From: Greg Kroah-Hartman Date: Mon, 24 Jan 2022 12:28:17 +0000 (+0100) Subject: 5.16-stable patches X-Git-Tag: v4.4.300~68 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7752d398431b021cb3438685858d1ee1bf934f34;p=thirdparty%2Fkernel%2Fstable-queue.git 5.16-stable patches added patches: af_unix-annote-lockless-accesses-to-unix_tot_inflight-gc_in_progress.patch arm64-bpf-remove-128mb-limit-for-bpf-jit-programs.patch bpf-fix-mount-source-show-for-bpffs.patch bpf-mark-ptr_to_func-register-initially-with-zero-offset.patch bpftool-fix-indent-in-option-lists-in-the-documentation.patch bpftool-remove-inclusion-of-utilities.mak-from-makefiles.patch crypto-octeontx2-uninitialized-variable-in-kvf_limits_store.patch drm-vmwgfx-remove-explicit-transparent-hugepages-support.patch drm-vmwgfx-remove-unused-compile-options.patch f2fs-compress-fix-potential-deadlock-of-compress-file.patch f2fs-fix-remove-page-failed-in-invalidate-compress-pages.patch f2fs-fix-to-avoid-panic-in-is_alive-if-metadata-is-inconsistent.patch f2fs-fix-to-check-available-space-of-cp-area-correctly-in-update_ckpt_flags.patch f2fs-fix-to-reserve-space-for-io-align-feature.patch ipv4-avoid-quadratic-behavior-in-netns-dismantle.patch ipv4-update-fib_info_cnt-under-spinlock-protection.patch libbpf-remove-deprecation-attribute-from-struct-bpf_prog_prep_result.patch mlx5-don-t-accidentally-set-rto_onlink-before-mlx5e_route_lookup_ipv4_get.patch net-fsl-xgmac_mdio-add-workaround-for-erratum-a-009885.patch net-fsl-xgmac_mdio-fix-incorrect-iounmap-when-removing-module.patch parisc-pdc_stable-fix-memory-leak-in-pdcs_register_pathentries.patch perf-evsel-override-attr-sample_period-for-non-libpfm4-events.patch risc-v-defconfigs-set-config_fb-y-for-fb-console.patch riscv-dts-microchip-mpfs-drop-empty-chosen-node.patch xdp-check-prog-type-before-updating-bpf-link.patch --- diff --git a/queue-5.16/af_unix-annote-lockless-accesses-to-unix_tot_inflight-gc_in_progress.patch b/queue-5.16/af_unix-annote-lockless-accesses-to-unix_tot_inflight-gc_in_progress.patch new file mode 100644 index 00000000000..56bcb84d87d --- /dev/null +++ b/queue-5.16/af_unix-annote-lockless-accesses-to-unix_tot_inflight-gc_in_progress.patch @@ -0,0 +1,128 @@ +From 9d6d7f1cb67cdee15f1a0e85aacfb924e0e02435 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Fri, 14 Jan 2022 08:43:28 -0800 +Subject: af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress + +From: Eric Dumazet + +commit 9d6d7f1cb67cdee15f1a0e85aacfb924e0e02435 upstream. + +wait_for_unix_gc() reads unix_tot_inflight & gc_in_progress +without synchronization. + +Adds READ_ONCE()/WRITE_ONCE() and their associated comments +to better document the intent. + +BUG: KCSAN: data-race in unix_inflight / wait_for_unix_gc + +write to 0xffffffff86e2b7c0 of 4 bytes by task 9380 on cpu 0: + unix_inflight+0x1e8/0x260 net/unix/scm.c:63 + unix_attach_fds+0x10c/0x1e0 net/unix/scm.c:121 + unix_scm_to_skb net/unix/af_unix.c:1674 [inline] + unix_dgram_sendmsg+0x679/0x16b0 net/unix/af_unix.c:1817 + unix_seqpacket_sendmsg+0xcc/0x110 net/unix/af_unix.c:2258 + sock_sendmsg_nosec net/socket.c:704 [inline] + sock_sendmsg net/socket.c:724 [inline] + ____sys_sendmsg+0x39a/0x510 net/socket.c:2409 + ___sys_sendmsg net/socket.c:2463 [inline] + __sys_sendmmsg+0x267/0x4c0 net/socket.c:2549 + __do_sys_sendmmsg net/socket.c:2578 [inline] + __se_sys_sendmmsg net/socket.c:2575 [inline] + __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2575 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +read to 0xffffffff86e2b7c0 of 4 bytes by task 9375 on cpu 1: + wait_for_unix_gc+0x24/0x160 net/unix/garbage.c:196 + unix_dgram_sendmsg+0x8e/0x16b0 net/unix/af_unix.c:1772 + unix_seqpacket_sendmsg+0xcc/0x110 net/unix/af_unix.c:2258 + sock_sendmsg_nosec net/socket.c:704 [inline] + sock_sendmsg net/socket.c:724 [inline] + ____sys_sendmsg+0x39a/0x510 net/socket.c:2409 + ___sys_sendmsg net/socket.c:2463 [inline] + __sys_sendmmsg+0x267/0x4c0 net/socket.c:2549 + __do_sys_sendmmsg net/socket.c:2578 [inline] + __se_sys_sendmmsg net/socket.c:2575 [inline] + __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2575 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +value changed: 0x00000002 -> 0x00000004 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 PID: 9375 Comm: syz-executor.1 Not tainted 5.16.0-rc7-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + +Fixes: 9915672d4127 ("af_unix: limit unix_tot_inflight") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Link: https://lore.kernel.org/r/20220114164328.2038499-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/unix/garbage.c | 14 +++++++++++--- + net/unix/scm.c | 6 ++++-- + 2 files changed, 15 insertions(+), 5 deletions(-) + +--- a/net/unix/garbage.c ++++ b/net/unix/garbage.c +@@ -192,8 +192,11 @@ void wait_for_unix_gc(void) + { + /* If number of inflight sockets is insane, + * force a garbage collect right now. ++ * Paired with the WRITE_ONCE() in unix_inflight(), ++ * unix_notinflight() and gc_in_progress(). + */ +- if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress) ++ if (READ_ONCE(unix_tot_inflight) > UNIX_INFLIGHT_TRIGGER_GC && ++ !READ_ONCE(gc_in_progress)) + unix_gc(); + wait_event(unix_gc_wait, gc_in_progress == false); + } +@@ -213,7 +216,9 @@ void unix_gc(void) + if (gc_in_progress) + goto out; + +- gc_in_progress = true; ++ /* Paired with READ_ONCE() in wait_for_unix_gc(). */ ++ WRITE_ONCE(gc_in_progress, true); ++ + /* First, select candidates for garbage collection. Only + * in-flight sockets are considered, and from those only ones + * which don't have any external reference. +@@ -299,7 +304,10 @@ void unix_gc(void) + + /* All candidates should have been detached by now. */ + BUG_ON(!list_empty(&gc_candidates)); +- gc_in_progress = false; ++ ++ /* Paired with READ_ONCE() in wait_for_unix_gc(). */ ++ WRITE_ONCE(gc_in_progress, false); ++ + wake_up(&unix_gc_wait); + + out: +--- a/net/unix/scm.c ++++ b/net/unix/scm.c +@@ -60,7 +60,8 @@ void unix_inflight(struct user_struct *u + } else { + BUG_ON(list_empty(&u->link)); + } +- unix_tot_inflight++; ++ /* Paired with READ_ONCE() in wait_for_unix_gc() */ ++ WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + 1); + } + user->unix_inflight++; + spin_unlock(&unix_gc_lock); +@@ -80,7 +81,8 @@ void unix_notinflight(struct user_struct + + if (atomic_long_dec_and_test(&u->inflight)) + list_del_init(&u->link); +- unix_tot_inflight--; ++ /* Paired with READ_ONCE() in wait_for_unix_gc() */ ++ WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - 1); + } + user->unix_inflight--; + spin_unlock(&unix_gc_lock); diff --git a/queue-5.16/arm64-bpf-remove-128mb-limit-for-bpf-jit-programs.patch b/queue-5.16/arm64-bpf-remove-128mb-limit-for-bpf-jit-programs.patch new file mode 100644 index 00000000000..d54478c44ed --- /dev/null +++ b/queue-5.16/arm64-bpf-remove-128mb-limit-for-bpf-jit-programs.patch @@ -0,0 +1,115 @@ +From b89ddf4cca43f1269093942cf5c4e457fd45c335 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Fri, 5 Nov 2021 16:50:45 +0000 +Subject: arm64/bpf: Remove 128MB limit for BPF JIT programs + +From: Russell King + +commit b89ddf4cca43f1269093942cf5c4e457fd45c335 upstream. + +Commit 91fc957c9b1d ("arm64/bpf: don't allocate BPF JIT programs in module +memory") restricts BPF JIT program allocation to a 128MB region to ensure +BPF programs are still in branching range of each other. However this +restriction should not apply to the aarch64 JIT, since BPF_JMP | BPF_CALL +are implemented as a 64-bit move into a register and then a BLR instruction - +which has the effect of being able to call anything without proximity +limitation. + +The practical reason to relax this restriction on JIT memory is that 128MB of +JIT memory can be quickly exhausted, especially where PAGE_SIZE is 64KB - one +page is needed per program. In cases where seccomp filters are applied to +multiple VMs on VM launch - such filters are classic BPF but converted to +BPF - this can severely limit the number of VMs that can be launched. In a +world where we support BPF JIT always on, turning off the JIT isn't always an +option either. + +Fixes: 91fc957c9b1d ("arm64/bpf: don't allocate BPF JIT programs in module memory") +Suggested-by: Ard Biesheuvel +Signed-off-by: Russell King +Signed-off-by: Daniel Borkmann +Tested-by: Alan Maguire +Link: https://lore.kernel.org/bpf/1636131046-5982-2-git-send-email-alan.maguire@oracle.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/include/asm/extable.h | 9 --------- + arch/arm64/include/asm/memory.h | 5 +---- + arch/arm64/kernel/traps.c | 2 +- + arch/arm64/mm/ptdump.c | 2 -- + arch/arm64/net/bpf_jit_comp.c | 7 ++----- + 5 files changed, 4 insertions(+), 21 deletions(-) + +--- a/arch/arm64/include/asm/extable.h ++++ b/arch/arm64/include/asm/extable.h +@@ -33,15 +33,6 @@ do { \ + (b)->data = (tmp).data; \ + } while (0) + +-static inline bool in_bpf_jit(struct pt_regs *regs) +-{ +- if (!IS_ENABLED(CONFIG_BPF_JIT)) +- return false; +- +- return regs->pc >= BPF_JIT_REGION_START && +- regs->pc < BPF_JIT_REGION_END; +-} +- + #ifdef CONFIG_BPF_JIT + bool ex_handler_bpf(const struct exception_table_entry *ex, + struct pt_regs *regs); +--- a/arch/arm64/include/asm/memory.h ++++ b/arch/arm64/include/asm/memory.h +@@ -44,11 +44,8 @@ + #define _PAGE_OFFSET(va) (-(UL(1) << (va))) + #define PAGE_OFFSET (_PAGE_OFFSET(VA_BITS)) + #define KIMAGE_VADDR (MODULES_END) +-#define BPF_JIT_REGION_START (_PAGE_END(VA_BITS_MIN)) +-#define BPF_JIT_REGION_SIZE (SZ_128M) +-#define BPF_JIT_REGION_END (BPF_JIT_REGION_START + BPF_JIT_REGION_SIZE) + #define MODULES_END (MODULES_VADDR + MODULES_VSIZE) +-#define MODULES_VADDR (BPF_JIT_REGION_END) ++#define MODULES_VADDR (_PAGE_END(VA_BITS_MIN)) + #define MODULES_VSIZE (SZ_128M) + #define VMEMMAP_START (-(UL(1) << (VA_BITS - VMEMMAP_SHIFT))) + #define VMEMMAP_END (VMEMMAP_START + VMEMMAP_SIZE) +--- a/arch/arm64/kernel/traps.c ++++ b/arch/arm64/kernel/traps.c +@@ -994,7 +994,7 @@ static struct break_hook bug_break_hook + static int reserved_fault_handler(struct pt_regs *regs, unsigned int esr) + { + pr_err("%s generated an invalid instruction at %pS!\n", +- in_bpf_jit(regs) ? "BPF JIT" : "Kernel text patching", ++ "Kernel text patching", + (void *)instruction_pointer(regs)); + + /* We cannot handle this */ +--- a/arch/arm64/mm/ptdump.c ++++ b/arch/arm64/mm/ptdump.c +@@ -41,8 +41,6 @@ static struct addr_marker address_marker + { 0 /* KASAN_SHADOW_START */, "Kasan shadow start" }, + { KASAN_SHADOW_END, "Kasan shadow end" }, + #endif +- { BPF_JIT_REGION_START, "BPF start" }, +- { BPF_JIT_REGION_END, "BPF end" }, + { MODULES_VADDR, "Modules start" }, + { MODULES_END, "Modules end" }, + { VMALLOC_START, "vmalloc() area" }, +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -1145,15 +1145,12 @@ out: + + u64 bpf_jit_alloc_exec_limit(void) + { +- return BPF_JIT_REGION_SIZE; ++ return VMALLOC_END - VMALLOC_START; + } + + void *bpf_jit_alloc_exec(unsigned long size) + { +- return __vmalloc_node_range(size, PAGE_SIZE, BPF_JIT_REGION_START, +- BPF_JIT_REGION_END, GFP_KERNEL, +- PAGE_KERNEL, 0, NUMA_NO_NODE, +- __builtin_return_address(0)); ++ return vmalloc(size); + } + + void bpf_jit_free_exec(void *addr) diff --git a/queue-5.16/bpf-fix-mount-source-show-for-bpffs.patch b/queue-5.16/bpf-fix-mount-source-show-for-bpffs.patch new file mode 100644 index 00000000000..247c863bd78 --- /dev/null +++ b/queue-5.16/bpf-fix-mount-source-show-for-bpffs.patch @@ -0,0 +1,80 @@ +From 1e9d74660d4df625b0889e77018f9e94727ceacd Mon Sep 17 00:00:00 2001 +From: Yafang Shao +Date: Sat, 8 Jan 2022 13:46:23 +0000 +Subject: bpf: Fix mount source show for bpffs + +From: Yafang Shao + +commit 1e9d74660d4df625b0889e77018f9e94727ceacd upstream. + +We noticed our tc ebpf tools can't start after we upgrade our in-house kernel +version from 4.19 to 5.10. That is because of the behaviour change in bpffs +caused by commit d2935de7e4fd ("vfs: Convert bpf to use the new mount API"). + +In our tc ebpf tools, we do strict environment check. If the environment is +not matched, we won't allow to start the ebpf progs. One of the check is whether +bpffs is properly mounted. The mount information of bpffs in kernel-4.19 and +kernel-5.10 are as follows: + +- kernel 4.19 +$ mount -t bpf bpffs /sys/fs/bpf +$ mount -t bpf +bpffs on /sys/fs/bpf type bpf (rw,relatime) + +- kernel 5.10 +$ mount -t bpf bpffs /sys/fs/bpf +$ mount -t bpf +none on /sys/fs/bpf type bpf (rw,relatime) + +The device name in kernel-5.10 is displayed as none instead of bpffs, then our +environment check fails. Currently we modify the tools to adopt to the kernel +behaviour change, but I think we'd better change the kernel code to keep the +behavior consistent. + +After this change, the mount information will be displayed the same with the +behavior in kernel-4.19, for example: + +$ mount -t bpf bpffs /sys/fs/bpf +$ mount -t bpf +bpffs on /sys/fs/bpf type bpf (rw,relatime) + +Fixes: d2935de7e4fd ("vfs: Convert bpf to use the new mount API") +Suggested-by: Daniel Borkmann +Signed-off-by: Yafang Shao +Signed-off-by: Daniel Borkmann +Acked-by: Christian Brauner +Cc: David Howells +Cc: Al Viro +Link: https://lore.kernel.org/bpf/20220108134623.32467-1-laoar.shao@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/inode.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/kernel/bpf/inode.c ++++ b/kernel/bpf/inode.c +@@ -648,12 +648,22 @@ static int bpf_parse_param(struct fs_con + int opt; + + opt = fs_parse(fc, bpf_fs_parameters, param, &result); +- if (opt < 0) ++ if (opt < 0) { + /* We might like to report bad mount options here, but + * traditionally we've ignored all mount options, so we'd + * better continue to ignore non-existing options for bpf. + */ +- return opt == -ENOPARAM ? 0 : opt; ++ if (opt == -ENOPARAM) { ++ opt = vfs_parse_fs_param_source(fc, param); ++ if (opt != -ENOPARAM) ++ return opt; ++ ++ return 0; ++ } ++ ++ if (opt < 0) ++ return opt; ++ } + + switch (opt) { + case OPT_MODE: diff --git a/queue-5.16/bpf-mark-ptr_to_func-register-initially-with-zero-offset.patch b/queue-5.16/bpf-mark-ptr_to_func-register-initially-with-zero-offset.patch new file mode 100644 index 00000000000..48ce15c9a67 --- /dev/null +++ b/queue-5.16/bpf-mark-ptr_to_func-register-initially-with-zero-offset.patch @@ -0,0 +1,52 @@ +From d400a6cf1c8a57cdf10f35220ead3284320d85ff Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Fri, 14 Jan 2022 13:58:36 +0000 +Subject: bpf: Mark PTR_TO_FUNC register initially with zero offset + +From: Daniel Borkmann + +commit d400a6cf1c8a57cdf10f35220ead3284320d85ff upstream. + +Similar as with other pointer types where we use ldimm64, clear the register +content to zero first, and then populate the PTR_TO_FUNC type and subprogno +number. Currently this is not done, and leads to reuse of stale register +tracking data. + +Given for special ldimm64 cases we always clear the register offset, make it +common for all cases, so it won't be forgotten in future. + +Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper") +Signed-off-by: Daniel Borkmann +Acked-by: John Fastabend +Acked-by: Alexei Starovoitov +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/verifier.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -9389,9 +9389,13 @@ static int check_ld_imm(struct bpf_verif + return 0; + } + +- if (insn->src_reg == BPF_PSEUDO_BTF_ID) { +- mark_reg_known_zero(env, regs, insn->dst_reg); ++ /* All special src_reg cases are listed below. From this point onwards ++ * we either succeed and assign a corresponding dst_reg->type after ++ * zeroing the offset, or fail and reject the program. ++ */ ++ mark_reg_known_zero(env, regs, insn->dst_reg); + ++ if (insn->src_reg == BPF_PSEUDO_BTF_ID) { + dst_reg->type = aux->btf_var.reg_type; + switch (dst_reg->type) { + case PTR_TO_MEM: +@@ -9429,7 +9433,6 @@ static int check_ld_imm(struct bpf_verif + } + + map = env->used_maps[aux->map_index]; +- mark_reg_known_zero(env, regs, insn->dst_reg); + dst_reg->map_ptr = map; + + if (insn->src_reg == BPF_PSEUDO_MAP_VALUE || diff --git a/queue-5.16/bpftool-fix-indent-in-option-lists-in-the-documentation.patch b/queue-5.16/bpftool-fix-indent-in-option-lists-in-the-documentation.patch new file mode 100644 index 00000000000..33b8625de3b --- /dev/null +++ b/queue-5.16/bpftool-fix-indent-in-option-lists-in-the-documentation.patch @@ -0,0 +1,138 @@ +From 986dec18bbf41f50edc2e0aa4ac5ef8e0f64f328 Mon Sep 17 00:00:00 2001 +From: Quentin Monnet +Date: Wed, 10 Nov 2021 11:46:30 +0000 +Subject: bpftool: Fix indent in option lists in the documentation + +From: Quentin Monnet + +commit 986dec18bbf41f50edc2e0aa4ac5ef8e0f64f328 upstream. + +Mixed indentation levels in the lists of options in bpftool's +documentation produces some unexpected results. For the "bpftool" man +page, it prints a warning: + + $ make -C bpftool.8 + GEN bpftool.8 + :26: (ERROR/3) Unexpected indentation. + +For other pages, there is no warning, but it results in a line break +appearing in the option lists in the generated man pages. + +RST paragraphs should have a uniform indentation level. Let's fix it. + +Fixes: c07ba629df97 ("tools: bpftool: Update and synchronise option list in doc and help msg") +Fixes: 8cc8c6357c8f ("tools: bpftool: Document and add bash completion for -L, -B options") +Signed-off-by: Quentin Monnet +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20211110114632.24537-5-quentin@isovalent.com +Signed-off-by: Greg Kroah-Hartman +--- + tools/bpf/bpftool/Documentation/bpftool-btf.rst | 2 +- + tools/bpf/bpftool/Documentation/bpftool-cgroup.rst | 2 +- + tools/bpf/bpftool/Documentation/bpftool-gen.rst | 2 +- + tools/bpf/bpftool/Documentation/bpftool-link.rst | 2 +- + tools/bpf/bpftool/Documentation/bpftool-map.rst | 6 +++--- + tools/bpf/bpftool/Documentation/bpftool-prog.rst | 8 ++++---- + tools/bpf/bpftool/Documentation/bpftool.rst | 6 +++--- + 7 files changed, 14 insertions(+), 14 deletions(-) + +--- a/tools/bpf/bpftool/Documentation/bpftool-btf.rst ++++ b/tools/bpf/bpftool/Documentation/bpftool-btf.rst +@@ -13,7 +13,7 @@ SYNOPSIS + **bpftool** [*OPTIONS*] **btf** *COMMAND* + + *OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | {**-d** | **--debug** } | +- { **-B** | **--base-btf** } } ++ { **-B** | **--base-btf** } } + + *COMMANDS* := { **dump** | **help** } + +--- a/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst ++++ b/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst +@@ -13,7 +13,7 @@ SYNOPSIS + **bpftool** [*OPTIONS*] **cgroup** *COMMAND* + + *OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-d** | **--debug** } | +- { **-f** | **--bpffs** } } ++ { **-f** | **--bpffs** } } + + *COMMANDS* := + { **show** | **list** | **tree** | **attach** | **detach** | **help** } +--- a/tools/bpf/bpftool/Documentation/bpftool-gen.rst ++++ b/tools/bpf/bpftool/Documentation/bpftool-gen.rst +@@ -13,7 +13,7 @@ SYNOPSIS + **bpftool** [*OPTIONS*] **gen** *COMMAND* + + *OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-d** | **--debug** } | +- { **-L** | **--use-loader** } } ++ { **-L** | **--use-loader** } } + + *COMMAND* := { **object** | **skeleton** | **help** } + +--- a/tools/bpf/bpftool/Documentation/bpftool-link.rst ++++ b/tools/bpf/bpftool/Documentation/bpftool-link.rst +@@ -13,7 +13,7 @@ SYNOPSIS + **bpftool** [*OPTIONS*] **link** *COMMAND* + + *OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-d** | **--debug** } | +- { **-f** | **--bpffs** } | { **-n** | **--nomount** } } ++ { **-f** | **--bpffs** } | { **-n** | **--nomount** } } + + *COMMANDS* := { **show** | **list** | **pin** | **help** } + +--- a/tools/bpf/bpftool/Documentation/bpftool-map.rst ++++ b/tools/bpf/bpftool/Documentation/bpftool-map.rst +@@ -13,11 +13,11 @@ SYNOPSIS + **bpftool** [*OPTIONS*] **map** *COMMAND* + + *OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-d** | **--debug** } | +- { **-f** | **--bpffs** } | { **-n** | **--nomount** } } ++ { **-f** | **--bpffs** } | { **-n** | **--nomount** } } + + *COMMANDS* := +- { **show** | **list** | **create** | **dump** | **update** | **lookup** | **getnext** +- | **delete** | **pin** | **help** } ++ { **show** | **list** | **create** | **dump** | **update** | **lookup** | **getnext** | ++ **delete** | **pin** | **help** } + + MAP COMMANDS + ============= +--- a/tools/bpf/bpftool/Documentation/bpftool-prog.rst ++++ b/tools/bpf/bpftool/Documentation/bpftool-prog.rst +@@ -13,12 +13,12 @@ SYNOPSIS + **bpftool** [*OPTIONS*] **prog** *COMMAND* + + *OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-d** | **--debug** } | +- { **-f** | **--bpffs** } | { **-m** | **--mapcompat** } | { **-n** | **--nomount** } | +- { **-L** | **--use-loader** } } ++ { **-f** | **--bpffs** } | { **-m** | **--mapcompat** } | { **-n** | **--nomount** } | ++ { **-L** | **--use-loader** } } + + *COMMANDS* := +- { **show** | **list** | **dump xlated** | **dump jited** | **pin** | **load** +- | **loadall** | **help** } ++ { **show** | **list** | **dump xlated** | **dump jited** | **pin** | **load** | ++ **loadall** | **help** } + + PROG COMMANDS + ============= +--- a/tools/bpf/bpftool/Documentation/bpftool.rst ++++ b/tools/bpf/bpftool/Documentation/bpftool.rst +@@ -19,14 +19,14 @@ SYNOPSIS + *OBJECT* := { **map** | **program** | **cgroup** | **perf** | **net** | **feature** } + + *OPTIONS* := { { **-V** | **--version** } | +- { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-d** | **--debug** } } ++ { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-d** | **--debug** } } + + *MAP-COMMANDS* := + { **show** | **list** | **create** | **dump** | **update** | **lookup** | **getnext** | +- **delete** | **pin** | **event_pipe** | **help** } ++ **delete** | **pin** | **event_pipe** | **help** } + + *PROG-COMMANDS* := { **show** | **list** | **dump jited** | **dump xlated** | **pin** | +- **load** | **attach** | **detach** | **help** } ++ **load** | **attach** | **detach** | **help** } + + *CGROUP-COMMANDS* := { **show** | **list** | **attach** | **detach** | **help** } + diff --git a/queue-5.16/bpftool-remove-inclusion-of-utilities.mak-from-makefiles.patch b/queue-5.16/bpftool-remove-inclusion-of-utilities.mak-from-makefiles.patch new file mode 100644 index 00000000000..b4b5744c020 --- /dev/null +++ b/queue-5.16/bpftool-remove-inclusion-of-utilities.mak-from-makefiles.patch @@ -0,0 +1,41 @@ +From 48f5aef4c458c19ab337eed8c95a6486cc014aa3 Mon Sep 17 00:00:00 2001 +From: Quentin Monnet +Date: Wed, 10 Nov 2021 11:46:28 +0000 +Subject: bpftool: Remove inclusion of utilities.mak from Makefiles + +From: Quentin Monnet + +commit 48f5aef4c458c19ab337eed8c95a6486cc014aa3 upstream. + +Bpftool's Makefile, and the Makefile for its documentation, both include +scripts/utilities.mak, but they use none of the items defined in this +file. Remove the includes. + +Fixes: 71bb428fe2c1 ("tools: bpf: add bpftool") +Signed-off-by: Quentin Monnet +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20211110114632.24537-3-quentin@isovalent.com +Signed-off-by: Greg Kroah-Hartman +--- + tools/bpf/bpftool/Documentation/Makefile | 1 - + tools/bpf/bpftool/Makefile | 1 - + 2 files changed, 2 deletions(-) + +--- a/tools/bpf/bpftool/Documentation/Makefile ++++ b/tools/bpf/bpftool/Documentation/Makefile +@@ -1,6 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0-only + include ../../../scripts/Makefile.include +-include ../../../scripts/utilities.mak + + INSTALL ?= install + RM ?= rm -f +--- a/tools/bpf/bpftool/Makefile ++++ b/tools/bpf/bpftool/Makefile +@@ -1,6 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0-only + include ../../scripts/Makefile.include +-include ../../scripts/utilities.mak + + ifeq ($(srctree),) + srctree := $(patsubst %/,%,$(dir $(CURDIR))) diff --git a/queue-5.16/crypto-octeontx2-uninitialized-variable-in-kvf_limits_store.patch b/queue-5.16/crypto-octeontx2-uninitialized-variable-in-kvf_limits_store.patch new file mode 100644 index 00000000000..bb2ceee9d97 --- /dev/null +++ b/queue-5.16/crypto-octeontx2-uninitialized-variable-in-kvf_limits_store.patch @@ -0,0 +1,39 @@ +From 0ea275df84c389e910a3575a9233075118c173ee Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sat, 27 Nov 2021 17:10:27 +0300 +Subject: crypto: octeontx2 - uninitialized variable in kvf_limits_store() + +From: Dan Carpenter + +commit 0ea275df84c389e910a3575a9233075118c173ee upstream. + +If kstrtoint() fails then "lfs_num" is uninitialized and the warning +doesn't make any sense. Just delete it. + +Fixes: 8ec8015a3168 ("crypto: octeontx2 - add support to process the crypto request") +Signed-off-by: Dan Carpenter +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c ++++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c +@@ -494,12 +494,11 @@ static ssize_t kvf_limits_store(struct d + { + struct otx2_cptpf_dev *cptpf = dev_get_drvdata(dev); + int lfs_num; ++ int ret; + +- if (kstrtoint(buf, 0, &lfs_num)) { +- dev_err(dev, "lfs count %d must be in range [1 - %d]\n", +- lfs_num, num_online_cpus()); +- return -EINVAL; +- } ++ ret = kstrtoint(buf, 0, &lfs_num); ++ if (ret) ++ return ret; + if (lfs_num < 1 || lfs_num > num_online_cpus()) { + dev_err(dev, "lfs count %d must be in range [1 - %d]\n", + lfs_num, num_online_cpus()); diff --git a/queue-5.16/drm-vmwgfx-remove-explicit-transparent-hugepages-support.patch b/queue-5.16/drm-vmwgfx-remove-explicit-transparent-hugepages-support.patch new file mode 100644 index 00000000000..aad03eaffe6 --- /dev/null +++ b/queue-5.16/drm-vmwgfx-remove-explicit-transparent-hugepages-support.patch @@ -0,0 +1,280 @@ +From bc701a28c74e78d7b5aa2b8628cb3608d4785d14 Mon Sep 17 00:00:00 2001 +From: Zack Rusin +Date: Wed, 15 Dec 2021 13:41:46 -0500 +Subject: drm/vmwgfx: Remove explicit transparent hugepages support +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zack Rusin + +commit bc701a28c74e78d7b5aa2b8628cb3608d4785d14 upstream. + +Old versions of the svga device used to export virtual vram, handling of +which was optimized on top of transparent hugepages support. Only very +old devices (OpenGL 2.1 support and earlier) used this code and at this +point performance differences are negligible. + +Because the code requires very old hardware versions to run it has +been largely untested and unused for a long time. + +Furthermore removal of the ttm hugepages support in: +commit 0d979509539e ("drm/ttm: remove ttm_bo_vm_insert_huge()") +broke the coherency mode in vmwgfx when running with hugepages. + +Fixes: 0d979509539e ("drm/ttm: remove ttm_bo_vm_insert_huge()") +Signed-off-by: Zack Rusin +Cc: Jason Gunthorpe +Cc: Thomas Hellström +Cc: Christian König +Cc: Daniel Vetter +Reviewed-by: Martin Krastev +Reviewed-by: Maaz Mombasawala +Link: https://patchwork.freedesktop.org/patch/msgid/20211215184147.3688785-2-zack@kde.org +(cherry picked from commit 49d535d64d52945e2c874f380705675e20a02b6a) +Signed-off-by: Thomas Zimmermann +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vmwgfx/Makefile | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 8 - + drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 5 + drivers/gpu/drm/vmwgfx/vmwgfx_thp.c | 184 ------------------------------------ + 4 files changed, 198 deletions(-) + delete mode 100644 drivers/gpu/drm/vmwgfx/vmwgfx_thp.c + +--- a/drivers/gpu/drm/vmwgfx/Makefile ++++ b/drivers/gpu/drm/vmwgfx/Makefile +@@ -12,6 +12,5 @@ vmwgfx-y := vmwgfx_execbuf.o vmwgfx_gmr. + vmwgfx_devcaps.o ttm_object.o ttm_memory.o vmwgfx_system_manager.o + + vmwgfx-$(CONFIG_DRM_FBDEV_EMULATION) += vmwgfx_fb.o +-vmwgfx-$(CONFIG_TRANSPARENT_HUGEPAGE) += vmwgfx_thp.o + + obj-$(CONFIG_DRM_VMWGFX) := vmwgfx.o +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +@@ -707,23 +707,15 @@ static int vmw_dma_masks(struct vmw_priv + static int vmw_vram_manager_init(struct vmw_private *dev_priv) + { + int ret; +-#ifdef CONFIG_TRANSPARENT_HUGEPAGE +- ret = vmw_thp_init(dev_priv); +-#else + ret = ttm_range_man_init(&dev_priv->bdev, TTM_PL_VRAM, false, + dev_priv->vram_size >> PAGE_SHIFT); +-#endif + ttm_resource_manager_set_used(ttm_manager_type(&dev_priv->bdev, TTM_PL_VRAM), false); + return ret; + } + + static void vmw_vram_manager_fini(struct vmw_private *dev_priv) + { +-#ifdef CONFIG_TRANSPARENT_HUGEPAGE +- vmw_thp_fini(dev_priv); +-#else + ttm_range_man_fini(&dev_priv->bdev, TTM_PL_VRAM); +-#endif + } + + static int vmw_setup_pci_resources(struct vmw_private *dev, +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +@@ -1557,11 +1557,6 @@ void vmw_bo_dirty_unmap(struct vmw_buffe + vm_fault_t vmw_bo_vm_fault(struct vm_fault *vmf); + vm_fault_t vmw_bo_vm_mkwrite(struct vm_fault *vmf); + +-/* Transparent hugepage support - vmwgfx_thp.c */ +-#ifdef CONFIG_TRANSPARENT_HUGEPAGE +-extern int vmw_thp_init(struct vmw_private *dev_priv); +-void vmw_thp_fini(struct vmw_private *dev_priv); +-#endif + + /** + * VMW_DEBUG_KMS - Debug output for kernel mode-setting +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_thp.c ++++ /dev/null +@@ -1,184 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0 OR MIT +-/* +- * Huge page-table-entry support for IO memory. +- * +- * Copyright (C) 2007-2019 Vmware, Inc. All rights reservedd. +- */ +-#include "vmwgfx_drv.h" +-#include +-#include +-#include +- +-/** +- * struct vmw_thp_manager - Range manager implementing huge page alignment +- * +- * @manager: TTM resource manager. +- * @mm: The underlying range manager. Protected by @lock. +- * @lock: Manager lock. +- */ +-struct vmw_thp_manager { +- struct ttm_resource_manager manager; +- struct drm_mm mm; +- spinlock_t lock; +-}; +- +-static struct vmw_thp_manager *to_thp_manager(struct ttm_resource_manager *man) +-{ +- return container_of(man, struct vmw_thp_manager, manager); +-} +- +-static const struct ttm_resource_manager_func vmw_thp_func; +- +-static int vmw_thp_insert_aligned(struct ttm_buffer_object *bo, +- struct drm_mm *mm, struct drm_mm_node *node, +- unsigned long align_pages, +- const struct ttm_place *place, +- struct ttm_resource *mem, +- unsigned long lpfn, +- enum drm_mm_insert_mode mode) +-{ +- if (align_pages >= bo->page_alignment && +- (!bo->page_alignment || align_pages % bo->page_alignment == 0)) { +- return drm_mm_insert_node_in_range(mm, node, +- mem->num_pages, +- align_pages, 0, +- place->fpfn, lpfn, mode); +- } +- +- return -ENOSPC; +-} +- +-static int vmw_thp_get_node(struct ttm_resource_manager *man, +- struct ttm_buffer_object *bo, +- const struct ttm_place *place, +- struct ttm_resource **res) +-{ +- struct vmw_thp_manager *rman = to_thp_manager(man); +- struct drm_mm *mm = &rman->mm; +- struct ttm_range_mgr_node *node; +- unsigned long align_pages; +- unsigned long lpfn; +- enum drm_mm_insert_mode mode = DRM_MM_INSERT_BEST; +- int ret; +- +- node = kzalloc(struct_size(node, mm_nodes, 1), GFP_KERNEL); +- if (!node) +- return -ENOMEM; +- +- ttm_resource_init(bo, place, &node->base); +- +- lpfn = place->lpfn; +- if (!lpfn) +- lpfn = man->size; +- +- mode = DRM_MM_INSERT_BEST; +- if (place->flags & TTM_PL_FLAG_TOPDOWN) +- mode = DRM_MM_INSERT_HIGH; +- +- spin_lock(&rman->lock); +- if (IS_ENABLED(CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD)) { +- align_pages = (HPAGE_PUD_SIZE >> PAGE_SHIFT); +- if (node->base.num_pages >= align_pages) { +- ret = vmw_thp_insert_aligned(bo, mm, &node->mm_nodes[0], +- align_pages, place, +- &node->base, lpfn, mode); +- if (!ret) +- goto found_unlock; +- } +- } +- +- align_pages = (HPAGE_PMD_SIZE >> PAGE_SHIFT); +- if (node->base.num_pages >= align_pages) { +- ret = vmw_thp_insert_aligned(bo, mm, &node->mm_nodes[0], +- align_pages, place, &node->base, +- lpfn, mode); +- if (!ret) +- goto found_unlock; +- } +- +- ret = drm_mm_insert_node_in_range(mm, &node->mm_nodes[0], +- node->base.num_pages, +- bo->page_alignment, 0, +- place->fpfn, lpfn, mode); +-found_unlock: +- spin_unlock(&rman->lock); +- +- if (unlikely(ret)) { +- kfree(node); +- } else { +- node->base.start = node->mm_nodes[0].start; +- *res = &node->base; +- } +- +- return ret; +-} +- +-static void vmw_thp_put_node(struct ttm_resource_manager *man, +- struct ttm_resource *res) +-{ +- struct ttm_range_mgr_node *node = to_ttm_range_mgr_node(res); +- struct vmw_thp_manager *rman = to_thp_manager(man); +- +- spin_lock(&rman->lock); +- drm_mm_remove_node(&node->mm_nodes[0]); +- spin_unlock(&rman->lock); +- +- kfree(node); +-} +- +-int vmw_thp_init(struct vmw_private *dev_priv) +-{ +- struct vmw_thp_manager *rman; +- +- rman = kzalloc(sizeof(*rman), GFP_KERNEL); +- if (!rman) +- return -ENOMEM; +- +- ttm_resource_manager_init(&rman->manager, +- dev_priv->vram_size >> PAGE_SHIFT); +- +- rman->manager.func = &vmw_thp_func; +- drm_mm_init(&rman->mm, 0, rman->manager.size); +- spin_lock_init(&rman->lock); +- +- ttm_set_driver_manager(&dev_priv->bdev, TTM_PL_VRAM, &rman->manager); +- ttm_resource_manager_set_used(&rman->manager, true); +- return 0; +-} +- +-void vmw_thp_fini(struct vmw_private *dev_priv) +-{ +- struct ttm_resource_manager *man = ttm_manager_type(&dev_priv->bdev, TTM_PL_VRAM); +- struct vmw_thp_manager *rman = to_thp_manager(man); +- struct drm_mm *mm = &rman->mm; +- int ret; +- +- ttm_resource_manager_set_used(man, false); +- +- ret = ttm_resource_manager_evict_all(&dev_priv->bdev, man); +- if (ret) +- return; +- spin_lock(&rman->lock); +- drm_mm_clean(mm); +- drm_mm_takedown(mm); +- spin_unlock(&rman->lock); +- ttm_resource_manager_cleanup(man); +- ttm_set_driver_manager(&dev_priv->bdev, TTM_PL_VRAM, NULL); +- kfree(rman); +-} +- +-static void vmw_thp_debug(struct ttm_resource_manager *man, +- struct drm_printer *printer) +-{ +- struct vmw_thp_manager *rman = to_thp_manager(man); +- +- spin_lock(&rman->lock); +- drm_mm_print(&rman->mm, printer); +- spin_unlock(&rman->lock); +-} +- +-static const struct ttm_resource_manager_func vmw_thp_func = { +- .alloc = vmw_thp_get_node, +- .free = vmw_thp_put_node, +- .debug = vmw_thp_debug +-}; diff --git a/queue-5.16/drm-vmwgfx-remove-unused-compile-options.patch b/queue-5.16/drm-vmwgfx-remove-unused-compile-options.patch new file mode 100644 index 00000000000..e47dab04d43 --- /dev/null +++ b/queue-5.16/drm-vmwgfx-remove-unused-compile-options.patch @@ -0,0 +1,98 @@ +From 50ca8cc7c0fdd9ab16b8b66ffb301fface101fac Mon Sep 17 00:00:00 2001 +From: Zack Rusin +Date: Wed, 15 Dec 2021 13:41:47 -0500 +Subject: drm/vmwgfx: Remove unused compile options + +From: Zack Rusin + +commit 50ca8cc7c0fdd9ab16b8b66ffb301fface101fac upstream. + +Before the driver had screen targets support we had to disable explicit +bringup of its infrastructure because it was breaking screen objects +support. +Since the implementation of screen targets landed there hasn't been a +reason to explicitly disable it and the options were never used. +Remove of all that unused code. + +Signed-off-by: Zack Rusin +Fixes: d80efd5cb3de ("drm/vmwgfx: Initial DX support") +Reviewed-by: Martin Krastev +Link: https://patchwork.freedesktop.org/patch/msgid/20211215184147.3688785-3-zack@kde.org +(cherry picked from commit 11343099d5ae6c7411da1425b6b162c89fb5bf10) +Signed-off-by: Thomas Zimmermann +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 3 --- + drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 12 +++--------- + drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 4 ++-- + 3 files changed, 5 insertions(+), 14 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +@@ -59,11 +59,8 @@ + #define VMWGFX_DRIVER_MINOR 19 + #define VMWGFX_DRIVER_PATCHLEVEL 0 + #define VMWGFX_FIFO_STATIC_SIZE (1024*1024) +-#define VMWGFX_MAX_RELOCATIONS 2048 +-#define VMWGFX_MAX_VALIDATIONS 2048 + #define VMWGFX_MAX_DISPLAYS 16 + #define VMWGFX_CMD_BOUNCE_INIT_SIZE 32768 +-#define VMWGFX_ENABLE_SCREEN_TARGET_OTABLE 1 + + #define VMWGFX_PCI_ID_SVGA2 0x0405 + #define VMWGFX_PCI_ID_SVGA3 0x0406 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c +@@ -1,7 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0 OR MIT + /************************************************************************** + * +- * Copyright 2012-2015 VMware, Inc., Palo Alto, CA., USA ++ * Copyright 2012-2021 VMware, Inc., Palo Alto, CA., USA + * + * Permission is hereby granted, free of charge, to any person obtaining a + * copy of this software and associated documentation files (the +@@ -29,12 +29,6 @@ + + #include "vmwgfx_drv.h" + +-/* +- * If we set up the screen target otable, screen objects stop working. +- */ +- +-#define VMW_OTABLE_SETUP_SUB ((VMWGFX_ENABLE_SCREEN_TARGET_OTABLE ? 0 : 1)) +- + #ifdef CONFIG_64BIT + #define VMW_PPN_SIZE 8 + #define VMW_MOBFMT_PTDEPTH_0 SVGA3D_MOBFMT_PT64_0 +@@ -75,7 +69,7 @@ static const struct vmw_otable pre_dx_ta + {VMWGFX_NUM_GB_CONTEXT * sizeof(SVGAOTableContextEntry), NULL, true}, + {VMWGFX_NUM_GB_SHADER * sizeof(SVGAOTableShaderEntry), NULL, true}, + {VMWGFX_NUM_GB_SCREEN_TARGET * sizeof(SVGAOTableScreenTargetEntry), +- NULL, VMWGFX_ENABLE_SCREEN_TARGET_OTABLE} ++ NULL, true} + }; + + static const struct vmw_otable dx_tables[] = { +@@ -84,7 +78,7 @@ static const struct vmw_otable dx_tables + {VMWGFX_NUM_GB_CONTEXT * sizeof(SVGAOTableContextEntry), NULL, true}, + {VMWGFX_NUM_GB_SHADER * sizeof(SVGAOTableShaderEntry), NULL, true}, + {VMWGFX_NUM_GB_SCREEN_TARGET * sizeof(SVGAOTableScreenTargetEntry), +- NULL, VMWGFX_ENABLE_SCREEN_TARGET_OTABLE}, ++ NULL, true}, + {VMWGFX_NUM_DXCONTEXT * sizeof(SVGAOTableDXContextEntry), NULL, true}, + }; + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c +@@ -1872,8 +1872,8 @@ int vmw_kms_stdu_init_display(struct vmw + int i, ret; + + +- /* Do nothing if Screen Target support is turned off */ +- if (!VMWGFX_ENABLE_SCREEN_TARGET_OTABLE || !dev_priv->has_mob) ++ /* Do nothing if there's no support for MOBs */ ++ if (!dev_priv->has_mob) + return -ENOSYS; + + if (!(dev_priv->capabilities & SVGA_CAP_GBOBJECTS)) diff --git a/queue-5.16/f2fs-compress-fix-potential-deadlock-of-compress-file.patch b/queue-5.16/f2fs-compress-fix-potential-deadlock-of-compress-file.patch new file mode 100644 index 00000000000..c516f94518d --- /dev/null +++ b/queue-5.16/f2fs-compress-fix-potential-deadlock-of-compress-file.patch @@ -0,0 +1,141 @@ +From 7377e853967ba45bf409e3b5536624d2cbc99f21 Mon Sep 17 00:00:00 2001 +From: Hyeong-Jun Kim +Date: Fri, 10 Dec 2021 13:30:12 +0900 +Subject: f2fs: compress: fix potential deadlock of compress file + +From: Hyeong-Jun Kim + +commit 7377e853967ba45bf409e3b5536624d2cbc99f21 upstream. + +There is a potential deadlock between writeback process and a process +performing write_begin() or write_cache_pages() while trying to write +same compress file, but not compressable, as below: + +[Process A] - doing checkpoint +[Process B] [Process C] +f2fs_write_cache_pages() +- lock_page() [all pages in cluster, 0-31] +- f2fs_write_multi_pages() + - f2fs_write_raw_pages() + - f2fs_write_single_data_page() + - f2fs_do_write_data_page() + - return -EAGAIN [f2fs_trylock_op() failed] + - unlock_page(page) [e.g., page 0] + - generic_perform_write() + - f2fs_write_begin() + - f2fs_prepare_compress_overwrite() + - prepare_compress_overwrite() + - lock_page() [e.g., page 0] + - lock_page() [e.g., page 1] + - lock_page(page) [e.g., page 0] + +Since there is no compress process, it is no longer necessary to hold +locks on every pages in cluster within f2fs_write_raw_pages(). + +This patch changes f2fs_write_raw_pages() to release all locks first +and then perform write same as the non-compress file in +f2fs_write_cache_pages(). + +Fixes: 4c8ff7095bef ("f2fs: support data compression") +Signed-off-by: Hyeong-Jun Kim +Signed-off-by: Sungjong Seo +Signed-off-by: Youngjin Gil +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/compress.c | 50 ++++++++++++++++++++++---------------------------- + 1 file changed, 22 insertions(+), 28 deletions(-) + +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -1468,25 +1468,38 @@ static int f2fs_write_raw_pages(struct c + enum iostat_type io_type) + { + struct address_space *mapping = cc->inode->i_mapping; +- int _submitted, compr_blocks, ret; +- int i = -1, err = 0; ++ int _submitted, compr_blocks, ret, i; + + compr_blocks = f2fs_compressed_blocks(cc); +- if (compr_blocks < 0) { +- err = compr_blocks; +- goto out_err; ++ ++ for (i = 0; i < cc->cluster_size; i++) { ++ if (!cc->rpages[i]) ++ continue; ++ ++ redirty_page_for_writepage(wbc, cc->rpages[i]); ++ unlock_page(cc->rpages[i]); + } + ++ if (compr_blocks < 0) ++ return compr_blocks; ++ + for (i = 0; i < cc->cluster_size; i++) { + if (!cc->rpages[i]) + continue; + retry_write: ++ lock_page(cc->rpages[i]); ++ + if (cc->rpages[i]->mapping != mapping) { ++continue_unlock: + unlock_page(cc->rpages[i]); + continue; + } + +- BUG_ON(!PageLocked(cc->rpages[i])); ++ if (!PageDirty(cc->rpages[i])) ++ goto continue_unlock; ++ ++ if (!clear_page_dirty_for_io(cc->rpages[i])) ++ goto continue_unlock; + + ret = f2fs_write_single_data_page(cc->rpages[i], &_submitted, + NULL, NULL, wbc, io_type, +@@ -1501,26 +1514,15 @@ retry_write: + * avoid deadlock caused by cluster update race + * from foreground operation. + */ +- if (IS_NOQUOTA(cc->inode)) { +- err = 0; +- goto out_err; +- } ++ if (IS_NOQUOTA(cc->inode)) ++ return 0; + ret = 0; + cond_resched(); + congestion_wait(BLK_RW_ASYNC, + DEFAULT_IO_TIMEOUT); +- lock_page(cc->rpages[i]); +- +- if (!PageDirty(cc->rpages[i])) { +- unlock_page(cc->rpages[i]); +- continue; +- } +- +- clear_page_dirty_for_io(cc->rpages[i]); + goto retry_write; + } +- err = ret; +- goto out_err; ++ return ret; + } + + *submitted += _submitted; +@@ -1529,14 +1531,6 @@ retry_write: + f2fs_balance_fs(F2FS_M_SB(mapping), true); + + return 0; +-out_err: +- for (++i; i < cc->cluster_size; i++) { +- if (!cc->rpages[i]) +- continue; +- redirty_page_for_writepage(wbc, cc->rpages[i]); +- unlock_page(cc->rpages[i]); +- } +- return err; + } + + int f2fs_write_multi_pages(struct compress_ctx *cc, diff --git a/queue-5.16/f2fs-fix-remove-page-failed-in-invalidate-compress-pages.patch b/queue-5.16/f2fs-fix-remove-page-failed-in-invalidate-compress-pages.patch new file mode 100644 index 00000000000..25c9e7d8f0b --- /dev/null +++ b/queue-5.16/f2fs-fix-remove-page-failed-in-invalidate-compress-pages.patch @@ -0,0 +1,36 @@ +From d1917865a7906baf6b687e15e8e6195a295a3992 Mon Sep 17 00:00:00 2001 +From: Fengnan Chang +Date: Fri, 26 Nov 2021 18:19:19 +0800 +Subject: f2fs: fix remove page failed in invalidate compress pages + +From: Fengnan Chang + +commit d1917865a7906baf6b687e15e8e6195a295a3992 upstream. + +Since compress inode not a regular file, generic_error_remove_page in +f2fs_invalidate_compress_pages will always be failed, set compress +inode as a regular file to fix it. + +Fixes: 6ce19aff0b8c ("f2fs: compress: add compress_inode to cache compressed blocks") +Signed-off-by: Fengnan Chang +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/inode.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/f2fs/inode.c ++++ b/fs/f2fs/inode.c +@@ -516,6 +516,11 @@ make_now: + } else if (ino == F2FS_COMPRESS_INO(sbi)) { + #ifdef CONFIG_F2FS_FS_COMPRESSION + inode->i_mapping->a_ops = &f2fs_compress_aops; ++ /* ++ * generic_error_remove_page only truncates pages of regular ++ * inode ++ */ ++ inode->i_mode |= S_IFREG; + #endif + mapping_set_gfp_mask(inode->i_mapping, + GFP_NOFS | __GFP_HIGHMEM | __GFP_MOVABLE); diff --git a/queue-5.16/f2fs-fix-to-avoid-panic-in-is_alive-if-metadata-is-inconsistent.patch b/queue-5.16/f2fs-fix-to-avoid-panic-in-is_alive-if-metadata-is-inconsistent.patch new file mode 100644 index 00000000000..0a5798d498f --- /dev/null +++ b/queue-5.16/f2fs-fix-to-avoid-panic-in-is_alive-if-metadata-is-inconsistent.patch @@ -0,0 +1,58 @@ +From f6db43076d190d9bf75559dec28e18b9d12e4ce5 Mon Sep 17 00:00:00 2001 +From: Chao Yu +Date: Mon, 6 Dec 2021 22:44:20 +0800 +Subject: f2fs: fix to avoid panic in is_alive() if metadata is inconsistent + +From: Chao Yu + +commit f6db43076d190d9bf75559dec28e18b9d12e4ce5 upstream. + +As report by Wenqing Liu in bugzilla: + +https://bugzilla.kernel.org/show_bug.cgi?id=215231 + +If we enable CONFIG_F2FS_CHECK_FS config, and with fuzzed image attached +in above link, we will encounter panic when executing below script: + +1. mkdir mnt +2. mount -t f2fs tmp1.img mnt +3. touch tmp + +F2FS-fs (loop11): mismatched blkaddr 5765 (source_blkaddr 1) in seg 3 +kernel BUG at fs/f2fs/gc.c:1042! + do_garbage_collect+0x90f/0xa80 [f2fs] + f2fs_gc+0x294/0x12a0 [f2fs] + f2fs_balance_fs+0x2c5/0x7d0 [f2fs] + f2fs_create+0x239/0xd90 [f2fs] + lookup_open+0x45e/0xa90 + open_last_lookups+0x203/0x670 + path_openat+0xae/0x490 + do_filp_open+0xbc/0x160 + do_sys_openat2+0x2f1/0x500 + do_sys_open+0x5e/0xa0 + __x64_sys_openat+0x28/0x40 + +Previously, f2fs tries to catch data inconcistency exception in between +SSA and SIT table during GC, however once the exception is caught, it will +call f2fs_bug_on to hang kernel, it's not needed, instead, let's set +SBI_NEED_FSCK flag and skip migrating current block. + +Fixes: bbf9f7d90f21 ("f2fs: Fix indefinite loop in f2fs_gc()") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/gc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -1042,7 +1042,7 @@ static bool is_alive(struct f2fs_sb_info + if (!test_and_set_bit(segno, SIT_I(sbi)->invalid_segmap)) { + f2fs_err(sbi, "mismatched blkaddr %u (source_blkaddr %u) in seg %u", + blkaddr, source_blkaddr, segno); +- f2fs_bug_on(sbi, 1); ++ set_sbi_flag(sbi, SBI_NEED_FSCK); + } + } + #endif diff --git a/queue-5.16/f2fs-fix-to-check-available-space-of-cp-area-correctly-in-update_ckpt_flags.patch b/queue-5.16/f2fs-fix-to-check-available-space-of-cp-area-correctly-in-update_ckpt_flags.patch new file mode 100644 index 00000000000..4b70c3c3807 --- /dev/null +++ b/queue-5.16/f2fs-fix-to-check-available-space-of-cp-area-correctly-in-update_ckpt_flags.patch @@ -0,0 +1,33 @@ +From b702c83e2eaa2fa2d72e957c55c0321535cc8b9f Mon Sep 17 00:00:00 2001 +From: Chao Yu +Date: Sun, 12 Dec 2021 20:28:12 +0800 +Subject: f2fs: fix to check available space of CP area correctly in update_ckpt_flags() + +From: Chao Yu + +commit b702c83e2eaa2fa2d72e957c55c0321535cc8b9f upstream. + +Otherwise, nat_bit area may be persisted across boundary of CP area during +nat_bit rebuilding. + +Fixes: 94c821fb286b ("f2fs: rebuild nat_bits during umount") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/checkpoint.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/f2fs/checkpoint.c ++++ b/fs/f2fs/checkpoint.c +@@ -1302,8 +1302,8 @@ static void update_ckpt_flags(struct f2f + unsigned long flags; + + if (cpc->reason & CP_UMOUNT) { +- if (le32_to_cpu(ckpt->cp_pack_total_block_count) > +- sbi->blocks_per_seg - NM_I(sbi)->nat_bits_blocks) { ++ if (le32_to_cpu(ckpt->cp_pack_total_block_count) + ++ NM_I(sbi)->nat_bits_blocks > sbi->blocks_per_seg) { + clear_ckpt_flags(sbi, CP_NAT_BITS_FLAG); + f2fs_notice(sbi, "Disable nat_bits due to no space"); + } else if (!is_set_ckpt_flags(sbi, CP_NAT_BITS_FLAG) && diff --git a/queue-5.16/f2fs-fix-to-reserve-space-for-io-align-feature.patch b/queue-5.16/f2fs-fix-to-reserve-space-for-io-align-feature.patch new file mode 100644 index 00000000000..2ef268b2b47 --- /dev/null +++ b/queue-5.16/f2fs-fix-to-reserve-space-for-io-align-feature.patch @@ -0,0 +1,155 @@ +From 300a842937fbcfb5a189cea9ba15374fdb0b5c6b Mon Sep 17 00:00:00 2001 +From: Chao Yu +Date: Sat, 11 Dec 2021 21:27:36 +0800 +Subject: f2fs: fix to reserve space for IO align feature + +From: Chao Yu + +commit 300a842937fbcfb5a189cea9ba15374fdb0b5c6b upstream. + +https://bugzilla.kernel.org/show_bug.cgi?id=204137 + +With below script, we will hit panic during new segment allocation: + +DISK=bingo.img +MOUNT_DIR=/mnt/f2fs + +dd if=/dev/zero of=$DISK bs=1M count=105 +mkfs.f2fe -a 1 -o 19 -t 1 -z 1 -f -q $DISK + +mount -t f2fs $DISK $MOUNT_DIR -o "noinline_dentry,flush_merge,noextent_cache,mode=lfs,io_bits=7,fsync_mode=strict" + +for (( i = 0; i < 4096; i++ )); do + name=`head /dev/urandom | tr -dc A-Za-z0-9 | head -c 10` + mkdir $MOUNT_DIR/$name +done + +umount $MOUNT_DIR +rm $DISK + +--- + fs/f2fs/f2fs.h | 11 +++++++++++ + fs/f2fs/segment.h | 3 ++- + fs/f2fs/super.c | 44 ++++++++++++++++++++++++++++++++++++++++++++ + fs/f2fs/sysfs.c | 4 +++- + 4 files changed, 60 insertions(+), 2 deletions(-) + +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -1018,6 +1018,7 @@ struct f2fs_sm_info { + unsigned int segment_count; /* total # of segments */ + unsigned int main_segments; /* # of segments in main area */ + unsigned int reserved_segments; /* # of reserved segments */ ++ unsigned int additional_reserved_segments;/* reserved segs for IO align feature */ + unsigned int ovp_segments; /* # of overprovision segments */ + + /* a threshold to reclaim prefree segments */ +@@ -2198,6 +2199,11 @@ static inline int inc_valid_block_count( + + if (!__allow_reserved_blocks(sbi, inode, true)) + avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks; ++ ++ if (F2FS_IO_ALIGNED(sbi)) ++ avail_user_block_count -= sbi->blocks_per_seg * ++ SM_I(sbi)->additional_reserved_segments; ++ + if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) { + if (avail_user_block_count > sbi->unusable_block_count) + avail_user_block_count -= sbi->unusable_block_count; +@@ -2444,6 +2450,11 @@ static inline int inc_valid_node_count(s + + if (!__allow_reserved_blocks(sbi, inode, false)) + valid_block_count += F2FS_OPTION(sbi).root_reserved_blocks; ++ ++ if (F2FS_IO_ALIGNED(sbi)) ++ valid_block_count += sbi->blocks_per_seg * ++ SM_I(sbi)->additional_reserved_segments; ++ + user_block_count = sbi->user_block_count; + if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) + user_block_count -= sbi->unusable_block_count; +--- a/fs/f2fs/segment.h ++++ b/fs/f2fs/segment.h +@@ -538,7 +538,8 @@ static inline unsigned int free_segments + + static inline unsigned int reserved_segments(struct f2fs_sb_info *sbi) + { +- return SM_I(sbi)->reserved_segments; ++ return SM_I(sbi)->reserved_segments + ++ SM_I(sbi)->additional_reserved_segments; + } + + static inline unsigned int free_sections(struct f2fs_sb_info *sbi) +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -328,6 +328,46 @@ static inline void limit_reserve_root(st + F2FS_OPTION(sbi).s_resgid)); + } + ++static inline int adjust_reserved_segment(struct f2fs_sb_info *sbi) ++{ ++ unsigned int sec_blks = sbi->blocks_per_seg * sbi->segs_per_sec; ++ unsigned int avg_vblocks; ++ unsigned int wanted_reserved_segments; ++ block_t avail_user_block_count; ++ ++ if (!F2FS_IO_ALIGNED(sbi)) ++ return 0; ++ ++ /* average valid block count in section in worst case */ ++ avg_vblocks = sec_blks / F2FS_IO_SIZE(sbi); ++ ++ /* ++ * we need enough free space when migrating one section in worst case ++ */ ++ wanted_reserved_segments = (F2FS_IO_SIZE(sbi) / avg_vblocks) * ++ reserved_segments(sbi); ++ wanted_reserved_segments -= reserved_segments(sbi); ++ ++ avail_user_block_count = sbi->user_block_count - ++ sbi->current_reserved_blocks - ++ F2FS_OPTION(sbi).root_reserved_blocks; ++ ++ if (wanted_reserved_segments * sbi->blocks_per_seg > ++ avail_user_block_count) { ++ f2fs_err(sbi, "IO align feature can't grab additional reserved segment: %u, available segments: %u", ++ wanted_reserved_segments, ++ avail_user_block_count >> sbi->log_blocks_per_seg); ++ return -ENOSPC; ++ } ++ ++ SM_I(sbi)->additional_reserved_segments = wanted_reserved_segments; ++ ++ f2fs_info(sbi, "IO align feature needs additional reserved segment: %u", ++ wanted_reserved_segments); ++ ++ return 0; ++} ++ + static inline void adjust_unusable_cap_perc(struct f2fs_sb_info *sbi) + { + if (!F2FS_OPTION(sbi).unusable_cap_perc) +@@ -4180,6 +4220,10 @@ try_onemore: + goto free_nm; + } + ++ err = adjust_reserved_segment(sbi); ++ if (err) ++ goto free_nm; ++ + /* For write statistics */ + sbi->sectors_written_start = f2fs_get_sectors_written(sbi); + +--- a/fs/f2fs/sysfs.c ++++ b/fs/f2fs/sysfs.c +@@ -415,7 +415,9 @@ out: + if (a->struct_type == RESERVED_BLOCKS) { + spin_lock(&sbi->stat_lock); + if (t > (unsigned long)(sbi->user_block_count - +- F2FS_OPTION(sbi).root_reserved_blocks)) { ++ F2FS_OPTION(sbi).root_reserved_blocks - ++ sbi->blocks_per_seg * ++ SM_I(sbi)->additional_reserved_segments)) { + spin_unlock(&sbi->stat_lock); + return -EINVAL; + } diff --git a/queue-5.16/ipv4-avoid-quadratic-behavior-in-netns-dismantle.patch b/queue-5.16/ipv4-avoid-quadratic-behavior-in-netns-dismantle.patch new file mode 100644 index 00000000000..c8e2b361f9a --- /dev/null +++ b/queue-5.16/ipv4-avoid-quadratic-behavior-in-netns-dismantle.patch @@ -0,0 +1,139 @@ +From d07418afea8f1d9896aaf9dc5ae47ac4f45b220c Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 19 Jan 2022 02:04:12 -0800 +Subject: ipv4: avoid quadratic behavior in netns dismantle + +From: Eric Dumazet + +commit d07418afea8f1d9896aaf9dc5ae47ac4f45b220c upstream. + +net/ipv4/fib_semantics.c uses an hash table of 256 slots, +keyed by device ifindexes: fib_info_devhash[DEVINDEX_HASHSIZE] + +Problem is that with network namespaces, devices tend +to use the same ifindex. + +lo device for instance has a fixed ifindex of one, +for all network namespaces. + +This means that hosts with thousands of netns spend +a lot of time looking at some hash buckets with thousands +of elements, notably at netns dismantle. + +Simply add a per netns perturbation (net_hash_mix()) +to spread elements more uniformely. + +Also change fib_devindex_hashfn() to use more entropy. + +Fixes: aa79e66eee5d ("net: Make ifindex generation per-net namespace") +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/fib_semantics.c | 36 +++++++++++++++++------------------- + 1 file changed, 17 insertions(+), 19 deletions(-) + +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -319,11 +320,15 @@ static inline int nh_comp(struct fib_inf + + static inline unsigned int fib_devindex_hashfn(unsigned int val) + { +- unsigned int mask = DEVINDEX_HASHSIZE - 1; ++ return hash_32(val, DEVINDEX_HASHBITS); ++} ++ ++static struct hlist_head * ++fib_info_devhash_bucket(const struct net_device *dev) ++{ ++ u32 val = net_hash_mix(dev_net(dev)) ^ dev->ifindex; + +- return (val ^ +- (val >> DEVINDEX_HASHBITS) ^ +- (val >> (DEVINDEX_HASHBITS * 2))) & mask; ++ return &fib_info_devhash[fib_devindex_hashfn(val)]; + } + + static unsigned int fib_info_hashfn_1(int init_val, u8 protocol, u8 scope, +@@ -433,12 +438,11 @@ int ip_fib_check_default(__be32 gw, stru + { + struct hlist_head *head; + struct fib_nh *nh; +- unsigned int hash; + + spin_lock(&fib_info_lock); + +- hash = fib_devindex_hashfn(dev->ifindex); +- head = &fib_info_devhash[hash]; ++ head = fib_info_devhash_bucket(dev); ++ + hlist_for_each_entry(nh, head, nh_hash) { + if (nh->fib_nh_dev == dev && + nh->fib_nh_gw4 == gw && +@@ -1607,12 +1611,10 @@ link_it: + } else { + change_nexthops(fi) { + struct hlist_head *head; +- unsigned int hash; + + if (!nexthop_nh->fib_nh_dev) + continue; +- hash = fib_devindex_hashfn(nexthop_nh->fib_nh_dev->ifindex); +- head = &fib_info_devhash[hash]; ++ head = fib_info_devhash_bucket(nexthop_nh->fib_nh_dev); + hlist_add_head(&nexthop_nh->nh_hash, head); + } endfor_nexthops(fi) + } +@@ -1964,8 +1966,7 @@ void fib_nhc_update_mtu(struct fib_nh_co + + void fib_sync_mtu(struct net_device *dev, u32 orig_mtu) + { +- unsigned int hash = fib_devindex_hashfn(dev->ifindex); +- struct hlist_head *head = &fib_info_devhash[hash]; ++ struct hlist_head *head = fib_info_devhash_bucket(dev); + struct fib_nh *nh; + + hlist_for_each_entry(nh, head, nh_hash) { +@@ -1984,12 +1985,11 @@ void fib_sync_mtu(struct net_device *dev + */ + int fib_sync_down_dev(struct net_device *dev, unsigned long event, bool force) + { +- int ret = 0; +- int scope = RT_SCOPE_NOWHERE; ++ struct hlist_head *head = fib_info_devhash_bucket(dev); + struct fib_info *prev_fi = NULL; +- unsigned int hash = fib_devindex_hashfn(dev->ifindex); +- struct hlist_head *head = &fib_info_devhash[hash]; ++ int scope = RT_SCOPE_NOWHERE; + struct fib_nh *nh; ++ int ret = 0; + + if (force) + scope = -1; +@@ -2134,7 +2134,6 @@ out: + int fib_sync_up(struct net_device *dev, unsigned char nh_flags) + { + struct fib_info *prev_fi; +- unsigned int hash; + struct hlist_head *head; + struct fib_nh *nh; + int ret; +@@ -2150,8 +2149,7 @@ int fib_sync_up(struct net_device *dev, + } + + prev_fi = NULL; +- hash = fib_devindex_hashfn(dev->ifindex); +- head = &fib_info_devhash[hash]; ++ head = fib_info_devhash_bucket(dev); + ret = 0; + + hlist_for_each_entry(nh, head, nh_hash) { diff --git a/queue-5.16/ipv4-update-fib_info_cnt-under-spinlock-protection.patch b/queue-5.16/ipv4-update-fib_info_cnt-under-spinlock-protection.patch new file mode 100644 index 00000000000..217f29d8da0 --- /dev/null +++ b/queue-5.16/ipv4-update-fib_info_cnt-under-spinlock-protection.patch @@ -0,0 +1,140 @@ +From 0a6e6b3c7db6c34e3d149f09cd714972f8753e3f Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Sun, 16 Jan 2022 01:02:20 -0800 +Subject: ipv4: update fib_info_cnt under spinlock protection + +From: Eric Dumazet + +commit 0a6e6b3c7db6c34e3d149f09cd714972f8753e3f upstream. + +In the past, free_fib_info() was supposed to be called +under RTNL protection. + +This eventually was no longer the case. + +Instead of enforcing RTNL it seems we simply can +move fib_info_cnt changes to occur when fib_info_lock +is held. + +v2: David Laight suggested to update fib_info_cnt +only when an entry is added/deleted to/from the hash table, +as fib_info_cnt is used to make sure hash table size +is optimal. + +BUG: KCSAN: data-race in fib_create_info / free_fib_info + +write to 0xffffffff86e243a0 of 4 bytes by task 26429 on cpu 0: + fib_create_info+0xe78/0x3440 net/ipv4/fib_semantics.c:1428 + fib_table_insert+0x148/0x10c0 net/ipv4/fib_trie.c:1224 + fib_magic+0x195/0x1e0 net/ipv4/fib_frontend.c:1087 + fib_add_ifaddr+0xd0/0x2e0 net/ipv4/fib_frontend.c:1109 + fib_netdev_event+0x178/0x510 net/ipv4/fib_frontend.c:1466 + notifier_call_chain kernel/notifier.c:83 [inline] + raw_notifier_call_chain+0x53/0xb0 kernel/notifier.c:391 + __dev_notify_flags+0x1d3/0x3b0 + dev_change_flags+0xa2/0xc0 net/core/dev.c:8872 + do_setlink+0x810/0x2410 net/core/rtnetlink.c:2719 + rtnl_group_changelink net/core/rtnetlink.c:3242 [inline] + __rtnl_newlink net/core/rtnetlink.c:3396 [inline] + rtnl_newlink+0xb10/0x13b0 net/core/rtnetlink.c:3506 + rtnetlink_rcv_msg+0x745/0x7e0 net/core/rtnetlink.c:5571 + netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2496 + rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5589 + netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] + netlink_unicast+0x5fc/0x6c0 net/netlink/af_netlink.c:1345 + netlink_sendmsg+0x726/0x840 net/netlink/af_netlink.c:1921 + sock_sendmsg_nosec net/socket.c:704 [inline] + sock_sendmsg net/socket.c:724 [inline] + ____sys_sendmsg+0x39a/0x510 net/socket.c:2409 + ___sys_sendmsg net/socket.c:2463 [inline] + __sys_sendmsg+0x195/0x230 net/socket.c:2492 + __do_sys_sendmsg net/socket.c:2501 [inline] + __se_sys_sendmsg net/socket.c:2499 [inline] + __x64_sys_sendmsg+0x42/0x50 net/socket.c:2499 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +read to 0xffffffff86e243a0 of 4 bytes by task 31505 on cpu 1: + free_fib_info+0x35/0x80 net/ipv4/fib_semantics.c:252 + fib_info_put include/net/ip_fib.h:575 [inline] + nsim_fib4_rt_destroy drivers/net/netdevsim/fib.c:294 [inline] + nsim_fib4_rt_replace drivers/net/netdevsim/fib.c:403 [inline] + nsim_fib4_rt_insert drivers/net/netdevsim/fib.c:431 [inline] + nsim_fib4_event drivers/net/netdevsim/fib.c:461 [inline] + nsim_fib_event drivers/net/netdevsim/fib.c:881 [inline] + nsim_fib_event_work+0x15ca/0x2cf0 drivers/net/netdevsim/fib.c:1477 + process_one_work+0x3fc/0x980 kernel/workqueue.c:2298 + process_scheduled_works kernel/workqueue.c:2361 [inline] + worker_thread+0x7df/0xa70 kernel/workqueue.c:2447 + kthread+0x2c7/0x2e0 kernel/kthread.c:327 + ret_from_fork+0x1f/0x30 + +value changed: 0x00000d2d -> 0x00000d2e + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 PID: 31505 Comm: kworker/1:21 Not tainted 5.16.0-rc6-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Workqueue: events nsim_fib_event_work + +Fixes: 48bb9eb47b27 ("netdevsim: fib: Add dummy implementation for FIB offload") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Cc: David Laight +Cc: Ido Schimmel +Cc: Jiri Pirko +Reviewed-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/fib_semantics.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -249,7 +249,6 @@ void free_fib_info(struct fib_info *fi) + pr_warn("Freeing alive fib_info %p\n", fi); + return; + } +- fib_info_cnt--; + + call_rcu(&fi->rcu, free_fib_info_rcu); + } +@@ -260,6 +259,10 @@ void fib_release_info(struct fib_info *f + spin_lock_bh(&fib_info_lock); + if (fi && refcount_dec_and_test(&fi->fib_treeref)) { + hlist_del(&fi->fib_hash); ++ ++ /* Paired with READ_ONCE() in fib_create_info(). */ ++ WRITE_ONCE(fib_info_cnt, fib_info_cnt - 1); ++ + if (fi->fib_prefsrc) + hlist_del(&fi->fib_lhash); + if (fi->nh) { +@@ -1430,7 +1433,9 @@ struct fib_info *fib_create_info(struct + #endif + + err = -ENOBUFS; +- if (fib_info_cnt >= fib_info_hash_size) { ++ ++ /* Paired with WRITE_ONCE() in fib_release_info() */ ++ if (READ_ONCE(fib_info_cnt) >= fib_info_hash_size) { + unsigned int new_size = fib_info_hash_size << 1; + struct hlist_head *new_info_hash; + struct hlist_head *new_laddrhash; +@@ -1462,7 +1467,6 @@ struct fib_info *fib_create_info(struct + return ERR_PTR(err); + } + +- fib_info_cnt++; + fi->fib_net = net; + fi->fib_protocol = cfg->fc_protocol; + fi->fib_scope = cfg->fc_scope; +@@ -1589,6 +1593,7 @@ link_it: + refcount_set(&fi->fib_treeref, 1); + refcount_set(&fi->fib_clntref, 1); + spin_lock_bh(&fib_info_lock); ++ fib_info_cnt++; + hlist_add_head(&fi->fib_hash, + &fib_info_hash[fib_info_hashfn(fi)]); + if (fi->fib_prefsrc) { diff --git a/queue-5.16/libbpf-remove-deprecation-attribute-from-struct-bpf_prog_prep_result.patch b/queue-5.16/libbpf-remove-deprecation-attribute-from-struct-bpf_prog_prep_result.patch new file mode 100644 index 00000000000..929885cff2f --- /dev/null +++ b/queue-5.16/libbpf-remove-deprecation-attribute-from-struct-bpf_prog_prep_result.patch @@ -0,0 +1,39 @@ +From 5c5edcdebfcf3a95257b0d8ef27a60af0e0ea03a Mon Sep 17 00:00:00 2001 +From: Andrii Nakryiko +Date: Wed, 3 Nov 2021 15:08:40 -0700 +Subject: libbpf: Remove deprecation attribute from struct bpf_prog_prep_result + +From: Andrii Nakryiko + +commit 5c5edcdebfcf3a95257b0d8ef27a60af0e0ea03a upstream. + +This deprecation annotation has no effect because for struct deprecation +attribute has to be declared after struct definition. But instead of +moving it to the end of struct definition, remove it. When deprecation +will go in effect at libbpf v0.7, this deprecation attribute will cause +libbpf's own source code compilation to trigger deprecation warnings, +which is unavoidable because libbpf still has to support that API. + +So keep deprecation of APIs, but don't mark structs used in API as +deprecated. + +Fixes: e21d585cb3db ("libbpf: Deprecate multi-instance bpf_program APIs") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Acked-by: Dave Marchevsky +Link: https://lore.kernel.org/bpf/20211103220845.2676888-8-andrii@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + tools/lib/bpf/libbpf.h | 1 - + 1 file changed, 1 deletion(-) + +--- a/tools/lib/bpf/libbpf.h ++++ b/tools/lib/bpf/libbpf.h +@@ -431,7 +431,6 @@ bpf_program__attach_iter(const struct bp + * one instance. In this case bpf_program__fd(prog) is equal to + * bpf_program__nth_fd(prog, 0). + */ +-LIBBPF_DEPRECATED_SINCE(0, 7, "use bpf_program__insns() for getting bpf_program instructions") + struct bpf_prog_prep_result { + /* + * If not NULL, load new instruction array. diff --git a/queue-5.16/mlx5-don-t-accidentally-set-rto_onlink-before-mlx5e_route_lookup_ipv4_get.patch b/queue-5.16/mlx5-don-t-accidentally-set-rto_onlink-before-mlx5e_route_lookup_ipv4_get.patch new file mode 100644 index 00000000000..2bdd26086d9 --- /dev/null +++ b/queue-5.16/mlx5-don-t-accidentally-set-rto_onlink-before-mlx5e_route_lookup_ipv4_get.patch @@ -0,0 +1,53 @@ +From 48d67543e01d73292e0bb66d3f10fc422e79e031 Mon Sep 17 00:00:00 2001 +From: Guillaume Nault +Date: Mon, 10 Jan 2022 14:43:14 +0100 +Subject: mlx5: Don't accidentally set RTO_ONLINK before mlx5e_route_lookup_ipv4_get() + +From: Guillaume Nault + +commit 48d67543e01d73292e0bb66d3f10fc422e79e031 upstream. + +Mask the ECN bits before calling mlx5e_route_lookup_ipv4_get(). The +tunnel key might have the last ECN bit set. This interferes with the +route lookup process as ip_route_output_key_hash() interpretes this bit +specially (to restrict the route scope). + +Found by code inspection, compile tested only. + +Fixes: c7b9038d8af6 ("net/mlx5e: TC preparation refactoring for routing update event") +Fixes: 9a941117fb76 ("net/mlx5e: Maximize ip tunnel key usage on the TC offloading path") +Signed-off-by: Guillaume Nault +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c +@@ -1,6 +1,7 @@ + /* SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB */ + /* Copyright (c) 2018 Mellanox Technologies. */ + ++#include + #include + #include + #include +@@ -235,7 +236,7 @@ int mlx5e_tc_tun_create_header_ipv4(stru + int err; + + /* add the IP fields */ +- attr.fl.fl4.flowi4_tos = tun_key->tos; ++ attr.fl.fl4.flowi4_tos = tun_key->tos & ~INET_ECN_MASK; + attr.fl.fl4.daddr = tun_key->u.ipv4.dst; + attr.fl.fl4.saddr = tun_key->u.ipv4.src; + attr.ttl = tun_key->ttl; +@@ -350,7 +351,7 @@ int mlx5e_tc_tun_update_header_ipv4(stru + int err; + + /* add the IP fields */ +- attr.fl.fl4.flowi4_tos = tun_key->tos; ++ attr.fl.fl4.flowi4_tos = tun_key->tos & ~INET_ECN_MASK; + attr.fl.fl4.daddr = tun_key->u.ipv4.dst; + attr.fl.fl4.saddr = tun_key->u.ipv4.src; + attr.ttl = tun_key->ttl; diff --git a/queue-5.16/net-fsl-xgmac_mdio-add-workaround-for-erratum-a-009885.patch b/queue-5.16/net-fsl-xgmac_mdio-add-workaround-for-erratum-a-009885.patch new file mode 100644 index 00000000000..23a4679b333 --- /dev/null +++ b/queue-5.16/net-fsl-xgmac_mdio-add-workaround-for-erratum-a-009885.patch @@ -0,0 +1,98 @@ +From 6198c722019774d38018457a8bfb9ba3ed8c931e Mon Sep 17 00:00:00 2001 +From: Tobias Waldekranz +Date: Tue, 18 Jan 2022 22:50:50 +0100 +Subject: net/fsl: xgmac_mdio: Add workaround for erratum A-009885 + +From: Tobias Waldekranz + +commit 6198c722019774d38018457a8bfb9ba3ed8c931e upstream. + +Once an MDIO read transaction is initiated, we must read back the data +register within 16 MDC cycles after the transaction completes. Outside +of this window, reads may return corrupt data. + +Therefore, disable local interrupts in the critical section, to +maximize the probability that we can satisfy this requirement. + +Fixes: d55ad2967d89 ("powerpc/mpc85xx: Create dts components for the FSL QorIQ DPAA FMan") +Signed-off-by: Tobias Waldekranz +Reviewed-by: Andrew Lunn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/xgmac_mdio.c | 25 +++++++++++++++++++------ + 1 file changed, 19 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/freescale/xgmac_mdio.c ++++ b/drivers/net/ethernet/freescale/xgmac_mdio.c +@@ -51,6 +51,7 @@ struct tgec_mdio_controller { + struct mdio_fsl_priv { + struct tgec_mdio_controller __iomem *mdio_base; + bool is_little_endian; ++ bool has_a009885; + bool has_a011043; + }; + +@@ -186,10 +187,10 @@ static int xgmac_mdio_read(struct mii_bu + { + struct mdio_fsl_priv *priv = (struct mdio_fsl_priv *)bus->priv; + struct tgec_mdio_controller __iomem *regs = priv->mdio_base; ++ unsigned long flags; + uint16_t dev_addr; + uint32_t mdio_stat; + uint32_t mdio_ctl; +- uint16_t value; + int ret; + bool endian = priv->is_little_endian; + +@@ -221,12 +222,18 @@ static int xgmac_mdio_read(struct mii_bu + return ret; + } + ++ if (priv->has_a009885) ++ /* Once the operation completes, i.e. MDIO_STAT_BSY clears, we ++ * must read back the data register within 16 MDC cycles. ++ */ ++ local_irq_save(flags); ++ + /* Initiate the read */ + xgmac_write32(mdio_ctl | MDIO_CTL_READ, ®s->mdio_ctl, endian); + + ret = xgmac_wait_until_done(&bus->dev, regs, endian); + if (ret) +- return ret; ++ goto irq_restore; + + /* Return all Fs if nothing was there */ + if ((xgmac_read32(®s->mdio_stat, endian) & MDIO_STAT_RD_ER) && +@@ -234,13 +241,17 @@ static int xgmac_mdio_read(struct mii_bu + dev_dbg(&bus->dev, + "Error while reading PHY%d reg at %d.%hhu\n", + phy_id, dev_addr, regnum); +- return 0xffff; ++ ret = 0xffff; ++ } else { ++ ret = xgmac_read32(®s->mdio_data, endian) & 0xffff; ++ dev_dbg(&bus->dev, "read %04x\n", ret); + } + +- value = xgmac_read32(®s->mdio_data, endian) & 0xffff; +- dev_dbg(&bus->dev, "read %04x\n", value); ++irq_restore: ++ if (priv->has_a009885) ++ local_irq_restore(flags); + +- return value; ++ return ret; + } + + static int xgmac_mdio_probe(struct platform_device *pdev) +@@ -287,6 +298,8 @@ static int xgmac_mdio_probe(struct platf + priv->is_little_endian = device_property_read_bool(&pdev->dev, + "little-endian"); + ++ priv->has_a009885 = device_property_read_bool(&pdev->dev, ++ "fsl,erratum-a009885"); + priv->has_a011043 = device_property_read_bool(&pdev->dev, + "fsl,erratum-a011043"); + diff --git a/queue-5.16/net-fsl-xgmac_mdio-fix-incorrect-iounmap-when-removing-module.patch b/queue-5.16/net-fsl-xgmac_mdio-fix-incorrect-iounmap-when-removing-module.patch new file mode 100644 index 00000000000..2a61d343ced --- /dev/null +++ b/queue-5.16/net-fsl-xgmac_mdio-fix-incorrect-iounmap-when-removing-module.patch @@ -0,0 +1,36 @@ +From 3f7c239c7844d2044ed399399d97a5f1c6008e1b Mon Sep 17 00:00:00 2001 +From: Tobias Waldekranz +Date: Tue, 18 Jan 2022 22:50:53 +0100 +Subject: net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module + +From: Tobias Waldekranz + +commit 3f7c239c7844d2044ed399399d97a5f1c6008e1b upstream. + +As reported by sparse: In the remove path, the driver would attempt to +unmap its own priv pointer - instead of the io memory that it mapped +in probe. + +Fixes: 9f35a7342cff ("net/fsl: introduce Freescale 10G MDIO driver") +Signed-off-by: Tobias Waldekranz +Reviewed-by: Andrew Lunn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/xgmac_mdio.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/freescale/xgmac_mdio.c ++++ b/drivers/net/ethernet/freescale/xgmac_mdio.c +@@ -331,9 +331,10 @@ err_ioremap: + static int xgmac_mdio_remove(struct platform_device *pdev) + { + struct mii_bus *bus = platform_get_drvdata(pdev); ++ struct mdio_fsl_priv *priv = bus->priv; + + mdiobus_unregister(bus); +- iounmap(bus->priv); ++ iounmap(priv->mdio_base); + mdiobus_free(bus); + + return 0; diff --git a/queue-5.16/parisc-pdc_stable-fix-memory-leak-in-pdcs_register_pathentries.patch b/queue-5.16/parisc-pdc_stable-fix-memory-leak-in-pdcs_register_pathentries.patch new file mode 100644 index 00000000000..6b7b6274ab0 --- /dev/null +++ b/queue-5.16/parisc-pdc_stable-fix-memory-leak-in-pdcs_register_pathentries.patch @@ -0,0 +1,42 @@ +From d24846a4246b6e61ecbd036880a4adf61681d241 Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Thu, 20 Jan 2022 12:18:12 +0000 +Subject: parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Miaoqian Lin + +commit d24846a4246b6e61ecbd036880a4adf61681d241 upstream. + +kobject_init_and_add() takes reference even when it fails. +According to the doc of kobject_init_and_add()： + + If this function returns an error, kobject_put() must be called to + properly clean up the memory associated with the object. + +Fix memory leak by calling kobject_put(). + +Fixes: 73f368cf679b ("Kobject: change drivers/parisc/pdc_stable.c to use kobject_init_and_add") +Signed-off-by: Miaoqian Lin +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/parisc/pdc_stable.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/parisc/pdc_stable.c ++++ b/drivers/parisc/pdc_stable.c +@@ -979,8 +979,10 @@ pdcs_register_pathentries(void) + entry->kobj.kset = paths_kset; + err = kobject_init_and_add(&entry->kobj, &ktype_pdcspath, NULL, + "%s", entry->name); +- if (err) ++ if (err) { ++ kobject_put(&entry->kobj); + return err; ++ } + + /* kobject is now registered */ + write_lock(&entry->rw_lock); diff --git a/queue-5.16/perf-evsel-override-attr-sample_period-for-non-libpfm4-events.patch b/queue-5.16/perf-evsel-override-attr-sample_period-for-non-libpfm4-events.patch new file mode 100644 index 00000000000..84e6c125607 --- /dev/null +++ b/queue-5.16/perf-evsel-override-attr-sample_period-for-non-libpfm4-events.patch @@ -0,0 +1,89 @@ +From 3606c0e1a1050d397ad759a62607e419fd8b0ccb Mon Sep 17 00:00:00 2001 +From: German Gomez +Date: Tue, 18 Jan 2022 14:40:54 +0000 +Subject: perf evsel: Override attr->sample_period for non-libpfm4 events +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: German Gomez + +commit 3606c0e1a1050d397ad759a62607e419fd8b0ccb upstream. + +A previous patch preventing "attr->sample_period" values from being +overridden in pfm events changed a related behaviour in arm-spe. + +Before said patch: + + perf record -c 10000 -e arm_spe_0// -- sleep 1 + +Would yield an SPE event with period=10000. After the patch, the period +in "-c 10000" was being ignored because the arm-spe code initializes +sample_period to a non-zero value. + +This patch restores the previous behaviour for non-libpfm4 events. + +Fixes: ae5dcc8abe31 (“perf record: Prevent override of attr->sample_period for libpfm4 events”) +Reported-by: Chase Conklin +Signed-off-by: German Gomez +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: John Fastabend +Cc: KP Singh +Cc: Mark Rutland +Cc: Martin KaFai Lau +Cc: Namhyung Kim +Cc: Song Liu +Cc: Stephane Eranian +Cc: Yonghong Song +Cc: bpf@vger.kernel.org +Cc: netdev@vger.kernel.org +Link: http://lore.kernel.org/lkml/20220118144054.2541-1-german.gomez@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/evsel.c | 25 +++++++++++++++++-------- + 1 file changed, 17 insertions(+), 8 deletions(-) + +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -1064,6 +1064,17 @@ void __weak arch_evsel__fixup_new_cycles + { + } + ++static void evsel__set_default_freq_period(struct record_opts *opts, ++ struct perf_event_attr *attr) ++{ ++ if (opts->freq) { ++ attr->freq = 1; ++ attr->sample_freq = opts->freq; ++ } else { ++ attr->sample_period = opts->default_interval; ++ } ++} ++ + /* + * The enable_on_exec/disabled value strategy: + * +@@ -1130,14 +1141,12 @@ void evsel__config(struct evsel *evsel, + * We default some events to have a default interval. But keep + * it a weak assumption overridable by the user. + */ +- if (!attr->sample_period) { +- if (opts->freq) { +- attr->freq = 1; +- attr->sample_freq = opts->freq; +- } else { +- attr->sample_period = opts->default_interval; +- } +- } ++ if ((evsel->is_libpfm_event && !attr->sample_period) || ++ (!evsel->is_libpfm_event && (!attr->sample_period || ++ opts->user_freq != UINT_MAX || ++ opts->user_interval != ULLONG_MAX))) ++ evsel__set_default_freq_period(opts, attr); ++ + /* + * If attr->freq was set (here or earlier), ask for period + * to be sampled. diff --git a/queue-5.16/risc-v-defconfigs-set-config_fb-y-for-fb-console.patch b/queue-5.16/risc-v-defconfigs-set-config_fb-y-for-fb-console.patch new file mode 100644 index 00000000000..b3ff9747c8f --- /dev/null +++ b/queue-5.16/risc-v-defconfigs-set-config_fb-y-for-fb-console.patch @@ -0,0 +1,43 @@ +From 3d12b634fe8206ea974c6061a3f3eea529ffbc48 Mon Sep 17 00:00:00 2001 +From: Palmer Dabbelt +Date: Fri, 19 Nov 2021 08:44:02 -0800 +Subject: RISC-V: defconfigs: Set CONFIG_FB=y, for FB console + +From: Palmer Dabbelt + +commit 3d12b634fe8206ea974c6061a3f3eea529ffbc48 upstream. + +We have CONFIG_FRAMEBUFFER_CONSOLE=y in the defconfigs, but that depends +on CONFIG_FB so it's not actually getting set. I'm assuming most users +on real systems want a framebuffer console, so this enables CONFIG_FB to +allow that to take effect. + +Fixes: 33c57c0d3c67 ("RISC-V: Add a basic defconfig") +Reviewed-by: Anup Patel +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/configs/defconfig | 1 + + arch/riscv/configs/rv32_defconfig | 1 + + 2 files changed, 2 insertions(+) + +--- a/arch/riscv/configs/defconfig ++++ b/arch/riscv/configs/defconfig +@@ -78,6 +78,7 @@ CONFIG_DRM=m + CONFIG_DRM_RADEON=m + CONFIG_DRM_NOUVEAU=m + CONFIG_DRM_VIRTIO_GPU=m ++CONFIG_FB=y + CONFIG_FRAMEBUFFER_CONSOLE=y + CONFIG_USB=y + CONFIG_USB_XHCI_HCD=y +--- a/arch/riscv/configs/rv32_defconfig ++++ b/arch/riscv/configs/rv32_defconfig +@@ -73,6 +73,7 @@ CONFIG_POWER_RESET=y + CONFIG_DRM=y + CONFIG_DRM_RADEON=y + CONFIG_DRM_VIRTIO_GPU=y ++CONFIG_FB=y + CONFIG_FRAMEBUFFER_CONSOLE=y + CONFIG_USB=y + CONFIG_USB_XHCI_HCD=y diff --git a/queue-5.16/riscv-dts-microchip-mpfs-drop-empty-chosen-node.patch b/queue-5.16/riscv-dts-microchip-mpfs-drop-empty-chosen-node.patch new file mode 100644 index 00000000000..94362b77fd4 --- /dev/null +++ b/queue-5.16/riscv-dts-microchip-mpfs-drop-empty-chosen-node.patch @@ -0,0 +1,36 @@ +From 53ef07326ad0d6ae7fefded22bc53b427d542761 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Fri, 17 Dec 2021 13:49:24 +0100 +Subject: riscv: dts: microchip: mpfs: Drop empty chosen node + +From: Geert Uytterhoeven + +commit 53ef07326ad0d6ae7fefded22bc53b427d542761 upstream. + +It does not make sense to have an (empty) chosen node in an SoC-specific +.dtsi, as chosen is meant for system-specific configuration. +It is already provided in microchip-mpfs-icicle-kit.dts anyway. + +Fixes: 0fa6107eca4186ad ("RISC-V: Initial DTS for Microchip ICICLE board") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Conor Dooley +Tested-by: Conor Dooley +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi | 3 --- + 1 file changed, 3 deletions(-) + +--- a/arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi ++++ b/arch/riscv/boot/dts/microchip/microchip-mpfs.dtsi +@@ -9,9 +9,6 @@ + model = "Microchip PolarFire SoC"; + compatible = "microchip,mpfs"; + +- chosen { +- }; +- + cpus { + #address-cells = <1>; + #size-cells = <0>; diff --git a/queue-5.16/series b/queue-5.16/series index 51413b12830..5b48b6a81bf 100644 --- a/queue-5.16/series +++ b/queue-5.16/series @@ -934,3 +934,28 @@ block-fix-fsync-always-failed-if-once-failed.patch drm-vc4-crtc-drop-feed_txp-from-state.patch drm-vc4-fix-non-blocking-commit-getting-stuck-forever.patch drm-vc4-crtc-copy-assigned-channel-to-the-crtc.patch +libbpf-remove-deprecation-attribute-from-struct-bpf_prog_prep_result.patch +arm64-bpf-remove-128mb-limit-for-bpf-jit-programs.patch +bpftool-remove-inclusion-of-utilities.mak-from-makefiles.patch +bpftool-fix-indent-in-option-lists-in-the-documentation.patch +xdp-check-prog-type-before-updating-bpf-link.patch +bpf-fix-mount-source-show-for-bpffs.patch +bpf-mark-ptr_to_func-register-initially-with-zero-offset.patch +perf-evsel-override-attr-sample_period-for-non-libpfm4-events.patch +ipv4-update-fib_info_cnt-under-spinlock-protection.patch +ipv4-avoid-quadratic-behavior-in-netns-dismantle.patch +mlx5-don-t-accidentally-set-rto_onlink-before-mlx5e_route_lookup_ipv4_get.patch +net-fsl-xgmac_mdio-add-workaround-for-erratum-a-009885.patch +net-fsl-xgmac_mdio-fix-incorrect-iounmap-when-removing-module.patch +parisc-pdc_stable-fix-memory-leak-in-pdcs_register_pathentries.patch +risc-v-defconfigs-set-config_fb-y-for-fb-console.patch +riscv-dts-microchip-mpfs-drop-empty-chosen-node.patch +drm-vmwgfx-remove-explicit-transparent-hugepages-support.patch +drm-vmwgfx-remove-unused-compile-options.patch +f2fs-fix-remove-page-failed-in-invalidate-compress-pages.patch +f2fs-fix-to-avoid-panic-in-is_alive-if-metadata-is-inconsistent.patch +f2fs-compress-fix-potential-deadlock-of-compress-file.patch +f2fs-fix-to-reserve-space-for-io-align-feature.patch +f2fs-fix-to-check-available-space-of-cp-area-correctly-in-update_ckpt_flags.patch +crypto-octeontx2-uninitialized-variable-in-kvf_limits_store.patch +af_unix-annote-lockless-accesses-to-unix_tot_inflight-gc_in_progress.patch diff --git a/queue-5.16/xdp-check-prog-type-before-updating-bpf-link.patch b/queue-5.16/xdp-check-prog-type-before-updating-bpf-link.patch new file mode 100644 index 00000000000..eef27b292ec --- /dev/null +++ b/queue-5.16/xdp-check-prog-type-before-updating-bpf-link.patch @@ -0,0 +1,46 @@ +From 382778edc8262b7535f00523e9eb22edba1b9816 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= +Date: Fri, 7 Jan 2022 23:11:13 +0100 +Subject: xdp: check prog type before updating BPF link +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +commit 382778edc8262b7535f00523e9eb22edba1b9816 upstream. + +The bpf_xdp_link_update() function didn't check the program type before +updating the program, which made it possible to install any program type as +an XDP program, which is obviously not good. Syzbot managed to trigger this +by swapping in an LWT program on the XDP hook which would crash in a helper +call. + +Fix this by adding a check and bailing out if the types don't match. + +Fixes: 026a4c28e1db ("bpf, xdp: Implement LINK_UPDATE for BPF XDP link") +Reported-by: syzbot+983941aa85af6ded1fd9@syzkaller.appspotmail.com +Acked-by: Andrii Nakryiko +Signed-off-by: Toke Høiland-Jørgensen +Link: https://lore.kernel.org/r/20220107221115.326171-1-toke@redhat.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Greg Kroah-Hartman +--- + net/core/dev.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -9656,6 +9656,12 @@ static int bpf_xdp_link_update(struct bp + goto out_unlock; + } + old_prog = link->prog; ++ if (old_prog->type != new_prog->type || ++ old_prog->expected_attach_type != new_prog->expected_attach_type) { ++ err = -EINVAL; ++ goto out_unlock; ++ } ++ + if (old_prog == new_prog) { + /* no-op, don't disturb drivers */ + bpf_prog_put(new_prog);