kardashevskiy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1596717992-7321-1-git-send-email-atrajeev@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/core-book3s.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c +index 01d70280d2872..190bc4f255b42 100644 +--- a/arch/powerpc/perf/core-book3s.c ++++ b/arch/powerpc/perf/core-book3s.c +@@ -2101,6 +2101,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val, + + if (perf_event_overflow(event, &data, regs)) + power_pmu_stop(event, 0); ++ } else if (period) { ++ /* Account for interrupt in case of invalid SIAR */ ++ if (perf_event_account_interrupt(event)) ++ power_pmu_stop(event, 0); + } + } + +-- +2.25.1 + diff --git a/queue-5.8/revert-scsi-qla2xxx-fix-crash-on-qla2x00_mailbox_com.patch b/queue-5.8/revert-scsi-qla2xxx-fix-crash-on-qla2x00_mailbox_com.patch new file mode 100644 index 00000000000..4cfb655f8de --- /dev/null +++ b/queue-5.8/revert-scsi-qla2xxx-fix-crash-on-qla2x00_mailbox_com.patch @@ -0,0 +1,47 @@ +From 2822126db0b5f2818ce0a3f2a3c1257fe1197e0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 04:10:13 -0700 +Subject: Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command" + +From: Saurav Kashyap + +[ Upstream commit de7e6194301ad31c4ce95395eb678e51a1b907e5 ] + +FCoE adapter initialization failed for ISP8021 with the following patch +applied. In addition, reproduction of the issue the patch originally tried +to address has been unsuccessful. + +This reverts commit 3cb182b3fa8b7a61f05c671525494697cba39c6a. + +Link: https://lore.kernel.org/r/20200806111014.28434-11-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Saurav Kashyap +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_mbx.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index df31ee0d59b20..fdb2ce7acb912 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -333,14 +333,6 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) + if (time_after(jiffies, wait_time)) + break; + +- /* +- * Check if it's UNLOADING, cause we cannot poll in +- * this case, or else a NULL pointer dereference +- * is triggered. +- */ +- if (unlikely(test_bit(UNLOADING, &base_vha->dpc_flags))) +- return QLA_FUNCTION_TIMEOUT; +- + /* Check for pending interrupts. */ + qla2x00_poll(ha->rsp_q_map[0]); + +-- +2.25.1 + diff --git a/queue-5.8/s390-cio-add-cond_resched-in-the-slow_eval_known_fn-.patch b/queue-5.8/s390-cio-add-cond_resched-in-the-slow_eval_known_fn-.patch new file mode 100644 index 00000000000..e44bee8f423 --- /dev/null +++ b/queue-5.8/s390-cio-add-cond_resched-in-the-slow_eval_known_fn-.patch @@ -0,0 +1,43 @@ +From 8de14d5dc5c017c972c0fcd2e20f5c1719eeffa3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jun 2020 16:42:45 +0200 +Subject: s390/cio: add cond_resched() in the slow_eval_known_fn() loop + +From: Vineeth Vijayan + +[ Upstream commit 0b8eb2ee9da1e8c9b8082f404f3948aa82a057b2 ] + +The scanning through subchannels during the time of an event could +take significant amount of time in case of platforms with lots of +known subchannels. This might result in higher scheduling latencies +for other tasks especially on systems with a single CPU. Add +cond_resched() call, as the loop in slow_eval_known_fn() can be +executed for a longer duration. + +Reviewed-by: Peter Oberparleiter +Signed-off-by: Vineeth Vijayan +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/css.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c +index 94edbb33d0d1f..aca022239b333 100644 +--- a/drivers/s390/cio/css.c ++++ b/drivers/s390/cio/css.c +@@ -677,6 +677,11 @@ static int slow_eval_known_fn(struct subchannel *sch, void *data) + rc = css_evaluate_known_subchannel(sch, 1); + if (rc == -EAGAIN) + css_schedule_eval(sch->schid); ++ /* ++ * The loop might take long time for platforms with lots of ++ * known devices. Allow scheduling here. ++ */ ++ cond_resched(); + } + return 0; + } +-- +2.25.1 + diff --git a/queue-5.8/scsi-fcoe-fix-i-o-path-allocation.patch b/queue-5.8/scsi-fcoe-fix-i-o-path-allocation.patch new file mode 100644 index 00000000000..d8dd4c969f8 --- /dev/null +++ b/queue-5.8/scsi-fcoe-fix-i-o-path-allocation.patch @@ -0,0 +1,39 @@ +From 5ae1489a09c62d0b3dde641d9922c2a772046b8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Aug 2020 15:23:33 -0500 +Subject: scsi: fcoe: Fix I/O path allocation + +From: Mike Christie + +[ Upstream commit fa39ab5184d64563cd36f2fb5f0d3fbad83a432c ] + +ixgbe_fcoe_ddp_setup() can be called from the main I/O path and is called +with a spin_lock held, so we have to use GFP_ATOMIC allocation instead of +GFP_KERNEL. + +Link: https://lore.kernel.org/r/1596831813-9839-1-git-send-email-michael.christie@oracle.com +cc: Hannes Reinecke +Reviewed-by: Lee Duncan +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c +index ec7a11d13fdc0..9e70b9a674409 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c +@@ -192,7 +192,7 @@ static int ixgbe_fcoe_ddp_setup(struct net_device *netdev, u16 xid, + } + + /* alloc the udl from per cpu ddp pool */ +- ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_KERNEL, &ddp->udp); ++ ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_ATOMIC, &ddp->udp); + if (!ddp->udl) { + e_err(drv, "failed allocated ddp context\n"); + goto out_noddp_unmap; +-- +2.25.1 + diff --git a/queue-5.8/scsi-qla2xxx-check-if-fw-supports-mq-before-enabling.patch b/queue-5.8/scsi-qla2xxx-check-if-fw-supports-mq-before-enabling.patch new file mode 100644 index 00000000000..873d189a7dd --- /dev/null +++ b/queue-5.8/scsi-qla2xxx-check-if-fw-supports-mq-before-enabling.patch @@ -0,0 +1,42 @@ +From d1fbee591668913c06e27d9298e664f5d2853453 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 04:10:11 -0700 +Subject: scsi: qla2xxx: Check if FW supports MQ before enabling + +From: Saurav Kashyap + +[ Upstream commit dffa11453313a115157b19021cc2e27ea98e624c ] + +OS boot during Boot from SAN was stuck at dracut emergency shell after +enabling NVMe driver parameter. For non-MQ support the driver was enabling +MQ. Add a check to confirm if FW supports MQ. + +Link: https://lore.kernel.org/r/20200806111014.28434-9-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Saurav Kashyap +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_os.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 5c7c22d0fab4b..8b6803f4f2dc1 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -2017,6 +2017,11 @@ skip_pio: + /* Determine queue resources */ + ha->max_req_queues = ha->max_rsp_queues = 1; + ha->msix_count = QLA_BASE_VECTORS; ++ ++ /* Check if FW supports MQ or not */ ++ if (!(ha->fw_attributes & BIT_6)) ++ goto mqiobase_exit; ++ + if (!ql2xmqsupport || !ql2xnvmeenable || + (!IS_QLA25XX(ha) && !IS_QLA81XX(ha))) + goto mqiobase_exit; +-- +2.25.1 + diff --git a/queue-5.8/scsi-qla2xxx-fix-login-timeout.patch b/queue-5.8/scsi-qla2xxx-fix-login-timeout.patch new file mode 100644 index 00000000000..3eba41de68a --- /dev/null +++ b/queue-5.8/scsi-qla2xxx-fix-login-timeout.patch @@ -0,0 +1,73 @@ +From 5e9dfa03a1e59f0afdb579898a0826b5120272b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 04:10:07 -0700 +Subject: scsi: qla2xxx: Fix login timeout + +From: Quinn Tran + +[ Upstream commit abb31aeaa9b20680b0620b23fea5475ea4591e31 ] + +Multipath errors were seen during failback due to login timeout. The +remote device sent LOGO, the local host tore down the session and did +relogin. The RSCN arrived indicates remote device is going through failover +after which the relogin is in a 20s timeout phase. At this point the +driver is stuck in the relogin process. Add a fix to delete the session as +part of abort/flush the login. + +Link: https://lore.kernel.org/r/20200806111014.28434-5-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_gs.c | 18 +++++++++++++++--- + drivers/scsi/qla2xxx/qla_target.c | 2 +- + 2 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c +index 3bfb5678f6515..de9fd7f688d01 100644 +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -3538,10 +3538,22 @@ login_logout: + } + + if (fcport->scan_state != QLA_FCPORT_FOUND) { ++ bool do_delete = false; ++ ++ if (fcport->scan_needed && ++ fcport->disc_state == DSC_LOGIN_PEND) { ++ /* Cable got disconnected after we sent ++ * a login. Do delete to prevent timeout. ++ */ ++ fcport->logout_on_delete = 1; ++ do_delete = true; ++ } ++ + fcport->scan_needed = 0; +- if ((qla_dual_mode_enabled(vha) || +- qla_ini_mode_enabled(vha)) && +- atomic_read(&fcport->state) == FCS_ONLINE) { ++ if (((qla_dual_mode_enabled(vha) || ++ qla_ini_mode_enabled(vha)) && ++ atomic_read(&fcport->state) == FCS_ONLINE) || ++ do_delete) { + if (fcport->loop_id != FC_NO_LOOP_ID) { + if (fcport->flags & FCF_FCP2_DEVICE) + fcport->logout_on_delete = 0; +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index fbb80a043b4fe..90289162dbd4c 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -1270,7 +1270,7 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess) + + qla24xx_chk_fcp_state(sess); + +- ql_dbg(ql_dbg_tgt, sess->vha, 0xe001, ++ ql_dbg(ql_dbg_disc, sess->vha, 0xe001, + "Scheduling sess %p for deletion %8phC\n", + sess, sess->port_name); + +-- +2.25.1 + diff --git a/queue-5.8/scsi-qla2xxx-fix-null-pointer-access-during-disconne.patch b/queue-5.8/scsi-qla2xxx-fix-null-pointer-access-during-disconne.patch new file mode 100644 index 00000000000..c3da9d518a9 --- /dev/null +++ b/queue-5.8/scsi-qla2xxx-fix-null-pointer-access-during-disconne.patch @@ -0,0 +1,76 @@ +From 0e42aacd6d956cf5340b1d7c1c9034b0d451a967 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 04:10:12 -0700 +Subject: scsi: qla2xxx: Fix null pointer access during disconnect from + subsystem + +From: Quinn Tran + +[ Upstream commit 83949613fac61e8e37eadf8275bf072342302f4e ] + +NVMEAsync command is being submitted to QLA while the same NVMe controller +is in the middle of reset. The reset path has deleted the association and +freed aen_op->fcp_req.private. Add a check for this private pointer before +issuing the command. + +... + 6 [ffffb656ca11fce0] page_fault at ffffffff8c00114e + [exception RIP: qla_nvme_post_cmd+394] + RIP: ffffffffc0d012ba RSP: ffffb656ca11fd98 RFLAGS: 00010206 + RAX: ffff8fb039eda228 RBX: ffff8fb039eda200 RCX: 00000000000da161 + RDX: ffffffffc0d4d0f0 RSI: ffffffffc0d26c9b RDI: ffff8fb039eda220 + RBP: 0000000000000013 R8: ffff8fb47ff6aa80 R9: 0000000000000002 + R10: 0000000000000000 R11: ffffb656ca11fdc8 R12: ffff8fb27d04a3b0 + R13: ffff8fc46dd98a58 R14: 0000000000000000 R15: ffff8fc4540f0000 + ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + 7 [ffffb656ca11fe08] nvme_fc_start_fcp_op at ffffffffc0241568 [nvme_fc] + 8 [ffffb656ca11fe50] nvme_fc_submit_async_event at ffffffffc0241901 [nvme_fc] + 9 [ffffb656ca11fe68] nvme_async_event_work at ffffffffc014543d [nvme_core] +10 [ffffb656ca11fe98] process_one_work at ffffffff8b6cd437 +11 [ffffb656ca11fed8] worker_thread at ffffffff8b6cdcef +12 [ffffb656ca11ff10] kthread at ffffffff8b6d3402 +13 [ffffb656ca11ff50] ret_from_fork at ffffffff8c000255 + +-- +PID: 37824 TASK: ffff8fb033063d80 CPU: 20 COMMAND: "kworker/u97:451" + 0 [ffffb656ce1abc28] __schedule at ffffffff8be629e3 + 1 [ffffb656ce1abcc8] schedule at ffffffff8be62fe8 + 2 [ffffb656ce1abcd0] schedule_timeout at ffffffff8be671ed + 3 [ffffb656ce1abd70] wait_for_completion at ffffffff8be639cf + 4 [ffffb656ce1abdd0] flush_work at ffffffff8b6ce2d5 + 5 [ffffb656ce1abe70] nvme_stop_ctrl at ffffffffc0144900 [nvme_core] + 6 [ffffb656ce1abe80] nvme_fc_reset_ctrl_work at ffffffffc0243445 [nvme_fc] + 7 [ffffb656ce1abe98] process_one_work at ffffffff8b6cd437 + 8 [ffffb656ce1abed8] worker_thread at ffffffff8b6cdb50 + 9 [ffffb656ce1abf10] kthread at ffffffff8b6d3402 +10 [ffffb656ce1abf50] ret_from_fork at ffffffff8c000255 + +Link: https://lore.kernel.org/r/20200806111014.28434-10-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_nvme.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index fa695a4007f86..262dfd7635a48 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -536,6 +536,11 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport, + struct nvme_private *priv = fd->private; + struct qla_nvme_rport *qla_rport = rport->private; + ++ if (!priv) { ++ /* nvme association has been torn down */ ++ return rval; ++ } ++ + fcport = qla_rport->fcport; + + if (!qpair || !fcport || (qpair && !qpair->fw_started) || +-- +2.25.1 + diff --git a/queue-5.8/scsi-qla2xxx-flush-all-sessions-on-zone-disable.patch b/queue-5.8/scsi-qla2xxx-flush-all-sessions-on-zone-disable.patch new file mode 100644 index 00000000000..a22605faf1f --- /dev/null +++ b/queue-5.8/scsi-qla2xxx-flush-all-sessions-on-zone-disable.patch @@ -0,0 +1,50 @@ +From a4c3a37b39f2a6e13e17ff53e2ba76d3f2d215ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 04:10:04 -0700 +Subject: scsi: qla2xxx: Flush all sessions on zone disable + +From: Quinn Tran + +[ Upstream commit 10ae30ba664822f62de169a61628e31c999c7cc8 ] + +On Zone Disable, certain switches would ignore all commands. This causes +timeout for both switch scan command and abort of that command. On +detection of this condition, all sessions will be shutdown. + +Link: https://lore.kernel.org/r/20200806111014.28434-2-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Quinn Tran +Signed-off-by: Himanshu Madhani +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_gs.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c +index df670fba2ab8a..c6b6a3250312e 100644 +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -3736,6 +3736,18 @@ static void qla2x00_async_gpnft_gnnft_sp_done(srb_t *sp, int res) + unsigned long flags; + const char *name = sp->name; + ++ if (res == QLA_OS_TIMER_EXPIRED) { ++ /* switch is ignoring all commands. ++ * This might be a zone disable behavior. ++ * This means we hit 64s timeout. ++ * 22s GPNFT + 44s Abort = 64s ++ */ ++ ql_dbg(ql_dbg_disc, vha, 0xffff, ++ "%s: Switch Zone check please .\n", ++ name); ++ qla2x00_mark_all_devices_lost(vha); ++ } ++ + /* + * We are in an Interrupt context, queue up this + * sp for GNNFT_DONE work. This will allow all +-- +2.25.1 + diff --git a/queue-5.8/scsi-qla2xxx-flush-i-o-on-zone-disable.patch b/queue-5.8/scsi-qla2xxx-flush-i-o-on-zone-disable.patch new file mode 100644 index 00000000000..e391b0c928c --- /dev/null +++ b/queue-5.8/scsi-qla2xxx-flush-i-o-on-zone-disable.patch @@ -0,0 +1,37 @@ +From 9ca89a4114b5b76f920f75fed43b00c830b9dace Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 04:10:05 -0700 +Subject: scsi: qla2xxx: Flush I/O on zone disable + +From: Quinn Tran + +[ Upstream commit a117579d0205b5a0592a3a98493e2b875e4da236 ] + +Perform implicit logout to flush I/O on zone disable. + +Link: https://lore.kernel.org/r/20200806111014.28434-3-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Quinn Tran +Signed-off-by: Himanshu Madhani +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_gs.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c +index c6b6a3250312e..7074073446701 100644 +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -3436,7 +3436,6 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp) + list_for_each_entry(fcport, &vha->vp_fcports, list) { + if ((fcport->flags & FCF_FABRIC_DEVICE) != 0) { + fcport->scan_state = QLA_FCPORT_SCAN; +- fcport->logout_on_delete = 0; + } + } + goto login_logout; +-- +2.25.1 + diff --git a/queue-5.8/scsi-qla2xxx-indicate-correct-supported-speeds-for-m.patch b/queue-5.8/scsi-qla2xxx-indicate-correct-supported-speeds-for-m.patch new file mode 100644 index 00000000000..a4649a17013 --- /dev/null +++ b/queue-5.8/scsi-qla2xxx-indicate-correct-supported-speeds-for-m.patch @@ -0,0 +1,62 @@ +From 933157370fe7246322843b4e4c09e81e03f28a54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 04:10:06 -0700 +Subject: scsi: qla2xxx: Indicate correct supported speeds for Mezz card + +From: Quinn Tran + +[ Upstream commit 4709272f6327cc4a8ee1dc55771bcf9718346980 ] + +Correct the supported speeds for 16G Mezz card. + +Link: https://lore.kernel.org/r/20200806111014.28434-4-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_gs.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c +index 7074073446701..3bfb5678f6515 100644 +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -1505,11 +1505,11 @@ qla2x00_prep_ct_fdmi_req(struct ct_sns_pkt *p, uint16_t cmd, + static uint + qla25xx_fdmi_port_speed_capability(struct qla_hw_data *ha) + { ++ uint speeds = 0; ++ + if (IS_CNA_CAPABLE(ha)) + return FDMI_PORT_SPEED_10GB; + if (IS_QLA28XX(ha) || IS_QLA27XX(ha)) { +- uint speeds = 0; +- + if (ha->max_supported_speed == 2) { + if (ha->min_supported_speed <= 6) + speeds |= FDMI_PORT_SPEED_64GB; +@@ -1536,9 +1536,16 @@ qla25xx_fdmi_port_speed_capability(struct qla_hw_data *ha) + } + return speeds; + } +- if (IS_QLA2031(ha)) +- return FDMI_PORT_SPEED_16GB|FDMI_PORT_SPEED_8GB| +- FDMI_PORT_SPEED_4GB; ++ if (IS_QLA2031(ha)) { ++ if ((ha->pdev->subsystem_vendor == 0x103C) && ++ (ha->pdev->subsystem_device == 0x8002)) { ++ speeds = FDMI_PORT_SPEED_16GB; ++ } else { ++ speeds = FDMI_PORT_SPEED_16GB|FDMI_PORT_SPEED_8GB| ++ FDMI_PORT_SPEED_4GB; ++ } ++ return speeds; ++ } + if (IS_QLA25XX(ha)) + return FDMI_PORT_SPEED_8GB|FDMI_PORT_SPEED_4GB| + FDMI_PORT_SPEED_2GB|FDMI_PORT_SPEED_1GB; +-- +2.25.1 + diff --git a/queue-5.8/scsi-scsi_debug-fix-scp-is-null-errors.patch b/queue-5.8/scsi-scsi_debug-fix-scp-is-null-errors.patch new file mode 100644 index 00000000000..71dc9e66773 --- /dev/null +++ b/queue-5.8/scsi-scsi_debug-fix-scp-is-null-errors.patch @@ -0,0 +1,53 @@ +From a3d246135f5e8a8f9e82d78a8773689dcceec08d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Aug 2020 11:57:38 -0400 +Subject: scsi: scsi_debug: Fix scp is NULL errors + +From: Douglas Gilbert + +[ Upstream commit 223f91b48079227f914657f07d2d686f7b60aa26 ] + +John Garry reported 'sdebug_q_cmd_complete: scp is NULL' failures that were +mainly seen on aarch64 machines (e.g. RPi 4 with four A72 CPUs). The +problem was tracked down to a missing critical section on a "short circuit" +path. Namely, the time to process the current command so far has already +exceeded the requested command duration (i.e. the number of nanoseconds in +the ndelay parameter). + +The random=1 parameter setting was pivotal in finding this error. The +failure scenario involved first taking that "short circuit" path (due to a +very short command duration) and then taking the more likely +hrtimer_start() path (due to a longer command duration). With random=1 each +command's duration is taken from the uniformly distributed [0..ndelay) +interval. The fio utility also helped by reliably generating the error +scenario at about once per minute on a RPi 4 (64 bit OS). + +Link: https://lore.kernel.org/r/20200813155738.109298-1-dgilbert@interlog.com +Reported-by: John Garry +Reviewed-by: Lee Duncan +Signed-off-by: Douglas Gilbert +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_debug.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c +index b0d93bf79978f..25faad7f8e617 100644 +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -5486,9 +5486,11 @@ static int schedule_resp(struct scsi_cmnd *cmnd, struct sdebug_dev_info *devip, + u64 d = ktime_get_boottime_ns() - ns_from_boot; + + if (kt <= d) { /* elapsed duration >= kt */ ++ spin_lock_irqsave(&sqp->qc_lock, iflags); + sqcp->a_cmnd = NULL; + atomic_dec(&devip->num_in_q); + clear_bit(k, sqp->in_use_bm); ++ spin_unlock_irqrestore(&sqp->qc_lock, iflags); + if (new_sd_dp) + kfree(sd_dp); + /* call scsi_done() from this thread */ +-- +2.25.1 + diff --git a/queue-5.8/scsi-ufs-clean-up-completed-request-without-interrup.patch b/queue-5.8/scsi-ufs-clean-up-completed-request-without-interrup.patch new file mode 100644 index 00000000000..22bd367eaa7 --- /dev/null +++ b/queue-5.8/scsi-ufs-clean-up-completed-request-without-interrup.patch @@ -0,0 +1,56 @@ +From b544efcee4f92baa38016a128d823a077ecc0c1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 16:18:58 +0200 +Subject: scsi: ufs: Clean up completed request without interrupt notification + +From: Stanley Chu + +[ Upstream commit b10178ee7fa88b68a9e8adc06534d2605cb0ec23 ] + +If somehow no interrupt notification is raised for a completed request and +its doorbell bit is cleared by host, UFS driver needs to cleanup its +outstanding bit in ufshcd_abort(). Otherwise, system may behave abnormally +in the following scenario: + +After ufshcd_abort() returns, this request will be requeued by SCSI layer +with its outstanding bit set. Any future completed request will trigger +ufshcd_transfer_req_compl() to handle all "completed outstanding bits". At +this time the "abnormal outstanding bit" will be detected and the "requeued +request" will be chosen to execute request post-processing flow. This is +wrong because this request is still "alive". + +Link: https://lore.kernel.org/r/20200811141859.27399-2-huobean@gmail.com +Reviewed-by: Can Guo +Acked-by: Avri Altman +Signed-off-by: Stanley Chu +Signed-off-by: Bean Huo +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 6af79ff5185f6..8bc8e4e62c045 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -6541,7 +6541,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd) + /* command completed already */ + dev_err(hba->dev, "%s: cmd at tag %d successfully cleared from DB.\n", + __func__, tag); +- goto out; ++ goto cleanup; + } else { + dev_err(hba->dev, + "%s: no response from device. tag = %d, err %d\n", +@@ -6575,6 +6575,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd) + goto out; + } + ++cleanup: + scsi_dma_unmap(cmd); + + spin_lock_irqsave(host->host_lock, flags); +-- +2.25.1 + diff --git a/queue-5.8/scsi-ufs-fix-possible-infinite-loop-in-ufshcd_hold.patch b/queue-5.8/scsi-ufs-fix-possible-infinite-loop-in-ufshcd_hold.patch new file mode 100644 index 00000000000..d8fb72b8cb4 --- /dev/null +++ b/queue-5.8/scsi-ufs-fix-possible-infinite-loop-in-ufshcd_hold.patch @@ -0,0 +1,57 @@ +From 9360d412055c37af05811226117cc0ac9c74680f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Aug 2020 13:07:34 +0800 +Subject: scsi: ufs: Fix possible infinite loop in ufshcd_hold + +From: Stanley Chu + +[ Upstream commit 93b6c5db06028a3b55122bbb74d0715dd8ca4ae0 ] + +In ufshcd_suspend(), after clk-gating is suspended and link is set +as Hibern8 state, ufshcd_hold() is still possibly invoked before +ufshcd_suspend() returns. For example, MediaTek's suspend vops may +issue UIC commands which would call ufshcd_hold() during the command +issuing flow. + +Now if UFSHCD_CAP_HIBERN8_WITH_CLK_GATING capability is enabled, +then ufshcd_hold() may enter infinite loops because there is no +clk-ungating work scheduled or pending. In this case, ufshcd_hold() +shall just bypass, and keep the link as Hibern8 state. + +Link: https://lore.kernel.org/r/20200809050734.18740-1-stanley.chu@mediatek.com +Reviewed-by: Avri Altman +Co-developed-by: Andy Teng +Signed-off-by: Andy Teng +Signed-off-by: Stanley Chu +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 136b863bc1d45..2b5acdfb17820 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -1566,6 +1566,7 @@ unblock_reqs: + int ufshcd_hold(struct ufs_hba *hba, bool async) + { + int rc = 0; ++ bool flush_result; + unsigned long flags; + + if (!ufshcd_is_clkgating_allowed(hba)) +@@ -1597,7 +1598,9 @@ start: + break; + } + spin_unlock_irqrestore(hba->host->host_lock, flags); +- flush_work(&hba->clk_gating.ungate_work); ++ flush_result = flush_work(&hba->clk_gating.ungate_work); ++ if (hba->clk_gating.is_suspended && !flush_result) ++ goto out; + spin_lock_irqsave(hba->host->host_lock, flags); + goto start; + } +-- +2.25.1 + diff --git a/queue-5.8/scsi-ufs-improve-interrupt-handling-for-shared-inter.patch b/queue-5.8/scsi-ufs-improve-interrupt-handling-for-shared-inter.patch new file mode 100644 index 00000000000..ddae2ce2d93 --- /dev/null +++ b/queue-5.8/scsi-ufs-improve-interrupt-handling-for-shared-inter.patch @@ -0,0 +1,55 @@ +From dc6f3bd6f09bc251872646549a01465f9f141ab1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 16:39:36 +0300 +Subject: scsi: ufs: Improve interrupt handling for shared interrupts + +From: Adrian Hunter + +[ Upstream commit 127d5f7c4b653b8be5eb3b2c7bbe13728f9003ff ] + +For shared interrupts, the interrupt status might be zero, so check that +first. + +Link: https://lore.kernel.org/r/20200811133936.19171-2-adrian.hunter@intel.com +Reviewed-by: Avri Altman +Signed-off-by: Adrian Hunter +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 2b5acdfb17820..6af79ff5185f6 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -5991,7 +5991,7 @@ static irqreturn_t ufshcd_sl_intr(struct ufs_hba *hba, u32 intr_status) + */ + static irqreturn_t ufshcd_intr(int irq, void *__hba) + { +- u32 intr_status, enabled_intr_status; ++ u32 intr_status, enabled_intr_status = 0; + irqreturn_t retval = IRQ_NONE; + struct ufs_hba *hba = __hba; + int retries = hba->nutrs; +@@ -6005,7 +6005,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba) + * read, make sure we handle them by checking the interrupt status + * again in a loop until we process all of the reqs before returning. + */ +- do { ++ while (intr_status && retries--) { + enabled_intr_status = + intr_status & ufshcd_readl(hba, REG_INTERRUPT_ENABLE); + if (intr_status) +@@ -6014,7 +6014,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba) + retval |= ufshcd_sl_intr(hba, enabled_intr_status); + + intr_status = ufshcd_readl(hba, REG_INTERRUPT_STATUS); +- } while (intr_status && --retries); ++ } + + if (enabled_intr_status && retval == IRQ_NONE) { + dev_err(hba->dev, "%s: Unhandled interrupt 0x%08x\n", +-- +2.25.1 + diff --git a/queue-5.8/selftest-bpf-fix-compilation-warnings-in-32-bit-mode.patch b/queue-5.8/selftest-bpf-fix-compilation-warnings-in-32-bit-mode.patch new file mode 100644 index 00000000000..338b4760670 --- /dev/null +++ b/queue-5.8/selftest-bpf-fix-compilation-warnings-in-32-bit-mode.patch @@ -0,0 +1,235 @@ +From 8a8552226413962999b8744d00dfb6095b801505 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Aug 2020 13:49:38 -0700 +Subject: selftest/bpf: Fix compilation warnings in 32-bit mode + +From: Andrii Nakryiko + +[ Upstream commit 9028bbcc3e12510cac13a9554f1a1e39667a4387 ] + +Fix compilation warnings emitted when compiling selftests for 32-bit platform +(x86 in my case). + +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20200813204945.1020225-3-andriin@fb.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/bpf_obj_id.c | 8 ++++---- + tools/testing/selftests/bpf/prog_tests/core_extern.c | 4 ++-- + tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c | 6 +++--- + tools/testing/selftests/bpf/prog_tests/flow_dissector.c | 2 +- + tools/testing/selftests/bpf/prog_tests/global_data.c | 6 +++--- + tools/testing/selftests/bpf/prog_tests/prog_run_xattr.c | 2 +- + tools/testing/selftests/bpf/prog_tests/skb_ctx.c | 2 +- + tools/testing/selftests/bpf/test_btf.c | 8 ++++---- + tools/testing/selftests/bpf/test_progs.h | 5 +++++ + 9 files changed, 24 insertions(+), 19 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_obj_id.c b/tools/testing/selftests/bpf/prog_tests/bpf_obj_id.c +index 7afa4160416f6..284d5921c3458 100644 +--- a/tools/testing/selftests/bpf/prog_tests/bpf_obj_id.c ++++ b/tools/testing/selftests/bpf/prog_tests/bpf_obj_id.c +@@ -159,15 +159,15 @@ void test_bpf_obj_id(void) + /* Check getting link info */ + info_len = sizeof(struct bpf_link_info) * 2; + bzero(&link_infos[i], info_len); +- link_infos[i].raw_tracepoint.tp_name = (__u64)&tp_name; ++ link_infos[i].raw_tracepoint.tp_name = ptr_to_u64(&tp_name); + link_infos[i].raw_tracepoint.tp_name_len = sizeof(tp_name); + err = bpf_obj_get_info_by_fd(bpf_link__fd(links[i]), + &link_infos[i], &info_len); + if (CHECK(err || + link_infos[i].type != BPF_LINK_TYPE_RAW_TRACEPOINT || + link_infos[i].prog_id != prog_infos[i].id || +- link_infos[i].raw_tracepoint.tp_name != (__u64)&tp_name || +- strcmp((char *)link_infos[i].raw_tracepoint.tp_name, ++ link_infos[i].raw_tracepoint.tp_name != ptr_to_u64(&tp_name) || ++ strcmp(u64_to_ptr(link_infos[i].raw_tracepoint.tp_name), + "sys_enter") || + info_len != sizeof(struct bpf_link_info), + "get-link-info(fd)", +@@ -178,7 +178,7 @@ void test_bpf_obj_id(void) + link_infos[i].type, BPF_LINK_TYPE_RAW_TRACEPOINT, + link_infos[i].id, + link_infos[i].prog_id, prog_infos[i].id, +- (char *)link_infos[i].raw_tracepoint.tp_name, ++ (const char *)u64_to_ptr(link_infos[i].raw_tracepoint.tp_name), + "sys_enter")) + goto done; + +diff --git a/tools/testing/selftests/bpf/prog_tests/core_extern.c b/tools/testing/selftests/bpf/prog_tests/core_extern.c +index b093787e94489..1931a158510e0 100644 +--- a/tools/testing/selftests/bpf/prog_tests/core_extern.c ++++ b/tools/testing/selftests/bpf/prog_tests/core_extern.c +@@ -159,8 +159,8 @@ void test_core_extern(void) + exp = (uint64_t *)&t->data; + for (j = 0; j < n; j++) { + CHECK(got[j] != exp[j], "check_res", +- "result #%d: expected %lx, but got %lx\n", +- j, exp[j], got[j]); ++ "result #%d: expected %llx, but got %llx\n", ++ j, (__u64)exp[j], (__u64)got[j]); + } + cleanup: + test_core_extern__destroy(skel); +diff --git a/tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c b/tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c +index a895bfed55db0..197d0d217b56b 100644 +--- a/tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c ++++ b/tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c +@@ -16,7 +16,7 @@ static void test_fexit_bpf2bpf_common(const char *obj_file, + __u32 duration = 0, retval; + struct bpf_map *data_map; + const int zero = 0; +- u64 *result = NULL; ++ __u64 *result = NULL; + + err = bpf_prog_load(target_obj_file, BPF_PROG_TYPE_UNSPEC, + &pkt_obj, &pkt_fd); +@@ -29,7 +29,7 @@ static void test_fexit_bpf2bpf_common(const char *obj_file, + + link = calloc(sizeof(struct bpf_link *), prog_cnt); + prog = calloc(sizeof(struct bpf_program *), prog_cnt); +- result = malloc((prog_cnt + 32 /* spare */) * sizeof(u64)); ++ result = malloc((prog_cnt + 32 /* spare */) * sizeof(__u64)); + if (CHECK(!link || !prog || !result, "alloc_memory", + "failed to alloc memory")) + goto close_prog; +@@ -72,7 +72,7 @@ static void test_fexit_bpf2bpf_common(const char *obj_file, + goto close_prog; + + for (i = 0; i < prog_cnt; i++) +- if (CHECK(result[i] != 1, "result", "fexit_bpf2bpf failed err %ld\n", ++ if (CHECK(result[i] != 1, "result", "fexit_bpf2bpf failed err %llu\n", + result[i])) + goto close_prog; + +diff --git a/tools/testing/selftests/bpf/prog_tests/flow_dissector.c b/tools/testing/selftests/bpf/prog_tests/flow_dissector.c +index f11f187990e95..cd6dc80edf18e 100644 +--- a/tools/testing/selftests/bpf/prog_tests/flow_dissector.c ++++ b/tools/testing/selftests/bpf/prog_tests/flow_dissector.c +@@ -591,7 +591,7 @@ void test_flow_dissector(void) + CHECK_ATTR(tattr.data_size_out != sizeof(flow_keys) || + err || tattr.retval != 1, + tests[i].name, +- "err %d errno %d retval %d duration %d size %u/%lu\n", ++ "err %d errno %d retval %d duration %d size %u/%zu\n", + err, errno, tattr.retval, tattr.duration, + tattr.data_size_out, sizeof(flow_keys)); + CHECK_FLOW_KEYS(tests[i].name, flow_keys, tests[i].keys); +diff --git a/tools/testing/selftests/bpf/prog_tests/global_data.c b/tools/testing/selftests/bpf/prog_tests/global_data.c +index e3cb62b0a110e..9efa7e50eab27 100644 +--- a/tools/testing/selftests/bpf/prog_tests/global_data.c ++++ b/tools/testing/selftests/bpf/prog_tests/global_data.c +@@ -5,7 +5,7 @@ + static void test_global_data_number(struct bpf_object *obj, __u32 duration) + { + int i, err, map_fd; +- uint64_t num; ++ __u64 num; + + map_fd = bpf_find_map(__func__, obj, "result_number"); + if (CHECK_FAIL(map_fd < 0)) +@@ -14,7 +14,7 @@ static void test_global_data_number(struct bpf_object *obj, __u32 duration) + struct { + char *name; + uint32_t key; +- uint64_t num; ++ __u64 num; + } tests[] = { + { "relocate .bss reference", 0, 0 }, + { "relocate .data reference", 1, 42 }, +@@ -32,7 +32,7 @@ static void test_global_data_number(struct bpf_object *obj, __u32 duration) + for (i = 0; i < sizeof(tests) / sizeof(tests[0]); i++) { + err = bpf_map_lookup_elem(map_fd, &tests[i].key, &num); + CHECK(err || num != tests[i].num, tests[i].name, +- "err %d result %lx expected %lx\n", ++ "err %d result %llx expected %llx\n", + err, num, tests[i].num); + } + } +diff --git a/tools/testing/selftests/bpf/prog_tests/prog_run_xattr.c b/tools/testing/selftests/bpf/prog_tests/prog_run_xattr.c +index dde2b7ae7bc9e..935a294f049a2 100644 +--- a/tools/testing/selftests/bpf/prog_tests/prog_run_xattr.c ++++ b/tools/testing/selftests/bpf/prog_tests/prog_run_xattr.c +@@ -28,7 +28,7 @@ void test_prog_run_xattr(void) + "err %d errno %d retval %d\n", err, errno, tattr.retval); + + CHECK_ATTR(tattr.data_size_out != sizeof(pkt_v4), "data_size_out", +- "incorrect output size, want %lu have %u\n", ++ "incorrect output size, want %zu have %u\n", + sizeof(pkt_v4), tattr.data_size_out); + + CHECK_ATTR(buf[5] != 0, "overflow", +diff --git a/tools/testing/selftests/bpf/prog_tests/skb_ctx.c b/tools/testing/selftests/bpf/prog_tests/skb_ctx.c +index 7021b92af3134..c61b2b69710a9 100644 +--- a/tools/testing/selftests/bpf/prog_tests/skb_ctx.c ++++ b/tools/testing/selftests/bpf/prog_tests/skb_ctx.c +@@ -80,7 +80,7 @@ void test_skb_ctx(void) + + CHECK_ATTR(tattr.ctx_size_out != sizeof(skb), + "ctx_size_out", +- "incorrect output size, want %lu have %u\n", ++ "incorrect output size, want %zu have %u\n", + sizeof(skb), tattr.ctx_size_out); + + for (i = 0; i < 5; i++) +diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c +index 305fae8f80a98..c75fc6447186a 100644 +--- a/tools/testing/selftests/bpf/test_btf.c ++++ b/tools/testing/selftests/bpf/test_btf.c +@@ -3883,7 +3883,7 @@ static int test_big_btf_info(unsigned int test_num) + info_garbage.garbage = 0; + err = bpf_obj_get_info_by_fd(btf_fd, info, &info_len); + if (CHECK(err || info_len != sizeof(*info), +- "err:%d errno:%d info_len:%u sizeof(*info):%lu", ++ "err:%d errno:%d info_len:%u sizeof(*info):%zu", + err, errno, info_len, sizeof(*info))) { + err = -1; + goto done; +@@ -4094,7 +4094,7 @@ static int do_test_get_info(unsigned int test_num) + if (CHECK(err || !info.id || info_len != sizeof(info) || + info.btf_size != raw_btf_size || + (ret = memcmp(raw_btf, user_btf, expected_nbytes)), +- "err:%d errno:%d info.id:%u info_len:%u sizeof(info):%lu raw_btf_size:%u info.btf_size:%u expected_nbytes:%u memcmp:%d", ++ "err:%d errno:%d info.id:%u info_len:%u sizeof(info):%zu raw_btf_size:%u info.btf_size:%u expected_nbytes:%u memcmp:%d", + err, errno, info.id, info_len, sizeof(info), + raw_btf_size, info.btf_size, expected_nbytes, ret)) { + err = -1; +@@ -4730,7 +4730,7 @@ ssize_t get_pprint_expected_line(enum pprint_mapv_kind_t mapv_kind, + + nexpected_line = snprintf(expected_line, line_size, + "%s%u: {%u,0,%d,0x%x,0x%x,0x%x," +- "{%lu|[%u,%u,%u,%u,%u,%u,%u,%u]},%s," ++ "{%llu|[%u,%u,%u,%u,%u,%u,%u,%u]},%s," + "%u,0x%x,[[%d,%d],[%d,%d]]}\n", + percpu_map ? "\tcpu" : "", + percpu_map ? cpu : next_key, +@@ -4738,7 +4738,7 @@ ssize_t get_pprint_expected_line(enum pprint_mapv_kind_t mapv_kind, + v->unused_bits2a, + v->bits28, + v->unused_bits2b, +- v->ui64, ++ (__u64)v->ui64, + v->ui8a[0], v->ui8a[1], + v->ui8a[2], v->ui8a[3], + v->ui8a[4], v->ui8a[5], +diff --git a/tools/testing/selftests/bpf/test_progs.h b/tools/testing/selftests/bpf/test_progs.h +index b809246039181..b5670350e3263 100644 +--- a/tools/testing/selftests/bpf/test_progs.h ++++ b/tools/testing/selftests/bpf/test_progs.h +@@ -133,6 +133,11 @@ static inline __u64 ptr_to_u64(const void *ptr) + return (__u64) (unsigned long) ptr; + } + ++static inline void *u64_to_ptr(__u64 ptr) ++{ ++ return (void *) (unsigned long) ptr; ++} ++ + int bpf_find_map(const char *test, struct bpf_object *obj, const char *name); + int compare_map_keys(int map1_fd, int map2_fd); + int compare_stack_ips(int smap_fd, int amap_fd, int stack_trace_len); +-- +2.25.1 + diff --git a/queue-5.8/selftests-bpf-correct-various-core_reloc-64-bit-assu.patch b/queue-5.8/selftests-bpf-correct-various-core_reloc-64-bit-assu.patch new file mode 100644 index 00000000000..4943cba1975 --- /dev/null +++ b/queue-5.8/selftests-bpf-correct-various-core_reloc-64-bit-assu.patch @@ -0,0 +1,239 @@ +From 716a0a6b7ca65dda2ecdb91e48808f9634d53c8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Aug 2020 13:49:43 -0700 +Subject: selftests/bpf: Correct various core_reloc 64-bit assumptions + +From: Andrii Nakryiko + +[ Upstream commit 5705d705832f74395c5465ce93192688f543006a ] + +Ensure that types are memory layout- and field alignment-compatible regardless +of 32/64-bitness mix of libbpf and BPF architecture. + +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20200813204945.1020225-8-andriin@fb.com +Signed-off-by: Sasha Levin +--- + .../selftests/bpf/prog_tests/core_reloc.c | 20 +++--- + .../selftests/bpf/progs/core_reloc_types.h | 69 ++++++++++--------- + 2 files changed, 47 insertions(+), 42 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/core_reloc.c b/tools/testing/selftests/bpf/prog_tests/core_reloc.c +index 084ed26a7d78c..a54eafc5e4b31 100644 +--- a/tools/testing/selftests/bpf/prog_tests/core_reloc.c ++++ b/tools/testing/selftests/bpf/prog_tests/core_reloc.c +@@ -237,8 +237,8 @@ + .union_sz = sizeof(((type *)0)->union_field), \ + .arr_sz = sizeof(((type *)0)->arr_field), \ + .arr_elem_sz = sizeof(((type *)0)->arr_field[0]), \ +- .ptr_sz = sizeof(((type *)0)->ptr_field), \ +- .enum_sz = sizeof(((type *)0)->enum_field), \ ++ .ptr_sz = 8, /* always 8-byte pointer for BPF */ \ ++ .enum_sz = sizeof(((type *)0)->enum_field), \ + } + + #define SIZE_CASE(name) { \ +@@ -432,20 +432,20 @@ static struct core_reloc_test_case test_cases[] = { + .sb4 = -1, + .sb20 = -0x17654321, + .u32 = 0xBEEF, +- .s32 = -0x3FEDCBA987654321, ++ .s32 = -0x3FEDCBA987654321LL, + }), + BITFIELDS_CASE(bitfields___bitfield_vs_int, { +- .ub1 = 0xFEDCBA9876543210, ++ .ub1 = 0xFEDCBA9876543210LL, + .ub2 = 0xA6, +- .ub7 = -0x7EDCBA987654321, +- .sb4 = -0x6123456789ABCDE, +- .sb20 = 0xD00D, ++ .ub7 = -0x7EDCBA987654321LL, ++ .sb4 = -0x6123456789ABCDELL, ++ .sb20 = 0xD00DLL, + .u32 = -0x76543, +- .s32 = 0x0ADEADBEEFBADB0B, ++ .s32 = 0x0ADEADBEEFBADB0BLL, + }), + BITFIELDS_CASE(bitfields___just_big_enough, { +- .ub1 = 0xF, +- .ub2 = 0x0812345678FEDCBA, ++ .ub1 = 0xFLL, ++ .ub2 = 0x0812345678FEDCBALL, + }), + BITFIELDS_ERR_CASE(bitfields___err_too_big_bitfield), + +diff --git a/tools/testing/selftests/bpf/progs/core_reloc_types.h b/tools/testing/selftests/bpf/progs/core_reloc_types.h +index 34d84717c9464..69139ed662164 100644 +--- a/tools/testing/selftests/bpf/progs/core_reloc_types.h ++++ b/tools/testing/selftests/bpf/progs/core_reloc_types.h +@@ -1,5 +1,10 @@ + #include + #include ++ ++void preserce_ptr_sz_fn(long x) {} ++ ++#define __bpf_aligned __attribute__((aligned(8))) ++ + /* + * KERNEL + */ +@@ -444,51 +449,51 @@ struct core_reloc_primitives { + char a; + int b; + enum core_reloc_primitives_enum c; +- void *d; +- int (*f)(const char *); ++ void *d __bpf_aligned; ++ int (*f)(const char *) __bpf_aligned; + }; + + struct core_reloc_primitives___diff_enum_def { + char a; + int b; +- void *d; +- int (*f)(const char *); ++ void *d __bpf_aligned; ++ int (*f)(const char *) __bpf_aligned; + enum { + X = 100, + Y = 200, +- } c; /* inline enum def with differing set of values */ ++ } c __bpf_aligned; /* inline enum def with differing set of values */ + }; + + struct core_reloc_primitives___diff_func_proto { +- void (*f)(int); /* incompatible function prototype */ +- void *d; +- enum core_reloc_primitives_enum c; ++ void (*f)(int) __bpf_aligned; /* incompatible function prototype */ ++ void *d __bpf_aligned; ++ enum core_reloc_primitives_enum c __bpf_aligned; + int b; + char a; + }; + + struct core_reloc_primitives___diff_ptr_type { +- const char * const d; /* different pointee type + modifiers */ +- char a; ++ const char * const d __bpf_aligned; /* different pointee type + modifiers */ ++ char a __bpf_aligned; + int b; + enum core_reloc_primitives_enum c; +- int (*f)(const char *); ++ int (*f)(const char *) __bpf_aligned; + }; + + struct core_reloc_primitives___err_non_enum { + char a[1]; + int b; + int c; /* int instead of enum */ +- void *d; +- int (*f)(const char *); ++ void *d __bpf_aligned; ++ int (*f)(const char *) __bpf_aligned; + }; + + struct core_reloc_primitives___err_non_int { + char a[1]; +- int *b; /* ptr instead of int */ +- enum core_reloc_primitives_enum c; +- void *d; +- int (*f)(const char *); ++ int *b __bpf_aligned; /* ptr instead of int */ ++ enum core_reloc_primitives_enum c __bpf_aligned; ++ void *d __bpf_aligned; ++ int (*f)(const char *) __bpf_aligned; + }; + + struct core_reloc_primitives___err_non_ptr { +@@ -496,7 +501,7 @@ struct core_reloc_primitives___err_non_ptr { + int b; + enum core_reloc_primitives_enum c; + int d; /* int instead of ptr */ +- int (*f)(const char *); ++ int (*f)(const char *) __bpf_aligned; + }; + + /* +@@ -507,7 +512,7 @@ struct core_reloc_mods_output { + }; + + typedef const int int_t; +-typedef const char *char_ptr_t; ++typedef const char *char_ptr_t __bpf_aligned; + typedef const int arr_t[7]; + + struct core_reloc_mods_substruct { +@@ -523,9 +528,9 @@ typedef struct { + struct core_reloc_mods { + int a; + int_t b; +- char *c; ++ char *c __bpf_aligned; + char_ptr_t d; +- int e[3]; ++ int e[3] __bpf_aligned; + arr_t f; + struct core_reloc_mods_substruct g; + core_reloc_mods_substruct_t h; +@@ -535,9 +540,9 @@ struct core_reloc_mods { + struct core_reloc_mods___mod_swap { + int b; + int_t a; +- char *d; ++ char *d __bpf_aligned; + char_ptr_t c; +- int f[3]; ++ int f[3] __bpf_aligned; + arr_t e; + struct { + int y; +@@ -555,7 +560,7 @@ typedef arr1_t arr2_t; + typedef arr2_t arr3_t; + typedef arr3_t arr4_t; + +-typedef const char * const volatile fancy_char_ptr_t; ++typedef const char * const volatile fancy_char_ptr_t __bpf_aligned; + + typedef core_reloc_mods_substruct_t core_reloc_mods_substruct_tt; + +@@ -567,7 +572,7 @@ struct core_reloc_mods___typedefs { + arr4_t e; + fancy_char_ptr_t d; + fancy_char_ptr_t c; +- int3_t b; ++ int3_t b __bpf_aligned; + int3_t a; + }; + +@@ -739,19 +744,19 @@ struct core_reloc_bitfields___bit_sz_change { + int8_t sb4: 1; /* 4 -> 1 */ + int32_t sb20: 30; /* 20 -> 30 */ + /* non-bitfields */ +- uint16_t u32; /* 32 -> 16 */ +- int64_t s32; /* 32 -> 64 */ ++ uint16_t u32; /* 32 -> 16 */ ++ int64_t s32 __bpf_aligned; /* 32 -> 64 */ + }; + + /* turn bitfield into non-bitfield and vice versa */ + struct core_reloc_bitfields___bitfield_vs_int { + uint64_t ub1; /* 3 -> 64 non-bitfield */ + uint8_t ub2; /* 20 -> 8 non-bitfield */ +- int64_t ub7; /* 7 -> 64 non-bitfield signed */ +- int64_t sb4; /* 4 -> 64 non-bitfield signed */ +- uint64_t sb20; /* 20 -> 16 non-bitfield unsigned */ +- int32_t u32: 20; /* 32 non-bitfield -> 20 bitfield */ +- uint64_t s32: 60; /* 32 non-bitfield -> 60 bitfield */ ++ int64_t ub7 __bpf_aligned; /* 7 -> 64 non-bitfield signed */ ++ int64_t sb4 __bpf_aligned; /* 4 -> 64 non-bitfield signed */ ++ uint64_t sb20 __bpf_aligned; /* 20 -> 16 non-bitfield unsigned */ ++ int32_t u32: 20; /* 32 non-bitfield -> 20 bitfield */ ++ uint64_t s32: 60 __bpf_aligned; /* 32 non-bitfield -> 60 bitfield */ + }; + + struct core_reloc_bitfields___just_big_enough { +-- +2.25.1 + diff --git a/queue-5.8/selftests-bpf-fix-btf_dump-test-cases-on-32-bit-arch.patch b/queue-5.8/selftests-bpf-fix-btf_dump-test-cases-on-32-bit-arch.patch new file mode 100644 index 00000000000..e0a64cb825f --- /dev/null +++ b/queue-5.8/selftests-bpf-fix-btf_dump-test-cases-on-32-bit-arch.patch @@ -0,0 +1,71 @@ +From 69139551b7d6e7d1ee178e0deb77d30c939c2f9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Aug 2020 13:49:41 -0700 +Subject: selftests/bpf: Fix btf_dump test cases on 32-bit arches + +From: Andrii Nakryiko + +[ Upstream commit eed7818adf03e874994b966aa33bc00204dd275a ] + +Fix btf_dump test cases by hard-coding BPF's pointer size of 8 bytes for cases +where it's impossible to deterimne the pointer size (no long type in BTF). In +cases where it's known, validate libbpf correctly determines it as 8. + +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20200813204945.1020225-6-andriin@fb.com +Signed-off-by: Sasha Levin +--- + .../selftests/bpf/prog_tests/btf_dump.c | 27 ++++++++++++++----- + 1 file changed, 20 insertions(+), 7 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/btf_dump.c b/tools/testing/selftests/bpf/prog_tests/btf_dump.c +index cb33a7ee4e04f..39fb81d9daeb5 100644 +--- a/tools/testing/selftests/bpf/prog_tests/btf_dump.c ++++ b/tools/testing/selftests/bpf/prog_tests/btf_dump.c +@@ -12,15 +12,16 @@ void btf_dump_printf(void *ctx, const char *fmt, va_list args) + static struct btf_dump_test_case { + const char *name; + const char *file; ++ bool known_ptr_sz; + struct btf_dump_opts opts; + } btf_dump_test_cases[] = { +- {"btf_dump: syntax", "btf_dump_test_case_syntax", {}}, +- {"btf_dump: ordering", "btf_dump_test_case_ordering", {}}, +- {"btf_dump: padding", "btf_dump_test_case_padding", {}}, +- {"btf_dump: packing", "btf_dump_test_case_packing", {}}, +- {"btf_dump: bitfields", "btf_dump_test_case_bitfields", {}}, +- {"btf_dump: multidim", "btf_dump_test_case_multidim", {}}, +- {"btf_dump: namespacing", "btf_dump_test_case_namespacing", {}}, ++ {"btf_dump: syntax", "btf_dump_test_case_syntax", true, {}}, ++ {"btf_dump: ordering", "btf_dump_test_case_ordering", false, {}}, ++ {"btf_dump: padding", "btf_dump_test_case_padding", true, {}}, ++ {"btf_dump: packing", "btf_dump_test_case_packing", true, {}}, ++ {"btf_dump: bitfields", "btf_dump_test_case_bitfields", true, {}}, ++ {"btf_dump: multidim", "btf_dump_test_case_multidim", false, {}}, ++ {"btf_dump: namespacing", "btf_dump_test_case_namespacing", false, {}}, + }; + + static int btf_dump_all_types(const struct btf *btf, +@@ -62,6 +63,18 @@ static int test_btf_dump_case(int n, struct btf_dump_test_case *t) + goto done; + } + ++ /* tests with t->known_ptr_sz have no "long" or "unsigned long" type, ++ * so it's impossible to determine correct pointer size; but if they ++ * do, it should be 8 regardless of host architecture, becaues BPF ++ * target is always 64-bit ++ */ ++ if (!t->known_ptr_sz) { ++ btf__set_pointer_size(btf, 8); ++ } else { ++ CHECK(btf__pointer_size(btf) != 8, "ptr_sz", "exp %d, got %zu\n", ++ 8, btf__pointer_size(btf)); ++ } ++ + snprintf(out_file, sizeof(out_file), "/tmp/%s.output.XXXXXX", t->file); + fd = mkstemp(out_file); + if (CHECK(fd < 0, "create_tmp", "failed to create file: %d\n", fd)) { +-- +2.25.1 + diff --git a/queue-5.8/selftests-bpf-fix-segmentation-fault-in-test_progs.patch b/queue-5.8/selftests-bpf-fix-segmentation-fault-in-test_progs.patch new file mode 100644 index 00000000000..2ddbbb135dd --- /dev/null +++ b/queue-5.8/selftests-bpf-fix-segmentation-fault-in-test_progs.patch @@ -0,0 +1,101 @@ +From 9446a6d0140f127abfb26e98d3d9a74ac1bc336d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 23:39:40 +0800 +Subject: selftests/bpf: Fix segmentation fault in test_progs + +From: Jianlin Lv + +[ Upstream commit 0390c429dbed4068bd2cd8dded937d9a5ec24cd2 ] + +test_progs reports the segmentation fault as below: + + $ sudo ./test_progs -t mmap --verbose + test_mmap:PASS:skel_open_and_load 0 nsec + [...] + test_mmap:PASS:adv_mmap1 0 nsec + test_mmap:PASS:adv_mmap2 0 nsec + test_mmap:PASS:adv_mmap3 0 nsec + test_mmap:PASS:adv_mmap4 0 nsec + Segmentation fault + +This issue was triggered because mmap() and munmap() used inconsistent +length parameters; mmap() creates a new mapping of 3 * page_size, but the +length parameter set in the subsequent re-map and munmap() functions is +4 * page_size; this leads to the destruction of the process space. + +To fix this issue, first create 4 pages of anonymous mapping, then do all +the mmap() with MAP_FIXED. + +Another issue is that when unmap the second page fails, the length +parameter to delete tmp1 mappings should be 4 * page_size. + +Signed-off-by: Jianlin Lv +Signed-off-by: Daniel Borkmann +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20200810153940.125508-1-Jianlin.Lv@arm.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/mmap.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/mmap.c b/tools/testing/selftests/bpf/prog_tests/mmap.c +index 43d0b5578f461..9c3c5c0f068fb 100644 +--- a/tools/testing/selftests/bpf/prog_tests/mmap.c ++++ b/tools/testing/selftests/bpf/prog_tests/mmap.c +@@ -21,7 +21,7 @@ void test_mmap(void) + const long page_size = sysconf(_SC_PAGE_SIZE); + int err, duration = 0, i, data_map_fd, data_map_id, tmp_fd, rdmap_fd; + struct bpf_map *data_map, *bss_map; +- void *bss_mmaped = NULL, *map_mmaped = NULL, *tmp1, *tmp2; ++ void *bss_mmaped = NULL, *map_mmaped = NULL, *tmp0, *tmp1, *tmp2; + struct test_mmap__bss *bss_data; + struct bpf_map_info map_info; + __u32 map_info_sz = sizeof(map_info); +@@ -183,16 +183,23 @@ void test_mmap(void) + + /* check some more advanced mmap() manipulations */ + ++ tmp0 = mmap(NULL, 4 * page_size, PROT_READ, MAP_SHARED | MAP_ANONYMOUS, ++ -1, 0); ++ if (CHECK(tmp0 == MAP_FAILED, "adv_mmap0", "errno %d\n", errno)) ++ goto cleanup; ++ + /* map all but last page: pages 1-3 mapped */ +- tmp1 = mmap(NULL, 3 * page_size, PROT_READ, MAP_SHARED, ++ tmp1 = mmap(tmp0, 3 * page_size, PROT_READ, MAP_SHARED | MAP_FIXED, + data_map_fd, 0); +- if (CHECK(tmp1 == MAP_FAILED, "adv_mmap1", "errno %d\n", errno)) ++ if (CHECK(tmp0 != tmp1, "adv_mmap1", "tmp0: %p, tmp1: %p\n", tmp0, tmp1)) { ++ munmap(tmp0, 4 * page_size); + goto cleanup; ++ } + + /* unmap second page: pages 1, 3 mapped */ + err = munmap(tmp1 + page_size, page_size); + if (CHECK(err, "adv_mmap2", "errno %d\n", errno)) { +- munmap(tmp1, map_sz); ++ munmap(tmp1, 4 * page_size); + goto cleanup; + } + +@@ -201,7 +208,7 @@ void test_mmap(void) + MAP_SHARED | MAP_FIXED, data_map_fd, 0); + if (CHECK(tmp2 == MAP_FAILED, "adv_mmap3", "errno %d\n", errno)) { + munmap(tmp1, page_size); +- munmap(tmp1 + 2*page_size, page_size); ++ munmap(tmp1 + 2*page_size, 2 * page_size); + goto cleanup; + } + CHECK(tmp1 + page_size != tmp2, "adv_mmap4", +@@ -211,7 +218,7 @@ void test_mmap(void) + tmp2 = mmap(tmp1, 4 * page_size, PROT_READ, MAP_SHARED | MAP_FIXED, + data_map_fd, 0); + if (CHECK(tmp2 == MAP_FAILED, "adv_mmap5", "errno %d\n", errno)) { +- munmap(tmp1, 3 * page_size); /* unmap page 1 */ ++ munmap(tmp1, 4 * page_size); /* unmap page 1 */ + goto cleanup; + } + CHECK(tmp1 != tmp2, "adv_mmap6", "tmp1: %p, tmp2: %p\n", tmp1, tmp2); +-- +2.25.1 + diff --git a/queue-5.8/selftests-disable-rp_filter-for-icmp_redirect.sh.patch b/queue-5.8/selftests-disable-rp_filter-for-icmp_redirect.sh.patch new file mode 100644 index 00000000000..691c12a9ea6 --- /dev/null +++ b/queue-5.8/selftests-disable-rp_filter-for-icmp_redirect.sh.patch @@ -0,0 +1,38 @@ +From d6c5a0c30bae337c51a88b4c6d55dc2c15c9a81a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 09:43:33 -0600 +Subject: selftests: disable rp_filter for icmp_redirect.sh + +From: David Ahern + +[ Upstream commit bcf7ddb0186d366f761f86196b480ea6dd2dc18c ] + +h1 is initially configured to reach h2 via r1 rather than the +more direct path through r2. If rp_filter is set and inherited +for r2, forwarding fails since the source address of h1 is +reachable from eth0 vs the packet coming to it via r1 and eth1. +Since rp_filter setting affects the test, explicitly reset it. + +Signed-off-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/icmp_redirect.sh | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/net/icmp_redirect.sh b/tools/testing/selftests/net/icmp_redirect.sh +index 18c5de53558af..bf361f30d6ef9 100755 +--- a/tools/testing/selftests/net/icmp_redirect.sh ++++ b/tools/testing/selftests/net/icmp_redirect.sh +@@ -180,6 +180,8 @@ setup() + ;; + r[12]) ip netns exec $ns sysctl -q -w net.ipv4.ip_forward=1 + ip netns exec $ns sysctl -q -w net.ipv4.conf.all.send_redirects=1 ++ ip netns exec $ns sysctl -q -w net.ipv4.conf.default.rp_filter=0 ++ ip netns exec $ns sysctl -q -w net.ipv4.conf.all.rp_filter=0 + + ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=1 + ip netns exec $ns sysctl -q -w net.ipv6.route.mtu_expires=10 +-- +2.25.1 + diff --git a/queue-5.8/series b/queue-5.8/series index ba4c59c7477..f1ca8cf5753 100644 --- a/queue-5.8/series +++ b/queue-5.8/series @@ -82,3 +82,85 @@ pci-qcom-add-missing-reset-for-ipq806x.patch pm-devfreq-fix-the-wrong-end-with-semicolon.patch cpufreq-intel_pstate-fix-epp-setting-via-sysfs-in-ac.patch alsa-usb-audio-add-capture-support-for-saffire-6-usb.patch +nfsd-fix-oops-on-mixed-nfsv4-nfsv3-client-access.patch +block-respect-queue-limit-of-max-discard-segment.patch +block-virtio_blk-fix-handling-single-range-discard-r.patch +drm-msm-adreno-fix-updating-ring-fence.patch +block-fix-page_is_mergeable-for-compound-pages.patch +bfq-fix-blkio-cgroup-leakage-v4.patch +hwmon-nct7904-correct-divide-by-0.patch +blk-mq-insert-request-not-through-queue_rq-into-sw-s.patch +blkcg-fix-memleak-for-iolatency.patch +nvmet-fix-a-memory-leak.patch +nvme-fc-fix-wrong-return-value-in-__nvme_fc_init_req.patch +nvme-multipath-round-robin-fix-single-non-optimized-.patch +null_blk-fix-passing-of-req_fua-flag-in-null_handle_.patch +habanalabs-fix-memory-corruption-in-debugfs.patch +drm-etnaviv-always-start-stop-scheduler-in-timeout-p.patch +i2c-core-don-t-fail-prp0001-enumeration-when-no-id-t.patch +i2c-rcar-in-slave-mode-clear-nack-earlier.patch +vdpa-ifcvf-return-err-when-fail-to-request-config-ir.patch +vdpa-ifcvf-free-config-irq-in-ifcvf_free_irq.patch +usb-gadget-f_tcm-fix-some-resource-leaks-in-some-err.patch +video-fbdev-controlfb-fix-build-for-compile_test-y-p.patch +spi-stm32-clear-only-asserted-irq-flags-on-interrupt.patch +jbd2-make-sure-jh-have-b_transaction-set-in-refile-u.patch +ext4-don-t-bug-on-inconsistent-journal-feature.patch +ext4-handle-read-only-external-journal-device.patch +ext4-skip-non-loaded-groups-at-cr-0-1-when-scanning-.patch +drm-virtio-fix-memory-leak-in-virtio_gpu_cleanup_obj.patch +ext4-abort-the-filesystem-if-failed-to-async-write-m.patch +jbd2-abort-journal-if-free-a-async-write-error-metad.patch +ext4-handle-option-set-by-mount-flags-correctly.patch +ext4-handle-error-of-ext4_setup_system_zone-on-remou.patch +ext4-correctly-restore-system-zone-info-when-remount.patch +fs-prevent-bug_on-in-submit_bh_wbc.patch +spi-stm32h7-fix-race-condition-at-end-of-transfer.patch +spi-stm32-fix-fifo-threshold-level-in-case-of-short-.patch +spi-stm32-fix-stm32_spi_prepare_mbr-in-case-of-odd-c.patch +spi-stm32-always-perform-registers-configuration-pri.patch +drm-amd-powerplay-correct-vega20-cached-smu-feature-.patch +drm-amd-powerplay-correct-uvd-vce-pg-state-on-custom.patch +drm-amd-display-fix-lfc-multiplier-changing-erratica.patch +drm-amd-display-switch-to-immediate-mode-for-updatin.patch +selftests-bpf-fix-segmentation-fault-in-test_progs.patch +libbpf-handle-gcc-built-in-types-for-arm-neon.patch +netfilter-avoid-ipv6-nf_defrag_ipv6-module-dependenc.patch +libbpf-prevent-overriding-errno-when-logging-errors.patch +tools-bpftool-fix-compilation-warnings-in-32-bit-mod.patch +selftest-bpf-fix-compilation-warnings-in-32-bit-mode.patch +selftests-bpf-fix-btf_dump-test-cases-on-32-bit-arch.patch +selftests-bpf-correct-various-core_reloc-64-bit-assu.patch +can-j1939-transport-j1939_xtp_rx_dat_one-compare-own.patch +dma-pool-fix-coherent-pool-allocations-for-iommu-map.patch +dma-pool-only-allocate-from-cma-when-in-same-memory-.patch +drivers-net-wan-hdlc_x25-added-needed_headroom-and-a.patch +alsa-hda-realtek-add-model-alc298-samsung-headphone.patch +s390-cio-add-cond_resched-in-the-slow_eval_known_fn-.patch +asoc-wm8994-avoid-attempts-to-read-unreadable-regist.patch +alsa-usb-audio-ignore-broken-processing-extension-un.patch +selftests-disable-rp_filter-for-icmp_redirect.sh.patch +scsi-fcoe-fix-i-o-path-allocation.patch +scsi-ufs-fix-possible-infinite-loop-in-ufshcd_hold.patch +scsi-ufs-improve-interrupt-handling-for-shared-inter.patch +scsi-ufs-clean-up-completed-request-without-interrup.patch +scsi-scsi_debug-fix-scp-is-null-errors.patch +scsi-qla2xxx-flush-all-sessions-on-zone-disable.patch +scsi-qla2xxx-flush-i-o-on-zone-disable.patch +scsi-qla2xxx-indicate-correct-supported-speeds-for-m.patch +scsi-qla2xxx-fix-login-timeout.patch +scsi-qla2xxx-check-if-fw-supports-mq-before-enabling.patch +scsi-qla2xxx-fix-null-pointer-access-during-disconne.patch +revert-scsi-qla2xxx-fix-crash-on-qla2x00_mailbox_com.patch +macvlan-validate-setting-of-multiple-remote-source-m.patch +net-gianfar-add-of_node_put-before-goto-statement.patch +drm-amdgpu-fix-null-pointer-access-issue-when-unload.patch +drm-amdkfd-fix-the-wrong-sdma-instance-query-for-ren.patch +bpf-fix-a-rcu_sched-stall-issue-with-bpf-task-task_f.patch +bpf-avoid-visit-same-object-multiple-times.patch +ext4-limit-the-length-of-per-inode-prealloc-list.patch +powerpc-perf-fix-soft-lockups-due-to-missed-interrup.patch +libbpf-fix-map-index-used-in-error-message.patch +bpf-selftests-global_funcs-check-err_str-before-strs.patch +arm64-move-handling-of-erratum-1418040-into-c-code.patch +arm64-allow-booting-of-late-cpus-affected-by-erratum.patch diff --git a/queue-5.8/spi-stm32-always-perform-registers-configuration-pri.patch b/queue-5.8/spi-stm32-always-perform-registers-configuration-pri.patch new file mode 100644 index 00000000000..db824e99cfa --- /dev/null +++ b/queue-5.8/spi-stm32-always-perform-registers-configuration-pri.patch @@ -0,0 +1,87 @@ +From a8b321f59e182a7cef112f0fd4f10005930a3439 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 09:12:38 +0200 +Subject: spi: stm32: always perform registers configuration prior to transfer + +From: Alain Volmat + +[ Upstream commit 60ccb3515fc61a0124c70aa37317f75b67560024 ] + +SPI registers content may have been lost upon suspend/resume sequence. +So, always compute and apply the necessary configuration in +stm32_spi_transfer_one_setup routine. + +Signed-off-by: Alain Volmat +Link: https://lore.kernel.org/r/1597043558-29668-6-git-send-email-alain.volmat@st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 42 +++++++++++++++++------------------------ + 1 file changed, 17 insertions(+), 25 deletions(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 9b90a22543fd7..d4b33b358a31e 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -1597,41 +1597,33 @@ static int stm32_spi_transfer_one_setup(struct stm32_spi *spi, + unsigned long flags; + unsigned int comm_type; + int nb_words, ret = 0; ++ int mbr; + + spin_lock_irqsave(&spi->lock, flags); + + spi->cur_xferlen = transfer->len; + +- if (spi->cur_bpw != transfer->bits_per_word) { +- spi->cur_bpw = transfer->bits_per_word; +- spi->cfg->set_bpw(spi); +- } +- +- if (spi->cur_speed != transfer->speed_hz) { +- int mbr; +- +- /* Update spi->cur_speed with real clock speed */ +- mbr = stm32_spi_prepare_mbr(spi, transfer->speed_hz, +- spi->cfg->baud_rate_div_min, +- spi->cfg->baud_rate_div_max); +- if (mbr < 0) { +- ret = mbr; +- goto out; +- } ++ spi->cur_bpw = transfer->bits_per_word; ++ spi->cfg->set_bpw(spi); + +- transfer->speed_hz = spi->cur_speed; +- stm32_spi_set_mbr(spi, mbr); ++ /* Update spi->cur_speed with real clock speed */ ++ mbr = stm32_spi_prepare_mbr(spi, transfer->speed_hz, ++ spi->cfg->baud_rate_div_min, ++ spi->cfg->baud_rate_div_max); ++ if (mbr < 0) { ++ ret = mbr; ++ goto out; + } + +- comm_type = stm32_spi_communication_type(spi_dev, transfer); +- if (spi->cur_comm != comm_type) { +- ret = spi->cfg->set_mode(spi, comm_type); ++ transfer->speed_hz = spi->cur_speed; ++ stm32_spi_set_mbr(spi, mbr); + +- if (ret < 0) +- goto out; ++ comm_type = stm32_spi_communication_type(spi_dev, transfer); ++ ret = spi->cfg->set_mode(spi, comm_type); ++ if (ret < 0) ++ goto out; + +- spi->cur_comm = comm_type; +- } ++ spi->cur_comm = comm_type; + + if (spi->cfg->set_data_idleness) + spi->cfg->set_data_idleness(spi, transfer->len); +-- +2.25.1 + diff --git a/queue-5.8/spi-stm32-clear-only-asserted-irq-flags-on-interrupt.patch b/queue-5.8/spi-stm32-clear-only-asserted-irq-flags-on-interrupt.patch new file mode 100644 index 00000000000..60a4519d011 --- /dev/null +++ b/queue-5.8/spi-stm32-clear-only-asserted-irq-flags-on-interrupt.patch @@ -0,0 +1,39 @@ +From 806ff3f86f5fa59de9b8e4bfcda592aa17545341 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Aug 2020 21:51:36 +0200 +Subject: spi: stm32: clear only asserted irq flags on interrupt + +From: Tobias Schramm + +[ Upstream commit ae1ba50f1e706dfd7ce402ac52c1f1f10becad68 ] + +Previously the stm32h7 interrupt thread cleared all non-masked interrupts. +If an interrupt was to occur during the handling of another interrupt its +flag would be unset, resulting in a lost interrupt. +This patches fixes the issue by clearing only the currently set interrupt +flags. + +Signed-off-by: Tobias Schramm +Link: https://lore.kernel.org/r/20200804195136.1485392-1-t.schramm@manjaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 9672cda2f8031..13f3d959759fb 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -967,7 +967,7 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id) + if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len > 0))) + stm32h7_spi_read_rxfifo(spi, false); + +- writel_relaxed(mask, spi->base + STM32H7_SPI_IFCR); ++ writel_relaxed(sr & mask, spi->base + STM32H7_SPI_IFCR); + + spin_unlock_irqrestore(&spi->lock, flags); + +-- +2.25.1 + diff --git a/queue-5.8/spi-stm32-fix-fifo-threshold-level-in-case-of-short-.patch b/queue-5.8/spi-stm32-fix-fifo-threshold-level-in-case-of-short-.patch new file mode 100644 index 00000000000..d3a578b92b5 --- /dev/null +++ b/queue-5.8/spi-stm32-fix-fifo-threshold-level-in-case-of-short-.patch @@ -0,0 +1,99 @@ +From 3bfa391f680aa22db6d56b48bcc21bbef32edb6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 09:12:35 +0200 +Subject: spi: stm32: fix fifo threshold level in case of short transfer + +From: Amelie Delaunay + +[ Upstream commit 3373e9004acc0603242622b4378c64bc01d21b5f ] + +When transfer is shorter than half of the fifo, set the data packet size +up to transfer size instead of up to half of the fifo. +Check also that threshold is set at least to 1 data frame. + +Signed-off-by: Amelie Delaunay +Signed-off-by: Alain Volmat +Link: https://lore.kernel.org/r/1597043558-29668-3-git-send-email-alain.volmat@st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 26 ++++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index fce679635829c..7f2113e7b3ddc 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -468,20 +468,27 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz, + /** + * stm32h7_spi_prepare_fthlv - Determine FIFO threshold level + * @spi: pointer to the spi controller data structure ++ * @xfer_len: length of the message to be transferred + */ +-static u32 stm32h7_spi_prepare_fthlv(struct stm32_spi *spi) ++static u32 stm32h7_spi_prepare_fthlv(struct stm32_spi *spi, u32 xfer_len) + { +- u32 fthlv, half_fifo; ++ u32 fthlv, half_fifo, packet; + + /* data packet should not exceed 1/2 of fifo space */ + half_fifo = (spi->fifo_size / 2); + ++ /* data_packet should not exceed transfer length */ ++ if (half_fifo > xfer_len) ++ packet = xfer_len; ++ else ++ packet = half_fifo; ++ + if (spi->cur_bpw <= 8) +- fthlv = half_fifo; ++ fthlv = packet; + else if (spi->cur_bpw <= 16) +- fthlv = half_fifo / 2; ++ fthlv = packet / 2; + else +- fthlv = half_fifo / 4; ++ fthlv = packet / 4; + + /* align packet size with data registers access */ + if (spi->cur_bpw > 8) +@@ -489,6 +496,9 @@ static u32 stm32h7_spi_prepare_fthlv(struct stm32_spi *spi) + else + fthlv -= (fthlv % 4); /* multiple of 4 */ + ++ if (!fthlv) ++ fthlv = 1; ++ + return fthlv; + } + +@@ -1394,7 +1404,7 @@ static void stm32h7_spi_set_bpw(struct stm32_spi *spi) + cfg1_setb |= (bpw << STM32H7_SPI_CFG1_DSIZE_SHIFT) & + STM32H7_SPI_CFG1_DSIZE; + +- spi->cur_fthlv = stm32h7_spi_prepare_fthlv(spi); ++ spi->cur_fthlv = stm32h7_spi_prepare_fthlv(spi, spi->cur_xferlen); + fthlv = spi->cur_fthlv - 1; + + cfg1_clrb |= STM32H7_SPI_CFG1_FTHLV; +@@ -1589,6 +1599,8 @@ static int stm32_spi_transfer_one_setup(struct stm32_spi *spi, + + spin_lock_irqsave(&spi->lock, flags); + ++ spi->cur_xferlen = transfer->len; ++ + if (spi->cur_bpw != transfer->bits_per_word) { + spi->cur_bpw = transfer->bits_per_word; + spi->cfg->set_bpw(spi); +@@ -1636,8 +1648,6 @@ static int stm32_spi_transfer_one_setup(struct stm32_spi *spi, + goto out; + } + +- spi->cur_xferlen = transfer->len; +- + dev_dbg(spi->dev, "transfer communication mode set to %d\n", + spi->cur_comm); + dev_dbg(spi->dev, +-- +2.25.1 + diff --git a/queue-5.8/spi-stm32-fix-stm32_spi_prepare_mbr-in-case-of-odd-c.patch b/queue-5.8/spi-stm32-fix-stm32_spi_prepare_mbr-in-case-of-odd-c.patch new file mode 100644 index 00000000000..a3c081409aa --- /dev/null +++ b/queue-5.8/spi-stm32-fix-stm32_spi_prepare_mbr-in-case-of-odd-c.patch @@ -0,0 +1,38 @@ +From 4fecc9ef85a49ade4d2239a0636d1d18149fe06b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 09:12:36 +0200 +Subject: spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate + +From: Amelie Delaunay + +[ Upstream commit 9cc61973bf9385b19ff5dda4a2a7e265fcba85e4 ] + +Fix spi->clk_rate when it is odd to the nearest lowest even value because +minimum SPI divider is 2. + +Signed-off-by: Amelie Delaunay +Signed-off-by: Alain Volmat +Link: https://lore.kernel.org/r/1597043558-29668-4-git-send-email-alain.volmat@st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 7f2113e7b3ddc..9b90a22543fd7 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -442,7 +442,8 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz, + { + u32 div, mbrdiv; + +- div = DIV_ROUND_UP(spi->clk_rate, speed_hz); ++ /* Ensure spi->clk_rate is even */ ++ div = DIV_ROUND_UP(spi->clk_rate & ~0x1, speed_hz); + + /* + * SPI framework set xfer->speed_hz to master->max_speed_hz if +-- +2.25.1 + diff --git a/queue-5.8/spi-stm32h7-fix-race-condition-at-end-of-transfer.patch b/queue-5.8/spi-stm32h7-fix-race-condition-at-end-of-transfer.patch new file mode 100644 index 00000000000..39aed23756c --- /dev/null +++ b/queue-5.8/spi-stm32h7-fix-race-condition-at-end-of-transfer.patch @@ -0,0 +1,44 @@ +From a37930829df4f2f316f8425569ad7a46d093304b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 09:12:34 +0200 +Subject: spi: stm32h7: fix race condition at end of transfer + +From: Antonio Borneo + +[ Upstream commit 135dd873d3c76d812ae64c668adef3f2c59ed27f ] + +The caller of stm32_spi_transfer_one(), spi_transfer_one_message(), +is waiting for us to call spi_finalize_current_transfer() and will +eventually schedule a new transfer, if available. +We should guarantee that the spi controller is really available +before calling spi_finalize_current_transfer(). + +Move the call to spi_finalize_current_transfer() _after_ the call +to stm32_spi_disable(). + +Signed-off-by: Antonio Borneo +Signed-off-by: Alain Volmat +Link: https://lore.kernel.org/r/1597043558-29668-2-git-send-email-alain.volmat@st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 13f3d959759fb..fce679635829c 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -972,8 +972,8 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id) + spin_unlock_irqrestore(&spi->lock, flags); + + if (end) { +- spi_finalize_current_transfer(master); + stm32h7_spi_disable(spi); ++ spi_finalize_current_transfer(master); + } + + return IRQ_HANDLED; +-- +2.25.1 + diff --git a/queue-5.8/tools-bpftool-fix-compilation-warnings-in-32-bit-mod.patch b/queue-5.8/tools-bpftool-fix-compilation-warnings-in-32-bit-mod.patch new file mode 100644 index 00000000000..ccf8f59e037 --- /dev/null +++ b/queue-5.8/tools-bpftool-fix-compilation-warnings-in-32-bit-mod.patch @@ -0,0 +1,155 @@ +From 949b1e8ef2f2dcf98e2017a98282efbc3d748e3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Aug 2020 13:49:37 -0700 +Subject: tools/bpftool: Fix compilation warnings in 32-bit mode + +From: Andrii Nakryiko + +[ Upstream commit 09f44b753a7d120becc80213c3459183c8acd26b ] + +Fix few compilation warnings in bpftool when compiling in 32-bit mode. +Abstract away u64 to pointer conversion into a helper function. + +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20200813204945.1020225-2-andriin@fb.com +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/btf_dumper.c | 2 +- + tools/bpf/bpftool/link.c | 4 ++-- + tools/bpf/bpftool/main.h | 10 +++++++++- + tools/bpf/bpftool/prog.c | 16 ++++++++-------- + 4 files changed, 20 insertions(+), 12 deletions(-) + +diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c +index ede162f83eea0..0e9310727281a 100644 +--- a/tools/bpf/bpftool/btf_dumper.c ++++ b/tools/bpf/bpftool/btf_dumper.c +@@ -67,7 +67,7 @@ static int dump_prog_id_as_func_ptr(const struct btf_dumper *d, + if (!info->btf_id || !info->nr_func_info || + btf__get_from_id(info->btf_id, &prog_btf)) + goto print; +- finfo = (struct bpf_func_info *)info->func_info; ++ finfo = u64_to_ptr(info->func_info); + func_type = btf__type_by_id(prog_btf, finfo->type_id); + if (!func_type || !btf_is_func(func_type)) + goto print; +diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c +index fca57ee8fafe4..dea691c83afca 100644 +--- a/tools/bpf/bpftool/link.c ++++ b/tools/bpf/bpftool/link.c +@@ -101,7 +101,7 @@ static int show_link_close_json(int fd, struct bpf_link_info *info) + switch (info->type) { + case BPF_LINK_TYPE_RAW_TRACEPOINT: + jsonw_string_field(json_wtr, "tp_name", +- (const char *)info->raw_tracepoint.tp_name); ++ u64_to_ptr(info->raw_tracepoint.tp_name)); + break; + case BPF_LINK_TYPE_TRACING: + err = get_prog_info(info->prog_id, &prog_info); +@@ -177,7 +177,7 @@ static int show_link_close_plain(int fd, struct bpf_link_info *info) + switch (info->type) { + case BPF_LINK_TYPE_RAW_TRACEPOINT: + printf("\n\ttp '%s' ", +- (const char *)info->raw_tracepoint.tp_name); ++ (const char *)u64_to_ptr(info->raw_tracepoint.tp_name)); + break; + case BPF_LINK_TYPE_TRACING: + err = get_prog_info(info->prog_id, &prog_info); +diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h +index 5cdf0bc049bd9..5917484c2e027 100644 +--- a/tools/bpf/bpftool/main.h ++++ b/tools/bpf/bpftool/main.h +@@ -21,7 +21,15 @@ + /* Make sure we do not use kernel-only integer typedefs */ + #pragma GCC poison u8 u16 u32 u64 s8 s16 s32 s64 + +-#define ptr_to_u64(ptr) ((__u64)(unsigned long)(ptr)) ++static inline __u64 ptr_to_u64(const void *ptr) ++{ ++ return (__u64)(unsigned long)ptr; ++} ++ ++static inline void *u64_to_ptr(__u64 ptr) ++{ ++ return (void *)(unsigned long)ptr; ++} + + #define NEXT_ARG() ({ argc--; argv++; if (argc < 0) usage(); }) + #define NEXT_ARGP() ({ (*argc)--; (*argv)++; if (*argc < 0) usage(); }) +diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c +index a5eff83496f2d..2c6f7e160b248 100644 +--- a/tools/bpf/bpftool/prog.c ++++ b/tools/bpf/bpftool/prog.c +@@ -537,14 +537,14 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode, + p_info("no instructions returned"); + return -1; + } +- buf = (unsigned char *)(info->jited_prog_insns); ++ buf = u64_to_ptr(info->jited_prog_insns); + member_len = info->jited_prog_len; + } else { /* DUMP_XLATED */ + if (info->xlated_prog_len == 0 || !info->xlated_prog_insns) { + p_err("error retrieving insn dump: kernel.kptr_restrict set?"); + return -1; + } +- buf = (unsigned char *)info->xlated_prog_insns; ++ buf = u64_to_ptr(info->xlated_prog_insns); + member_len = info->xlated_prog_len; + } + +@@ -553,7 +553,7 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode, + return -1; + } + +- func_info = (void *)info->func_info; ++ func_info = u64_to_ptr(info->func_info); + + if (info->nr_line_info) { + prog_linfo = bpf_prog_linfo__new(info); +@@ -571,7 +571,7 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode, + + n = write(fd, buf, member_len); + close(fd); +- if (n != member_len) { ++ if (n != (ssize_t)member_len) { + p_err("error writing output file: %s", + n < 0 ? strerror(errno) : "short write"); + return -1; +@@ -601,13 +601,13 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode, + __u32 i; + if (info->nr_jited_ksyms) { + kernel_syms_load(&dd); +- ksyms = (__u64 *) info->jited_ksyms; ++ ksyms = u64_to_ptr(info->jited_ksyms); + } + + if (json_output) + jsonw_start_array(json_wtr); + +- lens = (__u32 *) info->jited_func_lens; ++ lens = u64_to_ptr(info->jited_func_lens); + for (i = 0; i < info->nr_jited_func_lens; i++) { + if (ksyms) { + sym = kernel_syms_search(&dd, ksyms[i]); +@@ -668,7 +668,7 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode, + } else { + kernel_syms_load(&dd); + dd.nr_jited_ksyms = info->nr_jited_ksyms; +- dd.jited_ksyms = (__u64 *) info->jited_ksyms; ++ dd.jited_ksyms = u64_to_ptr(info->jited_ksyms); + dd.btf = btf; + dd.func_info = func_info; + dd.finfo_rec_size = info->func_info_rec_size; +@@ -1790,7 +1790,7 @@ static char *profile_target_name(int tgt_fd) + goto out; + } + +- func_info = (struct bpf_func_info *)(info_linear->info.func_info); ++ func_info = u64_to_ptr(info_linear->info.func_info); + t = btf__type_by_id(btf, func_info[0].type_id); + if (!t) { + p_err("btf %d doesn't have type %d", +-- +2.25.1 + diff --git a/queue-5.8/usb-gadget-f_tcm-fix-some-resource-leaks-in-some-err.patch b/queue-5.8/usb-gadget-f_tcm-fix-some-resource-leaks-in-some-err.patch new file mode 100644 index 00000000000..142841a8d7e --- /dev/null +++ b/queue-5.8/usb-gadget-f_tcm-fix-some-resource-leaks-in-some-err.patch @@ -0,0 +1,46 @@ +From e52b31b3452089a46d44dd122db1a94d6e72b415 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Aug 2020 07:55:01 +0200 +Subject: usb: gadget: f_tcm: Fix some resource leaks in some error paths + +From: Christophe JAILLET + +[ Upstream commit 07c8434150f4eb0b65cae288721c8af1080fde17 ] + +If a memory allocation fails within a 'usb_ep_alloc_request()' call, the +already allocated memory must be released. + +Fix a mix-up in the code and free the correct requests. + +Fixes: c52661d60f63 ("usb-gadget: Initial merge of target module for UASP + BOT") +Signed-off-by: Christophe JAILLET +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_tcm.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c +index eaf556ceac32b..0a45b4ef66a67 100644 +--- a/drivers/usb/gadget/function/f_tcm.c ++++ b/drivers/usb/gadget/function/f_tcm.c +@@ -753,12 +753,13 @@ static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream) + goto err_sts; + + return 0; ++ + err_sts: +- usb_ep_free_request(fu->ep_status, stream->req_status); +- stream->req_status = NULL; +-err_out: + usb_ep_free_request(fu->ep_out, stream->req_out); + stream->req_out = NULL; ++err_out: ++ usb_ep_free_request(fu->ep_in, stream->req_in); ++ stream->req_in = NULL; + out: + return -ENOMEM; + } +-- +2.25.1 + diff --git a/queue-5.8/vdpa-ifcvf-free-config-irq-in-ifcvf_free_irq.patch b/queue-5.8/vdpa-ifcvf-free-config-irq-in-ifcvf_free_irq.patch new file mode 100644 index 00000000000..f3b4830d4e1 --- /dev/null +++ b/queue-5.8/vdpa-ifcvf-free-config-irq-in-ifcvf_free_irq.patch @@ -0,0 +1,68 @@ +From 186f88dfc78aa59ea780f924c97f925f675831c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 17:12:54 +0800 +Subject: vdpa: ifcvf: free config irq in ifcvf_free_irq() + +From: Jason Wang + +[ Upstream commit 2b9f28d5e8efad34f472542315911c5ee9a65b6c ] + +We don't free config irq in ifcvf_free_irq() which will trigger a +BUG() in pci core since we try to free the vectors that has an +action. Fixing this by recording the config irq in ifcvf_hw structure +and free it in ifcvf_free_irq(). + +Fixes: e7991f376a4d ("ifcvf: implement config interrupt in IFCVF") +Cc: Zhu Lingshan +Signed-off-by: Jason Wang +Link: https://lore.kernel.org/r/20200723091254.20617-2-jasowang@redhat.com +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Zhu Lingshan +Fixes: e7991f376a4d ("ifcvf: implement config interrupt in IFCVF") +Cc: Zhu Lingshan <lingshan.zhu@intel.com> +Signed-off-by: Jason Wang <jasowang@redhat.com> +Signed-off-by: Sasha Levin +--- + drivers/vdpa/ifcvf/ifcvf_base.h | 2 +- + drivers/vdpa/ifcvf/ifcvf_main.c | 5 +++-- + 2 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/vdpa/ifcvf/ifcvf_base.h b/drivers/vdpa/ifcvf/ifcvf_base.h +index f4554412e607f..29efa75cdfce5 100644 +--- a/drivers/vdpa/ifcvf/ifcvf_base.h ++++ b/drivers/vdpa/ifcvf/ifcvf_base.h +@@ -84,7 +84,7 @@ struct ifcvf_hw { + void __iomem * const *base; + char config_msix_name[256]; + struct vdpa_callback config_cb; +- ++ unsigned int config_irq; + }; + + struct ifcvf_adapter { +diff --git a/drivers/vdpa/ifcvf/ifcvf_main.c b/drivers/vdpa/ifcvf/ifcvf_main.c +index ae7110955a44d..7a6d899e541df 100644 +--- a/drivers/vdpa/ifcvf/ifcvf_main.c ++++ b/drivers/vdpa/ifcvf/ifcvf_main.c +@@ -53,6 +53,7 @@ static void ifcvf_free_irq(struct ifcvf_adapter *adapter, int queues) + for (i = 0; i < queues; i++) + devm_free_irq(&pdev->dev, vf->vring[i].irq, &vf->vring[i]); + ++ devm_free_irq(&pdev->dev, vf->config_irq, vf); + ifcvf_free_irq_vectors(pdev); + } + +@@ -72,8 +73,8 @@ static int ifcvf_request_irq(struct ifcvf_adapter *adapter) + snprintf(vf->config_msix_name, 256, "ifcvf[%s]-config\n", + pci_name(pdev)); + vector = 0; +- irq = pci_irq_vector(pdev, vector); +- ret = devm_request_irq(&pdev->dev, irq, ++ vf->config_irq = pci_irq_vector(pdev, vector); ++ ret = devm_request_irq(&pdev->dev, vf->config_irq, + ifcvf_config_changed, 0, + vf->config_msix_name, vf); + if (ret) { +-- +2.25.1 + diff --git a/queue-5.8/vdpa-ifcvf-return-err-when-fail-to-request-config-ir.patch b/queue-5.8/vdpa-ifcvf-return-err-when-fail-to-request-config-ir.patch new file mode 100644 index 00000000000..4475d6ead01 --- /dev/null +++ b/queue-5.8/vdpa-ifcvf-return-err-when-fail-to-request-config-ir.patch @@ -0,0 +1,44 @@ +From f6f69751ab79b5e5ab3d362998964979fdd22233 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 17:12:53 +0800 +Subject: vdpa: ifcvf: return err when fail to request config irq + +From: Jason Wang + +[ Upstream commit 9f4ce5d72b8e7a1f750598407c99f9e39dfb12fc ] + +We ignore the err of requesting config interrupt, fix this. + +Fixes: e7991f376a4d ("ifcvf: implement config interrupt in IFCVF") +Cc: Zhu Lingshan +Signed-off-by: Jason Wang +Link: https://lore.kernel.org/r/20200723091254.20617-1-jasowang@redhat.com +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Zhu Lingshan +Fixes: e7991f376a4d ("ifcvf: implement config interrupt in IFCVF") +Cc: Zhu Lingshan <lingshan.zhu@intel.com> +Signed-off-by: Jason Wang <jasowang@redhat.com> +Tested-by: Maxime Coquelin +Signed-off-by: Sasha Levin +--- + drivers/vdpa/ifcvf/ifcvf_main.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/vdpa/ifcvf/ifcvf_main.c b/drivers/vdpa/ifcvf/ifcvf_main.c +index f5a60c14b9799..ae7110955a44d 100644 +--- a/drivers/vdpa/ifcvf/ifcvf_main.c ++++ b/drivers/vdpa/ifcvf/ifcvf_main.c +@@ -76,6 +76,10 @@ static int ifcvf_request_irq(struct ifcvf_adapter *adapter) + ret = devm_request_irq(&pdev->dev, irq, + ifcvf_config_changed, 0, + vf->config_msix_name, vf); ++ if (ret) { ++ IFCVF_ERR(pdev, "Failed to request config irq\n"); ++ return ret; ++ } + + for (i = 0; i < IFCVF_MAX_QUEUE_PAIRS * 2; i++) { + snprintf(vf->vring[i].msix_name, 256, "ifcvf[%s]-%d\n", +-- +2.25.1 + diff --git a/queue-5.8/video-fbdev-controlfb-fix-build-for-compile_test-y-p.patch b/queue-5.8/video-fbdev-controlfb-fix-build-for-compile_test-y-p.patch new file mode 100644 index 00000000000..3bd6abe36d2 --- /dev/null +++ b/queue-5.8/video-fbdev-controlfb-fix-build-for-compile_test-y-p.patch @@ -0,0 +1,46 @@ +From 3926a37877f179f9d703989839aa8b07a7eaef12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 20:49:10 +1000 +Subject: video: fbdev: controlfb: Fix build for COMPILE_TEST=y && PPC_PMAC=n +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Ellerman + +[ Upstream commit 4d618b9f3fcab84e9ec28c180de46fb2c929d096 ] + +The build is currently broken, if COMPILE_TEST=y and PPC_PMAC=n: + + linux/drivers/video/fbdev/controlfb.c: In function ‘control_set_hardware’: + linux/drivers/video/fbdev/controlfb.c:276:2: error: implicit declaration of function ‘btext_update_display’ + 276 | btext_update_display(p->frame_buffer_phys + CTRLFB_OFF, + | ^~~~~~~~~~~~~~~~~~~~ + +Fix it by including btext.h whenever CONFIG_BOOTX_TEXT is enabled. + +Fixes: a07a63b0e24d ("video: fbdev: controlfb: add COMPILE_TEST support") +Signed-off-by: Michael Ellerman +Acked-by: Bartlomiej Zolnierkiewicz +Link: https://lore.kernel.org/r/20200821104910.3363818-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/controlfb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/video/fbdev/controlfb.c b/drivers/video/fbdev/controlfb.c +index 9c4f1be856eca..547abeb39f87a 100644 +--- a/drivers/video/fbdev/controlfb.c ++++ b/drivers/video/fbdev/controlfb.c +@@ -49,6 +49,8 @@ + #include + #ifdef CONFIG_PPC_PMAC + #include ++#endif ++#ifdef CONFIG_BOOTX_TEXT + #include + #endif + +-- +2.25.1 +