From: Sasha Levin Date: Fri, 12 May 2023 06:32:37 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v4.14.315~106 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b7fad94c338ec4ef1978863b97b5739619887048;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/af_packet-don-t-send-zero-byte-data-in-packet_sendms.patch b/queue-5.15/af_packet-don-t-send-zero-byte-data-in-packet_sendms.patch new file mode 100644 index 00000000000..b4887ed2dd5 --- /dev/null +++ b/queue-5.15/af_packet-don-t-send-zero-byte-data-in-packet_sendms.patch @@ -0,0 +1,111 @@ +From aae50227aaeea5fada17f158e27c7120cdb01bfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 May 2023 13:28:57 -0700 +Subject: af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). + +From: Kuniyuki Iwashima + +[ Upstream commit 6a341729fb31b4c5df9f74f24b4b1c98410c9b87 ] + +syzkaller reported a warning below [0]. + +We can reproduce it by sending 0-byte data from the (AF_PACKET, +SOCK_PACKET) socket via some devices whose dev->hard_header_len +is 0. + + struct sockaddr_pkt addr = { + .spkt_family = AF_PACKET, + .spkt_device = "tun0", + }; + int fd; + + fd = socket(AF_PACKET, SOCK_PACKET, 0); + sendto(fd, NULL, 0, 0, (struct sockaddr *)&addr, sizeof(addr)); + +We have a similar fix for the (AF_PACKET, SOCK_RAW) socket as +commit dc633700f00f ("net/af_packet: check len when min_header_len +equals to 0"). + +Let's add the same test for the SOCK_PACKET socket. + +[0]: +skb_assert_len +WARNING: CPU: 1 PID: 19945 at include/linux/skbuff.h:2552 skb_assert_len include/linux/skbuff.h:2552 [inline] +WARNING: CPU: 1 PID: 19945 at include/linux/skbuff.h:2552 __dev_queue_xmit+0x1f26/0x31d0 net/core/dev.c:4159 +Modules linked in: +CPU: 1 PID: 19945 Comm: syz-executor.0 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +RIP: 0010:skb_assert_len include/linux/skbuff.h:2552 [inline] +RIP: 0010:__dev_queue_xmit+0x1f26/0x31d0 net/core/dev.c:4159 +Code: 89 de e8 1d a2 85 fd 84 db 75 21 e8 64 a9 85 fd 48 c7 c6 80 2a 1f 86 48 c7 c7 c0 06 1f 86 c6 05 23 cf 27 04 01 e8 fa ee 56 fd <0f> 0b e8 43 a9 85 fd 0f b6 1d 0f cf 27 04 31 ff 89 de e8 e3 a1 85 +RSP: 0018:ffff8880217af6e0 EFLAGS: 00010282 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90001133000 +RDX: 0000000000040000 RSI: ffffffff81186922 RDI: 0000000000000001 +RBP: ffff8880217af8b0 R08: 0000000000000001 R09: 0000000000000000 +R10: 0000000000000001 R11: 0000000000000001 R12: ffff888030045640 +R13: ffff8880300456b0 R14: ffff888030045650 R15: ffff888030045718 +FS: 00007fc5864da640(0000) GS:ffff88806cd00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000020005740 CR3: 000000003f856003 CR4: 0000000000770ee0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 +Call Trace: + + dev_queue_xmit include/linux/netdevice.h:3085 [inline] + packet_sendmsg_spkt+0xc4b/0x1230 net/packet/af_packet.c:2066 + sock_sendmsg_nosec net/socket.c:724 [inline] + sock_sendmsg+0x1b4/0x200 net/socket.c:747 + ____sys_sendmsg+0x331/0x970 net/socket.c:2503 + ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2557 + __sys_sendmmsg+0x18c/0x430 net/socket.c:2643 + __do_sys_sendmmsg net/socket.c:2672 [inline] + __se_sys_sendmmsg net/socket.c:2669 [inline] + __x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2669 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3c/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x72/0xdc +RIP: 0033:0x7fc58791de5d +Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 +RSP: 002b:00007fc5864d9cc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 +RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007fc58791de5d +RDX: 0000000000000001 RSI: 0000000020005740 RDI: 0000000000000004 +RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 +R13: 000000000000000b R14: 00007fc58797e530 R15: 0000000000000000 + +---[ end trace 0000000000000000 ]--- +skb len=0 headroom=16 headlen=0 tailroom=304 +mac=(16,0) net=(16,-1) trans=-1 +shinfo(txflags=0 nr_frags=0 gso(size=0 type=0 segs=0)) +csum(0x0 ip_summed=0 complete_sw=0 valid=0 level=0) +hash(0x0 sw=0 l4=0) proto=0x0000 pkttype=0 iif=0 +dev name=sit0 feat=0x00000006401d7869 +sk family=17 type=10 proto=0 + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: syzbot +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 0db871edd3a18..f5d430bd372ce 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1999,7 +1999,7 @@ static int packet_sendmsg_spkt(struct socket *sock, struct msghdr *msg, + goto retry; + } + +- if (!dev_validate_header(dev, skb->data, len)) { ++ if (!dev_validate_header(dev, skb->data, len) || !skb->len) { + err = -EINVAL; + goto out_unlock; + } +-- +2.39.2 + diff --git a/queue-5.15/alsa-caiaq-input-add-error-handling-for-unsupported-.patch b/queue-5.15/alsa-caiaq-input-add-error-handling-for-unsupported-.patch new file mode 100644 index 00000000000..8a274da80ec --- /dev/null +++ b/queue-5.15/alsa-caiaq-input-add-error-handling-for-unsupported-.patch @@ -0,0 +1,44 @@ +From 33de66b715cbe899dc2e1f8e2fe269ea21ecf626 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 14:50:53 +0800 +Subject: ALSA: caiaq: input: Add error handling for unsupported input methods + in `snd_usb_caiaq_input_init` + +From: Ruliang Lin + +[ Upstream commit 0d727e1856ef22dd9337199430258cb64cbbc658 ] + +Smatch complains that: +snd_usb_caiaq_input_init() warn: missing error code 'ret' + +This patch adds a new case to handle the situation where the +device does not support any input methods in the +`snd_usb_caiaq_input_init` function. It returns an `-EINVAL` error code +to indicate that no input methods are supported on the device. + +Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support") +Signed-off-by: Ruliang Lin +Reviewed-by: Dongliang Mu +Acked-by: Daniel Mack +Link: https://lore.kernel.org/r/20230504065054.3309-1-u202112092@hust.edu.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/caiaq/input.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/usb/caiaq/input.c b/sound/usb/caiaq/input.c +index 1e2cf2f08eecd..84f26dce7f5d0 100644 +--- a/sound/usb/caiaq/input.c ++++ b/sound/usb/caiaq/input.c +@@ -804,6 +804,7 @@ int snd_usb_caiaq_input_init(struct snd_usb_caiaqdev *cdev) + + default: + /* no input methods supported on this device */ ++ ret = -EINVAL; + goto exit_free_idev; + } + +-- +2.39.2 + diff --git a/queue-5.15/crypto-api-add-scaffolding-to-change-completion-func.patch b/queue-5.15/crypto-api-add-scaffolding-to-change-completion-func.patch new file mode 100644 index 00000000000..8fae27f4137 --- /dev/null +++ b/queue-5.15/crypto-api-add-scaffolding-to-change-completion-func.patch @@ -0,0 +1,79 @@ +From bdcac4c8875fd8fb5c10561a52e2e650f6c08149 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 16:01:45 +0800 +Subject: crypto: api - Add scaffolding to change completion function signature + +From: Herbert Xu + +[ Upstream commit c35e03eaece71101ff6cbf776b86403860ac8cc3 ] + +The crypto completion function currently takes a pointer to a +struct crypto_async_request object. However, in reality the API +does not allow the use of any part of the object apart from the +data field. For example, ahash/shash will create a fake object +on the stack to pass along a different data field. + +This leads to potential bugs where the user may try to dereference +or otherwise use the crypto_async_request object. + +This patch adds some temporary scaffolding so that the completion +function can take a void * instead. Once affected users have been +converted this can be removed. + +The helper crypto_request_complete will remain even after the +conversion is complete. It should be used instead of calling +the completion function directly. + +Signed-off-by: Herbert Xu +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Stable-dep-of: 4140aafcff16 ("crypto: engine - fix crypto_queue backlog handling") +Signed-off-by: Sasha Levin +--- + include/crypto/algapi.h | 7 +++++++ + include/linux/crypto.h | 6 ++++++ + 2 files changed, 13 insertions(+) + +diff --git a/include/crypto/algapi.h b/include/crypto/algapi.h +index 5f6841c73e5a7..0ffd61930e180 100644 +--- a/include/crypto/algapi.h ++++ b/include/crypto/algapi.h +@@ -256,4 +256,11 @@ enum { + CRYPTO_MSG_ALG_LOADED, + }; + ++static inline void crypto_request_complete(struct crypto_async_request *req, ++ int err) ++{ ++ crypto_completion_t complete = req->complete; ++ complete(req, err); ++} ++ + #endif /* _CRYPTO_ALGAPI_H */ +diff --git a/include/linux/crypto.h b/include/linux/crypto.h +index 855869e1fd327..987eeb94bb70b 100644 +--- a/include/linux/crypto.h ++++ b/include/linux/crypto.h +@@ -167,6 +167,7 @@ struct crypto_async_request; + struct crypto_tfm; + struct crypto_type; + ++typedef struct crypto_async_request crypto_completion_data_t; + typedef void (*crypto_completion_t)(struct crypto_async_request *req, int err); + + /** +@@ -586,6 +587,11 @@ struct crypto_wait { + /* + * Async ops completion helper functioons + */ ++static inline void *crypto_get_completion_data(crypto_completion_data_t *req) ++{ ++ return req->data; ++} ++ + void crypto_req_done(struct crypto_async_request *req, int err); + + static inline int crypto_wait_req(int err, struct crypto_wait *wait) +-- +2.39.2 + diff --git a/queue-5.15/crypto-engine-check-if-bh-is-disabled-during-complet.patch b/queue-5.15/crypto-engine-check-if-bh-is-disabled-during-complet.patch new file mode 100644 index 00000000000..f127cd943a2 --- /dev/null +++ b/queue-5.15/crypto-engine-check-if-bh-is-disabled-during-complet.patch @@ -0,0 +1,40 @@ +From f0efed381e89c78671714ea364c2e4545e66c99c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Feb 2022 12:08:33 +0000 +Subject: crypto: engine - check if BH is disabled during completion + +From: Corentin Labbe + +[ Upstream commit 4058cf08945c18a6de193f4118fd05d83d3d4285 ] + +When doing iperf over ipsec with crypto hardware sun8i-ce, I hit some +spinlock recursion bug. + +This is due to completion function called with enabled BH. + +Add check a to detect this. + +Fixes: 735d37b5424b ("crypto: engine - Introduce the block request crypto engine framework") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Stable-dep-of: 4140aafcff16 ("crypto: engine - fix crypto_queue backlog handling") +Signed-off-by: Sasha Levin +--- + crypto/crypto_engine.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/crypto/crypto_engine.c b/crypto/crypto_engine.c +index cff21f4e03e32..fecf6baaa4f7d 100644 +--- a/crypto/crypto_engine.c ++++ b/crypto/crypto_engine.c +@@ -53,6 +53,7 @@ static void crypto_finalize_request(struct crypto_engine *engine, + dev_err(engine->dev, "failed to unprepare request\n"); + } + } ++ lockdep_assert_in_softirq(); + req->complete(req, err); + + kthread_queue_work(engine->kworker, &engine->pump_requests); +-- +2.39.2 + diff --git a/queue-5.15/crypto-engine-fix-crypto_queue-backlog-handling.patch b/queue-5.15/crypto-engine-fix-crypto_queue-backlog-handling.patch new file mode 100644 index 00000000000..0d16027e2c9 --- /dev/null +++ b/queue-5.15/crypto-engine-fix-crypto_queue-backlog-handling.patch @@ -0,0 +1,87 @@ +From d620106cd3d4c4870d22cfe1c094d9359b242865 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 11:00:35 -0400 +Subject: crypto: engine - fix crypto_queue backlog handling + +From: Olivier Bacon + +[ Upstream commit 4140aafcff167b5b9e8dae6a1709a6de7cac6f74 ] + +CRYPTO_TFM_REQ_MAY_BACKLOG tells the crypto driver that it should +internally backlog requests until the crypto hw's queue becomes +full. At that point, crypto_engine backlogs the request and returns +-EBUSY. Calling driver such as dm-crypt then waits until the +complete() function is called with a status of -EINPROGRESS before +sending a new request. + +The problem lies in the call to complete() with a value of -EINPROGRESS +that is made when a backlog item is present on the queue. The call is +done before the successful execution of the crypto request. In the case +that do_one_request() returns < 0 and the retry support is available, +the request is put back in the queue. This leads upper drivers to send +a new request even if the queue is still full. + +The problem can be reproduced by doing a large dd into a crypto +dm-crypt device. This is pretty easy to see when using +Freescale CAAM crypto driver and SWIOTLB dma. Since the actual amount +of requests that can be hold in the queue is unlimited we get IOs error +and dma allocation. + +The fix is to call complete with a value of -EINPROGRESS only if +the request is not enqueued back in crypto_queue. This is done +by calling complete() later in the code. In order to delay the decision, +crypto_queue is modified to correctly set the backlog pointer +when a request is enqueued back. + +Fixes: 6a89f492f8e5 ("crypto: engine - support for parallel requests based on retry mechanism") +Co-developed-by: Sylvain Ouellet +Signed-off-by: Sylvain Ouellet +Signed-off-by: Olivier Bacon +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/algapi.c | 3 +++ + crypto/crypto_engine.c | 6 +++--- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/crypto/algapi.c b/crypto/algapi.c +index c1af76ec65f51..3920c4b1e9c13 100644 +--- a/crypto/algapi.c ++++ b/crypto/algapi.c +@@ -920,6 +920,9 @@ EXPORT_SYMBOL_GPL(crypto_enqueue_request); + void crypto_enqueue_request_head(struct crypto_queue *queue, + struct crypto_async_request *request) + { ++ if (unlikely(queue->qlen >= queue->max_qlen)) ++ queue->backlog = queue->backlog->prev; ++ + queue->qlen++; + list_add(&request->list, &queue->list); + } +diff --git a/crypto/crypto_engine.c b/crypto/crypto_engine.c +index 43fe324b9521b..34effd4826c03 100644 +--- a/crypto/crypto_engine.c ++++ b/crypto/crypto_engine.c +@@ -129,9 +129,6 @@ static void crypto_pump_requests(struct crypto_engine *engine, + if (!engine->retry_support) + engine->cur_req = async_req; + +- if (backlog) +- crypto_request_complete(backlog, -EINPROGRESS); +- + if (engine->busy) + was_busy = true; + else +@@ -217,6 +214,9 @@ static void crypto_pump_requests(struct crypto_engine *engine, + crypto_request_complete(async_req, ret); + + retry: ++ if (backlog) ++ crypto_request_complete(backlog, -EINPROGRESS); ++ + /* If retry mechanism is supported, send new requests to engine */ + if (engine->retry_support) { + spin_lock_irqsave(&engine->queue_lock, flags); +-- +2.39.2 + diff --git a/queue-5.15/crypto-engine-use-crypto_request_complete.patch b/queue-5.15/crypto-engine-use-crypto_request_complete.patch new file mode 100644 index 00000000000..635b6a6ed9e --- /dev/null +++ b/queue-5.15/crypto-engine-use-crypto_request_complete.patch @@ -0,0 +1,53 @@ +From 0a2ae14c0ecfdb489e28498fbaf9327312bf08c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 16:02:02 +0800 +Subject: crypto: engine - Use crypto_request_complete + +From: Herbert Xu + +[ Upstream commit 6909823d47c17cba84e9244d04050b5db8d53789 ] + +Use the crypto_request_complete helper instead of calling the +completion function directly. + +Signed-off-by: Herbert Xu +Stable-dep-of: 4140aafcff16 ("crypto: engine - fix crypto_queue backlog handling") +Signed-off-by: Sasha Levin +--- + crypto/crypto_engine.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/crypto/crypto_engine.c b/crypto/crypto_engine.c +index fecf6baaa4f7d..43fe324b9521b 100644 +--- a/crypto/crypto_engine.c ++++ b/crypto/crypto_engine.c +@@ -54,7 +54,7 @@ static void crypto_finalize_request(struct crypto_engine *engine, + } + } + lockdep_assert_in_softirq(); +- req->complete(req, err); ++ crypto_request_complete(req, err); + + kthread_queue_work(engine->kworker, &engine->pump_requests); + } +@@ -130,7 +130,7 @@ static void crypto_pump_requests(struct crypto_engine *engine, + engine->cur_req = async_req; + + if (backlog) +- backlog->complete(backlog, -EINPROGRESS); ++ crypto_request_complete(backlog, -EINPROGRESS); + + if (engine->busy) + was_busy = true; +@@ -214,7 +214,7 @@ static void crypto_pump_requests(struct crypto_engine *engine, + } + + req_err_2: +- async_req->complete(async_req, ret); ++ crypto_request_complete(async_req, ret); + + retry: + /* If retry mechanism is supported, send new requests to engine */ +-- +2.39.2 + diff --git a/queue-5.15/crypto-sun8i-ss-fix-a-test-in-sun8i_ss_setup_ivs.patch b/queue-5.15/crypto-sun8i-ss-fix-a-test-in-sun8i_ss_setup_ivs.patch new file mode 100644 index 00000000000..3f340b3b4f7 --- /dev/null +++ b/queue-5.15/crypto-sun8i-ss-fix-a-test-in-sun8i_ss_setup_ivs.patch @@ -0,0 +1,38 @@ +From b96cd8468ec5b7b52e8070477a3b7f2303dc4ea0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 22:25:09 +0200 +Subject: crypto: sun8i-ss - Fix a test in sun8i_ss_setup_ivs() + +From: Christophe JAILLET + +[ Upstream commit 8fd91151ebcb21b3f2f2bf158ac6092192550b2b ] + +SS_ENCRYPTION is (0 << 7 = 0), so the test can never be true. +Use a direct comparison to SS_ENCRYPTION instead. + +The same king of test is already done the same way in sun8i_ss_run_task(). + +Fixes: 359e893e8af4 ("crypto: sun8i-ss - rework handling of IV") +Signed-off-by: Christophe JAILLET +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c +index 005eefecfdf59..0cc8cafdde27c 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c +@@ -132,7 +132,7 @@ static int sun8i_ss_setup_ivs(struct skcipher_request *areq) + } + rctx->p_iv[i] = a; + /* we need to setup all others IVs only in the decrypt way */ +- if (rctx->op_dir & SS_ENCRYPTION) ++ if (rctx->op_dir == SS_ENCRYPTION) + return 0; + todo = min(len, sg_dma_len(sg)); + len -= todo; +-- +2.39.2 + diff --git a/queue-5.15/drm-amdgpu-add-a-missing-lock-for-amdgpu_sched.patch b/queue-5.15/drm-amdgpu-add-a-missing-lock-for-amdgpu_sched.patch new file mode 100644 index 00000000000..6edaf965e7b --- /dev/null +++ b/queue-5.15/drm-amdgpu-add-a-missing-lock-for-amdgpu_sched.patch @@ -0,0 +1,54 @@ +From 1c0beccd21683d2a495d7c7ac3330dc7488ab94e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 15:54:55 -0700 +Subject: drm/amdgpu: add a missing lock for AMDGPU_SCHED +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chia-I Wu + +[ Upstream commit 2397e3d8d2e120355201a8310b61929f5a8bd2c0 ] + +mgr->ctx_handles should be protected by mgr->lock. + +v2: improve commit message +v3: add a Fixes tag + +Signed-off-by: Chia-I Wu +Reviewed-by: Christian König +Fixes: 52c6a62c64fa ("drm/amdgpu: add interface for editing a foreign process's priority v3") +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c +index b7d861ed52849..88f986a61c93a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c +@@ -66,6 +66,7 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev, + { + struct fd f = fdget(fd); + struct amdgpu_fpriv *fpriv; ++ struct amdgpu_ctx_mgr *mgr; + struct amdgpu_ctx *ctx; + uint32_t id; + int r; +@@ -79,8 +80,11 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev, + return r; + } + +- idr_for_each_entry(&fpriv->ctx_mgr.ctx_handles, ctx, id) ++ mgr = &fpriv->ctx_mgr; ++ mutex_lock(&mgr->lock); ++ idr_for_each_entry(&mgr->ctx_handles, ctx, id) + amdgpu_ctx_priority_override(ctx, priority); ++ mutex_unlock(&mgr->lock); + + fdput(f); + return 0; +-- +2.39.2 + diff --git a/queue-5.15/ethtool-fix-uninitialized-number-of-lanes.patch b/queue-5.15/ethtool-fix-uninitialized-number-of-lanes.patch new file mode 100644 index 00000000000..1bd7bff4207 --- /dev/null +++ b/queue-5.15/ethtool-fix-uninitialized-number-of-lanes.patch @@ -0,0 +1,130 @@ +From f2d04c627c85e8c549246d11e70cbbf3d20ee447 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 May 2023 15:20:50 +0300 +Subject: ethtool: Fix uninitialized number of lanes + +From: Ido Schimmel + +[ Upstream commit 9ad685dbfe7e856bbf17a7177b64676d324d6ed7 ] + +It is not possible to set the number of lanes when setting link modes +using the legacy IOCTL ethtool interface. Since 'struct +ethtool_link_ksettings' is not initialized in this path, drivers receive +an uninitialized number of lanes in 'struct +ethtool_link_ksettings::lanes'. + +When this information is later queried from drivers, it results in the +ethtool code making decisions based on uninitialized memory, leading to +the following KMSAN splat [1]. In practice, this most likely only +happens with the tun driver that simply returns whatever it got in the +set operation. + +As far as I can tell, this uninitialized memory is not leaked to user +space thanks to the 'ethtool_ops->cap_link_lanes_supported' check in +linkmodes_prepare_data(). + +Fix by initializing the structure in the IOCTL path. Did not find any +more call sites that pass an uninitialized structure when calling +'ethtool_ops::set_link_ksettings()'. + +[1] +BUG: KMSAN: uninit-value in ethnl_update_linkmodes net/ethtool/linkmodes.c:273 [inline] +BUG: KMSAN: uninit-value in ethnl_set_linkmodes+0x190b/0x19d0 net/ethtool/linkmodes.c:333 + ethnl_update_linkmodes net/ethtool/linkmodes.c:273 [inline] + ethnl_set_linkmodes+0x190b/0x19d0 net/ethtool/linkmodes.c:333 + ethnl_default_set_doit+0x88d/0xde0 net/ethtool/netlink.c:640 + genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline] + genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline] + genl_rcv_msg+0x141a/0x14c0 net/netlink/genetlink.c:1065 + netlink_rcv_skb+0x3f8/0x750 net/netlink/af_netlink.c:2577 + genl_rcv+0x40/0x60 net/netlink/genetlink.c:1076 + netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] + netlink_unicast+0xf41/0x1270 net/netlink/af_netlink.c:1365 + netlink_sendmsg+0x127d/0x1430 net/netlink/af_netlink.c:1942 + sock_sendmsg_nosec net/socket.c:724 [inline] + sock_sendmsg net/socket.c:747 [inline] + ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501 + ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555 + __sys_sendmsg net/socket.c:2584 [inline] + __do_sys_sendmsg net/socket.c:2593 [inline] + __se_sys_sendmsg net/socket.c:2591 [inline] + __x64_sys_sendmsg+0x36b/0x540 net/socket.c:2591 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Uninit was stored to memory at: + tun_get_link_ksettings+0x37/0x60 drivers/net/tun.c:3544 + __ethtool_get_link_ksettings+0x17b/0x260 net/ethtool/ioctl.c:441 + ethnl_set_linkmodes+0xee/0x19d0 net/ethtool/linkmodes.c:327 + ethnl_default_set_doit+0x88d/0xde0 net/ethtool/netlink.c:640 + genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline] + genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline] + genl_rcv_msg+0x141a/0x14c0 net/netlink/genetlink.c:1065 + netlink_rcv_skb+0x3f8/0x750 net/netlink/af_netlink.c:2577 + genl_rcv+0x40/0x60 net/netlink/genetlink.c:1076 + netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] + netlink_unicast+0xf41/0x1270 net/netlink/af_netlink.c:1365 + netlink_sendmsg+0x127d/0x1430 net/netlink/af_netlink.c:1942 + sock_sendmsg_nosec net/socket.c:724 [inline] + sock_sendmsg net/socket.c:747 [inline] + ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501 + ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555 + __sys_sendmsg net/socket.c:2584 [inline] + __do_sys_sendmsg net/socket.c:2593 [inline] + __se_sys_sendmsg net/socket.c:2591 [inline] + __x64_sys_sendmsg+0x36b/0x540 net/socket.c:2591 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Uninit was stored to memory at: + tun_set_link_ksettings+0x37/0x60 drivers/net/tun.c:3553 + ethtool_set_link_ksettings+0x600/0x690 net/ethtool/ioctl.c:609 + __dev_ethtool net/ethtool/ioctl.c:3024 [inline] + dev_ethtool+0x1db9/0x2a70 net/ethtool/ioctl.c:3078 + dev_ioctl+0xb07/0x1270 net/core/dev_ioctl.c:524 + sock_do_ioctl+0x295/0x540 net/socket.c:1213 + sock_ioctl+0x729/0xd90 net/socket.c:1316 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:870 [inline] + __se_sys_ioctl+0x222/0x400 fs/ioctl.c:856 + __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:856 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Local variable link_ksettings created at: + ethtool_set_link_ksettings+0x54/0x690 net/ethtool/ioctl.c:577 + __dev_ethtool net/ethtool/ioctl.c:3024 [inline] + dev_ethtool+0x1db9/0x2a70 net/ethtool/ioctl.c:3078 + +Fixes: 012ce4dd3102 ("ethtool: Extend link modes settings uAPI with lanes") +Reported-and-tested-by: syzbot+ef6edd9f1baaa54d6235@syzkaller.appspotmail.com +Link: https://lore.kernel.org/netdev/0000000000004bb41105fa70f361@google.com/ +Reviewed-by: Danielle Ratson +Signed-off-by: Ido Schimmel +Reviewed-by: Leon Romanovsky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ethtool/ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c +index 939c63d6e74b7..53e2ef6ada8f3 100644 +--- a/net/ethtool/ioctl.c ++++ b/net/ethtool/ioctl.c +@@ -568,8 +568,8 @@ static int ethtool_get_link_ksettings(struct net_device *dev, + static int ethtool_set_link_ksettings(struct net_device *dev, + void __user *useraddr) + { ++ struct ethtool_link_ksettings link_ksettings = {}; + int err; +- struct ethtool_link_ksettings link_ksettings; + + ASSERT_RTNL(); + +-- +2.39.2 + diff --git a/queue-5.15/ionic-catch-failure-from-devlink_alloc.patch b/queue-5.15/ionic-catch-failure-from-devlink_alloc.patch new file mode 100644 index 00000000000..3657b7a4df7 --- /dev/null +++ b/queue-5.15/ionic-catch-failure-from-devlink_alloc.patch @@ -0,0 +1,40 @@ +From 9ea062bc319178e0f4bc7e94989e6ecc0aee80ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 May 2023 11:35:36 -0700 +Subject: ionic: catch failure from devlink_alloc + +From: Shannon Nelson + +[ Upstream commit 4a54903ff68ddb33b6463c94b4eb37fc584ef760 ] + +Add a check for NULL on the alloc return. If devlink_alloc() fails and +we try to use devlink_priv() on the NULL return, the kernel gets very +unhappy and panics. With this fix, the driver load will still fail, +but at least it won't panic the kernel. + +Fixes: df69ba43217d ("ionic: Add basic framework for IONIC Network device driver") +Signed-off-by: Shannon Nelson +Reviewed-by: Simon Horman +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_devlink.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_devlink.c b/drivers/net/ethernet/pensando/ionic/ionic_devlink.c +index c7d0e195d1760..5c06decc868c4 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_devlink.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_devlink.c +@@ -65,6 +65,8 @@ struct ionic *ionic_devlink_alloc(struct device *dev) + struct devlink *dl; + + dl = devlink_alloc(&ionic_dl_ops, sizeof(struct ionic), dev); ++ if (!dl) ++ return NULL; + + return devlink_priv(dl); + } +-- +2.39.2 + diff --git a/queue-5.15/ionic-remove-noise-from-ethtool-rxnfc-error-msg.patch b/queue-5.15/ionic-remove-noise-from-ethtool-rxnfc-error-msg.patch new file mode 100644 index 00000000000..0195732a338 --- /dev/null +++ b/queue-5.15/ionic-remove-noise-from-ethtool-rxnfc-error-msg.patch @@ -0,0 +1,38 @@ +From df3a1616e4c03cf273f6b23c333362c399b00d1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 May 2023 11:47:40 -0700 +Subject: ionic: remove noise from ethtool rxnfc error msg + +From: Shannon Nelson + +[ Upstream commit 3711d44fac1f80ea69ecb7315fed05b3812a7401 ] + +It seems that ethtool is calling into .get_rxnfc more often with +ETHTOOL_GRXCLSRLCNT which ionic doesn't know about. We don't +need to log a message about it, just return not supported. + +Fixes: aa3198819bea6 ("ionic: Add RSS support") +Signed-off-by: Shannon Nelson +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c +index 3de1a03839e25..2fa116c3694c4 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c +@@ -724,7 +724,7 @@ static int ionic_get_rxnfc(struct net_device *netdev, + info->data = lif->nxqs; + break; + default: +- netdev_err(netdev, "Command parameter %d is not supported\n", ++ netdev_dbg(netdev, "Command parameter %d is not supported\n", + info->cmd); + err = -EOPNOTSUPP; + } +-- +2.39.2 + diff --git a/queue-5.15/kvm-s390-fix-race-in-gmap_make_secure.patch b/queue-5.15/kvm-s390-fix-race-in-gmap_make_secure.patch new file mode 100644 index 00000000000..fa2bf1d96ff --- /dev/null +++ b/queue-5.15/kvm-s390-fix-race-in-gmap_make_secure.patch @@ -0,0 +1,94 @@ +From c81dd0c57eac8918bc162b79a18f49308e91f362 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Apr 2023 11:27:53 +0200 +Subject: KVM: s390: fix race in gmap_make_secure() + +From: Claudio Imbrenda + +[ Upstream commit c148dc8e2fa403be501612ee409db866eeed35c0 ] + +Fix a potential race in gmap_make_secure() and remove the last user of +follow_page() without FOLL_GET. + +The old code is locking something it doesn't have a reference to, and +as explained by Jason and David in this discussion: +https://lore.kernel.org/linux-mm/Y9J4P%2FRNvY1Ztn0Q@nvidia.com/ +it can lead to all kind of bad things, including the page getting +unmapped (MADV_DONTNEED), freed, reallocated as a larger folio and the +unlock_page() would target the wrong bit. +There is also another race with the FOLL_WRITE, which could race +between the follow_page() and the get_locked_pte(). + +The main point is to remove the last use of follow_page() without +FOLL_GET or FOLL_PIN, removing the races can be considered a nice +bonus. + +Link: https://lore.kernel.org/linux-mm/Y9J4P%2FRNvY1Ztn0Q@nvidia.com/ +Suggested-by: Jason Gunthorpe +Fixes: 214d9bbcd3a6 ("s390/mm: provide memory management functions for protected KVM guests") +Reviewed-by: Jason Gunthorpe +Signed-off-by: Claudio Imbrenda +Message-Id: <20230428092753.27913-2-imbrenda@linux.ibm.com> +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/uv.c | 32 +++++++++++--------------------- + 1 file changed, 11 insertions(+), 21 deletions(-) + +diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c +index afb9bbfc475b9..1d49744614326 100644 +--- a/arch/s390/kernel/uv.c ++++ b/arch/s390/kernel/uv.c +@@ -160,21 +160,10 @@ static int expected_page_refs(struct page *page) + return res; + } + +-static int make_secure_pte(pte_t *ptep, unsigned long addr, +- struct page *exp_page, struct uv_cb_header *uvcb) ++static int make_page_secure(struct page *page, struct uv_cb_header *uvcb) + { +- pte_t entry = READ_ONCE(*ptep); +- struct page *page; + int expected, cc = 0; + +- if (!pte_present(entry)) +- return -ENXIO; +- if (pte_val(entry) & _PAGE_INVALID) +- return -ENXIO; +- +- page = pte_page(entry); +- if (page != exp_page) +- return -ENXIO; + if (PageWriteback(page)) + return -EAGAIN; + expected = expected_page_refs(page); +@@ -265,17 +254,18 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) + goto out; + + rc = -ENXIO; +- page = follow_page(vma, uaddr, FOLL_WRITE); +- if (IS_ERR_OR_NULL(page)) +- goto out; +- +- lock_page(page); + ptep = get_locked_pte(gmap->mm, uaddr, &ptelock); +- if (should_export_before_import(uvcb, gmap->mm)) +- uv_convert_from_secure(page_to_phys(page)); +- rc = make_secure_pte(ptep, uaddr, page, uvcb); ++ if (pte_present(*ptep) && !(pte_val(*ptep) & _PAGE_INVALID) && pte_write(*ptep)) { ++ page = pte_page(*ptep); ++ rc = -EAGAIN; ++ if (trylock_page(page)) { ++ if (should_export_before_import(uvcb, gmap->mm)) ++ uv_convert_from_secure(page_to_phys(page)); ++ rc = make_page_secure(page, uvcb); ++ unlock_page(page); ++ } ++ } + pte_unmap_unlock(ptep, ptelock); +- unlock_page(page); + out: + mmap_read_unlock(gmap->mm); + +-- +2.39.2 + diff --git a/queue-5.15/kvm-s390-pv-add-export-before-import.patch b/queue-5.15/kvm-s390-pv-add-export-before-import.patch new file mode 100644 index 00000000000..8f07a61d2bf --- /dev/null +++ b/queue-5.15/kvm-s390-pv-add-export-before-import.patch @@ -0,0 +1,81 @@ +From 048e2024597b7061e660aab60619d149d453166b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jun 2022 15:56:07 +0200 +Subject: KVM: s390: pv: add export before import + +From: Claudio Imbrenda + +[ Upstream commit 72b1daff2671cef2c8cccc6c4e52f8d5ce4ebe58 ] + +Due to upcoming changes, it will be possible to temporarily have +multiple protected VMs in the same address space, although only one +will be actually active. + +In that scenario, it is necessary to perform an export of every page +that is to be imported, since the hardware does not allow a page +belonging to a protected guest to be imported into a different +protected guest. + +This also applies to pages that are shared, and thus accessible by the +host. + +Signed-off-by: Claudio Imbrenda +Reviewed-by: Janosch Frank +Link: https://lore.kernel.org/r/20220628135619.32410-7-imbrenda@linux.ibm.com +Message-Id: <20220628135619.32410-7-imbrenda@linux.ibm.com> +Signed-off-by: Janosch Frank +Stable-dep-of: c148dc8e2fa4 ("KVM: s390: fix race in gmap_make_secure()") +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/uv.c | 28 ++++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c +index 09b80d371409b..afb9bbfc475b9 100644 +--- a/arch/s390/kernel/uv.c ++++ b/arch/s390/kernel/uv.c +@@ -202,6 +202,32 @@ static int make_secure_pte(pte_t *ptep, unsigned long addr, + return uvcb->rc == 0x10a ? -ENXIO : -EINVAL; + } + ++/** ++ * should_export_before_import - Determine whether an export is needed ++ * before an import-like operation ++ * @uvcb: the Ultravisor control block of the UVC to be performed ++ * @mm: the mm of the process ++ * ++ * Returns whether an export is needed before every import-like operation. ++ * This is needed for shared pages, which don't trigger a secure storage ++ * exception when accessed from a different guest. ++ * ++ * Although considered as one, the Unpin Page UVC is not an actual import, ++ * so it is not affected. ++ * ++ * No export is needed also when there is only one protected VM, because the ++ * page cannot belong to the wrong VM in that case (there is no "other VM" ++ * it can belong to). ++ * ++ * Return: true if an export is needed before every import, otherwise false. ++ */ ++static bool should_export_before_import(struct uv_cb_header *uvcb, struct mm_struct *mm) ++{ ++ if (uvcb->cmd == UVC_CMD_UNPIN_PAGE_SHARED) ++ return false; ++ return atomic_read(&mm->context.protected_count) > 1; ++} ++ + /* + * Requests the Ultravisor to make a page accessible to a guest. + * If it's brought in the first time, it will be cleared. If +@@ -245,6 +271,8 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) + + lock_page(page); + ptep = get_locked_pte(gmap->mm, uaddr, &ptelock); ++ if (should_export_before_import(uvcb, gmap->mm)) ++ uv_convert_from_secure(page_to_phys(page)); + rc = make_secure_pte(ptep, uaddr, page, uvcb); + pte_unmap_unlock(ptep, ptelock); + unlock_page(page); +-- +2.39.2 + diff --git a/queue-5.15/kvm-s390-pv-avoid-stalls-when-making-pages-secure.patch b/queue-5.15/kvm-s390-pv-avoid-stalls-when-making-pages-secure.patch new file mode 100644 index 00000000000..da6b9c2c09a --- /dev/null +++ b/queue-5.15/kvm-s390-pv-avoid-stalls-when-making-pages-secure.patch @@ -0,0 +1,110 @@ +From cc906bbbb096c62a9801917856b3691fe89fba35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Sep 2021 15:24:52 +0200 +Subject: KVM: s390: pv: avoid stalls when making pages secure + +From: Claudio Imbrenda + +[ Upstream commit f0a1a0615a6ff6d38af2c65a522698fb4bb85df6 ] + +Improve make_secure_pte to avoid stalls when the system is heavily +overcommitted. This was especially problematic in kvm_s390_pv_unpack, +because of the loop over all pages that needed unpacking. + +Due to the locks being held, it was not possible to simply replace +uv_call with uv_call_sched. A more complex approach was +needed, in which uv_call is replaced with __uv_call, which does not +loop. When the UVC needs to be executed again, -EAGAIN is returned, and +the caller (or its caller) will try again. + +When -EAGAIN is returned, the path is the same as when the page is in +writeback (and the writeback check is also performed, which is +harmless). + +Fixes: 214d9bbcd3a672 ("s390/mm: provide memory management functions for protected KVM guests") +Signed-off-by: Claudio Imbrenda +Reviewed-by: Janosch Frank +Reviewed-by: Christian Borntraeger +Link: https://lore.kernel.org/r/20210920132502.36111-5-imbrenda@linux.ibm.com +Signed-off-by: Christian Borntraeger +Stable-dep-of: c148dc8e2fa4 ("KVM: s390: fix race in gmap_make_secure()") +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/uv.c | 29 +++++++++++++++++++++++------ + arch/s390/kvm/intercept.c | 5 +++++ + 2 files changed, 28 insertions(+), 6 deletions(-) + +diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c +index f95ccbd396925..09b80d371409b 100644 +--- a/arch/s390/kernel/uv.c ++++ b/arch/s390/kernel/uv.c +@@ -165,7 +165,7 @@ static int make_secure_pte(pte_t *ptep, unsigned long addr, + { + pte_t entry = READ_ONCE(*ptep); + struct page *page; +- int expected, rc = 0; ++ int expected, cc = 0; + + if (!pte_present(entry)) + return -ENXIO; +@@ -181,12 +181,25 @@ static int make_secure_pte(pte_t *ptep, unsigned long addr, + if (!page_ref_freeze(page, expected)) + return -EBUSY; + set_bit(PG_arch_1, &page->flags); +- rc = uv_call(0, (u64)uvcb); ++ /* ++ * If the UVC does not succeed or fail immediately, we don't want to ++ * loop for long, or we might get stall notifications. ++ * On the other hand, this is a complex scenario and we are holding a lot of ++ * locks, so we can't easily sleep and reschedule. We try only once, ++ * and if the UVC returned busy or partial completion, we return ++ * -EAGAIN and we let the callers deal with it. ++ */ ++ cc = __uv_call(0, (u64)uvcb); + page_ref_unfreeze(page, expected); +- /* Return -ENXIO if the page was not mapped, -EINVAL otherwise */ +- if (rc) +- rc = uvcb->rc == 0x10a ? -ENXIO : -EINVAL; +- return rc; ++ /* ++ * Return -ENXIO if the page was not mapped, -EINVAL for other errors. ++ * If busy or partially completed, return -EAGAIN. ++ */ ++ if (cc == UVC_CC_OK) ++ return 0; ++ else if (cc == UVC_CC_BUSY || cc == UVC_CC_PARTIAL) ++ return -EAGAIN; ++ return uvcb->rc == 0x10a ? -ENXIO : -EINVAL; + } + + /* +@@ -239,6 +252,10 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) + mmap_read_unlock(gmap->mm); + + if (rc == -EAGAIN) { ++ /* ++ * If we are here because the UVC returned busy or partial ++ * completion, this is just a useless check, but it is safe. ++ */ + wait_on_page_writeback(page); + } else if (rc == -EBUSY) { + /* +diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c +index aeb0e0865e890..0eacd29033173 100644 +--- a/arch/s390/kvm/intercept.c ++++ b/arch/s390/kvm/intercept.c +@@ -534,6 +534,11 @@ static int handle_pv_uvc(struct kvm_vcpu *vcpu) + */ + if (rc == -EINVAL) + return 0; ++ /* ++ * If we got -EAGAIN here, we simply return it. It will eventually ++ * get propagated all the way to userspace, which should then try ++ * again. ++ */ + return rc; + } + +-- +2.39.2 + diff --git a/queue-5.15/net-bcmgenet-remove-phy_stop-from-bcmgenet_netif_sto.patch b/queue-5.15/net-bcmgenet-remove-phy_stop-from-bcmgenet_netif_sto.patch new file mode 100644 index 00000000000..6619d3049f4 --- /dev/null +++ b/queue-5.15/net-bcmgenet-remove-phy_stop-from-bcmgenet_netif_sto.patch @@ -0,0 +1,37 @@ +From 7740412cc3a41401c3759a4310192dfde61e224d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 16:07:27 -0700 +Subject: net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() + +From: Florian Fainelli + +[ Upstream commit 93e0401e0fc0c54b0ac05b687cd135c2ac38187c ] + +The call to phy_stop() races with the later call to phy_disconnect(), +resulting in concurrent phy_suspend() calls being run from different +CPUs. The final call to phy_disconnect() ensures that the PHY is +stopped and suspended, too. + +Fixes: c96e731c93ff ("net: bcmgenet: connect and disconnect from the PHY state machine") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 92cd2916e8015..35bf840716d57 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -3416,7 +3416,6 @@ static void bcmgenet_netif_stop(struct net_device *dev) + /* Disable MAC transmit. TX DMA disabled must be done before this */ + umac_enable_set(priv, CMD_TX_EN, false); + +- phy_stop(dev->phydev); + bcmgenet_disable_rx_napi(priv); + bcmgenet_intr_disable(priv); + +-- +2.39.2 + diff --git a/queue-5.15/net-dsa-mt7530-fix-corrupt-frames-using-trgmii-on-40.patch b/queue-5.15/net-dsa-mt7530-fix-corrupt-frames-using-trgmii-on-40.patch new file mode 100644 index 00000000000..1d9bac67fa5 --- /dev/null +++ b/queue-5.15/net-dsa-mt7530-fix-corrupt-frames-using-trgmii-on-40.patch @@ -0,0 +1,65 @@ +From 1671499efb97ce4d39c7ad479c7f369fa56d9477 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 00:09:46 +0300 +Subject: net: dsa: mt7530: fix corrupt frames using trgmii on 40 MHz XTAL + MT7621 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arınç ÜNAL + +[ Upstream commit 37c218d8021e36e226add4bab93d071d30fe0704 ] + +The multi-chip module MT7530 switch with a 40 MHz oscillator on the +MT7621AT, MT7621DAT, and MT7621ST SoCs forwards corrupt frames using +trgmii. + +This is caused by the assumption that MT7621 SoCs have got 150 MHz PLL, +hence using the ncpo1 value, 0x0780. + +My testing shows this value works on Unielec U7621-06, Bartel's testing +shows it won't work on Hi-Link HLK-MT7621A and Netgear WAC104. All devices +tested have got 40 MHz oscillators. + +Using the value for 125 MHz PLL, 0x0640, works on all boards at hand. The +definitions for 125 MHz PLL exist on the Banana Pi BPI-R2 BSP source code +whilst 150 MHz PLL don't. + +Forwarding frames using trgmii on the MCM MT7530 switch with a 25 MHz +oscillator on the said MT7621 SoCs works fine because the ncpo1 value +defined for it is for 125 MHz PLL. + +Change the 150 MHz PLL comment to 125 MHz PLL, and use the 125 MHz PLL +ncpo1 values for both oscillator frequencies. + +Link: https://github.com/BPI-SINOVOIP/BPI-R2-bsp/blob/81d24bbce7d99524d0771a8bdb2d6663e4eb4faa/u-boot-mt/drivers/net/rt2880_eth.c#L2195 +Fixes: 7ef6f6f8d237 ("net: dsa: mt7530: Add MT7621 TRGMII mode support") +Tested-by: Bartel Eerdekens +Signed-off-by: Arınç ÜNAL +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index dfea2ab0c297f..e7a551570cf3c 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -441,9 +441,9 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface) + else + ssc_delta = 0x87; + if (priv->id == ID_MT7621) { +- /* PLL frequency: 150MHz: 1.2GBit */ ++ /* PLL frequency: 125MHz: 1.0GBit */ + if (xtal == HWTRAP_XTAL_40MHZ) +- ncpo1 = 0x0780; ++ ncpo1 = 0x0640; + if (xtal == HWTRAP_XTAL_25MHZ) + ncpo1 = 0x0a00; + } else { /* PLL frequency: 250MHz: 2.0Gbit */ +-- +2.39.2 + diff --git a/queue-5.15/net-dsa-mv88e6xxx-add-mv88e6321-rsvd2cpu.patch b/queue-5.15/net-dsa-mv88e6xxx-add-mv88e6321-rsvd2cpu.patch new file mode 100644 index 00000000000..b0944d045fb --- /dev/null +++ b/queue-5.15/net-dsa-mv88e6xxx-add-mv88e6321-rsvd2cpu.patch @@ -0,0 +1,36 @@ +From 455f5d0122fd9c9fc881ccf7a81f748a857cdbc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 22:28:15 +0200 +Subject: net: dsa: mv88e6xxx: add mv88e6321 rsvd2cpu + +From: Angelo Dureghello + +[ Upstream commit 6686317855c6997671982d4489ccdd946f644957 ] + +Add rsvd2cpu capability for mv88e6321 model, to allow proper bpdu +processing. + +Signed-off-by: Angelo Dureghello +Fixes: 51c901a775621 ("net: dsa: mv88e6xxx: distinguish Global 2 Rsvd2CPU") +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index bc363fca2895f..b33aee4404de2 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -4575,6 +4575,7 @@ static const struct mv88e6xxx_ops mv88e6321_ops = { + .set_cpu_port = mv88e6095_g1_set_cpu_port, + .set_egress_port = mv88e6095_g1_set_egress_port, + .watchdog_ops = &mv88e6390_watchdog_ops, ++ .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, + .reset = mv88e6352_g1_reset, + .vtu_getnext = mv88e6185_g1_vtu_getnext, + .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge, +-- +2.39.2 + diff --git a/queue-5.15/net-enetc-check-the-index-of-the-sfi-rather-than-the.patch b/queue-5.15/net-enetc-check-the-index-of-the-sfi-rather-than-the.patch new file mode 100644 index 00000000000..4d4b5001cac --- /dev/null +++ b/queue-5.15/net-enetc-check-the-index-of-the-sfi-rather-than-the.patch @@ -0,0 +1,38 @@ +From 4ac9663c9d5ac18f537eeb938c553e30de6a42cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 16:03:59 +0800 +Subject: net: enetc: check the index of the SFI rather than the handle + +From: Wei Fang + +[ Upstream commit 299efdc2380aac588557f4d0b2ce7bee05bd0cf2 ] + +We should check whether the current SFI (Stream Filter Instance) table +is full before creating a new SFI entry. However, the previous logic +checks the handle by mistake and might lead to unpredictable behavior. + +Fixes: 888ae5a3952b ("net: enetc: add tc flower psfp offload driver") +Signed-off-by: Wei Fang +Reviewed-by: Leon Romanovsky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc_qos.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_qos.c b/drivers/net/ethernet/freescale/enetc/enetc_qos.c +index ba51fb381f0cb..4e9cb1deaf810 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_qos.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_qos.c +@@ -1270,7 +1270,7 @@ static int enetc_psfp_parse_clsflower(struct enetc_ndev_priv *priv, + int index; + + index = enetc_get_free_index(priv); +- if (sfi->handle < 0) { ++ if (index < 0) { + NL_SET_ERR_MSG_MOD(extack, "No Stream Filter resource!"); + err = -ENOSPC; + goto free_fmi; +-- +2.39.2 + diff --git a/queue-5.15/net-ncsi-clear-tx-enable-mode-when-handling-a-config.patch b/queue-5.15/net-ncsi-clear-tx-enable-mode-when-handling-a-config.patch new file mode 100644 index 00000000000..67a71a568b5 --- /dev/null +++ b/queue-5.15/net-ncsi-clear-tx-enable-mode-when-handling-a-config.patch @@ -0,0 +1,41 @@ +From 81f8da20e4ba70311096a8a2df1d6823afeb9e99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 16:13:50 +0800 +Subject: net/ncsi: clear Tx enable mode when handling a Config required AEN + +From: Cosmo Chou + +[ Upstream commit 6f75cd166a5a3c0bc50441faa8b8304f60522fdd ] + +ncsi_channel_is_tx() determines whether a given channel should be +used for Tx or not. However, when reconfiguring the channel by +handling a Configuration Required AEN, there is a misjudgment that +the channel Tx has already been enabled, which results in the Enable +Channel Network Tx command not being sent. + +Clear the channel Tx enable flag before reconfiguring the channel to +avoid the misjudgment. + +Fixes: 8d951a75d022 ("net/ncsi: Configure multi-package, multi-channel modes with failover") +Signed-off-by: Cosmo Chou +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ncsi/ncsi-aen.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/ncsi/ncsi-aen.c b/net/ncsi/ncsi-aen.c +index b635c194f0a85..62fb1031763d1 100644 +--- a/net/ncsi/ncsi-aen.c ++++ b/net/ncsi/ncsi-aen.c +@@ -165,6 +165,7 @@ static int ncsi_aen_handler_cr(struct ncsi_dev_priv *ndp, + nc->state = NCSI_CHANNEL_INACTIVE; + list_add_tail_rcu(&nc->link, &ndp->channel_queue); + spin_unlock_irqrestore(&ndp->lock, flags); ++ nc->modes[NCSI_MODE_TX_ENABLE].enable = 0; + + return ncsi_process_next_channel(ndp); + } +-- +2.39.2 + diff --git a/queue-5.15/net-sched-act_mirred-add-carrier-check.patch b/queue-5.15/net-sched-act_mirred-add-carrier-check.patch new file mode 100644 index 00000000000..0086e1e9a78 --- /dev/null +++ b/queue-5.15/net-sched-act_mirred-add-carrier-check.patch @@ -0,0 +1,49 @@ +From 1c9b301cb0277da415b4d7d317850fe3552d918d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 15:19:40 +0000 +Subject: net/sched: act_mirred: Add carrier check + +From: Victor Nogueira + +[ Upstream commit 526f28bd0fbdc699cda31426928802650c1528e5 ] + +There are cases where the device is adminstratively UP, but operationally +down. For example, we have a physical device (Nvidia ConnectX-6 Dx, 25Gbps) +who's cable was pulled out, here is its ip link output: + +5: ens2f1: mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000 + link/ether b8:ce:f6:4b:68:35 brd ff:ff:ff:ff:ff:ff + altname enp179s0f1np1 + +As you can see, it's administratively UP but operationally down. +In this case, sending a packet to this port caused a nasty kernel hang (so +nasty that we were unable to capture it). Aborting a transmit based on +operational status (in addition to administrative status) fixes the issue. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Acked-by: Jamal Hadi Salim +Signed-off-by: Victor Nogueira +v1->v2: Add fixes tag +v2->v3: Remove blank line between tags + add change log, suggested by Leon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/act_mirred.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index 6f39789d9d14b..97cd4b2377d69 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -261,7 +261,7 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + goto out; + } + +- if (unlikely(!(dev->flags & IFF_UP))) { ++ if (unlikely(!(dev->flags & IFF_UP)) || !netif_carrier_ok(dev)) { + net_notice_ratelimited("tc mirred to Houston: device %s is down\n", + dev->name); + goto out; +-- +2.39.2 + diff --git a/queue-5.15/net-sched-cls_api-remove-block_cb-from-driver_list-b.patch b/queue-5.15/net-sched-cls_api-remove-block_cb-from-driver_list-b.patch new file mode 100644 index 00000000000..b0f3cb2d941 --- /dev/null +++ b/queue-5.15/net-sched-cls_api-remove-block_cb-from-driver_list-b.patch @@ -0,0 +1,192 @@ +From b3e5fbe55fbc72febfa7eabf6ba33853720615df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 14:31:11 +0200 +Subject: net/sched: cls_api: remove block_cb from driver_list before freeing + +From: Vlad Buslov + +[ Upstream commit da94a7781fc3c92e7df7832bc2746f4d39bc624e ] + +Error handler of tcf_block_bind() frees the whole bo->cb_list on error. +However, by that time the flow_block_cb instances are already in the driver +list because driver ndo_setup_tc() callback is called before that up the +call chain in tcf_block_offload_cmd(). This leaves dangling pointers to +freed objects in the list and causes use-after-free[0]. Fix it by also +removing flow_block_cb instances from driver_list before deallocating them. + +[0]: +[ 279.868433] ================================================================== +[ 279.869964] BUG: KASAN: slab-use-after-free in flow_block_cb_setup_simple+0x631/0x7c0 +[ 279.871527] Read of size 8 at addr ffff888147e2bf20 by task tc/2963 + +[ 279.873151] CPU: 6 PID: 2963 Comm: tc Not tainted 6.3.0-rc6+ #4 +[ 279.874273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 +[ 279.876295] Call Trace: +[ 279.876882] +[ 279.877413] dump_stack_lvl+0x33/0x50 +[ 279.878198] print_report+0xc2/0x610 +[ 279.878987] ? flow_block_cb_setup_simple+0x631/0x7c0 +[ 279.879994] kasan_report+0xae/0xe0 +[ 279.880750] ? flow_block_cb_setup_simple+0x631/0x7c0 +[ 279.881744] ? mlx5e_tc_reoffload_flows_work+0x240/0x240 [mlx5_core] +[ 279.883047] flow_block_cb_setup_simple+0x631/0x7c0 +[ 279.884027] tcf_block_offload_cmd.isra.0+0x189/0x2d0 +[ 279.885037] ? tcf_block_setup+0x6b0/0x6b0 +[ 279.885901] ? mutex_lock+0x7d/0xd0 +[ 279.886669] ? __mutex_unlock_slowpath.constprop.0+0x2d0/0x2d0 +[ 279.887844] ? ingress_init+0x1c0/0x1c0 [sch_ingress] +[ 279.888846] tcf_block_get_ext+0x61c/0x1200 +[ 279.889711] ingress_init+0x112/0x1c0 [sch_ingress] +[ 279.890682] ? clsact_init+0x2b0/0x2b0 [sch_ingress] +[ 279.891701] qdisc_create+0x401/0xea0 +[ 279.892485] ? qdisc_tree_reduce_backlog+0x470/0x470 +[ 279.893473] tc_modify_qdisc+0x6f7/0x16d0 +[ 279.894344] ? tc_get_qdisc+0xac0/0xac0 +[ 279.895213] ? mutex_lock+0x7d/0xd0 +[ 279.896005] ? __mutex_lock_slowpath+0x10/0x10 +[ 279.896910] rtnetlink_rcv_msg+0x5fe/0x9d0 +[ 279.897770] ? rtnl_calcit.isra.0+0x2b0/0x2b0 +[ 279.898672] ? __sys_sendmsg+0xb5/0x140 +[ 279.899494] ? do_syscall_64+0x3d/0x90 +[ 279.900302] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 +[ 279.901337] ? kasan_save_stack+0x2e/0x40 +[ 279.902177] ? kasan_save_stack+0x1e/0x40 +[ 279.903058] ? kasan_set_track+0x21/0x30 +[ 279.903913] ? kasan_save_free_info+0x2a/0x40 +[ 279.904836] ? ____kasan_slab_free+0x11a/0x1b0 +[ 279.905741] ? kmem_cache_free+0x179/0x400 +[ 279.906599] netlink_rcv_skb+0x12c/0x360 +[ 279.907450] ? rtnl_calcit.isra.0+0x2b0/0x2b0 +[ 279.908360] ? netlink_ack+0x1550/0x1550 +[ 279.909192] ? rhashtable_walk_peek+0x170/0x170 +[ 279.910135] ? kmem_cache_alloc_node+0x1af/0x390 +[ 279.911086] ? _copy_from_iter+0x3d6/0xc70 +[ 279.912031] netlink_unicast+0x553/0x790 +[ 279.912864] ? netlink_attachskb+0x6a0/0x6a0 +[ 279.913763] ? netlink_recvmsg+0x416/0xb50 +[ 279.914627] netlink_sendmsg+0x7a1/0xcb0 +[ 279.915473] ? netlink_unicast+0x790/0x790 +[ 279.916334] ? iovec_from_user.part.0+0x4d/0x220 +[ 279.917293] ? netlink_unicast+0x790/0x790 +[ 279.918159] sock_sendmsg+0xc5/0x190 +[ 279.918938] ____sys_sendmsg+0x535/0x6b0 +[ 279.919813] ? import_iovec+0x7/0x10 +[ 279.920601] ? kernel_sendmsg+0x30/0x30 +[ 279.921423] ? __copy_msghdr+0x3c0/0x3c0 +[ 279.922254] ? import_iovec+0x7/0x10 +[ 279.923041] ___sys_sendmsg+0xeb/0x170 +[ 279.923854] ? copy_msghdr_from_user+0x110/0x110 +[ 279.924797] ? ___sys_recvmsg+0xd9/0x130 +[ 279.925630] ? __perf_event_task_sched_in+0x183/0x470 +[ 279.926656] ? ___sys_sendmsg+0x170/0x170 +[ 279.927529] ? ctx_sched_in+0x530/0x530 +[ 279.928369] ? update_curr+0x283/0x4f0 +[ 279.929185] ? perf_event_update_userpage+0x570/0x570 +[ 279.930201] ? __fget_light+0x57/0x520 +[ 279.931023] ? __switch_to+0x53d/0xe70 +[ 279.931846] ? sockfd_lookup_light+0x1a/0x140 +[ 279.932761] __sys_sendmsg+0xb5/0x140 +[ 279.933560] ? __sys_sendmsg_sock+0x20/0x20 +[ 279.934436] ? fpregs_assert_state_consistent+0x1d/0xa0 +[ 279.935490] do_syscall_64+0x3d/0x90 +[ 279.936300] entry_SYSCALL_64_after_hwframe+0x46/0xb0 +[ 279.937311] RIP: 0033:0x7f21c814f887 +[ 279.938085] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 +[ 279.941448] RSP: 002b:00007fff11efd478 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +[ 279.942964] RAX: ffffffffffffffda RBX: 0000000064401979 RCX: 00007f21c814f887 +[ 279.944337] RDX: 0000000000000000 RSI: 00007fff11efd4e0 RDI: 0000000000000003 +[ 279.945660] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 +[ 279.947003] R10: 00007f21c8008708 R11: 0000000000000246 R12: 0000000000000001 +[ 279.948345] R13: 0000000000409980 R14: 000000000047e538 R15: 0000000000485400 +[ 279.949690] + +[ 279.950706] Allocated by task 2960: +[ 279.951471] kasan_save_stack+0x1e/0x40 +[ 279.952338] kasan_set_track+0x21/0x30 +[ 279.953165] __kasan_kmalloc+0x77/0x90 +[ 279.954006] flow_block_cb_setup_simple+0x3dd/0x7c0 +[ 279.955001] tcf_block_offload_cmd.isra.0+0x189/0x2d0 +[ 279.956020] tcf_block_get_ext+0x61c/0x1200 +[ 279.956881] ingress_init+0x112/0x1c0 [sch_ingress] +[ 279.957873] qdisc_create+0x401/0xea0 +[ 279.958656] tc_modify_qdisc+0x6f7/0x16d0 +[ 279.959506] rtnetlink_rcv_msg+0x5fe/0x9d0 +[ 279.960392] netlink_rcv_skb+0x12c/0x360 +[ 279.961216] netlink_unicast+0x553/0x790 +[ 279.962044] netlink_sendmsg+0x7a1/0xcb0 +[ 279.962906] sock_sendmsg+0xc5/0x190 +[ 279.963702] ____sys_sendmsg+0x535/0x6b0 +[ 279.964534] ___sys_sendmsg+0xeb/0x170 +[ 279.965343] __sys_sendmsg+0xb5/0x140 +[ 279.966132] do_syscall_64+0x3d/0x90 +[ 279.966908] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +[ 279.968407] Freed by task 2960: +[ 279.969114] kasan_save_stack+0x1e/0x40 +[ 279.969929] kasan_set_track+0x21/0x30 +[ 279.970729] kasan_save_free_info+0x2a/0x40 +[ 279.971603] ____kasan_slab_free+0x11a/0x1b0 +[ 279.972483] __kmem_cache_free+0x14d/0x280 +[ 279.973337] tcf_block_setup+0x29d/0x6b0 +[ 279.974173] tcf_block_offload_cmd.isra.0+0x226/0x2d0 +[ 279.975186] tcf_block_get_ext+0x61c/0x1200 +[ 279.976080] ingress_init+0x112/0x1c0 [sch_ingress] +[ 279.977065] qdisc_create+0x401/0xea0 +[ 279.977857] tc_modify_qdisc+0x6f7/0x16d0 +[ 279.978695] rtnetlink_rcv_msg+0x5fe/0x9d0 +[ 279.979562] netlink_rcv_skb+0x12c/0x360 +[ 279.980388] netlink_unicast+0x553/0x790 +[ 279.981214] netlink_sendmsg+0x7a1/0xcb0 +[ 279.982043] sock_sendmsg+0xc5/0x190 +[ 279.982827] ____sys_sendmsg+0x535/0x6b0 +[ 279.983703] ___sys_sendmsg+0xeb/0x170 +[ 279.984510] __sys_sendmsg+0xb5/0x140 +[ 279.985298] do_syscall_64+0x3d/0x90 +[ 279.986076] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +[ 279.987532] The buggy address belongs to the object at ffff888147e2bf00 + which belongs to the cache kmalloc-192 of size 192 +[ 279.989747] The buggy address is located 32 bytes inside of + freed 192-byte region [ffff888147e2bf00, ffff888147e2bfc0) + +[ 279.992367] The buggy address belongs to the physical page: +[ 279.993430] page:00000000550f405c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x147e2a +[ 279.995182] head:00000000550f405c order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 +[ 279.996713] anon flags: 0x200000000010200(slab|head|node=0|zone=2) +[ 279.997878] raw: 0200000000010200 ffff888100042a00 0000000000000000 dead000000000001 +[ 279.999384] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 +[ 280.000894] page dumped because: kasan: bad access detected + +[ 280.002386] Memory state around the buggy address: +[ 280.003338] ffff888147e2be00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 280.004781] ffff888147e2be80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc +[ 280.006224] >ffff888147e2bf00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 280.007700] ^ +[ 280.008592] ffff888147e2bf80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc +[ 280.010035] ffff888147e2c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 280.011564] ================================================================== + +Fixes: 59094b1e5094 ("net: sched: use flow block API") +Signed-off-by: Vlad Buslov +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/cls_api.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index 62ce6981942b7..501e05943f02b 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -1465,6 +1465,7 @@ static int tcf_block_bind(struct tcf_block *block, + + err_unroll: + list_for_each_entry_safe(block_cb, next, &bo->cb_list, list) { ++ list_del(&block_cb->driver_list); + if (i-- > 0) { + list_del(&block_cb->list); + tcf_block_playback_offloads(block, block_cb->cb, +-- +2.39.2 + diff --git a/queue-5.15/octeontx2-af-secure-apr-table-update-with-the-lock.patch b/queue-5.15/octeontx2-af-secure-apr-table-update-with-the-lock.patch new file mode 100644 index 00000000000..d40458f9aea --- /dev/null +++ b/queue-5.15/octeontx2-af-secure-apr-table-update-with-the-lock.patch @@ -0,0 +1,81 @@ +From d0f651cfb10d1146b1e59d4495814368957f28e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 12:39:34 +0530 +Subject: octeontx2-af: Secure APR table update with the lock + +From: Geetha sowjanya + +[ Upstream commit 048486f81d01db4d100af021ee2ea211d19732a0 ] + +APR table contains the lmtst base address of PF/VFs. These entries +are updated by the PF/VF during the device probe. The lmtst address +is fetched from HW using "TXN_REQ" and "ADDR_RSP_STS" registers. +The lock tries to protect these registers from getting overwritten +when multiple PFs invokes rvu_get_lmtaddr() simultaneously. + +For example, if PF1 submit the request and got permitted before it +reads the response and PF2 got scheduled submit the request then the +response of PF1 is overwritten by the PF2 response. + +Fixes: 893ae97214c3 ("octeontx2-af: cn10k: Support configurable LMTST regions") +Signed-off-by: Geetha sowjanya +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: Sai Krishna +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c +index 46a41cfff5751..25713287a288f 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c +@@ -60,13 +60,14 @@ static int rvu_get_lmtaddr(struct rvu *rvu, u16 pcifunc, + u64 iova, u64 *lmt_addr) + { + u64 pa, val, pf; +- int err; ++ int err = 0; + + if (!iova) { + dev_err(rvu->dev, "%s Requested Null address for transulation\n", __func__); + return -EINVAL; + } + ++ mutex_lock(&rvu->rsrc_lock); + rvu_write64(rvu, BLKADDR_RVUM, RVU_AF_SMMU_ADDR_REQ, iova); + pf = rvu_get_pf(pcifunc) & 0x1F; + val = BIT_ULL(63) | BIT_ULL(14) | BIT_ULL(13) | pf << 8 | +@@ -76,12 +77,13 @@ static int rvu_get_lmtaddr(struct rvu *rvu, u16 pcifunc, + err = rvu_poll_reg(rvu, BLKADDR_RVUM, RVU_AF_SMMU_ADDR_RSP_STS, BIT_ULL(0), false); + if (err) { + dev_err(rvu->dev, "%s LMTLINE iova transulation failed\n", __func__); +- return err; ++ goto exit; + } + val = rvu_read64(rvu, BLKADDR_RVUM, RVU_AF_SMMU_ADDR_RSP_STS); + if (val & ~0x1ULL) { + dev_err(rvu->dev, "%s LMTLINE iova transulation failed err:%llx\n", __func__, val); +- return -EIO; ++ err = -EIO; ++ goto exit; + } + /* PA[51:12] = RVU_AF_SMMU_TLN_FLIT0[57:18] + * PA[11:0] = IOVA[11:0] +@@ -89,8 +91,9 @@ static int rvu_get_lmtaddr(struct rvu *rvu, u16 pcifunc, + pa = rvu_read64(rvu, BLKADDR_RVUM, RVU_AF_SMMU_TLN_FLIT0) >> 18; + pa &= GENMASK_ULL(39, 0); + *lmt_addr = (pa << 12) | (iova & 0xFFF); +- +- return 0; ++exit: ++ mutex_unlock(&rvu->rsrc_lock); ++ return err; + } + + static int rvu_update_lmtaddr(struct rvu *rvu, u16 pcifunc, u64 lmt_addr) +-- +2.39.2 + diff --git a/queue-5.15/octeontx2-af-skip-pfs-if-not-enabled.patch b/queue-5.15/octeontx2-af-skip-pfs-if-not-enabled.patch new file mode 100644 index 00000000000..82b7f50811a --- /dev/null +++ b/queue-5.15/octeontx2-af-skip-pfs-if-not-enabled.patch @@ -0,0 +1,196 @@ +From fd3ca952ccda7f221584d56fe9b88a27efdbe729 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 12:39:42 +0530 +Subject: octeontx2-af: Skip PFs if not enabled + +From: Ratheesh Kannoth + +[ Upstream commit 5eb1b7220948a69298a436148a735f32ec325289 ] + +Firmware enables PFs and allocate mbox resources for each of the PFs. +Currently PF driver configures mbox resources without checking whether +PF is enabled or not. This results in crash. This patch fixes this issue +by skipping disabled PF's mbox initialization. + +Fixes: 9bdc47a6e328 ("octeontx2-af: Mbox communication support btw AF and it's VFs") +Signed-off-by: Ratheesh Kannoth +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: Sai Krishna +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/marvell/octeontx2/af/mbox.c | 5 +- + .../net/ethernet/marvell/octeontx2/af/mbox.h | 3 +- + .../net/ethernet/marvell/octeontx2/af/rvu.c | 49 +++++++++++++++---- + 3 files changed, 46 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.c b/drivers/net/ethernet/marvell/octeontx2/af/mbox.c +index 2898931d5260a..9690ac01f02c8 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.c +@@ -157,7 +157,7 @@ EXPORT_SYMBOL(otx2_mbox_init); + */ + int otx2_mbox_regions_init(struct otx2_mbox *mbox, void **hwbase, + struct pci_dev *pdev, void *reg_base, +- int direction, int ndevs) ++ int direction, int ndevs, unsigned long *pf_bmap) + { + struct otx2_mbox_dev *mdev; + int devid, err; +@@ -169,6 +169,9 @@ int otx2_mbox_regions_init(struct otx2_mbox *mbox, void **hwbase, + mbox->hwbase = hwbase[0]; + + for (devid = 0; devid < ndevs; devid++) { ++ if (!test_bit(devid, pf_bmap)) ++ continue; ++ + mdev = &mbox->dev[devid]; + mdev->mbase = hwbase[devid]; + mdev->hwbase = hwbase[devid]; +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h +index c6643c7db1fc4..2b6cbd5af100d 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h +@@ -96,9 +96,10 @@ void otx2_mbox_destroy(struct otx2_mbox *mbox); + int otx2_mbox_init(struct otx2_mbox *mbox, void __force *hwbase, + struct pci_dev *pdev, void __force *reg_base, + int direction, int ndevs); ++ + int otx2_mbox_regions_init(struct otx2_mbox *mbox, void __force **hwbase, + struct pci_dev *pdev, void __force *reg_base, +- int direction, int ndevs); ++ int direction, int ndevs, unsigned long *bmap); + void otx2_mbox_msg_send(struct otx2_mbox *mbox, int devid); + int otx2_mbox_wait_for_rsp(struct otx2_mbox *mbox, int devid); + int otx2_mbox_busy_poll_for_rsp(struct otx2_mbox *mbox, int devid); +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +index bd33b90aaa67b..f64509b1d120c 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +@@ -2196,7 +2196,7 @@ static inline void rvu_afvf_mbox_up_handler(struct work_struct *work) + } + + static int rvu_get_mbox_regions(struct rvu *rvu, void **mbox_addr, +- int num, int type) ++ int num, int type, unsigned long *pf_bmap) + { + struct rvu_hwinfo *hw = rvu->hw; + int region; +@@ -2208,6 +2208,9 @@ static int rvu_get_mbox_regions(struct rvu *rvu, void **mbox_addr, + */ + if (type == TYPE_AFVF) { + for (region = 0; region < num; region++) { ++ if (!test_bit(region, pf_bmap)) ++ continue; ++ + if (hw->cap.per_pf_mbox_regs) { + bar4 = rvu_read64(rvu, BLKADDR_RVUM, + RVU_AF_PFX_BAR4_ADDR(0)) + +@@ -2229,6 +2232,9 @@ static int rvu_get_mbox_regions(struct rvu *rvu, void **mbox_addr, + * RVU_AF_PF_BAR4_ADDR register. + */ + for (region = 0; region < num; region++) { ++ if (!test_bit(region, pf_bmap)) ++ continue; ++ + if (hw->cap.per_pf_mbox_regs) { + bar4 = rvu_read64(rvu, BLKADDR_RVUM, + RVU_AF_PFX_BAR4_ADDR(region)); +@@ -2257,20 +2263,41 @@ static int rvu_mbox_init(struct rvu *rvu, struct mbox_wq_info *mw, + int err = -EINVAL, i, dir, dir_up; + void __iomem *reg_base; + struct rvu_work *mwork; ++ unsigned long *pf_bmap; + void **mbox_regions; + const char *name; ++ u64 cfg; + +- mbox_regions = kcalloc(num, sizeof(void *), GFP_KERNEL); +- if (!mbox_regions) ++ pf_bmap = bitmap_zalloc(num, GFP_KERNEL); ++ if (!pf_bmap) + return -ENOMEM; + ++ /* RVU VFs */ ++ if (type == TYPE_AFVF) ++ bitmap_set(pf_bmap, 0, num); ++ ++ if (type == TYPE_AFPF) { ++ /* Mark enabled PFs in bitmap */ ++ for (i = 0; i < num; i++) { ++ cfg = rvu_read64(rvu, BLKADDR_RVUM, RVU_PRIV_PFX_CFG(i)); ++ if (cfg & BIT_ULL(20)) ++ set_bit(i, pf_bmap); ++ } ++ } ++ ++ mbox_regions = kcalloc(num, sizeof(void *), GFP_KERNEL); ++ if (!mbox_regions) { ++ err = -ENOMEM; ++ goto free_bitmap; ++ } ++ + switch (type) { + case TYPE_AFPF: + name = "rvu_afpf_mailbox"; + dir = MBOX_DIR_AFPF; + dir_up = MBOX_DIR_AFPF_UP; + reg_base = rvu->afreg_base; +- err = rvu_get_mbox_regions(rvu, mbox_regions, num, TYPE_AFPF); ++ err = rvu_get_mbox_regions(rvu, mbox_regions, num, TYPE_AFPF, pf_bmap); + if (err) + goto free_regions; + break; +@@ -2279,7 +2306,7 @@ static int rvu_mbox_init(struct rvu *rvu, struct mbox_wq_info *mw, + dir = MBOX_DIR_PFVF; + dir_up = MBOX_DIR_PFVF_UP; + reg_base = rvu->pfreg_base; +- err = rvu_get_mbox_regions(rvu, mbox_regions, num, TYPE_AFVF); ++ err = rvu_get_mbox_regions(rvu, mbox_regions, num, TYPE_AFVF, pf_bmap); + if (err) + goto free_regions; + break; +@@ -2310,16 +2337,19 @@ static int rvu_mbox_init(struct rvu *rvu, struct mbox_wq_info *mw, + } + + err = otx2_mbox_regions_init(&mw->mbox, mbox_regions, rvu->pdev, +- reg_base, dir, num); ++ reg_base, dir, num, pf_bmap); + if (err) + goto exit; + + err = otx2_mbox_regions_init(&mw->mbox_up, mbox_regions, rvu->pdev, +- reg_base, dir_up, num); ++ reg_base, dir_up, num, pf_bmap); + if (err) + goto exit; + + for (i = 0; i < num; i++) { ++ if (!test_bit(i, pf_bmap)) ++ continue; ++ + mwork = &mw->mbox_wrk[i]; + mwork->rvu = rvu; + INIT_WORK(&mwork->work, mbox_handler); +@@ -2328,8 +2358,7 @@ static int rvu_mbox_init(struct rvu *rvu, struct mbox_wq_info *mw, + mwork->rvu = rvu; + INIT_WORK(&mwork->work, mbox_up_handler); + } +- kfree(mbox_regions); +- return 0; ++ goto free_regions; + + exit: + destroy_workqueue(mw->mbox_wq); +@@ -2338,6 +2367,8 @@ static int rvu_mbox_init(struct rvu *rvu, struct mbox_wq_info *mw, + iounmap((void __iomem *)mbox_regions[num]); + free_regions: + kfree(mbox_regions); ++free_bitmap: ++ bitmap_free(pf_bmap); + return err; + } + +-- +2.39.2 + diff --git a/queue-5.15/octeontx2-pf-disable-packet-i-o-for-graceful-exit.patch b/queue-5.15/octeontx2-pf-disable-packet-i-o-for-graceful-exit.patch new file mode 100644 index 00000000000..947399bb0e3 --- /dev/null +++ b/queue-5.15/octeontx2-pf-disable-packet-i-o-for-graceful-exit.patch @@ -0,0 +1,55 @@ +From 8d2323ded32267e2dd84bc4edfef6f9fda84e16e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 12:39:43 +0530 +Subject: octeontx2-pf: Disable packet I/O for graceful exit + +From: Subbaraya Sundeep + +[ Upstream commit c926252205c424c4842dbdbe02f8e3296f623204 ] + +At the stage of enabling packet I/O in otx2_open, If mailbox +timeout occurs then interface ends up in down state where as +hardware packet I/O is enabled. Hence disable packet I/O also +before bailing out. + +Fixes: 1ea0166da050 ("octeontx2-pf: Fix the device state on error") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: Sai Krishna +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index ab291c2c30144..a987ae9d6a285 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -1761,13 +1761,22 @@ int otx2_open(struct net_device *netdev) + otx2_dmacflt_reinstall_flows(pf); + + err = otx2_rxtx_enable(pf, true); +- if (err) ++ /* If a mbox communication error happens at this point then interface ++ * will end up in a state such that it is in down state but hardware ++ * mcam entries are enabled to receive the packets. Hence disable the ++ * packet I/O. ++ */ ++ if (err == EIO) ++ goto err_disable_rxtx; ++ else if (err) + goto err_tx_stop_queues; + + otx2_do_set_rx_mode(pf); + + return 0; + ++err_disable_rxtx: ++ otx2_rxtx_enable(pf, false); + err_tx_stop_queues: + netif_tx_stop_all_queues(netdev); + netif_carrier_off(netdev); +-- +2.39.2 + diff --git a/queue-5.15/octeontx2-vf-detach-lf-resources-on-probe-cleanup.patch b/queue-5.15/octeontx2-vf-detach-lf-resources-on-probe-cleanup.patch new file mode 100644 index 00000000000..610a2bd12b7 --- /dev/null +++ b/queue-5.15/octeontx2-vf-detach-lf-resources-on-probe-cleanup.patch @@ -0,0 +1,39 @@ +From 7cfe6683c999531258c2f5a2879e0a2c0caf6270 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 12:39:44 +0530 +Subject: octeontx2-vf: Detach LF resources on probe cleanup + +From: Subbaraya Sundeep + +[ Upstream commit 99ae1260fdb5f15beab8a3adfb93a9041c87a2c1 ] + +When a VF device probe fails due to error in MSIX vector allocation then +the resources NIX and NPA LFs were not detached. Fix this by detaching +the LFs when MSIX vector allocation fails. + +Fixes: 3184fb5ba96e ("octeontx2-vf: Virtual function driver support") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: Sai Krishna +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +index 9822db362c88e..e69b0e2729cb2 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +@@ -630,7 +630,7 @@ static int otx2vf_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + err = otx2vf_realloc_msix_vectors(vf); + if (err) +- goto err_mbox_destroy; ++ goto err_detach_rsrc; + + err = otx2_set_real_num_queues(netdev, qcount, qcount); + if (err) +-- +2.39.2 + diff --git a/queue-5.15/perf-evlist-refactor-evlist__for_each_cpu.patch b/queue-5.15/perf-evlist-refactor-evlist__for_each_cpu.patch new file mode 100644 index 00000000000..0dceb003721 --- /dev/null +++ b/queue-5.15/perf-evlist-refactor-evlist__for_each_cpu.patch @@ -0,0 +1,574 @@ +From 8d1c545ff6de6c4f1c08beb57b30b92d93a23916 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jan 2022 22:13:37 -0800 +Subject: perf evlist: Refactor evlist__for_each_cpu() + +From: Ian Rogers + +[ Upstream commit 472832d2c000b9611feaea66fe521055c3dbf17a ] + +Previously evlist__for_each_cpu() needed to iterate over the evlist in +an inner loop and call "skip" routines. Refactor this so that the +iteratr is smarter and the next function can update both the current CPU +and evsel. + +By using a cpu map index, fix apparent off-by-1 in __run_perf_stat's +call to perf_evsel__close_cpu(). + +Signed-off-by: Ian Rogers +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: John Garry +Cc: Kajol Jain +Cc: Kan Liang +Cc: Leo Yan +Cc: Mark Rutland +Cc: Mathieu Poirier +Cc: Mike Leach +Cc: Namhyung Kim +Cc: Paul Clarke +Cc: Peter Zijlstra +Cc: Riccardo Mancini +Cc: Stephane Eranian +Cc: Suzuki Poulouse +Cc: Vineet Singh +Cc: coresight@lists.linaro.org +Cc: linux-arm-kernel@lists.infradead.org +Cc: zhengjun.xing@intel.com +Link: https://lore.kernel.org/r/20220105061351.120843-35-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: ecc68ee216c6 ("perf stat: Separate bperf from bpf_profiler") +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-stat.c | 179 ++++++++++++++++++-------------------- + tools/perf/util/evlist.c | 146 +++++++++++++++++-------------- + tools/perf/util/evlist.h | 50 +++++++++-- + tools/perf/util/evsel.h | 1 - + 4 files changed, 210 insertions(+), 166 deletions(-) + +diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c +index 0b709e3ead2ac..4ccd0c7c13ea1 100644 +--- a/tools/perf/builtin-stat.c ++++ b/tools/perf/builtin-stat.c +@@ -405,36 +405,33 @@ static int read_counter_cpu(struct evsel *counter, struct timespec *rs, int cpu) + + static int read_affinity_counters(struct timespec *rs) + { +- struct evsel *counter; +- struct affinity affinity; +- int i, ncpus, cpu; ++ struct evlist_cpu_iterator evlist_cpu_itr; ++ struct affinity saved_affinity, *affinity; + + if (all_counters_use_bpf) + return 0; + +- if (affinity__setup(&affinity) < 0) ++ if (!target__has_cpu(&target) || target__has_per_thread(&target)) ++ affinity = NULL; ++ else if (affinity__setup(&saved_affinity) < 0) + return -1; ++ else ++ affinity = &saved_affinity; + +- ncpus = perf_cpu_map__nr(evsel_list->core.all_cpus); +- if (!target__has_cpu(&target) || target__has_per_thread(&target)) +- ncpus = 1; +- evlist__for_each_cpu(evsel_list, i, cpu) { +- if (i >= ncpus) +- break; +- affinity__set(&affinity, cpu); ++ evlist__for_each_cpu(evlist_cpu_itr, evsel_list, affinity) { ++ struct evsel *counter = evlist_cpu_itr.evsel; + +- evlist__for_each_entry(evsel_list, counter) { +- if (evsel__cpu_iter_skip(counter, cpu)) +- continue; +- if (evsel__is_bpf(counter)) +- continue; +- if (!counter->err) { +- counter->err = read_counter_cpu(counter, rs, +- counter->cpu_iter - 1); +- } ++ if (evsel__is_bpf(counter)) ++ continue; ++ ++ if (!counter->err) { ++ counter->err = read_counter_cpu(counter, rs, ++ evlist_cpu_itr.cpu_map_idx); + } + } +- affinity__cleanup(&affinity); ++ if (affinity) ++ affinity__cleanup(&saved_affinity); ++ + return 0; + } + +@@ -771,8 +768,9 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx) + int status = 0; + const bool forks = (argc > 0); + bool is_pipe = STAT_RECORD ? perf_stat.data.is_pipe : false; ++ struct evlist_cpu_iterator evlist_cpu_itr; + struct affinity affinity; +- int i, cpu, err; ++ int err; + bool second_pass = false; + + if (forks) { +@@ -797,102 +795,97 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx) + all_counters_use_bpf = false; + } + +- evlist__for_each_cpu (evsel_list, i, cpu) { ++ evlist__for_each_cpu(evlist_cpu_itr, evsel_list, &affinity) { ++ counter = evlist_cpu_itr.evsel; ++ + /* + * bperf calls evsel__open_per_cpu() in bperf__load(), so + * no need to call it again here. + */ + if (target.use_bpf) + break; +- affinity__set(&affinity, cpu); + +- evlist__for_each_entry(evsel_list, counter) { +- if (evsel__cpu_iter_skip(counter, cpu)) ++ if (counter->reset_group || counter->errored) ++ continue; ++ if (evsel__is_bpf(counter)) ++ continue; ++try_again: ++ if (create_perf_stat_counter(counter, &stat_config, &target, ++ evlist_cpu_itr.cpu_map_idx) < 0) { ++ ++ /* ++ * Weak group failed. We cannot just undo this here ++ * because earlier CPUs might be in group mode, and the kernel ++ * doesn't support mixing group and non group reads. Defer ++ * it to later. ++ * Don't close here because we're in the wrong affinity. ++ */ ++ if ((errno == EINVAL || errno == EBADF) && ++ evsel__leader(counter) != counter && ++ counter->weak_group) { ++ evlist__reset_weak_group(evsel_list, counter, false); ++ assert(counter->reset_group); ++ second_pass = true; + continue; +- if (counter->reset_group || counter->errored) ++ } ++ ++ switch (stat_handle_error(counter)) { ++ case COUNTER_FATAL: ++ return -1; ++ case COUNTER_RETRY: ++ goto try_again; ++ case COUNTER_SKIP: + continue; +- if (evsel__is_bpf(counter)) ++ default: ++ break; ++ } ++ ++ } ++ counter->supported = true; ++ } ++ ++ if (second_pass) { ++ /* ++ * Now redo all the weak group after closing them, ++ * and also close errored counters. ++ */ ++ ++ /* First close errored or weak retry */ ++ evlist__for_each_cpu(evlist_cpu_itr, evsel_list, &affinity) { ++ counter = evlist_cpu_itr.evsel; ++ ++ if (!counter->reset_group && !counter->errored) + continue; +-try_again: ++ ++ perf_evsel__close_cpu(&counter->core, evlist_cpu_itr.cpu_map_idx); ++ } ++ /* Now reopen weak */ ++ evlist__for_each_cpu(evlist_cpu_itr, evsel_list, &affinity) { ++ counter = evlist_cpu_itr.evsel; ++ ++ if (!counter->reset_group && !counter->errored) ++ continue; ++ if (!counter->reset_group) ++ continue; ++try_again_reset: ++ pr_debug2("reopening weak %s\n", evsel__name(counter)); + if (create_perf_stat_counter(counter, &stat_config, &target, +- counter->cpu_iter - 1) < 0) { +- +- /* +- * Weak group failed. We cannot just undo this here +- * because earlier CPUs might be in group mode, and the kernel +- * doesn't support mixing group and non group reads. Defer +- * it to later. +- * Don't close here because we're in the wrong affinity. +- */ +- if ((errno == EINVAL || errno == EBADF) && +- evsel__leader(counter) != counter && +- counter->weak_group) { +- evlist__reset_weak_group(evsel_list, counter, false); +- assert(counter->reset_group); +- second_pass = true; +- continue; +- } ++ evlist_cpu_itr.cpu_map_idx) < 0) { + + switch (stat_handle_error(counter)) { + case COUNTER_FATAL: + return -1; + case COUNTER_RETRY: +- goto try_again; ++ goto try_again_reset; + case COUNTER_SKIP: + continue; + default: + break; + } +- + } + counter->supported = true; + } + } +- +- if (second_pass) { +- /* +- * Now redo all the weak group after closing them, +- * and also close errored counters. +- */ +- +- evlist__for_each_cpu(evsel_list, i, cpu) { +- affinity__set(&affinity, cpu); +- /* First close errored or weak retry */ +- evlist__for_each_entry(evsel_list, counter) { +- if (!counter->reset_group && !counter->errored) +- continue; +- if (evsel__cpu_iter_skip_no_inc(counter, cpu)) +- continue; +- perf_evsel__close_cpu(&counter->core, counter->cpu_iter); +- } +- /* Now reopen weak */ +- evlist__for_each_entry(evsel_list, counter) { +- if (!counter->reset_group && !counter->errored) +- continue; +- if (evsel__cpu_iter_skip(counter, cpu)) +- continue; +- if (!counter->reset_group) +- continue; +-try_again_reset: +- pr_debug2("reopening weak %s\n", evsel__name(counter)); +- if (create_perf_stat_counter(counter, &stat_config, &target, +- counter->cpu_iter - 1) < 0) { +- +- switch (stat_handle_error(counter)) { +- case COUNTER_FATAL: +- return -1; +- case COUNTER_RETRY: +- goto try_again_reset; +- case COUNTER_SKIP: +- continue; +- default: +- break; +- } +- } +- counter->supported = true; +- } +- } +- } + affinity__cleanup(&affinity); + + evlist__for_each_entry(evsel_list, counter) { +diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c +index 5f92319ce258d..39d294f6c3218 100644 +--- a/tools/perf/util/evlist.c ++++ b/tools/perf/util/evlist.c +@@ -342,36 +342,65 @@ static int evlist__nr_threads(struct evlist *evlist, struct evsel *evsel) + return perf_thread_map__nr(evlist->core.threads); + } + +-void evlist__cpu_iter_start(struct evlist *evlist) +-{ +- struct evsel *pos; +- +- /* +- * Reset the per evsel cpu_iter. This is needed because +- * each evsel's cpumap may have a different index space, +- * and some operations need the index to modify +- * the FD xyarray (e.g. open, close) +- */ +- evlist__for_each_entry(evlist, pos) +- pos->cpu_iter = 0; +-} ++struct evlist_cpu_iterator evlist__cpu_begin(struct evlist *evlist, struct affinity *affinity) ++{ ++ struct evlist_cpu_iterator itr = { ++ .container = evlist, ++ .evsel = evlist__first(evlist), ++ .cpu_map_idx = 0, ++ .evlist_cpu_map_idx = 0, ++ .evlist_cpu_map_nr = perf_cpu_map__nr(evlist->core.all_cpus), ++ .cpu = -1, ++ .affinity = affinity, ++ }; + +-bool evsel__cpu_iter_skip_no_inc(struct evsel *ev, int cpu) +-{ +- if (ev->cpu_iter >= ev->core.cpus->nr) +- return true; +- if (cpu >= 0 && ev->core.cpus->map[ev->cpu_iter] != cpu) +- return true; +- return false; ++ if (itr.affinity) { ++ itr.cpu = perf_cpu_map__cpu(evlist->core.all_cpus, 0); ++ affinity__set(itr.affinity, itr.cpu); ++ itr.cpu_map_idx = perf_cpu_map__idx(itr.evsel->core.cpus, itr.cpu); ++ /* ++ * If this CPU isn't in the evsel's cpu map then advance through ++ * the list. ++ */ ++ if (itr.cpu_map_idx == -1) ++ evlist_cpu_iterator__next(&itr); ++ } ++ return itr; ++} ++ ++void evlist_cpu_iterator__next(struct evlist_cpu_iterator *evlist_cpu_itr) ++{ ++ while (evlist_cpu_itr->evsel != evlist__last(evlist_cpu_itr->container)) { ++ evlist_cpu_itr->evsel = evsel__next(evlist_cpu_itr->evsel); ++ evlist_cpu_itr->cpu_map_idx = ++ perf_cpu_map__idx(evlist_cpu_itr->evsel->core.cpus, ++ evlist_cpu_itr->cpu); ++ if (evlist_cpu_itr->cpu_map_idx != -1) ++ return; ++ } ++ evlist_cpu_itr->evlist_cpu_map_idx++; ++ if (evlist_cpu_itr->evlist_cpu_map_idx < evlist_cpu_itr->evlist_cpu_map_nr) { ++ evlist_cpu_itr->evsel = evlist__first(evlist_cpu_itr->container); ++ evlist_cpu_itr->cpu = ++ perf_cpu_map__cpu(evlist_cpu_itr->container->core.all_cpus, ++ evlist_cpu_itr->evlist_cpu_map_idx); ++ if (evlist_cpu_itr->affinity) ++ affinity__set(evlist_cpu_itr->affinity, evlist_cpu_itr->cpu); ++ evlist_cpu_itr->cpu_map_idx = ++ perf_cpu_map__idx(evlist_cpu_itr->evsel->core.cpus, ++ evlist_cpu_itr->cpu); ++ /* ++ * If this CPU isn't in the evsel's cpu map then advance through ++ * the list. ++ */ ++ if (evlist_cpu_itr->cpu_map_idx == -1) ++ evlist_cpu_iterator__next(evlist_cpu_itr); ++ } + } + +-bool evsel__cpu_iter_skip(struct evsel *ev, int cpu) ++bool evlist_cpu_iterator__end(const struct evlist_cpu_iterator *evlist_cpu_itr) + { +- if (!evsel__cpu_iter_skip_no_inc(ev, cpu)) { +- ev->cpu_iter++; +- return false; +- } +- return true; ++ return evlist_cpu_itr->evlist_cpu_map_idx >= evlist_cpu_itr->evlist_cpu_map_nr; + } + + static int evsel__strcmp(struct evsel *pos, char *evsel_name) +@@ -400,31 +429,26 @@ static int evlist__is_enabled(struct evlist *evlist) + static void __evlist__disable(struct evlist *evlist, char *evsel_name) + { + struct evsel *pos; ++ struct evlist_cpu_iterator evlist_cpu_itr; + struct affinity affinity; +- int cpu, i, imm = 0; + bool has_imm = false; + + if (affinity__setup(&affinity) < 0) + return; + + /* Disable 'immediate' events last */ +- for (imm = 0; imm <= 1; imm++) { +- evlist__for_each_cpu(evlist, i, cpu) { +- affinity__set(&affinity, cpu); +- +- evlist__for_each_entry(evlist, pos) { +- if (evsel__strcmp(pos, evsel_name)) +- continue; +- if (evsel__cpu_iter_skip(pos, cpu)) +- continue; +- if (pos->disabled || !evsel__is_group_leader(pos) || !pos->core.fd) +- continue; +- if (pos->immediate) +- has_imm = true; +- if (pos->immediate != imm) +- continue; +- evsel__disable_cpu(pos, pos->cpu_iter - 1); +- } ++ for (int imm = 0; imm <= 1; imm++) { ++ evlist__for_each_cpu(evlist_cpu_itr, evlist, &affinity) { ++ pos = evlist_cpu_itr.evsel; ++ if (evsel__strcmp(pos, evsel_name)) ++ continue; ++ if (pos->disabled || !evsel__is_group_leader(pos) || !pos->core.fd) ++ continue; ++ if (pos->immediate) ++ has_imm = true; ++ if (pos->immediate != imm) ++ continue; ++ evsel__disable_cpu(pos, evlist_cpu_itr.cpu_map_idx); + } + if (!has_imm) + break; +@@ -462,24 +486,19 @@ void evlist__disable_evsel(struct evlist *evlist, char *evsel_name) + static void __evlist__enable(struct evlist *evlist, char *evsel_name) + { + struct evsel *pos; ++ struct evlist_cpu_iterator evlist_cpu_itr; + struct affinity affinity; +- int cpu, i; + + if (affinity__setup(&affinity) < 0) + return; + +- evlist__for_each_cpu(evlist, i, cpu) { +- affinity__set(&affinity, cpu); +- +- evlist__for_each_entry(evlist, pos) { +- if (evsel__strcmp(pos, evsel_name)) +- continue; +- if (evsel__cpu_iter_skip(pos, cpu)) +- continue; +- if (!evsel__is_group_leader(pos) || !pos->core.fd) +- continue; +- evsel__enable_cpu(pos, pos->cpu_iter - 1); +- } ++ evlist__for_each_cpu(evlist_cpu_itr, evlist, &affinity) { ++ pos = evlist_cpu_itr.evsel; ++ if (evsel__strcmp(pos, evsel_name)) ++ continue; ++ if (!evsel__is_group_leader(pos) || !pos->core.fd) ++ continue; ++ evsel__enable_cpu(pos, evlist_cpu_itr.cpu_map_idx); + } + affinity__cleanup(&affinity); + evlist__for_each_entry(evlist, pos) { +@@ -1264,8 +1283,8 @@ void evlist__set_selected(struct evlist *evlist, struct evsel *evsel) + void evlist__close(struct evlist *evlist) + { + struct evsel *evsel; ++ struct evlist_cpu_iterator evlist_cpu_itr; + struct affinity affinity; +- int cpu, i; + + /* + * With perf record core.cpus is usually NULL. +@@ -1279,15 +1298,12 @@ void evlist__close(struct evlist *evlist) + + if (affinity__setup(&affinity) < 0) + return; +- evlist__for_each_cpu(evlist, i, cpu) { +- affinity__set(&affinity, cpu); + +- evlist__for_each_entry_reverse(evlist, evsel) { +- if (evsel__cpu_iter_skip(evsel, cpu)) +- continue; +- perf_evsel__close_cpu(&evsel->core, evsel->cpu_iter - 1); +- } ++ evlist__for_each_cpu(evlist_cpu_itr, evlist, &affinity) { ++ perf_evsel__close_cpu(&evlist_cpu_itr.evsel->core, ++ evlist_cpu_itr.cpu_map_idx); + } ++ + affinity__cleanup(&affinity); + evlist__for_each_entry_reverse(evlist, evsel) { + perf_evsel__free_fd(&evsel->core); +diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h +index 97bfb8d0be4f0..ec177f783ee67 100644 +--- a/tools/perf/util/evlist.h ++++ b/tools/perf/util/evlist.h +@@ -325,17 +325,53 @@ void evlist__to_front(struct evlist *evlist, struct evsel *move_evsel); + #define evlist__for_each_entry_safe(evlist, tmp, evsel) \ + __evlist__for_each_entry_safe(&(evlist)->core.entries, tmp, evsel) + +-#define evlist__for_each_cpu(evlist, index, cpu) \ +- evlist__cpu_iter_start(evlist); \ +- perf_cpu_map__for_each_cpu (cpu, index, (evlist)->core.all_cpus) ++/** Iterator state for evlist__for_each_cpu */ ++struct evlist_cpu_iterator { ++ /** The list being iterated through. */ ++ struct evlist *container; ++ /** The current evsel of the iterator. */ ++ struct evsel *evsel; ++ /** The CPU map index corresponding to the evsel->core.cpus for the current CPU. */ ++ int cpu_map_idx; ++ /** ++ * The CPU map index corresponding to evlist->core.all_cpus for the ++ * current CPU. Distinct from cpu_map_idx as the evsel's cpu map may ++ * contain fewer entries. ++ */ ++ int evlist_cpu_map_idx; ++ /** The number of CPU map entries in evlist->core.all_cpus. */ ++ int evlist_cpu_map_nr; ++ /** The current CPU of the iterator. */ ++ int cpu; ++ /** If present, used to set the affinity when switching between CPUs. */ ++ struct affinity *affinity; ++}; ++ ++/** ++ * evlist__for_each_cpu - without affinity, iterate over the evlist. With ++ * affinity, iterate over all CPUs and then the evlist ++ * for each evsel on that CPU. When switching between ++ * CPUs the affinity is set to the CPU to avoid IPIs ++ * during syscalls. ++ * @evlist_cpu_itr: the iterator instance. ++ * @evlist: evlist instance to iterate. ++ * @affinity: NULL or used to set the affinity to the current CPU. ++ */ ++#define evlist__for_each_cpu(evlist_cpu_itr, evlist, affinity) \ ++ for ((evlist_cpu_itr) = evlist__cpu_begin(evlist, affinity); \ ++ !evlist_cpu_iterator__end(&evlist_cpu_itr); \ ++ evlist_cpu_iterator__next(&evlist_cpu_itr)) ++ ++/** Returns an iterator set to the first CPU/evsel of evlist. */ ++struct evlist_cpu_iterator evlist__cpu_begin(struct evlist *evlist, struct affinity *affinity); ++/** Move to next element in iterator, updating CPU, evsel and the affinity. */ ++void evlist_cpu_iterator__next(struct evlist_cpu_iterator *evlist_cpu_itr); ++/** Returns true when iterator is at the end of the CPUs and evlist. */ ++bool evlist_cpu_iterator__end(const struct evlist_cpu_iterator *evlist_cpu_itr); + + struct evsel *evlist__get_tracking_event(struct evlist *evlist); + void evlist__set_tracking_event(struct evlist *evlist, struct evsel *tracking_evsel); + +-void evlist__cpu_iter_start(struct evlist *evlist); +-bool evsel__cpu_iter_skip(struct evsel *ev, int cpu); +-bool evsel__cpu_iter_skip_no_inc(struct evsel *ev, int cpu); +- + struct evsel *evlist__find_evsel_by_str(struct evlist *evlist, const char *str); + + struct evsel *evlist__event2evsel(struct evlist *evlist, union perf_event *event); +diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h +index 1f7edfa8568a6..9372ddd369ef4 100644 +--- a/tools/perf/util/evsel.h ++++ b/tools/perf/util/evsel.h +@@ -119,7 +119,6 @@ struct evsel { + bool errored; + struct hashmap *per_pkg_mask; + int err; +- int cpu_iter; + struct { + evsel__sb_cb_t *cb; + void *data; +-- +2.39.2 + diff --git a/queue-5.15/perf-map-delete-two-variable-initialisations-before-.patch b/queue-5.15/perf-map-delete-two-variable-initialisations-before-.patch new file mode 100644 index 00000000000..e690d6536ff --- /dev/null +++ b/queue-5.15/perf-map-delete-two-variable-initialisations-before-.patch @@ -0,0 +1,60 @@ +From 5a9792dfb7af7b786b1fc585baaa7e144b1ba722 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 14:46:39 +0200 +Subject: perf map: Delete two variable initialisations before null pointer + checks in sort__sym_from_cmp() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Markus Elfring + +[ Upstream commit c160118a90d4acf335993d8d59b02ae2147a524e ] + +Addresses of two data structure members were determined before +corresponding null pointer checks in the implementation of the function +“sort__sym_from_cmp”. + +Thus avoid the risk for undefined behaviour by removing extra +initialisations for the local variables “from_l” and “from_r” (also +because they were already reassigned with the same value behind this +pointer check). + +This issue was detected by using the Coccinelle software. + +Fixes: 1b9e97a2a95e4941 ("perf tools: Fix report -F symbol_from for data without branch info") +Signed-off-by: +Acked-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: German Gomez +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Link: https://lore.kernel.org/cocci/54a21fea-64e3-de67-82ef-d61b90ffad05@web.de/ +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/sort.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c +index a111065b484ef..a4f2ffe2bdb6d 100644 +--- a/tools/perf/util/sort.c ++++ b/tools/perf/util/sort.c +@@ -876,8 +876,7 @@ static int hist_entry__dso_to_filter(struct hist_entry *he, int type, + static int64_t + sort__sym_from_cmp(struct hist_entry *left, struct hist_entry *right) + { +- struct addr_map_symbol *from_l = &left->branch_info->from; +- struct addr_map_symbol *from_r = &right->branch_info->from; ++ struct addr_map_symbol *from_l, *from_r; + + if (!left->branch_info || !right->branch_info) + return cmp_null(left->branch_info, right->branch_info); +-- +2.39.2 + diff --git a/queue-5.15/perf-pmu-zfree-expects-a-pointer-to-a-pointer-to-zer.patch b/queue-5.15/perf-pmu-zfree-expects-a-pointer-to-a-pointer-to-zer.patch new file mode 100644 index 00000000000..1186b6188d3 --- /dev/null +++ b/queue-5.15/perf-pmu-zfree-expects-a-pointer-to-a-pointer-to-zer.patch @@ -0,0 +1,35 @@ +From 146096a480fad9aef4cb2926493d42447241c0dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 10:23:35 -0300 +Subject: perf pmu: zfree() expects a pointer to a pointer to zero it after + freeing its contents + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 57f14b5ae1a97537f2abd2828ee7212cada7036e ] + +An audit showed just this one problem with zfree(), fix it. + +Fixes: 9fbc61f832ebf432 ("perf pmu: Add support for PMU capabilities") +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/pmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c +index 26c0b88cef4c8..eafd80be66076 100644 +--- a/tools/perf/util/pmu.c ++++ b/tools/perf/util/pmu.c +@@ -1858,7 +1858,7 @@ static int perf_pmu__new_caps(struct list_head *list, char *name, char *value) + return 0; + + free_name: +- zfree(caps->name); ++ zfree(&caps->name); + free_caps: + free(caps); + +-- +2.39.2 + diff --git a/queue-5.15/perf-scripts-intel-pt-events.py-fix-ipc-output-for-p.patch b/queue-5.15/perf-scripts-intel-pt-events.py-fix-ipc-output-for-p.patch new file mode 100644 index 00000000000..b7082eec8d1 --- /dev/null +++ b/queue-5.15/perf-scripts-intel-pt-events.py-fix-ipc-output-for-p.patch @@ -0,0 +1,40 @@ +From 387ca8a12997e96632ca2b4d3cf3fc37205e1a22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 15:04:45 +0000 +Subject: perf scripts intel-pt-events.py: Fix IPC output for Python 2 + +From: Roman Lozko + +[ Upstream commit 1f64cfdebfe0494264271e8d7a3a47faf5f58ec7 ] + +Integers are not converted to floats during division in Python 2 which +results in incorrect IPC values. Fix by switching to new division +behavior. + +Fixes: a483e64c0b62e93a ("perf scripting python: intel-pt-events.py: Add --insn-trace and --src-trace") +Signed-off-by: Roman Lozko +Acked-by: Adrian Hunter +Cc: Adrian Hunter +Link: https://lore.kernel.org/r/20230310150445.2925841-1-lozko.roma@gmail.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/scripts/python/intel-pt-events.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/scripts/python/intel-pt-events.py b/tools/perf/scripts/python/intel-pt-events.py +index 66452a8ec3586..ed6f614f2724d 100644 +--- a/tools/perf/scripts/python/intel-pt-events.py ++++ b/tools/perf/scripts/python/intel-pt-events.py +@@ -11,7 +11,7 @@ + # FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + # more details. + +-from __future__ import print_function ++from __future__ import division, print_function + + import os + import sys +-- +2.39.2 + diff --git a/queue-5.15/perf-stat-separate-bperf-from-bpf_profiler.patch b/queue-5.15/perf-stat-separate-bperf-from-bpf_profiler.patch new file mode 100644 index 00000000000..29a9c78b6be --- /dev/null +++ b/queue-5.15/perf-stat-separate-bperf-from-bpf_profiler.patch @@ -0,0 +1,103 @@ +From cc56ef3b9dde3f42072bae0ec020eaa7be91442b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 20:23:16 +0200 +Subject: perf stat: Separate bperf from bpf_profiler + +From: Dmitrii Dolgov <9erthalion6@gmail.com> + +[ Upstream commit ecc68ee216c6c5b2f84915e1441adf436f1b019b ] + +It seems that perf stat -b doesn't produce any results: + + $ perf stat -e cycles -b 4 -I 10000 -vvv + Control descriptor is not initialized + cycles: 0 0 0 + time counts unit events + 10.007641640 cycles + +Looks like this happens because fentry/fexit progs are getting loaded, but the +corresponding perf event is not enabled and not added into the events bpf map. +I think there is some mixing up between two type of bpf support, one for bperf +and one for bpf_profiler. Both are identified via evsel__is_bpf, based on which +perf events are enabled, but for the latter (bpf_profiler) a perf event is +required. Using evsel__is_bperf to check only bperf produces expected results: + + $ perf stat -e cycles -b 4 -I 10000 -vvv + Control descriptor is not initialized + ------------------------------------------------------------ + perf_event_attr: + size 136 + sample_type IDENTIFIER + read_format TOTAL_TIME_ENABLED|TOTAL_TIME_RUNNING + disabled 1 + exclude_guest 1 + ------------------------------------------------------------ + sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 3 + ------------------------------------------------------------ + [...perf_event_attr for other CPUs...] + ------------------------------------------------------------ + cycles: 309426 169009 169009 + time counts unit events + 10.010091271 309426 cycles + +The final numbers correspond (at least in the level of magnitude) to the +same metric obtained via bpftool. + +Fixes: 112cb56164bc2108 ("perf stat: Introduce config stat.bpf-counter-events") +Reviewed-by: Song Liu +Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com> +Tested-by: Song Liu +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Song Liu +Link: https://lore.kernel.org/r/20230412182316.11628-1-9erthalion6@gmail.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-stat.c | 4 ++-- + tools/perf/util/evsel.h | 5 +++++ + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c +index 4ccd0c7c13ea1..efae2998a472f 100644 +--- a/tools/perf/builtin-stat.c ++++ b/tools/perf/builtin-stat.c +@@ -791,7 +791,7 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx) + counter->reset_group = false; + if (bpf_counter__load(counter, &target)) + return -1; +- if (!evsel__is_bpf(counter)) ++ if (!(evsel__is_bperf(counter))) + all_counters_use_bpf = false; + } + +@@ -807,7 +807,7 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx) + + if (counter->reset_group || counter->errored) + continue; +- if (evsel__is_bpf(counter)) ++ if (evsel__is_bperf(counter)) + continue; + try_again: + if (create_perf_stat_counter(counter, &stat_config, &target, +diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h +index 9372ddd369ef4..0492cafac4430 100644 +--- a/tools/perf/util/evsel.h ++++ b/tools/perf/util/evsel.h +@@ -248,6 +248,11 @@ static inline bool evsel__is_bpf(struct evsel *evsel) + return evsel->bpf_counter_ops != NULL; + } + ++static inline bool evsel__is_bperf(struct evsel *evsel) ++{ ++ return evsel->bpf_counter_ops != NULL && list_empty(&evsel->bpf_counter_list); ++} ++ + #define EVSEL__MAX_ALIASES 8 + + extern const char *evsel__hw_cache[PERF_COUNT_HW_CACHE_MAX][EVSEL__MAX_ALIASES]; +-- +2.39.2 + diff --git a/queue-5.15/perf-symbols-fix-return-incorrect-build_id-size-in-e.patch b/queue-5.15/perf-symbols-fix-return-incorrect-build_id-size-in-e.patch new file mode 100644 index 00000000000..72b29ef45ee --- /dev/null +++ b/queue-5.15/perf-symbols-fix-return-incorrect-build_id-size-in-e.patch @@ -0,0 +1,52 @@ +From d3e8674f2980c5c300ac8860d3ab79c8ac26ec55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 01:28:41 +0000 +Subject: perf symbols: Fix return incorrect build_id size in + elf_read_build_id() + +From: Yang Jihong + +[ Upstream commit 1511e4696acb715a4fe48be89e1e691daec91c0e ] + +In elf_read_build_id(), if gnu build_id is found, should return the size of +the actually copied data. If descsz is greater thanBuild_ID_SIZE, +write_buildid data access may occur. + +Fixes: be96ea8ffa788dcc ("perf symbols: Fix issue with binaries using 16-bytes buildids (v2)") +Reported-by: Will Ochowicz +Signed-off-by: Yang Jihong +Tested-by: Will Ochowicz +Acked-by: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Leo Yan +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: https://lore.kernel.org/lkml/CWLP265MB49702F7BA3D6D8F13E4B1A719C649@CWLP265MB4970.GBRP265.PROD.OUTLOOK.COM/T/ +Link: https://lore.kernel.org/r/20230427012841.231729-1-yangjihong1@huawei.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/symbol-elf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c +index fd42f768e5848..bbc3a150597a4 100644 +--- a/tools/perf/util/symbol-elf.c ++++ b/tools/perf/util/symbol-elf.c +@@ -553,7 +553,7 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size) + size_t sz = min(size, descsz); + memcpy(bf, ptr, sz); + memset(bf + sz, 0, size - sz); +- err = descsz; ++ err = sz; + break; + } + } +-- +2.39.2 + diff --git a/queue-5.15/perf-vendor-events-power9-remove-utf-8-characters-fr.patch b/queue-5.15/perf-vendor-events-power9-remove-utf-8-characters-fr.patch new file mode 100644 index 00000000000..b5606ddeb95 --- /dev/null +++ b/queue-5.15/perf-vendor-events-power9-remove-utf-8-characters-fr.patch @@ -0,0 +1,108 @@ +From 394719eb6ef944760bae3858a7b256afc61d7fbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 16:59:08 +0530 +Subject: perf vendor events power9: Remove UTF-8 characters from JSON files + +From: Kajol Jain + +[ Upstream commit 5d9df8731c0941f3add30f96745a62586a0c9d52 ] + +Commit 3c22ba5243040c13 ("perf vendor events powerpc: Update POWER9 +events") added and updated power9 PMU JSON events. However some of the +JSON events which are part of other.json and pipeline.json files, +contains UTF-8 characters in their brief description. Having UTF-8 +character could breaks the perf build on some distros. + +Fix this issue by removing the UTF-8 characters from other.json and +pipeline.json files. + +Result without the fix: + + [command]# file -i pmu-events/arch/powerpc/power9/* + pmu-events/arch/powerpc/power9/cache.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/floating-point.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/frontend.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/marked.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/memory.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/metrics.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/nest_metrics.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/other.json: application/json; charset=utf-8 + pmu-events/arch/powerpc/power9/pipeline.json: application/json; charset=utf-8 + pmu-events/arch/powerpc/power9/pmc.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/translation.json: application/json; charset=us-ascii + [command]# + +Result with the fix: + + [command]# file -i pmu-events/arch/powerpc/power9/* + pmu-events/arch/powerpc/power9/cache.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/floating-point.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/frontend.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/marked.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/memory.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/metrics.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/nest_metrics.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/other.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/pipeline.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/pmc.json: application/json; charset=us-ascii + pmu-events/arch/powerpc/power9/translation.json: application/json; charset=us-ascii + [command]# + +Fixes: 3c22ba5243040c13 ("perf vendor events powerpc: Update POWER9 events") +Reported-by: Arnaldo Carvalho de Melo +Signed-off-by: Kajol Jain +Acked-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Athira Rajeev +Cc: Disha Goel +Cc: Jiri Olsa +Cc: Madhavan Srinivasan +Cc: Sukadev Bhattiprolu +Cc: linuxppc-dev@lists.ozlabs.org +Link: https://lore.kernel.org/lkml/ZBxP77deq7ikTxwG@kernel.org/ +Link: https://lore.kernel.org/r/20230328112908.113158-1-kjain@linux.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/pmu-events/arch/powerpc/power9/other.json | 4 ++-- + tools/perf/pmu-events/arch/powerpc/power9/pipeline.json | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/pmu-events/arch/powerpc/power9/other.json b/tools/perf/pmu-events/arch/powerpc/power9/other.json +index 3f69422c21f99..f10bd554521a0 100644 +--- a/tools/perf/pmu-events/arch/powerpc/power9/other.json ++++ b/tools/perf/pmu-events/arch/powerpc/power9/other.json +@@ -1417,7 +1417,7 @@ + { + "EventCode": "0x45054", + "EventName": "PM_FMA_CMPL", +- "BriefDescription": "two flops operation completed (fmadd, fnmadd, fmsub, fnmsub) Scalar instructions only. " ++ "BriefDescription": "two flops operation completed (fmadd, fnmadd, fmsub, fnmsub) Scalar instructions only." + }, + { + "EventCode": "0x201E8", +@@ -2017,7 +2017,7 @@ + { + "EventCode": "0xC0BC", + "EventName": "PM_LSU_FLUSH_OTHER", +- "BriefDescription": "Other LSU flushes including: Sync (sync ack from L2 caused search of LRQ for oldest snooped load, This will either signal a Precise Flush of the oldest snooped loa or a Flush Next PPC); Data Valid Flush Next (several cases of this, one example is store and reload are lined up such that a store-hit-reload scenario exists and the CDF has already launched and has gotten bad/stale data); Bad Data Valid Flush Next (might be a few cases of this, one example is a larxa (D$ hit) return data and dval but can't allocate to LMQ (LMQ full or other reason). Already gave dval but can't watch it for snoop_hit_larx. Need to take the “bad dval” back and flush all younger ops)" ++ "BriefDescription": "Other LSU flushes including: Sync (sync ack from L2 caused search of LRQ for oldest snooped load, This will either signal a Precise Flush of the oldest snooped loa or a Flush Next PPC); Data Valid Flush Next (several cases of this, one example is store and reload are lined up such that a store-hit-reload scenario exists and the CDF has already launched and has gotten bad/stale data); Bad Data Valid Flush Next (might be a few cases of this, one example is a larxa (D$ hit) return data and dval but can't allocate to LMQ (LMQ full or other reason). Already gave dval but can't watch it for snoop_hit_larx. Need to take the 'bad dval' back and flush all younger ops)" + }, + { + "EventCode": "0x5094", +diff --git a/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json b/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json +index d0265f255de2b..723bffa41c448 100644 +--- a/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json ++++ b/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json +@@ -442,7 +442,7 @@ + { + "EventCode": "0x4D052", + "EventName": "PM_2FLOP_CMPL", +- "BriefDescription": "DP vector version of fmul, fsub, fcmp, fsel, fabs, fnabs, fres ,fsqrte, fneg " ++ "BriefDescription": "DP vector version of fmul, fsub, fcmp, fsel, fabs, fnabs, fres ,fsqrte, fneg" + }, + { + "EventCode": "0x1F142", +-- +2.39.2 + diff --git a/queue-5.15/r8152-fix-flow-control-issue-of-rtl8156a.patch b/queue-5.15/r8152-fix-flow-control-issue-of-rtl8156a.patch new file mode 100644 index 00000000000..bcd21ca67bd --- /dev/null +++ b/queue-5.15/r8152-fix-flow-control-issue-of-rtl8156a.patch @@ -0,0 +1,129 @@ +From 555ba405235e330a7761b2204bdcc42cc975e851 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Apr 2023 16:53:29 +0800 +Subject: r8152: fix flow control issue of RTL8156A + +From: Hayes Wang + +[ Upstream commit 8ceda6d5a1e5402fd852e6cc59a286ce3dc545ee ] + +The feature of flow control becomes abnormal, if the device sends a +pause frame and the tx/rx is disabled before sending a release frame. It +causes the lost of packets. + +Set PLA_RX_FIFO_FULL and PLA_RX_FIFO_EMPTY to zeros before disabling the +tx/rx. And, toggle FC_PATCH_TASK before enabling tx/rx to reset the flow +control patch and timer. Then, the hardware could clear the state and +the flow control becomes normal after enabling tx/rx. + +Besides, remove inline for fc_pause_on_auto() and fc_pause_off_auto(). + +Fixes: 195aae321c82 ("r8152: support new chips") +Signed-off-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 56 ++++++++++++++++++++++++++--------------- + 1 file changed, 36 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index cf6941b1d2800..1c45f5dd0be4c 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -5979,6 +5979,25 @@ static void rtl8153_disable(struct r8152 *tp) + r8153_aldps_en(tp, true); + } + ++static u32 fc_pause_on_auto(struct r8152 *tp) ++{ ++ return (ALIGN(mtu_to_size(tp->netdev->mtu), 1024) + 6 * 1024); ++} ++ ++static u32 fc_pause_off_auto(struct r8152 *tp) ++{ ++ return (ALIGN(mtu_to_size(tp->netdev->mtu), 1024) + 14 * 1024); ++} ++ ++static void r8156_fc_parameter(struct r8152 *tp) ++{ ++ u32 pause_on = tp->fc_pause_on ? tp->fc_pause_on : fc_pause_on_auto(tp); ++ u32 pause_off = tp->fc_pause_off ? tp->fc_pause_off : fc_pause_off_auto(tp); ++ ++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_RX_FIFO_FULL, pause_on / 16); ++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_RX_FIFO_EMPTY, pause_off / 16); ++} ++ + static int rtl8156_enable(struct r8152 *tp) + { + u32 ocp_data; +@@ -5987,6 +6006,7 @@ static int rtl8156_enable(struct r8152 *tp) + if (test_bit(RTL8152_UNPLUG, &tp->flags)) + return -ENODEV; + ++ r8156_fc_parameter(tp); + set_tx_qlen(tp); + rtl_set_eee_plus(tp); + r8153_set_rx_early_timeout(tp); +@@ -6018,9 +6038,24 @@ static int rtl8156_enable(struct r8152 *tp) + ocp_write_word(tp, MCU_TYPE_USB, USB_L1_CTRL, ocp_data); + } + ++ ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_FW_TASK); ++ ocp_data &= ~FC_PATCH_TASK; ++ ocp_write_word(tp, MCU_TYPE_USB, USB_FW_TASK, ocp_data); ++ usleep_range(1000, 2000); ++ ocp_data |= FC_PATCH_TASK; ++ ocp_write_word(tp, MCU_TYPE_USB, USB_FW_TASK, ocp_data); ++ + return rtl_enable(tp); + } + ++static void rtl8156_disable(struct r8152 *tp) ++{ ++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_RX_FIFO_FULL, 0); ++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_RX_FIFO_EMPTY, 0); ++ ++ rtl8153_disable(tp); ++} ++ + static int rtl8156b_enable(struct r8152 *tp) + { + u32 ocp_data; +@@ -6422,25 +6457,6 @@ static void rtl8153c_up(struct r8152 *tp) + r8153b_u1u2en(tp, true); + } + +-static inline u32 fc_pause_on_auto(struct r8152 *tp) +-{ +- return (ALIGN(mtu_to_size(tp->netdev->mtu), 1024) + 6 * 1024); +-} +- +-static inline u32 fc_pause_off_auto(struct r8152 *tp) +-{ +- return (ALIGN(mtu_to_size(tp->netdev->mtu), 1024) + 14 * 1024); +-} +- +-static void r8156_fc_parameter(struct r8152 *tp) +-{ +- u32 pause_on = tp->fc_pause_on ? tp->fc_pause_on : fc_pause_on_auto(tp); +- u32 pause_off = tp->fc_pause_off ? tp->fc_pause_off : fc_pause_off_auto(tp); +- +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_RX_FIFO_FULL, pause_on / 16); +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_RX_FIFO_EMPTY, pause_off / 16); +-} +- + static void rtl8156_change_mtu(struct r8152 *tp) + { + u32 rx_max_size = mtu_to_size(tp->netdev->mtu); +@@ -9366,7 +9382,7 @@ static int rtl_ops_init(struct r8152 *tp) + case RTL_VER_10: + ops->init = r8156_init; + ops->enable = rtl8156_enable; +- ops->disable = rtl8153_disable; ++ ops->disable = rtl8156_disable; + ops->up = rtl8156_up; + ops->down = rtl8156_down; + ops->unload = rtl8153_unload; +-- +2.39.2 + diff --git a/queue-5.15/r8152-fix-the-poor-throughput-for-2.5g-devices.patch b/queue-5.15/r8152-fix-the-poor-throughput-for-2.5g-devices.patch new file mode 100644 index 00000000000..eeaa6a67731 --- /dev/null +++ b/queue-5.15/r8152-fix-the-poor-throughput-for-2.5g-devices.patch @@ -0,0 +1,71 @@ +From 2f09078ceb355ea3388403bdd2cf8e94bbeca5ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Apr 2023 16:53:30 +0800 +Subject: r8152: fix the poor throughput for 2.5G devices + +From: Hayes Wang + +[ Upstream commit 61b0ad6f58e2066e054c6d4839d67974d2861a7d ] + +Fix the poor throughput for 2.5G devices, when changing the speed from +auto mode to force mode. This patch is used to notify the MAC when the +mode is changed. + +Fixes: 195aae321c82 ("r8152: support new chips") +Signed-off-by: Hayes Wang +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 1c45f5dd0be4c..b0e1ef97c4951 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -199,6 +199,7 @@ + #define OCP_EEE_AR 0xa41a + #define OCP_EEE_DATA 0xa41c + #define OCP_PHY_STATUS 0xa420 ++#define OCP_INTR_EN 0xa424 + #define OCP_NCTL_CFG 0xa42c + #define OCP_POWER_CFG 0xa430 + #define OCP_EEE_CFG 0xa432 +@@ -620,6 +621,9 @@ enum spd_duplex { + #define PHY_STAT_LAN_ON 3 + #define PHY_STAT_PWRDN 5 + ++/* OCP_INTR_EN */ ++#define INTR_SPEED_FORCE BIT(3) ++ + /* OCP_NCTL_CFG */ + #define PGA_RETURN_EN BIT(1) + +@@ -7547,6 +7551,11 @@ static void r8156_hw_phy_cfg(struct r8152 *tp) + ((swap_a & 0x1f) << 8) | + ((swap_a >> 8) & 0x1f)); + } ++ ++ /* Notify the MAC when the speed is changed to force mode. */ ++ data = ocp_reg_read(tp, OCP_INTR_EN); ++ data |= INTR_SPEED_FORCE; ++ ocp_reg_write(tp, OCP_INTR_EN, data); + break; + default: + break; +@@ -7942,6 +7951,11 @@ static void r8156b_hw_phy_cfg(struct r8152 *tp) + break; + } + ++ /* Notify the MAC when the speed is changed to force mode. */ ++ data = ocp_reg_read(tp, OCP_INTR_EN); ++ data |= INTR_SPEED_FORCE; ++ ocp_reg_write(tp, OCP_INTR_EN, data); ++ + if (rtl_phy_patch_request(tp, true, true)) + return; + +-- +2.39.2 + diff --git a/queue-5.15/r8152-move-setting-r8153b_rx_agg_chg_indicate.patch b/queue-5.15/r8152-move-setting-r8153b_rx_agg_chg_indicate.patch new file mode 100644 index 00000000000..0a4f7a5bb09 --- /dev/null +++ b/queue-5.15/r8152-move-setting-r8153b_rx_agg_chg_indicate.patch @@ -0,0 +1,65 @@ +From b745b4b81ca173847e116c797cd40429ee3ae919 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Apr 2023 16:53:31 +0800 +Subject: r8152: move setting r8153b_rx_agg_chg_indicate() + +From: Hayes Wang + +[ Upstream commit cce8334f4aacd9936309a002d4a4de92a07cd2c2 ] + +Move setting r8153b_rx_agg_chg_indicate() for 2.5G devices. The +r8153b_rx_agg_chg_indicate() has to be called after enabling tx/rx. +Otherwise, the coalescing settings are useless. + +Fixes: 195aae321c82 ("r8152: support new chips") +Signed-off-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index b0e1ef97c4951..579524cb5d9b2 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -3020,12 +3020,16 @@ static int rtl_enable(struct r8152 *tp) + ocp_write_byte(tp, MCU_TYPE_PLA, PLA_CR, ocp_data); + + switch (tp->version) { +- case RTL_VER_08: +- case RTL_VER_09: +- case RTL_VER_14: +- r8153b_rx_agg_chg_indicate(tp); ++ case RTL_VER_01: ++ case RTL_VER_02: ++ case RTL_VER_03: ++ case RTL_VER_04: ++ case RTL_VER_05: ++ case RTL_VER_06: ++ case RTL_VER_07: + break; + default: ++ r8153b_rx_agg_chg_indicate(tp); + break; + } + +@@ -3079,7 +3083,6 @@ static void r8153_set_rx_early_timeout(struct r8152 *tp) + 640 / 8); + ocp_write_word(tp, MCU_TYPE_USB, USB_RX_EXTRA_AGGR_TMR, + ocp_data); +- r8153b_rx_agg_chg_indicate(tp); + break; + + default: +@@ -3113,7 +3116,6 @@ static void r8153_set_rx_early_size(struct r8152 *tp) + case RTL_VER_15: + ocp_write_word(tp, MCU_TYPE_USB, USB_RX_EARLY_SIZE, + ocp_data / 8); +- r8153b_rx_agg_chg_indicate(tp); + break; + default: + WARN_ON_ONCE(1); +-- +2.39.2 + diff --git a/queue-5.15/risc-v-mm-enable-huge-page-support-to-kernel_page_pr.patch b/queue-5.15/risc-v-mm-enable-huge-page-support-to-kernel_page_pr.patch new file mode 100644 index 00000000000..a4fca7efdd3 --- /dev/null +++ b/queue-5.15/risc-v-mm-enable-huge-page-support-to-kernel_page_pr.patch @@ -0,0 +1,63 @@ +From f79e0573ddb01b3139d3e923881d25828e3ffa5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 14:43:20 +0800 +Subject: RISC-V: mm: Enable huge page support to kernel_page_present() + function + +From: Sia Jee Heng + +[ Upstream commit a15c90b67a662c75f469822a7f95c7aaa049e28f ] + +Currently kernel_page_present() function doesn't support huge page +detection causes the function to mistakenly return false to the +hibernation core. + +Add huge page detection to the function to solve the problem. + +Fixes: 9e953cda5cdf ("riscv: Introduce huge page support for 32/64bit kernel") +Signed-off-by: Sia Jee Heng +Reviewed-by: Ley Foon Tan +Reviewed-by: Mason Huo +Reviewed-by: Andrew Jones +Reviewed-by: Alexandre Ghiti +Link: https://lore.kernel.org/r/20230330064321.1008373-4-jeeheng.sia@starfivetech.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/mm/pageattr.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c +index 86c56616e5dea..ea3d61de065b3 100644 +--- a/arch/riscv/mm/pageattr.c ++++ b/arch/riscv/mm/pageattr.c +@@ -217,18 +217,26 @@ bool kernel_page_present(struct page *page) + pgd = pgd_offset_k(addr); + if (!pgd_present(*pgd)) + return false; ++ if (pgd_leaf(*pgd)) ++ return true; + + p4d = p4d_offset(pgd, addr); + if (!p4d_present(*p4d)) + return false; ++ if (p4d_leaf(*p4d)) ++ return true; + + pud = pud_offset(p4d, addr); + if (!pud_present(*pud)) + return false; ++ if (pud_leaf(*pud)) ++ return true; + + pmd = pmd_offset(pud, addr); + if (!pmd_present(*pmd)) + return false; ++ if (pmd_leaf(*pmd)) ++ return true; + + pte = pte_offset_kernel(pmd, addr); + return pte_present(*pte); +-- +2.39.2 + diff --git a/queue-5.15/rxrpc-fix-hard-call-timeout-units.patch b/queue-5.15/rxrpc-fix-hard-call-timeout-units.patch new file mode 100644 index 00000000000..cb6569fd7ff --- /dev/null +++ b/queue-5.15/rxrpc-fix-hard-call-timeout-units.patch @@ -0,0 +1,45 @@ +From 7e9adba4e5c0e2478cb94c37fe0a84eb8c0e69bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Apr 2023 21:27:54 +0100 +Subject: rxrpc: Fix hard call timeout units + +From: David Howells + +[ Upstream commit 0d098d83c5d9e107b2df7f5e11f81492f56d2fe7 ] + +The hard call timeout is specified in the RXRPC_SET_CALL_TIMEOUT cmsg in +seconds, so fix the point at which sendmsg() applies it to the call to +convert to jiffies from seconds, not milliseconds. + +Fixes: a158bdd3247b ("rxrpc: Fix timeout of a call that hasn't yet been granted a channel") +Signed-off-by: David Howells +cc: Marc Dionne +cc: "David S. Miller" +cc: Eric Dumazet +cc: Jakub Kicinski +cc: Paolo Abeni +cc: linux-afs@lists.infradead.org +cc: netdev@vger.kernel.org +cc: linux-kernel@vger.kernel.org +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rxrpc/sendmsg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c +index d4e4e94f4f987..71e40f91dd398 100644 +--- a/net/rxrpc/sendmsg.c ++++ b/net/rxrpc/sendmsg.c +@@ -736,7 +736,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len) + fallthrough; + case 1: + if (p.call.timeouts.hard > 0) { +- j = msecs_to_jiffies(p.call.timeouts.hard); ++ j = p.call.timeouts.hard * HZ; + now = jiffies; + j += now; + WRITE_ONCE(call->expect_term_by, j); +-- +2.39.2 + diff --git a/queue-5.15/scsi-qedi-fix-use-after-free-bug-in-qedi_remove.patch b/queue-5.15/scsi-qedi-fix-use-after-free-bug-in-qedi_remove.patch new file mode 100644 index 00000000000..29569b76ed8 --- /dev/null +++ b/queue-5.15/scsi-qedi-fix-use-after-free-bug-in-qedi_remove.patch @@ -0,0 +1,62 @@ +From f839d25d61010b8eeea4976867fc6672010d61d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 11:34:22 +0800 +Subject: scsi: qedi: Fix use after free bug in qedi_remove() + +From: Zheng Wang + +[ Upstream commit c5749639f2d0a1f6cbe187d05f70c2e7c544d748 ] + +In qedi_probe() we call __qedi_probe() which initializes +&qedi->recovery_work with qedi_recovery_handler() and +&qedi->board_disable_work with qedi_board_disable_work(). + +When qedi_schedule_recovery_handler() is called, schedule_delayed_work() +will finally start the work. + +In qedi_remove(), which is called to remove the driver, the following +sequence may be observed: + +Fix this by finishing the work before cleanup in qedi_remove(). + +CPU0 CPU1 + + |qedi_recovery_handler +qedi_remove | + __qedi_remove | +iscsi_host_free | +scsi_host_put | +//free shost | + |iscsi_host_for_each_session + |//use qedi->shost + +Cancel recovery_work and board_disable_work in __qedi_remove(). + +Fixes: 4b1068f5d74b ("scsi: qedi: Add MFW error recovery process") +Signed-off-by: Zheng Wang +Link: https://lore.kernel.org/r/20230413033422.28003-1-zyytlz.wz@163.com +Acked-by: Manish Rangankar +Reviewed-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedi/qedi_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c +index a117d11f2b078..e0096fc5927e7 100644 +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -2455,6 +2455,9 @@ static void __qedi_remove(struct pci_dev *pdev, int mode) + qedi_ops->ll2->stop(qedi->cdev); + } + ++ cancel_delayed_work_sync(&qedi->recovery_work); ++ cancel_delayed_work_sync(&qedi->board_disable_work); ++ + qedi_free_iscsi_pf_param(qedi); + + rval = qedi_ops->common->update_drv_state(qedi->cdev, false); +-- +2.39.2 + diff --git a/queue-5.15/selftests-srv6-make-srv6_end_dt46_l3vpn_test-more-ro.patch b/queue-5.15/selftests-srv6-make-srv6_end_dt46_l3vpn_test-more-ro.patch new file mode 100644 index 00000000000..d999c30627f --- /dev/null +++ b/queue-5.15/selftests-srv6-make-srv6_end_dt46_l3vpn_test-more-ro.patch @@ -0,0 +1,61 @@ +From b33dce1ee584630ab5eca059ce865ff5d6f5f681 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 11:49:23 +0200 +Subject: selftests: srv6: make srv6_end_dt46_l3vpn_test more robust + +From: Andrea Mayer + +[ Upstream commit 46ef24c60f8ee70662968ac55325297ed4624d61 ] + +On some distributions, the rp_filter is automatically set (=1) by +default on a netdev basis (also on VRFs). +In an SRv6 End.DT46 behavior, decapsulated IPv4 packets are routed using +the table associated with the VRF bound to that tunnel. During lookup +operations, the rp_filter can lead to packet loss when activated on the +VRF. +Therefore, we chose to make this selftest more robust by explicitly +disabling the rp_filter during tests (as it is automatically set by some +Linux distributions). + +Fixes: 03a0b567a03d ("selftests: seg6: add selftest for SRv6 End.DT46 Behavior") +Reported-by: Hangbin Liu +Signed-off-by: Andrea Mayer +Tested-by: Hangbin Liu +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../testing/selftests/net/srv6_end_dt46_l3vpn_test.sh | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh b/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh +index aebaab8ce44cb..441eededa0312 100755 +--- a/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh ++++ b/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh +@@ -292,6 +292,11 @@ setup_hs() + ip netns exec ${hsname} sysctl -wq net.ipv6.conf.all.accept_dad=0 + ip netns exec ${hsname} sysctl -wq net.ipv6.conf.default.accept_dad=0 + ++ # disable the rp_filter otherwise the kernel gets confused about how ++ # to route decap ipv4 packets. ++ ip netns exec ${rtname} sysctl -wq net.ipv4.conf.all.rp_filter=0 ++ ip netns exec ${rtname} sysctl -wq net.ipv4.conf.default.rp_filter=0 ++ + ip -netns ${hsname} link add veth0 type veth peer name ${rtveth} + ip -netns ${hsname} link set ${rtveth} netns ${rtname} + ip -netns ${hsname} addr add ${IPv6_HS_NETWORK}::${hs}/64 dev veth0 nodad +@@ -316,11 +321,6 @@ setup_hs() + ip netns exec ${rtname} sysctl -wq net.ipv6.conf.${rtveth}.proxy_ndp=1 + ip netns exec ${rtname} sysctl -wq net.ipv4.conf.${rtveth}.proxy_arp=1 + +- # disable the rp_filter otherwise the kernel gets confused about how +- # to route decap ipv4 packets. +- ip netns exec ${rtname} sysctl -wq net.ipv4.conf.all.rp_filter=0 +- ip netns exec ${rtname} sysctl -wq net.ipv4.conf.${rtveth}.rp_filter=0 +- + ip netns exec ${rtname} sh -c "echo 1 > /proc/sys/net/vrf/strict_mode" + } + +-- +2.39.2 + diff --git a/queue-5.15/series b/queue-5.15/series index f293965ad46..c882aafbe1d 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -16,3 +16,48 @@ asoc-soc-pcm-test-refcount-before-triggering.patch asoc-soc-pcm-fix-be-handling-of-pause_release.patch fs-ntfs3-fix-null-ptr-deref-on-inode-i_op-in-ntfs_lo.patch drm-hyperv-don-t-overwrite-dirt_needed-value-set-by-.patch +scsi-qedi-fix-use-after-free-bug-in-qedi_remove.patch +net-ncsi-clear-tx-enable-mode-when-handling-a-config.patch +net-sched-cls_api-remove-block_cb-from-driver_list-b.patch +sit-update-dev-needed_headroom-in-ipip6_tunnel_bind_.patch +selftests-srv6-make-srv6_end_dt46_l3vpn_test-more-ro.patch +net-dsa-mv88e6xxx-add-mv88e6321-rsvd2cpu.patch +writeback-fix-call-of-incorrect-macro.patch +watchdog-dw_wdt-fix-the-error-handling-path-of-dw_wd.patch +risc-v-mm-enable-huge-page-support-to-kernel_page_pr.patch +net-sched-act_mirred-add-carrier-check.patch +r8152-fix-flow-control-issue-of-rtl8156a.patch +r8152-fix-the-poor-throughput-for-2.5g-devices.patch +r8152-move-setting-r8153b_rx_agg_chg_indicate.patch +sfc-fix-module-eeprom-reporting-for-qsfp-modules.patch +rxrpc-fix-hard-call-timeout-units.patch +octeontx2-af-secure-apr-table-update-with-the-lock.patch +octeontx2-af-skip-pfs-if-not-enabled.patch +octeontx2-pf-disable-packet-i-o-for-graceful-exit.patch +octeontx2-vf-detach-lf-resources-on-probe-cleanup.patch +ionic-remove-noise-from-ethtool-rxnfc-error-msg.patch +ethtool-fix-uninitialized-number-of-lanes.patch +ionic-catch-failure-from-devlink_alloc.patch +af_packet-don-t-send-zero-byte-data-in-packet_sendms.patch +drm-amdgpu-add-a-missing-lock-for-amdgpu_sched.patch +alsa-caiaq-input-add-error-handling-for-unsupported-.patch +kvm-s390-pv-avoid-stalls-when-making-pages-secure.patch +kvm-s390-pv-add-export-before-import.patch +kvm-s390-fix-race-in-gmap_make_secure.patch +net-dsa-mt7530-fix-corrupt-frames-using-trgmii-on-40.patch +virtio_net-split-free_unused_bufs.patch +virtio_net-suppress-cpu-stall-when-free_unused_bufs.patch +net-enetc-check-the-index-of-the-sfi-rather-than-the.patch +net-bcmgenet-remove-phy_stop-from-bcmgenet_netif_sto.patch +perf-scripts-intel-pt-events.py-fix-ipc-output-for-p.patch +perf-vendor-events-power9-remove-utf-8-characters-fr.patch +perf-pmu-zfree-expects-a-pointer-to-a-pointer-to-zer.patch +perf-map-delete-two-variable-initialisations-before-.patch +crypto-sun8i-ss-fix-a-test-in-sun8i_ss_setup_ivs.patch +crypto-engine-check-if-bh-is-disabled-during-complet.patch +crypto-api-add-scaffolding-to-change-completion-func.patch +crypto-engine-use-crypto_request_complete.patch +crypto-engine-fix-crypto_queue-backlog-handling.patch +perf-symbols-fix-return-incorrect-build_id-size-in-e.patch +perf-evlist-refactor-evlist__for_each_cpu.patch +perf-stat-separate-bperf-from-bpf_profiler.patch diff --git a/queue-5.15/sfc-fix-module-eeprom-reporting-for-qsfp-modules.patch b/queue-5.15/sfc-fix-module-eeprom-reporting-for-qsfp-modules.patch new file mode 100644 index 00000000000..566b0e47b8b --- /dev/null +++ b/queue-5.15/sfc-fix-module-eeprom-reporting-for-qsfp-modules.patch @@ -0,0 +1,59 @@ +From 1e44b46524a70c5960bb0a60d21f066f4670207a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Apr 2023 12:33:33 +0100 +Subject: sfc: Fix module EEPROM reporting for QSFP modules + +From: Andy Moreton + +[ Upstream commit 281900a923d4c50df109b52a22ae3cdac150159b ] + +The sfc driver does not report QSFP module EEPROM contents correctly +as only the first page is fetched from hardware. + +Commit 0e1a2a3e6e7d ("ethtool: Add SFF-8436 and SFF-8636 max EEPROM +length definitions") added ETH_MODULE_SFF_8436_MAX_LEN for the overall +size of the EEPROM info, so use that to report the full EEPROM contents. + +Fixes: 9b17010da57a ("sfc: Add ethtool -m support for QSFP modules") +Signed-off-by: Andy Moreton +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/mcdi_port_common.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/mcdi_port_common.c b/drivers/net/ethernet/sfc/mcdi_port_common.c +index c4fe3c48ac46a..eccb97a5d9387 100644 +--- a/drivers/net/ethernet/sfc/mcdi_port_common.c ++++ b/drivers/net/ethernet/sfc/mcdi_port_common.c +@@ -974,12 +974,15 @@ static u32 efx_mcdi_phy_module_type(struct efx_nic *efx) + + /* A QSFP+ NIC may actually have an SFP+ module attached. + * The ID is page 0, byte 0. ++ * QSFP28 is of type SFF_8636, however, this is treated ++ * the same by ethtool, so we can also treat them the same. + */ + switch (efx_mcdi_phy_get_module_eeprom_byte(efx, 0, 0)) { +- case 0x3: ++ case 0x3: /* SFP */ + return MC_CMD_MEDIA_SFP_PLUS; +- case 0xc: +- case 0xd: ++ case 0xc: /* QSFP */ ++ case 0xd: /* QSFP+ */ ++ case 0x11: /* QSFP28 */ + return MC_CMD_MEDIA_QSFP_PLUS; + default: + return 0; +@@ -1077,7 +1080,7 @@ int efx_mcdi_phy_get_module_info(struct efx_nic *efx, struct ethtool_modinfo *mo + + case MC_CMD_MEDIA_QSFP_PLUS: + modinfo->type = ETH_MODULE_SFF_8436; +- modinfo->eeprom_len = ETH_MODULE_SFF_8436_LEN; ++ modinfo->eeprom_len = ETH_MODULE_SFF_8436_MAX_LEN; + break; + + default: +-- +2.39.2 + diff --git a/queue-5.15/sit-update-dev-needed_headroom-in-ipip6_tunnel_bind_.patch b/queue-5.15/sit-update-dev-needed_headroom-in-ipip6_tunnel_bind_.patch new file mode 100644 index 00000000000..cff08c973cf --- /dev/null +++ b/queue-5.15/sit-update-dev-needed_headroom-in-ipip6_tunnel_bind_.patch @@ -0,0 +1,69 @@ +From 1311184360d71efdc9a0affd2898e0d54d5494de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 23:00:06 -0700 +Subject: sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() + +From: Cong Wang + +[ Upstream commit c88f8d5cd95fd039cff95d682b8e71100c001df0 ] + +When a tunnel device is bound with the underlying device, its +dev->needed_headroom needs to be updated properly. IPv4 tunnels +already do the same in ip_tunnel_bind_dev(). Otherwise we may +not have enough header room for skb, especially after commit +b17f709a2401 ("gue: TX support for using remote checksum offload option"). + +Fixes: 32b8a8e59c9c ("sit: add IPv4 over IPv4 support") +Reported-by: Palash Oswal +Link: https://lore.kernel.org/netdev/CAGyP=7fDcSPKu6nttbGwt7RXzE3uyYxLjCSE97J64pRxJP8jPA@mail.gmail.com/ +Cc: Kuniyuki Iwashima +Cc: Eric Dumazet +Signed-off-by: Cong Wang +Reviewed-by: Eric Dumazet +Reviewed-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/sit.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index d4cdc2b1b4689..3bc02ab9ceaca 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -1101,12 +1101,13 @@ static netdev_tx_t sit_tunnel_xmit(struct sk_buff *skb, + + static void ipip6_tunnel_bind_dev(struct net_device *dev) + { ++ struct ip_tunnel *tunnel = netdev_priv(dev); ++ int t_hlen = tunnel->hlen + sizeof(struct iphdr); + struct net_device *tdev = NULL; +- struct ip_tunnel *tunnel; ++ int hlen = LL_MAX_HEADER; + const struct iphdr *iph; + struct flowi4 fl4; + +- tunnel = netdev_priv(dev); + iph = &tunnel->parms.iph; + + if (iph->daddr) { +@@ -1129,14 +1130,15 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev) + tdev = __dev_get_by_index(tunnel->net, tunnel->parms.link); + + if (tdev && !netif_is_l3_master(tdev)) { +- int t_hlen = tunnel->hlen + sizeof(struct iphdr); + int mtu; + + mtu = tdev->mtu - t_hlen; + if (mtu < IPV6_MIN_MTU) + mtu = IPV6_MIN_MTU; + WRITE_ONCE(dev->mtu, mtu); ++ hlen = tdev->hard_header_len + tdev->needed_headroom; + } ++ dev->needed_headroom = t_hlen + hlen; + } + + static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p, +-- +2.39.2 + diff --git a/queue-5.15/virtio_net-split-free_unused_bufs.patch b/queue-5.15/virtio_net-split-free_unused_bufs.patch new file mode 100644 index 00000000000..677d5e4d157 --- /dev/null +++ b/queue-5.15/virtio_net-split-free_unused_bufs.patch @@ -0,0 +1,91 @@ +From 84e0fcaa52d757cc926ce94c46b694af4e9d39c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Aug 2022 14:38:59 +0800 +Subject: virtio_net: split free_unused_bufs() + +From: Xuan Zhuo + +[ Upstream commit 6e345f8c7cd029ad3aaece15ad4425ac26e4eb63 ] + +This patch separates two functions for freeing sq buf and rq buf from +free_unused_bufs(). + +When supporting the enable/disable tx/rq queue in the future, it is +necessary to support separate recovery of a sq buf or a rq buf. + +Signed-off-by: Xuan Zhuo +Acked-by: Jason Wang +Message-Id: <20220801063902.129329-40-xuanzhuo@linux.alibaba.com> +Signed-off-by: Michael S. Tsirkin +Stable-dep-of: f8bb51043945 ("virtio_net: suppress cpu stall when free_unused_bufs") +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 41 ++++++++++++++++++++++++---------------- + 1 file changed, 25 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 8a380086ac257..cff3e2a7ce7fc 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -2814,6 +2814,27 @@ static void free_receive_page_frags(struct virtnet_info *vi) + put_page(vi->rq[i].alloc_frag.page); + } + ++static void virtnet_sq_free_unused_buf(struct virtqueue *vq, void *buf) ++{ ++ if (!is_xdp_frame(buf)) ++ dev_kfree_skb(buf); ++ else ++ xdp_return_frame(ptr_to_xdp(buf)); ++} ++ ++static void virtnet_rq_free_unused_buf(struct virtqueue *vq, void *buf) ++{ ++ struct virtnet_info *vi = vq->vdev->priv; ++ int i = vq2rxq(vq); ++ ++ if (vi->mergeable_rx_bufs) ++ put_page(virt_to_head_page(buf)); ++ else if (vi->big_packets) ++ give_pages(&vi->rq[i], buf); ++ else ++ put_page(virt_to_head_page(buf)); ++} ++ + static void free_unused_bufs(struct virtnet_info *vi) + { + void *buf; +@@ -2821,26 +2842,14 @@ static void free_unused_bufs(struct virtnet_info *vi) + + for (i = 0; i < vi->max_queue_pairs; i++) { + struct virtqueue *vq = vi->sq[i].vq; +- while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) { +- if (!is_xdp_frame(buf)) +- dev_kfree_skb(buf); +- else +- xdp_return_frame(ptr_to_xdp(buf)); +- } ++ while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) ++ virtnet_sq_free_unused_buf(vq, buf); + } + + for (i = 0; i < vi->max_queue_pairs; i++) { + struct virtqueue *vq = vi->rq[i].vq; +- +- while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) { +- if (vi->mergeable_rx_bufs) { +- put_page(virt_to_head_page(buf)); +- } else if (vi->big_packets) { +- give_pages(&vi->rq[i], buf); +- } else { +- put_page(virt_to_head_page(buf)); +- } +- } ++ while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) ++ virtnet_rq_free_unused_buf(vq, buf); + } + } + +-- +2.39.2 + diff --git a/queue-5.15/virtio_net-suppress-cpu-stall-when-free_unused_bufs.patch b/queue-5.15/virtio_net-suppress-cpu-stall-when-free_unused_bufs.patch new file mode 100644 index 00000000000..fb697279afc --- /dev/null +++ b/queue-5.15/virtio_net-suppress-cpu-stall-when-free_unused_bufs.patch @@ -0,0 +1,44 @@ +From 65196c493c3fa0cb49119a3c7d7caf4b213acaa0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 10:27:06 +0800 +Subject: virtio_net: suppress cpu stall when free_unused_bufs + +From: Wenliang Wang + +[ Upstream commit f8bb5104394560e29017c25bcade4c6b7aabd108 ] + +For multi-queue and large ring-size use case, the following error +occurred when free_unused_bufs: +rcu: INFO: rcu_sched self-detected stall on CPU. + +Fixes: 986a4f4d452d ("virtio_net: multiqueue support") +Signed-off-by: Wenliang Wang +Acked-by: Michael S. Tsirkin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index cff3e2a7ce7fc..9f2d691908b42 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -2844,12 +2844,14 @@ static void free_unused_bufs(struct virtnet_info *vi) + struct virtqueue *vq = vi->sq[i].vq; + while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) + virtnet_sq_free_unused_buf(vq, buf); ++ cond_resched(); + } + + for (i = 0; i < vi->max_queue_pairs; i++) { + struct virtqueue *vq = vi->rq[i].vq; + while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) + virtnet_rq_free_unused_buf(vq, buf); ++ cond_resched(); + } + } + +-- +2.39.2 + diff --git a/queue-5.15/watchdog-dw_wdt-fix-the-error-handling-path-of-dw_wd.patch b/queue-5.15/watchdog-dw_wdt-fix-the-error-handling-path-of-dw_wd.patch new file mode 100644 index 00000000000..36634ac9062 --- /dev/null +++ b/queue-5.15/watchdog-dw_wdt-fix-the-error-handling-path-of-dw_wd.patch @@ -0,0 +1,59 @@ +From 878e14fd2daf32534e94c6e4f164a93e9559f21a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 08:52:48 +0200 +Subject: watchdog: dw_wdt: Fix the error handling path of dw_wdt_drv_probe() + +From: Christophe JAILLET + +[ Upstream commit 7f5390750645756bd5da2b24fac285f2654dd922 ] + +The commit in Fixes has only updated the remove function and missed the +error handling path of the probe. + +Add the missing reset_control_assert() call. + +Fixes: 65a3b6935d92 ("watchdog: dw_wdt: get reset lines from dt") +Signed-off-by: Christophe JAILLET +Reviewed-by: Philipp Zabel +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/fbb650650bbb33a8fa2fd028c23157bedeed50e1.1682491863.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/dw_wdt.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/watchdog/dw_wdt.c b/drivers/watchdog/dw_wdt.c +index cd578843277e5..498c1c403fc92 100644 +--- a/drivers/watchdog/dw_wdt.c ++++ b/drivers/watchdog/dw_wdt.c +@@ -637,7 +637,7 @@ static int dw_wdt_drv_probe(struct platform_device *pdev) + + ret = dw_wdt_init_timeouts(dw_wdt, dev); + if (ret) +- goto out_disable_clk; ++ goto out_assert_rst; + + wdd = &dw_wdt->wdd; + wdd->ops = &dw_wdt_ops; +@@ -668,12 +668,15 @@ static int dw_wdt_drv_probe(struct platform_device *pdev) + + ret = watchdog_register_device(wdd); + if (ret) +- goto out_disable_pclk; ++ goto out_assert_rst; + + dw_wdt_dbgfs_init(dw_wdt); + + return 0; + ++out_assert_rst: ++ reset_control_assert(dw_wdt->rst); ++ + out_disable_pclk: + clk_disable_unprepare(dw_wdt->pclk); + +-- +2.39.2 + diff --git a/queue-5.15/writeback-fix-call-of-incorrect-macro.patch b/queue-5.15/writeback-fix-call-of-incorrect-macro.patch new file mode 100644 index 00000000000..0a4ce5eb4ea --- /dev/null +++ b/queue-5.15/writeback-fix-call-of-incorrect-macro.patch @@ -0,0 +1,41 @@ +From fd479acdbd856a3008c0bc2b28728cb06a78f4b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 13:44:43 +0300 +Subject: writeback: fix call of incorrect macro + +From: Maxim Korotkov + +[ Upstream commit 3e46c89c74f2c38e5337d2cf44b0b551adff1cb4 ] + + the variable 'history' is of type u16, it may be an error + that the hweight32 macro was used for it + I guess macro hweight16 should be used + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 2a81490811d0 ("writeback: implement foreign cgroup inode detection") +Signed-off-by: Maxim Korotkov +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20230119104443.3002-1-korotkov.maxim.s@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/fs-writeback.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index fbc3f0ef38c02..c76537a6826a7 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -825,7 +825,7 @@ void wbc_detach_inode(struct writeback_control *wbc) + * is okay. The main goal is avoiding keeping an inode on + * the wrong wb for an extended period of time. + */ +- if (hweight32(history) > WB_FRN_HIST_THR_SLOTS) ++ if (hweight16(history) > WB_FRN_HIST_THR_SLOTS) + inode_switch_wbs(inode, max_id); + } + +-- +2.39.2 +