From: Sasha Levin Date: Mon, 31 Oct 2022 10:23:21 +0000 (-0400) Subject: Fixes for 6.0 X-Git-Tag: v4.19.263~15 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=de2c43bc5c91321b5528e850dc3f22b3f2232b5d;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.0 Signed-off-by: Sasha Levin --- diff --git a/queue-6.0/alsa-ac97-fix-possible-memory-leak-in-snd_ac97_dev_r.patch b/queue-6.0/alsa-ac97-fix-possible-memory-leak-in-snd_ac97_dev_r.patch new file mode 100644 index 00000000000..bd1a1c17fb2 --- /dev/null +++ b/queue-6.0/alsa-ac97-fix-possible-memory-leak-in-snd_ac97_dev_r.patch @@ -0,0 +1,37 @@ +From 6d53c0f184654d73b966905d30601d129387091a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 17:30:25 +0800 +Subject: ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() + +From: Yang Yingliang + +[ Upstream commit 4881bda5ea05c8c240fc8afeaa928e2bc43f61fa ] + +If device_register() fails in snd_ac97_dev_register(), it should +call put_device() to give up reference, or the name allocated in +dev_set_name() is leaked. + +Fixes: 0ca06a00e206 ("[ALSA] AC97 bus interface for ad-hoc drivers") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221019093025.1179475-1-yangyingliang@huawei.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/ac97/ac97_codec.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c +index ef03769dfcbd..ff685321f1a1 100644 +--- a/sound/pci/ac97/ac97_codec.c ++++ b/sound/pci/ac97/ac97_codec.c +@@ -2009,6 +2009,7 @@ static int snd_ac97_dev_register(struct snd_device *device) + err = device_register(&ac97->dev); + if (err < 0) { + ac97_err(ac97, "Can't register ac97 bus\n"); ++ put_device(&ac97->dev); + ac97->dev.bus = NULL; + return err; + } +-- +2.35.1 + diff --git a/queue-6.0/alsa-aoa-fix-i2s-device-accounting.patch b/queue-6.0/alsa-aoa-fix-i2s-device-accounting.patch new file mode 100644 index 00000000000..ee2f7bfa172 --- /dev/null +++ b/queue-6.0/alsa-aoa-fix-i2s-device-accounting.patch @@ -0,0 +1,49 @@ +From d566d1296d8e99acd818b1c53e4dfda6536c85a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 08:52:33 +0200 +Subject: ALSA: aoa: Fix I2S device accounting + +From: Takashi Iwai + +[ Upstream commit f1fae475f10a26b7e34da4ff2e2f19b7feb3548e ] + +i2sbus_add_dev() is supposed to return the number of probed devices, +i.e. either 1 or 0. However, i2sbus_add_dev() has one error handling +that returns -ENODEV; this will screw up the accumulation number +counted in the caller, i2sbus_probe(). + +Fix the return value to 0 and add the comment for better understanding +for readers. + +Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa") +Link: https://lore.kernel.org/r/20221027065233.13292-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/aoa/soundbus/i2sbus/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/aoa/soundbus/i2sbus/core.c b/sound/aoa/soundbus/i2sbus/core.c +index f6841daf9e3b..51ed2f34b276 100644 +--- a/sound/aoa/soundbus/i2sbus/core.c ++++ b/sound/aoa/soundbus/i2sbus/core.c +@@ -147,6 +147,7 @@ static int i2sbus_get_and_fixup_rsrc(struct device_node *np, int index, + return rc; + } + ++/* Returns 1 if added, 0 for otherwise; don't return a negative value! */ + /* FIXME: look at device node refcounting */ + static int i2sbus_add_dev(struct macio_dev *macio, + struct i2sbus_control *control, +@@ -213,7 +214,7 @@ static int i2sbus_add_dev(struct macio_dev *macio, + * either as the second one in that case is just a modem. */ + if (!ok) { + kfree(dev); +- return -ENODEV; ++ return 0; + } + + mutex_init(&dev->lock); +-- +2.35.1 + diff --git a/queue-6.0/alsa-aoa-i2sbus-fix-possible-memory-leak-in-i2sbus_a.patch b/queue-6.0/alsa-aoa-i2sbus-fix-possible-memory-leak-in-i2sbus_a.patch new file mode 100644 index 00000000000..98c1382bf83 --- /dev/null +++ b/queue-6.0/alsa-aoa-i2sbus-fix-possible-memory-leak-in-i2sbus_a.patch @@ -0,0 +1,42 @@ +From e9f9f686866e5c7885247138aa281963ff2042c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 09:34:38 +0800 +Subject: ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() + +From: Yang Yingliang + +[ Upstream commit 4a4c8482e370d697738a78dcd7bf2780832cb712 ] + +dev_set_name() in soundbus_add_one() allocates memory for name, it need be +freed when of_device_register() fails, call soundbus_dev_put() to give up +the reference that hold in device_initialize(), so that it can be freed in +kobject_cleanup() when the refcount hit to 0. And other resources are also +freed in i2sbus_release_dev(), so it can return 0 directly. + +Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221027013438.991920-1-yangyingliang@huawei.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/aoa/soundbus/i2sbus/core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/aoa/soundbus/i2sbus/core.c b/sound/aoa/soundbus/i2sbus/core.c +index faf6b03131ee..f6841daf9e3b 100644 +--- a/sound/aoa/soundbus/i2sbus/core.c ++++ b/sound/aoa/soundbus/i2sbus/core.c +@@ -302,6 +302,10 @@ static int i2sbus_add_dev(struct macio_dev *macio, + + if (soundbus_add_one(&dev->sound)) { + printk(KERN_DEBUG "i2sbus: device registration error!\n"); ++ if (dev->sound.ofdev.dev.kobj.state_initialized) { ++ soundbus_dev_put(&dev->sound); ++ return 0; ++ } + goto err; + } + +-- +2.35.1 + diff --git a/queue-6.0/amd-xgbe-add-the-bit-rate-quirk-for-molex-cables.patch b/queue-6.0/amd-xgbe-add-the-bit-rate-quirk-for-molex-cables.patch new file mode 100644 index 00000000000..8e0bb4dffbf --- /dev/null +++ b/queue-6.0/amd-xgbe-add-the-bit-rate-quirk-for-molex-cables.patch @@ -0,0 +1,61 @@ +From d0e29bc7fd7ee55579621432380c9e6de89fd4e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Oct 2022 12:12:15 +0530 +Subject: amd-xgbe: add the bit rate quirk for Molex cables + +From: Raju Rangoju + +[ Upstream commit 170a9e341a3b02c0b2ea0df16ef14a33a4f41de8 ] + +The offset 12 (bit-rate) of EEPROM SFP DAC (passive) cables is expected +to be in the range 0x64 to 0x68. However, the 5 meter and 7 meter Molex +passive cables have the rate ceiling 0x78 at offset 12. + +Add a quirk for Molex passive cables to extend the rate ceiling to 0x78. + +Fixes: abf0a1c2b26a ("amd-xgbe: Add support for SFP+ modules") +Signed-off-by: Raju Rangoju +Acked-by: Tom Lendacky +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +index d322bce41d81..601a9f2fa9bf 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +@@ -239,6 +239,7 @@ enum xgbe_sfp_speed { + #define XGBE_SFP_BASE_BR_1GBE_MAX 0x0d + #define XGBE_SFP_BASE_BR_10GBE_MIN 0x64 + #define XGBE_SFP_BASE_BR_10GBE_MAX 0x68 ++#define XGBE_MOLEX_SFP_BASE_BR_10GBE_MAX 0x78 + + #define XGBE_SFP_BASE_CU_CABLE_LEN 18 + +@@ -284,6 +285,8 @@ struct xgbe_sfp_eeprom { + #define XGBE_BEL_FUSE_VENDOR "BEL-FUSE " + #define XGBE_BEL_FUSE_PARTNO "1GBT-SFP06 " + ++#define XGBE_MOLEX_VENDOR "Molex Inc. " ++ + struct xgbe_sfp_ascii { + union { + char vendor[XGBE_SFP_BASE_VENDOR_NAME_LEN + 1]; +@@ -834,7 +837,11 @@ static bool xgbe_phy_sfp_bit_rate(struct xgbe_sfp_eeprom *sfp_eeprom, + break; + case XGBE_SFP_SPEED_10000: + min = XGBE_SFP_BASE_BR_10GBE_MIN; +- max = XGBE_SFP_BASE_BR_10GBE_MAX; ++ if (memcmp(&sfp_eeprom->base[XGBE_SFP_BASE_VENDOR_NAME], ++ XGBE_MOLEX_VENDOR, XGBE_SFP_BASE_VENDOR_NAME_LEN) == 0) ++ max = XGBE_MOLEX_SFP_BASE_BR_10GBE_MAX; ++ else ++ max = XGBE_SFP_BASE_BR_10GBE_MAX; + break; + default: + return false; +-- +2.35.1 + diff --git a/queue-6.0/amd-xgbe-fix-the-sfp-compliance-codes-check-for-dac-.patch b/queue-6.0/amd-xgbe-fix-the-sfp-compliance-codes-check-for-dac-.patch new file mode 100644 index 00000000000..f13ef43a268 --- /dev/null +++ b/queue-6.0/amd-xgbe-fix-the-sfp-compliance-codes-check-for-dac-.patch @@ -0,0 +1,54 @@ +From 7c145f5f81db1a0a36b1c35d4085aa4fab364da9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Oct 2022 12:12:14 +0530 +Subject: amd-xgbe: fix the SFP compliance codes check for DAC cables + +From: Raju Rangoju + +[ Upstream commit 09c5f6bf11ac98874339e55f4f5f79a9dbc9b375 ] + +The current XGBE code assumes that offset 6 of EEPROM SFP DAC (passive) +cables is NULL. However, some cables (the 5 meter and 7 meter Molex +passive cables) have non-zero data at offset 6. Fix the logic by moving +the passive cable check above the active checks, so as not to be +improperly identified as an active cable. This will fix the issue for +any passive cable that advertises 1000Base-CX in offset 6. + +Fixes: abf0a1c2b26a ("amd-xgbe: Add support for SFP+ modules") +Signed-off-by: Raju Rangoju +Acked-by: Tom Lendacky +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +index 19b943eba560..d322bce41d81 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +@@ -1151,7 +1151,10 @@ static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata) + } + + /* Determine the type of SFP */ +- if (sfp_base[XGBE_SFP_BASE_10GBE_CC] & XGBE_SFP_BASE_10GBE_CC_SR) ++ if (phy_data->sfp_cable == XGBE_SFP_CABLE_PASSIVE && ++ xgbe_phy_sfp_bit_rate(sfp_eeprom, XGBE_SFP_SPEED_10000)) ++ phy_data->sfp_base = XGBE_SFP_BASE_10000_CR; ++ else if (sfp_base[XGBE_SFP_BASE_10GBE_CC] & XGBE_SFP_BASE_10GBE_CC_SR) + phy_data->sfp_base = XGBE_SFP_BASE_10000_SR; + else if (sfp_base[XGBE_SFP_BASE_10GBE_CC] & XGBE_SFP_BASE_10GBE_CC_LR) + phy_data->sfp_base = XGBE_SFP_BASE_10000_LR; +@@ -1167,9 +1170,6 @@ static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata) + phy_data->sfp_base = XGBE_SFP_BASE_1000_CX; + else if (sfp_base[XGBE_SFP_BASE_1GBE_CC] & XGBE_SFP_BASE_1GBE_CC_T) + phy_data->sfp_base = XGBE_SFP_BASE_1000_T; +- else if ((phy_data->sfp_cable == XGBE_SFP_CABLE_PASSIVE) && +- xgbe_phy_sfp_bit_rate(sfp_eeprom, XGBE_SFP_SPEED_10000)) +- phy_data->sfp_base = XGBE_SFP_BASE_10000_CR; + + switch (phy_data->sfp_base) { + case XGBE_SFP_BASE_1000_T: +-- +2.35.1 + diff --git a/queue-6.0/amd-xgbe-yellow-carp-devices-do-not-need-rrc.patch b/queue-6.0/amd-xgbe-yellow-carp-devices-do-not-need-rrc.patch new file mode 100644 index 00000000000..6a50dcb004b --- /dev/null +++ b/queue-6.0/amd-xgbe-yellow-carp-devices-do-not-need-rrc.patch @@ -0,0 +1,84 @@ +From e6d6ed4dc905912af1eab9619079ef63ef6510df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Oct 2022 12:12:11 +0530 +Subject: amd-xgbe: Yellow carp devices do not need rrc + +From: Raju Rangoju + +[ Upstream commit f97fc7ef414603189d5ba6f529407c5341c03c2a ] + +Link stability issues are noticed on Yellow carp platforms when Receiver +Reset Cycle is issued. Since the CDR workaround is disabled on these +platforms, the Receiver Reset Cycle is not needed. + +So, avoid issuing rrc on Yellow carp platforms. + +Fixes: dbb6c58b5a61 ("net: amd-xgbe: Add Support for Yellow Carp Ethernet device") +Signed-off-by: Raju Rangoju +Acked-by: Tom Lendacky +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-pci.c | 5 +++++ + drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 2 +- + drivers/net/ethernet/amd/xgbe/xgbe.h | 1 + + 3 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c +index 2af3da4b2d05..f409d7bd1f1e 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c +@@ -285,6 +285,9 @@ static int xgbe_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + /* Yellow Carp devices do not need cdr workaround */ + pdata->vdata->an_cdr_workaround = 0; ++ ++ /* Yellow Carp devices do not need rrc */ ++ pdata->vdata->enable_rrc = 0; + } else { + pdata->xpcs_window_def_reg = PCS_V2_WINDOW_DEF; + pdata->xpcs_window_sel_reg = PCS_V2_WINDOW_SELECT; +@@ -483,6 +486,7 @@ static struct xgbe_version_data xgbe_v2a = { + .tx_desc_prefetch = 5, + .rx_desc_prefetch = 5, + .an_cdr_workaround = 1, ++ .enable_rrc = 1, + }; + + static struct xgbe_version_data xgbe_v2b = { +@@ -498,6 +502,7 @@ static struct xgbe_version_data xgbe_v2b = { + .tx_desc_prefetch = 5, + .rx_desc_prefetch = 5, + .an_cdr_workaround = 1, ++ .enable_rrc = 1, + }; + + static const struct pci_device_id xgbe_pci_table[] = { +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +index 2156600641b6..19b943eba560 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +@@ -2640,7 +2640,7 @@ static int xgbe_phy_link_status(struct xgbe_prv_data *pdata, int *an_restart) + } + + /* No link, attempt a receiver reset cycle */ +- if (phy_data->rrc_count++ > XGBE_RRC_FREQUENCY) { ++ if (pdata->vdata->enable_rrc && phy_data->rrc_count++ > XGBE_RRC_FREQUENCY) { + phy_data->rrc_count = 0; + xgbe_phy_rrc(pdata); + } +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h +index b875c430222e..49d23abce73d 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe.h ++++ b/drivers/net/ethernet/amd/xgbe/xgbe.h +@@ -1013,6 +1013,7 @@ struct xgbe_version_data { + unsigned int tx_desc_prefetch; + unsigned int rx_desc_prefetch; + unsigned int an_cdr_workaround; ++ unsigned int enable_rrc; + }; + + struct xgbe_prv_data { +-- +2.35.1 + diff --git a/queue-6.0/arc-iounmap-arg-is-volatile.patch b/queue-6.0/arc-iounmap-arg-is-volatile.patch new file mode 100644 index 00000000000..1780ed42ee7 --- /dev/null +++ b/queue-6.0/arc-iounmap-arg-is-volatile.patch @@ -0,0 +1,59 @@ +From 97cf232e9e7238e0a3c89177db2e1f207d00668d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Oct 2022 19:28:46 -0700 +Subject: arc: iounmap() arg is volatile + +From: Randy Dunlap + +[ Upstream commit c44f15c1c09481d50fd33478ebb5b8284f8f5edb ] + +Add 'volatile' to iounmap()'s argument to prevent build warnings. +This make it the same as other major architectures. + +Placates these warnings: (12 such warnings) + +../drivers/video/fbdev/riva/fbdev.c: In function 'rivafb_probe': +../drivers/video/fbdev/riva/fbdev.c:2067:42: error: passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type [-Werror=discarded-qualifiers] + 2067 | iounmap(default_par->riva.PRAMIN); + +Fixes: 1162b0701b14b ("ARC: I/O and DMA Mappings") +Signed-off-by: Randy Dunlap +Cc: Vineet Gupta +Cc: linux-snps-arc@lists.infradead.org +Cc: Arnd Bergmann +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/include/asm/io.h | 2 +- + arch/arc/mm/ioremap.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arc/include/asm/io.h b/arch/arc/include/asm/io.h +index 8f777d6441a5..80347382a380 100644 +--- a/arch/arc/include/asm/io.h ++++ b/arch/arc/include/asm/io.h +@@ -32,7 +32,7 @@ static inline void ioport_unmap(void __iomem *addr) + { + } + +-extern void iounmap(const void __iomem *addr); ++extern void iounmap(const volatile void __iomem *addr); + + /* + * io{read,write}{16,32}be() macros +diff --git a/arch/arc/mm/ioremap.c b/arch/arc/mm/ioremap.c +index 0ee75aca6e10..712c2311daef 100644 +--- a/arch/arc/mm/ioremap.c ++++ b/arch/arc/mm/ioremap.c +@@ -94,7 +94,7 @@ void __iomem *ioremap_prot(phys_addr_t paddr, unsigned long size, + EXPORT_SYMBOL(ioremap_prot); + + +-void iounmap(const void __iomem *addr) ++void iounmap(const volatile void __iomem *addr) + { + /* weird double cast to handle phys_addr_t > 32 bits */ + if (arc_uncached_addr_space((phys_addr_t)(u32)addr)) +-- +2.35.1 + diff --git a/queue-6.0/arm64-add-ampere1-to-the-spectre-bhb-affected-list.patch b/queue-6.0/arm64-add-ampere1-to-the-spectre-bhb-affected-list.patch new file mode 100644 index 00000000000..d984cecfd0a --- /dev/null +++ b/queue-6.0/arm64-add-ampere1-to-the-spectre-bhb-affected-list.patch @@ -0,0 +1,80 @@ +From ff03d75484409cba6cfd1f914ecd889eec9c51e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 19:21:40 -0700 +Subject: arm64: Add AMPERE1 to the Spectre-BHB affected list + +From: D Scott Phillips + +[ Upstream commit 0e5d5ae837c8ce04d2ddb874ec5f920118bd9d31 ] + +Per AmpereOne erratum AC03_CPU_12, "Branch history may allow control of +speculative execution across software contexts," the AMPERE1 core needs the +bhb clearing loop to mitigate Spectre-BHB, with a loop iteration count of +11. + +Signed-off-by: D Scott Phillips +Link: https://lore.kernel.org/r/20221011022140.432370-1-scott@os.amperecomputing.com +Reviewed-by: James Morse +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/cputype.h | 4 ++++ + arch/arm64/kernel/proton-pack.c | 6 ++++++ + 2 files changed, 10 insertions(+) + +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index 8aa0d276a636..abc418650fec 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -60,6 +60,7 @@ + #define ARM_CPU_IMP_FUJITSU 0x46 + #define ARM_CPU_IMP_HISI 0x48 + #define ARM_CPU_IMP_APPLE 0x61 ++#define ARM_CPU_IMP_AMPERE 0xC0 + + #define ARM_CPU_PART_AEM_V8 0xD0F + #define ARM_CPU_PART_FOUNDATION 0xD00 +@@ -123,6 +124,8 @@ + #define APPLE_CPU_PART_M1_ICESTORM_MAX 0x028 + #define APPLE_CPU_PART_M1_FIRESTORM_MAX 0x029 + ++#define AMPERE_CPU_PART_AMPERE1 0xAC3 ++ + #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53) + #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57) + #define MIDR_CORTEX_A72 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) +@@ -172,6 +175,7 @@ + #define MIDR_APPLE_M1_FIRESTORM_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM_PRO) + #define MIDR_APPLE_M1_ICESTORM_MAX MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_MAX) + #define MIDR_APPLE_M1_FIRESTORM_MAX MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM_MAX) ++#define MIDR_AMPERE1 MIDR_CPU_MODEL(ARM_CPU_IMP_AMPERE, AMPERE_CPU_PART_AMPERE1) + + /* Fujitsu Erratum 010001 affects A64FX 1.0 and 1.1, (v0r0 and v1r0) */ + #define MIDR_FUJITSU_ERRATUM_010001 MIDR_FUJITSU_A64FX +diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c +index 40be3a7c2c53..428cfabd11c4 100644 +--- a/arch/arm64/kernel/proton-pack.c ++++ b/arch/arm64/kernel/proton-pack.c +@@ -868,6 +868,10 @@ u8 spectre_bhb_loop_affected(int scope) + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), + {}, + }; ++ static const struct midr_range spectre_bhb_k11_list[] = { ++ MIDR_ALL_VERSIONS(MIDR_AMPERE1), ++ {}, ++ }; + static const struct midr_range spectre_bhb_k8_list[] = { + MIDR_ALL_VERSIONS(MIDR_CORTEX_A72), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A57), +@@ -878,6 +882,8 @@ u8 spectre_bhb_loop_affected(int scope) + k = 32; + else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k24_list)) + k = 24; ++ else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k11_list)) ++ k = 11; + else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k8_list)) + k = 8; + +-- +2.35.1 + diff --git a/queue-6.0/asoc-codec-tlv320adc3xxx-add-gpiolib-dependency.patch b/queue-6.0/asoc-codec-tlv320adc3xxx-add-gpiolib-dependency.patch new file mode 100644 index 00000000000..05025d56b25 --- /dev/null +++ b/queue-6.0/asoc-codec-tlv320adc3xxx-add-gpiolib-dependency.patch @@ -0,0 +1,51 @@ +From 01e966a7a3332d3b98181520bed954fc73151116 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Oct 2022 16:58:22 -0700 +Subject: ASoC: codec: tlv320adc3xxx: add GPIOLIB dependency + +From: Randy Dunlap + +[ Upstream commit 551f2994b8ccdbe296e239278531e345d6e94d4d ] + +Fix build errors when CONFIG_GPIOLIB is not enabled: + +../sound/soc/codecs/tlv320adc3xxx.c: In function 'adc3xxx_i2c_probe': +../sound/soc/codecs/tlv320adc3xxx.c:1352:28: error: implicit declaration of function 'devm_gpiod_get'; did you mean 'devm_gpio_free'? [-Werror=implicit-function-declaration] + 1352 | adc3xxx->rst_pin = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW); +../sound/soc/codecs/tlv320adc3xxx.c:1352:57: error: 'GPIOD_OUT_LOW' undeclared (first use in this function); did you mean 'GPIOF_INIT_LOW'? + 1352 | adc3xxx->rst_pin = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW); + CC lib/dynamic_debug.o +../sound/soc/codecs/tlv320adc3xxx.c:1400:9: error: implicit declaration of function 'gpiod_set_value_cansleep'; did you mean 'gpio_set_value_cansleep'? [-Werror=implicit-function-declaration] + 1400 | gpiod_set_value_cansleep(adc3xxx->rst_pin, 1); + +Fixes: e9a3b57efd28 ("ASoC: codec: tlv320adc3xxx: New codec driver") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Mark Brown +Cc: Liam Girdwood +Cc: Ricard Wanderlof +Cc: Jaroslav Kysela +Cc: Takashi Iwai +Cc: alsa-devel@alsa-project.org +Link: https://lore.kernel.org/r/20221006235822.30074-1-rdunlap@infradead.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig +index d16b4efb88a7..932f08549788 100644 +--- a/sound/soc/codecs/Kconfig ++++ b/sound/soc/codecs/Kconfig +@@ -1599,6 +1599,7 @@ config SND_SOC_TFA989X + config SND_SOC_TLV320ADC3XXX + tristate "Texas Instruments TLV320ADC3001/3101 audio ADC" + depends on I2C ++ depends on GPIOLIB + help + Enable support for Texas Instruments TLV320ADC3001 and TLV320ADC3101 + ADCs. +-- +2.35.1 + diff --git a/queue-6.0/asoc-codecs-tlv320adc3xxx-wrap-adc3xxx_i2c_remove-in.patch b/queue-6.0/asoc-codecs-tlv320adc3xxx-wrap-adc3xxx_i2c_remove-in.patch new file mode 100644 index 00000000000..010dcef7eac --- /dev/null +++ b/queue-6.0/asoc-codecs-tlv320adc3xxx-wrap-adc3xxx_i2c_remove-in.patch @@ -0,0 +1,40 @@ +From e433474cfce34062f4e3af16ae0d746be7c7aa52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Oct 2022 10:33:50 +0200 +Subject: ASoC: codecs: tlv320adc3xxx: Wrap adc3xxx_i2c_remove() in __exit_p() + +From: Geert Uytterhoeven + +[ Upstream commit 4e8ff35878685291978b93543d6b9e9290be770a ] + +If CONFIG_SND_SOC_TLV320ADC3XXX=y: + + `.exit.text' referenced in section `.data' of sound/soc/codecs/tlv320adc3xxx.o: defined in discarded section `.exit.text' of sound/soc/codecs/tlv320adc3xxx.o + +Fix this by wrapping the adc3xxx_i2c_remove() pointer in __exit_p(). + +Fixes: e9a3b57efd28fe88 ("ASoC: codec: tlv320adc3xxx: New codec driver") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/3225ba4cfe558d9380155e75385954dd21d4e7eb.1665909132.git.geert@linux-m68k.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tlv320adc3xxx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/tlv320adc3xxx.c b/sound/soc/codecs/tlv320adc3xxx.c +index 748998e48af9..8a0965cd3e66 100644 +--- a/sound/soc/codecs/tlv320adc3xxx.c ++++ b/sound/soc/codecs/tlv320adc3xxx.c +@@ -1450,7 +1450,7 @@ static struct i2c_driver adc3xxx_i2c_driver = { + .of_match_table = tlv320adc3xxx_of_match, + }, + .probe_new = adc3xxx_i2c_probe, +- .remove = adc3xxx_i2c_remove, ++ .remove = __exit_p(adc3xxx_i2c_remove), + .id_table = adc3xxx_i2c_id, + }; + +-- +2.35.1 + diff --git a/queue-6.0/asoc-intel-common-add-acpi-matching-tables-for-rapto.patch b/queue-6.0/asoc-intel-common-add-acpi-matching-tables-for-rapto.patch new file mode 100644 index 00000000000..f7c19aec5fa --- /dev/null +++ b/queue-6.0/asoc-intel-common-add-acpi-matching-tables-for-rapto.patch @@ -0,0 +1,119 @@ +From d2fbbac0583ce8bc89ecc4ba67a321f581dea2c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Aug 2022 16:05:09 +0300 +Subject: ASoC: Intel: common: add ACPI matching tables for Raptor Lake + +From: Kai Vehmanen + +[ Upstream commit 5f3db54cfbc21772d984372fdcc5bb17b57f425f ] + +Initial support for RPL w/ RT711 + +Signed-off-by: Kai Vehmanen +Reviewed-by: Bard Liao +Reviewed-by: Pierre-Louis Bossart +Tested-by: Gopal Vamshi Krishna +Link: https://lore.kernel.org/r/20220816130510.190427-1-kai.vehmanen@linux.intel.com +Signed-off-by: Mark Brown +Stable-dep-of: 05de5cf6fb7d ("ASoC: SOF: Intel: pci-tgl: fix ADL-N descriptor") +Signed-off-by: Sasha Levin +--- + include/sound/soc-acpi-intel-match.h | 2 + + sound/soc/intel/common/Makefile | 2 +- + .../intel/common/soc-acpi-intel-rpl-match.c | 51 +++++++++++++++++++ + 3 files changed, 54 insertions(+), 1 deletion(-) + create mode 100644 sound/soc/intel/common/soc-acpi-intel-rpl-match.c + +diff --git a/include/sound/soc-acpi-intel-match.h b/include/sound/soc-acpi-intel-match.h +index bc7fd46ec2bc..ac750afa7bc6 100644 +--- a/include/sound/soc-acpi-intel-match.h ++++ b/include/sound/soc-acpi-intel-match.h +@@ -30,6 +30,7 @@ extern struct snd_soc_acpi_mach snd_soc_acpi_intel_tgl_machines[]; + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_ehl_machines[]; + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_jsl_machines[]; + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_adl_machines[]; ++extern struct snd_soc_acpi_mach snd_soc_acpi_intel_rpl_machines[]; + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_mtl_machines[]; + + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_cnl_sdw_machines[]; +@@ -38,6 +39,7 @@ extern struct snd_soc_acpi_mach snd_soc_acpi_intel_cml_sdw_machines[]; + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_icl_sdw_machines[]; + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_tgl_sdw_machines[]; + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_adl_sdw_machines[]; ++extern struct snd_soc_acpi_mach snd_soc_acpi_intel_rpl_sdw_machines[]; + extern struct snd_soc_acpi_mach snd_soc_acpi_intel_mtl_sdw_machines[]; + + /* +diff --git a/sound/soc/intel/common/Makefile b/sound/soc/intel/common/Makefile +index 8ca8f872ec80..41054cf09ec9 100644 +--- a/sound/soc/intel/common/Makefile ++++ b/sound/soc/intel/common/Makefile +@@ -9,7 +9,7 @@ snd-soc-acpi-intel-match-objs := soc-acpi-intel-byt-match.o soc-acpi-intel-cht-m + soc-acpi-intel-cml-match.o soc-acpi-intel-icl-match.o \ + soc-acpi-intel-tgl-match.o soc-acpi-intel-ehl-match.o \ + soc-acpi-intel-jsl-match.o soc-acpi-intel-adl-match.o \ +- soc-acpi-intel-mtl-match.o \ ++ soc-acpi-intel-rpl-match.o soc-acpi-intel-mtl-match.o \ + soc-acpi-intel-hda-match.o \ + soc-acpi-intel-sdw-mockup-match.o + +diff --git a/sound/soc/intel/common/soc-acpi-intel-rpl-match.c b/sound/soc/intel/common/soc-acpi-intel-rpl-match.c +new file mode 100644 +index 000000000000..0b77401e4e6f +--- /dev/null ++++ b/sound/soc/intel/common/soc-acpi-intel-rpl-match.c +@@ -0,0 +1,51 @@ ++// SPDX-License-Identifier: GPL-2.0-only ++/* ++ * soc-apci-intel-rpl-match.c - tables and support for RPL ACPI enumeration. ++ * ++ * Copyright (c) 2022 Intel Corporation. ++ */ ++ ++#include ++#include ++ ++static const struct snd_soc_acpi_endpoint single_endpoint = { ++ .num = 0, ++ .aggregated = 0, ++ .group_position = 0, ++ .group_id = 0, ++}; ++ ++static const struct snd_soc_acpi_adr_device rt711_0_adr[] = { ++ { ++ .adr = 0x000020025D071100ull, ++ .num_endpoints = 1, ++ .endpoints = &single_endpoint, ++ .name_prefix = "rt711" ++ } ++}; ++ ++static const struct snd_soc_acpi_link_adr rpl_rvp[] = { ++ { ++ .mask = BIT(0), ++ .num_adr = ARRAY_SIZE(rt711_0_adr), ++ .adr_d = rt711_0_adr, ++ }, ++ {} ++}; ++ ++struct snd_soc_acpi_mach snd_soc_acpi_intel_rpl_machines[] = { ++ {}, ++}; ++EXPORT_SYMBOL_GPL(snd_soc_acpi_intel_rpl_machines); ++ ++/* this table is used when there is no I2S codec present */ ++struct snd_soc_acpi_mach snd_soc_acpi_intel_rpl_sdw_machines[] = { ++ { ++ .link_mask = 0x1, /* link0 required */ ++ .links = rpl_rvp, ++ .drv_name = "sof_sdw", ++ .sof_tplg_filename = "sof-rpl-rt711.tplg", ++ }, ++ {}, ++}; ++EXPORT_SYMBOL_GPL(snd_soc_acpi_intel_rpl_sdw_machines); +-- +2.35.1 + diff --git a/queue-6.0/asoc-qcom-lpass-cpu-mark-hdmi-tx-parity-register-as-.patch b/queue-6.0/asoc-qcom-lpass-cpu-mark-hdmi-tx-parity-register-as-.patch new file mode 100644 index 00000000000..99c7b0fbbec --- /dev/null +++ b/queue-6.0/asoc-qcom-lpass-cpu-mark-hdmi-tx-parity-register-as-.patch @@ -0,0 +1,39 @@ +From 47c3c0ea99db58b50f40911f6a06d1d4d6cfcccd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Oct 2022 14:48:50 +0530 +Subject: ASoC: qcom: lpass-cpu: Mark HDMI TX parity register as volatile + +From: Srinivasa Rao Mandadapu + +[ Upstream commit 1dd5166102e7ca91e8c5d833110333835e147ddb ] + +Update LPASS_HDMI_TX_PARITY_ADDR register as volatile, to fix +dp audio failures observed with some of external monitors. + +Fixes: 7cb37b7bd0d3 ("ASoC: qcom: Add support for lpass hdmi driver") + +Signed-off-by: Srinivasa Rao Mandadapu +Reviewed-by: Stephen Boyd +Link: https://lore.kernel.org/r/1665825530-7593-1-git-send-email-quic_srivasam@quicinc.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/lpass-cpu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c +index 99a3b4428591..54353842dc07 100644 +--- a/sound/soc/qcom/lpass-cpu.c ++++ b/sound/soc/qcom/lpass-cpu.c +@@ -784,6 +784,8 @@ static bool lpass_hdmi_regmap_volatile(struct device *dev, unsigned int reg) + return true; + if (reg == LPASS_HDMI_TX_VBIT_CTL_ADDR(v)) + return true; ++ if (reg == LPASS_HDMI_TX_PARITY_ADDR(v)) ++ return true; + + for (i = 0; i < v->hdmi_rdma_channels; ++i) { + if (reg == LPAIF_HDMI_RDMACURR_REG(v, i)) +-- +2.35.1 + diff --git a/queue-6.0/asoc-qcom-lpass-cpu-mark-hdmi-tx-registers-as-volati.patch b/queue-6.0/asoc-qcom-lpass-cpu-mark-hdmi-tx-registers-as-volati.patch new file mode 100644 index 00000000000..a953f7a1690 --- /dev/null +++ b/queue-6.0/asoc-qcom-lpass-cpu-mark-hdmi-tx-registers-as-volati.patch @@ -0,0 +1,57 @@ +From 7b3c0b14f735aad0d64ca40987cdf86fd98bd282 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 10:38:31 +0530 +Subject: ASoC: qcom: lpass-cpu: mark HDMI TX registers as volatile + +From: Srinivasa Rao Mandadapu + +[ Upstream commit c9a3545b1d771fb7b06a487796c40288c02c41c5 ] + +Update HDMI volatile registers list as DMA, Channel Selection registers, +vbit control registers are being reflected by hardware DP port +disconnection. + +This update is required to fix no display and no sound issue observed +after reconnecting TAMA/SANWA DP cables. +Once DP cable is unplugged, DMA control registers are being reset by +hardware, however at second plugin, new dma control values does not +updated to the dma hardware registers since new register value and +cached values at the time of first plugin are same. + +Fixes: 7cb37b7bd0d3 ("ASoC: qcom: Add support for lpass hdmi driver") + +Signed-off-by: Srinivasa Rao Mandadapu +Reported-by: Kuogee Hsieh +Link: https://lore.kernel.org/r/1665637711-13300-1-git-send-email-quic_srivasam@quicinc.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/lpass-cpu.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c +index 8a56f38dc7e8..99a3b4428591 100644 +--- a/sound/soc/qcom/lpass-cpu.c ++++ b/sound/soc/qcom/lpass-cpu.c +@@ -782,10 +782,18 @@ static bool lpass_hdmi_regmap_volatile(struct device *dev, unsigned int reg) + return true; + if (reg == LPASS_HDMI_TX_LEGACY_ADDR(v)) + return true; ++ if (reg == LPASS_HDMI_TX_VBIT_CTL_ADDR(v)) ++ return true; + + for (i = 0; i < v->hdmi_rdma_channels; ++i) { + if (reg == LPAIF_HDMI_RDMACURR_REG(v, i)) + return true; ++ if (reg == LPASS_HDMI_TX_DMA_ADDR(v, i)) ++ return true; ++ if (reg == LPASS_HDMI_TX_CH_LSB_ADDR(v, i)) ++ return true; ++ if (reg == LPASS_HDMI_TX_CH_MSB_ADDR(v, i)) ++ return true; + } + return false; + } +-- +2.35.1 + diff --git a/queue-6.0/asoc-sof-intel-pci-mtl-fix-firmware-name.patch b/queue-6.0/asoc-sof-intel-pci-mtl-fix-firmware-name.patch new file mode 100644 index 00000000000..fbb9d02f645 --- /dev/null +++ b/queue-6.0/asoc-sof-intel-pci-mtl-fix-firmware-name.patch @@ -0,0 +1,45 @@ +From a71e87808273dc24ab8045bf35e29e9c30b742ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 15:40:04 -0500 +Subject: ASoC: SOF: Intel: pci-mtl: fix firmware name + +From: Pierre-Louis Bossart + +[ Upstream commit 73189c064e11137c8b78a825800a374924ebb7b7 ] + +Initial IPC4 tests used the same conventions as previous reference +closed-source firmware, but for MeteorLake the convention is the same +as previous SOF releases (sof-.ri). Only the prefix changes +to avoid confusions between IPC types. + +This change has no impact on users since the firmware has not yet been +released. + +Fixes: 064520e8aeaa2 ("ASoC: SOF: Intel: Add support for MeteorLake (MTL)") +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Chao Song +Reviewed-by: Kai Vehmanen +Reviewed-by: Ranjani Sridharan +Link: https://lore.kernel.org/r/20221017204004.207446-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/pci-mtl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sof/intel/pci-mtl.c b/sound/soc/sof/intel/pci-mtl.c +index 899b00d53d64..9f39da984e9f 100644 +--- a/sound/soc/sof/intel/pci-mtl.c ++++ b/sound/soc/sof/intel/pci-mtl.c +@@ -38,7 +38,7 @@ static const struct sof_dev_desc mtl_desc = { + [SOF_INTEL_IPC4] = "intel/sof-ace-tplg", + }, + .default_fw_filename = { +- [SOF_INTEL_IPC4] = "dsp_basefw.bin", ++ [SOF_INTEL_IPC4] = "sof-mtl.ri", + }, + .nocodec_tplg_filename = "sof-mtl-nocodec.tplg", + .ops = &sof_mtl_ops, +-- +2.35.1 + diff --git a/queue-6.0/asoc-sof-intel-pci-tgl-fix-adl-n-descriptor.patch b/queue-6.0/asoc-sof-intel-pci-tgl-fix-adl-n-descriptor.patch new file mode 100644 index 00000000000..8c63049b1e7 --- /dev/null +++ b/queue-6.0/asoc-sof-intel-pci-tgl-fix-adl-n-descriptor.patch @@ -0,0 +1,75 @@ +From e5ed6d11488098e2b803f9f2a7282f1a6d609541 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 10:49:26 -0500 +Subject: ASoC: SOF: Intel: pci-tgl: fix ADL-N descriptor + +From: Pierre-Louis Bossart + +[ Upstream commit 05de5cf6fb7d73d2bf0a0c882433f31db5c93f63 ] + +ADL-N uses a different signing key, which means we can't reuse the +regular ADL descriptor used for ADL-P/M/S. + +Fixes: cd57eb3c403cb ("ASoC: SOF: Intel: pci-tgl: add ADL-N support") +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Reviewed-by: Chao Song +Reviewed-by: Bard Liao +Link: https://lore.kernel.org/r/20221019154926.163539-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/pci-tgl.c | 30 +++++++++++++++++++++++++++++- + 1 file changed, 29 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/sof/intel/pci-tgl.c b/sound/soc/sof/intel/pci-tgl.c +index aac47cd007e8..4644a78bc95d 100644 +--- a/sound/soc/sof/intel/pci-tgl.c ++++ b/sound/soc/sof/intel/pci-tgl.c +@@ -159,6 +159,34 @@ static const struct sof_dev_desc adl_desc = { + .ops_init = sof_tgl_ops_init, + }; + ++static const struct sof_dev_desc adl_n_desc = { ++ .machines = snd_soc_acpi_intel_adl_machines, ++ .alt_machines = snd_soc_acpi_intel_adl_sdw_machines, ++ .use_acpi_target_states = true, ++ .resindex_lpe_base = 0, ++ .resindex_pcicfg_base = -1, ++ .resindex_imr_base = -1, ++ .irqindex_host_ipc = -1, ++ .chip_info = &tgl_chip_info, ++ .ipc_supported_mask = BIT(SOF_IPC) | BIT(SOF_INTEL_IPC4), ++ .ipc_default = SOF_IPC, ++ .default_fw_path = { ++ [SOF_IPC] = "intel/sof", ++ [SOF_INTEL_IPC4] = "intel/avs/adl-n", ++ }, ++ .default_tplg_path = { ++ [SOF_IPC] = "intel/sof-tplg", ++ [SOF_INTEL_IPC4] = "intel/avs-tplg", ++ }, ++ .default_fw_filename = { ++ [SOF_IPC] = "sof-adl-n.ri", ++ [SOF_INTEL_IPC4] = "dsp_basefw.bin", ++ }, ++ .nocodec_tplg_filename = "sof-adl-nocodec.tplg", ++ .ops = &sof_tgl_ops, ++ .ops_init = sof_tgl_ops_init, ++}; ++ + static const struct sof_dev_desc rpls_desc = { + .machines = snd_soc_acpi_intel_rpl_machines, + .alt_machines = snd_soc_acpi_intel_rpl_sdw_machines, +@@ -242,7 +270,7 @@ static const struct pci_device_id sof_pci_ids[] = { + { PCI_DEVICE(0x8086, 0x51cc), /* ADL-M */ + .driver_data = (unsigned long)&adl_desc}, + { PCI_DEVICE(0x8086, 0x54c8), /* ADL-N */ +- .driver_data = (unsigned long)&adl_desc}, ++ .driver_data = (unsigned long)&adl_n_desc}, + { 0, } + }; + MODULE_DEVICE_TABLE(pci, sof_pci_ids); +-- +2.35.1 + diff --git a/queue-6.0/asoc-sof-intel-pci-tgl-use-rpl-specific-firmware-def.patch b/queue-6.0/asoc-sof-intel-pci-tgl-use-rpl-specific-firmware-def.patch new file mode 100644 index 00000000000..6f3ba6f06b3 --- /dev/null +++ b/queue-6.0/asoc-sof-intel-pci-tgl-use-rpl-specific-firmware-def.patch @@ -0,0 +1,114 @@ +From 6add84dcec515416af7fcac06b49139b3ecc3a29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Aug 2022 16:05:10 +0300 +Subject: ASoC: SOF: Intel: pci-tgl: use RPL specific firmware definitions + +From: Kai Vehmanen + +[ Upstream commit 63d375b9f2a99bb111e3fb5f3e2442a391988949 ] + +Split out firmware definitions for Intel Raptor Lake platforms. + +Signed-off-by: Kai Vehmanen +Reviewed-by: Bard Liao +Reviewed-by: Pierre-Louis Bossart +Suggested-by: Gopal Vamshi Krishna +Link: https://lore.kernel.org/r/20220816130510.190427-2-kai.vehmanen@linux.intel.com +Signed-off-by: Mark Brown +Stable-dep-of: 05de5cf6fb7d ("ASoC: SOF: Intel: pci-tgl: fix ADL-N descriptor") +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/pci-tgl.c | 62 +++++++++++++++++++++++++++++++++-- + 1 file changed, 59 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/sof/intel/pci-tgl.c b/sound/soc/sof/intel/pci-tgl.c +index ccc44ba3ad94..aac47cd007e8 100644 +--- a/sound/soc/sof/intel/pci-tgl.c ++++ b/sound/soc/sof/intel/pci-tgl.c +@@ -159,6 +159,62 @@ static const struct sof_dev_desc adl_desc = { + .ops_init = sof_tgl_ops_init, + }; + ++static const struct sof_dev_desc rpls_desc = { ++ .machines = snd_soc_acpi_intel_rpl_machines, ++ .alt_machines = snd_soc_acpi_intel_rpl_sdw_machines, ++ .use_acpi_target_states = true, ++ .resindex_lpe_base = 0, ++ .resindex_pcicfg_base = -1, ++ .resindex_imr_base = -1, ++ .irqindex_host_ipc = -1, ++ .chip_info = &adls_chip_info, ++ .ipc_supported_mask = BIT(SOF_IPC) | BIT(SOF_INTEL_IPC4), ++ .ipc_default = SOF_IPC, ++ .default_fw_path = { ++ [SOF_IPC] = "intel/sof", ++ [SOF_INTEL_IPC4] = "intel/avs/rpl-s", ++ }, ++ .default_tplg_path = { ++ [SOF_IPC] = "intel/sof-tplg", ++ [SOF_INTEL_IPC4] = "intel/avs-tplg", ++ }, ++ .default_fw_filename = { ++ [SOF_IPC] = "sof-rpl-s.ri", ++ [SOF_INTEL_IPC4] = "dsp_basefw.bin", ++ }, ++ .nocodec_tplg_filename = "sof-rpl-nocodec.tplg", ++ .ops = &sof_tgl_ops, ++ .ops_init = sof_tgl_ops_init, ++}; ++ ++static const struct sof_dev_desc rpl_desc = { ++ .machines = snd_soc_acpi_intel_rpl_machines, ++ .alt_machines = snd_soc_acpi_intel_rpl_sdw_machines, ++ .use_acpi_target_states = true, ++ .resindex_lpe_base = 0, ++ .resindex_pcicfg_base = -1, ++ .resindex_imr_base = -1, ++ .irqindex_host_ipc = -1, ++ .chip_info = &tgl_chip_info, ++ .ipc_supported_mask = BIT(SOF_IPC) | BIT(SOF_INTEL_IPC4), ++ .ipc_default = SOF_IPC, ++ .default_fw_path = { ++ [SOF_IPC] = "intel/sof", ++ [SOF_INTEL_IPC4] = "intel/avs/rpl", ++ }, ++ .default_tplg_path = { ++ [SOF_IPC] = "intel/sof-tplg", ++ [SOF_INTEL_IPC4] = "intel/avs-tplg", ++ }, ++ .default_fw_filename = { ++ [SOF_IPC] = "sof-rpl.ri", ++ [SOF_INTEL_IPC4] = "dsp_basefw.bin", ++ }, ++ .nocodec_tplg_filename = "sof-rpl-nocodec.tplg", ++ .ops = &sof_tgl_ops, ++ .ops_init = sof_tgl_ops_init, ++}; ++ + /* PCI IDs */ + static const struct pci_device_id sof_pci_ids[] = { + { PCI_DEVICE(0x8086, 0xa0c8), /* TGL-LP */ +@@ -172,7 +228,7 @@ static const struct pci_device_id sof_pci_ids[] = { + { PCI_DEVICE(0x8086, 0x7ad0), /* ADL-S */ + .driver_data = (unsigned long)&adls_desc}, + { PCI_DEVICE(0x8086, 0x7a50), /* RPL-S */ +- .driver_data = (unsigned long)&adls_desc}, ++ .driver_data = (unsigned long)&rpls_desc}, + { PCI_DEVICE(0x8086, 0x51c8), /* ADL-P */ + .driver_data = (unsigned long)&adl_desc}, + { PCI_DEVICE(0x8086, 0x51cd), /* ADL-P */ +@@ -180,9 +236,9 @@ static const struct pci_device_id sof_pci_ids[] = { + { PCI_DEVICE(0x8086, 0x51c9), /* ADL-PS */ + .driver_data = (unsigned long)&adl_desc}, + { PCI_DEVICE(0x8086, 0x51ca), /* RPL-P */ +- .driver_data = (unsigned long)&adl_desc}, ++ .driver_data = (unsigned long)&rpl_desc}, + { PCI_DEVICE(0x8086, 0x51cb), /* RPL-P */ +- .driver_data = (unsigned long)&adl_desc}, ++ .driver_data = (unsigned long)&rpl_desc}, + { PCI_DEVICE(0x8086, 0x51cc), /* ADL-M */ + .driver_data = (unsigned long)&adl_desc}, + { PCI_DEVICE(0x8086, 0x54c8), /* ADL-N */ +-- +2.35.1 + diff --git a/queue-6.0/atlantic-fix-deadlock-at-aq_nic_stop.patch b/queue-6.0/atlantic-fix-deadlock-at-aq_nic_stop.patch new file mode 100644 index 00000000000..bb128c8f26b --- /dev/null +++ b/queue-6.0/atlantic-fix-deadlock-at-aq_nic_stop.patch @@ -0,0 +1,250 @@ +From aac008b7b55b24a1d1a3922f91d30a2c141c762f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Oct 2022 09:53:10 +0200 +Subject: atlantic: fix deadlock at aq_nic_stop +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Íñigo Huguet + +[ Upstream commit 6960d133f66ecddcd3af2b1cbd0c7dcd104268b8 ] + +NIC is stopped with rtnl_lock held, and during the stop it cancels the +'service_task' work and free irqs. + +However, if CONFIG_MACSEC is set, rtnl_lock is acquired both from +aq_nic_service_task and aq_linkstate_threaded_isr. Then a deadlock +happens if aq_nic_stop tries to cancel/disable them when they've already +started their execution. + +As the deadlock is caused by rtnl_lock, it causes many other processes +to stall, not only atlantic related stuff. + +Fix it by introducing a mutex that protects each NIC's macsec related +data, and locking it instead of the rtnl_lock from the service task and +the threaded IRQ. + +Before this patch, all macsec data was protected with rtnl_lock, but +maybe not all of it needs to be protected. With this new mutex, further +efforts can be made to limit the protected data only to that which +requires it. However, probably it doesn't worth it because all macsec's +data accesses are infrequent, and almost all are done from macsec_ops +or ethtool callbacks, called holding rtnl_lock, so macsec_mutex won't +never be much contended. + +The issue appeared repeteadly attaching and deattaching the NIC to a +bond interface. Doing that after this patch I cannot reproduce the bug. + +Fixes: 62c1c2e606f6 ("net: atlantic: MACSec offload skeleton") +Reported-by: Li Liang +Suggested-by: Andrew Lunn +Signed-off-by: Íñigo Huguet +Reviewed-by: Igor Russkikh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/aquantia/atlantic/aq_macsec.c | 96 ++++++++++++++----- + .../net/ethernet/aquantia/atlantic/aq_nic.h | 2 + + 2 files changed, 74 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_macsec.c b/drivers/net/ethernet/aquantia/atlantic/aq_macsec.c +index 02058fe79f52..8b53d6688a4b 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_macsec.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_macsec.c +@@ -1451,26 +1451,57 @@ static void aq_check_txsa_expiration(struct aq_nic_s *nic) + egress_sa_threshold_expired); + } + ++#define AQ_LOCKED_MDO_DEF(mdo) \ ++static int aq_locked_mdo_##mdo(struct macsec_context *ctx) \ ++{ \ ++ struct aq_nic_s *nic = netdev_priv(ctx->netdev); \ ++ int ret; \ ++ mutex_lock(&nic->macsec_mutex); \ ++ ret = aq_mdo_##mdo(ctx); \ ++ mutex_unlock(&nic->macsec_mutex); \ ++ return ret; \ ++} ++ ++AQ_LOCKED_MDO_DEF(dev_open) ++AQ_LOCKED_MDO_DEF(dev_stop) ++AQ_LOCKED_MDO_DEF(add_secy) ++AQ_LOCKED_MDO_DEF(upd_secy) ++AQ_LOCKED_MDO_DEF(del_secy) ++AQ_LOCKED_MDO_DEF(add_rxsc) ++AQ_LOCKED_MDO_DEF(upd_rxsc) ++AQ_LOCKED_MDO_DEF(del_rxsc) ++AQ_LOCKED_MDO_DEF(add_rxsa) ++AQ_LOCKED_MDO_DEF(upd_rxsa) ++AQ_LOCKED_MDO_DEF(del_rxsa) ++AQ_LOCKED_MDO_DEF(add_txsa) ++AQ_LOCKED_MDO_DEF(upd_txsa) ++AQ_LOCKED_MDO_DEF(del_txsa) ++AQ_LOCKED_MDO_DEF(get_dev_stats) ++AQ_LOCKED_MDO_DEF(get_tx_sc_stats) ++AQ_LOCKED_MDO_DEF(get_tx_sa_stats) ++AQ_LOCKED_MDO_DEF(get_rx_sc_stats) ++AQ_LOCKED_MDO_DEF(get_rx_sa_stats) ++ + const struct macsec_ops aq_macsec_ops = { +- .mdo_dev_open = aq_mdo_dev_open, +- .mdo_dev_stop = aq_mdo_dev_stop, +- .mdo_add_secy = aq_mdo_add_secy, +- .mdo_upd_secy = aq_mdo_upd_secy, +- .mdo_del_secy = aq_mdo_del_secy, +- .mdo_add_rxsc = aq_mdo_add_rxsc, +- .mdo_upd_rxsc = aq_mdo_upd_rxsc, +- .mdo_del_rxsc = aq_mdo_del_rxsc, +- .mdo_add_rxsa = aq_mdo_add_rxsa, +- .mdo_upd_rxsa = aq_mdo_upd_rxsa, +- .mdo_del_rxsa = aq_mdo_del_rxsa, +- .mdo_add_txsa = aq_mdo_add_txsa, +- .mdo_upd_txsa = aq_mdo_upd_txsa, +- .mdo_del_txsa = aq_mdo_del_txsa, +- .mdo_get_dev_stats = aq_mdo_get_dev_stats, +- .mdo_get_tx_sc_stats = aq_mdo_get_tx_sc_stats, +- .mdo_get_tx_sa_stats = aq_mdo_get_tx_sa_stats, +- .mdo_get_rx_sc_stats = aq_mdo_get_rx_sc_stats, +- .mdo_get_rx_sa_stats = aq_mdo_get_rx_sa_stats, ++ .mdo_dev_open = aq_locked_mdo_dev_open, ++ .mdo_dev_stop = aq_locked_mdo_dev_stop, ++ .mdo_add_secy = aq_locked_mdo_add_secy, ++ .mdo_upd_secy = aq_locked_mdo_upd_secy, ++ .mdo_del_secy = aq_locked_mdo_del_secy, ++ .mdo_add_rxsc = aq_locked_mdo_add_rxsc, ++ .mdo_upd_rxsc = aq_locked_mdo_upd_rxsc, ++ .mdo_del_rxsc = aq_locked_mdo_del_rxsc, ++ .mdo_add_rxsa = aq_locked_mdo_add_rxsa, ++ .mdo_upd_rxsa = aq_locked_mdo_upd_rxsa, ++ .mdo_del_rxsa = aq_locked_mdo_del_rxsa, ++ .mdo_add_txsa = aq_locked_mdo_add_txsa, ++ .mdo_upd_txsa = aq_locked_mdo_upd_txsa, ++ .mdo_del_txsa = aq_locked_mdo_del_txsa, ++ .mdo_get_dev_stats = aq_locked_mdo_get_dev_stats, ++ .mdo_get_tx_sc_stats = aq_locked_mdo_get_tx_sc_stats, ++ .mdo_get_tx_sa_stats = aq_locked_mdo_get_tx_sa_stats, ++ .mdo_get_rx_sc_stats = aq_locked_mdo_get_rx_sc_stats, ++ .mdo_get_rx_sa_stats = aq_locked_mdo_get_rx_sa_stats, + }; + + int aq_macsec_init(struct aq_nic_s *nic) +@@ -1492,6 +1523,7 @@ int aq_macsec_init(struct aq_nic_s *nic) + + nic->ndev->features |= NETIF_F_HW_MACSEC; + nic->ndev->macsec_ops = &aq_macsec_ops; ++ mutex_init(&nic->macsec_mutex); + + return 0; + } +@@ -1515,7 +1547,7 @@ int aq_macsec_enable(struct aq_nic_s *nic) + if (!nic->macsec_cfg) + return 0; + +- rtnl_lock(); ++ mutex_lock(&nic->macsec_mutex); + + if (nic->aq_fw_ops->send_macsec_req) { + struct macsec_cfg_request cfg = { 0 }; +@@ -1564,7 +1596,7 @@ int aq_macsec_enable(struct aq_nic_s *nic) + ret = aq_apply_macsec_cfg(nic); + + unlock: +- rtnl_unlock(); ++ mutex_unlock(&nic->macsec_mutex); + return ret; + } + +@@ -1576,9 +1608,9 @@ void aq_macsec_work(struct aq_nic_s *nic) + if (!netif_carrier_ok(nic->ndev)) + return; + +- rtnl_lock(); ++ mutex_lock(&nic->macsec_mutex); + aq_check_txsa_expiration(nic); +- rtnl_unlock(); ++ mutex_unlock(&nic->macsec_mutex); + } + + int aq_macsec_rx_sa_cnt(struct aq_nic_s *nic) +@@ -1589,21 +1621,30 @@ int aq_macsec_rx_sa_cnt(struct aq_nic_s *nic) + if (!cfg) + return 0; + ++ mutex_lock(&nic->macsec_mutex); ++ + for (i = 0; i < AQ_MACSEC_MAX_SC; i++) { + if (!test_bit(i, &cfg->rxsc_idx_busy)) + continue; + cnt += hweight_long(cfg->aq_rxsc[i].rx_sa_idx_busy); + } + ++ mutex_unlock(&nic->macsec_mutex); + return cnt; + } + + int aq_macsec_tx_sc_cnt(struct aq_nic_s *nic) + { ++ int cnt; ++ + if (!nic->macsec_cfg) + return 0; + +- return hweight_long(nic->macsec_cfg->txsc_idx_busy); ++ mutex_lock(&nic->macsec_mutex); ++ cnt = hweight_long(nic->macsec_cfg->txsc_idx_busy); ++ mutex_unlock(&nic->macsec_mutex); ++ ++ return cnt; + } + + int aq_macsec_tx_sa_cnt(struct aq_nic_s *nic) +@@ -1614,12 +1655,15 @@ int aq_macsec_tx_sa_cnt(struct aq_nic_s *nic) + if (!cfg) + return 0; + ++ mutex_lock(&nic->macsec_mutex); ++ + for (i = 0; i < AQ_MACSEC_MAX_SC; i++) { + if (!test_bit(i, &cfg->txsc_idx_busy)) + continue; + cnt += hweight_long(cfg->aq_txsc[i].tx_sa_idx_busy); + } + ++ mutex_unlock(&nic->macsec_mutex); + return cnt; + } + +@@ -1691,6 +1735,8 @@ u64 *aq_macsec_get_stats(struct aq_nic_s *nic, u64 *data) + if (!cfg) + return data; + ++ mutex_lock(&nic->macsec_mutex); ++ + aq_macsec_update_stats(nic); + + common_stats = &cfg->stats; +@@ -1773,5 +1819,7 @@ u64 *aq_macsec_get_stats(struct aq_nic_s *nic, u64 *data) + + data += i; + ++ mutex_unlock(&nic->macsec_mutex); ++ + return data; + } +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h +index 935ba889bd9a..ad33f8586532 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h +@@ -157,6 +157,8 @@ struct aq_nic_s { + struct mutex fwreq_mutex; + #if IS_ENABLED(CONFIG_MACSEC) + struct aq_macsec_cfg *macsec_cfg; ++ /* mutex to protect data in macsec_cfg */ ++ struct mutex macsec_mutex; + #endif + /* PTP support */ + struct aq_ptp_s *aq_ptp; +-- +2.35.1 + diff --git a/queue-6.0/bpf-prevent-decl_tag-from-being-referenced-in-func_p.patch b/queue-6.0/bpf-prevent-decl_tag-from-being-referenced-in-func_p.patch new file mode 100644 index 00000000000..a5b80d4ff19 --- /dev/null +++ b/queue-6.0/bpf-prevent-decl_tag-from-being-referenced-in-func_p.patch @@ -0,0 +1,99 @@ +From 2716bbb033c40f0af5d97e1c7f18f5c1aad6ffca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Oct 2022 17:24:44 -0700 +Subject: bpf: prevent decl_tag from being referenced in func_proto + +From: Stanislav Fomichev + +[ Upstream commit ea68376c8bed5cd156900852aada20c3a0874d17 ] + +Syzkaller was able to hit the following issue: + +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 3609 at kernel/bpf/btf.c:1946 +btf_type_id_size+0x2d5/0x9d0 kernel/bpf/btf.c:1946 +Modules linked in: +CPU: 0 PID: 3609 Comm: syz-executor361 Not tainted +6.0.0-syzkaller-02734-g0326074ff465 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS +Google 09/22/2022 +RIP: 0010:btf_type_id_size+0x2d5/0x9d0 kernel/bpf/btf.c:1946 +Code: ef e8 7f 8e e4 ff 41 83 ff 0b 77 28 f6 44 24 10 18 75 3f e8 6d 91 +e4 ff 44 89 fe bf 0e 00 00 00 e8 20 8e e4 ff e8 5b 91 e4 ff <0f> 0b 45 +31 f6 e9 98 02 00 00 41 83 ff 12 74 18 e8 46 91 e4 ff 44 +RSP: 0018:ffffc90003cefb40 EFLAGS: 00010293 +RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 +RDX: ffff8880259c0000 RSI: ffffffff81968415 RDI: 0000000000000005 +RBP: ffff88801270ca00 R08: 0000000000000005 R09: 000000000000000e +R10: 0000000000000011 R11: 0000000000000000 R12: 0000000000000000 +R13: 0000000000000011 R14: ffff888026ee6424 R15: 0000000000000011 +FS: 000055555641b300(0000) GS:ffff8880b9a00000(0000) +knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000f2e258 CR3: 000000007110e000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + btf_func_proto_check kernel/bpf/btf.c:4447 [inline] + btf_check_all_types kernel/bpf/btf.c:4723 [inline] + btf_parse_type_sec kernel/bpf/btf.c:4752 [inline] + btf_parse kernel/bpf/btf.c:5026 [inline] + btf_new_fd+0x1926/0x1e70 kernel/bpf/btf.c:6892 + bpf_btf_load kernel/bpf/syscall.c:4324 [inline] + __sys_bpf+0xb7d/0x4cf0 kernel/bpf/syscall.c:5010 + __do_sys_bpf kernel/bpf/syscall.c:5069 [inline] + __se_sys_bpf kernel/bpf/syscall.c:5067 [inline] + __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:5067 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7f0fbae41c69 +Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 +f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 +f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007ffc8aeb6228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0fbae41c69 +RDX: 0000000000000020 RSI: 0000000020000140 RDI: 0000000000000012 +RBP: 00007f0fbae05e10 R08: 0000000000000000 R09: 0000000000000000 +R10: 00000000ffffffff R11: 0000000000000246 R12: 00007f0fbae05ea0 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + + +Looks like it tries to create a func_proto which return type is +decl_tag. For the details, see Martin's spot on analysis in [0]. + +0: https://lore.kernel.org/bpf/CAKH8qBuQDLva_hHxxBuZzyAcYNO4ejhovz6TQeVSk8HY-2SO6g@mail.gmail.com/T/#mea6524b3fcd6298347432226e81b1e6155efc62c + +Cc: Yonghong Song +Cc: Martin KaFai Lau +Fixes: bd16dee66ae4 ("bpf: Add BTF_KIND_DECL_TAG typedef support") +Reported-by: syzbot+d8bd751aef7c6b39a344@syzkaller.appspotmail.com +Signed-off-by: Stanislav Fomichev +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20221015002444.2680969-2-sdf@google.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index 36fd4b509294..0d23d4bcd81c 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -4436,6 +4436,11 @@ static int btf_func_proto_check(struct btf_verifier_env *env, + return -EINVAL; + } + ++ if (btf_type_is_resolve_source_only(ret_type)) { ++ btf_verifier_log_type(env, t, "Invalid return type"); ++ return -EINVAL; ++ } ++ + if (btf_type_needs_resolve(ret_type) && + !env_type_is_resolved(env, ret_type_id)) { + err = btf_resolve(env, ret_type, ret_type_id); +-- +2.35.1 + diff --git a/queue-6.0/can-mcp251x-mcp251x_can_probe-add-missing-unregister.patch b/queue-6.0/can-mcp251x-mcp251x_can_probe-add-missing-unregister.patch new file mode 100644 index 00000000000..6fa8ebef23f --- /dev/null +++ b/queue-6.0/can-mcp251x-mcp251x_can_probe-add-missing-unregister.patch @@ -0,0 +1,48 @@ +From 7b67eaf7416c8797d5a776f44589bc1ced5e03a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 17:02:52 +0800 +Subject: can: mcp251x: mcp251x_can_probe(): add missing unregister_candev() in + error path + +From: Dongliang Mu + +[ Upstream commit b1a09b63684cea56774786ca14c13b7041ffee63 ] + +In mcp251x_can_probe(), if mcp251x_gpio_setup() fails, it forgets to +unregister the CAN device. + +Fix this by unregistering can device in mcp251x_can_probe(). + +Fixes: 2d52dabbef60 ("can: mcp251x: add GPIO support") +Signed-off-by: Dongliang Mu +Link: https://lore.kernel.org/all/20221024090256.717236-1-dzm91@hust.edu.cn +[mkl: adjust label] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/spi/mcp251x.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c +index c320de474f40..24883a65ca66 100644 +--- a/drivers/net/can/spi/mcp251x.c ++++ b/drivers/net/can/spi/mcp251x.c +@@ -1415,11 +1415,14 @@ static int mcp251x_can_probe(struct spi_device *spi) + + ret = mcp251x_gpio_setup(priv); + if (ret) +- goto error_probe; ++ goto out_unregister_candev; + + netdev_info(net, "MCP%x successfully initialized.\n", priv->model); + return 0; + ++out_unregister_candev: ++ unregister_candev(net); ++ + error_probe: + destroy_workqueue(priv->wq); + priv->wq = NULL; +-- +2.35.1 + diff --git a/queue-6.0/can-mscan-mpc5xxx-mpc5xxx_can_probe-add-missing-put_.patch b/queue-6.0/can-mscan-mpc5xxx-mpc5xxx_can_probe-add-missing-put_.patch new file mode 100644 index 00000000000..2ea84fe091f --- /dev/null +++ b/queue-6.0/can-mscan-mpc5xxx-mpc5xxx_can_probe-add-missing-put_.patch @@ -0,0 +1,60 @@ +From cb2779abef41478a3b6880510cce7ef27717d66c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 19:48:07 +0800 +Subject: can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in + error path + +From: Dongliang Mu + +[ Upstream commit 3e5b3418827cefb5e1cc658806f02965791b8f07 ] + +The commit 1149108e2fbf ("can: mscan: improve clock API use") only +adds put_clock() in mpc5xxx_can_remove() function, forgetting to add +put_clock() in the error handling code. + +Fix this bug by adding put_clock() in the error handling code. + +Fixes: 1149108e2fbf ("can: mscan: improve clock API use") +Signed-off-by: Dongliang Mu +Link: https://lore.kernel.org/all/20221024133828.35881-1-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/mscan/mpc5xxx_can.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/can/mscan/mpc5xxx_can.c b/drivers/net/can/mscan/mpc5xxx_can.c +index c469b2f3e57d..b0ed798ae70f 100644 +--- a/drivers/net/can/mscan/mpc5xxx_can.c ++++ b/drivers/net/can/mscan/mpc5xxx_can.c +@@ -322,14 +322,14 @@ static int mpc5xxx_can_probe(struct platform_device *ofdev) + &mscan_clksrc); + if (!priv->can.clock.freq) { + dev_err(&ofdev->dev, "couldn't get MSCAN clock properties\n"); +- goto exit_free_mscan; ++ goto exit_put_clock; + } + + err = register_mscandev(dev, mscan_clksrc); + if (err) { + dev_err(&ofdev->dev, "registering %s failed (err=%d)\n", + DRV_NAME, err); +- goto exit_free_mscan; ++ goto exit_put_clock; + } + + dev_info(&ofdev->dev, "MSCAN at 0x%p, irq %d, clock %d Hz\n", +@@ -337,7 +337,9 @@ static int mpc5xxx_can_probe(struct platform_device *ofdev) + + return 0; + +-exit_free_mscan: ++exit_put_clock: ++ if (data->put_clock) ++ data->put_clock(ofdev); + free_candev(dev); + exit_dispose_irq: + irq_dispose_mapping(irq); +-- +2.35.1 + diff --git a/queue-6.0/drm-amdkfd-fix-memory-leak-in-kfd_mem_dmamap_userptr.patch b/queue-6.0/drm-amdkfd-fix-memory-leak-in-kfd_mem_dmamap_userptr.patch new file mode 100644 index 00000000000..f06d4d53c02 --- /dev/null +++ b/queue-6.0/drm-amdkfd-fix-memory-leak-in-kfd_mem_dmamap_userptr.patch @@ -0,0 +1,48 @@ +From 7772decb6ae7f9b59535725c34fc65dbe2e097d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 22:27:50 -0300 +Subject: drm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr() + +From: Rafael Mendonca + +[ Upstream commit 90bfee142af0f0e9d3bec80e7acd5f49b230acf7 ] + +If the number of pages from the userptr BO differs from the SG BO then the +allocated memory for the SG table doesn't get freed before returning +-EINVAL, which may lead to a memory leak in some error paths. Fix this by +checking the number of pages before allocating memory for the SG table. + +Fixes: 264fb4d332f5 ("drm/amdgpu: Add multi-GPU DMA mapping helpers") +Signed-off-by: Rafael Mendonca +Reviewed-by: Felix Kuehling +Signed-off-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +index 2170db83e41d..93ad00453f4b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +@@ -509,13 +509,13 @@ kfd_mem_dmamap_userptr(struct kgd_mem *mem, + struct ttm_tt *ttm = bo->tbo.ttm; + int ret; + ++ if (WARN_ON(ttm->num_pages != src_ttm->num_pages)) ++ return -EINVAL; ++ + ttm->sg = kmalloc(sizeof(*ttm->sg), GFP_KERNEL); + if (unlikely(!ttm->sg)) + return -ENOMEM; + +- if (WARN_ON(ttm->num_pages != src_ttm->num_pages)) +- return -EINVAL; +- + /* Same sequence as in amdgpu_ttm_tt_pin_userptr */ + ret = sg_alloc_table_from_pages(ttm->sg, src_ttm->pages, + ttm->num_pages, 0, +-- +2.35.1 + diff --git a/queue-6.0/drm-bridge-ps8640-add-back-the-50-ms-mystery-delay-a.patch b/queue-6.0/drm-bridge-ps8640-add-back-the-50-ms-mystery-delay-a.patch new file mode 100644 index 00000000000..a635ce23b8a --- /dev/null +++ b/queue-6.0/drm-bridge-ps8640-add-back-the-50-ms-mystery-delay-a.patch @@ -0,0 +1,115 @@ +From 50fff0af1d1f6da691db8cf14a1df3db374153e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 12:18:51 -0700 +Subject: drm/bridge: ps8640: Add back the 50 ms mystery delay after HPD + +From: Douglas Anderson + +[ Upstream commit cb8e30ddb7e345867f6f2da8a08291d7d9e037db ] + +Back in commit 826cff3f7ebb ("drm/bridge: parade-ps8640: Enable +runtime power management") we removed a mysterious 50 ms delay because +"Parade's support [couldn't] explain what the delay [was] for". + +While I'm always a fan of removing mysterious delays, I suspect that +we need this mysterious delay to avoid some problems. + +Specifically, what I found recently is that on sc7180-trogdor-homestar +sometimes the AUX backlight wasn't initializing properly. Some +debugging showed that the drm_dp_dpcd_read() function that the AUX +backlight driver was calling was returning bogus data about 1% of the +time when I booted up. This confused +drm_panel_dp_aux_backlight(). From continued debugging: +- If I retried the read then the read worked just fine. +- If I added a loop to perform the same read that + drm_panel_dp_aux_backlight() was doing 30 times at bootup I could + see that some percentage of the time the first read would give bogus + data but all 29 additional reads would always be fine. +- If I added a large delay _after_ powering on the panel but before + powering on PS8640 I could still reproduce the problem. +- If I added a delay after PS8640 powered on then I couldn't reproduce + the problem. +- I couldn't reproduce the problem on a board with the same panel but + the ti-sn65dsi86 bridge chip. + +To me, the above indicated that there was a problem with PS8640 and +not the panel. + +I don't really have any insight into what's going on in the MCU, but +my best guess is that when the MCU itself sees the HPD go high that it +does some AUX transfers itself and this is confusing things. + +Let's go back and add back in the mysterious 50 ms delay. We only want +to do this the first time we see HPD go high after booting the MCU, +not every time we double-check HPD. + +With this, the backlight initializes reliably on homestar. + +Fixes: 826cff3f7ebb ("drm/bridge: parade-ps8640: Enable runtime power management") +Reviewed-by: Stephen Boyd +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20221017121813.1.I59700c745fbc31559a5d5c8e2a960279c751dbd5@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/parade-ps8640.c | 25 +++++++++++++++++++++++-- + 1 file changed, 23 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/parade-ps8640.c b/drivers/gpu/drm/bridge/parade-ps8640.c +index 49107a6cdac1..0dacbdb49a30 100644 +--- a/drivers/gpu/drm/bridge/parade-ps8640.c ++++ b/drivers/gpu/drm/bridge/parade-ps8640.c +@@ -105,6 +105,7 @@ struct ps8640 { + struct gpio_desc *gpio_powerdown; + struct device_link *link; + bool pre_enabled; ++ bool need_post_hpd_delay; + }; + + static const struct regmap_config ps8640_regmap_config[] = { +@@ -173,14 +174,31 @@ static int _ps8640_wait_hpd_asserted(struct ps8640 *ps_bridge, unsigned long wai + { + struct regmap *map = ps_bridge->regmap[PAGE2_TOP_CNTL]; + int status; ++ int ret; + + /* + * Apparently something about the firmware in the chip signals that + * HPD goes high by reporting GPIO9 as high (even though HPD isn't + * actually connected to GPIO9). + */ +- return regmap_read_poll_timeout(map, PAGE2_GPIO_H, status, +- status & PS_GPIO9, wait_us / 10, wait_us); ++ ret = regmap_read_poll_timeout(map, PAGE2_GPIO_H, status, ++ status & PS_GPIO9, wait_us / 10, wait_us); ++ ++ /* ++ * The first time we see HPD go high after a reset we delay an extra ++ * 50 ms. The best guess is that the MCU is doing "stuff" during this ++ * time (maybe talking to the panel) and we don't want to interrupt it. ++ * ++ * No locking is done around "need_post_hpd_delay". If we're here we ++ * know we're holding a PM Runtime reference and the only other place ++ * that touches this is PM Runtime resume. ++ */ ++ if (!ret && ps_bridge->need_post_hpd_delay) { ++ ps_bridge->need_post_hpd_delay = false; ++ msleep(50); ++ } ++ ++ return ret; + } + + static int ps8640_wait_hpd_asserted(struct drm_dp_aux *aux, unsigned long wait_us) +@@ -376,6 +394,9 @@ static int __maybe_unused ps8640_resume(struct device *dev) + usleep_range(2000, 2500); + gpiod_set_value(ps_bridge->gpio_reset, 0); + ++ /* We just reset things, so we need a delay after the first HPD */ ++ ps_bridge->need_post_hpd_delay = true; ++ + /* + * Mystery 200 ms delay for the "MCU to be ready". It's unclear if + * this is truly necessary since the MCU will already signal that +-- +2.35.1 + diff --git a/queue-6.0/drm-i915-dgfx-keep-pci-autosuspend-control-on-by-def.patch b/queue-6.0/drm-i915-dgfx-keep-pci-autosuspend-control-on-by-def.patch new file mode 100644 index 00000000000..c4c156c6b32 --- /dev/null +++ b/queue-6.0/drm-i915-dgfx-keep-pci-autosuspend-control-on-by-def.patch @@ -0,0 +1,79 @@ +From 5c1532eb8dcc6e4e9bd72e930c2c7a4c7fab7f4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Oct 2022 17:02:58 +0530 +Subject: drm/i915/dgfx: Keep PCI autosuspend control 'on' by default on all + dGPU + +From: Anshuman Gupta + +[ Upstream commit 62c52eac1ad680fc68ef6d75955127dca46e2740 ] + +DGFX platforms has lmem and cpu can access the lmem objects +via mmap and i915 internal i915_gem_object_pin_map() for +i915 own usages. Both of these methods has pre-requisite +requirement to keep GFX PCI endpoint in D0 for a supported +iomem transaction over PCI link. (Refer PCIe specs 5.3.1.4.1) + +Both DG1/DG2 have a known hardware bug that violates the PCIe specs +and support the iomem read write transaction over PCIe bus despite +endpoint is D3 state. +Due to above H/W bug, we had never observed any issue with i915 runtime +PM versus lmem access. +But this issue becomes visible when PCIe gfx endpoint's upstream +bridge enters to D3, at this point any lmem read/write access will be +returned as unsupported request. But again this issue is not observed +on every platform because it has been observed on few host machines +DG1/DG2 endpoint's upstream bridge does not bind with pcieport driver. +which really disables the PCIe power savings and leaves the bridge +at D0 state. + +We need a unique interface to read/write from lmem with runtime PM +wakeref protection something similar to intel_uncore_{read, write}, +keep autosuspend control to 'on' on all discrete platforms, +until we have a unique interface to read/write from lmem. + +This just change the default autosuspend setting of i915 on dGPU, +user can still change it to 'auto'. + +v2: +- Modified the commit message and subject with more information. +- Changed the Fixes tag to LMEM support commit. [Joonas] +- Changed !HAS_LMEM() Cond to !IS_DGFX(). [Rodrigo] + +Fixes: b908be543e44 ("drm/i915: support creating LMEM objects") +Suggested-by: Rodrigo Vivi +Reviewed-by: Rodrigo Vivi +Signed-off-by: Anshuman Gupta +Link: https://patchwork.freedesktop.org/patch/msgid/20221014113258.1284226-1-anshuman.gupta@intel.com +(cherry picked from commit 66eb93e71a7a6695b7c5eb682e3ca1c980cf9d58) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/intel_runtime_pm.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c +index 6ed5786bcd29..744cca507946 100644 +--- a/drivers/gpu/drm/i915/intel_runtime_pm.c ++++ b/drivers/gpu/drm/i915/intel_runtime_pm.c +@@ -591,8 +591,15 @@ void intel_runtime_pm_enable(struct intel_runtime_pm *rpm) + pm_runtime_use_autosuspend(kdev); + } + +- /* Enable by default */ +- pm_runtime_allow(kdev); ++ /* ++ * FIXME: Temp hammer to keep autosupend disable on lmem supported platforms. ++ * As per PCIe specs 5.3.1.4.1, all iomem read write request over a PCIe ++ * function will be unsupported in case PCIe endpoint function is in D3. ++ * Let's keep i915 autosuspend control 'on' till we fix all known issue ++ * with lmem access in D3. ++ */ ++ if (!IS_DGFX(i915)) ++ pm_runtime_allow(kdev); + + /* + * The core calls the driver load handler with an RPM reference held. +-- +2.35.1 + diff --git a/queue-6.0/drm-i915-dp-reset-frl-trained-flag-before-restarting.patch b/queue-6.0/drm-i915-dp-reset-frl-trained-flag-before-restarting.patch new file mode 100644 index 00000000000..38117fc659a --- /dev/null +++ b/queue-6.0/drm-i915-dp-reset-frl-trained-flag-before-restarting.patch @@ -0,0 +1,47 @@ +From 8189cad46fcdb97502a19dd3d679275465705c13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Oct 2022 12:04:40 +0530 +Subject: drm/i915/dp: Reset frl trained flag before restarting FRL training +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ankit Nautiyal + +[ Upstream commit 63720a561b3c98199adf0c73e152807f15cc3b7f ] + +For cases where DP has HDMI2.1 sink and FRL Link issues are detected, +reset the flag to state FRL trained status before restarting FRL +training. + +Fixes: 9488a030ac91 ("drm/i915: Add support for enabling link status and recovery") +Cc: Swati Sharma +Cc: Ankit Nautiyal +Cc: Uma Shankar (v2) +Cc: Jani Nikula +Signed-off-by: Ankit Nautiyal +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20221011063447.904649-2-ankit.k.nautiyal@intel.com +(cherry picked from commit 47e1a59e60c688c5f95b67277202f05b7e84c189) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_dp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c +index 3ed7eeacc706..d4492b6d23d2 100644 +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -3923,6 +3923,8 @@ intel_dp_handle_hdmi_link_status_change(struct intel_dp *intel_dp) + + drm_dp_pcon_hdmi_frl_link_error_count(&intel_dp->aux, &intel_dp->attached_connector->base); + ++ intel_dp->frl.is_trained = false; ++ + /* Restart FRL training or fall back to TMDS mode */ + intel_dp_check_frl_training(intel_dp); + } +-- +2.35.1 + diff --git a/queue-6.0/drm-msm-a6xx-fix-kvzalloc-vs-state_kcalloc-usage.patch b/queue-6.0/drm-msm-a6xx-fix-kvzalloc-vs-state_kcalloc-usage.patch new file mode 100644 index 00000000000..2f45b83b203 --- /dev/null +++ b/queue-6.0/drm-msm-a6xx-fix-kvzalloc-vs-state_kcalloc-usage.patch @@ -0,0 +1,81 @@ +From 5af5ddbb85e2d04911cf19f61ab5e0ab0a2d4146 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 15:55:13 -0700 +Subject: drm/msm/a6xx: Fix kvzalloc vs state_kcalloc usage + +From: Rob Clark + +[ Upstream commit 83d18e9d9c0150d98dc24e3642ea93f5e245322c ] + +adreno_show_object() is a trap! It will re-allocate the pointer it is +passed on first call, when the data is ascii85 encoded, using kvmalloc/ +kvfree(). Which means the data *passed* to it must be kvmalloc'd, ie. +we cannot use the state_kcalloc() helper. + +This partially reverts commit ec8f1813bf8d ("drm/msm/a6xx: Replace +kcalloc() with kvzalloc()"), but adds the missing kvfree() to fix the +memory leak that was present previously. And adds a warning comment. + +Fixes: ec8f1813bf8d ("drm/msm/a6xx: Replace kcalloc() with kvzalloc()") +Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/20 +Signed-off-by: Rob Clark +Reviewed-by: Chia-I Wu +Reviewed-by: Akhil P Oommen +Patchwork: https://patchwork.freedesktop.org/patch/507014/ +Link: https://lore.kernel.org/r/20221013225520.371226-2-robdclark@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 11 ++++++++++- + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 7 ++++++- + 2 files changed, 16 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +index 3c112a6cc8a2..730355f9e2d4 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +@@ -819,7 +819,7 @@ static struct msm_gpu_state_bo *a6xx_snapshot_gmu_bo( + + snapshot->iova = bo->iova; + snapshot->size = bo->size; +- snapshot->data = state_kcalloc(a6xx_state, 1, snapshot->size); ++ snapshot->data = kvzalloc(snapshot->size, GFP_KERNEL); + if (!snapshot->data) + return NULL; + +@@ -1034,6 +1034,15 @@ static void a6xx_gpu_state_destroy(struct kref *kref) + struct a6xx_gpu_state *a6xx_state = container_of(state, + struct a6xx_gpu_state, base); + ++ if (a6xx_state->gmu_log) ++ kvfree(a6xx_state->gmu_log->data); ++ ++ if (a6xx_state->gmu_hfi) ++ kvfree(a6xx_state->gmu_hfi->data); ++ ++ if (a6xx_state->gmu_debug) ++ kvfree(a6xx_state->gmu_debug->data); ++ + list_for_each_entry_safe(obj, tmp, &a6xx_state->objs, node) + kvfree(obj); + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +index 382fb7f9e497..5a0e8491cd3a 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -729,7 +729,12 @@ static char *adreno_gpu_ascii85_encode(u32 *src, size_t len) + return buf; + } + +-/* len is expected to be in bytes */ ++/* len is expected to be in bytes ++ * ++ * WARNING: *ptr should be allocated with kvmalloc or friends. It can be free'd ++ * with kvfree() and replaced with a newly kvmalloc'd buffer on the first call ++ * when the unencoded raw data is encoded ++ */ + void adreno_show_object(struct drm_printer *p, void **ptr, int len, + bool *encoded) + { +-- +2.35.1 + diff --git a/queue-6.0/drm-msm-a6xx-replace-kcalloc-with-kvzalloc.patch b/queue-6.0/drm-msm-a6xx-replace-kcalloc-with-kvzalloc.patch new file mode 100644 index 00000000000..28babfb4cad --- /dev/null +++ b/queue-6.0/drm-msm-a6xx-replace-kcalloc-with-kvzalloc.patch @@ -0,0 +1,66 @@ +From 039e47d323faf89e060d2740b4bc710b77bb9c84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Sep 2022 12:48:59 +0530 +Subject: drm/msm/a6xx: Replace kcalloc() with kvzalloc() + +From: Akhil P Oommen + +[ Upstream commit ec8f1813bf8d0737898f99a8c1c69df0cde0d7dd ] + +In order to reduce chance of allocation failure while capturing a6xx +gpu state, use kvzalloc() instead of kcalloc() in state_kcalloc(). + +Indirectly, this patch helps to fix leaking memory allocated for +gmu_debug object. + +Fixes: b859f9b009b (drm/msm/gpu: Snapshot GMU debug buffer) +Signed-off-by: Akhil P Oommen +Patchwork: https://patchwork.freedesktop.org/patch/505074/ +Link: https://lore.kernel.org/r/20220928124830.1.I8ea24a8d586b4978823b848adde000f92f74d5c2@changeid +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +index 55f443328d8e..3c112a6cc8a2 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +@@ -91,7 +91,7 @@ struct a6xx_state_memobj { + static void *state_kcalloc(struct a6xx_gpu_state *a6xx_state, int nr, size_t objsize) + { + struct a6xx_state_memobj *obj = +- kzalloc((nr * objsize) + sizeof(*obj), GFP_KERNEL); ++ kvzalloc((nr * objsize) + sizeof(*obj), GFP_KERNEL); + + if (!obj) + return NULL; +@@ -819,7 +819,7 @@ static struct msm_gpu_state_bo *a6xx_snapshot_gmu_bo( + + snapshot->iova = bo->iova; + snapshot->size = bo->size; +- snapshot->data = kvzalloc(snapshot->size, GFP_KERNEL); ++ snapshot->data = state_kcalloc(a6xx_state, 1, snapshot->size); + if (!snapshot->data) + return NULL; + +@@ -1034,14 +1034,8 @@ static void a6xx_gpu_state_destroy(struct kref *kref) + struct a6xx_gpu_state *a6xx_state = container_of(state, + struct a6xx_gpu_state, base); + +- if (a6xx_state->gmu_log) +- kvfree(a6xx_state->gmu_log->data); +- +- if (a6xx_state->gmu_hfi) +- kvfree(a6xx_state->gmu_hfi->data); +- + list_for_each_entry_safe(obj, tmp, &a6xx_state->objs, node) +- kfree(obj); ++ kvfree(obj); + + adreno_gpu_state_destroy(state); + kfree(a6xx_state); +-- +2.35.1 + diff --git a/queue-6.0/drm-msm-dp-add-atomic_check-to-bridge-ops.patch b/queue-6.0/drm-msm-dp-add-atomic_check-to-bridge-ops.patch new file mode 100644 index 00000000000..7f6c835a8b2 --- /dev/null +++ b/queue-6.0/drm-msm-dp-add-atomic_check-to-bridge-ops.patch @@ -0,0 +1,203 @@ +From dd39e404591fc8080050c6db10a82618938224b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Sep 2022 16:36:51 -0700 +Subject: drm/msm/dp: add atomic_check to bridge ops + +From: Kuogee Hsieh + +[ Upstream commit 3a661247967a6f3c99a95a8ba4c8073c5846ea4b ] + +DRM commit_tails() will disable downstream crtc/encoder/bridge if +both disable crtc is required and crtc->active is set before pushing +a new frame downstream. + +There is a rare case that user space display manager issue an extra +screen update immediately followed by close DRM device while down +stream display interface is disabled. This extra screen update will +timeout due to the downstream interface is disabled but will cause +crtc->active be set. Hence the followed commit_tails() called by +drm_release() will pass the disable downstream crtc/encoder/bridge +conditions checking even downstream interface is disabled. +This cause the crash to happen at dp_bridge_disable() due to it trying +to access the main link register to push the idle pattern out while main +link clocks is disabled. + +This patch adds atomic_check to prevent the extra frame will not +be pushed down if display interface is down so that crtc->active +will not be set neither. This will fail the conditions checking +of disabling down stream crtc/encoder/bridge which prevent +drm_release() from calling dp_bridge_disable() so that crash +at dp_bridge_disable() prevented. + +There is no protection in the DRM framework to check if the display +pipeline has been already disabled before trying again. The only +check is the crtc_state->active but this is controlled by usermode +using UAPI. Hence if the usermode sets this and then crashes, the +driver needs to protect against double disable. + +SError Interrupt on CPU7, code 0x00000000be000411 -- SError +CPU: 7 PID: 3878 Comm: Xorg Not tainted 5.19.0-stb-cbq #19 +Hardware name: Google Lazor (rev3 - 8) (DT) +pstate: a04000c9 (NzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : __cmpxchg_case_acq_32+0x14/0x2c +lr : do_raw_spin_lock+0xa4/0xdc +sp : ffffffc01092b6a0 +x29: ffffffc01092b6a0 x28: 0000000000000028 x27: 0000000000000038 +x26: 0000000000000004 x25: ffffffd2973dce48 x24: 0000000000000000 +x23: 00000000ffffffff x22: 00000000ffffffff x21: ffffffd2978d0008 +x20: ffffffd2978d0008 x19: ffffff80ff759fc0 x18: 0000000000000000 +x17: 004800a501260460 x16: 0441043b04600438 x15: 04380000089807d0 +x14: 07b0089807800780 x13: 0000000000000000 x12: 0000000000000000 +x11: 0000000000000438 x10: 00000000000007d0 x9 : ffffffd2973e09e4 +x8 : ffffff8092d53300 x7 : ffffff808902e8b8 x6 : 0000000000000001 +x5 : ffffff808902e880 x4 : 0000000000000000 x3 : ffffff80ff759fc0 +x2 : 0000000000000001 x1 : 0000000000000000 x0 : ffffff80ff759fc0 +Kernel panic - not syncing: Asynchronous SError Interrupt +CPU: 7 PID: 3878 Comm: Xorg Not tainted 5.19.0-stb-cbq #19 +Hardware name: Google Lazor (rev3 - 8) (DT) +Call trace: + dump_backtrace.part.0+0xbc/0xe4 + show_stack+0x24/0x70 + dump_stack_lvl+0x68/0x84 + dump_stack+0x18/0x34 + panic+0x14c/0x32c + nmi_panic+0x58/0x7c + arm64_serror_panic+0x78/0x84 + do_serror+0x40/0x64 + el1h_64_error_handler+0x30/0x48 + el1h_64_error+0x68/0x6c + __cmpxchg_case_acq_32+0x14/0x2c + _raw_spin_lock_irqsave+0x38/0x4c + lock_timer_base+0x40/0x78 + __mod_timer+0xf4/0x25c + schedule_timeout+0xd4/0xfc + __wait_for_common+0xac/0x140 + wait_for_completion_timeout+0x2c/0x54 + dp_ctrl_push_idle+0x40/0x88 + dp_bridge_disable+0x24/0x30 + drm_atomic_bridge_chain_disable+0x90/0xbc + drm_atomic_helper_commit_modeset_disables+0x198/0x444 + msm_atomic_commit_tail+0x1d0/0x374 + commit_tail+0x80/0x108 + drm_atomic_helper_commit+0x118/0x11c + drm_atomic_commit+0xb4/0xe0 + drm_client_modeset_commit_atomic+0x184/0x224 + drm_client_modeset_commit_locked+0x58/0x160 + drm_client_modeset_commit+0x3c/0x64 + __drm_fb_helper_restore_fbdev_mode_unlocked+0x98/0xac + drm_fb_helper_set_par+0x74/0x80 + drm_fb_helper_hotplug_event+0xdc/0xe0 + __drm_fb_helper_restore_fbdev_mode_unlocked+0x7c/0xac + drm_fb_helper_restore_fbdev_mode_unlocked+0x20/0x2c + drm_fb_helper_lastclose+0x20/0x2c + drm_lastclose+0x44/0x6c + drm_release+0x88/0xd4 + __fput+0x104/0x220 + ____fput+0x1c/0x28 + task_work_run+0x8c/0x100 + do_exit+0x450/0x8d0 + do_group_exit+0x40/0xac + __wake_up_parent+0x0/0x38 + invoke_syscall+0x84/0x11c + el0_svc_common.constprop.0+0xb8/0xe4 + do_el0_svc+0x8c/0xb8 + el0_svc+0x2c/0x54 + el0t_64_sync_handler+0x120/0x1c0 + el0t_64_sync+0x190/0x194 +SMP: stopping secondary CPUs +Kernel Offset: 0x128e800000 from 0xffffffc008000000 +PHYS_OFFSET: 0x80000000 +CPU features: 0x800,00c2a015,19801c82 +Memory Limit: none + +Changes in v2: +-- add more commit text + +Changes in v3: +-- add comments into dp_bridge_atomic_check() + +Changes in v4: +-- rewording the comment into dp_bridge_atomic_check() + +Changes in v5: +-- removed quote x at end of commit text + +Changes in v6: +-- removed quote x at end of comment in dp_bridge_atomic_check() + +Fixes: 8a3b4c17f863 ("drm/msm/dp: employ bridge mechanism for display enable and disable") +Reported-by: Leonard Lausen +Suggested-by: Rob Clark +Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/17 +Signed-off-by: Kuogee Hsieh +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/505331/ +Link: https://lore.kernel.org/r/1664408211-25314-1-git-send-email-quic_khsieh@quicinc.com +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dp/dp_drm.c | 34 +++++++++++++++++++++++++++++++++ + 1 file changed, 34 insertions(+) + +diff --git a/drivers/gpu/drm/msm/dp/dp_drm.c b/drivers/gpu/drm/msm/dp/dp_drm.c +index 6df25f7662e7..6db82f9b03af 100644 +--- a/drivers/gpu/drm/msm/dp/dp_drm.c ++++ b/drivers/gpu/drm/msm/dp/dp_drm.c +@@ -31,6 +31,36 @@ static enum drm_connector_status dp_bridge_detect(struct drm_bridge *bridge) + connector_status_disconnected; + } + ++static int dp_bridge_atomic_check(struct drm_bridge *bridge, ++ struct drm_bridge_state *bridge_state, ++ struct drm_crtc_state *crtc_state, ++ struct drm_connector_state *conn_state) ++{ ++ struct msm_dp *dp; ++ ++ dp = to_dp_bridge(bridge)->dp_display; ++ ++ drm_dbg_dp(dp->drm_dev, "is_connected = %s\n", ++ (dp->is_connected) ? "true" : "false"); ++ ++ /* ++ * There is no protection in the DRM framework to check if the display ++ * pipeline has been already disabled before trying to disable it again. ++ * Hence if the sink is unplugged, the pipeline gets disabled, but the ++ * crtc->active is still true. Any attempt to set the mode or manually ++ * disable this encoder will result in the crash. ++ * ++ * TODO: add support for telling the DRM subsystem that the pipeline is ++ * disabled by the hardware and thus all access to it should be forbidden. ++ * After that this piece of code can be removed. ++ */ ++ if (bridge->ops & DRM_BRIDGE_OP_HPD) ++ return (dp->is_connected) ? 0 : -ENOTCONN; ++ ++ return 0; ++} ++ ++ + /** + * dp_bridge_get_modes - callback to add drm modes via drm_mode_probed_add() + * @bridge: Poiner to drm bridge +@@ -61,6 +91,9 @@ static int dp_bridge_get_modes(struct drm_bridge *bridge, struct drm_connector * + } + + static const struct drm_bridge_funcs dp_bridge_ops = { ++ .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state, ++ .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state, ++ .atomic_reset = drm_atomic_helper_bridge_reset, + .enable = dp_bridge_enable, + .disable = dp_bridge_disable, + .post_disable = dp_bridge_post_disable, +@@ -68,6 +101,7 @@ static const struct drm_bridge_funcs dp_bridge_ops = { + .mode_valid = dp_bridge_mode_valid, + .get_modes = dp_bridge_get_modes, + .detect = dp_bridge_detect, ++ .atomic_check = dp_bridge_atomic_check, + }; + + struct drm_bridge *dp_bridge_init(struct msm_dp *dp_display, struct drm_device *dev, +-- +2.35.1 + diff --git a/queue-6.0/drm-msm-dp-cleared-dp_downspread_ctrl-register-befor.patch b/queue-6.0/drm-msm-dp-cleared-dp_downspread_ctrl-register-befor.patch new file mode 100644 index 00000000000..31fcba97508 --- /dev/null +++ b/queue-6.0/drm-msm-dp-cleared-dp_downspread_ctrl-register-befor.patch @@ -0,0 +1,74 @@ +From 7886ef163f3542d5b49591cbb61765a95295caa4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Sep 2022 09:23:48 -0700 +Subject: drm/msm/dp: cleared DP_DOWNSPREAD_CTRL register before start link + training + +From: Kuogee Hsieh + +[ Upstream commit 70445dee1b4cf44c9fecc580dfa08079011866f1 ] + +DOWNSPREAD_CTRL (0x107) shall be cleared to 0 upon power-on reset or an +upstream device disconnect. This patch will enforce this rule by always +cleared DOWNSPREAD_CTRL register to 0 before start link training. At rare +case that DP MSA timing parameters may be mis-interpreted by the sink +which causes audio sampling rate be calculated wrongly and cause audio +did not work at sink if DOWNSPREAD_CTRL register is not cleared to 0. + +Changes in v2: +1) fix spelling at commit text +2) merge ssc variable into encoding[0] + +Changes in v3: +-- correct spelling of DOWNSPREAD_CTRL +-- replace err with len of ssize_t + +Changes in v4: +-- split into 2 patches + +Signed-off-by: Kuogee Hsieh +Reviewed-by: Dmitry Baryshkov +Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") +Patchwork: https://patchwork.freedesktop.org/patch/502532/ +Link: https://lore.kernel.org/r/1662999830-13916-2-git-send-email-quic_khsieh@quicinc.com +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dp/dp_ctrl.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c +index 013ca02e17cb..3ac139a4bbe8 100644 +--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c ++++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c +@@ -1245,8 +1245,7 @@ static int dp_ctrl_link_train(struct dp_ctrl_private *ctrl, + { + int ret = 0; + const u8 *dpcd = ctrl->panel->dpcd; +- u8 encoding = DP_SET_ANSI_8B10B; +- u8 ssc; ++ u8 encoding[] = { 0, DP_SET_ANSI_8B10B }; + u8 assr; + struct dp_link_info link_info = {0}; + +@@ -1258,13 +1257,11 @@ static int dp_ctrl_link_train(struct dp_ctrl_private *ctrl, + + dp_aux_link_configure(ctrl->aux, &link_info); + +- if (drm_dp_max_downspread(dpcd)) { +- ssc = DP_SPREAD_AMP_0_5; +- drm_dp_dpcd_write(ctrl->aux, DP_DOWNSPREAD_CTRL, &ssc, 1); +- } ++ if (drm_dp_max_downspread(dpcd)) ++ encoding[0] |= DP_SPREAD_AMP_0_5; + +- drm_dp_dpcd_write(ctrl->aux, DP_MAIN_LINK_CHANNEL_CODING_SET, +- &encoding, 1); ++ /* config DOWNSPREAD_CTRL and MAIN_LINK_CHANNEL_CODING_SET */ ++ drm_dp_dpcd_write(ctrl->aux, DP_DOWNSPREAD_CTRL, encoding, 2); + + if (drm_dp_alternate_scrambler_reset_cap(dpcd)) { + assr = DP_ALTERNATE_SCRAMBLER_RESET_ENABLE; +-- +2.35.1 + diff --git a/queue-6.0/drm-msm-fix-return-type-of-mdp4_lvds_connector_mode_.patch b/queue-6.0/drm-msm-fix-return-type-of-mdp4_lvds_connector_mode_.patch new file mode 100644 index 00000000000..0fd12233fb8 --- /dev/null +++ b/queue-6.0/drm-msm-fix-return-type-of-mdp4_lvds_connector_mode_.patch @@ -0,0 +1,54 @@ +From 9dcf857dc990a2963fc4f8ee381651e8a2864807 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Sep 2022 13:55:48 -0700 +Subject: drm/msm: Fix return type of mdp4_lvds_connector_mode_valid + +From: Nathan Huckleberry + +[ Upstream commit 0b33a33bd15d5bab73b87152b220a8d0153a4587 ] + +The mode_valid field in drm_connector_helper_funcs is expected to be of +type: +enum drm_mode_status (* mode_valid) (struct drm_connector *connector, + struct drm_display_mode *mode); + +The mismatched return type breaks forward edge kCFI since the underlying +function definition does not match the function hook definition. + +The return type of mdp4_lvds_connector_mode_valid should be changed from +int to enum drm_mode_status. + +Reported-by: Dan Carpenter +Link: https://github.com/ClangBuiltLinux/linux/issues/1703 +Cc: llvm@lists.linux.dev +Signed-off-by: Nathan Huckleberry +Fixes: 3e87599b68e7 ("drm/msm/mdp4: add LVDS panel support") +Reviewed-by: Abhinav Kumar +Reviewed-by: Nathan Chancellor +Patchwork: https://patchwork.freedesktop.org/patch/502878/ +Link: https://lore.kernel.org/r/20220913205551.155128-1-nhuck@google.com +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/mdp4/mdp4_lvds_connector.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_lvds_connector.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_lvds_connector.c +index 7288041dd86a..7444b75c4215 100644 +--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_lvds_connector.c ++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_lvds_connector.c +@@ -56,8 +56,9 @@ static int mdp4_lvds_connector_get_modes(struct drm_connector *connector) + return ret; + } + +-static int mdp4_lvds_connector_mode_valid(struct drm_connector *connector, +- struct drm_display_mode *mode) ++static enum drm_mode_status ++mdp4_lvds_connector_mode_valid(struct drm_connector *connector, ++ struct drm_display_mode *mode) + { + struct mdp4_lvds_connector *mdp4_lvds_connector = + to_mdp4_lvds_connector(connector); +-- +2.35.1 + diff --git a/queue-6.0/erofs-fix-illegal-unmapped-accesses-in-z_erofs_fill_.patch b/queue-6.0/erofs-fix-illegal-unmapped-accesses-in-z_erofs_fill_.patch new file mode 100644 index 00000000000..36c75ceff8f --- /dev/null +++ b/queue-6.0/erofs-fix-illegal-unmapped-accesses-in-z_erofs_fill_.patch @@ -0,0 +1,88 @@ +From b95b03c53efc1eccb1872b52e07549c5cebf4f76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Oct 2022 09:35:28 +0800 +Subject: erofs: fix illegal unmapped accesses in z_erofs_fill_inode_lazy() + +From: Yue Hu + +[ Upstream commit 664609e49f1c84fc97987b2bf64544e586b8849c ] + +Note that we are still accessing 'h_idata_size' and 'h_fragmentoff' +after calling erofs_put_metabuf(), that is not correct. Fix it. + +Fixes: ab92184ff8f1 ("erofs: add on-disk compressed tail-packing inline support") +Fixes: b15b2e307c3a ("erofs: support on-disk compressed fragments data") +Signed-off-by: Yue Hu +Reviewed-by: Gao Xiang +Reviewed-by: Chao Yu +Link: https://lore.kernel.org/r/20221005013528.62977-1-zbestahu@163.com +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +--- + fs/erofs/zmap.c | 17 +++++++---------- + 1 file changed, 7 insertions(+), 10 deletions(-) + +diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c +index d58549ca1df9..63fd2f146026 100644 +--- a/fs/erofs/zmap.c ++++ b/fs/erofs/zmap.c +@@ -61,8 +61,7 @@ static int z_erofs_fill_inode_lazy(struct inode *inode) + + pos = ALIGN(iloc(EROFS_SB(sb), vi->nid) + vi->inode_isize + + vi->xattr_isize, 8); +- kaddr = erofs_read_metabuf(&buf, sb, erofs_blknr(pos), +- EROFS_KMAP_ATOMIC); ++ kaddr = erofs_read_metabuf(&buf, sb, erofs_blknr(pos), EROFS_KMAP); + if (IS_ERR(kaddr)) { + err = PTR_ERR(kaddr); + goto out_unlock; +@@ -79,7 +78,7 @@ static int z_erofs_fill_inode_lazy(struct inode *inode) + erofs_err(sb, "unknown HEAD%u format %u for nid %llu, please upgrade kernel", + headnr + 1, vi->z_algorithmtype[headnr], vi->nid); + err = -EOPNOTSUPP; +- goto unmap_done; ++ goto out_put_metabuf; + } + + vi->z_logical_clusterbits = LOG_BLOCK_SIZE + (h->h_clusterbits & 7); +@@ -89,7 +88,7 @@ static int z_erofs_fill_inode_lazy(struct inode *inode) + erofs_err(sb, "per-inode big pcluster without sb feature for nid %llu", + vi->nid); + err = -EFSCORRUPTED; +- goto unmap_done; ++ goto out_put_metabuf; + } + if (vi->datalayout == EROFS_INODE_FLAT_COMPRESSION && + !(vi->z_advise & Z_EROFS_ADVISE_BIG_PCLUSTER_1) ^ +@@ -97,12 +96,8 @@ static int z_erofs_fill_inode_lazy(struct inode *inode) + erofs_err(sb, "big pcluster head1/2 of compact indexes should be consistent for nid %llu", + vi->nid); + err = -EFSCORRUPTED; +- goto unmap_done; ++ goto out_put_metabuf; + } +-unmap_done: +- erofs_put_metabuf(&buf); +- if (err) +- goto out_unlock; + + if (vi->z_advise & Z_EROFS_ADVISE_INLINE_PCLUSTER) { + struct erofs_map_blocks map = { +@@ -121,11 +116,13 @@ static int z_erofs_fill_inode_lazy(struct inode *inode) + err = -EFSCORRUPTED; + } + if (err < 0) +- goto out_unlock; ++ goto out_put_metabuf; + } + /* paired with smp_mb() at the beginning of the function */ + smp_mb(); + set_bit(EROFS_I_Z_INITED_BIT, &vi->flags); ++out_put_metabuf: ++ erofs_put_metabuf(&buf); + out_unlock: + clear_and_wake_up_bit(EROFS_I_BL_Z_BIT, &vi->flags); + return err; +-- +2.35.1 + diff --git a/queue-6.0/erofs-fix-up-inplace-decompression-success-rate.patch b/queue-6.0/erofs-fix-up-inplace-decompression-success-rate.patch new file mode 100644 index 00000000000..36ba6e9e1cd --- /dev/null +++ b/queue-6.0/erofs-fix-up-inplace-decompression-success-rate.patch @@ -0,0 +1,45 @@ +From 54e2b6b936d837f6ee20ed60a431b8ce3d3ea22f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Oct 2022 14:49:15 +0800 +Subject: erofs: fix up inplace decompression success rate + +From: Gao Xiang + +[ Upstream commit e7933278b442f97809b1ea84264586302bd08a03 ] + +Partial decompression should be checked after updating length. +It's a new regression when introducing multi-reference pclusters. + +Fixes: 2bfab9c0edac ("erofs: record the longest decompressed size in this round") +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Link: https://lore.kernel.org/r/20221014064915.8103-1-hsiangkao@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + fs/erofs/zdata.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c +index 6e663275aeb1..c7511b431776 100644 +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -765,13 +765,13 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe, + if (fe->pcl->pageofs_out != (map->m_la & ~PAGE_MASK)) + fe->pcl->multibases = true; + +- if ((map->m_flags & EROFS_MAP_FULL_MAPPED) && +- fe->pcl->length == map->m_llen) +- fe->pcl->partial = false; + if (fe->pcl->length < offset + end - map->m_la) { + fe->pcl->length = offset + end - map->m_la; + fe->pcl->pageofs_out = map->m_la & ~PAGE_MASK; + } ++ if ((map->m_flags & EROFS_MAP_FULL_MAPPED) && ++ fe->pcl->length == map->m_llen) ++ fe->pcl->partial = false; + next_part: + /* shorten the remaining extent to update progress */ + map->m_llen = offset + cur - map->m_la; +-- +2.35.1 + diff --git a/queue-6.0/i40e-fix-ethtool-rx-flow-hash-setting-for-x722.patch b/queue-6.0/i40e-fix-ethtool-rx-flow-hash-setting-for-x722.patch new file mode 100644 index 00000000000..909c685320d --- /dev/null +++ b/queue-6.0/i40e-fix-ethtool-rx-flow-hash-setting-for-x722.patch @@ -0,0 +1,129 @@ +From 6a76ffa3bb241e8770515047b302e37e10126b1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 03:05:24 -0700 +Subject: i40e: Fix ethtool rx-flow-hash setting for X722 + +From: Slawomir Laba + +[ Upstream commit 54b5af5a438076082d482cab105b1bd484ab5074 ] + +When enabling flow type for RSS hash via ethtool: + +ethtool -N $pf rx-flow-hash tcp4|tcp6|udp4|udp6 s|d + +the driver would fail to setup this setting on X722 +device since it was using the mask on the register +dedicated for X710 devices. + +Apply a different mask on the register when setting the +RSS hash for the X722 device. + +When displaying the flow types enabled via ethtool: + +ethtool -n $pf rx-flow-hash tcp4|tcp6|udp4|udp6 + +the driver would print wrong values for X722 device. + +Fix this issue by testing masks for X722 device in +i40e_get_rss_hash_opts function. + +Fixes: eb0dd6e4a3b3 ("i40e: Allow RSS Hash set with less than four parameters") +Signed-off-by: Slawomir Laba +Signed-off-by: Michal Jaron +Signed-off-by: Mateusz Palczewski +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Jacob Keller +Link: https://lore.kernel.org/r/20221024100526.1874914-1-jacob.e.keller@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/i40e/i40e_ethtool.c | 31 ++++++++++++++----- + drivers/net/ethernet/intel/i40e/i40e_type.h | 4 +++ + 2 files changed, 27 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index af5fe84db596..0f2042f1597c 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -3185,10 +3185,17 @@ static int i40e_get_rss_hash_opts(struct i40e_pf *pf, struct ethtool_rxnfc *cmd) + + if (cmd->flow_type == TCP_V4_FLOW || + cmd->flow_type == UDP_V4_FLOW) { +- if (i_set & I40E_L3_SRC_MASK) +- cmd->data |= RXH_IP_SRC; +- if (i_set & I40E_L3_DST_MASK) +- cmd->data |= RXH_IP_DST; ++ if (hw->mac.type == I40E_MAC_X722) { ++ if (i_set & I40E_X722_L3_SRC_MASK) ++ cmd->data |= RXH_IP_SRC; ++ if (i_set & I40E_X722_L3_DST_MASK) ++ cmd->data |= RXH_IP_DST; ++ } else { ++ if (i_set & I40E_L3_SRC_MASK) ++ cmd->data |= RXH_IP_SRC; ++ if (i_set & I40E_L3_DST_MASK) ++ cmd->data |= RXH_IP_DST; ++ } + } else if (cmd->flow_type == TCP_V6_FLOW || + cmd->flow_type == UDP_V6_FLOW) { + if (i_set & I40E_L3_V6_SRC_MASK) +@@ -3546,12 +3553,15 @@ static int i40e_get_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *cmd, + + /** + * i40e_get_rss_hash_bits - Read RSS Hash bits from register ++ * @hw: hw structure + * @nfc: pointer to user request + * @i_setc: bits currently set + * + * Returns value of bits to be set per user request + **/ +-static u64 i40e_get_rss_hash_bits(struct ethtool_rxnfc *nfc, u64 i_setc) ++static u64 i40e_get_rss_hash_bits(struct i40e_hw *hw, ++ struct ethtool_rxnfc *nfc, ++ u64 i_setc) + { + u64 i_set = i_setc; + u64 src_l3 = 0, dst_l3 = 0; +@@ -3570,8 +3580,13 @@ static u64 i40e_get_rss_hash_bits(struct ethtool_rxnfc *nfc, u64 i_setc) + dst_l3 = I40E_L3_V6_DST_MASK; + } else if (nfc->flow_type == TCP_V4_FLOW || + nfc->flow_type == UDP_V4_FLOW) { +- src_l3 = I40E_L3_SRC_MASK; +- dst_l3 = I40E_L3_DST_MASK; ++ if (hw->mac.type == I40E_MAC_X722) { ++ src_l3 = I40E_X722_L3_SRC_MASK; ++ dst_l3 = I40E_X722_L3_DST_MASK; ++ } else { ++ src_l3 = I40E_L3_SRC_MASK; ++ dst_l3 = I40E_L3_DST_MASK; ++ } + } else { + /* Any other flow type are not supported here */ + return i_set; +@@ -3686,7 +3701,7 @@ static int i40e_set_rss_hash_opt(struct i40e_pf *pf, struct ethtool_rxnfc *nfc) + flow_pctype)) | + ((u64)i40e_read_rx_ctl(hw, I40E_GLQF_HASH_INSET(1, + flow_pctype)) << 32); +- i_set = i40e_get_rss_hash_bits(nfc, i_setc); ++ i_set = i40e_get_rss_hash_bits(&pf->hw, nfc, i_setc); + i40e_write_rx_ctl(hw, I40E_GLQF_HASH_INSET(0, flow_pctype), + (u32)i_set); + i40e_write_rx_ctl(hw, I40E_GLQF_HASH_INSET(1, flow_pctype), +diff --git a/drivers/net/ethernet/intel/i40e/i40e_type.h b/drivers/net/ethernet/intel/i40e/i40e_type.h +index 7b3f30beb757..388c3d36d96a 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_type.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_type.h +@@ -1404,6 +1404,10 @@ struct i40e_lldp_variables { + #define I40E_PFQF_CTL_0_HASHLUTSIZE_512 0x00010000 + + /* INPUT SET MASK for RSS, flow director, and flexible payload */ ++#define I40E_X722_L3_SRC_SHIFT 49 ++#define I40E_X722_L3_SRC_MASK (0x3ULL << I40E_X722_L3_SRC_SHIFT) ++#define I40E_X722_L3_DST_SHIFT 41 ++#define I40E_X722_L3_DST_MASK (0x3ULL << I40E_X722_L3_DST_SHIFT) + #define I40E_L3_SRC_SHIFT 47 + #define I40E_L3_SRC_MASK (0x3ULL << I40E_L3_SRC_SHIFT) + #define I40E_L3_V6_SRC_SHIFT 43 +-- +2.35.1 + diff --git a/queue-6.0/i40e-fix-flow-type-by-setting-gl_hash_inset-register.patch b/queue-6.0/i40e-fix-flow-type-by-setting-gl_hash_inset-register.patch new file mode 100644 index 00000000000..dba5ab57bab --- /dev/null +++ b/queue-6.0/i40e-fix-flow-type-by-setting-gl_hash_inset-register.patch @@ -0,0 +1,144 @@ +From cc4a50150c8ae3ccb2696cdb18fa9688fc9a2b6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 03:05:26 -0700 +Subject: i40e: Fix flow-type by setting GL_HASH_INSET registers + +From: Slawomir Laba + +[ Upstream commit 3b32c9932853e11d71f9db012d69e92e4669ba23 ] + +Fix setting bits for specific flow_type for GLQF_HASH_INSET register. +In previous version all of the bits were set only in hena register, while +in inset only one bit was set. In order for this working correctly on all +types of cards these bits needs to be set correctly for both hena and inset +registers. + +Fixes: eb0dd6e4a3b3 ("i40e: Allow RSS Hash set with less than four parameters") +Signed-off-by: Slawomir Laba +Signed-off-by: Michal Jaron +Signed-off-by: Mateusz Palczewski +Signed-off-by: Jacob Keller +Link: https://lore.kernel.org/r/20221024100526.1874914-3-jacob.e.keller@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/i40e/i40e_ethtool.c | 71 ++++++++++--------- + 1 file changed, 38 insertions(+), 33 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index 0f2042f1597c..6f0d4160ff82 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -3604,6 +3604,7 @@ static u64 i40e_get_rss_hash_bits(struct i40e_hw *hw, + return i_set; + } + ++#define FLOW_PCTYPES_SIZE 64 + /** + * i40e_set_rss_hash_opt - Enable/Disable flow types for RSS hash + * @pf: pointer to the physical function struct +@@ -3616,9 +3617,11 @@ static int i40e_set_rss_hash_opt(struct i40e_pf *pf, struct ethtool_rxnfc *nfc) + struct i40e_hw *hw = &pf->hw; + u64 hena = (u64)i40e_read_rx_ctl(hw, I40E_PFQF_HENA(0)) | + ((u64)i40e_read_rx_ctl(hw, I40E_PFQF_HENA(1)) << 32); +- u8 flow_pctype = 0; ++ DECLARE_BITMAP(flow_pctypes, FLOW_PCTYPES_SIZE); + u64 i_set, i_setc; + ++ bitmap_zero(flow_pctypes, FLOW_PCTYPES_SIZE); ++ + if (pf->flags & I40E_FLAG_MFP_ENABLED) { + dev_err(&pf->pdev->dev, + "Change of RSS hash input set is not supported when MFP mode is enabled\n"); +@@ -3634,36 +3637,35 @@ static int i40e_set_rss_hash_opt(struct i40e_pf *pf, struct ethtool_rxnfc *nfc) + + switch (nfc->flow_type) { + case TCP_V4_FLOW: +- flow_pctype = I40E_FILTER_PCTYPE_NONF_IPV4_TCP; ++ set_bit(I40E_FILTER_PCTYPE_NONF_IPV4_TCP, flow_pctypes); + if (pf->hw_features & I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE) +- hena |= +- BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV4_TCP_SYN_NO_ACK); ++ set_bit(I40E_FILTER_PCTYPE_NONF_IPV4_TCP_SYN_NO_ACK, ++ flow_pctypes); + break; + case TCP_V6_FLOW: +- flow_pctype = I40E_FILTER_PCTYPE_NONF_IPV6_TCP; +- if (pf->hw_features & I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE) +- hena |= +- BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV4_TCP_SYN_NO_ACK); ++ set_bit(I40E_FILTER_PCTYPE_NONF_IPV6_TCP, flow_pctypes); + if (pf->hw_features & I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE) +- hena |= +- BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV6_TCP_SYN_NO_ACK); ++ set_bit(I40E_FILTER_PCTYPE_NONF_IPV6_TCP_SYN_NO_ACK, ++ flow_pctypes); + break; + case UDP_V4_FLOW: +- flow_pctype = I40E_FILTER_PCTYPE_NONF_IPV4_UDP; +- if (pf->hw_features & I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE) +- hena |= +- BIT_ULL(I40E_FILTER_PCTYPE_NONF_UNICAST_IPV4_UDP) | +- BIT_ULL(I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV4_UDP); +- ++ set_bit(I40E_FILTER_PCTYPE_NONF_IPV4_UDP, flow_pctypes); ++ if (pf->hw_features & I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE) { ++ set_bit(I40E_FILTER_PCTYPE_NONF_UNICAST_IPV4_UDP, ++ flow_pctypes); ++ set_bit(I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV4_UDP, ++ flow_pctypes); ++ } + hena |= BIT_ULL(I40E_FILTER_PCTYPE_FRAG_IPV4); + break; + case UDP_V6_FLOW: +- flow_pctype = I40E_FILTER_PCTYPE_NONF_IPV6_UDP; +- if (pf->hw_features & I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE) +- hena |= +- BIT_ULL(I40E_FILTER_PCTYPE_NONF_UNICAST_IPV6_UDP) | +- BIT_ULL(I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV6_UDP); +- ++ set_bit(I40E_FILTER_PCTYPE_NONF_IPV6_UDP, flow_pctypes); ++ if (pf->hw_features & I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE) { ++ set_bit(I40E_FILTER_PCTYPE_NONF_UNICAST_IPV6_UDP, ++ flow_pctypes); ++ set_bit(I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV6_UDP, ++ flow_pctypes); ++ } + hena |= BIT_ULL(I40E_FILTER_PCTYPE_FRAG_IPV6); + break; + case AH_ESP_V4_FLOW: +@@ -3696,17 +3698,20 @@ static int i40e_set_rss_hash_opt(struct i40e_pf *pf, struct ethtool_rxnfc *nfc) + return -EINVAL; + } + +- if (flow_pctype) { +- i_setc = (u64)i40e_read_rx_ctl(hw, I40E_GLQF_HASH_INSET(0, +- flow_pctype)) | +- ((u64)i40e_read_rx_ctl(hw, I40E_GLQF_HASH_INSET(1, +- flow_pctype)) << 32); +- i_set = i40e_get_rss_hash_bits(&pf->hw, nfc, i_setc); +- i40e_write_rx_ctl(hw, I40E_GLQF_HASH_INSET(0, flow_pctype), +- (u32)i_set); +- i40e_write_rx_ctl(hw, I40E_GLQF_HASH_INSET(1, flow_pctype), +- (u32)(i_set >> 32)); +- hena |= BIT_ULL(flow_pctype); ++ if (bitmap_weight(flow_pctypes, FLOW_PCTYPES_SIZE)) { ++ u8 flow_id; ++ ++ for_each_set_bit(flow_id, flow_pctypes, FLOW_PCTYPES_SIZE) { ++ i_setc = (u64)i40e_read_rx_ctl(hw, I40E_GLQF_HASH_INSET(0, flow_id)) | ++ ((u64)i40e_read_rx_ctl(hw, I40E_GLQF_HASH_INSET(1, flow_id)) << 32); ++ i_set = i40e_get_rss_hash_bits(&pf->hw, nfc, i_setc); ++ ++ i40e_write_rx_ctl(hw, I40E_GLQF_HASH_INSET(0, flow_id), ++ (u32)i_set); ++ i40e_write_rx_ctl(hw, I40E_GLQF_HASH_INSET(1, flow_id), ++ (u32)(i_set >> 32)); ++ hena |= BIT_ULL(flow_id); ++ } + } + + i40e_write_rx_ctl(hw, I40E_PFQF_HENA(0), (u32)hena); +-- +2.35.1 + diff --git a/queue-6.0/i40e-fix-vf-hang-when-reset-is-triggered-on-another-.patch b/queue-6.0/i40e-fix-vf-hang-when-reset-is-triggered-on-another-.patch new file mode 100644 index 00000000000..44ecfd4c7ac --- /dev/null +++ b/queue-6.0/i40e-fix-vf-hang-when-reset-is-triggered-on-another-.patch @@ -0,0 +1,150 @@ +From e7a49e394827d822e85011b4ae4830d69d3102e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 03:05:25 -0700 +Subject: i40e: Fix VF hang when reset is triggered on another VF + +From: Sylwester Dziedziuch + +[ Upstream commit 52424f974bc53c26ba3f00300a00e9de9afcd972 ] + +When a reset was triggered on one VF with i40e_reset_vf +global PF state __I40E_VF_DISABLE was set on a PF until +the reset finished. If immediately after triggering reset +on one VF there is a request to reset on another +it will cause a hang on VF side because VF will be notified +of incoming reset but the reset will never happen because +of this global state, we will get such error message: + +[ +4.890195] iavf 0000:86:02.1: Never saw reset + +and VF will hang waiting for the reset to be triggered. + +Fix this by introducing new VF state I40E_VF_STATE_RESETTING +that will be set on a VF if it is currently resetting instead of +the global __I40E_VF_DISABLE PF state. + +Fixes: 3ba9bcb4b68f ("i40e: add locking around VF reset") +Signed-off-by: Sylwester Dziedziuch +Signed-off-by: Mateusz Palczewski +Tested-by: Konrad Jankowski +Signed-off-by: Jacob Keller +Link: https://lore.kernel.org/r/20221024100526.1874914-2-jacob.e.keller@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 43 ++++++++++++++----- + .../ethernet/intel/i40e/i40e_virtchnl_pf.h | 1 + + 2 files changed, 33 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 7e9f6a69eb10..72ddcefc45b1 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1536,10 +1536,12 @@ bool i40e_reset_vf(struct i40e_vf *vf, bool flr) + if (test_bit(__I40E_VF_RESETS_DISABLED, pf->state)) + return true; + +- /* If the VFs have been disabled, this means something else is +- * resetting the VF, so we shouldn't continue. +- */ +- if (test_and_set_bit(__I40E_VF_DISABLE, pf->state)) ++ /* Bail out if VFs are disabled. */ ++ if (test_bit(__I40E_VF_DISABLE, pf->state)) ++ return true; ++ ++ /* If VF is being reset already we don't need to continue. */ ++ if (test_and_set_bit(I40E_VF_STATE_RESETTING, &vf->vf_states)) + return true; + + i40e_trigger_vf_reset(vf, flr); +@@ -1576,7 +1578,7 @@ bool i40e_reset_vf(struct i40e_vf *vf, bool flr) + i40e_cleanup_reset_vf(vf); + + i40e_flush(hw); +- clear_bit(__I40E_VF_DISABLE, pf->state); ++ clear_bit(I40E_VF_STATE_RESETTING, &vf->vf_states); + + return true; + } +@@ -1609,8 +1611,12 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr) + return false; + + /* Begin reset on all VFs at once */ +- for (v = 0; v < pf->num_alloc_vfs; v++) +- i40e_trigger_vf_reset(&pf->vf[v], flr); ++ for (v = 0; v < pf->num_alloc_vfs; v++) { ++ vf = &pf->vf[v]; ++ /* If VF is being reset no need to trigger reset again */ ++ if (!test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states)) ++ i40e_trigger_vf_reset(&pf->vf[v], flr); ++ } + + /* HW requires some time to make sure it can flush the FIFO for a VF + * when it resets it. Poll the VPGEN_VFRSTAT register for each VF in +@@ -1626,9 +1632,11 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr) + */ + while (v < pf->num_alloc_vfs) { + vf = &pf->vf[v]; +- reg = rd32(hw, I40E_VPGEN_VFRSTAT(vf->vf_id)); +- if (!(reg & I40E_VPGEN_VFRSTAT_VFRD_MASK)) +- break; ++ if (!test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states)) { ++ reg = rd32(hw, I40E_VPGEN_VFRSTAT(vf->vf_id)); ++ if (!(reg & I40E_VPGEN_VFRSTAT_VFRD_MASK)) ++ break; ++ } + + /* If the current VF has finished resetting, move on + * to the next VF in sequence. +@@ -1656,6 +1664,10 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr) + if (pf->vf[v].lan_vsi_idx == 0) + continue; + ++ /* If VF is reset in another thread just continue */ ++ if (test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states)) ++ continue; ++ + i40e_vsi_stop_rings_no_wait(pf->vsi[pf->vf[v].lan_vsi_idx]); + } + +@@ -1667,6 +1679,10 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr) + if (pf->vf[v].lan_vsi_idx == 0) + continue; + ++ /* If VF is reset in another thread just continue */ ++ if (test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states)) ++ continue; ++ + i40e_vsi_wait_queues_disabled(pf->vsi[pf->vf[v].lan_vsi_idx]); + } + +@@ -1676,8 +1692,13 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr) + mdelay(50); + + /* Finish the reset on each VF */ +- for (v = 0; v < pf->num_alloc_vfs; v++) ++ for (v = 0; v < pf->num_alloc_vfs; v++) { ++ /* If VF is reset in another thread just continue */ ++ if (test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states)) ++ continue; ++ + i40e_cleanup_reset_vf(&pf->vf[v]); ++ } + + i40e_flush(hw); + clear_bit(__I40E_VF_DISABLE, pf->state); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h +index a554d0a0b09b..358bbdb58795 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h +@@ -39,6 +39,7 @@ enum i40e_vf_states { + I40E_VF_STATE_MC_PROMISC, + I40E_VF_STATE_UC_PROMISC, + I40E_VF_STATE_PRE_ENABLE, ++ I40E_VF_STATE_RESETTING + }; + + /* VF capabilities */ +-- +2.35.1 + diff --git a/queue-6.0/ipv6-ensure-sane-device-mtu-in-tunnels.patch b/queue-6.0/ipv6-ensure-sane-device-mtu-in-tunnels.patch new file mode 100644 index 00000000000..8d2b5fa242a --- /dev/null +++ b/queue-6.0/ipv6-ensure-sane-device-mtu-in-tunnels.patch @@ -0,0 +1,157 @@ +From 473e4ed9aacae33df70f89512aea87a006720a41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Oct 2022 19:01:24 -0700 +Subject: ipv6: ensure sane device mtu in tunnels + +From: Eric Dumazet + +[ Upstream commit d89d7ff01235f218dad37de84457717f699dee79 ] + +Another syzbot report [1] with no reproducer hints +at a bug in ip6_gre tunnel (dev:ip6gretap0) + +Since ipv6 mcast code makes sure to read dev->mtu once +and applies a sanity check on it (see commit b9b312a7a451 +"ipv6: mcast: better catch silly mtu values"), a remaining +possibility is that a layer is able to set dev->mtu to +an underflowed value (high order bit set). + +This could happen indeed in ip6gre_tnl_link_config_route(), +ip6_tnl_link_config() and ipip6_tunnel_bind_dev() + +Make sure to sanitize mtu value in a local variable before +it is written once on dev->mtu, as lockless readers could +catch wrong temporary value. + +[1] +skbuff: skb_over_panic: text:ffff80000b7a2f38 len:40 put:40 head:ffff000149dcf200 data:ffff000149dcf2b0 tail:0xd8 end:0xc0 dev:ip6gretap0 +------------[ cut here ]------------ +kernel BUG at net/core/skbuff.c:120 +Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP +Modules linked in: +CPU: 1 PID: 10241 Comm: kworker/1:1 Not tainted 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022 +Workqueue: mld mld_ifc_work +pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : skb_panic+0x4c/0x50 net/core/skbuff.c:116 +lr : skb_panic+0x4c/0x50 net/core/skbuff.c:116 +sp : ffff800020dd3b60 +x29: ffff800020dd3b70 x28: 0000000000000000 x27: ffff00010df2a800 +x26: 00000000000000c0 x25: 00000000000000b0 x24: ffff000149dcf200 +x23: 00000000000000c0 x22: 00000000000000d8 x21: ffff80000b7a2f38 +x20: ffff00014c2f7800 x19: 0000000000000028 x18: 00000000000001a9 +x17: 0000000000000000 x16: ffff80000db49158 x15: ffff000113bf1a80 +x14: 0000000000000000 x13: 00000000ffffffff x12: ffff000113bf1a80 +x11: ff808000081c0d5c x10: 0000000000000000 x9 : 73f125dc5c63ba00 +x8 : 73f125dc5c63ba00 x7 : ffff800008161d1c x6 : 0000000000000000 +x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000 +x2 : ffff0001fefddcd0 x1 : 0000000100000000 x0 : 0000000000000089 +Call trace: +skb_panic+0x4c/0x50 net/core/skbuff.c:116 +skb_over_panic net/core/skbuff.c:125 [inline] +skb_put+0xd4/0xdc net/core/skbuff.c:2049 +ip6_mc_hdr net/ipv6/mcast.c:1714 [inline] +mld_newpack+0x14c/0x270 net/ipv6/mcast.c:1765 +add_grhead net/ipv6/mcast.c:1851 [inline] +add_grec+0xa20/0xae0 net/ipv6/mcast.c:1989 +mld_send_cr+0x438/0x5a8 net/ipv6/mcast.c:2115 +mld_ifc_work+0x38/0x290 net/ipv6/mcast.c:2653 +process_one_work+0x2d8/0x504 kernel/workqueue.c:2289 +worker_thread+0x340/0x610 kernel/workqueue.c:2436 +kthread+0x12c/0x158 kernel/kthread.c:376 +ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 +Code: 91011400 aa0803e1 a90027ea 94373093 (d4210000) + +Fixes: c12b395a4664 ("gre: Support GRE over IPv6") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20221024020124.3756833-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/ip6_gre.c | 12 +++++++----- + net/ipv6/ip6_tunnel.c | 11 ++++++----- + net/ipv6/sit.c | 8 +++++--- + 3 files changed, 18 insertions(+), 13 deletions(-) + +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 80cb50d459e4..409e8dded7c6 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -1175,14 +1175,16 @@ static void ip6gre_tnl_link_config_route(struct ip6_tnl *t, int set_mtu, + dev->needed_headroom = dst_len; + + if (set_mtu) { +- dev->mtu = rt->dst.dev->mtu - t_hlen; ++ int mtu = rt->dst.dev->mtu - t_hlen; ++ + if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT)) +- dev->mtu -= 8; ++ mtu -= 8; + if (dev->type == ARPHRD_ETHER) +- dev->mtu -= ETH_HLEN; ++ mtu -= ETH_HLEN; + +- if (dev->mtu < IPV6_MIN_MTU) +- dev->mtu = IPV6_MIN_MTU; ++ if (mtu < IPV6_MIN_MTU) ++ mtu = IPV6_MIN_MTU; ++ WRITE_ONCE(dev->mtu, mtu); + } + } + ip6_rt_put(rt); +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 79c6a827dea9..616487b14698 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1450,8 +1450,8 @@ static void ip6_tnl_link_config(struct ip6_tnl *t) + struct net_device *tdev = NULL; + struct __ip6_tnl_parm *p = &t->parms; + struct flowi6 *fl6 = &t->fl.u.ip6; +- unsigned int mtu; + int t_hlen; ++ int mtu; + + __dev_addr_set(dev, &p->laddr, sizeof(struct in6_addr)); + memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr)); +@@ -1498,12 +1498,13 @@ static void ip6_tnl_link_config(struct ip6_tnl *t) + dev->hard_header_len = tdev->hard_header_len + t_hlen; + mtu = min_t(unsigned int, tdev->mtu, IP6_MAX_MTU); + +- dev->mtu = mtu - t_hlen; ++ mtu = mtu - t_hlen; + if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT)) +- dev->mtu -= 8; ++ mtu -= 8; + +- if (dev->mtu < IPV6_MIN_MTU) +- dev->mtu = IPV6_MIN_MTU; ++ if (mtu < IPV6_MIN_MTU) ++ mtu = IPV6_MIN_MTU; ++ WRITE_ONCE(dev->mtu, mtu); + } + } + } +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index 6b73b7a5f175..59b2d9a6210c 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -1124,10 +1124,12 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev) + + if (tdev && !netif_is_l3_master(tdev)) { + int t_hlen = tunnel->hlen + sizeof(struct iphdr); ++ int mtu; + +- dev->mtu = tdev->mtu - t_hlen; +- if (dev->mtu < IPV6_MIN_MTU) +- dev->mtu = IPV6_MIN_MTU; ++ mtu = tdev->mtu - t_hlen; ++ if (mtu < IPV6_MIN_MTU) ++ mtu = IPV6_MIN_MTU; ++ WRITE_ONCE(dev->mtu, mtu); + } + } + +-- +2.35.1 + diff --git a/queue-6.0/kcm-annotate-data-races-around-kcm-rx_psock.patch b/queue-6.0/kcm-annotate-data-races-around-kcm-rx_psock.patch new file mode 100644 index 00000000000..32298e950d5 --- /dev/null +++ b/queue-6.0/kcm-annotate-data-races-around-kcm-rx_psock.patch @@ -0,0 +1,101 @@ +From c515de917c138aa7da1be4edb0bb1b7f2f68ba74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Oct 2022 22:45:11 +0000 +Subject: kcm: annotate data-races around kcm->rx_psock + +From: Eric Dumazet + +[ Upstream commit 15e4dabda11b0fa31d510a915d1a580f47dfc92e ] + +kcm->rx_psock can be read locklessly in kcm_rfree(). +Annotate the read and writes accordingly. + +We do the same for kcm->rx_wait in the following patch. + +syzbot reported: +BUG: KCSAN: data-race in kcm_rfree / unreserve_rx_kcm + +write to 0xffff888123d827b8 of 8 bytes by task 2758 on cpu 1: +unreserve_rx_kcm+0x72/0x1f0 net/kcm/kcmsock.c:313 +kcm_rcv_strparser+0x2b5/0x3a0 net/kcm/kcmsock.c:373 +__strp_recv+0x64c/0xd20 net/strparser/strparser.c:301 +strp_recv+0x6d/0x80 net/strparser/strparser.c:335 +tcp_read_sock+0x13e/0x5a0 net/ipv4/tcp.c:1703 +strp_read_sock net/strparser/strparser.c:358 [inline] +do_strp_work net/strparser/strparser.c:406 [inline] +strp_work+0xe8/0x180 net/strparser/strparser.c:415 +process_one_work+0x3d3/0x720 kernel/workqueue.c:2289 +worker_thread+0x618/0xa70 kernel/workqueue.c:2436 +kthread+0x1a9/0x1e0 kernel/kthread.c:376 +ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 + +read to 0xffff888123d827b8 of 8 bytes by task 5859 on cpu 0: +kcm_rfree+0x14c/0x220 net/kcm/kcmsock.c:181 +skb_release_head_state+0x8e/0x160 net/core/skbuff.c:841 +skb_release_all net/core/skbuff.c:852 [inline] +__kfree_skb net/core/skbuff.c:868 [inline] +kfree_skb_reason+0x5c/0x260 net/core/skbuff.c:891 +kfree_skb include/linux/skbuff.h:1216 [inline] +kcm_recvmsg+0x226/0x2b0 net/kcm/kcmsock.c:1161 +____sys_recvmsg+0x16c/0x2e0 +___sys_recvmsg net/socket.c:2743 [inline] +do_recvmmsg+0x2f1/0x710 net/socket.c:2837 +__sys_recvmmsg net/socket.c:2916 [inline] +__do_sys_recvmmsg net/socket.c:2939 [inline] +__se_sys_recvmmsg net/socket.c:2932 [inline] +__x64_sys_recvmmsg+0xde/0x160 net/socket.c:2932 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +value changed: 0xffff88812971ce00 -> 0x0000000000000000 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 0 PID: 5859 Comm: syz-executor.3 Not tainted 6.0.0-syzkaller-12189-g19d17ab7c68b-dirty #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 + +Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/kcm/kcmsock.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c +index 1215c863e1c4..656d07a92029 100644 +--- a/net/kcm/kcmsock.c ++++ b/net/kcm/kcmsock.c +@@ -178,7 +178,7 @@ static void kcm_rfree(struct sk_buff *skb) + /* For reading rx_wait and rx_psock without holding lock */ + smp_mb__after_atomic(); + +- if (!kcm->rx_wait && !kcm->rx_psock && ++ if (!kcm->rx_wait && !READ_ONCE(kcm->rx_psock) && + sk_rmem_alloc_get(sk) < sk->sk_rcvlowat) { + spin_lock_bh(&mux->rx_lock); + kcm_rcv_ready(kcm); +@@ -283,7 +283,8 @@ static struct kcm_sock *reserve_rx_kcm(struct kcm_psock *psock, + kcm->rx_wait = false; + + psock->rx_kcm = kcm; +- kcm->rx_psock = psock; ++ /* paired with lockless reads in kcm_rfree() */ ++ WRITE_ONCE(kcm->rx_psock, psock); + + spin_unlock_bh(&mux->rx_lock); + +@@ -310,7 +311,8 @@ static void unreserve_rx_kcm(struct kcm_psock *psock, + spin_lock_bh(&mux->rx_lock); + + psock->rx_kcm = NULL; +- kcm->rx_psock = NULL; ++ /* paired with lockless reads in kcm_rfree() */ ++ WRITE_ONCE(kcm->rx_psock, NULL); + + /* Commit kcm->rx_psock before sk_rmem_alloc_get to sync with + * kcm_rfree +-- +2.35.1 + diff --git a/queue-6.0/kcm-annotate-data-races-around-kcm-rx_wait.patch b/queue-6.0/kcm-annotate-data-races-around-kcm-rx_wait.patch new file mode 100644 index 00000000000..1b9f3078da7 --- /dev/null +++ b/queue-6.0/kcm-annotate-data-races-around-kcm-rx_wait.patch @@ -0,0 +1,130 @@ +From d4e9b9650ac86b8c6416c63c3b84831339062c8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Oct 2022 22:45:12 +0000 +Subject: kcm: annotate data-races around kcm->rx_wait + +From: Eric Dumazet + +[ Upstream commit 0c745b5141a45a076f1cb9772a399f7ebcb0948a ] + +kcm->rx_psock can be read locklessly in kcm_rfree(). +Annotate the read and writes accordingly. + +syzbot reported: + +BUG: KCSAN: data-race in kcm_rcv_strparser / kcm_rfree + +write to 0xffff88810784e3d0 of 1 bytes by task 1823 on cpu 1: +reserve_rx_kcm net/kcm/kcmsock.c:283 [inline] +kcm_rcv_strparser+0x250/0x3a0 net/kcm/kcmsock.c:363 +__strp_recv+0x64c/0xd20 net/strparser/strparser.c:301 +strp_recv+0x6d/0x80 net/strparser/strparser.c:335 +tcp_read_sock+0x13e/0x5a0 net/ipv4/tcp.c:1703 +strp_read_sock net/strparser/strparser.c:358 [inline] +do_strp_work net/strparser/strparser.c:406 [inline] +strp_work+0xe8/0x180 net/strparser/strparser.c:415 +process_one_work+0x3d3/0x720 kernel/workqueue.c:2289 +worker_thread+0x618/0xa70 kernel/workqueue.c:2436 +kthread+0x1a9/0x1e0 kernel/kthread.c:376 +ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 + +read to 0xffff88810784e3d0 of 1 bytes by task 17869 on cpu 0: +kcm_rfree+0x121/0x220 net/kcm/kcmsock.c:181 +skb_release_head_state+0x8e/0x160 net/core/skbuff.c:841 +skb_release_all net/core/skbuff.c:852 [inline] +__kfree_skb net/core/skbuff.c:868 [inline] +kfree_skb_reason+0x5c/0x260 net/core/skbuff.c:891 +kfree_skb include/linux/skbuff.h:1216 [inline] +kcm_recvmsg+0x226/0x2b0 net/kcm/kcmsock.c:1161 +____sys_recvmsg+0x16c/0x2e0 +___sys_recvmsg net/socket.c:2743 [inline] +do_recvmmsg+0x2f1/0x710 net/socket.c:2837 +__sys_recvmmsg net/socket.c:2916 [inline] +__do_sys_recvmmsg net/socket.c:2939 [inline] +__se_sys_recvmmsg net/socket.c:2932 [inline] +__x64_sys_recvmmsg+0xde/0x160 net/socket.c:2932 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +value changed: 0x01 -> 0x00 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 0 PID: 17869 Comm: syz-executor.2 Not tainted 6.1.0-rc1-syzkaller-00010-gbb1a1146467a-dirty #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 + +Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/kcm/kcmsock.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c +index 656d07a92029..90e0aeae9ff2 100644 +--- a/net/kcm/kcmsock.c ++++ b/net/kcm/kcmsock.c +@@ -162,7 +162,8 @@ static void kcm_rcv_ready(struct kcm_sock *kcm) + /* Buffer limit is okay now, add to ready list */ + list_add_tail(&kcm->wait_rx_list, + &kcm->mux->kcm_rx_waiters); +- kcm->rx_wait = true; ++ /* paired with lockless reads in kcm_rfree() */ ++ WRITE_ONCE(kcm->rx_wait, true); + } + + static void kcm_rfree(struct sk_buff *skb) +@@ -178,7 +179,7 @@ static void kcm_rfree(struct sk_buff *skb) + /* For reading rx_wait and rx_psock without holding lock */ + smp_mb__after_atomic(); + +- if (!kcm->rx_wait && !READ_ONCE(kcm->rx_psock) && ++ if (!READ_ONCE(kcm->rx_wait) && !READ_ONCE(kcm->rx_psock) && + sk_rmem_alloc_get(sk) < sk->sk_rcvlowat) { + spin_lock_bh(&mux->rx_lock); + kcm_rcv_ready(kcm); +@@ -237,7 +238,8 @@ static void requeue_rx_msgs(struct kcm_mux *mux, struct sk_buff_head *head) + if (kcm_queue_rcv_skb(&kcm->sk, skb)) { + /* Should mean socket buffer full */ + list_del(&kcm->wait_rx_list); +- kcm->rx_wait = false; ++ /* paired with lockless reads in kcm_rfree() */ ++ WRITE_ONCE(kcm->rx_wait, false); + + /* Commit rx_wait to read in kcm_free */ + smp_wmb(); +@@ -280,7 +282,8 @@ static struct kcm_sock *reserve_rx_kcm(struct kcm_psock *psock, + kcm = list_first_entry(&mux->kcm_rx_waiters, + struct kcm_sock, wait_rx_list); + list_del(&kcm->wait_rx_list); +- kcm->rx_wait = false; ++ /* paired with lockless reads in kcm_rfree() */ ++ WRITE_ONCE(kcm->rx_wait, false); + + psock->rx_kcm = kcm; + /* paired with lockless reads in kcm_rfree() */ +@@ -1242,7 +1245,8 @@ static void kcm_recv_disable(struct kcm_sock *kcm) + if (!kcm->rx_psock) { + if (kcm->rx_wait) { + list_del(&kcm->wait_rx_list); +- kcm->rx_wait = false; ++ /* paired with lockless reads in kcm_rfree() */ ++ WRITE_ONCE(kcm->rx_wait, false); + } + + requeue_rx_msgs(mux, &kcm->sk.sk_receive_queue); +@@ -1795,7 +1799,8 @@ static void kcm_done(struct kcm_sock *kcm) + + if (kcm->rx_wait) { + list_del(&kcm->wait_rx_list); +- kcm->rx_wait = false; ++ /* paired with lockless reads in kcm_rfree() */ ++ WRITE_ONCE(kcm->rx_wait, false); + } + /* Move any pending receive messages to other kcm sockets */ + requeue_rx_msgs(mux, &sk->sk_receive_queue); +-- +2.35.1 + diff --git a/queue-6.0/kcm-do-not-sense-pfmemalloc-status-in-kcm_sendpage.patch b/queue-6.0/kcm-do-not-sense-pfmemalloc-status-in-kcm_sendpage.patch new file mode 100644 index 00000000000..cdf1ecbed15 --- /dev/null +++ b/queue-6.0/kcm-do-not-sense-pfmemalloc-status-in-kcm_sendpage.patch @@ -0,0 +1,37 @@ +From d89e2167ce1b223720d29d095396189f90ea91c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 04:06:37 +0000 +Subject: kcm: do not sense pfmemalloc status in kcm_sendpage() + +From: Eric Dumazet + +[ Upstream commit ee15e1f38dc201fa7d63c13aa258b728dce27f4d ] + +Similar to changes done in TCP in blamed commit. +We should not sense pfmemalloc status in sendpage() methods. + +Fixes: 326140063946 ("tcp: TX zerocopy should not sense pfmemalloc status") +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20221027040637.1107703-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/kcm/kcmsock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c +index 90e0aeae9ff2..befc62606cdf 100644 +--- a/net/kcm/kcmsock.c ++++ b/net/kcm/kcmsock.c +@@ -839,7 +839,7 @@ static ssize_t kcm_sendpage(struct socket *sock, struct page *page, + } + + get_page(page); +- skb_fill_page_desc(skb, i, page, offset, size); ++ skb_fill_page_desc_noacc(skb, i, page, offset, size); + skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; + + coalesced: +-- +2.35.1 + diff --git a/queue-6.0/kvm-arm64-selftests-fix-multiple-versions-of-gic-cre.patch b/queue-6.0/kvm-arm64-selftests-fix-multiple-versions-of-gic-cre.patch new file mode 100644 index 00000000000..fd8b972831a --- /dev/null +++ b/queue-6.0/kvm-arm64-selftests-fix-multiple-versions-of-gic-cre.patch @@ -0,0 +1,42 @@ +From f931decd1d2ae4349f0a6e0e98ede3c5970f4f3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Oct 2022 11:31:31 +0800 +Subject: KVM: arm64: selftests: Fix multiple versions of GIC creation + +From: Zenghui Yu + +[ Upstream commit 8a6ffcbe26fd14d58075dcf3cbdf1b5b69b20402 ] + +Commit 98f94ce42ac6 ("KVM: selftests: Move KVM_CREATE_DEVICE_TEST code to +separate helper") wrongly converted a "real" GIC device creation to +__kvm_test_create_device() and caused the test failure on my D05 (which +supports v2 emulation). Fix it. + +Fixes: 98f94ce42ac6 ("KVM: selftests: Move KVM_CREATE_DEVICE_TEST code to separate helper") +Signed-off-by: Zenghui Yu +Reviewed-by: Oliver Upton +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20221009033131.365-1-yuzenghui@huawei.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kvm/aarch64/vgic_init.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/kvm/aarch64/vgic_init.c b/tools/testing/selftests/kvm/aarch64/vgic_init.c +index e05ecb31823f..9c131d977a1b 100644 +--- a/tools/testing/selftests/kvm/aarch64/vgic_init.c ++++ b/tools/testing/selftests/kvm/aarch64/vgic_init.c +@@ -662,8 +662,8 @@ int test_kvm_device(uint32_t gic_dev_type) + : KVM_DEV_TYPE_ARM_VGIC_V2; + + if (!__kvm_test_create_device(v.vm, other)) { +- ret = __kvm_test_create_device(v.vm, other); +- TEST_ASSERT(ret && (errno == EINVAL || errno == EEXIST), ++ ret = __kvm_create_device(v.vm, other); ++ TEST_ASSERT(ret < 0 && (errno == EINVAL || errno == EEXIST), + "create GIC device while other version exists"); + } + +-- +2.35.1 + diff --git a/queue-6.0/kvm-selftests-fix-number-of-pages-for-memory-slot-in.patch b/queue-6.0/kvm-selftests-fix-number-of-pages-for-memory-slot-in.patch new file mode 100644 index 00000000000..1923e0e1d5c --- /dev/null +++ b/queue-6.0/kvm-selftests-fix-number-of-pages-for-memory-slot-in.patch @@ -0,0 +1,62 @@ +From ec3e73e60c7dbd9244bf4e7c4a9f094beae36ca4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 14:30:20 +0800 +Subject: KVM: selftests: Fix number of pages for memory slot in + memslot_modification_stress_test + +From: Gavin Shan + +[ Upstream commit 05c2224d4b049406b0545a10be05280ff4b8ba0a ] + +It's required by vm_userspace_mem_region_add() that memory size +should be aligned to host page size. However, one guest page is +provided by memslot_modification_stress_test. It triggers failure +in the scenario of 64KB-page-size-host and 4KB-page-size-guest, +as the following messages indicate. + + # ./memslot_modification_stress_test + Testing guest mode: PA-bits:40, VA-bits:48, 4K pages + guest physical test memory: [0xffbfff0000, 0xffffff0000) + Finished creating vCPUs + Started all vCPUs + ==== Test Assertion Failure ==== + lib/kvm_util.c:824: vm_adjust_num_guest_pages(vm->mode, npages) == npages + pid=5712 tid=5712 errno=0 - Success + 1 0x0000000000404eeb: vm_userspace_mem_region_add at kvm_util.c:822 + 2 0x0000000000401a5b: add_remove_memslot at memslot_modification_stress_test.c:82 + 3 (inlined by) run_test at memslot_modification_stress_test.c:110 + 4 0x0000000000402417: for_each_guest_mode at guest_modes.c:100 + 5 0x00000000004016a7: main at memslot_modification_stress_test.c:187 + 6 0x0000ffffb8cd4383: ?? ??:0 + 7 0x0000000000401827: _start at :? + Number of guest pages is not compatible with the host. Try npages=16 + +Fix the issue by providing 16 guest pages to the memory slot for this +particular combination of 64KB-page-size-host and 4KB-page-size-guest +on aarch64. + +Fixes: ef4c9f4f65462 ("KVM: selftests: Fix 32-bit truncation of vm_get_max_gfn()") +Signed-off-by: Gavin Shan +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20221013063020.201856-1-gshan@redhat.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kvm/memslot_modification_stress_test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/kvm/memslot_modification_stress_test.c b/tools/testing/selftests/kvm/memslot_modification_stress_test.c +index 6ee7e1dde404..bb1d17a1171b 100644 +--- a/tools/testing/selftests/kvm/memslot_modification_stress_test.c ++++ b/tools/testing/selftests/kvm/memslot_modification_stress_test.c +@@ -67,7 +67,7 @@ struct memslot_antagonist_args { + static void add_remove_memslot(struct kvm_vm *vm, useconds_t delay, + uint64_t nr_modifications) + { +- const uint64_t pages = 1; ++ uint64_t pages = max_t(int, vm->page_size, getpagesize()) / vm->page_size; + uint64_t gpa; + int i; + +-- +2.35.1 + diff --git a/queue-6.0/media-amphion-release-m2m-ctx-when-releasing-vpu-ins.patch b/queue-6.0/media-amphion-release-m2m-ctx-when-releasing-vpu-ins.patch new file mode 100644 index 00000000000..ebcae868cc7 --- /dev/null +++ b/queue-6.0/media-amphion-release-m2m-ctx-when-releasing-vpu-ins.patch @@ -0,0 +1,55 @@ +From 3276f18d9e7a65d102e449f88014408eb8763a09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 07:33:16 +0200 +Subject: media: amphion: release m2m ctx when releasing vpu instance + +From: Ming Qian + +[ Upstream commit d91d7bc85062309aae6d8064563ddf17947cb6bc ] + +release m2m ctx in the callback function that +release the vpu instance, then there is no need +to add lock around releasing m2m ctx. + +Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support") +Signed-off-by: Ming Qian +Reviewed-by: Tommaso Merciai +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vpu_v4l2.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c +index 8a3eed957ae6..b779e0ba916c 100644 +--- a/drivers/media/platform/amphion/vpu_v4l2.c ++++ b/drivers/media/platform/amphion/vpu_v4l2.c +@@ -603,6 +603,10 @@ static int vpu_v4l2_release(struct vpu_inst *inst) + inst->workqueue = NULL; + } + ++ if (inst->fh.m2m_ctx) { ++ v4l2_m2m_ctx_release(inst->fh.m2m_ctx); ++ inst->fh.m2m_ctx = NULL; ++ } + v4l2_ctrl_handler_free(&inst->ctrl_handler); + mutex_destroy(&inst->lock); + v4l2_fh_del(&inst->fh); +@@ -685,13 +689,6 @@ int vpu_v4l2_close(struct file *file) + + vpu_trace(vpu->dev, "tgid = %d, pid = %d, inst = %p\n", inst->tgid, inst->pid, inst); + +- vpu_inst_lock(inst); +- if (inst->fh.m2m_ctx) { +- v4l2_m2m_ctx_release(inst->fh.m2m_ctx); +- inst->fh.m2m_ctx = NULL; +- } +- vpu_inst_unlock(inst); +- + call_void_vop(inst, release); + vpu_inst_unregister(inst); + vpu_inst_put(inst); +-- +2.35.1 + diff --git a/queue-6.0/media-ar0521-fix-error-return-code-in-ar0521_power_o.patch b/queue-6.0/media-ar0521-fix-error-return-code-in-ar0521_power_o.patch new file mode 100644 index 00000000000..ac658b3745b --- /dev/null +++ b/queue-6.0/media-ar0521-fix-error-return-code-in-ar0521_power_o.patch @@ -0,0 +1,43 @@ +From 1dc119f416e34711eab751adc6ca4421e15a761d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 10:59:24 +0200 +Subject: media: ar0521: fix error return code in ar0521_power_on() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yang Yingliang + +[ Upstream commit b5f8fa876931c1adfd2c5eca5b189fd2be893238 ] + +Return error code if ar0521_write_regs() fails in ar0521_power_on(). + +Fixes: 852b50aeed15 ("media: On Semi AR0521 sensor driver") +Signed-off-by: Yang Yingliang +Acked-by: Krzysztof Hałasa +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ar0521.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/ar0521.c b/drivers/media/i2c/ar0521.c +index c7bdfc69b9be..e850c92d847e 100644 +--- a/drivers/media/i2c/ar0521.c ++++ b/drivers/media/i2c/ar0521.c +@@ -757,8 +757,9 @@ static int ar0521_power_on(struct device *dev) + usleep_range(4500, 5000); /* min 45000 clocks */ + + for (cnt = 0; cnt < ARRAY_SIZE(initial_regs); cnt++) +- if (ar0521_write_regs(sensor, initial_regs[cnt].data, +- initial_regs[cnt].count)) ++ ret = ar0521_write_regs(sensor, initial_regs[cnt].data, ++ initial_regs[cnt].count); ++ if (ret) + goto off; + + ret = ar0521_write_reg(sensor, AR0521_REG_SERIAL_FORMAT, +-- +2.35.1 + diff --git a/queue-6.0/media-atomisp-prevent-integer-overflow-in-sh_css_set.patch b/queue-6.0/media-atomisp-prevent-integer-overflow-in-sh_css_set.patch new file mode 100644 index 00000000000..a8555a31258 --- /dev/null +++ b/queue-6.0/media-atomisp-prevent-integer-overflow-in-sh_css_set.patch @@ -0,0 +1,42 @@ +From 3fc3f2a82e1fedb0bbb76d5e718a0e8e972d07e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Sep 2022 07:20:09 +0200 +Subject: media: atomisp: prevent integer overflow in sh_css_set_black_frame() + +From: Dan Carpenter + +[ Upstream commit 3ad290194bb06979367622e47357462836c1d3b4 ] + +The "height" and "width" values come from the user so the "height * width" +multiplication can overflow. + +Link: https://lore.kernel.org/r/YxBBCRnm3mmvaiuR@kili + +Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") +Signed-off-by: Dan Carpenter +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/sh_css_params.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/media/atomisp/pci/sh_css_params.c b/drivers/staging/media/atomisp/pci/sh_css_params.c +index 0e7c38b2bfe3..67915d76a87f 100644 +--- a/drivers/staging/media/atomisp/pci/sh_css_params.c ++++ b/drivers/staging/media/atomisp/pci/sh_css_params.c +@@ -950,8 +950,8 @@ sh_css_set_black_frame(struct ia_css_stream *stream, + params->fpn_config.data = NULL; + } + if (!params->fpn_config.data) { +- params->fpn_config.data = kvmalloc(height * width * +- sizeof(short), GFP_KERNEL); ++ params->fpn_config.data = kvmalloc(array3_size(height, width, sizeof(short)), ++ GFP_KERNEL); + if (!params->fpn_config.data) { + IA_CSS_ERROR("out of memory"); + IA_CSS_LEAVE_ERR_PRIVATE(-ENOMEM); +-- +2.35.1 + diff --git a/queue-6.0/media-cedrus-add-a-kconfig-dependency-on-reset_contr.patch b/queue-6.0/media-cedrus-add-a-kconfig-dependency-on-reset_contr.patch new file mode 100644 index 00000000000..c533b861b81 --- /dev/null +++ b/queue-6.0/media-cedrus-add-a-kconfig-dependency-on-reset_contr.patch @@ -0,0 +1,36 @@ +From 22966366377699c0770b56fd60a8cdd6b6126155 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Aug 2022 12:20:35 +0200 +Subject: media: cedrus: Add a Kconfig dependency on RESET_CONTROLLER + +From: Paul Kocialkowski + +[ Upstream commit 26686b0da9f3fd042578c1093862c853f8e4ff1b ] + +The driver relies on the reset controller API to work, so add +RESET_CONTROLLER as one of its Kconfig dependencies. + +Fixes: 50e761516f2b ("media: platform: Add Cedrus VPU decoder driver") +Signed-off-by: Paul Kocialkowski +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/sunxi/cedrus/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/staging/media/sunxi/cedrus/Kconfig b/drivers/staging/media/sunxi/cedrus/Kconfig +index 21c13f9b6e33..621944f9907a 100644 +--- a/drivers/staging/media/sunxi/cedrus/Kconfig ++++ b/drivers/staging/media/sunxi/cedrus/Kconfig +@@ -2,6 +2,7 @@ + config VIDEO_SUNXI_CEDRUS + tristate "Allwinner Cedrus VPU driver" + depends on VIDEO_DEV ++ depends on RESET_CONTROLLER + depends on HAS_DMA + depends on OF + select MEDIA_CONTROLLER +-- +2.35.1 + diff --git a/queue-6.0/media-ov8865-fix-an-error-handling-path-in-ov8865_pr.patch b/queue-6.0/media-ov8865-fix-an-error-handling-path-in-ov8865_pr.patch new file mode 100644 index 00000000000..ae796d8e211 --- /dev/null +++ b/queue-6.0/media-ov8865-fix-an-error-handling-path-in-ov8865_pr.patch @@ -0,0 +1,47 @@ +From 41fc49e836eccd75cf35f9bbaeebc8243f883450 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Aug 2022 08:43:29 +0200 +Subject: media: ov8865: Fix an error handling path in ov8865_probe() + +From: Christophe JAILLET + +[ Upstream commit 080e0b7404850406628674b07286f16cc389a892 ] + +The commit in Fixes also introduced some new error handling which should +goto the existing error handling path. +Otherwise some resources leak. + +Fixes: 73dcffeb2ff9 ("media: i2c: Support 19.2MHz input clock in ov8865") +Signed-off-by: Christophe JAILLET +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov8865.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/i2c/ov8865.c b/drivers/media/i2c/ov8865.c +index b8f4f0d3e33d..15d0f79231dd 100644 +--- a/drivers/media/i2c/ov8865.c ++++ b/drivers/media/i2c/ov8865.c +@@ -3034,11 +3034,13 @@ static int ov8865_probe(struct i2c_client *client) + &rate); + if (!ret && sensor->extclk) { + ret = clk_set_rate(sensor->extclk, rate); +- if (ret) +- return dev_err_probe(dev, ret, +- "failed to set clock rate\n"); ++ if (ret) { ++ dev_err_probe(dev, ret, "failed to set clock rate\n"); ++ goto error_endpoint; ++ } + } else if (ret && !sensor->extclk) { +- return dev_err_probe(dev, ret, "invalid clock config\n"); ++ dev_err_probe(dev, ret, "invalid clock config\n"); ++ goto error_endpoint; + } + + sensor->extclk_rate = rate ? rate : clk_get_rate(sensor->extclk); +-- +2.35.1 + diff --git a/queue-6.0/media-sun4i-csi-add-a-kconfig-dependency-on-reset_co.patch b/queue-6.0/media-sun4i-csi-add-a-kconfig-dependency-on-reset_co.patch new file mode 100644 index 00000000000..ec597c3bb7f --- /dev/null +++ b/queue-6.0/media-sun4i-csi-add-a-kconfig-dependency-on-reset_co.patch @@ -0,0 +1,37 @@ +From c8ce1670d4aa17b55c94f1374063f6e66f794b8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Aug 2022 12:20:32 +0200 +Subject: media: sun4i-csi: Add a Kconfig dependency on RESET_CONTROLLER + +From: Paul Kocialkowski + +[ Upstream commit 140a9b57d3a306ca77a92e903facbdc4a31ccd51 ] + +The driver relies on the reset controller API to work, so add +RESET_CONTROLLER as one of its Kconfig dependencies. + +Fixes: 577bbf23b758 ("media: sunxi: Add A10 CSI driver") +Signed-off-by: Paul Kocialkowski +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sunxi/sun4i-csi/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/sunxi/sun4i-csi/Kconfig b/drivers/media/platform/sunxi/sun4i-csi/Kconfig +index 7960e6836f41..60610c04d6a7 100644 +--- a/drivers/media/platform/sunxi/sun4i-csi/Kconfig ++++ b/drivers/media/platform/sunxi/sun4i-csi/Kconfig +@@ -3,7 +3,7 @@ + config VIDEO_SUN4I_CSI + tristate "Allwinner A10 CMOS Sensor Interface Support" + depends on V4L_PLATFORM_DRIVERS +- depends on VIDEO_DEV && COMMON_CLK && HAS_DMA ++ depends on VIDEO_DEV && COMMON_CLK && RESET_CONTROLLER && HAS_DMA + depends on ARCH_SUNXI || COMPILE_TEST + select MEDIA_CONTROLLER + select VIDEO_V4L2_SUBDEV_API +-- +2.35.1 + diff --git a/queue-6.0/media-sun6i-csi-add-a-kconfig-dependency-on-reset_co.patch b/queue-6.0/media-sun6i-csi-add-a-kconfig-dependency-on-reset_co.patch new file mode 100644 index 00000000000..de04ffe84a3 --- /dev/null +++ b/queue-6.0/media-sun6i-csi-add-a-kconfig-dependency-on-reset_co.patch @@ -0,0 +1,37 @@ +From f94e3ec289841cfc6f9c6f87c4a8f7d7a815c8dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Aug 2022 12:20:31 +0200 +Subject: media: sun6i-csi: Add a Kconfig dependency on RESET_CONTROLLER + +From: Paul Kocialkowski + +[ Upstream commit 6a720df702db764e2b3bbdaaa217e9d344efcfb2 ] + +The driver relies on the reset controller API to work, so add +RESET_CONTROLLER as one of its Kconfig dependencies. + +Fixes: 5cc7522d8965 ("media: sun6i: Add support for Allwinner CSI V3s") +Signed-off-by: Paul Kocialkowski +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sunxi/sun6i-csi/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/sunxi/sun6i-csi/Kconfig b/drivers/media/platform/sunxi/sun6i-csi/Kconfig +index 0345901617d4..e5b6991ce7f0 100644 +--- a/drivers/media/platform/sunxi/sun6i-csi/Kconfig ++++ b/drivers/media/platform/sunxi/sun6i-csi/Kconfig +@@ -2,7 +2,7 @@ + config VIDEO_SUN6I_CSI + tristate "Allwinner V3s Camera Sensor Interface driver" + depends on V4L_PLATFORM_DRIVERS +- depends on VIDEO_DEV && COMMON_CLK && HAS_DMA ++ depends on VIDEO_DEV && COMMON_CLK && RESET_CONTROLLER && HAS_DMA + depends on ARCH_SUNXI || COMPILE_TEST + select MEDIA_CONTROLLER + select VIDEO_V4L2_SUBDEV_API +-- +2.35.1 + diff --git a/queue-6.0/media-sun6i-mipi-csi2-add-a-kconfig-dependency-on-re.patch b/queue-6.0/media-sun6i-mipi-csi2-add-a-kconfig-dependency-on-re.patch new file mode 100644 index 00000000000..f724b209f46 --- /dev/null +++ b/queue-6.0/media-sun6i-mipi-csi2-add-a-kconfig-dependency-on-re.patch @@ -0,0 +1,41 @@ +From 5914dc23f27b66738df12477f9712974d40f0031 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Aug 2022 12:20:29 +0200 +Subject: media: sun6i-mipi-csi2: Add a Kconfig dependency on RESET_CONTROLLER + +From: Paul Kocialkowski + +[ Upstream commit d0734dab5480325fd67548aa51ee126570d48574 ] + +The driver relies on the reset controller API to work, so add +RESET_CONTROLLER as one of its Kconfig dependencies. + +It also selects PHY_SUN6I_MIPI_DPHY, which depends on RESET_CONTROLLER. + +Fixes: af54b4f4c17f ("media: sunxi: Add support for the A31 MIPI CSI-2 controller") +Signed-off-by: Paul Kocialkowski +Reported-by: kernel test robot +Acked-by: Jernej Skrabec +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sunxi/sun6i-mipi-csi2/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/sunxi/sun6i-mipi-csi2/Kconfig b/drivers/media/platform/sunxi/sun6i-mipi-csi2/Kconfig +index 4d072abdfb70..08852f63692b 100644 +--- a/drivers/media/platform/sunxi/sun6i-mipi-csi2/Kconfig ++++ b/drivers/media/platform/sunxi/sun6i-mipi-csi2/Kconfig +@@ -3,7 +3,7 @@ config VIDEO_SUN6I_MIPI_CSI2 + tristate "Allwinner A31 MIPI CSI-2 Controller Driver" + depends on V4L_PLATFORM_DRIVERS && VIDEO_DEV + depends on ARCH_SUNXI || COMPILE_TEST +- depends on PM && COMMON_CLK ++ depends on PM && COMMON_CLK && RESET_CONTROLLER + depends on PHY_SUN6I_MIPI_DPHY + select MEDIA_CONTROLLER + select VIDEO_V4L2_SUBDEV_API +-- +2.35.1 + diff --git a/queue-6.0/media-sun6i-mipi-csi2-depend-on-phy_sun6i_mipi_dphy.patch b/queue-6.0/media-sun6i-mipi-csi2-depend-on-phy_sun6i_mipi_dphy.patch new file mode 100644 index 00000000000..f76080cf750 --- /dev/null +++ b/queue-6.0/media-sun6i-mipi-csi2-depend-on-phy_sun6i_mipi_dphy.patch @@ -0,0 +1,39 @@ +From 4cb551e08025e343a976ba779816780dbbaecd84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Sep 2022 11:52:35 +0200 +Subject: media: sun6i-mipi-csi2: Depend on PHY_SUN6I_MIPI_DPHY + +From: Sakari Ailus + +[ Upstream commit ff37bc8c7099b673e9838bfbd0de78eff740316b ] + +PHY_SUN6I_MIPI_DPHY is not a freely selectable option and so may not +always be available. Depend on it instead. + +Fixes: 94d7fd9692b5 ("media: sunxi: Depend on GENERIC_PHY_MIPI_DPHY") +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sunxi/sun6i-mipi-csi2/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/sunxi/sun6i-mipi-csi2/Kconfig b/drivers/media/platform/sunxi/sun6i-mipi-csi2/Kconfig +index eb982466abd3..4d072abdfb70 100644 +--- a/drivers/media/platform/sunxi/sun6i-mipi-csi2/Kconfig ++++ b/drivers/media/platform/sunxi/sun6i-mipi-csi2/Kconfig +@@ -4,10 +4,10 @@ config VIDEO_SUN6I_MIPI_CSI2 + depends on V4L_PLATFORM_DRIVERS && VIDEO_DEV + depends on ARCH_SUNXI || COMPILE_TEST + depends on PM && COMMON_CLK ++ depends on PHY_SUN6I_MIPI_DPHY + select MEDIA_CONTROLLER + select VIDEO_V4L2_SUBDEV_API + select V4L2_FWNODE +- select PHY_SUN6I_MIPI_DPHY + select GENERIC_PHY_MIPI_DPHY + select REGMAP_MMIO + help +-- +2.35.1 + diff --git a/queue-6.0/media-sun8i-a83t-mipi-csi2-add-a-kconfig-dependency-.patch b/queue-6.0/media-sun8i-a83t-mipi-csi2-add-a-kconfig-dependency-.patch new file mode 100644 index 00000000000..8846be20a3a --- /dev/null +++ b/queue-6.0/media-sun8i-a83t-mipi-csi2-add-a-kconfig-dependency-.patch @@ -0,0 +1,38 @@ +From f6fe2874eb0adbb23370e62686fcf12a7ffc68d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Aug 2022 12:20:30 +0200 +Subject: media: sun8i-a83t-mipi-csi2: Add a Kconfig dependency on + RESET_CONTROLLER + +From: Paul Kocialkowski + +[ Upstream commit 398c479234894c3d3347d83869760db3c406c269 ] + +The driver relies on the reset controller API to work, so add +RESET_CONTROLLER as one of its Kconfig dependencies. + +Fixes: 576d196c522b ("media: sunxi: Add support for the A83T MIPI CSI-2 controller") +Signed-off-by: Paul Kocialkowski +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig b/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig +index 789d58ee12ea..47a8c0fb7eb9 100644 +--- a/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig ++++ b/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig +@@ -3,7 +3,7 @@ config VIDEO_SUN8I_A83T_MIPI_CSI2 + tristate "Allwinner A83T MIPI CSI-2 Controller and D-PHY Driver" + depends on V4L_PLATFORM_DRIVERS && VIDEO_DEV + depends on ARCH_SUNXI || COMPILE_TEST +- depends on PM && COMMON_CLK ++ depends on PM && COMMON_CLK && RESET_CONTROLLER + select MEDIA_CONTROLLER + select VIDEO_V4L2_SUBDEV_API + select V4L2_FWNODE +-- +2.35.1 + diff --git a/queue-6.0/media-sun8i-di-add-a-kconfig-dependency-on-reset_con.patch b/queue-6.0/media-sun8i-di-add-a-kconfig-dependency-on-reset_con.patch new file mode 100644 index 00000000000..7674587b39d --- /dev/null +++ b/queue-6.0/media-sun8i-di-add-a-kconfig-dependency-on-reset_con.patch @@ -0,0 +1,37 @@ +From e79a200fe4e5f9731e435a685d237f33269591a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Aug 2022 12:20:33 +0200 +Subject: media: sun8i-di: Add a Kconfig dependency on RESET_CONTROLLER + +From: Paul Kocialkowski + +[ Upstream commit c2a46b19f0340e6647168f4ceac4e5e4cb9197d8 ] + +The driver relies on the reset controller API to work, so add +RESET_CONTROLLER as one of its Kconfig dependencies. + +Fixes: a4260ea49547 ("media: sun4i: Add H3 deinterlace driver") +Signed-off-by: Paul Kocialkowski +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sunxi/sun8i-di/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/sunxi/sun8i-di/Kconfig b/drivers/media/platform/sunxi/sun8i-di/Kconfig +index ff71e06ee2df..f688396913b7 100644 +--- a/drivers/media/platform/sunxi/sun8i-di/Kconfig ++++ b/drivers/media/platform/sunxi/sun8i-di/Kconfig +@@ -4,7 +4,7 @@ config VIDEO_SUN8I_DEINTERLACE + depends on V4L_MEM2MEM_DRIVERS + depends on VIDEO_DEV + depends on ARCH_SUNXI || COMPILE_TEST +- depends on COMMON_CLK && OF ++ depends on COMMON_CLK && RESET_CONTROLLER && OF + depends on PM + select VIDEOBUF2_DMA_CONTIG + select V4L2_MEM2MEM_DEV +-- +2.35.1 + diff --git a/queue-6.0/media-sun8i-rotate-add-a-kconfig-dependency-on-reset.patch b/queue-6.0/media-sun8i-rotate-add-a-kconfig-dependency-on-reset.patch new file mode 100644 index 00000000000..f6d98f995a4 --- /dev/null +++ b/queue-6.0/media-sun8i-rotate-add-a-kconfig-dependency-on-reset.patch @@ -0,0 +1,37 @@ +From ab803894fae5796b34e4fc0f40d504105e65010c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Aug 2022 12:20:34 +0200 +Subject: media: sun8i-rotate: Add a Kconfig dependency on RESET_CONTROLLER + +From: Paul Kocialkowski + +[ Upstream commit b9273150b8b7f8b02ac961463057191d243f953d ] + +The driver relies on the reset controller API to work, so add +RESET_CONTROLLER as one of its Kconfig dependencies. + +Fixes: d77182ada3d4 ("media: sun8i: Add Allwinner A83T Rotate driver") +Signed-off-by: Paul Kocialkowski +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sunxi/sun8i-rotate/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/sunxi/sun8i-rotate/Kconfig b/drivers/media/platform/sunxi/sun8i-rotate/Kconfig +index cfba29072d75..ee2c1f248c64 100644 +--- a/drivers/media/platform/sunxi/sun8i-rotate/Kconfig ++++ b/drivers/media/platform/sunxi/sun8i-rotate/Kconfig +@@ -5,7 +5,7 @@ config VIDEO_SUN8I_ROTATE + depends on V4L_MEM2MEM_DRIVERS + depends on VIDEO_DEV + depends on ARCH_SUNXI || COMPILE_TEST +- depends on COMMON_CLK && OF ++ depends on COMMON_CLK && RESET_CONTROLLER && OF + depends on PM + select VIDEOBUF2_DMA_CONTIG + select V4L2_MEM2MEM_DEV +-- +2.35.1 + diff --git a/queue-6.0/media-sunxi-fix-some-error-handling-path-of-sun6i_mi.patch b/queue-6.0/media-sunxi-fix-some-error-handling-path-of-sun6i_mi.patch new file mode 100644 index 00000000000..73e7aafe61f --- /dev/null +++ b/queue-6.0/media-sunxi-fix-some-error-handling-path-of-sun6i_mi.patch @@ -0,0 +1,85 @@ +From 806011f6ae0f90a62f0b9eddc6e166d0ab5e1409 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Aug 2022 09:42:11 +0200 +Subject: media: sunxi: Fix some error handling path of sun6i_mipi_csi2_probe() + +From: Christophe JAILLET + +[ Upstream commit 51e1440d309a74a3e4e252019a00f9d0df329945 ] + +Release some resources in the error handling path of the probe and of +sun6i_mipi_csi2_resources_setup(), as already done in the remove +function. + +Fixes: af54b4f4c17f ("media: sunxi: Add support for the A31 MIPI CSI-2 controller") +Signed-off-by: Christophe JAILLET +Acked-by: Paul Kocialkowski +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../sunxi/sun6i-mipi-csi2/sun6i_mipi_csi2.c | 20 +++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/sunxi/sun6i-mipi-csi2/sun6i_mipi_csi2.c b/drivers/media/platform/sunxi/sun6i-mipi-csi2/sun6i_mipi_csi2.c +index a4e3f9a6b2ff..30d6c0c5161f 100644 +--- a/drivers/media/platform/sunxi/sun6i-mipi-csi2/sun6i_mipi_csi2.c ++++ b/drivers/media/platform/sunxi/sun6i-mipi-csi2/sun6i_mipi_csi2.c +@@ -661,7 +661,8 @@ sun6i_mipi_csi2_resources_setup(struct sun6i_mipi_csi2_device *csi2_dev, + csi2_dev->reset = devm_reset_control_get_shared(dev, NULL); + if (IS_ERR(csi2_dev->reset)) { + dev_err(dev, "failed to get reset controller\n"); +- return PTR_ERR(csi2_dev->reset); ++ ret = PTR_ERR(csi2_dev->reset); ++ goto error_clock_rate_exclusive; + } + + /* D-PHY */ +@@ -669,13 +670,14 @@ sun6i_mipi_csi2_resources_setup(struct sun6i_mipi_csi2_device *csi2_dev, + csi2_dev->dphy = devm_phy_get(dev, "dphy"); + if (IS_ERR(csi2_dev->dphy)) { + dev_err(dev, "failed to get MIPI D-PHY\n"); +- return PTR_ERR(csi2_dev->dphy); ++ ret = PTR_ERR(csi2_dev->dphy); ++ goto error_clock_rate_exclusive; + } + + ret = phy_init(csi2_dev->dphy); + if (ret) { + dev_err(dev, "failed to initialize MIPI D-PHY\n"); +- return ret; ++ goto error_clock_rate_exclusive; + } + + /* Runtime PM */ +@@ -683,6 +685,11 @@ sun6i_mipi_csi2_resources_setup(struct sun6i_mipi_csi2_device *csi2_dev, + pm_runtime_enable(dev); + + return 0; ++ ++error_clock_rate_exclusive: ++ clk_rate_exclusive_put(csi2_dev->clock_mod); ++ ++ return ret; + } + + static void +@@ -712,9 +719,14 @@ static int sun6i_mipi_csi2_probe(struct platform_device *platform_dev) + + ret = sun6i_mipi_csi2_bridge_setup(csi2_dev); + if (ret) +- return ret; ++ goto error_resources; + + return 0; ++ ++error_resources: ++ sun6i_mipi_csi2_resources_cleanup(csi2_dev); ++ ++ return ret; + } + + static int sun6i_mipi_csi2_remove(struct platform_device *platform_dev) +-- +2.35.1 + diff --git a/queue-6.0/media-sunxi-fix-some-error-handling-path-of-sun8i_a8.patch b/queue-6.0/media-sunxi-fix-some-error-handling-path-of-sun8i_a8.patch new file mode 100644 index 00000000000..2f5ea5ce49e --- /dev/null +++ b/queue-6.0/media-sunxi-fix-some-error-handling-path-of-sun8i_a8.patch @@ -0,0 +1,96 @@ +From f5f48d3b1d0c82f8d957ee931e76c417c350fd3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Aug 2022 09:42:01 +0200 +Subject: media: sunxi: Fix some error handling path of + sun8i_a83t_mipi_csi2_probe() + +From: Christophe JAILLET + +[ Upstream commit 466c1e6d05003707e8baa16668e7bc287d875d5e ] + +Release some resources in the error handling path of the probe and of +sun8i_a83t_mipi_csi2_resources_setup(), as already done in the remove +function. + +Fixes: 576d196c522b ("media: sunxi: Add support for the A83T MIPI CSI-2 controller") +Signed-off-by: Christophe JAILLET +Acked-by: Paul Kocialkowski +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../sun8i_a83t_mipi_csi2.c | 23 +++++++++++++++---- + 1 file changed, 18 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/sun8i_a83t_mipi_csi2.c b/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/sun8i_a83t_mipi_csi2.c +index d052ee77ef0a..b032ec13a683 100644 +--- a/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/sun8i_a83t_mipi_csi2.c ++++ b/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/sun8i_a83t_mipi_csi2.c +@@ -719,13 +719,15 @@ sun8i_a83t_mipi_csi2_resources_setup(struct sun8i_a83t_mipi_csi2_device *csi2_de + csi2_dev->clock_mipi = devm_clk_get(dev, "mipi"); + if (IS_ERR(csi2_dev->clock_mipi)) { + dev_err(dev, "failed to acquire mipi clock\n"); +- return PTR_ERR(csi2_dev->clock_mipi); ++ ret = PTR_ERR(csi2_dev->clock_mipi); ++ goto error_clock_rate_exclusive; + } + + csi2_dev->clock_misc = devm_clk_get(dev, "misc"); + if (IS_ERR(csi2_dev->clock_misc)) { + dev_err(dev, "failed to acquire misc clock\n"); +- return PTR_ERR(csi2_dev->clock_misc); ++ ret = PTR_ERR(csi2_dev->clock_misc); ++ goto error_clock_rate_exclusive; + } + + /* Reset */ +@@ -733,7 +735,8 @@ sun8i_a83t_mipi_csi2_resources_setup(struct sun8i_a83t_mipi_csi2_device *csi2_de + csi2_dev->reset = devm_reset_control_get_shared(dev, NULL); + if (IS_ERR(csi2_dev->reset)) { + dev_err(dev, "failed to get reset controller\n"); +- return PTR_ERR(csi2_dev->reset); ++ ret = PTR_ERR(csi2_dev->reset); ++ goto error_clock_rate_exclusive; + } + + /* D-PHY */ +@@ -741,7 +744,7 @@ sun8i_a83t_mipi_csi2_resources_setup(struct sun8i_a83t_mipi_csi2_device *csi2_de + ret = sun8i_a83t_dphy_register(csi2_dev); + if (ret) { + dev_err(dev, "failed to initialize MIPI D-PHY\n"); +- return ret; ++ goto error_clock_rate_exclusive; + } + + /* Runtime PM */ +@@ -749,6 +752,11 @@ sun8i_a83t_mipi_csi2_resources_setup(struct sun8i_a83t_mipi_csi2_device *csi2_de + pm_runtime_enable(dev); + + return 0; ++ ++error_clock_rate_exclusive: ++ clk_rate_exclusive_put(csi2_dev->clock_mod); ++ ++ return ret; + } + + static void +@@ -778,9 +786,14 @@ static int sun8i_a83t_mipi_csi2_probe(struct platform_device *platform_dev) + + ret = sun8i_a83t_mipi_csi2_bridge_setup(csi2_dev); + if (ret) +- return ret; ++ goto error_resources; + + return 0; ++ ++error_resources: ++ sun8i_a83t_mipi_csi2_resources_cleanup(csi2_dev); ++ ++ return ret; + } + + static int sun8i_a83t_mipi_csi2_remove(struct platform_device *platform_dev) +-- +2.35.1 + diff --git a/queue-6.0/media-v4l2-dv-timings-add-sanity-checks-for-blanking.patch b/queue-6.0/media-v4l2-dv-timings-add-sanity-checks-for-blanking.patch new file mode 100644 index 00000000000..c7d5c7203fc --- /dev/null +++ b/queue-6.0/media-v4l2-dv-timings-add-sanity-checks-for-blanking.patch @@ -0,0 +1,48 @@ +From 4fcc64114f24a2d8ec7b72b07a30ea4574ce7a28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 09:00:34 +0100 +Subject: media: v4l2-dv-timings: add sanity checks for blanking values + +From: Hans Verkuil + +[ Upstream commit 4b6d66a45ed34a15721cb9e11492fa1a24bc83df ] + +Add sanity checks to v4l2_valid_dv_timings() to ensure that the provided +blanking values are reasonable. + +Signed-off-by: Hans Verkuil +Fixes: b18787ed1ce3 ([media] v4l2-dv-timings: add new helper module) +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-dv-timings.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c +index af48705c704f..003c32fed3f7 100644 +--- a/drivers/media/v4l2-core/v4l2-dv-timings.c ++++ b/drivers/media/v4l2-core/v4l2-dv-timings.c +@@ -161,6 +161,20 @@ bool v4l2_valid_dv_timings(const struct v4l2_dv_timings *t, + (bt->interlaced && !(caps & V4L2_DV_BT_CAP_INTERLACED)) || + (!bt->interlaced && !(caps & V4L2_DV_BT_CAP_PROGRESSIVE))) + return false; ++ ++ /* sanity checks for the blanking timings */ ++ if (!bt->interlaced && ++ (bt->il_vbackporch || bt->il_vsync || bt->il_vfrontporch)) ++ return false; ++ if (bt->hfrontporch > 2 * bt->width || ++ bt->hsync > 1024 || bt->hbackporch > 1024) ++ return false; ++ if (bt->vfrontporch > 4096 || ++ bt->vsync > 128 || bt->vbackporch > 4096) ++ return false; ++ if (bt->interlaced && (bt->il_vfrontporch > 4096 || ++ bt->il_vsync > 128 || bt->il_vbackporch > 4096)) ++ return false; + return fnc == NULL || fnc(t, fnc_handle); + } + EXPORT_SYMBOL_GPL(v4l2_valid_dv_timings); +-- +2.35.1 + diff --git a/queue-6.0/media-v4l2-fix-v4l2_i2c_subdev_set_name-function-doc.patch b/queue-6.0/media-v4l2-fix-v4l2_i2c_subdev_set_name-function-doc.patch new file mode 100644 index 00000000000..6298c5c77ed --- /dev/null +++ b/queue-6.0/media-v4l2-fix-v4l2_i2c_subdev_set_name-function-doc.patch @@ -0,0 +1,41 @@ +From 8127d4a65aadc4637bbd950405a02f7955fa17d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Jul 2022 09:11:31 +0200 +Subject: media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander Stein + +[ Upstream commit bb9ea2c31fa11b789ade4c3abcdda3c5370a76ab ] + +The doc says the I²C device's name is used if devname is NULL, but +actually the I²C device driver's name is used. + +Fixes: 0658293012af ("media: v4l: subdev: Add a function to set an I²C sub-device's name") +Signed-off-by: Alexander Stein +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + include/media/v4l2-common.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/media/v4l2-common.h b/include/media/v4l2-common.h +index b708d63995f4..2ae2be4c87e5 100644 +--- a/include/media/v4l2-common.h ++++ b/include/media/v4l2-common.h +@@ -175,7 +175,8 @@ struct v4l2_subdev *v4l2_i2c_new_subdev_board(struct v4l2_device *v4l2_dev, + * + * @sd: pointer to &struct v4l2_subdev + * @client: pointer to struct i2c_client +- * @devname: the name of the device; if NULL, the I²C device's name will be used ++ * @devname: the name of the device; if NULL, the I²C device drivers's name ++ * will be used + * @postfix: sub-device specific string to put right after the I²C device name; + * may be NULL + */ +-- +2.35.1 + diff --git a/queue-6.0/media-videodev2.h-v4l2_dv_bt_blanking_height-should-.patch b/queue-6.0/media-videodev2.h-v4l2_dv_bt_blanking_height-should-.patch new file mode 100644 index 00000000000..71b03ad735a --- /dev/null +++ b/queue-6.0/media-videodev2.h-v4l2_dv_bt_blanking_height-should-.patch @@ -0,0 +1,38 @@ +From c49a7da320c95aef8837e6a1b8fbc5dd6902b94e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Oct 2022 16:46:17 +0100 +Subject: media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check + 'interlaced' + +From: Hans Verkuil + +[ Upstream commit 8da7f0976b9071b528c545008de9d10cc81883b1 ] + +If it is a progressive (non-interlaced) format, then ignore the +interlaced timing values. + +Signed-off-by: Hans Verkuil +Fixes: 7f68127fa11f ([media] videodev2.h: defines to calculate blanking and frame sizes) +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + include/uapi/linux/videodev2.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h +index 01e630f2ec78..fbe40307934d 100644 +--- a/include/uapi/linux/videodev2.h ++++ b/include/uapi/linux/videodev2.h +@@ -1602,7 +1602,8 @@ struct v4l2_bt_timings { + ((bt)->width + V4L2_DV_BT_BLANKING_WIDTH(bt)) + #define V4L2_DV_BT_BLANKING_HEIGHT(bt) \ + ((bt)->vfrontporch + (bt)->vsync + (bt)->vbackporch + \ +- (bt)->il_vfrontporch + (bt)->il_vsync + (bt)->il_vbackporch) ++ ((bt)->interlaced ? \ ++ ((bt)->il_vfrontporch + (bt)->il_vsync + (bt)->il_vbackporch) : 0)) + #define V4L2_DV_BT_FRAME_HEIGHT(bt) \ + ((bt)->height + V4L2_DV_BT_BLANKING_HEIGHT(bt)) + +-- +2.35.1 + diff --git a/queue-6.0/media-vivid-dev-bitmap_cap-wasn-t-freed-in-all-cases.patch b/queue-6.0/media-vivid-dev-bitmap_cap-wasn-t-freed-in-all-cases.patch new file mode 100644 index 00000000000..fccc964e2b0 --- /dev/null +++ b/queue-6.0/media-vivid-dev-bitmap_cap-wasn-t-freed-in-all-cases.patch @@ -0,0 +1,75 @@ +From a6bb89e54750d2510dbb50aeaf5e5eaae51cdbc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 15:18:46 +0100 +Subject: media: vivid: dev->bitmap_cap wasn't freed in all cases + +From: Hans Verkuil + +[ Upstream commit 1f65ea411cc7b6ff128d82a3493d7b5648054e6f ] + +Whenever the compose width/height values change, the dev->bitmap_cap +vmalloc'ed array must be freed and dev->bitmap_cap set to NULL. + +This was done in some places, but not all. This is only an issue if +overlay support is enabled and the bitmap clipping is used. + +Signed-off-by: Hans Verkuil +Fixes: ef834f7836ec ([media] vivid: add the video capture and output parts) +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../media/test-drivers/vivid/vivid-vid-cap.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c +index c9eb28b3a03d..99139a8cd4c4 100644 +--- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c ++++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c +@@ -452,6 +452,12 @@ void vivid_update_format_cap(struct vivid_dev *dev, bool keep_controls) + tpg_reset_source(&dev->tpg, dev->src_rect.width, dev->src_rect.height, dev->field_cap); + dev->crop_cap = dev->src_rect; + dev->crop_bounds_cap = dev->src_rect; ++ if (dev->bitmap_cap && ++ (dev->compose_cap.width != dev->crop_cap.width || ++ dev->compose_cap.height != dev->crop_cap.height)) { ++ vfree(dev->bitmap_cap); ++ dev->bitmap_cap = NULL; ++ } + dev->compose_cap = dev->crop_cap; + if (V4L2_FIELD_HAS_T_OR_B(dev->field_cap)) + dev->compose_cap.height /= 2; +@@ -909,6 +915,8 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection + struct vivid_dev *dev = video_drvdata(file); + struct v4l2_rect *crop = &dev->crop_cap; + struct v4l2_rect *compose = &dev->compose_cap; ++ unsigned orig_compose_w = compose->width; ++ unsigned orig_compose_h = compose->height; + unsigned factor = V4L2_FIELD_HAS_T_OR_B(dev->field_cap) ? 2 : 1; + int ret; + +@@ -1025,17 +1033,17 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection + s->r.height /= factor; + } + v4l2_rect_map_inside(&s->r, &dev->fmt_cap_rect); +- if (dev->bitmap_cap && (compose->width != s->r.width || +- compose->height != s->r.height)) { +- vfree(dev->bitmap_cap); +- dev->bitmap_cap = NULL; +- } + *compose = s->r; + break; + default: + return -EINVAL; + } + ++ if (dev->bitmap_cap && (compose->width != orig_compose_w || ++ compose->height != orig_compose_h)) { ++ vfree(dev->bitmap_cap); ++ dev->bitmap_cap = NULL; ++ } + tpg_s_crop_compose(&dev->tpg, crop, compose); + return 0; + } +-- +2.35.1 + diff --git a/queue-6.0/media-vivid-s_fbuf-add-more-sanity-checks.patch b/queue-6.0/media-vivid-s_fbuf-add-more-sanity-checks.patch new file mode 100644 index 00000000000..22535917a86 --- /dev/null +++ b/queue-6.0/media-vivid-s_fbuf-add-more-sanity-checks.patch @@ -0,0 +1,90 @@ +From cf61ba72a7c80d989d7b2c568056ce715d47905c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Oct 2022 15:32:28 +0100 +Subject: media: vivid: s_fbuf: add more sanity checks + +From: Hans Verkuil + +[ Upstream commit f8bcaf714abfc94818dff8c0db84d750433984f4 ] + +VIDIOC_S_FBUF is by definition a scary ioctl, which is why only root +can use it. But at least check if the framebuffer parameters match that +of one of the framebuffer created by vivid, and reject anything else. + +Signed-off-by: Hans Verkuil +Fixes: ef834f7836ec ([media] vivid: add the video capture and output parts) +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/test-drivers/vivid/vivid-core.c | 22 +++++++++++++++++++ + drivers/media/test-drivers/vivid/vivid-core.h | 2 ++ + .../media/test-drivers/vivid/vivid-vid-cap.c | 9 +++++++- + 3 files changed, 32 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/test-drivers/vivid/vivid-core.c b/drivers/media/test-drivers/vivid/vivid-core.c +index 04b75666bad4..61d48fbc3d15 100644 +--- a/drivers/media/test-drivers/vivid/vivid-core.c ++++ b/drivers/media/test-drivers/vivid/vivid-core.c +@@ -339,6 +339,28 @@ static int vidioc_g_fbuf(struct file *file, void *fh, struct v4l2_framebuffer *a + return vivid_vid_out_g_fbuf(file, fh, a); + } + ++/* ++ * Only support the framebuffer of one of the vivid instances. ++ * Anything else is rejected. ++ */ ++bool vivid_validate_fb(const struct v4l2_framebuffer *a) ++{ ++ struct vivid_dev *dev; ++ int i; ++ ++ for (i = 0; i < n_devs; i++) { ++ dev = vivid_devs[i]; ++ if (!dev || !dev->video_pbase) ++ continue; ++ if ((unsigned long)a->base == dev->video_pbase && ++ a->fmt.width <= dev->display_width && ++ a->fmt.height <= dev->display_height && ++ a->fmt.bytesperline <= dev->display_byte_stride) ++ return true; ++ } ++ return false; ++} ++ + static int vidioc_s_fbuf(struct file *file, void *fh, const struct v4l2_framebuffer *a) + { + struct video_device *vdev = video_devdata(file); +diff --git a/drivers/media/test-drivers/vivid/vivid-core.h b/drivers/media/test-drivers/vivid/vivid-core.h +index 176b72cb143b..5def9b2a359a 100644 +--- a/drivers/media/test-drivers/vivid/vivid-core.h ++++ b/drivers/media/test-drivers/vivid/vivid-core.h +@@ -610,4 +610,6 @@ static inline bool vivid_is_hdmi_out(const struct vivid_dev *dev) + return dev->output_type[dev->output] == HDMI; + } + ++bool vivid_validate_fb(const struct v4l2_framebuffer *a); ++ + #endif +diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c +index b9caa4b26209..c9eb28b3a03d 100644 +--- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c ++++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c +@@ -1272,7 +1272,14 @@ int vivid_vid_cap_s_fbuf(struct file *file, void *fh, + return -EINVAL; + if (a->fmt.bytesperline < (a->fmt.width * fmt->bit_depth[0]) / 8) + return -EINVAL; +- if (a->fmt.height * a->fmt.bytesperline < a->fmt.sizeimage) ++ if (a->fmt.bytesperline > a->fmt.sizeimage / a->fmt.height) ++ return -EINVAL; ++ ++ /* ++ * Only support the framebuffer of one of the vivid instances. ++ * Anything else is rejected. ++ */ ++ if (!vivid_validate_fb(a)) + return -EINVAL; + + dev->fb_vbase_cap = phys_to_virt((unsigned long)a->base); +-- +2.35.1 + diff --git a/queue-6.0/media-vivid-set-num_in-outputs-to-0-if-not-supported.patch b/queue-6.0/media-vivid-set-num_in-outputs-to-0-if-not-supported.patch new file mode 100644 index 00000000000..a5dfdfa0834 --- /dev/null +++ b/queue-6.0/media-vivid-set-num_in-outputs-to-0-if-not-supported.patch @@ -0,0 +1,57 @@ +From 8f3878356e992bc57d224d36839cf30a692236e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 15:09:06 +0100 +Subject: media: vivid: set num_in/outputs to 0 if not supported + +From: Hans Verkuil + +[ Upstream commit 69d78a80da4ef12faf2a6f9cfa2097ab4ac43983 ] + +If node_types does not have video/vbi/meta inputs or outputs, +then set num_inputs/num_outputs to 0 instead of 1. + +Signed-off-by: Hans Verkuil +Fixes: 0c90f649d2f5 (media: vivid: add vivid_create_queue() helper) +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/test-drivers/vivid/vivid-core.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/test-drivers/vivid/vivid-core.c b/drivers/media/test-drivers/vivid/vivid-core.c +index 61d48fbc3d15..f28440e6c9f8 100644 +--- a/drivers/media/test-drivers/vivid/vivid-core.c ++++ b/drivers/media/test-drivers/vivid/vivid-core.c +@@ -942,8 +942,12 @@ static int vivid_detect_feature_set(struct vivid_dev *dev, int inst, + + /* how many inputs do we have and of what type? */ + dev->num_inputs = num_inputs[inst]; +- if (dev->num_inputs < 1) +- dev->num_inputs = 1; ++ if (node_type & 0x20007) { ++ if (dev->num_inputs < 1) ++ dev->num_inputs = 1; ++ } else { ++ dev->num_inputs = 0; ++ } + if (dev->num_inputs >= MAX_INPUTS) + dev->num_inputs = MAX_INPUTS; + for (i = 0; i < dev->num_inputs; i++) { +@@ -960,8 +964,12 @@ static int vivid_detect_feature_set(struct vivid_dev *dev, int inst, + + /* how many outputs do we have and of what type? */ + dev->num_outputs = num_outputs[inst]; +- if (dev->num_outputs < 1) +- dev->num_outputs = 1; ++ if (node_type & 0x40300) { ++ if (dev->num_outputs < 1) ++ dev->num_outputs = 1; ++ } else { ++ dev->num_outputs = 0; ++ } + if (dev->num_outputs >= MAX_OUTPUTS) + dev->num_outputs = MAX_OUTPUTS; + for (i = 0; i < dev->num_outputs; i++) { +-- +2.35.1 + diff --git a/queue-6.0/mptcp-set-msk-local-address-earlier.patch b/queue-6.0/mptcp-set-msk-local-address-earlier.patch new file mode 100644 index 00000000000..ea1e75fc2c8 --- /dev/null +++ b/queue-6.0/mptcp-set-msk-local-address-earlier.patch @@ -0,0 +1,98 @@ +From 309e6cb154da5c6e84867a2a8024f4b20c8a06ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Oct 2022 15:58:54 -0700 +Subject: mptcp: set msk local address earlier + +From: Paolo Abeni + +[ Upstream commit e72e4032637f4646554794ac28a3abecc6c2416d ] + +The mptcp_pm_nl_get_local_id() code assumes that the msk local address +is available at that point. For passive sockets, we initialize such +address at accept() time. + +Depending on the running configuration and the user-space timing, a +passive MPJ subflow can join the msk socket before accept() completes. + +In such case, the PM assigns a wrong local id to the MPJ subflow +and later PM netlink operations will end-up touching the wrong/unexpected +subflow. + +All the above causes sporadic self-tests failures, especially when +the host is heavy loaded. + +Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/308 +Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") +Fixes: d045b9eb95a9 ("mptcp: introduce implicit endpoints") +Reviewed-by: Mat Martineau +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/protocol.c | 3 +-- + net/mptcp/protocol.h | 1 + + net/mptcp/subflow.c | 7 +++++++ + 3 files changed, 9 insertions(+), 2 deletions(-) + +diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c +index f8897a70c11d..b568f55998f3 100644 +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -2867,7 +2867,7 @@ static void mptcp_close(struct sock *sk, long timeout) + sock_put(sk); + } + +-static void mptcp_copy_inaddrs(struct sock *msk, const struct sock *ssk) ++void mptcp_copy_inaddrs(struct sock *msk, const struct sock *ssk) + { + #if IS_ENABLED(CONFIG_MPTCP_IPV6) + const struct ipv6_pinfo *ssk6 = inet6_sk(ssk); +@@ -3613,7 +3613,6 @@ static int mptcp_stream_accept(struct socket *sock, struct socket *newsock, + if (mptcp_is_fully_established(newsk)) + mptcp_pm_fully_established(msk, msk->first, GFP_KERNEL); + +- mptcp_copy_inaddrs(newsk, msk->first); + mptcp_rcv_space_init(msk, msk->first); + mptcp_propagate_sndbuf(newsk, msk->first); + +diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h +index 8f372b8f059c..c1eaa1685592 100644 +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -597,6 +597,7 @@ int mptcp_is_checksum_enabled(const struct net *net); + int mptcp_allow_join_id0(const struct net *net); + unsigned int mptcp_stale_loss_cnt(const struct net *net); + int mptcp_get_pm_type(const struct net *net); ++void mptcp_copy_inaddrs(struct sock *msk, const struct sock *ssk); + void mptcp_subflow_fully_established(struct mptcp_subflow_context *subflow, + struct mptcp_options_received *mp_opt); + bool __mptcp_retransmit_pending_data(struct sock *sk); +diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c +index 07dd23d0fe04..02a54d59697b 100644 +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -723,6 +723,8 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, + goto dispose_child; + } + ++ if (new_msk) ++ mptcp_copy_inaddrs(new_msk, child); + subflow_drop_ctx(child); + goto out; + } +@@ -750,6 +752,11 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, + ctx->conn = new_msk; + new_msk = NULL; + ++ /* set msk addresses early to ensure mptcp_pm_get_local_id() ++ * uses the correct data ++ */ ++ mptcp_copy_inaddrs(ctx->conn, child); ++ + /* with OoO packets we can reach here without ingress + * mpc option + */ +-- +2.35.1 + diff --git a/queue-6.0/mtd-core-add-missing-of_node_get-in-dynamic-partitio.patch b/queue-6.0/mtd-core-add-missing-of_node_get-in-dynamic-partitio.patch new file mode 100644 index 00000000000..9217c61e897 --- /dev/null +++ b/queue-6.0/mtd-core-add-missing-of_node_get-in-dynamic-partitio.patch @@ -0,0 +1,110 @@ +From 284dbeca8ed44aaf1427bdf3de4d68e34de29297 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 07:18:22 +0200 +Subject: mtd: core: add missing of_node_get() in dynamic partitions code +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 12b58961de0bd88b3c7dfa5d21f6d67f4678b780 ] + +This fixes unbalanced of_node_put(): +[ 1.078910] 6 cmdlinepart partitions found on MTD device gpmi-nand +[ 1.085116] Creating 6 MTD partitions on "gpmi-nand": +[ 1.090181] 0x000000000000-0x000008000000 : "nandboot" +[ 1.096952] 0x000008000000-0x000009000000 : "nandfit" +[ 1.103547] 0x000009000000-0x00000b000000 : "nandkernel" +[ 1.110317] 0x00000b000000-0x00000c000000 : "nanddtb" +[ 1.115525] ------------[ cut here ]------------ +[ 1.120141] refcount_t: addition on 0; use-after-free. +[ 1.125328] WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0xdc/0x148 +[ 1.133528] Modules linked in: +[ 1.136589] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc7-next-20220930-04543-g8cf3f7 +[ 1.146342] Hardware name: Freescale i.MX8DXL DDR3L EVK (DT) +[ 1.151999] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 1.158965] pc : refcount_warn_saturate+0xdc/0x148 +[ 1.163760] lr : refcount_warn_saturate+0xdc/0x148 +[ 1.168556] sp : ffff800009ddb080 +[ 1.171866] x29: ffff800009ddb080 x28: ffff800009ddb35a x27: 0000000000000002 +[ 1.179015] x26: ffff8000098b06ad x25: ffffffffffffffff x24: ffff0a00ffffff05 +[ 1.186165] x23: ffff00001fdf6470 x22: ffff800009ddb367 x21: 0000000000000000 +[ 1.193314] x20: ffff00001fdfebe8 x19: ffff00001fdfec50 x18: ffffffffffffffff +[ 1.200464] x17: 0000000000000000 x16: 0000000000000118 x15: 0000000000000004 +[ 1.207614] x14: 0000000000000fff x13: ffff800009bca248 x12: 0000000000000003 +[ 1.214764] x11: 00000000ffffefff x10: c0000000ffffefff x9 : 4762cb2ccb52de00 +[ 1.221914] x8 : 4762cb2ccb52de00 x7 : 205d313431303231 x6 : 312e31202020205b +[ 1.229063] x5 : ffff800009d55c1f x4 : 0000000000000001 x3 : 0000000000000000 +[ 1.236213] x2 : 0000000000000000 x1 : ffff800009954be6 x0 : 000000000000002a +[ 1.243365] Call trace: +[ 1.245806] refcount_warn_saturate+0xdc/0x148 +[ 1.250253] kobject_get+0x98/0x9c +[ 1.253658] of_node_get+0x20/0x34 +[ 1.257072] of_fwnode_get+0x3c/0x54 +[ 1.260652] fwnode_get_nth_parent+0xd8/0xf4 +[ 1.264926] fwnode_full_name_string+0x3c/0xb4 +[ 1.269373] device_node_string+0x498/0x5b4 +[ 1.273561] pointer+0x41c/0x5d0 +[ 1.276793] vsnprintf+0x4d8/0x694 +[ 1.280198] vprintk_store+0x164/0x528 +[ 1.283951] vprintk_emit+0x98/0x164 +[ 1.287530] vprintk_default+0x44/0x6c +[ 1.291284] vprintk+0xf0/0x134 +[ 1.294428] _printk+0x54/0x7c +[ 1.297486] of_node_release+0xe8/0x128 +[ 1.301326] kobject_put+0x98/0xfc +[ 1.304732] of_node_put+0x1c/0x28 +[ 1.308137] add_mtd_device+0x484/0x6d4 +[ 1.311977] add_mtd_partitions+0xf0/0x1d0 +[ 1.316078] parse_mtd_partitions+0x45c/0x518 +[ 1.320439] mtd_device_parse_register+0xb0/0x274 +[ 1.325147] gpmi_nand_probe+0x51c/0x650 +[ 1.329074] platform_probe+0xa8/0xd0 +[ 1.332740] really_probe+0x130/0x334 +[ 1.336406] __driver_probe_device+0xb4/0xe0 +[ 1.340681] driver_probe_device+0x3c/0x1f8 +[ 1.344869] __driver_attach+0xdc/0x1a4 +[ 1.348708] bus_for_each_dev+0x80/0xcc +[ 1.352548] driver_attach+0x24/0x30 +[ 1.356127] bus_add_driver+0x108/0x1f4 +[ 1.359967] driver_register+0x78/0x114 +[ 1.363807] __platform_driver_register+0x24/0x30 +[ 1.368515] gpmi_nand_driver_init+0x1c/0x28 +[ 1.372798] do_one_initcall+0xbc/0x238 +[ 1.376638] do_initcall_level+0x94/0xb4 +[ 1.380565] do_initcalls+0x54/0x94 +[ 1.384058] do_basic_setup+0x1c/0x28 +[ 1.387724] kernel_init_freeable+0x110/0x188 +[ 1.392084] kernel_init+0x20/0x1a0 +[ 1.395578] ret_from_fork+0x10/0x20 +[ 1.399157] ---[ end trace 0000000000000000 ]--- +[ 1.403782] ------------[ cut here ]------------ + +Reported-by: Han Xu +Fixes: ad9b10d1eaada169 ("mtd: core: introduce of support for dynamic partitions") +Signed-off-by: Rafał Miłecki +Tested-by: Han Xu +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20221018051822.28685-1-zajec5@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtdcore.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c +index a9b8be9f40dc..477707bcad97 100644 +--- a/drivers/mtd/mtdcore.c ++++ b/drivers/mtd/mtdcore.c +@@ -562,7 +562,7 @@ static void mtd_check_of_node(struct mtd_info *mtd) + if (!mtd_is_partition(mtd)) + return; + parent = mtd->parent; +- parent_dn = dev_of_node(&parent->dev); ++ parent_dn = of_node_get(dev_of_node(&parent->dev)); + if (!parent_dn) + return; + +-- +2.35.1 + diff --git a/queue-6.0/mtd-rawnand-intel-add-missing-of_node_put-in-ebu_nan.patch b/queue-6.0/mtd-rawnand-intel-add-missing-of_node_put-in-ebu_nan.patch new file mode 100644 index 00000000000..07442e6ddd4 --- /dev/null +++ b/queue-6.0/mtd-rawnand-intel-add-missing-of_node_put-in-ebu_nan.patch @@ -0,0 +1,82 @@ +From f46a701453272c35265aad9822fa22658b91f82c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Sep 2022 21:10:10 +0800 +Subject: mtd: rawnand: intel: Add missing of_node_put() in ebu_nand_probe() + +From: Yang Yingliang + +[ Upstream commit 1f3b494d1fc18ebb37aaa47107e9b84bf5b54ff7 ] + +The 'chip_np' returned by of_get_next_child() with refcount decremented, +of_node_put() need be called in error path to decrease the refcount. + +Fixes: bfc618fcc3f1 ("mtd: rawnand: intel: Read the chip-select line from the correct OF node") +Signed-off-by: Yang Yingliang +Reviewed-by: Martin Blumenstingl +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220924131010.957117-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/intel-nand-controller.c | 23 +++++++++++++------- + 1 file changed, 15 insertions(+), 8 deletions(-) + +diff --git a/drivers/mtd/nand/raw/intel-nand-controller.c b/drivers/mtd/nand/raw/intel-nand-controller.c +index bd821e435329..4c721704d2fd 100644 +--- a/drivers/mtd/nand/raw/intel-nand-controller.c ++++ b/drivers/mtd/nand/raw/intel-nand-controller.c +@@ -611,11 +611,12 @@ static int ebu_nand_probe(struct platform_device *pdev) + ret = of_property_read_u32(chip_np, "reg", &cs); + if (ret) { + dev_err(dev, "failed to get chip select: %d\n", ret); +- return ret; ++ goto err_of_node_put; + } + if (cs >= MAX_CS) { + dev_err(dev, "got invalid chip select: %d\n", cs); +- return -EINVAL; ++ ret = -EINVAL; ++ goto err_of_node_put; + } + + ebu_host->cs_num = cs; +@@ -623,18 +624,22 @@ static int ebu_nand_probe(struct platform_device *pdev) + resname = devm_kasprintf(dev, GFP_KERNEL, "nand_cs%d", cs); + ebu_host->cs[cs].chipaddr = devm_platform_ioremap_resource_byname(pdev, + resname); +- if (IS_ERR(ebu_host->cs[cs].chipaddr)) +- return PTR_ERR(ebu_host->cs[cs].chipaddr); ++ if (IS_ERR(ebu_host->cs[cs].chipaddr)) { ++ ret = PTR_ERR(ebu_host->cs[cs].chipaddr); ++ goto err_of_node_put; ++ } + + ebu_host->clk = devm_clk_get(dev, NULL); +- if (IS_ERR(ebu_host->clk)) +- return dev_err_probe(dev, PTR_ERR(ebu_host->clk), +- "failed to get clock\n"); ++ if (IS_ERR(ebu_host->clk)) { ++ ret = dev_err_probe(dev, PTR_ERR(ebu_host->clk), ++ "failed to get clock\n"); ++ goto err_of_node_put; ++ } + + ret = clk_prepare_enable(ebu_host->clk); + if (ret) { + dev_err(dev, "failed to enable clock: %d\n", ret); +- return ret; ++ goto err_of_node_put; + } + ebu_host->clk_rate = clk_get_rate(ebu_host->clk); + +@@ -699,6 +704,8 @@ static int ebu_nand_probe(struct platform_device *pdev) + ebu_dma_cleanup(ebu_host); + err_disable_unprepare_clk: + clk_disable_unprepare(ebu_host->clk); ++err_of_node_put: ++ of_node_put(chip_np); + + return ret; + } +-- +2.35.1 + diff --git a/queue-6.0/mtd-rawnand-intel-remove-unused-nand_pa-member-from-.patch b/queue-6.0/mtd-rawnand-intel-remove-unused-nand_pa-member-from-.patch new file mode 100644 index 00000000000..5d896957062 --- /dev/null +++ b/queue-6.0/mtd-rawnand-intel-remove-unused-nand_pa-member-from-.patch @@ -0,0 +1,44 @@ +From 99e1c63c289aad4f7cd26ee9786944fa0832f8ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Jul 2022 01:12:25 +0200 +Subject: mtd: rawnand: intel: Remove unused nand_pa member from ebu_nand_cs + +From: Martin Blumenstingl + +[ Upstream commit dbe5f7880fb020f1984f72105189e877bd2c808c ] + +The nand_pa member from struct ebu_nand_cs is only written but never +read. Remove this unused and unneeded member. + +Signed-off-by: Martin Blumenstingl +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220702231227.1579176-7-martin.blumenstingl@googlemail.com +Stable-dep-of: 1f3b494d1fc1 ("mtd: rawnand: intel: Add missing of_node_put() in ebu_nand_probe()") +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/intel-nand-controller.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/mtd/nand/raw/intel-nand-controller.c b/drivers/mtd/nand/raw/intel-nand-controller.c +index 056835fd4562..8c78a05099bf 100644 +--- a/drivers/mtd/nand/raw/intel-nand-controller.c ++++ b/drivers/mtd/nand/raw/intel-nand-controller.c +@@ -108,7 +108,6 @@ + + struct ebu_nand_cs { + void __iomem *chipaddr; +- dma_addr_t nand_pa; + u32 addr_sel; + }; + +@@ -628,7 +627,6 @@ static int ebu_nand_probe(struct platform_device *pdev) + ebu_host->cs[cs].chipaddr = devm_ioremap_resource(dev, res); + if (IS_ERR(ebu_host->cs[cs].chipaddr)) + return PTR_ERR(ebu_host->cs[cs].chipaddr); +- ebu_host->cs[cs].nand_pa = res->start; + + ebu_host->clk = devm_clk_get(dev, NULL); + if (IS_ERR(ebu_host->clk)) +-- +2.35.1 + diff --git a/queue-6.0/mtd-rawnand-intel-use-devm_platform_ioremap_resource.patch b/queue-6.0/mtd-rawnand-intel-use-devm_platform_ioremap_resource.patch new file mode 100644 index 00000000000..d974c167e3e --- /dev/null +++ b/queue-6.0/mtd-rawnand-intel-use-devm_platform_ioremap_resource.patch @@ -0,0 +1,56 @@ +From d5994fbd4241680157f4b8a3d06abcca3d7de863 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Jul 2022 01:12:27 +0200 +Subject: mtd: rawnand: intel: Use devm_platform_ioremap_resource_byname() + +From: Martin Blumenstingl + +[ Upstream commit 7471a53ddce54cee9b7a340dc930eb35b02c9eed ] + +Switch from open-coded platform_get_resource_byname() and +devm_ioremap_resource() to devm_platform_ioremap_resource_byname() where +possible to simplify the code. + +Signed-off-by: Martin Blumenstingl +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220702231227.1579176-9-martin.blumenstingl@googlemail.com +Stable-dep-of: 1f3b494d1fc1 ("mtd: rawnand: intel: Add missing of_node_put() in ebu_nand_probe()") +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/intel-nand-controller.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/mtd/nand/raw/intel-nand-controller.c b/drivers/mtd/nand/raw/intel-nand-controller.c +index 8c78a05099bf..bd821e435329 100644 +--- a/drivers/mtd/nand/raw/intel-nand-controller.c ++++ b/drivers/mtd/nand/raw/intel-nand-controller.c +@@ -595,13 +595,11 @@ static int ebu_nand_probe(struct platform_device *pdev) + ebu_host->dev = dev; + nand_controller_init(&ebu_host->controller); + +- res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "ebunand"); +- ebu_host->ebu = devm_ioremap_resource(&pdev->dev, res); ++ ebu_host->ebu = devm_platform_ioremap_resource_byname(pdev, "ebunand"); + if (IS_ERR(ebu_host->ebu)) + return PTR_ERR(ebu_host->ebu); + +- res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "hsnand"); +- ebu_host->hsnand = devm_ioremap_resource(&pdev->dev, res); ++ ebu_host->hsnand = devm_platform_ioremap_resource_byname(pdev, "hsnand"); + if (IS_ERR(ebu_host->hsnand)) + return PTR_ERR(ebu_host->hsnand); + +@@ -623,8 +621,8 @@ static int ebu_nand_probe(struct platform_device *pdev) + ebu_host->cs_num = cs; + + resname = devm_kasprintf(dev, GFP_KERNEL, "nand_cs%d", cs); +- res = platform_get_resource_byname(pdev, IORESOURCE_MEM, resname); +- ebu_host->cs[cs].chipaddr = devm_ioremap_resource(dev, res); ++ ebu_host->cs[cs].chipaddr = devm_platform_ioremap_resource_byname(pdev, ++ resname); + if (IS_ERR(ebu_host->cs[cs].chipaddr)) + return PTR_ERR(ebu_host->cs[cs].chipaddr); + +-- +2.35.1 + diff --git a/queue-6.0/net-bcmsysport-indicate-mac-is-in-charge-of-phy-pm.patch b/queue-6.0/net-bcmsysport-indicate-mac-is-in-charge-of-phy-pm.patch new file mode 100644 index 00000000000..f2669e50eda --- /dev/null +++ b/queue-6.0/net-bcmsysport-indicate-mac-is-in-charge-of-phy-pm.patch @@ -0,0 +1,40 @@ +From 92a9a871a5b89e235cd903a8560b96548510c781 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Oct 2022 16:42:01 -0700 +Subject: net: bcmsysport: Indicate MAC is in charge of PHY PM + +From: Florian Fainelli + +[ Upstream commit 9f172134dde7e4f5bf4b9139f23a1e741ec1c36e ] + +Avoid the PHY library call unnecessarily into the suspend/resume +functions by setting phydev->mac_managed_pm to true. The SYSTEMPORT +driver essentially does exactly what mdio_bus_phy_resume() does by +calling phy_resume(). + +Fixes: fba863b81604 ("net: phy: make PHY PM ops a no-op if MAC driver manages PHY PM") +Signed-off-by: Florian Fainelli +Link: https://lore.kernel.org/r/20221025234201.2549360-1-f.fainelli@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bcmsysport.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index 47fc8e6963d5..2f01d4b0a9aa 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -1991,6 +1991,9 @@ static int bcm_sysport_open(struct net_device *dev) + goto out_clk_disable; + } + ++ /* Indicate that the MAC is responsible for PHY PM */ ++ phydev->mac_managed_pm = true; ++ + /* Reset house keeping link status */ + priv->old_duplex = -1; + priv->old_link = -1; +-- +2.35.1 + diff --git a/queue-6.0/net-broadcom-bcm4908_enet-update-tx-stats-after-actu.patch b/queue-6.0/net-broadcom-bcm4908_enet-update-tx-stats-after-actu.patch new file mode 100644 index 00000000000..6627e9a7bc6 --- /dev/null +++ b/queue-6.0/net-broadcom-bcm4908_enet-update-tx-stats-after-actu.patch @@ -0,0 +1,75 @@ +From fc571d09e2bcb2e0221d5a10bc39956799de0efc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 13:24:30 +0200 +Subject: net: broadcom: bcm4908_enet: update TX stats after actual + transmission +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit ef3556ee16c68735ec69bd08df41d1cd83b14ad3 ] + +Queueing packets doesn't guarantee their transmission. Update TX stats +after hardware confirms consuming submitted data. + +This also fixes a possible race and NULL dereference. +bcm4908_enet_start_xmit() could try to access skb after freeing it in +the bcm4908_enet_poll_tx(). + +Reported-by: Florian Fainelli +Fixes: 4feffeadbcb2e ("net: broadcom: bcm4908enet: add BCM4908 controller driver") +Signed-off-by: Rafał Miłecki +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20221027112430.8696-1-zajec5@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bcm4908_enet.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bcm4908_enet.c b/drivers/net/ethernet/broadcom/bcm4908_enet.c +index c131d8118489..5ec429663f4c 100644 +--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c ++++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c +@@ -561,8 +561,6 @@ static int bcm4908_enet_start_xmit(struct sk_buff *skb, struct net_device *netde + + if (++ring->write_idx == ring->length - 1) + ring->write_idx = 0; +- enet->netdev->stats.tx_bytes += skb->len; +- enet->netdev->stats.tx_packets++; + + return NETDEV_TX_OK; + } +@@ -635,6 +633,7 @@ static int bcm4908_enet_poll_tx(struct napi_struct *napi, int weight) + struct bcm4908_enet_dma_ring_bd *buf_desc; + struct bcm4908_enet_dma_ring_slot *slot; + struct device *dev = enet->dev; ++ unsigned int bytes = 0; + int handled = 0; + + while (handled < weight && tx_ring->read_idx != tx_ring->write_idx) { +@@ -645,12 +644,17 @@ static int bcm4908_enet_poll_tx(struct napi_struct *napi, int weight) + + dma_unmap_single(dev, slot->dma_addr, slot->len, DMA_TO_DEVICE); + dev_kfree_skb(slot->skb); +- if (++tx_ring->read_idx == tx_ring->length) +- tx_ring->read_idx = 0; + + handled++; ++ bytes += slot->len; ++ ++ if (++tx_ring->read_idx == tx_ring->length) ++ tx_ring->read_idx = 0; + } + ++ enet->netdev->stats.tx_packets += handled; ++ enet->netdev->stats.tx_bytes += bytes; ++ + if (handled < weight) { + napi_complete_done(napi, handled); + bcm4908_enet_dma_ring_intrs_on(enet, tx_ring); +-- +2.35.1 + diff --git a/queue-6.0/net-do-not-sense-pfmemalloc-status-in-skb_append_pag.patch b/queue-6.0/net-do-not-sense-pfmemalloc-status-in-skb_append_pag.patch new file mode 100644 index 00000000000..cde5f0e37ee --- /dev/null +++ b/queue-6.0/net-do-not-sense-pfmemalloc-status-in-skb_append_pag.patch @@ -0,0 +1,103 @@ +From 451cec176ea52ad83752f1e18d575b8e1214ad48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 04:03:46 +0000 +Subject: net: do not sense pfmemalloc status in skb_append_pagefrags() + +From: Eric Dumazet + +[ Upstream commit 228ebc41dfab5b5d34cd76835ddb0ca8ee12f513 ] + +skb_append_pagefrags() is used by af_unix and udp sendpage() +implementation so far. + +In commit 326140063946 ("tcp: TX zerocopy should not sense +pfmemalloc status") we explained why we should not sense +pfmemalloc status for pages owned by user space. + +We should also use skb_fill_page_desc_noacc() +in skb_append_pagefrags() to avoid following KCSAN report: + +BUG: KCSAN: data-race in lru_add_fn / skb_append_pagefrags + +write to 0xffffea00058fc1c8 of 8 bytes by task 17319 on cpu 0: +__list_add include/linux/list.h:73 [inline] +list_add include/linux/list.h:88 [inline] +lruvec_add_folio include/linux/mm_inline.h:323 [inline] +lru_add_fn+0x327/0x410 mm/swap.c:228 +folio_batch_move_lru+0x1e1/0x2a0 mm/swap.c:246 +lru_add_drain_cpu+0x73/0x250 mm/swap.c:669 +lru_add_drain+0x21/0x60 mm/swap.c:773 +free_pages_and_swap_cache+0x16/0x70 mm/swap_state.c:311 +tlb_batch_pages_flush mm/mmu_gather.c:59 [inline] +tlb_flush_mmu_free mm/mmu_gather.c:256 [inline] +tlb_flush_mmu+0x5b2/0x640 mm/mmu_gather.c:263 +tlb_finish_mmu+0x86/0x100 mm/mmu_gather.c:363 +exit_mmap+0x190/0x4d0 mm/mmap.c:3098 +__mmput+0x27/0x1b0 kernel/fork.c:1185 +mmput+0x3d/0x50 kernel/fork.c:1207 +copy_process+0x19fc/0x2100 kernel/fork.c:2518 +kernel_clone+0x166/0x550 kernel/fork.c:2671 +__do_sys_clone kernel/fork.c:2812 [inline] +__se_sys_clone kernel/fork.c:2796 [inline] +__x64_sys_clone+0xc3/0xf0 kernel/fork.c:2796 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +read to 0xffffea00058fc1c8 of 8 bytes by task 17325 on cpu 1: +page_is_pfmemalloc include/linux/mm.h:1817 [inline] +__skb_fill_page_desc include/linux/skbuff.h:2432 [inline] +skb_fill_page_desc include/linux/skbuff.h:2453 [inline] +skb_append_pagefrags+0x210/0x600 net/core/skbuff.c:3974 +unix_stream_sendpage+0x45e/0x990 net/unix/af_unix.c:2338 +kernel_sendpage+0x184/0x300 net/socket.c:3561 +sock_sendpage+0x5a/0x70 net/socket.c:1054 +pipe_to_sendpage+0x128/0x160 fs/splice.c:361 +splice_from_pipe_feed fs/splice.c:415 [inline] +__splice_from_pipe+0x222/0x4d0 fs/splice.c:559 +splice_from_pipe fs/splice.c:594 [inline] +generic_splice_sendpage+0x89/0xc0 fs/splice.c:743 +do_splice_from fs/splice.c:764 [inline] +direct_splice_actor+0x80/0xa0 fs/splice.c:931 +splice_direct_to_actor+0x305/0x620 fs/splice.c:886 +do_splice_direct+0xfb/0x180 fs/splice.c:974 +do_sendfile+0x3bf/0x910 fs/read_write.c:1255 +__do_sys_sendfile64 fs/read_write.c:1323 [inline] +__se_sys_sendfile64 fs/read_write.c:1309 [inline] +__x64_sys_sendfile64+0x10c/0x150 fs/read_write.c:1309 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +value changed: 0x0000000000000000 -> 0xffffea00058fc188 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 PID: 17325 Comm: syz-executor.0 Not tainted 6.1.0-rc1-syzkaller-00158-g440b7895c990-dirty #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 + +Fixes: 326140063946 ("tcp: TX zerocopy should not sense pfmemalloc status") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20221027040346.1104204-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/skbuff.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 417463da4fac..5e1a8eeb5e32 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -3868,7 +3868,7 @@ int skb_append_pagefrags(struct sk_buff *skb, struct page *page, + } else if (i < MAX_SKB_FRAGS) { + skb_zcopy_downgrade_managed(skb); + get_page(page); +- skb_fill_page_desc(skb, i, page, offset, size); ++ skb_fill_page_desc_noacc(skb, i, page, offset, size); + } else { + return -EMSGSIZE; + } +-- +2.35.1 + diff --git a/queue-6.0/net-ehea-fix-possible-memory-leak-in-ehea_register_p.patch b/queue-6.0/net-ehea-fix-possible-memory-leak-in-ehea_register_p.patch new file mode 100644 index 00000000000..f73985049ce --- /dev/null +++ b/queue-6.0/net-ehea-fix-possible-memory-leak-in-ehea_register_p.patch @@ -0,0 +1,39 @@ +From f1877f84863f48c7b5d1db5c1d98c304f09ded3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Oct 2022 21:00:11 +0800 +Subject: net: ehea: fix possible memory leak in ehea_register_port() + +From: Yang Yingliang + +[ Upstream commit 0e7ce23a917a9cc83ca3c779fbba836bca3bcf1e ] + +If of_device_register() returns error, the of node and the +name allocated in dev_set_name() is leaked, call put_device() +to give up the reference that was set in device_initialize(), +so that of node is put in logical_port_release() and the name +is freed in kobject_cleanup(). + +Fixes: 1acf2318dd13 ("ehea: dynamic add / remove port") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221025130011.1071357-1-yangyingliang@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ehea/ehea_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c +index 5dc302880f5f..acecf25a6041 100644 +--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c ++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c +@@ -2900,6 +2900,7 @@ static struct device *ehea_register_port(struct ehea_port *port, + ret = of_device_register(&port->ofdev); + if (ret) { + pr_err("failed to register device. ret=%d\n", ret); ++ put_device(&port->ofdev.dev); + goto out; + } + +-- +2.35.1 + diff --git a/queue-6.0/net-enetc-survive-memory-pressure-without-crashing.patch b/queue-6.0/net-enetc-survive-memory-pressure-without-crashing.patch new file mode 100644 index 00000000000..f5bc68a9c70 --- /dev/null +++ b/queue-6.0/net-enetc-survive-memory-pressure-without-crashing.patch @@ -0,0 +1,101 @@ +From 23d98aef0db9c66f8cc239c222983ba34f81f4bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 21:29:25 +0300 +Subject: net: enetc: survive memory pressure without crashing + +From: Vladimir Oltean + +[ Upstream commit 84ce1ca3fe9e1249bf21176ff162200f1c4e5ed1 ] + +Under memory pressure, enetc_refill_rx_ring() may fail, and when called +during the enetc_open() -> enetc_setup_rxbdr() procedure, this is not +checked for. + +An extreme case of memory pressure will result in exactly zero buffers +being allocated for the RX ring, and in such a case it is expected that +hardware drops all RX packets due to lack of buffers. + +This does not happen, because the reset-default value of the consumer +and produces index is 0, and this makes the ENETC think that all buffers +have been initialized and that it owns them (when in reality none were). + +The hardware guide explains this best: + +| Configure the receive ring producer index register RBaPIR with a value +| of 0. The producer index is initially configured by software but owned +| by hardware after the ring has been enabled. Hardware increments the +| index when a frame is received which may consume one or more BDs. +| Hardware is not allowed to increment the producer index to match the +| consumer index since it is used to indicate an empty condition. The ring +| can hold at most RBLENR[LENGTH]-1 received BDs. +| +| Configure the receive ring consumer index register RBaCIR. The +| consumer index is owned by software and updated during operation of the +| of the BD ring by software, to indicate that any receive data occupied +| in the BD has been processed and it has been prepared for new data. +| - If consumer index and producer index are initialized to the same +| value, it indicates that all BDs in the ring have been prepared and +| hardware owns all of the entries. +| - If consumer index is initialized to producer index plus N, it would +| indicate N BDs have been prepared. Note that hardware cannot start if +| only a single buffer is prepared due to the restrictions described in +| (2). +| - Software may write consumer index to match producer index anytime +| while the ring is operational to indicate all received BDs prior have +| been processed and new BDs prepared for hardware. + +Normally, the value of rx_ring->rcir (consumer index) is brought in sync +with the rx_ring->next_to_use software index, but this only happens if +page allocation ever succeeded. + +When PI==CI==0, the hardware appears to receive frames and write them to +DMA address 0x0 (?!), then set the READY bit in the BD. + +The enetc_clean_rx_ring() function (and its XDP derivative) is naturally +not prepared to handle such a condition. It will attempt to process +those frames using the rx_swbd structure associated with index i of the +RX ring, but that structure is not fully initialized (enetc_new_page() +does all of that). So what happens next is undefined behavior. + +To operate using no buffer, we must initialize the CI to PI + 1, which +will block the hardware from advancing the CI any further, and drop +everything. + +The issue was seen while adding support for zero-copy AF_XDP sockets, +where buffer memory comes from user space, which can even decide to +supply no buffers at all (example: "xdpsock --txonly"). However, the bug +is present also with the network stack code, even though it would take a +very determined person to trigger a page allocation failure at the +perfect time (a series of ifup/ifdown under memory pressure should +eventually reproduce it given enough retries). + +Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers") +Signed-off-by: Vladimir Oltean +Reviewed-by: Claudiu Manoil +Link: https://lore.kernel.org/r/20221027182925.3256653-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c +index 9f5b921039bd..d0fd3045ce11 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc.c +@@ -2090,7 +2090,12 @@ static void enetc_setup_rxbdr(struct enetc_hw *hw, struct enetc_bdr *rx_ring) + else + enetc_rxbdr_wr(hw, idx, ENETC_RBBSR, ENETC_RXB_DMA_SIZE); + ++ /* Also prepare the consumer index in case page allocation never ++ * succeeds. In that case, hardware will never advance producer index ++ * to match consumer index, and will drop all frames. ++ */ + enetc_rxbdr_wr(hw, idx, ENETC_RBPIR, 0); ++ enetc_rxbdr_wr(hw, idx, ENETC_RBCIR, 1); + + /* enable Rx ints by setting pkt thr to 1 */ + enetc_rxbdr_wr(hw, idx, ENETC_RBICR0, ENETC_RBICR0_ICEN | 0x1); +-- +2.35.1 + diff --git a/queue-6.0/net-ethernet-ave-fix-mac-to-be-in-charge-of-phy-pm.patch b/queue-6.0/net-ethernet-ave-fix-mac-to-be-in-charge-of-phy-pm.patch new file mode 100644 index 00000000000..0041a34195c --- /dev/null +++ b/queue-6.0/net-ethernet-ave-fix-mac-to-be-in-charge-of-phy-pm.patch @@ -0,0 +1,56 @@ +From 14023bf3b5470ab6968cec88b7e1ae11fecffed0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 16:22:27 +0900 +Subject: net: ethernet: ave: Fix MAC to be in charge of PHY PM + +From: Kunihiko Hayashi + +[ Upstream commit e2badb4bd33abe13ddc35975bd7f7f8693955a4b ] + +The phylib callback is called after MAC driver's own resume callback is +called. For AVE driver, after resuming immediately, PHY state machine is +in PHY_NOLINK because there is a time lag from link-down to link-up due to +autoneg. The result is WARN_ON() dump in mdio_bus_phy_resume(). + +Since ave_resume() itself calls phy_resume(), AVE driver should manage +PHY PM. To indicate that MAC driver manages PHY PM, set +phydev->mac_managed_pm to true to avoid the unnecessary phylib call and +add missing phy_init_hw() to ave_resume(). + +Suggested-by: Heiner Kallweit +Fixes: fba863b81604 ("net: phy: make PHY PM ops a no-op if MAC driver manages PHY PM") +Signed-off-by: Kunihiko Hayashi +Link: https://lore.kernel.org/r/20221024072227.24769-1-hayashi.kunihiko@socionext.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/socionext/sni_ave.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c +index f0c8de2c6075..db80a17a7e21 100644 +--- a/drivers/net/ethernet/socionext/sni_ave.c ++++ b/drivers/net/ethernet/socionext/sni_ave.c +@@ -1229,6 +1229,8 @@ static int ave_init(struct net_device *ndev) + + phy_support_asym_pause(phydev); + ++ phydev->mac_managed_pm = true; ++ + phy_attached_info(phydev); + + return 0; +@@ -1757,6 +1759,10 @@ static int ave_resume(struct device *dev) + + ave_global_reset(ndev); + ++ ret = phy_init_hw(ndev->phydev); ++ if (ret) ++ return ret; ++ + ave_ethtool_get_wol(ndev, &wol); + wol.wolopts = priv->wolopts; + __ave_ethtool_set_wol(ndev, &wol); +-- +2.35.1 + diff --git a/queue-6.0/net-fec-limit-register-access-on-i.mx6ul.patch b/queue-6.0/net-fec-limit-register-access-on-i.mx6ul.patch new file mode 100644 index 00000000000..521fc0a9c90 --- /dev/null +++ b/queue-6.0/net-fec-limit-register-access-on-i.mx6ul.patch @@ -0,0 +1,105 @@ +From 0437081717cfb0ba421286fe5d30c67453c2b7e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 10:05:52 +0200 +Subject: net: fec: limit register access on i.MX6UL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Juergen Borleis + +[ Upstream commit 0a8b43b12dd78daa77a7dc007b92770d262a2714 ] + +Using 'ethtool -d […]' on an i.MX6UL leads to a kernel crash: + + Unhandled fault: external abort on non-linefetch (0x1008) at […] + +due to this SoC has less registers in its FEC implementation compared to other +i.MX6 variants. Thus, a run-time decision is required to avoid access to +non-existing registers. + +Fixes: a51d3ab50702 ("net: fec: use a more proper compatible string for i.MX6UL type device") +Signed-off-by: Juergen Borleis +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20221024080552.21004-1-jbe@pengutronix.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 46 ++++++++++++++++++++++- + 1 file changed, 44 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 92c55e1a5507..a486435ceee2 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -2347,6 +2347,31 @@ static u32 fec_enet_register_offset[] = { + IEEE_R_DROP, IEEE_R_FRAME_OK, IEEE_R_CRC, IEEE_R_ALIGN, IEEE_R_MACERR, + IEEE_R_FDXFC, IEEE_R_OCTETS_OK + }; ++/* for i.MX6ul */ ++static u32 fec_enet_register_offset_6ul[] = { ++ FEC_IEVENT, FEC_IMASK, FEC_R_DES_ACTIVE_0, FEC_X_DES_ACTIVE_0, ++ FEC_ECNTRL, FEC_MII_DATA, FEC_MII_SPEED, FEC_MIB_CTRLSTAT, FEC_R_CNTRL, ++ FEC_X_CNTRL, FEC_ADDR_LOW, FEC_ADDR_HIGH, FEC_OPD, FEC_TXIC0, FEC_RXIC0, ++ FEC_HASH_TABLE_HIGH, FEC_HASH_TABLE_LOW, FEC_GRP_HASH_TABLE_HIGH, ++ FEC_GRP_HASH_TABLE_LOW, FEC_X_WMRK, FEC_R_DES_START_0, ++ FEC_X_DES_START_0, FEC_R_BUFF_SIZE_0, FEC_R_FIFO_RSFL, FEC_R_FIFO_RSEM, ++ FEC_R_FIFO_RAEM, FEC_R_FIFO_RAFL, FEC_RACC, ++ RMON_T_DROP, RMON_T_PACKETS, RMON_T_BC_PKT, RMON_T_MC_PKT, ++ RMON_T_CRC_ALIGN, RMON_T_UNDERSIZE, RMON_T_OVERSIZE, RMON_T_FRAG, ++ RMON_T_JAB, RMON_T_COL, RMON_T_P64, RMON_T_P65TO127, RMON_T_P128TO255, ++ RMON_T_P256TO511, RMON_T_P512TO1023, RMON_T_P1024TO2047, ++ RMON_T_P_GTE2048, RMON_T_OCTETS, ++ IEEE_T_DROP, IEEE_T_FRAME_OK, IEEE_T_1COL, IEEE_T_MCOL, IEEE_T_DEF, ++ IEEE_T_LCOL, IEEE_T_EXCOL, IEEE_T_MACERR, IEEE_T_CSERR, IEEE_T_SQE, ++ IEEE_T_FDXFC, IEEE_T_OCTETS_OK, ++ RMON_R_PACKETS, RMON_R_BC_PKT, RMON_R_MC_PKT, RMON_R_CRC_ALIGN, ++ RMON_R_UNDERSIZE, RMON_R_OVERSIZE, RMON_R_FRAG, RMON_R_JAB, ++ RMON_R_RESVD_O, RMON_R_P64, RMON_R_P65TO127, RMON_R_P128TO255, ++ RMON_R_P256TO511, RMON_R_P512TO1023, RMON_R_P1024TO2047, ++ RMON_R_P_GTE2048, RMON_R_OCTETS, ++ IEEE_R_DROP, IEEE_R_FRAME_OK, IEEE_R_CRC, IEEE_R_ALIGN, IEEE_R_MACERR, ++ IEEE_R_FDXFC, IEEE_R_OCTETS_OK ++}; + #else + static __u32 fec_enet_register_version = 1; + static u32 fec_enet_register_offset[] = { +@@ -2371,7 +2396,24 @@ static void fec_enet_get_regs(struct net_device *ndev, + u32 *buf = (u32 *)regbuf; + u32 i, off; + int ret; ++#if defined(CONFIG_M523x) || defined(CONFIG_M527x) || defined(CONFIG_M528x) || \ ++ defined(CONFIG_M520x) || defined(CONFIG_M532x) || defined(CONFIG_ARM) || \ ++ defined(CONFIG_ARM64) || defined(CONFIG_COMPILE_TEST) ++ u32 *reg_list; ++ u32 reg_cnt; + ++ if (!of_machine_is_compatible("fsl,imx6ul")) { ++ reg_list = fec_enet_register_offset; ++ reg_cnt = ARRAY_SIZE(fec_enet_register_offset); ++ } else { ++ reg_list = fec_enet_register_offset_6ul; ++ reg_cnt = ARRAY_SIZE(fec_enet_register_offset_6ul); ++ } ++#else ++ /* coldfire */ ++ static u32 *reg_list = fec_enet_register_offset; ++ static const u32 reg_cnt = ARRAY_SIZE(fec_enet_register_offset); ++#endif + ret = pm_runtime_resume_and_get(dev); + if (ret < 0) + return; +@@ -2380,8 +2422,8 @@ static void fec_enet_get_regs(struct net_device *ndev, + + memset(buf, 0, regs->len); + +- for (i = 0; i < ARRAY_SIZE(fec_enet_register_offset); i++) { +- off = fec_enet_register_offset[i]; ++ for (i = 0; i < reg_cnt; i++) { ++ off = reg_list[i]; + + if ((off == FEC_R_BOUND || off == FEC_R_FSTART) && + !(fep->quirks & FEC_QUIRK_HAS_FRREG)) +-- +2.35.1 + diff --git a/queue-6.0/net-fix-uaf-issue-in-nfqnl_nf_hook_drop-when-ops_ini.patch b/queue-6.0/net-fix-uaf-issue-in-nfqnl_nf_hook_drop-when-ops_ini.patch new file mode 100644 index 00000000000..cf0c331b2dc --- /dev/null +++ b/queue-6.0/net-fix-uaf-issue-in-nfqnl_nf_hook_drop-when-ops_ini.patch @@ -0,0 +1,121 @@ +From b5ed38c5b81617be640d1a911234918150eee421 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Oct 2022 10:42:13 +0800 +Subject: net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed + +From: Zhengchao Shao + +[ Upstream commit d266935ac43d57586e311a087510fe6a084af742 ] + +When the ops_init() interface is invoked to initialize the net, but +ops->init() fails, data is released. However, the ptr pointer in +net->gen is invalid. In this case, when nfqnl_nf_hook_drop() is invoked +to release the net, invalid address access occurs. + +The process is as follows: +setup_net() + ops_init() + data = kzalloc(...) ---> alloc "data" + net_assign_generic() ---> assign "date" to ptr in net->gen + ... + ops->init() ---> failed + ... + kfree(data); ---> ptr in net->gen is invalid + ... + ops_exit_list() + ... + nfqnl_nf_hook_drop() + *q = nfnl_queue_pernet(net) ---> q is invalid + +The following is the Call Trace information: +BUG: KASAN: use-after-free in nfqnl_nf_hook_drop+0x264/0x280 +Read of size 8 at addr ffff88810396b240 by task ip/15855 +Call Trace: + +dump_stack_lvl+0x8e/0xd1 +print_report+0x155/0x454 +kasan_report+0xba/0x1f0 +nfqnl_nf_hook_drop+0x264/0x280 +nf_queue_nf_hook_drop+0x8b/0x1b0 +__nf_unregister_net_hook+0x1ae/0x5a0 +nf_unregister_net_hooks+0xde/0x130 +ops_exit_list+0xb0/0x170 +setup_net+0x7ac/0xbd0 +copy_net_ns+0x2e6/0x6b0 +create_new_namespaces+0x382/0xa50 +unshare_nsproxy_namespaces+0xa6/0x1c0 +ksys_unshare+0x3a4/0x7e0 +__x64_sys_unshare+0x2d/0x40 +do_syscall_64+0x35/0x80 +entry_SYSCALL_64_after_hwframe+0x46/0xb0 + + +Allocated by task 15855: +kasan_save_stack+0x1e/0x40 +kasan_set_track+0x21/0x30 +__kasan_kmalloc+0xa1/0xb0 +__kmalloc+0x49/0xb0 +ops_init+0xe7/0x410 +setup_net+0x5aa/0xbd0 +copy_net_ns+0x2e6/0x6b0 +create_new_namespaces+0x382/0xa50 +unshare_nsproxy_namespaces+0xa6/0x1c0 +ksys_unshare+0x3a4/0x7e0 +__x64_sys_unshare+0x2d/0x40 +do_syscall_64+0x35/0x80 +entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Freed by task 15855: +kasan_save_stack+0x1e/0x40 +kasan_set_track+0x21/0x30 +kasan_save_free_info+0x2a/0x40 +____kasan_slab_free+0x155/0x1b0 +slab_free_freelist_hook+0x11b/0x220 +__kmem_cache_free+0xa4/0x360 +ops_init+0xb9/0x410 +setup_net+0x5aa/0xbd0 +copy_net_ns+0x2e6/0x6b0 +create_new_namespaces+0x382/0xa50 +unshare_nsproxy_namespaces+0xa6/0x1c0 +ksys_unshare+0x3a4/0x7e0 +__x64_sys_unshare+0x2d/0x40 +do_syscall_64+0x35/0x80 +entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Fixes: f875bae06533 ("net: Automatically allocate per namespace data.") +Signed-off-by: Zhengchao Shao +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/net_namespace.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c +index 0ec2f5906a27..f64654df71a2 100644 +--- a/net/core/net_namespace.c ++++ b/net/core/net_namespace.c +@@ -117,6 +117,7 @@ static int net_assign_generic(struct net *net, unsigned int id, void *data) + + static int ops_init(const struct pernet_operations *ops, struct net *net) + { ++ struct net_generic *ng; + int err = -ENOMEM; + void *data = NULL; + +@@ -135,7 +136,13 @@ static int ops_init(const struct pernet_operations *ops, struct net *net) + if (!err) + return 0; + ++ if (ops->id && ops->size) { + cleanup: ++ ng = rcu_dereference_protected(net->gen, ++ lockdep_is_held(&pernet_ops_rwsem)); ++ ng->ptr[*ops->id] = NULL; ++ } ++ + kfree(data); + + out: +-- +2.35.1 + diff --git a/queue-6.0/net-hinic-fix-incorrect-assignment-issue-in-hinic_se.patch b/queue-6.0/net-hinic-fix-incorrect-assignment-issue-in-hinic_se.patch new file mode 100644 index 00000000000..36b8168749a --- /dev/null +++ b/queue-6.0/net-hinic-fix-incorrect-assignment-issue-in-hinic_se.patch @@ -0,0 +1,36 @@ +From 8b959c89d16d35af0d029307f79d33851f022b3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 17:57:51 +0800 +Subject: net: hinic: fix incorrect assignment issue in + hinic_set_interrupt_cfg() + +From: Zhengchao Shao + +[ Upstream commit c0605cd6750f2db9890c43a91ea4d77be8fb4908 ] + +The value of lli_credit_cnt is incorrectly assigned, fix it. + +Fixes: a0337c0dee68 ("hinic: add support to set and get irq coalesce") +Signed-off-by: Zhengchao Shao +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c b/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c +index 2127a48749a8..1cd812c56672 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c +@@ -883,7 +883,7 @@ int hinic_set_interrupt_cfg(struct hinic_hwdev *hwdev, + if (err) + return -EINVAL; + +- interrupt_info->lli_credit_cnt = temp_info.lli_timer_cnt; ++ interrupt_info->lli_credit_cnt = temp_info.lli_credit_cnt; + interrupt_info->lli_timer_cnt = temp_info.lli_timer_cnt; + + err = hinic_msg_to_mgmt(&pfhwdev->pf_to_mgmt, HINIC_MOD_COMM, +-- +2.35.1 + diff --git a/queue-6.0/net-hinic-fix-memory-leak-when-reading-function-tabl.patch b/queue-6.0/net-hinic-fix-memory-leak-when-reading-function-tabl.patch new file mode 100644 index 00000000000..a0c81af5d87 --- /dev/null +++ b/queue-6.0/net-hinic-fix-memory-leak-when-reading-function-tabl.patch @@ -0,0 +1,67 @@ +From 56be6c819f7213a03965ccc58d0b1f1fe71e98f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 17:57:52 +0800 +Subject: net: hinic: fix memory leak when reading function table + +From: Zhengchao Shao + +[ Upstream commit 4c1f602df8956bc0decdafd7e4fc7eef50c550b1 ] + +When the input parameter idx meets the expected case option in +hinic_dbg_get_func_table(), read_data is not released. Fix it. + +Fixes: 5215e16244ee ("hinic: add support to query function table") +Signed-off-by: Zhengchao Shao +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/huawei/hinic/hinic_debugfs.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_debugfs.c b/drivers/net/ethernet/huawei/hinic/hinic_debugfs.c +index 19eb839177ec..061952c6c21a 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_debugfs.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_debugfs.c +@@ -85,6 +85,7 @@ static int hinic_dbg_get_func_table(struct hinic_dev *nic_dev, int idx) + struct tag_sml_funcfg_tbl *funcfg_table_elem; + struct hinic_cmd_lt_rd *read_data; + u16 out_size = sizeof(*read_data); ++ int ret = ~0; + int err; + + read_data = kzalloc(sizeof(*read_data), GFP_KERNEL); +@@ -111,20 +112,25 @@ static int hinic_dbg_get_func_table(struct hinic_dev *nic_dev, int idx) + + switch (idx) { + case VALID: +- return funcfg_table_elem->dw0.bs.valid; ++ ret = funcfg_table_elem->dw0.bs.valid; ++ break; + case RX_MODE: +- return funcfg_table_elem->dw0.bs.nic_rx_mode; ++ ret = funcfg_table_elem->dw0.bs.nic_rx_mode; ++ break; + case MTU: +- return funcfg_table_elem->dw1.bs.mtu; ++ ret = funcfg_table_elem->dw1.bs.mtu; ++ break; + case RQ_DEPTH: +- return funcfg_table_elem->dw13.bs.cfg_rq_depth; ++ ret = funcfg_table_elem->dw13.bs.cfg_rq_depth; ++ break; + case QUEUE_NUM: +- return funcfg_table_elem->dw13.bs.cfg_q_num; ++ ret = funcfg_table_elem->dw13.bs.cfg_q_num; ++ break; + } + + kfree(read_data); + +- return ~0; ++ return ret; + } + + static ssize_t hinic_dbg_cmd_read(struct file *filp, char __user *buffer, size_t count, +-- +2.35.1 + diff --git a/queue-6.0/net-hinic-fix-the-issue-of-cmdq-memory-leaks.patch b/queue-6.0/net-hinic-fix-the-issue-of-cmdq-memory-leaks.patch new file mode 100644 index 00000000000..6b980f43887 --- /dev/null +++ b/queue-6.0/net-hinic-fix-the-issue-of-cmdq-memory-leaks.patch @@ -0,0 +1,36 @@ +From 79314ab8d739382715d8d798b8e96c7239360a32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 17:57:53 +0800 +Subject: net: hinic: fix the issue of CMDQ memory leaks + +From: Zhengchao Shao + +[ Upstream commit 363cc87767f6ddcfb9158ad2e2afa2f8d5c4b94e ] + +When hinic_set_cmdq_depth() fails in hinic_init_cmdqs(), the cmdq memory is +not released correctly. Fix it. + +Fixes: 72ef908bb3ff ("hinic: add three net_device_ops of vf") +Signed-off-by: Zhengchao Shao +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c b/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c +index a627237f694b..afa816cfcdf4 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c +@@ -929,7 +929,7 @@ int hinic_init_cmdqs(struct hinic_cmdqs *cmdqs, struct hinic_hwif *hwif, + + err_set_cmdq_depth: + hinic_ceq_unregister_cb(&func_to_io->ceqs, HINIC_CEQ_CMDQ); +- ++ free_cmdq(&cmdqs->cmdq[HINIC_CMDQ_SYNC]); + err_cmdq_ctxt: + hinic_wqs_cmdq_free(&cmdqs->cmdq_pages, cmdqs->saved_wqs, + HINIC_MAX_CMDQ_TYPES); +-- +2.35.1 + diff --git a/queue-6.0/net-hinic-fix-the-issue-of-double-release-mbox-callb.patch b/queue-6.0/net-hinic-fix-the-issue-of-double-release-mbox-callb.patch new file mode 100644 index 00000000000..e3e2789b02a --- /dev/null +++ b/queue-6.0/net-hinic-fix-the-issue-of-double-release-mbox-callb.patch @@ -0,0 +1,36 @@ +From db0ee7ddf0d3434b67a8ce64d4dea781c1783d8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 17:57:54 +0800 +Subject: net: hinic: fix the issue of double release MBOX callback of VF + +From: Zhengchao Shao + +[ Upstream commit 8ec2f4c6b2e11a4249bba77460f0cfe6d95a82f8 ] + +In hinic_vf_func_init(), if VF fails to register information with PF +through the MBOX, the MBOX callback function of VF is released once. But +it is released again in hinic_init_hwdev(). Remove one. + +Fixes: 7dd29ee12865 ("hinic: add sriov feature support") +Signed-off-by: Zhengchao Shao +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/huawei/hinic/hinic_sriov.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_sriov.c b/drivers/net/ethernet/huawei/hinic/hinic_sriov.c +index df555847afb5..61c1da0c52a0 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_sriov.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_sriov.c +@@ -1175,7 +1175,6 @@ int hinic_vf_func_init(struct hinic_hwdev *hwdev) + dev_err(&hwdev->hwif->pdev->dev, + "Failed to register VF, err: %d, status: 0x%x, out size: 0x%x\n", + err, register_info.status, out_size); +- hinic_unregister_vf_mbox_cb(hwdev, HINIC_MOD_L2NIC); + return -EIO; + } + } else { +-- +2.35.1 + diff --git a/queue-6.0/net-ksz884x-fix-missing-pci_disable_device-on-error-.patch b/queue-6.0/net-ksz884x-fix-missing-pci_disable_device-on-error-.patch new file mode 100644 index 00000000000..6e279b55286 --- /dev/null +++ b/queue-6.0/net-ksz884x-fix-missing-pci_disable_device-on-error-.patch @@ -0,0 +1,39 @@ +From 518c6933582e30fd0200723ee0a122e8d4785f6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 21:13:38 +0800 +Subject: net: ksz884x: fix missing pci_disable_device() on error in + pcidev_init() + +From: Yang Yingliang + +[ Upstream commit 5da6d65590a0698199df44d095e54b0ed1708178 ] + +pci_disable_device() need be called while module exiting, switch to use +pcim_enable(), pci_disable_device() will be called in pcim_release() +while unbinding device. + +Fixes: 8ca86fd83eae ("net: Micrel KSZ8841/2 PCI Ethernet driver") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221024131338.2848959-1-yangyingliang@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/micrel/ksz884x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c +index 2b3eb5ed8233..97839f1b456c 100644 +--- a/drivers/net/ethernet/micrel/ksz884x.c ++++ b/drivers/net/ethernet/micrel/ksz884x.c +@@ -6851,7 +6851,7 @@ static int pcidev_init(struct pci_dev *pdev, const struct pci_device_id *id) + char banner[sizeof(version)]; + struct ksz_switch *sw = NULL; + +- result = pci_enable_device(pdev); ++ result = pcim_enable_device(pdev); + if (result) + return result; + +-- +2.35.1 + diff --git a/queue-6.0/net-lan966x-fix-the-rx-drop-counter.patch b/queue-6.0/net-lan966x-fix-the-rx-drop-counter.patch new file mode 100644 index 00000000000..5fd253d60b4 --- /dev/null +++ b/queue-6.0/net-lan966x-fix-the-rx-drop-counter.patch @@ -0,0 +1,49 @@ +From d9abd5ef359f5965c967e93658f982f287ab4342 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 10:30:56 +0200 +Subject: net: lan966x: Fix the rx drop counter + +From: Horatiu Vultur + +[ Upstream commit f8c1c66b99a570c08b9d26e4347276f00e49bba7 ] + +Currently the rx drop is calculated as the sum of multiple HW drop +counters. The issue is that not all the HW drop counters were added for +the rx drop counter. So if for example you have a police that drops +frames, they were not see in the rx drop counter. +Fix this by updating how the rx drop counter is calculated. It is +required to add also RX_RED_PRIO_* HW counters. + +Fixes: 12c2d0a5b8e2 ("net: lan966x: add ethtool configuration and statistics") +Signed-off-by: Horatiu Vultur +Link: https://lore.kernel.org/r/20221019083056.2744282-1-horatiu.vultur@microchip.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/microchip/lan966x/lan966x_ethtool.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c b/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c +index e58a27fd8b50..fea42542be28 100644 +--- a/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c ++++ b/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c +@@ -656,7 +656,15 @@ void lan966x_stats_get(struct net_device *dev, + stats->rx_dropped = dev->stats.rx_dropped + + lan966x->stats[idx + SYS_COUNT_RX_LONG] + + lan966x->stats[idx + SYS_COUNT_DR_LOCAL] + +- lan966x->stats[idx + SYS_COUNT_DR_TAIL]; ++ lan966x->stats[idx + SYS_COUNT_DR_TAIL] + ++ lan966x->stats[idx + SYS_COUNT_RX_RED_PRIO_0] + ++ lan966x->stats[idx + SYS_COUNT_RX_RED_PRIO_1] + ++ lan966x->stats[idx + SYS_COUNT_RX_RED_PRIO_2] + ++ lan966x->stats[idx + SYS_COUNT_RX_RED_PRIO_3] + ++ lan966x->stats[idx + SYS_COUNT_RX_RED_PRIO_4] + ++ lan966x->stats[idx + SYS_COUNT_RX_RED_PRIO_5] + ++ lan966x->stats[idx + SYS_COUNT_RX_RED_PRIO_6] + ++ lan966x->stats[idx + SYS_COUNT_RX_RED_PRIO_7]; + + for (i = 0; i < LAN966X_NUM_TC; i++) { + stats->rx_dropped += +-- +2.35.1 + diff --git a/queue-6.0/net-lan966x-stop-replacing-tx-dcbs-and-dcbs_buf-when.patch b/queue-6.0/net-lan966x-stop-replacing-tx-dcbs-and-dcbs_buf-when.patch new file mode 100644 index 00000000000..4a0b28eb03a --- /dev/null +++ b/queue-6.0/net-lan966x-stop-replacing-tx-dcbs-and-dcbs_buf-when.patch @@ -0,0 +1,108 @@ +From a2906b9d550eaf903917a42e1e00c04c702ddab7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Oct 2022 11:07:11 +0200 +Subject: net: lan966x: Stop replacing tx dcbs and dcbs_buf when changing MTU + +From: Horatiu Vultur + +[ Upstream commit 4a4b6848d1e932b977e6a00cda393adf7e839ff8 ] + +When a frame is sent using FDMA, the skb is mapped and then the mapped +address is given to an tx dcb that is different than the last used tx +dcb. Once the HW finish with this frame, it would generate an interrupt +and then the dcb can be reused and memory can be freed. For each dcb +there is an dcb buf that contains some meta-data(is used by PTP, is +it free). There is 1 to 1 relationship between dcb and dcb_buf. +The following issue was observed. That sometimes after changing the MTU +to allocate new tx dcbs and dcbs_buf, two frames were not +transmitted. The frames were not transmitted because when reloading the +tx dcbs, it was always presuming to use the first dcb but that was not +always happening. Because it could be that the last tx dcb used before +changing MTU was first dcb and then when it tried to get the next dcb it +would take dcb 1 instead of 0. Because it is supposed to take a +different dcb than the last used one. This can be fixed simply by +changing tx->last_in_use to -1 when the fdma is disabled to reload the +new dcb and dcbs_buff. +But there could be a different issue. For example, right after the frame +is sent, the MTU is changed. Now all the dcbs and dcbs_buf will be +cleared. And now get the interrupt from HW that it finished with the +frame. So when we try to clear the skb, it is not possible because we +lost all the dcbs_buf. +The solution here is to stop replacing the tx dcbs and dcbs_buf when +changing MTU because the TX doesn't care what is the MTU size, it is +only the RX that needs this information. + +Fixes: 2ea1cbac267e ("net: lan966x: Update FDMA to change MTU.") +Signed-off-by: Horatiu Vultur +Link: https://lore.kernel.org/r/20221021090711.3749009-1-horatiu.vultur@microchip.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../ethernet/microchip/lan966x/lan966x_fdma.c | 24 +++---------------- + 1 file changed, 3 insertions(+), 21 deletions(-) + +diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c +index 51f8a0816377..69f741db25b1 100644 +--- a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c ++++ b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c +@@ -309,6 +309,7 @@ static void lan966x_fdma_tx_disable(struct lan966x_tx *tx) + lan966x, FDMA_CH_DB_DISCARD); + + tx->activated = false; ++ tx->last_in_use = -1; + } + + static void lan966x_fdma_tx_reload(struct lan966x_tx *tx) +@@ -687,17 +688,14 @@ static int lan966x_qsys_sw_status(struct lan966x *lan966x) + + static int lan966x_fdma_reload(struct lan966x *lan966x, int new_mtu) + { +- void *rx_dcbs, *tx_dcbs, *tx_dcbs_buf; +- dma_addr_t rx_dma, tx_dma; ++ dma_addr_t rx_dma; ++ void *rx_dcbs; + u32 size; + int err; + + /* Store these for later to free them */ + rx_dma = lan966x->rx.dma; +- tx_dma = lan966x->tx.dma; + rx_dcbs = lan966x->rx.dcbs; +- tx_dcbs = lan966x->tx.dcbs; +- tx_dcbs_buf = lan966x->tx.dcbs_buf; + + napi_synchronize(&lan966x->napi); + napi_disable(&lan966x->napi); +@@ -715,17 +713,6 @@ static int lan966x_fdma_reload(struct lan966x *lan966x, int new_mtu) + size = ALIGN(size, PAGE_SIZE); + dma_free_coherent(lan966x->dev, size, rx_dcbs, rx_dma); + +- lan966x_fdma_tx_disable(&lan966x->tx); +- err = lan966x_fdma_tx_alloc(&lan966x->tx); +- if (err) +- goto restore_tx; +- +- size = sizeof(struct lan966x_tx_dcb) * FDMA_DCB_MAX; +- size = ALIGN(size, PAGE_SIZE); +- dma_free_coherent(lan966x->dev, size, tx_dcbs, tx_dma); +- +- kfree(tx_dcbs_buf); +- + lan966x_fdma_wakeup_netdev(lan966x); + napi_enable(&lan966x->napi); + +@@ -735,11 +722,6 @@ static int lan966x_fdma_reload(struct lan966x *lan966x, int new_mtu) + lan966x->rx.dcbs = rx_dcbs; + lan966x_fdma_rx_start(&lan966x->rx); + +-restore_tx: +- lan966x->tx.dma = tx_dma; +- lan966x->tx.dcbs = tx_dcbs; +- lan966x->tx.dcbs_buf = tx_dcbs_buf; +- + return err; + } + +-- +2.35.1 + diff --git a/queue-6.0/net-lantiq_etop-don-t-free-skb-when-returning-netdev.patch b/queue-6.0/net-lantiq_etop-don-t-free-skb-when-returning-netdev.patch new file mode 100644 index 00000000000..787dad0aa3f --- /dev/null +++ b/queue-6.0/net-lantiq_etop-don-t-free-skb-when-returning-netdev.patch @@ -0,0 +1,35 @@ +From a8cac54f931ad6851ba8951ad5159cde06a429da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Oct 2022 09:32:24 +0800 +Subject: net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY + +From: Zhang Changzhong + +[ Upstream commit 9c1eaa27ec599fcc25ed4970c0b73c247d147a2b ] + +The ndo_start_xmit() method must not free skb when returning +NETDEV_TX_BUSY, since caller is going to requeue freed skb. + +Fixes: 504d4721ee8e ("MIPS: Lantiq: Add ethernet driver") +Signed-off-by: Zhang Changzhong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/lantiq_etop.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c +index 7cedbe1fdfd7..bd04d9f33349 100644 +--- a/drivers/net/ethernet/lantiq_etop.c ++++ b/drivers/net/ethernet/lantiq_etop.c +@@ -485,7 +485,6 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev) + len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len; + + if ((desc->ctl & (LTQ_DMA_OWN | LTQ_DMA_C)) || ch->skb[ch->dma.desc]) { +- dev_kfree_skb_any(skb); + netdev_err(dev, "tx ring full\n"); + netif_tx_stop_queue(txq); + return NETDEV_TX_BUSY; +-- +2.35.1 + diff --git a/queue-6.0/net-macb-specify-phy-pm-management-done-by-mac.patch b/queue-6.0/net-macb-specify-phy-pm-management-done-by-mac.patch new file mode 100644 index 00000000000..5493b33a276 --- /dev/null +++ b/queue-6.0/net-macb-specify-phy-pm-management-done-by-mac.patch @@ -0,0 +1,44 @@ +From 5029e83154ff61ec1059d8a653900a873f7d1e28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 15:09:32 +0300 +Subject: net: macb: Specify PHY PM management done by MAC + +From: Sergiu Moga + +[ Upstream commit 15a9dbec631cd69dfbbfc4e2cbf90c9dd8432a8f ] + +The `macb_resume`/`macb_suspend` methods already call the +`phylink_start`/`phylink_stop` methods during their execution so +explicitly say that the PM of the PHY is done by MAC by using the +`mac_managed_pm` flag of the `struct phylink_config`. + +This also fixes the warning message issued during resume: +WARNING: CPU: 0 PID: 237 at drivers/net/phy/phy_device.c:323 mdio_bus_phy_resume+0x144/0x148 + +Depends-on: 96de900ae78e ("net: phylink: add mac_managed_pm in phylink_config structure") +Fixes: 744d23c71af3 ("net: phy: Warn about incorrect mdio_bus_phy_resume() state") +Signed-off-by: Sergiu Moga +Reviewed-by: Florian Fainelli +Reviewed-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20221019120929.63098-1-sergiu.moga@microchip.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cadence/macb_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index a2897549f9c4..aa1b03f8bfe9 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -805,6 +805,7 @@ static int macb_mii_probe(struct net_device *dev) + + bp->phylink_config.dev = &dev->dev; + bp->phylink_config.type = PHYLINK_NETDEV; ++ bp->phylink_config.mac_managed_pm = true; + + if (bp->phy_interface == PHY_INTERFACE_MODE_SGMII) { + bp->phylink_config.poll_fixed_state = true; +-- +2.35.1 + diff --git a/queue-6.0/net-memcg-avoid-stalls-when-under-memory-pressure.patch b/queue-6.0/net-memcg-avoid-stalls-when-under-memory-pressure.patch new file mode 100644 index 00000000000..c8cd5428065 --- /dev/null +++ b/queue-6.0/net-memcg-avoid-stalls-when-under-memory-pressure.patch @@ -0,0 +1,59 @@ +From 573bf7d67be1c28ca54c8edda88901311dcf9654 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Oct 2022 09:03:04 -0700 +Subject: net-memcg: avoid stalls when under memory pressure + +From: Jakub Kicinski + +[ Upstream commit 720ca52bcef225b967a339e0fffb6d0c7e962240 ] + +As Shakeel explains the commit under Fixes had the unintended +side-effect of no longer pre-loading the cached memory allowance. +Even tho we previously dropped the first packet received when +over memory limit - the consecutive ones would get thru by using +the cache. The charging was happening in batches of 128kB, so +we'd let in 128kB (truesize) worth of packets per one drop. + +After the change we no longer force charge, there will be no +cache filling side effects. This causes significant drops and +connection stalls for workloads which use a lot of page cache, +since we can't reclaim page cache under GFP_NOWAIT. + +Some of the latency can be recovered by improving SACK reneg +handling but nowhere near enough to get back to the pre-5.15 +performance (the application I'm experimenting with still +sees 5-10x worst latency). + +Apply the suggested workaround of using GFP_ATOMIC. We will now +be more permissive than previously as we'll drop _no_ packets +in softirq when under pressure. But I can't think of any good +and simple way to address that within networking. + +Link: https://lore.kernel.org/all/20221012163300.795e7b86@kernel.org/ +Suggested-by: Shakeel Butt +Fixes: 4b1327be9fe5 ("net-memcg: pass in gfp_t mask to mem_cgroup_charge_skmem()") +Acked-by: Shakeel Butt +Acked-by: Roman Gushchin +Link: https://lore.kernel.org/r/20221021160304.1362511-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/sock.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/sock.h b/include/net/sock.h +index d08cfe190a78..8a98ea9360fb 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -2567,7 +2567,7 @@ static inline gfp_t gfp_any(void) + + static inline gfp_t gfp_memcg_charge(void) + { +- return in_softirq() ? GFP_NOWAIT : GFP_KERNEL; ++ return in_softirq() ? GFP_ATOMIC : GFP_KERNEL; + } + + static inline long sock_rcvtimeo(const struct sock *sk, bool noblock) +-- +2.35.1 + diff --git a/queue-6.0/net-mlx5-aso-create-the-aso-sq-with-the-correct-time.patch b/queue-6.0/net-mlx5-aso-create-the-aso-sq-with-the-correct-time.patch new file mode 100644 index 00000000000..62a0827f165 --- /dev/null +++ b/queue-6.0/net-mlx5-aso-create-the-aso-sq-with-the-correct-time.patch @@ -0,0 +1,67 @@ +From 175cdc671dae7dde1ef8b04255bc940ca582a17a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 14:51:44 +0100 +Subject: net/mlx5: ASO, Create the ASO SQ with the correct timestamp format + +From: Saeed Mahameed + +[ Upstream commit 0f3caaa2c6fbf9f892bd235c9dce9eb551f8d815 ] + +mlx5 SQs must select the timestamp format explicitly according to the +active clock mode, select the current active timestamp mode so ASO SQ create +will succeed. + +This fixes the following error prints when trying to create ipsec ASO SQ +while the timestamp format is real time mode. + +mlx5_cmd_out_err:778:(pid 34874): CREATE_SQ(0x904) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0xd61c0b), err(-22) +mlx5_aso_create_sq:285:(pid 34874): Failed to open aso wq sq, err=-22 +mlx5e_ipsec_init:436:(pid 34874): IPSec initialization failed, -22 + +Fixes: cdd04f4d4d71 ("net/mlx5: Add support to create SQ and CQ for ASO") +Signed-off-by: Saeed Mahameed +Reported-by: Leon Romanovsky +Reviewed-by: Leon Romanovsky +Signed-off-by: Saeed Mahameed +Link: https://lore.kernel.org/r/20221026135153.154807-7-saeed@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c +index 21e14507ff5c..7cd9dda53774 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c +@@ -3,6 +3,7 @@ + + #include + #include ++#include "clock.h" + #include "aso.h" + #include "wq.h" + +@@ -179,6 +180,7 @@ static int create_aso_sq(struct mlx5_core_dev *mdev, int pdn, + { + void *in, *sqc, *wq; + int inlen, err; ++ u8 ts_format; + + inlen = MLX5_ST_SZ_BYTES(create_sq_in) + + sizeof(u64) * sq->wq_ctrl.buf.npages; +@@ -195,6 +197,11 @@ static int create_aso_sq(struct mlx5_core_dev *mdev, int pdn, + MLX5_SET(sqc, sqc, state, MLX5_SQC_STATE_RST); + MLX5_SET(sqc, sqc, flush_in_error_en, 1); + ++ ts_format = mlx5_is_real_time_sq(mdev) ? ++ MLX5_TIMESTAMP_FORMAT_REAL_TIME : ++ MLX5_TIMESTAMP_FORMAT_FREE_RUNNING; ++ MLX5_SET(sqc, sqc, ts_format, ts_format); ++ + MLX5_SET(wq, wq, wq_type, MLX5_WQ_TYPE_CYCLIC); + MLX5_SET(wq, wq, uar_page, mdev->mlx5e_res.hw_objs.bfreg.index); + MLX5_SET(wq, wq, log_wq_pg_sz, sq->wq_ctrl.buf.page_shift - +-- +2.35.1 + diff --git a/queue-6.0/net-mlx5-dr-fix-matcher-disconnect-error-flow.patch b/queue-6.0/net-mlx5-dr-fix-matcher-disconnect-error-flow.patch new file mode 100644 index 00000000000..f9177426bd3 --- /dev/null +++ b/queue-6.0/net-mlx5-dr-fix-matcher-disconnect-error-flow.patch @@ -0,0 +1,46 @@ +From 5416d35a2b27b20bed46eb44cf997a3a5d30ddc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 14:51:41 +0100 +Subject: net/mlx5: DR, Fix matcher disconnect error flow + +From: Rongwei Liu + +[ Upstream commit 4ea9891d66410da5030dababb4b825d8e41cd7bb ] + +When 2nd flow rules arrives, it will merge together with the +1st one if matcher criteria is the same. + +If merge fails, driver will rollback the merge contents, and +reject the 2nd rule. At rollback stage, matcher can't be +disconnected unconditionally, otherise the 1st rule can't be +hit anymore. + +Add logic to check if the matcher should be disconnected or not. + +Fixes: cc2295cd54e4 ("net/mlx5: DR, Improve steering for empty or RX/TX-only matchers") +Signed-off-by: Rongwei Liu +Signed-off-by: Saeed Mahameed +Link: https://lore.kernel.org/r/20221026135153.154807-4-saeed@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c +index ddfaf7891188..91ff19f67695 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c +@@ -1200,7 +1200,8 @@ dr_rule_create_rule_nic(struct mlx5dr_rule *rule, + } + + remove_from_nic_tbl: +- mlx5dr_matcher_remove_from_tbl_nic(dmn, nic_matcher); ++ if (!nic_matcher->rules) ++ mlx5dr_matcher_remove_from_tbl_nic(dmn, nic_matcher); + + free_hw_ste: + mlx5dr_domain_nic_unlock(nic_dmn); +-- +2.35.1 + diff --git a/queue-6.0/net-mlx5-fix-crash-during-sync-firmware-reset.patch b/queue-6.0/net-mlx5-fix-crash-during-sync-firmware-reset.patch new file mode 100644 index 00000000000..36c8c3eaf21 --- /dev/null +++ b/queue-6.0/net-mlx5-fix-crash-during-sync-firmware-reset.patch @@ -0,0 +1,62 @@ +From 8d709329fc94c985b98389a09e1a316d349b6067 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 14:51:49 +0100 +Subject: net/mlx5: Fix crash during sync firmware reset + +From: Suresh Devarakonda + +[ Upstream commit aefb62a9988749703435e941704624949a80a2a9 ] + +When setting Bluefield to DPU NIC mode using mlxconfig tool + sync +firmware reset flow, we run into scenario where the host was not +eswitch manager at the time of mlx5 driver load but becomes eswitch manager +after the sync firmware reset flow. This results in null pointer +access of mpfs structure during mac filter add. This change prevents null +pointer access but mpfs table entries will not be added. + +Fixes: 5ec697446f46 ("net/mlx5: Add support for devlink reload action fw activate") +Signed-off-by: Suresh Devarakonda +Reviewed-by: Moshe Shemesh +Reviewed-by: Bodong Wang +Signed-off-by: Saeed Mahameed +Link: https://lore.kernel.org/r/20221026135153.154807-12-saeed@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c +index 839a01da110f..8ff16318e32d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c +@@ -122,7 +122,7 @@ void mlx5_mpfs_cleanup(struct mlx5_core_dev *dev) + { + struct mlx5_mpfs *mpfs = dev->priv.mpfs; + +- if (!MLX5_ESWITCH_MANAGER(dev)) ++ if (!mpfs) + return; + + WARN_ON(!hlist_empty(mpfs->hash)); +@@ -137,7 +137,7 @@ int mlx5_mpfs_add_mac(struct mlx5_core_dev *dev, u8 *mac) + int err = 0; + u32 index; + +- if (!MLX5_ESWITCH_MANAGER(dev)) ++ if (!mpfs) + return 0; + + mutex_lock(&mpfs->lock); +@@ -185,7 +185,7 @@ int mlx5_mpfs_del_mac(struct mlx5_core_dev *dev, u8 *mac) + int err = 0; + u32 index; + +- if (!MLX5_ESWITCH_MANAGER(dev)) ++ if (!mpfs) + return 0; + + mutex_lock(&mpfs->lock); +-- +2.35.1 + diff --git a/queue-6.0/net-mlx5-fix-possible-use-after-free-in-async-comman.patch b/queue-6.0/net-mlx5-fix-possible-use-after-free-in-async-comman.patch new file mode 100644 index 00000000000..8fbdf40e89c --- /dev/null +++ b/queue-6.0/net-mlx5-fix-possible-use-after-free-in-async-comman.patch @@ -0,0 +1,212 @@ +From b699434f97605884b7926a654e53ec144701752b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 14:51:45 +0100 +Subject: net/mlx5: Fix possible use-after-free in async command interface + +From: Tariq Toukan + +[ Upstream commit bacd22df95147ed673bec4692ab2d4d585935241 ] + +mlx5_cmd_cleanup_async_ctx should return only after all its callback +handlers were completed. Before this patch, the below race between +mlx5_cmd_cleanup_async_ctx and mlx5_cmd_exec_cb_handler was possible and +lead to a use-after-free: + +1. mlx5_cmd_cleanup_async_ctx is called while num_inflight is 2 (i.e. + elevated by 1, a single inflight callback). +2. mlx5_cmd_cleanup_async_ctx decreases num_inflight to 1. +3. mlx5_cmd_exec_cb_handler is called, decreases num_inflight to 0 and + is about to call wake_up(). +4. mlx5_cmd_cleanup_async_ctx calls wait_event, which returns + immediately as the condition (num_inflight == 0) holds. +5. mlx5_cmd_cleanup_async_ctx returns. +6. The caller of mlx5_cmd_cleanup_async_ctx frees the mlx5_async_ctx + object. +7. mlx5_cmd_exec_cb_handler goes on and calls wake_up() on the freed + object. + +Fix it by syncing using a completion object. Mark it completed when +num_inflight reaches 0. + +Trace: + +BUG: KASAN: use-after-free in do_raw_spin_lock+0x23d/0x270 +Read of size 4 at addr ffff888139cd12f4 by task swapper/5/0 + +CPU: 5 PID: 0 Comm: swapper/5 Not tainted 6.0.0-rc3_for_upstream_debug_2022_08_30_13_10 #1 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 +Call Trace: + + dump_stack_lvl+0x57/0x7d + print_report.cold+0x2d5/0x684 + ? do_raw_spin_lock+0x23d/0x270 + kasan_report+0xb1/0x1a0 + ? do_raw_spin_lock+0x23d/0x270 + do_raw_spin_lock+0x23d/0x270 + ? rwlock_bug.part.0+0x90/0x90 + ? __delete_object+0xb8/0x100 + ? lock_downgrade+0x6e0/0x6e0 + _raw_spin_lock_irqsave+0x43/0x60 + ? __wake_up_common_lock+0xb9/0x140 + __wake_up_common_lock+0xb9/0x140 + ? __wake_up_common+0x650/0x650 + ? destroy_tis_callback+0x53/0x70 [mlx5_core] + ? kasan_set_track+0x21/0x30 + ? destroy_tis_callback+0x53/0x70 [mlx5_core] + ? kfree+0x1ba/0x520 + ? do_raw_spin_unlock+0x54/0x220 + mlx5_cmd_exec_cb_handler+0x136/0x1a0 [mlx5_core] + ? mlx5_cmd_cleanup_async_ctx+0x220/0x220 [mlx5_core] + ? mlx5_cmd_cleanup_async_ctx+0x220/0x220 [mlx5_core] + mlx5_cmd_comp_handler+0x65a/0x12b0 [mlx5_core] + ? dump_command+0xcc0/0xcc0 [mlx5_core] + ? lockdep_hardirqs_on_prepare+0x400/0x400 + ? cmd_comp_notifier+0x7e/0xb0 [mlx5_core] + cmd_comp_notifier+0x7e/0xb0 [mlx5_core] + atomic_notifier_call_chain+0xd7/0x1d0 + mlx5_eq_async_int+0x3ce/0xa20 [mlx5_core] + atomic_notifier_call_chain+0xd7/0x1d0 + ? irq_release+0x140/0x140 [mlx5_core] + irq_int_handler+0x19/0x30 [mlx5_core] + __handle_irq_event_percpu+0x1f2/0x620 + handle_irq_event+0xb2/0x1d0 + handle_edge_irq+0x21e/0xb00 + __common_interrupt+0x79/0x1a0 + common_interrupt+0x78/0xa0 + + + asm_common_interrupt+0x22/0x40 +RIP: 0010:default_idle+0x42/0x60 +Code: c1 83 e0 07 48 c1 e9 03 83 c0 03 0f b6 14 11 38 d0 7c 04 84 d2 75 14 8b 05 eb 47 22 02 85 c0 7e 07 0f 00 2d e0 9f 48 00 fb f4 48 c7 c7 80 08 7f 85 e8 d1 d3 3e fe eb de 66 66 2e 0f 1f 84 00 +RSP: 0018:ffff888100dbfdf0 EFLAGS: 00000242 +RAX: 0000000000000001 RBX: ffffffff84ecbd48 RCX: 1ffffffff0afe110 +RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffffffff835cc9bc +RBP: 0000000000000005 R08: 0000000000000001 R09: ffff88881dec4ac3 +R10: ffffed1103bd8958 R11: 0000017d0ca571c9 R12: 0000000000000005 +R13: ffffffff84f024e0 R14: 0000000000000000 R15: dffffc0000000000 + ? default_idle_call+0xcc/0x450 + default_idle_call+0xec/0x450 + do_idle+0x394/0x450 + ? arch_cpu_idle_exit+0x40/0x40 + ? do_idle+0x17/0x450 + cpu_startup_entry+0x19/0x20 + start_secondary+0x221/0x2b0 + ? set_cpu_sibling_map+0x2070/0x2070 + secondary_startup_64_no_verify+0xcd/0xdb + + +Allocated by task 49502: + kasan_save_stack+0x1e/0x40 + __kasan_kmalloc+0x81/0xa0 + kvmalloc_node+0x48/0xe0 + mlx5e_bulk_async_init+0x35/0x110 [mlx5_core] + mlx5e_tls_priv_tx_list_cleanup+0x84/0x3e0 [mlx5_core] + mlx5e_ktls_cleanup_tx+0x38f/0x760 [mlx5_core] + mlx5e_cleanup_nic_tx+0xa7/0x100 [mlx5_core] + mlx5e_detach_netdev+0x1ca/0x2b0 [mlx5_core] + mlx5e_suspend+0xdb/0x140 [mlx5_core] + mlx5e_remove+0x89/0x190 [mlx5_core] + auxiliary_bus_remove+0x52/0x70 + device_release_driver_internal+0x40f/0x650 + driver_detach+0xc1/0x180 + bus_remove_driver+0x125/0x2f0 + auxiliary_driver_unregister+0x16/0x50 + mlx5e_cleanup+0x26/0x30 [mlx5_core] + cleanup+0xc/0x4e [mlx5_core] + __x64_sys_delete_module+0x2b5/0x450 + do_syscall_64+0x3d/0x90 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Freed by task 49502: + kasan_save_stack+0x1e/0x40 + kasan_set_track+0x21/0x30 + kasan_set_free_info+0x20/0x30 + ____kasan_slab_free+0x11d/0x1b0 + kfree+0x1ba/0x520 + mlx5e_tls_priv_tx_list_cleanup+0x2e7/0x3e0 [mlx5_core] + mlx5e_ktls_cleanup_tx+0x38f/0x760 [mlx5_core] + mlx5e_cleanup_nic_tx+0xa7/0x100 [mlx5_core] + mlx5e_detach_netdev+0x1ca/0x2b0 [mlx5_core] + mlx5e_suspend+0xdb/0x140 [mlx5_core] + mlx5e_remove+0x89/0x190 [mlx5_core] + auxiliary_bus_remove+0x52/0x70 + device_release_driver_internal+0x40f/0x650 + driver_detach+0xc1/0x180 + bus_remove_driver+0x125/0x2f0 + auxiliary_driver_unregister+0x16/0x50 + mlx5e_cleanup+0x26/0x30 [mlx5_core] + cleanup+0xc/0x4e [mlx5_core] + __x64_sys_delete_module+0x2b5/0x450 + do_syscall_64+0x3d/0x90 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Fixes: e355477ed9e4 ("net/mlx5: Make mlx5_cmd_exec_cb() a safe API") +Signed-off-by: Tariq Toukan +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Link: https://lore.kernel.org/r/20221026135153.154807-8-saeed@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 10 +++++----- + include/linux/mlx5/driver.h | 2 +- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index 0377392848d9..46ba4c2faad2 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -2004,7 +2004,7 @@ void mlx5_cmd_init_async_ctx(struct mlx5_core_dev *dev, + ctx->dev = dev; + /* Starts at 1 to avoid doing wake_up if we are not cleaning up */ + atomic_set(&ctx->num_inflight, 1); +- init_waitqueue_head(&ctx->wait); ++ init_completion(&ctx->inflight_done); + } + EXPORT_SYMBOL(mlx5_cmd_init_async_ctx); + +@@ -2018,8 +2018,8 @@ EXPORT_SYMBOL(mlx5_cmd_init_async_ctx); + */ + void mlx5_cmd_cleanup_async_ctx(struct mlx5_async_ctx *ctx) + { +- atomic_dec(&ctx->num_inflight); +- wait_event(ctx->wait, atomic_read(&ctx->num_inflight) == 0); ++ if (!atomic_dec_and_test(&ctx->num_inflight)) ++ wait_for_completion(&ctx->inflight_done); + } + EXPORT_SYMBOL(mlx5_cmd_cleanup_async_ctx); + +@@ -2032,7 +2032,7 @@ static void mlx5_cmd_exec_cb_handler(int status, void *_work) + status = cmd_status_err(ctx->dev, status, work->opcode, work->out); + work->user_callback(status, work); + if (atomic_dec_and_test(&ctx->num_inflight)) +- wake_up(&ctx->wait); ++ complete(&ctx->inflight_done); + } + + int mlx5_cmd_exec_cb(struct mlx5_async_ctx *ctx, void *in, int in_size, +@@ -2050,7 +2050,7 @@ int mlx5_cmd_exec_cb(struct mlx5_async_ctx *ctx, void *in, int in_size, + ret = cmd_exec(ctx->dev, in, in_size, out, out_size, + mlx5_cmd_exec_cb_handler, work, false); + if (ret && atomic_dec_and_test(&ctx->num_inflight)) +- wake_up(&ctx->wait); ++ complete(&ctx->inflight_done); + + return ret; + } +diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h +index c32de987fa71..454dab40baf6 100644 +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -973,7 +973,7 @@ void mlx5_cmd_allowed_opcode(struct mlx5_core_dev *dev, u16 opcode); + struct mlx5_async_ctx { + struct mlx5_core_dev *dev; + atomic_t num_inflight; +- struct wait_queue_head wait; ++ struct completion inflight_done; + }; + + struct mlx5_async_work; +-- +2.35.1 + diff --git a/queue-6.0/net-mlx5-update-fw-fatal-reporter-state-on-pci-handl.patch b/queue-6.0/net-mlx5-update-fw-fatal-reporter-state-on-pci-handl.patch new file mode 100644 index 00000000000..9a14a02b59d --- /dev/null +++ b/queue-6.0/net-mlx5-update-fw-fatal-reporter-state-on-pci-handl.patch @@ -0,0 +1,49 @@ +From 1de38d26ab1590cb957e89e440eddea9d0fd560a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 14:51:48 +0100 +Subject: net/mlx5: Update fw fatal reporter state on PCI handlers successful + recover + +From: Roy Novich + +[ Upstream commit 416ef713631937cf5452476a7f1041a3ae7b06c6 ] + +Update devlink health fw fatal reporter state to "healthy" is needed by +strictly calling devlink_health_reporter_state_update() after recovery +was done by PCI error handler. This is needed when fw_fatal reporter was +triggered due to PCI error. Poll health is called and set reporter state +to error. Health recovery failed (since EEH didn't re-enable the PCI). +PCI handlers keep on recover flow and succeed later without devlink +acknowledgment. Fix this by adding devlink state update at the end of +the PCI handler recovery process. + +Fixes: 6181e5cb752e ("devlink: add support for reporter recovery completion") +Signed-off-by: Roy Novich +Reviewed-by: Moshe Shemesh +Reviewed-by: Aya Levin +Signed-off-by: Saeed Mahameed +Link: https://lore.kernel.org/r/20221026135153.154807-11-saeed@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 89b2d9cea33f..e5e32430b6af 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -1833,6 +1833,10 @@ static void mlx5_pci_resume(struct pci_dev *pdev) + + err = mlx5_load_one(dev, false); + ++ if (!err) ++ devlink_health_reporter_state_update(dev->priv.health.fw_fatal_reporter, ++ DEVLINK_HEALTH_REPORTER_STATE_HEALTHY); ++ + mlx5_pci_trace(dev, "Done, err = %d, device %s\n", err, + !err ? "recovered" : "Failed"); + } +-- +2.35.1 + diff --git a/queue-6.0/net-mlx5-wait-for-firmware-to-enable-crs-before-pci_.patch b/queue-6.0/net-mlx5-wait-for-firmware-to-enable-crs-before-pci_.patch new file mode 100644 index 00000000000..f39115e775a --- /dev/null +++ b/queue-6.0/net-mlx5-wait-for-firmware-to-enable-crs-before-pci_.patch @@ -0,0 +1,54 @@ +From 50583609047df27276f426cad691442142b664cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 14:51:40 +0100 +Subject: net/mlx5: Wait for firmware to enable CRS before pci_restore_state + +From: Moshe Shemesh + +[ Upstream commit 212b4d7251c169f87fa734e79bdec8dd413be5cf ] + +After firmware reset driver should verify firmware already enabled CRS +and became responsive to pci config cycles before restoring pci state. +Fix that by waiting till device_id is readable through PCI again. + +Fixes: eabe8e5e88f5 ("net/mlx5: Handle sync reset now event") +Signed-off-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Link: https://lore.kernel.org/r/20221026135153.154807-3-saeed@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/fw_reset.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +index e8896f368362..07c583996c29 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +@@ -358,6 +358,23 @@ static int mlx5_pci_link_toggle(struct mlx5_core_dev *dev) + err = -ETIMEDOUT; + } + ++ do { ++ err = pci_read_config_word(dev->pdev, PCI_DEVICE_ID, ®16); ++ if (err) ++ return err; ++ if (reg16 == dev_id) ++ break; ++ msleep(20); ++ } while (!time_after(jiffies, timeout)); ++ ++ if (reg16 == dev_id) { ++ mlx5_core_info(dev, "Firmware responds to PCI config cycles again\n"); ++ } else { ++ mlx5_core_err(dev, "Firmware is not responsive (0x%04x) after %llu ms\n", ++ reg16, mlx5_tout_ms(dev, PCI_TOGGLE)); ++ err = -ETIMEDOUT; ++ } ++ + restore: + list_for_each_entry(sdev, &bridge_bus->devices, bus_list) { + pci_cfg_access_unlock(sdev); +-- +2.35.1 + diff --git a/queue-6.0/net-mlx5e-do-not-increment-esn-when-updating-ipsec-e.patch b/queue-6.0/net-mlx5e-do-not-increment-esn-when-updating-ipsec-e.patch new file mode 100644 index 00000000000..ccb5be6fa2d --- /dev/null +++ b/queue-6.0/net-mlx5e-do-not-increment-esn-when-updating-ipsec-e.patch @@ -0,0 +1,75 @@ +From dea517930ddf00b83bdb15cb21819fb3c6c9deef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 14:51:39 +0100 +Subject: net/mlx5e: Do not increment ESN when updating IPsec ESN state + +From: Hyong Youb Kim + +[ Upstream commit 888be6b279b7257b5f6e4c9527675bff0a335596 ] + +An offloaded SA stops receiving after about 2^32 + replay_window +packets. For example, when SA reaches , all +subsequent packets get dropped with SA-icv-failure (integrity_failed). + +To reproduce the bug: +- ConnectX-6 Dx with crypto enabled (FW 22.30.1004) +- ipsec.conf: + nic-offload = yes + replay-window = 32 + esn = yes + salifetime=24h +- Run netperf for a long time to send more than 2^32 packets + netperf -H -t TCP_STREAM -l 20000 + +When 2^32 + replay_window packets are received, the replay window +moves from the 2nd half of subspace (overlap=1) to the 1st half +(overlap=0). The driver then updates the 'esn' value in NIC +(i.e. seq_hi) as follows. + + seq_hi = xfrm_replay_seqhi(seq_bottom) + new esn in NIC = seq_hi + 1 + +The +1 increment is wrong, as seq_hi already contains the correct +seq_hi. For example, when seq_hi=1, the driver actually tells NIC to +use seq_hi=2 (esn). This incorrect esn value causes all subsequent +packets to fail integrity checks (SA-icv-failure). So, do not +increment. + +Fixes: cb01008390bb ("net/mlx5: IPSec, Add support for ESN") +Signed-off-by: Hyong Youb Kim +Acked-by: Leon Romanovsky +Signed-off-by: Saeed Mahameed +Link: https://lore.kernel.org/r/20221026135153.154807-2-saeed@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +index 2a8fd7020622..a715601865d3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +@@ -101,7 +101,6 @@ static bool mlx5e_ipsec_update_esn_state(struct mlx5e_ipsec_sa_entry *sa_entry) + struct xfrm_replay_state_esn *replay_esn; + u32 seq_bottom = 0; + u8 overlap; +- u32 *esn; + + if (!(sa_entry->x->props.flags & XFRM_STATE_ESN)) { + sa_entry->esn_state.trigger = 0; +@@ -116,11 +115,9 @@ static bool mlx5e_ipsec_update_esn_state(struct mlx5e_ipsec_sa_entry *sa_entry) + + sa_entry->esn_state.esn = xfrm_replay_seqhi(sa_entry->x, + htonl(seq_bottom)); +- esn = &sa_entry->esn_state.esn; + + sa_entry->esn_state.trigger = 1; + if (unlikely(overlap && seq_bottom < MLX5E_IPSEC_ESN_SCOPE_MID)) { +- ++(*esn); + sa_entry->esn_state.overlap = 0; + return true; + } else if (unlikely(!overlap && +-- +2.35.1 + diff --git a/queue-6.0/net-mlx5e-extend-skb-room-check-to-include-ptp-sq.patch b/queue-6.0/net-mlx5e-extend-skb-room-check-to-include-ptp-sq.patch new file mode 100644 index 00000000000..7e9eeff9290 --- /dev/null +++ b/queue-6.0/net-mlx5e-extend-skb-room-check-to-include-ptp-sq.patch @@ -0,0 +1,102 @@ +From 7c4e7a0e593e987309e85a427588635c1abdee90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 14:51:42 +0100 +Subject: net/mlx5e: Extend SKB room check to include PTP-SQ + +From: Aya Levin + +[ Upstream commit 19b43a432e3e47db656a8269a74b50aef826950c ] + +When tx_port_ts is set, the driver diverts all UPD traffic over PTP port +to a dedicated PTP-SQ. The SKBs are cached until the wire-CQE arrives. +When the packet size is greater then MTU, the firmware might drop it and +the packet won't be transmitted to the wire, hence the wire-CQE won't +reach the driver. In this case the SKBs are accumulated in the SKB fifo. +Add room check to consider the PTP-SQ SKB fifo, when the SKB fifo is +full, driver stops the queue resulting in a TX timeout. Devlink +TX-reporter can recover from it. + +Fixes: 1880bc4e4a96 ("net/mlx5e: Add TX port timestamp support") +Signed-off-by: Aya Levin +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Link: https://lore.kernel.org/r/20221026135153.154807-5-saeed@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h | 9 +++++++++ + drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h | 6 ++++++ + drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 6 ++++++ + 3 files changed, 21 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h +index 92dbbec472ec..f324a0c6f869 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h +@@ -6,6 +6,7 @@ + + #include "en.h" + #include "en_stats.h" ++#include "en/txrx.h" + #include + + #define MLX5E_PTP_CHANNEL_IX 0 +@@ -68,6 +69,14 @@ static inline bool mlx5e_use_ptpsq(struct sk_buff *skb) + fk.ports.dst == htons(PTP_EV_PORT)); + } + ++static inline bool mlx5e_ptpsq_fifo_has_room(struct mlx5e_txqsq *sq) ++{ ++ if (!sq->ptpsq) ++ return true; ++ ++ return mlx5e_skb_fifo_has_room(&sq->ptpsq->skb_fifo); ++} ++ + int mlx5e_ptp_open(struct mlx5e_priv *priv, struct mlx5e_params *params, + u8 lag_port, struct mlx5e_ptp **cp); + void mlx5e_ptp_close(struct mlx5e_ptp *c); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h +index c208ea307bff..ff8ca7a7e103 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h +@@ -57,6 +57,12 @@ netdev_tx_t mlx5e_xmit(struct sk_buff *skb, struct net_device *dev); + bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget); + void mlx5e_free_txqsq_descs(struct mlx5e_txqsq *sq); + ++static inline bool ++mlx5e_skb_fifo_has_room(struct mlx5e_skb_fifo *fifo) ++{ ++ return (*fifo->pc - *fifo->cc) < fifo->mask; ++} ++ + static inline bool + mlx5e_wqc_has_room_for(struct mlx5_wq_cyc *wq, u16 cc, u16 pc, u16 n) + { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +index 27f791feb517..4d45150a3f8e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +@@ -391,6 +391,11 @@ mlx5e_txwqe_complete(struct mlx5e_txqsq *sq, struct sk_buff *skb, + if (unlikely(sq->ptpsq)) { + mlx5e_skb_cb_hwtstamp_init(skb); + mlx5e_skb_fifo_push(&sq->ptpsq->skb_fifo, skb); ++ if (!netif_tx_queue_stopped(sq->txq) && ++ !mlx5e_skb_fifo_has_room(&sq->ptpsq->skb_fifo)) { ++ netif_tx_stop_queue(sq->txq); ++ sq->stats->stopped++; ++ } + skb_get(skb); + } + +@@ -867,6 +872,7 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget) + + if (netif_tx_queue_stopped(sq->txq) && + mlx5e_wqc_has_room_for(&sq->wq, sq->cc, sq->pc, sq->stop_room) && ++ mlx5e_ptpsq_fifo_has_room(sq) && + !test_bit(MLX5E_SQ_STATE_RECOVERING, &sq->state)) { + netif_tx_wake_queue(sq->txq); + stats->wake++; +-- +2.35.1 + diff --git a/queue-6.0/net-mlx5e-tc-fix-cloned-flow-attr-instance-dests-are.patch b/queue-6.0/net-mlx5e-tc-fix-cloned-flow-attr-instance-dests-are.patch new file mode 100644 index 00000000000..2880f5cf1cd --- /dev/null +++ b/queue-6.0/net-mlx5e-tc-fix-cloned-flow-attr-instance-dests-are.patch @@ -0,0 +1,42 @@ +From e47ec25c93bd242a89398498f2f29ab1a8cd8533 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 14:51:47 +0100 +Subject: net/mlx5e: TC, Fix cloned flow attr instance dests are not zeroed + +From: Roi Dayan + +[ Upstream commit 94d651739e17b0ee9b556e60f206fe538d06dc05 ] + +On multi table split the driver creates a new attr instance with +data being copied from prev attr instance zeroing action flags. +Also need to reset dests properties to avoid incorrect dests per attr. + +Fixes: 8300f225268b ("net/mlx5e: Create new flow attr for multi table actions") +Signed-off-by: Roi Dayan +Reviewed-by: Maor Dickman +Signed-off-by: Saeed Mahameed +Link: https://lore.kernel.org/r/20221026135153.154807-10-saeed@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index a687f047e3ae..8998450c61a3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -3619,6 +3619,10 @@ mlx5e_clone_flow_attr_for_post_act(struct mlx5_flow_attr *attr, + attr2->action = 0; + attr2->flags = 0; + attr2->parse_attr = parse_attr; ++ attr2->esw_attr->out_count = 0; ++ attr2->esw_attr->split_count = 0; ++ attr2->dest_chain = 0; ++ attr2->dest_ft = NULL; + return attr2; + } + +-- +2.35.1 + diff --git a/queue-6.0/net-mlx5e-tc-reject-forwarding-from-internal-port-to.patch b/queue-6.0/net-mlx5e-tc-reject-forwarding-from-internal-port-to.patch new file mode 100644 index 00000000000..2b4e3dfaba7 --- /dev/null +++ b/queue-6.0/net-mlx5e-tc-reject-forwarding-from-internal-port-to.patch @@ -0,0 +1,74 @@ +From c9832c9985f51fdbf32b611bacb9010e9eeff6fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 14:51:46 +0100 +Subject: net/mlx5e: TC, Reject forwarding from internal port to internal port + +From: Ariel Levkovich + +[ Upstream commit f382a2413dae8c855226a72600812a4b37432c48 ] + +Reject TC rules that forward from internal port to internal port +as it is not supported. + +This include rules that are explicitly have internal port as +the filter device as well as rules that apply on tunnel interfaces +as the route device for the tunnel interface can be an internal +port. + +Fixes: 27484f7170ed ("net/mlx5e: Offload tc rules that redirect to ovs internal port") +Signed-off-by: Ariel Levkovich +Reviewed-by: Maor Dickman +Signed-off-by: Saeed Mahameed +Link: https://lore.kernel.org/r/20221026135153.154807-9-saeed@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 6a0df046064f..a687f047e3ae 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -4052,6 +4052,7 @@ parse_tc_fdb_actions(struct mlx5e_priv *priv, + struct mlx5e_tc_flow_parse_attr *parse_attr; + struct mlx5_flow_attr *attr = flow->attr; + struct mlx5_esw_flow_attr *esw_attr; ++ struct net_device *filter_dev; + int err; + + err = flow_action_supported(flow_action, extack); +@@ -4060,6 +4061,7 @@ parse_tc_fdb_actions(struct mlx5e_priv *priv, + + esw_attr = attr->esw_attr; + parse_attr = attr->parse_attr; ++ filter_dev = parse_attr->filter_dev; + parse_state = &parse_attr->parse_state; + mlx5e_tc_act_init_parse_state(parse_state, flow, flow_action, extack); + parse_state->ct_priv = get_ct_priv(priv); +@@ -4069,13 +4071,21 @@ parse_tc_fdb_actions(struct mlx5e_priv *priv, + return err; + + /* Forward to/from internal port can only have 1 dest */ +- if ((netif_is_ovs_master(parse_attr->filter_dev) || esw_attr->dest_int_port) && ++ if ((netif_is_ovs_master(filter_dev) || esw_attr->dest_int_port) && + esw_attr->out_count > 1) { + NL_SET_ERR_MSG_MOD(extack, + "Rules with internal port can have only one destination"); + return -EOPNOTSUPP; + } + ++ /* Forward from tunnel/internal port to internal port is not supported */ ++ if ((mlx5e_get_tc_tun(filter_dev) || netif_is_ovs_master(filter_dev)) && ++ esw_attr->dest_int_port) { ++ NL_SET_ERR_MSG_MOD(extack, ++ "Forwarding from tunnel/internal port to internal port is not supported"); ++ return -EOPNOTSUPP; ++ } ++ + err = actions_prepare_mod_hdr_actions(priv, flow, attr, extack); + if (err) + return err; +-- +2.35.1 + diff --git a/queue-6.0/net-mlx5e-update-restore-chain-id-for-slow-path-pack.patch b/queue-6.0/net-mlx5e-update-restore-chain-id-for-slow-path-pack.patch new file mode 100644 index 00000000000..0fa2d8b8573 --- /dev/null +++ b/queue-6.0/net-mlx5e-update-restore-chain-id-for-slow-path-pack.patch @@ -0,0 +1,146 @@ +From 7dc3a6fecfdd387c2f807b8daba8966049004334 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 14:51:43 +0100 +Subject: net/mlx5e: Update restore chain id for slow path packets + +From: Paul Blakey + +[ Upstream commit 8dc47c0527c1586e3ebe0efd323f1d8abb181c77 ] + +Currently encap slow path rules just forward to software without +setting the chain id miss register, so driver doesn't restore +the chain, and packets hitting this rule will restart from tc chain +0 instead of continuing to the chain the encap rule was on. + +Fix this by setting the chain id miss register to the chain id mapping. + +Fixes: 8f1e0b97cc70 ("net/mlx5: E-Switch, Mark miss packets with new chain id mapping") +Signed-off-by: Paul Blakey +Reviewed-by: Oz Shlomo +Signed-off-by: Saeed Mahameed +Link: https://lore.kernel.org/r/20221026135153.154807-6-saeed@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlx5/core/en/tc_priv.h | 2 + + .../net/ethernet/mellanox/mlx5/core/en_tc.c | 62 ++++++++++++++++++- + 2 files changed, 62 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_priv.h b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_priv.h +index 10c9a8a79d00..2e42d7c5451e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_priv.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_priv.h +@@ -96,6 +96,7 @@ struct mlx5e_tc_flow { + struct encap_flow_item encaps[MLX5_MAX_FLOW_FWD_VPORTS]; + struct mlx5e_tc_flow *peer_flow; + struct mlx5e_mod_hdr_handle *mh; /* attached mod header instance */ ++ struct mlx5e_mod_hdr_handle *slow_mh; /* attached mod header instance for slow path */ + struct mlx5e_hairpin_entry *hpe; /* attached hairpin instance */ + struct list_head hairpin; /* flows sharing the same hairpin */ + struct list_head peer; /* flows with peer flow */ +@@ -111,6 +112,7 @@ struct mlx5e_tc_flow { + struct completion del_hw_done; + struct mlx5_flow_attr *attr; + struct list_head attrs; ++ u32 chain_mapping; + }; + + struct mlx5_flow_handle * +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index f154bda668ad..6a0df046064f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -1394,8 +1394,13 @@ mlx5e_tc_offload_to_slow_path(struct mlx5_eswitch *esw, + struct mlx5e_tc_flow *flow, + struct mlx5_flow_spec *spec) + { ++ struct mlx5e_tc_mod_hdr_acts mod_acts = {}; ++ struct mlx5e_mod_hdr_handle *mh = NULL; + struct mlx5_flow_attr *slow_attr; + struct mlx5_flow_handle *rule; ++ bool fwd_and_modify_cap; ++ u32 chain_mapping = 0; ++ int err; + + slow_attr = mlx5_alloc_flow_attr(MLX5_FLOW_NAMESPACE_FDB); + if (!slow_attr) +@@ -1406,13 +1411,56 @@ mlx5e_tc_offload_to_slow_path(struct mlx5_eswitch *esw, + slow_attr->esw_attr->split_count = 0; + slow_attr->flags |= MLX5_ATTR_FLAG_SLOW_PATH; + ++ fwd_and_modify_cap = MLX5_CAP_ESW_FLOWTABLE((esw)->dev, fdb_modify_header_fwd_to_table); ++ if (!fwd_and_modify_cap) ++ goto skip_restore; ++ ++ err = mlx5_chains_get_chain_mapping(esw_chains(esw), flow->attr->chain, &chain_mapping); ++ if (err) ++ goto err_get_chain; ++ ++ err = mlx5e_tc_match_to_reg_set(esw->dev, &mod_acts, MLX5_FLOW_NAMESPACE_FDB, ++ CHAIN_TO_REG, chain_mapping); ++ if (err) ++ goto err_reg_set; ++ ++ mh = mlx5e_mod_hdr_attach(esw->dev, get_mod_hdr_table(flow->priv, flow), ++ MLX5_FLOW_NAMESPACE_FDB, &mod_acts); ++ if (IS_ERR(mh)) { ++ err = PTR_ERR(mh); ++ goto err_attach; ++ } ++ ++ slow_attr->action |= MLX5_FLOW_CONTEXT_ACTION_MOD_HDR; ++ slow_attr->modify_hdr = mlx5e_mod_hdr_get(mh); ++ ++skip_restore: + rule = mlx5e_tc_offload_fdb_rules(esw, flow, spec, slow_attr); +- if (!IS_ERR(rule)) +- flow_flag_set(flow, SLOW); ++ if (IS_ERR(rule)) { ++ err = PTR_ERR(rule); ++ goto err_offload; ++ } + ++ flow->slow_mh = mh; ++ flow->chain_mapping = chain_mapping; ++ flow_flag_set(flow, SLOW); ++ ++ mlx5e_mod_hdr_dealloc(&mod_acts); + kfree(slow_attr); + + return rule; ++ ++err_offload: ++ if (fwd_and_modify_cap) ++ mlx5e_mod_hdr_detach(esw->dev, get_mod_hdr_table(flow->priv, flow), mh); ++err_attach: ++err_reg_set: ++ if (fwd_and_modify_cap) ++ mlx5_chains_put_chain_mapping(esw_chains(esw), chain_mapping); ++err_get_chain: ++ mlx5e_mod_hdr_dealloc(&mod_acts); ++ kfree(slow_attr); ++ return ERR_PTR(err); + } + + void mlx5e_tc_unoffload_from_slow_path(struct mlx5_eswitch *esw, +@@ -1430,7 +1478,17 @@ void mlx5e_tc_unoffload_from_slow_path(struct mlx5_eswitch *esw, + slow_attr->action = MLX5_FLOW_CONTEXT_ACTION_FWD_DEST; + slow_attr->esw_attr->split_count = 0; + slow_attr->flags |= MLX5_ATTR_FLAG_SLOW_PATH; ++ if (flow->slow_mh) { ++ slow_attr->action |= MLX5_FLOW_CONTEXT_ACTION_MOD_HDR; ++ slow_attr->modify_hdr = mlx5e_mod_hdr_get(flow->slow_mh); ++ } + mlx5e_tc_unoffload_fdb_rules(esw, flow, slow_attr); ++ if (flow->slow_mh) { ++ mlx5e_mod_hdr_detach(esw->dev, get_mod_hdr_table(flow->priv, flow), flow->slow_mh); ++ mlx5_chains_put_chain_mapping(esw_chains(esw), flow->chain_mapping); ++ flow->chain_mapping = 0; ++ flow->slow_mh = NULL; ++ } + flow_flag_clear(flow, SLOW); + kfree(slow_attr); + } +-- +2.35.1 + diff --git a/queue-6.0/net-netsec-fix-error-handling-in-netsec_register_mdi.patch b/queue-6.0/net-netsec-fix-error-handling-in-netsec_register_mdi.patch new file mode 100644 index 00000000000..36f36a6df28 --- /dev/null +++ b/queue-6.0/net-netsec-fix-error-handling-in-netsec_register_mdi.patch @@ -0,0 +1,46 @@ +From b4eef12060149d1190b69185f313a50560d2634f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 14:41:04 +0800 +Subject: net: netsec: fix error handling in netsec_register_mdio() + +From: Yang Yingliang + +[ Upstream commit 94423589689124e8cd145b38a1034be7f25835b2 ] + +If phy_device_register() fails, phy_device_free() need be called to +put refcount, so memory of phy device and device name can be freed +in callback function. + +If get_phy_device() fails, mdiobus_unregister() need be called, +or it will cause warning in mdiobus_free() and kobject is leaked. + +Fixes: 533dd11a12f6 ("net: socionext: Add Synquacer NetSec driver") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221019064104.3228892-1-yangyingliang@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/socionext/netsec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c +index b0c5a44785fa..386c8640381b 100644 +--- a/drivers/net/ethernet/socionext/netsec.c ++++ b/drivers/net/ethernet/socionext/netsec.c +@@ -1961,11 +1961,13 @@ static int netsec_register_mdio(struct netsec_priv *priv, u32 phy_addr) + ret = PTR_ERR(priv->phydev); + dev_err(priv->dev, "get_phy_device err(%d)\n", ret); + priv->phydev = NULL; ++ mdiobus_unregister(bus); + return -ENODEV; + } + + ret = phy_device_register(priv->phydev); + if (ret) { ++ phy_device_free(priv->phydev); + mdiobus_unregister(bus); + dev_err(priv->dev, + "phy_device_register err(%d)\n", ret); +-- +2.35.1 + diff --git a/queue-6.0/netdevsim-fix-memory-leak-in-nsim_bus_dev_new.patch b/queue-6.0/netdevsim-fix-memory-leak-in-nsim_bus_dev_new.patch new file mode 100644 index 00000000000..856ef93707c --- /dev/null +++ b/queue-6.0/netdevsim-fix-memory-leak-in-nsim_bus_dev_new.patch @@ -0,0 +1,80 @@ +From f6d0c63df5c1643b55eb92470944d86bb203dabe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 09:54:05 +0800 +Subject: netdevsim: fix memory leak in nsim_bus_dev_new() + +From: Zhengchao Shao + +[ Upstream commit cf2010aa1c739bab067cbc90b690d28eaa0b47da ] + +If device_register() failed in nsim_bus_dev_new(), the value of reference +in nsim_bus_dev->dev is 1. obj->name in nsim_bus_dev->dev will not be +released. + +unreferenced object 0xffff88810352c480 (size 16): + comm "echo", pid 5691, jiffies 4294945921 (age 133.270s) + hex dump (first 16 bytes): + 6e 65 74 64 65 76 73 69 6d 31 00 00 00 00 00 00 netdevsim1...... + backtrace: + [<000000005e2e5e26>] __kmalloc_node_track_caller+0x3a/0xb0 + [<0000000094ca4fc8>] kvasprintf+0xc3/0x160 + [<00000000aad09bcc>] kvasprintf_const+0x55/0x180 + [<000000009bac868d>] kobject_set_name_vargs+0x56/0x150 + [<000000007c1a5d70>] dev_set_name+0xbb/0xf0 + [<00000000ad0d126b>] device_add+0x1f8/0x1cb0 + [<00000000c222ae24>] new_device_store+0x3b6/0x5e0 + [<0000000043593421>] bus_attr_store+0x72/0xa0 + [<00000000cbb1833a>] sysfs_kf_write+0x106/0x160 + [<00000000d0dedb8a>] kernfs_fop_write_iter+0x3a8/0x5a0 + [<00000000770b66e2>] vfs_write+0x8f0/0xc80 + [<0000000078bb39be>] ksys_write+0x106/0x210 + [<00000000005e55a4>] do_syscall_64+0x35/0x80 + [<00000000eaa40bbc>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Fixes: 40e4fe4ce115 ("netdevsim: move device registration and related code to bus.c") +Signed-off-by: Zhengchao Shao +Link: https://lore.kernel.org/r/20221026015405.128795-1-shaozhengchao@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/netdevsim/bus.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/netdevsim/bus.c b/drivers/net/netdevsim/bus.c +index b5f4df1a07a3..0052968e881e 100644 +--- a/drivers/net/netdevsim/bus.c ++++ b/drivers/net/netdevsim/bus.c +@@ -117,6 +117,10 @@ static const struct attribute_group *nsim_bus_dev_attr_groups[] = { + + static void nsim_bus_dev_release(struct device *dev) + { ++ struct nsim_bus_dev *nsim_bus_dev; ++ ++ nsim_bus_dev = container_of(dev, struct nsim_bus_dev, dev); ++ kfree(nsim_bus_dev); + } + + static struct device_type nsim_bus_dev_type = { +@@ -291,6 +295,8 @@ nsim_bus_dev_new(unsigned int id, unsigned int port_count, unsigned int num_queu + + err_nsim_bus_dev_id_free: + ida_free(&nsim_bus_dev_ids, nsim_bus_dev->dev.id); ++ put_device(&nsim_bus_dev->dev); ++ nsim_bus_dev = NULL; + err_nsim_bus_dev_free: + kfree(nsim_bus_dev); + return ERR_PTR(err); +@@ -300,9 +306,8 @@ static void nsim_bus_dev_del(struct nsim_bus_dev *nsim_bus_dev) + { + /* Disallow using nsim_bus_dev */ + smp_store_release(&nsim_bus_dev->init, false); +- device_unregister(&nsim_bus_dev->dev); + ida_free(&nsim_bus_dev_ids, nsim_bus_dev->dev.id); +- kfree(nsim_bus_dev); ++ device_unregister(&nsim_bus_dev->dev); + } + + static struct device_driver nsim_driver = { +-- +2.35.1 + diff --git a/queue-6.0/netdevsim-fix-memory-leak-in-nsim_drv_probe-when-nsi.patch b/queue-6.0/netdevsim-fix-memory-leak-in-nsim_drv_probe-when-nsi.patch new file mode 100644 index 00000000000..470f662acf6 --- /dev/null +++ b/queue-6.0/netdevsim-fix-memory-leak-in-nsim_drv_probe-when-nsi.patch @@ -0,0 +1,121 @@ +From 913c1598f94227e70b9fa2634e61304aec80f11c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 09:46:41 +0800 +Subject: netdevsim: fix memory leak in nsim_drv_probe() when + nsim_dev_resources_register() failed + +From: Zhengchao Shao + +[ Upstream commit 6b1da9f7126f05e857da6db24c6a04aa7974d644 ] + +If some items in nsim_dev_resources_register() fail, memory leak will +occur. The following is the memory leak information. + +unreferenced object 0xffff888074c02600 (size 128): + comm "echo", pid 8159, jiffies 4294945184 (age 493.530s) + hex dump (first 32 bytes): + 40 47 ea 89 ff ff ff ff 01 00 00 00 00 00 00 00 @G.............. + ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ + backtrace: + [<0000000011a31c98>] kmalloc_trace+0x22/0x60 + [<0000000027384c69>] devl_resource_register+0x144/0x4e0 + [<00000000a16db248>] nsim_drv_probe+0x37a/0x1260 + [<000000007d1f448c>] really_probe+0x20b/0xb10 + [<00000000c416848a>] __driver_probe_device+0x1b3/0x4a0 + [<00000000077e0351>] driver_probe_device+0x49/0x140 + [<0000000054f2465a>] __device_attach_driver+0x18c/0x2a0 + [<000000008538f359>] bus_for_each_drv+0x151/0x1d0 + [<0000000038e09747>] __device_attach+0x1c9/0x4e0 + [<00000000dd86e533>] bus_probe_device+0x1d5/0x280 + [<00000000839bea35>] device_add+0xae0/0x1cb0 + [<000000009c2abf46>] new_device_store+0x3b6/0x5f0 + [<00000000fb823d7f>] bus_attr_store+0x72/0xa0 + [<000000007acc4295>] sysfs_kf_write+0x106/0x160 + [<000000005f50cb4d>] kernfs_fop_write_iter+0x3a8/0x5a0 + [<0000000075eb41bf>] vfs_write+0x8f0/0xc80 + +Fixes: 37923ed6b8ce ("netdevsim: Add simple FIB resource controller via devlink") +Signed-off-by: Zhengchao Shao +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/netdevsim/dev.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c +index e88f783c297e..f31af8f0c0d6 100644 +--- a/drivers/net/netdevsim/dev.c ++++ b/drivers/net/netdevsim/dev.c +@@ -442,7 +442,7 @@ static int nsim_dev_resources_register(struct devlink *devlink) + ¶ms); + if (err) { + pr_err("Failed to register IPv4 top resource\n"); +- goto out; ++ goto err_out; + } + + err = devl_resource_register(devlink, "fib", (u64)-1, +@@ -450,7 +450,7 @@ static int nsim_dev_resources_register(struct devlink *devlink) + NSIM_RESOURCE_IPV4, ¶ms); + if (err) { + pr_err("Failed to register IPv4 FIB resource\n"); +- return err; ++ goto err_out; + } + + err = devl_resource_register(devlink, "fib-rules", (u64)-1, +@@ -458,7 +458,7 @@ static int nsim_dev_resources_register(struct devlink *devlink) + NSIM_RESOURCE_IPV4, ¶ms); + if (err) { + pr_err("Failed to register IPv4 FIB rules resource\n"); +- return err; ++ goto err_out; + } + + /* Resources for IPv6 */ +@@ -468,7 +468,7 @@ static int nsim_dev_resources_register(struct devlink *devlink) + ¶ms); + if (err) { + pr_err("Failed to register IPv6 top resource\n"); +- goto out; ++ goto err_out; + } + + err = devl_resource_register(devlink, "fib", (u64)-1, +@@ -476,7 +476,7 @@ static int nsim_dev_resources_register(struct devlink *devlink) + NSIM_RESOURCE_IPV6, ¶ms); + if (err) { + pr_err("Failed to register IPv6 FIB resource\n"); +- return err; ++ goto err_out; + } + + err = devl_resource_register(devlink, "fib-rules", (u64)-1, +@@ -484,7 +484,7 @@ static int nsim_dev_resources_register(struct devlink *devlink) + NSIM_RESOURCE_IPV6, ¶ms); + if (err) { + pr_err("Failed to register IPv6 FIB rules resource\n"); +- return err; ++ goto err_out; + } + + /* Resources for nexthops */ +@@ -492,8 +492,14 @@ static int nsim_dev_resources_register(struct devlink *devlink) + NSIM_RESOURCE_NEXTHOPS, + DEVLINK_RESOURCE_ID_PARENT_TOP, + ¶ms); ++ if (err) { ++ pr_err("Failed to register NEXTHOPS resource\n"); ++ goto err_out; ++ } ++ return 0; + +-out: ++err_out: ++ devl_resources_unregister(devlink); + return err; + } + +-- +2.35.1 + diff --git a/queue-6.0/netdevsim-remove-dir-in-nsim_dev_debugfs_init-when-c.patch b/queue-6.0/netdevsim-remove-dir-in-nsim_dev_debugfs_init-when-c.patch new file mode 100644 index 00000000000..4da807baf33 --- /dev/null +++ b/queue-6.0/netdevsim-remove-dir-in-nsim_dev_debugfs_init-when-c.patch @@ -0,0 +1,63 @@ +From 6c06daddbb6ad9299a60bbad399885060a122a8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 09:46:42 +0800 +Subject: netdevsim: remove dir in nsim_dev_debugfs_init() when creating ports + dir failed + +From: Zhengchao Shao + +[ Upstream commit a6aa8d0ce2cfba57ac0f23293fcb3be0b9f53fba ] + +Remove dir in nsim_dev_debugfs_init() when creating ports dir failed. +Otherwise, the netdevsim device will not be created next time. Kernel +reports an error: debugfs: Directory 'netdevsim1' with parent 'netdevsim' +already present! + +Fixes: ab1d0cc004d7 ("netdevsim: change debugfs tree topology") +Signed-off-by: Zhengchao Shao +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/netdevsim/dev.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c +index f31af8f0c0d6..b17e4e94a060 100644 +--- a/drivers/net/netdevsim/dev.c ++++ b/drivers/net/netdevsim/dev.c +@@ -309,8 +309,10 @@ static int nsim_dev_debugfs_init(struct nsim_dev *nsim_dev) + if (IS_ERR(nsim_dev->ddir)) + return PTR_ERR(nsim_dev->ddir); + nsim_dev->ports_ddir = debugfs_create_dir("ports", nsim_dev->ddir); +- if (IS_ERR(nsim_dev->ports_ddir)) +- return PTR_ERR(nsim_dev->ports_ddir); ++ if (IS_ERR(nsim_dev->ports_ddir)) { ++ err = PTR_ERR(nsim_dev->ports_ddir); ++ goto err_ddir; ++ } + debugfs_create_bool("fw_update_status", 0600, nsim_dev->ddir, + &nsim_dev->fw_update_status); + debugfs_create_u32("fw_update_overwrite_mask", 0600, nsim_dev->ddir, +@@ -346,7 +348,7 @@ static int nsim_dev_debugfs_init(struct nsim_dev *nsim_dev) + nsim_dev->nodes_ddir = debugfs_create_dir("rate_nodes", nsim_dev->ddir); + if (IS_ERR(nsim_dev->nodes_ddir)) { + err = PTR_ERR(nsim_dev->nodes_ddir); +- goto err_out; ++ goto err_ports_ddir; + } + debugfs_create_bool("fail_trap_drop_counter_get", 0600, + nsim_dev->ddir, +@@ -354,8 +356,9 @@ static int nsim_dev_debugfs_init(struct nsim_dev *nsim_dev) + nsim_udp_tunnels_debugfs_create(nsim_dev); + return 0; + +-err_out: ++err_ports_ddir: + debugfs_remove_recursive(nsim_dev->ports_ddir); ++err_ddir: + debugfs_remove_recursive(nsim_dev->ddir); + return err; + } +-- +2.35.1 + diff --git a/queue-6.0/nfc-virtual_ncidev-fix-memory-leak-in-virtual_nci_se.patch b/queue-6.0/nfc-virtual_ncidev-fix-memory-leak-in-virtual_nci_se.patch new file mode 100644 index 00000000000..a3c6192ac1c --- /dev/null +++ b/queue-6.0/nfc-virtual_ncidev-fix-memory-leak-in-virtual_nci_se.patch @@ -0,0 +1,78 @@ +From 244b1c33b6c433113580b5b600668f8069082554 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Oct 2022 11:05:05 +0800 +Subject: nfc: virtual_ncidev: Fix memory leak in virtual_nci_send() + +From: Shang XiaoJing + +[ Upstream commit e840d8f4a1b323973052a1af5ad4edafcde8ae3d ] + +skb should be free in virtual_nci_send(), otherwise kmemleak will report +memleak. + +Steps for reproduction (simulated in qemu): + cd tools/testing/selftests/nci + make + ./nci_dev + +BUG: memory leak +unreferenced object 0xffff888107588000 (size 208): + comm "nci_dev", pid 206, jiffies 4294945376 (age 368.248s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<000000008d94c8fd>] __alloc_skb+0x1da/0x290 + [<00000000278bc7f8>] nci_send_cmd+0xa3/0x350 + [<0000000081256a22>] nci_reset_req+0x6b/0xa0 + [<000000009e721112>] __nci_request+0x90/0x250 + [<000000005d556e59>] nci_dev_up+0x217/0x5b0 + [<00000000e618ce62>] nfc_dev_up+0x114/0x220 + [<00000000981e226b>] nfc_genl_dev_up+0x94/0xe0 + [<000000009bb03517>] genl_family_rcv_msg_doit.isra.14+0x228/0x2d0 + [<00000000b7f8c101>] genl_rcv_msg+0x35c/0x640 + [<00000000c94075ff>] netlink_rcv_skb+0x11e/0x350 + [<00000000440cfb1e>] genl_rcv+0x24/0x40 + [<0000000062593b40>] netlink_unicast+0x43f/0x640 + [<000000001d0b13cc>] netlink_sendmsg+0x73a/0xbf0 + [<000000003272487f>] __sys_sendto+0x324/0x370 + [<00000000ef9f1747>] __x64_sys_sendto+0xdd/0x1b0 + [<000000001e437841>] do_syscall_64+0x3f/0x90 + +Fixes: e624e6c3e777 ("nfc: Add a virtual nci device driver") +Signed-off-by: Shang XiaoJing +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20221020030505.15572-1-shangxiaojing@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/virtual_ncidev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nfc/virtual_ncidev.c b/drivers/nfc/virtual_ncidev.c +index f577449e4935..85c06dbb2c44 100644 +--- a/drivers/nfc/virtual_ncidev.c ++++ b/drivers/nfc/virtual_ncidev.c +@@ -54,16 +54,19 @@ static int virtual_nci_send(struct nci_dev *ndev, struct sk_buff *skb) + mutex_lock(&nci_mutex); + if (state != virtual_ncidev_enabled) { + mutex_unlock(&nci_mutex); ++ kfree_skb(skb); + return 0; + } + + if (send_buff) { + mutex_unlock(&nci_mutex); ++ kfree_skb(skb); + return -1; + } + send_buff = skb_copy(skb, GFP_KERNEL); + mutex_unlock(&nci_mutex); + wake_up_interruptible(&wq); ++ consume_skb(skb); + + return 0; + } +-- +2.35.1 + diff --git a/queue-6.0/nh-fix-scope-used-to-find-saddr-when-adding-non-gw-n.patch b/queue-6.0/nh-fix-scope-used-to-find-saddr-when-adding-non-gw-n.patch new file mode 100644 index 00000000000..e78c1effdd1 --- /dev/null +++ b/queue-6.0/nh-fix-scope-used-to-find-saddr-when-adding-non-gw-n.patch @@ -0,0 +1,42 @@ +From 97ba5b1a959917b06f4e97be94818dab84c74402 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Oct 2022 12:09:52 +0200 +Subject: nh: fix scope used to find saddr when adding non gw nh + +From: Nicolas Dichtel + +[ Upstream commit bac0f937c343d651874f83b265ca8f5070ed4f06 ] + +As explained by Julian, fib_nh_scope is related to fib_nh_gw4, but +fib_info_update_nhc_saddr() needs the scope of the route, which is +the scope "before" fib_nh_scope, ie fib_nh_scope - 1. + +This patch fixes the problem described in commit 747c14307214 ("ip: fix +dflt addr selection for connected nexthop"). + +Fixes: 597cfe4fc339 ("nexthop: Add support for IPv4 nexthops") +Link: https://lore.kernel.org/netdev/6c8a44ba-c2d5-cdf-c5c7-5baf97cba38@ssi.bg/ +Signed-off-by: Nicolas Dichtel +Reviewed-by: Julian Anastasov +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/nexthop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c +index 853a75a8fbaf..d8ef05347fd9 100644 +--- a/net/ipv4/nexthop.c ++++ b/net/ipv4/nexthop.c +@@ -2534,7 +2534,7 @@ static int nh_create_ipv4(struct net *net, struct nexthop *nh, + if (!err) { + nh->nh_flags = fib_nh->fib_nh_flags; + fib_info_update_nhc_saddr(net, &fib_nh->nh_common, +- fib_nh->fib_nh_scope); ++ !fib_nh->fib_nh_scope ? 0 : fib_nh->fib_nh_scope - 1); + } else { + fib_nh_release(net, fib_nh); + } +-- +2.35.1 + diff --git a/queue-6.0/openvswitch-switch-from-warn-to-pr_warn.patch b/queue-6.0/openvswitch-switch-from-warn-to-pr_warn.patch new file mode 100644 index 00000000000..a0fca51d8e0 --- /dev/null +++ b/queue-6.0/openvswitch-switch-from-warn-to-pr_warn.patch @@ -0,0 +1,42 @@ +From 2782da6162769d40b0b825c8e07b135b117d4073 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Oct 2022 06:50:17 -0400 +Subject: openvswitch: switch from WARN to pr_warn + +From: Aaron Conole + +[ Upstream commit fd954cc1919e35cb92f78671cab6e42d661945a3 ] + +As noted by Paolo Abeni, pr_warn doesn't generate any splat and can still +preserve the warning to the user that feature downgrade occurred. We +likely cannot introduce other kinds of checks / enforcement here because +syzbot can generate different genl versions to the datapath. + +Reported-by: syzbot+31cde0bef4bbf8ba2d86@syzkaller.appspotmail.com +Fixes: 44da5ae5fbea ("openvswitch: Drop user features if old user space attempted to create datapath") +Cc: Thomas Graf +Signed-off-by: Aaron Conole +Acked-by: Ilya Maximets +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/openvswitch/datapath.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c +index 93c596e3b22b..8a22574ed7ad 100644 +--- a/net/openvswitch/datapath.c ++++ b/net/openvswitch/datapath.c +@@ -1606,7 +1606,8 @@ static void ovs_dp_reset_user_features(struct sk_buff *skb, + if (IS_ERR(dp)) + return; + +- WARN(dp->user_features, "Dropping previously announced user features\n"); ++ pr_warn("%s: Dropping previously announced user features\n", ++ ovs_dp_name(dp)); + dp->user_features = 0; + } + +-- +2.35.1 + diff --git a/queue-6.0/perf-fix-missing-sigtraps.patch b/queue-6.0/perf-fix-missing-sigtraps.patch new file mode 100644 index 00000000000..fc97f64fcf8 --- /dev/null +++ b/queue-6.0/perf-fix-missing-sigtraps.patch @@ -0,0 +1,450 @@ +From 4ab49159b276a5d7e6e68f1d0ed4503ddd771732 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Oct 2022 15:00:39 +0200 +Subject: perf: Fix missing SIGTRAPs + +From: Peter Zijlstra + +[ Upstream commit ca6c21327c6af02b7eec31ce4b9a740a18c6c13f ] + +Marco reported: + +Due to the implementation of how SIGTRAP are delivered if +perf_event_attr::sigtrap is set, we've noticed 3 issues: + + 1. Missing SIGTRAP due to a race with event_sched_out() (more + details below). + + 2. Hardware PMU events being disabled due to returning 1 from + perf_event_overflow(). The only way to re-enable the event is + for user space to first "properly" disable the event and then + re-enable it. + + 3. The inability to automatically disable an event after a + specified number of overflows via PERF_EVENT_IOC_REFRESH. + +The worst of the 3 issues is problem (1), which occurs when a +pending_disable is "consumed" by a racing event_sched_out(), observed +as follows: + + CPU0 | CPU1 + --------------------------------+--------------------------- + __perf_event_overflow() | + perf_event_disable_inatomic() | + pending_disable = CPU0 | ... + | _perf_event_enable() + | event_function_call() + | task_function_call() + | /* sends IPI to CPU0 */ + | ... + __perf_event_enable() +--------------------------- + ctx_resched() + task_ctx_sched_out() + ctx_sched_out() + group_sched_out() + event_sched_out() + pending_disable = -1 + + + perf_pending_event() + perf_pending_event_disable() + /* Fails to send SIGTRAP because no pending_disable! */ + + +In the above case, not only is that particular SIGTRAP missed, but also +all future SIGTRAPs because 'event_limit' is not reset back to 1. + +To fix, rework pending delivery of SIGTRAP via IRQ-work by introduction +of a separate 'pending_sigtrap', no longer using 'event_limit' and +'pending_disable' for its delivery. + +Additionally; and different to Marco's proposed patch: + + - recognise that pending_disable effectively duplicates oncpu for + the case where it is set. As such, change the irq_work handler to + use ->oncpu to target the event and use pending_* as boolean toggles. + + - observe that SIGTRAP targets the ctx->task, so the context switch + optimization that carries contexts between tasks is invalid. If + the irq_work were delayed enough to hit after a context switch the + SIGTRAP would be delivered to the wrong task. + + - observe that if the event gets scheduled out + (rotation/migration/context-switch/...) the irq-work would be + insufficient to deliver the SIGTRAP when the event gets scheduled + back in (the irq-work might still be pending on the old CPU). + + Therefore have event_sched_out() convert the pending sigtrap into a + task_work which will deliver the signal at return_to_user. + +Fixes: 97ba62b27867 ("perf: Add support for SIGTRAP on perf events") +Reported-by: Dmitry Vyukov +Debugged-by: Dmitry Vyukov +Reported-by: Marco Elver +Debugged-by: Marco Elver +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Marco Elver +Tested-by: Marco Elver +Signed-off-by: Sasha Levin +--- + include/linux/perf_event.h | 19 ++++- + kernel/events/core.c | 151 +++++++++++++++++++++++++++--------- + kernel/events/ring_buffer.c | 2 +- + 3 files changed, 129 insertions(+), 43 deletions(-) + +diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h +index ee8b9ecdc03b..00df83258447 100644 +--- a/include/linux/perf_event.h ++++ b/include/linux/perf_event.h +@@ -736,11 +736,14 @@ struct perf_event { + struct fasync_struct *fasync; + + /* delayed work for NMIs and such */ +- int pending_wakeup; +- int pending_kill; +- int pending_disable; ++ unsigned int pending_wakeup; ++ unsigned int pending_kill; ++ unsigned int pending_disable; ++ unsigned int pending_sigtrap; + unsigned long pending_addr; /* SIGTRAP */ +- struct irq_work pending; ++ struct irq_work pending_irq; ++ struct callback_head pending_task; ++ unsigned int pending_work; + + atomic_t event_limit; + +@@ -857,6 +860,14 @@ struct perf_event_context { + #endif + void *task_ctx_data; /* pmu specific data */ + struct rcu_head rcu_head; ++ ++ /* ++ * Sum (event->pending_sigtrap + event->pending_work) ++ * ++ * The SIGTRAP is targeted at ctx->task, as such it won't do changing ++ * that until the signal is delivered. ++ */ ++ local_t nr_pending; + }; + + /* +diff --git a/kernel/events/core.c b/kernel/events/core.c +index ff4bffc502c6..072ab26269c0 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -54,6 +54,7 @@ + #include + #include + #include ++#include + + #include "internal.h" + +@@ -2268,11 +2269,26 @@ event_sched_out(struct perf_event *event, + event->pmu->del(event, 0); + event->oncpu = -1; + +- if (READ_ONCE(event->pending_disable) >= 0) { +- WRITE_ONCE(event->pending_disable, -1); ++ if (event->pending_disable) { ++ event->pending_disable = 0; + perf_cgroup_event_disable(event, ctx); + state = PERF_EVENT_STATE_OFF; + } ++ ++ if (event->pending_sigtrap) { ++ bool dec = true; ++ ++ event->pending_sigtrap = 0; ++ if (state != PERF_EVENT_STATE_OFF && ++ !event->pending_work) { ++ event->pending_work = 1; ++ dec = false; ++ task_work_add(current, &event->pending_task, TWA_RESUME); ++ } ++ if (dec) ++ local_dec(&event->ctx->nr_pending); ++ } ++ + perf_event_set_state(event, state); + + if (!is_software_event(event)) +@@ -2424,7 +2440,7 @@ static void __perf_event_disable(struct perf_event *event, + * hold the top-level event's child_mutex, so any descendant that + * goes to exit will block in perf_event_exit_event(). + * +- * When called from perf_pending_event it's OK because event->ctx ++ * When called from perf_pending_irq it's OK because event->ctx + * is the current context on this CPU and preemption is disabled, + * hence we can't get into perf_event_task_sched_out for this context. + */ +@@ -2463,9 +2479,8 @@ EXPORT_SYMBOL_GPL(perf_event_disable); + + void perf_event_disable_inatomic(struct perf_event *event) + { +- WRITE_ONCE(event->pending_disable, smp_processor_id()); +- /* can fail, see perf_pending_event_disable() */ +- irq_work_queue(&event->pending); ++ event->pending_disable = 1; ++ irq_work_queue(&event->pending_irq); + } + + #define MAX_INTERRUPTS (~0ULL) +@@ -3420,11 +3435,23 @@ static void perf_event_context_sched_out(struct task_struct *task, int ctxn, + raw_spin_lock_nested(&next_ctx->lock, SINGLE_DEPTH_NESTING); + if (context_equiv(ctx, next_ctx)) { + ++ perf_pmu_disable(pmu); ++ ++ /* PMIs are disabled; ctx->nr_pending is stable. */ ++ if (local_read(&ctx->nr_pending) || ++ local_read(&next_ctx->nr_pending)) { ++ /* ++ * Must not swap out ctx when there's pending ++ * events that rely on the ctx->task relation. ++ */ ++ raw_spin_unlock(&next_ctx->lock); ++ rcu_read_unlock(); ++ goto inside_switch; ++ } ++ + WRITE_ONCE(ctx->task, next); + WRITE_ONCE(next_ctx->task, task); + +- perf_pmu_disable(pmu); +- + if (cpuctx->sched_cb_usage && pmu->sched_task) + pmu->sched_task(ctx, false); + +@@ -3465,6 +3492,7 @@ static void perf_event_context_sched_out(struct task_struct *task, int ctxn, + raw_spin_lock(&ctx->lock); + perf_pmu_disable(pmu); + ++inside_switch: + if (cpuctx->sched_cb_usage && pmu->sched_task) + pmu->sched_task(ctx, false); + task_ctx_sched_out(cpuctx, ctx, EVENT_ALL); +@@ -4931,7 +4959,7 @@ static void perf_addr_filters_splice(struct perf_event *event, + + static void _free_event(struct perf_event *event) + { +- irq_work_sync(&event->pending); ++ irq_work_sync(&event->pending_irq); + + unaccount_event(event); + +@@ -6431,7 +6459,8 @@ static void perf_sigtrap(struct perf_event *event) + return; + + /* +- * perf_pending_event() can race with the task exiting. ++ * Both perf_pending_task() and perf_pending_irq() can race with the ++ * task exiting. + */ + if (current->flags & PF_EXITING) + return; +@@ -6440,23 +6469,33 @@ static void perf_sigtrap(struct perf_event *event) + event->attr.type, event->attr.sig_data); + } + +-static void perf_pending_event_disable(struct perf_event *event) ++/* ++ * Deliver the pending work in-event-context or follow the context. ++ */ ++static void __perf_pending_irq(struct perf_event *event) + { +- int cpu = READ_ONCE(event->pending_disable); ++ int cpu = READ_ONCE(event->oncpu); + ++ /* ++ * If the event isn't running; we done. event_sched_out() will have ++ * taken care of things. ++ */ + if (cpu < 0) + return; + ++ /* ++ * Yay, we hit home and are in the context of the event. ++ */ + if (cpu == smp_processor_id()) { +- WRITE_ONCE(event->pending_disable, -1); +- +- if (event->attr.sigtrap) { ++ if (event->pending_sigtrap) { ++ event->pending_sigtrap = 0; + perf_sigtrap(event); +- atomic_set_release(&event->event_limit, 1); /* rearm event */ +- return; ++ local_dec(&event->ctx->nr_pending); ++ } ++ if (event->pending_disable) { ++ event->pending_disable = 0; ++ perf_event_disable_local(event); + } +- +- perf_event_disable_local(event); + return; + } + +@@ -6476,35 +6515,62 @@ static void perf_pending_event_disable(struct perf_event *event) + * irq_work_queue(); // FAILS + * + * irq_work_run() +- * perf_pending_event() ++ * perf_pending_irq() + * + * But the event runs on CPU-B and wants disabling there. + */ +- irq_work_queue_on(&event->pending, cpu); ++ irq_work_queue_on(&event->pending_irq, cpu); + } + +-static void perf_pending_event(struct irq_work *entry) ++static void perf_pending_irq(struct irq_work *entry) + { +- struct perf_event *event = container_of(entry, struct perf_event, pending); ++ struct perf_event *event = container_of(entry, struct perf_event, pending_irq); + int rctx; + +- rctx = perf_swevent_get_recursion_context(); + /* + * If we 'fail' here, that's OK, it means recursion is already disabled + * and we won't recurse 'further'. + */ ++ rctx = perf_swevent_get_recursion_context(); + +- perf_pending_event_disable(event); +- ++ /* ++ * The wakeup isn't bound to the context of the event -- it can happen ++ * irrespective of where the event is. ++ */ + if (event->pending_wakeup) { + event->pending_wakeup = 0; + perf_event_wakeup(event); + } + ++ __perf_pending_irq(event); ++ + if (rctx >= 0) + perf_swevent_put_recursion_context(rctx); + } + ++static void perf_pending_task(struct callback_head *head) ++{ ++ struct perf_event *event = container_of(head, struct perf_event, pending_task); ++ int rctx; ++ ++ /* ++ * If we 'fail' here, that's OK, it means recursion is already disabled ++ * and we won't recurse 'further'. ++ */ ++ preempt_disable_notrace(); ++ rctx = perf_swevent_get_recursion_context(); ++ ++ if (event->pending_work) { ++ event->pending_work = 0; ++ perf_sigtrap(event); ++ local_dec(&event->ctx->nr_pending); ++ } ++ ++ if (rctx >= 0) ++ perf_swevent_put_recursion_context(rctx); ++ preempt_enable_notrace(); ++} ++ + #ifdef CONFIG_GUEST_PERF_EVENTS + struct perf_guest_info_callbacks __rcu *perf_guest_cbs; + +@@ -9188,8 +9254,8 @@ int perf_event_account_interrupt(struct perf_event *event) + */ + + static int __perf_event_overflow(struct perf_event *event, +- int throttle, struct perf_sample_data *data, +- struct pt_regs *regs) ++ int throttle, struct perf_sample_data *data, ++ struct pt_regs *regs) + { + int events = atomic_read(&event->event_limit); + int ret = 0; +@@ -9212,24 +9278,36 @@ static int __perf_event_overflow(struct perf_event *event, + if (events && atomic_dec_and_test(&event->event_limit)) { + ret = 1; + event->pending_kill = POLL_HUP; +- event->pending_addr = data->addr; +- + perf_event_disable_inatomic(event); + } + ++ if (event->attr.sigtrap) { ++ /* ++ * Should not be able to return to user space without processing ++ * pending_sigtrap (kernel events can overflow multiple times). ++ */ ++ WARN_ON_ONCE(event->pending_sigtrap && event->attr.exclude_kernel); ++ if (!event->pending_sigtrap) { ++ event->pending_sigtrap = 1; ++ local_inc(&event->ctx->nr_pending); ++ } ++ event->pending_addr = data->addr; ++ irq_work_queue(&event->pending_irq); ++ } ++ + READ_ONCE(event->overflow_handler)(event, data, regs); + + if (*perf_event_fasync(event) && event->pending_kill) { + event->pending_wakeup = 1; +- irq_work_queue(&event->pending); ++ irq_work_queue(&event->pending_irq); + } + + return ret; + } + + int perf_event_overflow(struct perf_event *event, +- struct perf_sample_data *data, +- struct pt_regs *regs) ++ struct perf_sample_data *data, ++ struct pt_regs *regs) + { + return __perf_event_overflow(event, 1, data, regs); + } +@@ -11537,8 +11615,8 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, + + + init_waitqueue_head(&event->waitq); +- event->pending_disable = -1; +- init_irq_work(&event->pending, perf_pending_event); ++ init_irq_work(&event->pending_irq, perf_pending_irq); ++ init_task_work(&event->pending_task, perf_pending_task); + + mutex_init(&event->mmap_mutex); + raw_spin_lock_init(&event->addr_filters.lock); +@@ -11560,9 +11638,6 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, + if (parent_event) + event->event_caps = parent_event->event_caps; + +- if (event->attr.sigtrap) +- atomic_set(&event->event_limit, 1); +- + if (task) { + event->attach_state = PERF_ATTACH_TASK; + /* +diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c +index 726132039c38..273a0fe7910a 100644 +--- a/kernel/events/ring_buffer.c ++++ b/kernel/events/ring_buffer.c +@@ -22,7 +22,7 @@ static void perf_output_wakeup(struct perf_output_handle *handle) + atomic_set(&handle->rb->poll, EPOLLIN); + + handle->event->pending_wakeup = 1; +- irq_work_queue(&handle->event->pending); ++ irq_work_queue(&handle->event->pending_irq); + } + + /* +-- +2.35.1 + diff --git a/queue-6.0/perf-list-fix-pmu-name-pai_crypto-in-perf-list-on-s3.patch b/queue-6.0/perf-list-fix-pmu-name-pai_crypto-in-perf-list-on-s3.patch new file mode 100644 index 00000000000..fc185d8c7b3 --- /dev/null +++ b/queue-6.0/perf-list-fix-pmu-name-pai_crypto-in-perf-list-on-s3.patch @@ -0,0 +1,59 @@ +From 1bcf317b1ce486c54de70f379c3c1e350b8d3d14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Oct 2022 10:25:57 +0200 +Subject: perf list: Fix PMU name pai_crypto in perf list on s390 + +From: Thomas Richter + +[ Upstream commit 5a6c184a72a375072cffe788d93ad6052c48f16b ] + +Commit e0b23af82d6f454c ("perf list: Add PMU pai_crypto event +description for IBM z16") introduced the "Processor Activity +Instrumentation" for cryptographic counters for z16. The PMU device +driver exports the counters via sysfs files listed in directory +/sys/devices/pai_crypto. + +To specify an event from that PMU, use 'perf stat -e pai_crypto/XXX/'. + +However the JSON file mentioned in above commit exports the counter +decriptions in file pmu-events/arch/s390/cf_z16/pai.json. Rename this +file to pmu-events/arch/s390/cf_z16/pai_crypto.json to make the naming +consistent. + +Now 'perf list' shows the counter names under pai_crypto section: + + pai_crypto: + + CRYPTO_ALL + [CRYPTO ALL. Unit: pai_crypto] + ... + +Output before was + + pai: + CRYPTO_ALL + [CRYPTO ALL. Unit: pai_crypto] + ... + +Fixes: e0b23af82d6f454c ("perf list: Add PMU pai_crypto event description for IBM z16") +Signed-off-by: Thomas Richter +Acked-by: Sumanth Korikkar +Cc: Heiko Carstens +Cc: Sven Schnelle +Cc: Thomas Richter +Cc: Vasily Gorbik +Link: https://lore.kernel.org/r/20221021082557.2695382-1-tmricht@linux.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + .../pmu-events/arch/s390/cf_z16/{pai.json => pai_crypto.json} | 0 + 1 file changed, 0 insertions(+), 0 deletions(-) + rename tools/perf/pmu-events/arch/s390/cf_z16/{pai.json => pai_crypto.json} (100%) + +diff --git a/tools/perf/pmu-events/arch/s390/cf_z16/pai.json b/tools/perf/pmu-events/arch/s390/cf_z16/pai_crypto.json +similarity index 100% +rename from tools/perf/pmu-events/arch/s390/cf_z16/pai.json +rename to tools/perf/pmu-events/arch/s390/cf_z16/pai_crypto.json +-- +2.35.1 + diff --git a/queue-6.0/perf-vendor-events-arm64-fix-incorrect-hisi-hip08-l3.patch b/queue-6.0/perf-vendor-events-arm64-fix-incorrect-hisi-hip08-l3.patch new file mode 100644 index 00000000000..d1db6cd786d --- /dev/null +++ b/queue-6.0/perf-vendor-events-arm64-fix-incorrect-hisi-hip08-l3.patch @@ -0,0 +1,84 @@ +From 6b7fca0b8a5617db196abfd9caa4cb0ee595c55c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Oct 2022 18:50:33 +0800 +Subject: perf vendor events arm64: Fix incorrect Hisi hip08 L3 metrics + +From: Shang XiaoJing + +[ Upstream commit e9229d5b6254a75291536f582652c599957344d2 ] + +Commit 0cc177cfc95d565e ("perf vendor events arm64: Add Hisi hip08 L3 +metrics") add L3 metrics of hip08, but some metrics (IF_BP_MISP_BR_RET, +IF_BP_MISP_BR_RET, IF_BP_MISP_BR_BL) have incorrect event number due to +the mistakes in document, which caused incorrect result. Fix the +incorrect metrics. + +Before: + + 65,811,214,308 armv8_pmuv3_0/event=0x1014/ # 18.87 push_branch + # -40.19 other_branch + 3,564,316,780 BR_MIS_PRED # 0.51 indirect_branch + # 21.81 pop_branch + +After: + + 6,537,146,245 BR_MIS_PRED # 0.48 indirect_branch + # 0.47 pop_branch + # 0.00 push_branch + # 0.05 other_branch + +Fixes: 0cc177cfc95d565e ("perf vendor events arm64: Add Hisi hip08 L3 metrics") +Reviewed-by: John Garry +Signed-off-by: Shang XiaoJing +Acked-by: James Clark +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: John Garry +Cc: Kajol Jain +Cc: Leo Yan +Cc: linux-arm-kernel@lists.infradead.org +Cc: Mark Rutland +Cc: Mike Leach +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Will Deacon +Link: https://lore.kernel.org/r/20221021105035.10000-2-shangxiaojing@huawei.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + .../perf/pmu-events/arch/arm64/hisilicon/hip08/metrics.json | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/metrics.json b/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/metrics.json +index 6970203cb247..6443a061e22a 100644 +--- a/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/metrics.json ++++ b/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/metrics.json +@@ -112,21 +112,21 @@ + "MetricName": "indirect_branch" + }, + { +- "MetricExpr": "(armv8_pmuv3_0@event\\=0x1014@ + armv8_pmuv3_0@event\\=0x1018@) / BR_MIS_PRED", ++ "MetricExpr": "(armv8_pmuv3_0@event\\=0x1013@ + armv8_pmuv3_0@event\\=0x1016@) / BR_MIS_PRED", + "PublicDescription": "Push branch L3 topdown metric", + "BriefDescription": "Push branch L3 topdown metric", + "MetricGroup": "TopDownL3", + "MetricName": "push_branch" + }, + { +- "MetricExpr": "armv8_pmuv3_0@event\\=0x100c@ / BR_MIS_PRED", ++ "MetricExpr": "armv8_pmuv3_0@event\\=0x100d@ / BR_MIS_PRED", + "PublicDescription": "Pop branch L3 topdown metric", + "BriefDescription": "Pop branch L3 topdown metric", + "MetricGroup": "TopDownL3", + "MetricName": "pop_branch" + }, + { +- "MetricExpr": "(BR_MIS_PRED - armv8_pmuv3_0@event\\=0x1010@ - armv8_pmuv3_0@event\\=0x1014@ - armv8_pmuv3_0@event\\=0x1018@ - armv8_pmuv3_0@event\\=0x100c@) / BR_MIS_PRED", ++ "MetricExpr": "(BR_MIS_PRED - armv8_pmuv3_0@event\\=0x1010@ - armv8_pmuv3_0@event\\=0x1013@ - armv8_pmuv3_0@event\\=0x1016@ - armv8_pmuv3_0@event\\=0x100d@) / BR_MIS_PRED", + "PublicDescription": "Other branch L3 topdown metric", + "BriefDescription": "Other branch L3 topdown metric", + "MetricGroup": "TopDownL3", +-- +2.35.1 + diff --git a/queue-6.0/perf-vendor-events-power10-fix-hv-24x7-metric-events.patch b/queue-6.0/perf-vendor-events-power10-fix-hv-24x7-metric-events.patch new file mode 100644 index 00000000000..36fc22f8545 --- /dev/null +++ b/queue-6.0/perf-vendor-events-power10-fix-hv-24x7-metric-events.patch @@ -0,0 +1,313 @@ +From 6a15a7ca058295c18a4d1bd7014b1bc09145ae74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Oct 2022 19:32:20 +0530 +Subject: perf vendor events power10: Fix hv-24x7 metric events + +From: Kajol Jain + +[ Upstream commit b92dd11725a7c57f55e148c7d3ce58a86f480575 ] + +Testcase stat_all_metrics.sh fails in powerpc: + + 90: perf all metrics test : FAILED! + +The testcase "stat_all_metrics.sh" verifies perf stat result for all the +metric events present in perf list. It runs perf metric events with +various commands and expects non-empty metric result. + +Incase of powerpc:hv-24x7 events, some of the event count can be 0 based +on system configuration. And if that event used as denominator in divide +equation, it can cause divide by 0 error. The current nest_metric.json +file creating divide by 0 issue for some of the metric events, which +results in failure of the "stat_all_metrics.sh" test case. + +Most of the metrics events have cycles or an event which expect to have +a larger value as denominator, so adding 1 to the denominator of the +metric expression as a fix. + +Result in powerpc box after this patch changes: + + 90: perf all metrics test : Ok + +Fixes: a3cbcadfdfc330c2 ("perf vendor events power10: Adds 24x7 nest metric events for power10 platform") +Signed-off-by: Kajol Jain +Reviewed-by: Madhavan Srinivasan +Cc: Athira Jajeev +Cc: Disha Goel +Cc: Jiri Olsa +Cc: Kajol Jain +Cc: linuxppc-dev@lists.ozlabs.org +Cc: Michael Ellerman +Cc: Nageswara R Sastry +Link: https://lore.kernel.org/r/20221014140220.122251-1-kjain@linux.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + .../arch/powerpc/power10/nest_metrics.json | 72 +++++++++---------- + 1 file changed, 36 insertions(+), 36 deletions(-) + +diff --git a/tools/perf/pmu-events/arch/powerpc/power10/nest_metrics.json b/tools/perf/pmu-events/arch/powerpc/power10/nest_metrics.json +index 8ba3e81c9808..fe050d44374b 100644 +--- a/tools/perf/pmu-events/arch/powerpc/power10/nest_metrics.json ++++ b/tools/perf/pmu-events/arch/powerpc/power10/nest_metrics.json +@@ -1,13 +1,13 @@ + [ + { + "MetricName": "VEC_GROUP_PUMP_RETRY_RATIO_P01", +- "MetricExpr": "(hv_24x7@PM_PB_RTY_VG_PUMP01\\,chip\\=?@ / hv_24x7@PM_PB_VG_PUMP01\\,chip\\=?@) * 100", ++ "MetricExpr": "(hv_24x7@PM_PB_RTY_VG_PUMP01\\,chip\\=?@ / (1 + hv_24x7@PM_PB_VG_PUMP01\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "VEC_GROUP_PUMP_RETRY_RATIO_P23", +- "MetricExpr": "(hv_24x7@PM_PB_RTY_VG_PUMP23\\,chip\\=?@ / hv_24x7@PM_PB_VG_PUMP23\\,chip\\=?@) * 100", ++ "MetricExpr": "(hv_24x7@PM_PB_RTY_VG_PUMP23\\,chip\\=?@ / (1 + hv_24x7@PM_PB_VG_PUMP23\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, +@@ -61,13 +61,13 @@ + }, + { + "MetricName": "REMOTE_NODE_PUMPS_RETRIES_RATIO_P01", +- "MetricExpr": "(hv_24x7@PM_PB_RTY_RNS_PUMP01\\,chip\\=?@ / hv_24x7@PM_PB_RNS_PUMP01\\,chip\\=?@) * 100", ++ "MetricExpr": "(hv_24x7@PM_PB_RTY_RNS_PUMP01\\,chip\\=?@ / (1 + hv_24x7@PM_PB_RNS_PUMP01\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "REMOTE_NODE_PUMPS_RETRIES_RATIO_P23", +- "MetricExpr": "(hv_24x7@PM_PB_RTY_RNS_PUMP23\\,chip\\=?@ / hv_24x7@PM_PB_RNS_PUMP23\\,chip\\=?@) * 100", ++ "MetricExpr": "(hv_24x7@PM_PB_RTY_RNS_PUMP23\\,chip\\=?@ / (1 + hv_24x7@PM_PB_RNS_PUMP23\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, +@@ -151,193 +151,193 @@ + }, + { + "MetricName": "XLINK0_OUT_TOTAL_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_XLINK0_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_XLINK0_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (hv_24x7@PM_XLINK0_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK0_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_XLINK0_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_XLINK0_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (1 + hv_24x7@PM_XLINK0_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK0_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "XLINK1_OUT_TOTAL_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_XLINK1_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_XLINK1_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (hv_24x7@PM_XLINK1_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK1_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_XLINK1_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_XLINK1_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (1 + hv_24x7@PM_XLINK1_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK1_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "XLINK2_OUT_TOTAL_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_XLINK2_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_XLINK2_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (hv_24x7@PM_XLINK2_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK2_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_XLINK2_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_XLINK2_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (1 + hv_24x7@PM_XLINK2_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK2_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "XLINK3_OUT_TOTAL_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_XLINK3_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_XLINK3_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (hv_24x7@PM_XLINK3_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK3_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_XLINK3_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_XLINK3_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (1 + hv_24x7@PM_XLINK3_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK3_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "XLINK4_OUT_TOTAL_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_XLINK4_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_XLINK4_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (hv_24x7@PM_XLINK4_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK4_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_XLINK4_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_XLINK4_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (1 + hv_24x7@PM_XLINK4_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK4_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "XLINK5_OUT_TOTAL_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_XLINK5_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_XLINK5_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (hv_24x7@PM_XLINK5_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK5_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_XLINK5_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_XLINK5_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (1 + hv_24x7@PM_XLINK5_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK5_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "XLINK6_OUT_TOTAL_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_XLINK6_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_XLINK6_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (hv_24x7@PM_XLINK6_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK6_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_XLINK6_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_XLINK6_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (1 + hv_24x7@PM_XLINK6_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK6_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "XLINK7_OUT_TOTAL_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_XLINK7_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_XLINK7_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (hv_24x7@PM_XLINK7_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK7_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_XLINK7_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_XLINK7_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (1 + hv_24x7@PM_XLINK7_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK7_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "XLINK0_OUT_DATA_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_XLINK0_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_XLINK0_OUT_EVEN_DATA\\,chip\\=?@) / (hv_24x7@PM_XLINK0_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK0_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_XLINK0_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_XLINK0_OUT_EVEN_DATA\\,chip\\=?@) / (1 + hv_24x7@PM_XLINK0_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK0_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1.063%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "XLINK1_OUT_DATA_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_XLINK1_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_XLINK1_OUT_EVEN_DATA\\,chip\\=?@) / (hv_24x7@PM_XLINK1_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK1_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_XLINK1_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_XLINK1_OUT_EVEN_DATA\\,chip\\=?@) / (1 + hv_24x7@PM_XLINK1_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK1_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1.063%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "XLINK2_OUT_DATA_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_XLINK2_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_XLINK2_OUT_EVEN_DATA\\,chip\\=?@) / (hv_24x7@PM_XLINK2_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK2_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_XLINK2_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_XLINK2_OUT_EVEN_DATA\\,chip\\=?@) / (1 + hv_24x7@PM_XLINK2_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK2_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1.063%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "XLINK3_OUT_DATA_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_XLINK3_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_XLINK3_OUT_EVEN_DATA\\,chip\\=?@) / (hv_24x7@PM_XLINK3_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK3_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_XLINK3_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_XLINK3_OUT_EVEN_DATA\\,chip\\=?@) / (1 + hv_24x7@PM_XLINK3_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK3_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1.063%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "XLINK4_OUT_DATA_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_XLINK4_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_XLINK4_OUT_EVEN_DATA\\,chip\\=?@) / (hv_24x7@PM_XLINK4_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK4_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_XLINK4_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_XLINK4_OUT_EVEN_DATA\\,chip\\=?@) / (1 + hv_24x7@PM_XLINK4_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK4_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1.063%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "XLINK5_OUT_DATA_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_XLINK5_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_XLINK5_OUT_EVEN_DATA\\,chip\\=?@) / (hv_24x7@PM_XLINK5_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK5_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_XLINK5_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_XLINK5_OUT_EVEN_DATA\\,chip\\=?@) / (1 + hv_24x7@PM_XLINK5_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK5_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1.063%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "XLINK6_OUT_DATA_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_XLINK6_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_XLINK6_OUT_EVEN_DATA\\,chip\\=?@) / (hv_24x7@PM_XLINK6_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK6_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_XLINK6_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_XLINK6_OUT_EVEN_DATA\\,chip\\=?@) / (1 + hv_24x7@PM_XLINK6_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK6_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1.063%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "XLINK7_OUT_DATA_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_XLINK7_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_XLINK7_OUT_EVEN_DATA\\,chip\\=?@) / (hv_24x7@PM_XLINK7_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK7_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_XLINK7_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_XLINK7_OUT_EVEN_DATA\\,chip\\=?@) / (1 + hv_24x7@PM_XLINK7_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_XLINK7_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1.063%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "ALINK0_OUT_TOTAL_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_ALINK0_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_ALINK0_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (hv_24x7@PM_ALINK0_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK0_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_ALINK0_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_ALINK0_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (1 + hv_24x7@PM_ALINK0_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK0_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "ALINK1_OUT_TOTAL_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_ALINK1_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_ALINK1_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (hv_24x7@PM_ALINK1_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK1_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_ALINK1_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_ALINK1_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (1 + hv_24x7@PM_ALINK1_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK1_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "ALINK2_OUT_TOTAL_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_ALINK2_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_ALINK2_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (hv_24x7@PM_ALINK2_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK2_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_ALINK2_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_ALINK2_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (1 + hv_24x7@PM_ALINK2_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK2_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "ALINK3_OUT_TOTAL_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_ALINK3_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_ALINK3_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (hv_24x7@PM_ALINK3_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK3_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_ALINK3_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_ALINK3_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (1 + hv_24x7@PM_ALINK3_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK3_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "ALINK4_OUT_TOTAL_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_ALINK4_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_ALINK4_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (hv_24x7@PM_ALINK4_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK4_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_ALINK4_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_ALINK4_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (1 + hv_24x7@PM_ALINK4_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK4_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "ALINK5_OUT_TOTAL_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_ALINK5_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_ALINK5_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (hv_24x7@PM_ALINK5_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK5_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_ALINK5_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_ALINK5_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (1 + hv_24x7@PM_ALINK5_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK5_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "ALINK6_OUT_TOTAL_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_ALINK6_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_ALINK6_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (hv_24x7@PM_ALINK6_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK6_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_ALINK6_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_ALINK6_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (1 + hv_24x7@PM_ALINK6_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK6_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "ALINK7_OUT_TOTAL_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_ALINK7_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_ALINK7_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (hv_24x7@PM_ALINK7_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK7_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_ALINK7_OUT_ODD_TOTAL_UTIL\\,chip\\=?@ + hv_24x7@PM_ALINK7_OUT_EVEN_TOTAL_UTIL\\,chip\\=?@) / (1 + hv_24x7@PM_ALINK7_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK7_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "ALINK0_OUT_DATA_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_ALINK0_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_ALINK0_OUT_EVEN_DATA\\,chip\\=?@) / (hv_24x7@PM_ALINK0_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK0_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_ALINK0_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_ALINK0_OUT_EVEN_DATA\\,chip\\=?@) / (1 + hv_24x7@PM_ALINK0_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK0_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1.063%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "ALINK1_OUT_DATA_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_ALINK1_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_ALINK1_OUT_EVEN_DATA\\,chip\\=?@) / (hv_24x7@PM_ALINK1_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK1_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_ALINK1_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_ALINK1_OUT_EVEN_DATA\\,chip\\=?@) / (1 + hv_24x7@PM_ALINK1_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK1_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1.063%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "ALINK2_OUT_DATA_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_ALINK2_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_ALINK2_OUT_EVEN_DATA\\,chip\\=?@) / (hv_24x7@PM_ALINK2_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK2_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_ALINK2_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_ALINK2_OUT_EVEN_DATA\\,chip\\=?@) / (1 + hv_24x7@PM_ALINK2_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK2_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1.063%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "ALINK3_OUT_DATA_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_ALINK3_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_ALINK3_OUT_EVEN_DATA\\,chip\\=?@) / (hv_24x7@PM_ALINK3_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK3_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_ALINK3_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_ALINK3_OUT_EVEN_DATA\\,chip\\=?@) / (1 + hv_24x7@PM_ALINK3_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK3_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1.063%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "ALINK4_OUT_DATA_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_ALINK4_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_ALINK4_OUT_EVEN_DATA\\,chip\\=?@) / (hv_24x7@PM_ALINK4_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK4_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_ALINK4_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_ALINK4_OUT_EVEN_DATA\\,chip\\=?@) / (1 + hv_24x7@PM_ALINK4_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK4_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1.063%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "ALINK5_OUT_DATA_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_ALINK5_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_ALINK5_OUT_EVEN_DATA\\,chip\\=?@) / (hv_24x7@PM_ALINK5_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK5_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_ALINK5_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_ALINK5_OUT_EVEN_DATA\\,chip\\=?@) / (1 + hv_24x7@PM_ALINK5_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK5_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1.063%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "ALINK6_OUT_DATA_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_ALINK6_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_ALINK6_OUT_EVEN_DATA\\,chip\\=?@) / (hv_24x7@PM_ALINK6_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK6_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_ALINK6_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_ALINK6_OUT_EVEN_DATA\\,chip\\=?@) / (1 + hv_24x7@PM_ALINK6_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK6_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1.063%", + "AggregationMode": "PerChip" + }, + { + "MetricName": "ALINK7_OUT_DATA_UTILIZATION", +- "MetricExpr": "((hv_24x7@PM_ALINK7_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_ALINK7_OUT_EVEN_DATA\\,chip\\=?@) / (hv_24x7@PM_ALINK7_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK7_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", ++ "MetricExpr": "((hv_24x7@PM_ALINK7_OUT_ODD_DATA\\,chip\\=?@ + hv_24x7@PM_ALINK7_OUT_EVEN_DATA\\,chip\\=?@) / (1 + hv_24x7@PM_ALINK7_OUT_ODD_AVLBL_CYCLES\\,chip\\=?@ + hv_24x7@PM_ALINK7_OUT_EVEN_AVLBL_CYCLES\\,chip\\=?@)) * 100", + "ScaleUnit": "1.063%", + "AggregationMode": "PerChip" + }, +-- +2.35.1 + diff --git a/queue-6.0/perf-x86-intel-lbr-use-setup_clear_cpu_cap-instead-o.patch b/queue-6.0/perf-x86-intel-lbr-use-setup_clear_cpu_cap-instead-o.patch new file mode 100644 index 00000000000..87db59869e6 --- /dev/null +++ b/queue-6.0/perf-x86-intel-lbr-use-setup_clear_cpu_cap-instead-o.patch @@ -0,0 +1,41 @@ +From 2e83b6af97a09f988912748957a027cd8f28459f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 17:11:19 +0300 +Subject: perf/x86/intel/lbr: Use setup_clear_cpu_cap() instead of + clear_cpu_cap() + +From: Maxim Levitsky + +[ Upstream commit b329f5ddc9ce4b622d9c7aaf5c6df4de52caf91a ] + +clear_cpu_cap(&boot_cpu_data) is very similar to setup_clear_cpu_cap() +except that the latter also sets a bit in 'cpu_caps_cleared' which +later clears the same cap in secondary cpus, which is likely what is +meant here. + +Fixes: 47125db27e47 ("perf/x86/intel/lbr: Support Architectural LBR") +Signed-off-by: Maxim Levitsky +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Kan Liang +Link: https://lkml.kernel.org/r/20220718141123.136106-2-mlevitsk@redhat.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/lbr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c +index 47fca6a7a8bc..c811cb7d632f 100644 +--- a/arch/x86/events/intel/lbr.c ++++ b/arch/x86/events/intel/lbr.c +@@ -1869,7 +1869,7 @@ void __init intel_pmu_arch_lbr_init(void) + return; + + clear_arch_lbr: +- clear_cpu_cap(&boot_cpu_data, X86_FEATURE_ARCH_LBR); ++ setup_clear_cpu_cap(X86_FEATURE_ARCH_LBR); + } + + /** +-- +2.35.1 + diff --git a/queue-6.0/pinctrl-ocelot-fix-incorrect-trigger-of-the-interrup.patch b/queue-6.0/pinctrl-ocelot-fix-incorrect-trigger-of-the-interrup.patch new file mode 100644 index 00000000000..fa8e554b17b --- /dev/null +++ b/queue-6.0/pinctrl-ocelot-fix-incorrect-trigger-of-the-interrup.patch @@ -0,0 +1,67 @@ +From 1b5ab5b4fdf875d73792408199ef27638be73e7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 09:09:59 +0200 +Subject: pinctrl: ocelot: Fix incorrect trigger of the interrupt. + +From: Horatiu Vultur + +[ Upstream commit e9945b2633deccda74a769d94060df49c53ff181 ] + +The interrupt controller can detect only link changes. So in case an +external device generated a level based interrupt, then the interrupt +controller detected correctly the first edge. But the problem was that +the interrupt controller was detecting also the edge when the interrupt +was cleared. So it would generate another interrupt. +The fix for this is to clear the second interrupt but still check the +interrupt line status. + +Fixes: c297561bc98a ("pinctrl: ocelot: Fix interrupt controller") +Signed-off-by: Horatiu Vultur +Tested-by: Michael Walle +Link: https://lore.kernel.org/r/20221018070959.1322606-1-horatiu.vultur@microchip.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-ocelot.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-ocelot.c b/drivers/pinctrl/pinctrl-ocelot.c +index c7df8c5fe585..105771ff82e6 100644 +--- a/drivers/pinctrl/pinctrl-ocelot.c ++++ b/drivers/pinctrl/pinctrl-ocelot.c +@@ -1863,19 +1863,28 @@ static void ocelot_irq_unmask_level(struct irq_data *data) + if (val & bit) + ack = true; + ++ /* Try to clear any rising edges */ ++ if (!active && ack) ++ regmap_write_bits(info->map, REG(OCELOT_GPIO_INTR, info, gpio), ++ bit, bit); ++ + /* Enable the interrupt now */ + gpiochip_enable_irq(chip, gpio); + regmap_update_bits(info->map, REG(OCELOT_GPIO_INTR_ENA, info, gpio), + bit, bit); + + /* +- * In case the interrupt line is still active and the interrupt +- * controller has not seen any changes in the interrupt line, then it +- * means that there happen another interrupt while the line was active. ++ * In case the interrupt line is still active then it means that ++ * there happen another interrupt while the line was active. + * So we missed that one, so we need to kick the interrupt again + * handler. + */ +- if (active && !ack) { ++ regmap_read(info->map, REG(OCELOT_GPIO_IN, info, gpio), &val); ++ if ((!(val & bit) && trigger_level == IRQ_TYPE_LEVEL_LOW) || ++ (val & bit && trigger_level == IRQ_TYPE_LEVEL_HIGH)) ++ active = true; ++ ++ if (active) { + struct ocelot_irq_work *work; + + work = kmalloc(sizeof(*work), GFP_ATOMIC); +-- +2.35.1 + diff --git a/queue-6.0/pinctrl-qcom-avoid-glitching-lines-when-we-first-mux.patch b/queue-6.0/pinctrl-qcom-avoid-glitching-lines-when-we-first-mux.patch new file mode 100644 index 00000000000..19ed865eb5f --- /dev/null +++ b/queue-6.0/pinctrl-qcom-avoid-glitching-lines-when-we-first-mux.patch @@ -0,0 +1,168 @@ +From 84ea0b0a4410c587d346c16226d2bd1a4c64b825 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Oct 2022 10:33:18 -0700 +Subject: pinctrl: qcom: Avoid glitching lines when we first mux to output + +From: Douglas Anderson + +[ Upstream commit d21f4b7ffc22c009da925046b69b15af08de9d75 ] + +Back in the description of commit e440e30e26dd ("arm64: dts: qcom: +sc7180: Avoid glitching SPI CS at bootup on trogdor") we described a +problem that we were seeing on trogdor devices. I'll re-summarize here +but you can also re-read the original commit. + +On trogdor devices, the BIOS is setting up the SPI chip select as: +- mux special function (SPI chip select) +- output enable +- output low (unused because we've muxed as special function) + +In the kernel, however, we've moved away from using the chip select +line as special function. Since the kernel wants to fully control the +chip select it's far more efficient to treat the line as a GPIO rather +than sending packet-like commands to the GENI firmware every time we +want the line to toggle. + +When we transition from how the BIOS had the pin configured to how the +kernel has the pin configured we end up glitching the line. That's +because we _first_ change the mux of the line and then later set its +output. This glitch is bad and can confuse the device on the other end +of the line. + +The old commit e440e30e26dd ("arm64: dts: qcom: sc7180: Avoid +glitching SPI CS at bootup on trogdor") fixed the glitch, though the +solution was far from elegant. It essentially did the thing that +everyone always hates: encoding a sequential program in device tree, +even if it's a simple one. It also, unfortunately, got broken by +commit b991f8c3622c ("pinctrl: core: Handling pinmux and pinconf +separately"). After that commit we did all the muxing _first_ even +though the config (set the pin to output high) was listed first. :( + +I looked at ideas for how to solve this more properly. My first +thought was to use the "init" pinctrl state. In theory the "init" +pinctrl state is supposed to be exactly for achieving glitch-free +transitions. My dream would have been for the "init" pinctrl to do +nothing at all. That would let us delay the automatic pin muxing until +the driver could set things up and call pinctrl_init_done(). In other +words, my dream was: + + /* Request the GPIO; init it 1 (because DT says GPIO_ACTIVE_LOW) */ + devm_gpiod_get_index(dev, "cs", GPIOD_OUT_LOW); + /* Output should be right, so we can remux, yay! */ + pinctrl_init_done(dev); + +Unfortunately, it didn't work out. The primary reason is that the MSM +GPIO driver implements gpio_request_enable(). As documented in +pinmux.h, that function automatically remuxes a line as a GPIO. ...and +it does this remuxing _before_ specifying the output of the pin. You +can see in gpiod_get_index() that we call gpiod_request() before +gpiod_configure_flags(). gpiod_request() isn't passed any flags so it +has no idea what the eventual output will be. + +We could have debates about whether or not the automatic remuxing to +GPIO for the MSM pinctrl was a good idea or not, but at this point I +think there is a plethora of code that's relying on it and I certainly +wouldn't suggest changing it. + +Alternatively, we could try to come up with a way to pass the initial +output state to gpio_request_enable() and plumb all that through. That +seems like it would be doable, but we'd have to plumb it through +several layers in the stack. + +This patch implements yet another alternative. Here, we specifically +avoid glitching the first time a pin is muxed to GPIO function if the +direction of the pin is output. The idea is that we can read the state +of the pin before we set the mux and make sure that the re-mux won't +change the state. + +NOTES: +- We only do this the first time since later swaps between mux states + might want to preserve the old output value. In other words, I + wouldn't want to break a driver that did: + gpiod_set_value(g, 1); + pinctrl_select_state(pinctrl, special_state); + pinctrl_select_default_state(); + /* We should be driving 1 even if "special_state" made the pin 0 */ +- It's safe to do this the first time since the driver _couldn't_ have + explicitly set a state. In order to even be able to control the GPIO + (at least using gpiod) we have to have requested it which would have + counted as the first mux. +- In theory, instead of keeping track of the first time a pin was set + as a GPIO we could enable the glitch-free behavior only when + msm_pinmux_request_gpio() is in the callchain. That works an enables + my "dream" implementation above where we use an "init" state to + solve this. However, it's nice not to have to do this. By handling + just the first transition to GPIO we can simply let the normal + "default" remuxing happen and we can be assured that there won't be + a glitch. + +Before this change I could see the glitch reported on the EC console +when booting. It would say this when booting the kernel: + Unexpected state 1 in CSNRE ISR + +After this change there is no error reported. + +Note that I haven't reproduced the original problem described in +e440e30e26dd ("arm64: dts: qcom: sc7180: Avoid glitching SPI CS at +bootup on trogdor") but I could believe it might happen in certain +timing conditions. + +Fixes: b991f8c3622c ("pinctrl: core: Handling pinmux and pinconf separately") +Signed-off-by: Douglas Anderson +Reviewed-by: Stephen Boyd +Link: https://lore.kernel.org/r/20221014103217.1.I656bb2c976ed626e5d37294eb252c1cf3be769dc@changeid +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-msm.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c +index a2abfe987ab1..8bf8b21954fe 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -51,6 +51,7 @@ + * detection. + * @skip_wake_irqs: Skip IRQs that are handled by wakeup interrupt controller + * @disabled_for_mux: These IRQs were disabled because we muxed away. ++ * @ever_gpio: This bit is set the first time we mux a pin to gpio_func. + * @soc: Reference to soc_data of platform specific data. + * @regs: Base addresses for the TLMM tiles. + * @phys_base: Physical base address +@@ -72,6 +73,7 @@ struct msm_pinctrl { + DECLARE_BITMAP(enabled_irqs, MAX_NR_GPIO); + DECLARE_BITMAP(skip_wake_irqs, MAX_NR_GPIO); + DECLARE_BITMAP(disabled_for_mux, MAX_NR_GPIO); ++ DECLARE_BITMAP(ever_gpio, MAX_NR_GPIO); + + const struct msm_pinctrl_soc_data *soc; + void __iomem *regs[MAX_NR_TILES]; +@@ -218,6 +220,25 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev, + + val = msm_readl_ctl(pctrl, g); + ++ /* ++ * If this is the first time muxing to GPIO and the direction is ++ * output, make sure that we're not going to be glitching the pin ++ * by reading the current state of the pin and setting it as the ++ * output. ++ */ ++ if (i == gpio_func && (val & BIT(g->oe_bit)) && ++ !test_and_set_bit(group, pctrl->ever_gpio)) { ++ u32 io_val = msm_readl_io(pctrl, g); ++ ++ if (io_val & BIT(g->in_bit)) { ++ if (!(io_val & BIT(g->out_bit))) ++ msm_writel_io(io_val | BIT(g->out_bit), pctrl, g); ++ } else { ++ if (io_val & BIT(g->out_bit)) ++ msm_writel_io(io_val & ~BIT(g->out_bit), pctrl, g); ++ } ++ } ++ + if (egpio_func && i == egpio_func) { + if (val & BIT(g->egpio_present)) + val &= ~BIT(g->egpio_enable); +-- +2.35.1 + diff --git a/queue-6.0/pm-domains-fix-handling-of-unavailable-disabled-idle.patch b/queue-6.0/pm-domains-fix-handling-of-unavailable-disabled-idle.patch new file mode 100644 index 00000000000..6770547f424 --- /dev/null +++ b/queue-6.0/pm-domains-fix-handling-of-unavailable-disabled-idle.patch @@ -0,0 +1,44 @@ +From 325bf5a4b04d663e17b34a66852395bc93cb49f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Oct 2022 13:34:32 +0100 +Subject: PM: domains: Fix handling of unavailable/disabled idle states + +From: Sudeep Holla + +[ Upstream commit e0c57a5c70c13317238cb19a7ded0eab4a5f7de5 ] + +Platforms can provide the information about the availability of each +idle states via status flag. Platforms may have to disable one or more +idle states for various reasons like broken firmware or other unmet +dependencies. + +Fix handling of such unavailable/disabled idle states by ignoring them +while parsing the states. + +Fixes: a3381e3a65cb ("PM / domains: Fix up domain-idle-states OF parsing") +Signed-off-by: Sudeep Holla +Reviewed-by: Ulf Hansson +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/domain.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c +index 55a10e6d4e2a..b7bb9df386de 100644 +--- a/drivers/base/power/domain.c ++++ b/drivers/base/power/domain.c +@@ -2950,6 +2950,10 @@ static int genpd_iterate_idle_states(struct device_node *dn, + np = it.node; + if (!of_match_node(idle_state_match, np)) + continue; ++ ++ if (!of_device_is_available(np)) ++ continue; ++ + if (states) { + ret = genpd_parse_state(&states[i], np); + if (ret) { +-- +2.35.1 + diff --git a/queue-6.0/pm-hibernate-allow-hybrid-sleep-to-work-with-s2idle.patch b/queue-6.0/pm-hibernate-allow-hybrid-sleep-to-work-with-s2idle.patch new file mode 100644 index 00000000000..ee51e5bacaf --- /dev/null +++ b/queue-6.0/pm-hibernate-allow-hybrid-sleep-to-work-with-s2idle.patch @@ -0,0 +1,43 @@ +From 3245e64909d49f0bb7d2f21659f7d710ab3ff89d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Oct 2022 22:50:17 -0500 +Subject: PM: hibernate: Allow hybrid sleep to work with s2idle + +From: Mario Limonciello + +[ Upstream commit 85850af4fc47132f3f2f0dd698b90f67906600b4 ] + +Hybrid sleep is currently hardcoded to only operate with S3 even +on systems that might not support it. + +Instead of assuming this mode is what the user wants to use, for +hybrid sleep follow the setting of `mem_sleep_current` which +will respect mem_sleep_default kernel command line and policy +decisions made by the presence of the FADT low power idle bit. + +Fixes: 81d45bdf8913 ("PM / hibernate: Untangle power_down()") +Reported-and-tested-by: kolAflash +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216574 +Signed-off-by: Mario Limonciello +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/power/hibernate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index 89c71fce225d..537dd3beafc1 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -641,7 +641,7 @@ static void power_down(void) + int error; + + if (hibernation_mode == HIBERNATION_SUSPEND) { +- error = suspend_devices_and_enter(PM_SUSPEND_MEM); ++ error = suspend_devices_and_enter(mem_sleep_current); + if (error) { + hibernation_mode = hibernation_ops ? + HIBERNATION_PLATFORM : +-- +2.35.1 + diff --git a/queue-6.0/powerpc-selftests-use-timersub-for-gettimeofday.patch b/queue-6.0/powerpc-selftests-use-timersub-for-gettimeofday.patch new file mode 100644 index 00000000000..f9ee7dc1973 --- /dev/null +++ b/queue-6.0/powerpc-selftests-use-timersub-for-gettimeofday.patch @@ -0,0 +1,48 @@ +From 8dec9501e43162a55dc5d4e1d3b68aadaf5ab847 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Aug 2022 10:51:06 +0000 +Subject: powerpc/selftests: Use timersub() for gettimeofday() + +From: ye xingchen + +[ Upstream commit c814bf958926ff45a9c1e899bd001006ab6cfbae ] + +Use timersub() function to simplify the code. + +Reported-by: Zeal Robot +Signed-off-by: ye xingchen +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220816105106.82666-1-ye.xingchen@zte.com.cn +Stable-dep-of: d21f4b7ffc22 ("pinctrl: qcom: Avoid glitching lines when we first mux to output") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/powerpc/benchmarks/gettimeofday.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/powerpc/benchmarks/gettimeofday.c b/tools/testing/selftests/powerpc/benchmarks/gettimeofday.c +index 6b415683357b..580fcac0a09f 100644 +--- a/tools/testing/selftests/powerpc/benchmarks/gettimeofday.c ++++ b/tools/testing/selftests/powerpc/benchmarks/gettimeofday.c +@@ -12,7 +12,7 @@ static int test_gettimeofday(void) + { + int i; + +- struct timeval tv_start, tv_end; ++ struct timeval tv_start, tv_end, tv_diff; + + gettimeofday(&tv_start, NULL); + +@@ -20,7 +20,9 @@ static int test_gettimeofday(void) + gettimeofday(&tv_end, NULL); + } + +- printf("time = %.6f\n", tv_end.tv_sec - tv_start.tv_sec + (tv_end.tv_usec - tv_start.tv_usec) * 1e-6); ++ timersub(&tv_start, &tv_end, &tv_diff); ++ ++ printf("time = %.6f\n", tv_diff.tv_sec + (tv_diff.tv_usec) * 1e-6); + + return 0; + } +-- +2.35.1 + diff --git a/queue-6.0/rcu-keep-synchronize_rcu-from-enabling-irqs-in-early.patch b/queue-6.0/rcu-keep-synchronize_rcu-from-enabling-irqs-in-early.patch new file mode 100644 index 00000000000..ef0063bd318 --- /dev/null +++ b/queue-6.0/rcu-keep-synchronize_rcu-from-enabling-irqs-in-early.patch @@ -0,0 +1,72 @@ +From dfbd20e896e9d08ad717882aebe7273696ac22a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Oct 2022 10:58:14 -0700 +Subject: rcu: Keep synchronize_rcu() from enabling irqs in early boot + +From: Paul E. McKenney + +[ Upstream commit 31d8aaa87fcef1be5932f3813ea369e21bd3b11d ] + +Making polled RCU grace periods account for expedited grace periods +required acquiring the leaf rcu_node structure's lock during early boot, +but after rcu_init() was called. This lock is irq-disabled, but the +code incorrectly assumes that irqs are always disabled when invoking +synchronize_rcu(). The exception is early boot before the scheduler has +started, which means that upon return from synchronize_rcu(), irqs will +be incorrectly enabled. + +This commit fixes this bug by using irqsave/irqrestore locking primitives. + +Fixes: bf95b2bc3e42 ("rcu: Switch polled grace-period APIs to ->gp_seq_polled") + +Reported-by: Steven Rostedt +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c +index eb435941e92f..5b52727dcc1c 100644 +--- a/kernel/rcu/tree.c ++++ b/kernel/rcu/tree.c +@@ -1402,30 +1402,32 @@ static void rcu_poll_gp_seq_end(unsigned long *snap) + // where caller does not hold the root rcu_node structure's lock. + static void rcu_poll_gp_seq_start_unlocked(unsigned long *snap) + { ++ unsigned long flags; + struct rcu_node *rnp = rcu_get_root(); + + if (rcu_init_invoked()) { + lockdep_assert_irqs_enabled(); +- raw_spin_lock_irq_rcu_node(rnp); ++ raw_spin_lock_irqsave_rcu_node(rnp, flags); + } + rcu_poll_gp_seq_start(snap); + if (rcu_init_invoked()) +- raw_spin_unlock_irq_rcu_node(rnp); ++ raw_spin_unlock_irqrestore_rcu_node(rnp, flags); + } + + // Make the polled API aware of the end of a grace period, but where + // caller does not hold the root rcu_node structure's lock. + static void rcu_poll_gp_seq_end_unlocked(unsigned long *snap) + { ++ unsigned long flags; + struct rcu_node *rnp = rcu_get_root(); + + if (rcu_init_invoked()) { + lockdep_assert_irqs_enabled(); +- raw_spin_lock_irq_rcu_node(rnp); ++ raw_spin_lock_irqsave_rcu_node(rnp, flags); + } + rcu_poll_gp_seq_end(snap); + if (rcu_init_invoked()) +- raw_spin_unlock_irq_rcu_node(rnp); ++ raw_spin_unlock_irqrestore_rcu_node(rnp, flags); + } + + /* +-- +2.35.1 + diff --git a/queue-6.0/risc-v-fix-compilation-without-riscv_isa_zicbom.patch b/queue-6.0/risc-v-fix-compilation-without-riscv_isa_zicbom.patch new file mode 100644 index 00000000000..09ce164ad18 --- /dev/null +++ b/queue-6.0/risc-v-fix-compilation-without-riscv_isa_zicbom.patch @@ -0,0 +1,172 @@ +From b347d868b8b70e539c00d7bf77dbf8f1c83a0ad4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Oct 2022 11:52:39 +0530 +Subject: RISC-V: Fix compilation without RISCV_ISA_ZICBOM + +From: Andrew Jones + +[ Upstream commit 5c20a3a9df19811051441214e7f5091cb3546db0 ] + +riscv_cbom_block_size and riscv_init_cbom_blocksize() should always +be available and riscv_init_cbom_blocksize() should always be +invoked, even when compiling without RISCV_ISA_ZICBOM enabled. This +is because disabling RISCV_ISA_ZICBOM means "don't use zicbom +instructions in the kernel" not "pretend there isn't zicbom, even +when there is". When zicbom is available, whether the kernel enables +its use with RISCV_ISA_ZICBOM or not, KVM will offer it to guests. +Ensure we can build KVM and that the block size is initialized even +when compiling without RISCV_ISA_ZICBOM. + +Fixes: 8f7e001e0325 ("RISC-V: Clean up the Zicbom block size probing") +Reported-by: kernel test robot +Signed-off-by: Andrew Jones +Signed-off-by: Anup Patel +Reviewed-by: Conor Dooley +Reviewed-by: Heiko Stuebner +Tested-by: Heiko Stuebner +Signed-off-by: Anup Patel +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/cacheflush.h | 8 ------ + arch/riscv/mm/cacheflush.c | 38 ++++++++++++++++++++++++++ + arch/riscv/mm/dma-noncoherent.c | 41 ----------------------------- + 3 files changed, 38 insertions(+), 49 deletions(-) + +diff --git a/arch/riscv/include/asm/cacheflush.h b/arch/riscv/include/asm/cacheflush.h +index 273ece6b622f..1470e556cdb1 100644 +--- a/arch/riscv/include/asm/cacheflush.h ++++ b/arch/riscv/include/asm/cacheflush.h +@@ -42,16 +42,8 @@ void flush_icache_mm(struct mm_struct *mm, bool local); + + #endif /* CONFIG_SMP */ + +-/* +- * The T-Head CMO errata internally probe the CBOM block size, but otherwise +- * don't depend on Zicbom. +- */ + extern unsigned int riscv_cbom_block_size; +-#ifdef CONFIG_RISCV_ISA_ZICBOM + void riscv_init_cbom_blocksize(void); +-#else +-static inline void riscv_init_cbom_blocksize(void) { } +-#endif + + #ifdef CONFIG_RISCV_DMA_NONCOHERENT + void riscv_noncoherent_supported(void); +diff --git a/arch/riscv/mm/cacheflush.c b/arch/riscv/mm/cacheflush.c +index 6cb7d96ad9c7..57b40a350420 100644 +--- a/arch/riscv/mm/cacheflush.c ++++ b/arch/riscv/mm/cacheflush.c +@@ -3,6 +3,7 @@ + * Copyright (C) 2017 SiFive + */ + ++#include + #include + + #ifdef CONFIG_SMP +@@ -86,3 +87,40 @@ void flush_icache_pte(pte_t pte) + flush_icache_all(); + } + #endif /* CONFIG_MMU */ ++ ++unsigned int riscv_cbom_block_size; ++EXPORT_SYMBOL_GPL(riscv_cbom_block_size); ++ ++void riscv_init_cbom_blocksize(void) ++{ ++ struct device_node *node; ++ unsigned long cbom_hartid; ++ u32 val, probed_block_size; ++ int ret; ++ ++ probed_block_size = 0; ++ for_each_of_cpu_node(node) { ++ unsigned long hartid; ++ ++ ret = riscv_of_processor_hartid(node, &hartid); ++ if (ret) ++ continue; ++ ++ /* set block-size for cbom extension if available */ ++ ret = of_property_read_u32(node, "riscv,cbom-block-size", &val); ++ if (ret) ++ continue; ++ ++ if (!probed_block_size) { ++ probed_block_size = val; ++ cbom_hartid = hartid; ++ } else { ++ if (probed_block_size != val) ++ pr_warn("cbom-block-size mismatched between harts %lu and %lu\n", ++ cbom_hartid, hartid); ++ } ++ } ++ ++ if (probed_block_size) ++ riscv_cbom_block_size = probed_block_size; ++} +diff --git a/arch/riscv/mm/dma-noncoherent.c b/arch/riscv/mm/dma-noncoherent.c +index b0add983530a..d919efab6eba 100644 +--- a/arch/riscv/mm/dma-noncoherent.c ++++ b/arch/riscv/mm/dma-noncoherent.c +@@ -8,13 +8,8 @@ + #include + #include + #include +-#include +-#include + #include + +-unsigned int riscv_cbom_block_size; +-EXPORT_SYMBOL_GPL(riscv_cbom_block_size); +- + static bool noncoherent_supported; + + void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, +@@ -77,42 +72,6 @@ void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size, + dev->dma_coherent = coherent; + } + +-#ifdef CONFIG_RISCV_ISA_ZICBOM +-void riscv_init_cbom_blocksize(void) +-{ +- struct device_node *node; +- unsigned long cbom_hartid; +- u32 val, probed_block_size; +- int ret; +- +- probed_block_size = 0; +- for_each_of_cpu_node(node) { +- unsigned long hartid; +- +- ret = riscv_of_processor_hartid(node, &hartid); +- if (ret) +- continue; +- +- /* set block-size for cbom extension if available */ +- ret = of_property_read_u32(node, "riscv,cbom-block-size", &val); +- if (ret) +- continue; +- +- if (!probed_block_size) { +- probed_block_size = val; +- cbom_hartid = hartid; +- } else { +- if (probed_block_size != val) +- pr_warn("cbom-block-size mismatched between harts %lu and %lu\n", +- cbom_hartid, hartid); +- } +- } +- +- if (probed_block_size) +- riscv_cbom_block_size = probed_block_size; +-} +-#endif +- + void riscv_noncoherent_supported(void) + { + WARN(!riscv_cbom_block_size, +-- +2.35.1 + diff --git a/queue-6.0/risc-v-kvm-fix-kvm_riscv_vcpu_timer_pending-for-sstc.patch b/queue-6.0/risc-v-kvm-fix-kvm_riscv_vcpu_timer_pending-for-sstc.patch new file mode 100644 index 00000000000..642d5244552 --- /dev/null +++ b/queue-6.0/risc-v-kvm-fix-kvm_riscv_vcpu_timer_pending-for-sstc.patch @@ -0,0 +1,100 @@ +From fbaeff3c0cd65dcf418c2156c4e3696e133d200c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Oct 2022 11:52:45 +0530 +Subject: RISC-V: KVM: Fix kvm_riscv_vcpu_timer_pending() for Sstc + +From: Anup Patel + +[ Upstream commit cea8896bd936135559253e9b23340cfa1cdf0caf ] + +The kvm_riscv_vcpu_timer_pending() checks per-VCPU next_cycles +and per-VCPU software injected VS timer interrupt. This function +returns incorrect value when Sstc is available because the per-VCPU +next_cycles are only updated by kvm_riscv_vcpu_timer_save() called +from kvm_arch_vcpu_put(). As a result, when Sstc is available the +VCPU does not block properly upon WFI traps. + +To fix the above issue, we introduce kvm_riscv_vcpu_timer_sync() +which will update per-VCPU next_cycles upon every VM exit instead +of kvm_riscv_vcpu_timer_save(). + +Fixes: 8f5cb44b1bae ("RISC-V: KVM: Support sstc extension") +Signed-off-by: Anup Patel +Reviewed-by: Atish Patra +Signed-off-by: Anup Patel +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/kvm_vcpu_timer.h | 1 + + arch/riscv/kvm/vcpu.c | 3 +++ + arch/riscv/kvm/vcpu_timer.c | 17 +++++++++++++++-- + 3 files changed, 19 insertions(+), 2 deletions(-) + +diff --git a/arch/riscv/include/asm/kvm_vcpu_timer.h b/arch/riscv/include/asm/kvm_vcpu_timer.h +index 0d8fdb8ec63a..82f7260301da 100644 +--- a/arch/riscv/include/asm/kvm_vcpu_timer.h ++++ b/arch/riscv/include/asm/kvm_vcpu_timer.h +@@ -45,6 +45,7 @@ int kvm_riscv_vcpu_timer_deinit(struct kvm_vcpu *vcpu); + int kvm_riscv_vcpu_timer_reset(struct kvm_vcpu *vcpu); + void kvm_riscv_vcpu_timer_restore(struct kvm_vcpu *vcpu); + void kvm_riscv_guest_timer_init(struct kvm *kvm); ++void kvm_riscv_vcpu_timer_sync(struct kvm_vcpu *vcpu); + void kvm_riscv_vcpu_timer_save(struct kvm_vcpu *vcpu); + bool kvm_riscv_vcpu_timer_pending(struct kvm_vcpu *vcpu); + +diff --git a/arch/riscv/kvm/vcpu.c b/arch/riscv/kvm/vcpu.c +index 2ef33d5d94d1..f692c0716aa7 100644 +--- a/arch/riscv/kvm/vcpu.c ++++ b/arch/riscv/kvm/vcpu.c +@@ -698,6 +698,9 @@ void kvm_riscv_vcpu_sync_interrupts(struct kvm_vcpu *vcpu) + clear_bit(IRQ_VS_SOFT, &v->irqs_pending); + } + } ++ ++ /* Sync-up timer CSRs */ ++ kvm_riscv_vcpu_timer_sync(vcpu); + } + + int kvm_riscv_vcpu_set_interrupt(struct kvm_vcpu *vcpu, unsigned int irq) +diff --git a/arch/riscv/kvm/vcpu_timer.c b/arch/riscv/kvm/vcpu_timer.c +index 185f2386a747..ad34519c8a13 100644 +--- a/arch/riscv/kvm/vcpu_timer.c ++++ b/arch/riscv/kvm/vcpu_timer.c +@@ -320,20 +320,33 @@ void kvm_riscv_vcpu_timer_restore(struct kvm_vcpu *vcpu) + kvm_riscv_vcpu_timer_unblocking(vcpu); + } + +-void kvm_riscv_vcpu_timer_save(struct kvm_vcpu *vcpu) ++void kvm_riscv_vcpu_timer_sync(struct kvm_vcpu *vcpu) + { + struct kvm_vcpu_timer *t = &vcpu->arch.timer; + + if (!t->sstc_enabled) + return; + +- t = &vcpu->arch.timer; + #if defined(CONFIG_32BIT) + t->next_cycles = csr_read(CSR_VSTIMECMP); + t->next_cycles |= (u64)csr_read(CSR_VSTIMECMPH) << 32; + #else + t->next_cycles = csr_read(CSR_VSTIMECMP); + #endif ++} ++ ++void kvm_riscv_vcpu_timer_save(struct kvm_vcpu *vcpu) ++{ ++ struct kvm_vcpu_timer *t = &vcpu->arch.timer; ++ ++ if (!t->sstc_enabled) ++ return; ++ ++ /* ++ * The vstimecmp CSRs are saved by kvm_riscv_vcpu_timer_sync() ++ * upon every VM exit so no need to save here. ++ */ ++ + /* timer should be enabled for the remaining operations */ + if (unlikely(!t->init_done)) + return; +-- +2.35.1 + diff --git a/queue-6.0/risc-v-kvm-provide-uapi-for-zicbom-block-size.patch b/queue-6.0/risc-v-kvm-provide-uapi-for-zicbom-block-size.patch new file mode 100644 index 00000000000..aad66c215e6 --- /dev/null +++ b/queue-6.0/risc-v-kvm-provide-uapi-for-zicbom-block-size.patch @@ -0,0 +1,88 @@ +From 3aeb35cba43b10ac0a394bf6981fb21e6eed0e19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Oct 2022 10:18:59 +0530 +Subject: RISC-V: KVM: Provide UAPI for Zicbom block size + +From: Andrew Jones + +[ Upstream commit afd5dde9a186b8fc5742fff707f184760c4af1a9 ] + +We're about to allow guests to use the Zicbom extension. KVM +userspace needs to know the cache block size in order to +properly advertise it to the guest. Provide a virtual config +register for userspace to get it with the GET_ONE_REG API, but +setting it cannot be supported, so disallow SET_ONE_REG. + +Signed-off-by: Andrew Jones +Reviewed-by: Conor Dooley +Reviewed-by: Atish Patra +Signed-off-by: Anup Patel +Stable-dep-of: 5c20a3a9df19 ("RISC-V: Fix compilation without RISCV_ISA_ZICBOM") +Signed-off-by: Sasha Levin +--- + arch/riscv/include/uapi/asm/kvm.h | 1 + + arch/riscv/kvm/vcpu.c | 8 ++++++++ + arch/riscv/mm/dma-noncoherent.c | 2 ++ + 3 files changed, 11 insertions(+) + +diff --git a/arch/riscv/include/uapi/asm/kvm.h b/arch/riscv/include/uapi/asm/kvm.h +index 7351417afd62..b9a4cf36be4b 100644 +--- a/arch/riscv/include/uapi/asm/kvm.h ++++ b/arch/riscv/include/uapi/asm/kvm.h +@@ -48,6 +48,7 @@ struct kvm_sregs { + /* CONFIG registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */ + struct kvm_riscv_config { + unsigned long isa; ++ unsigned long zicbom_block_size; + }; + + /* CORE registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */ +diff --git a/arch/riscv/kvm/vcpu.c b/arch/riscv/kvm/vcpu.c +index d0f08d5b4282..2ef33d5d94d1 100644 +--- a/arch/riscv/kvm/vcpu.c ++++ b/arch/riscv/kvm/vcpu.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + + const struct _kvm_stats_desc kvm_vcpu_stats_desc[] = { +@@ -254,6 +255,11 @@ static int kvm_riscv_vcpu_get_reg_config(struct kvm_vcpu *vcpu, + case KVM_REG_RISCV_CONFIG_REG(isa): + reg_val = vcpu->arch.isa[0] & KVM_RISCV_BASE_ISA_MASK; + break; ++ case KVM_REG_RISCV_CONFIG_REG(zicbom_block_size): ++ if (!riscv_isa_extension_available(vcpu->arch.isa, ZICBOM)) ++ return -EINVAL; ++ reg_val = riscv_cbom_block_size; ++ break; + default: + return -EINVAL; + } +@@ -311,6 +317,8 @@ static int kvm_riscv_vcpu_set_reg_config(struct kvm_vcpu *vcpu, + return -EOPNOTSUPP; + } + break; ++ case KVM_REG_RISCV_CONFIG_REG(zicbom_block_size): ++ return -EOPNOTSUPP; + default: + return -EINVAL; + } +diff --git a/arch/riscv/mm/dma-noncoherent.c b/arch/riscv/mm/dma-noncoherent.c +index e3f9bdf47c5f..b0add983530a 100644 +--- a/arch/riscv/mm/dma-noncoherent.c ++++ b/arch/riscv/mm/dma-noncoherent.c +@@ -13,6 +13,8 @@ + #include + + unsigned int riscv_cbom_block_size; ++EXPORT_SYMBOL_GPL(riscv_cbom_block_size); ++ + static bool noncoherent_supported; + + void arch_sync_dma_for_device(phys_addr_t paddr, size_t size, +-- +2.35.1 + diff --git a/queue-6.0/riscv-fix-detection-of-toolchain-zicbom-support.patch b/queue-6.0/riscv-fix-detection-of-toolchain-zicbom-support.patch new file mode 100644 index 00000000000..e9590a31bb3 --- /dev/null +++ b/queue-6.0/riscv-fix-detection-of-toolchain-zicbom-support.patch @@ -0,0 +1,77 @@ +From 749ab02eb698ee8a549b0e8667022a6528e19b20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Oct 2022 18:35:20 +0100 +Subject: riscv: fix detection of toolchain Zicbom support + +From: Conor Dooley + +[ Upstream commit b8c86872d1dc171d8f1c137917d6913cae2fa4f2 ] + +It is not sufficient to check if a toolchain supports a particular +extension without checking if the linker supports that extension too. +For example, Clang 15 supports Zicbom but GNU bintutils 2.35.2 does +not, leading build errors like so: + +riscv64-linux-gnu-ld: -march=rv64i2p0_m2p0_a2p0_c2p0_zicbom1p0_zihintpause2p0: Invalid or unknown z ISA extension: 'zicbom' + +Convert CC_HAS_ZICBOM to TOOLCHAIN_HAS_ZICBOM & check if the linker +also supports Zicbom. + +Reported-by: Kevin Hilman +Link: https://github.com/ClangBuiltLinux/linux/issues/1714 +Link: https://storage.kernelci.org/next/master/next-20220920/riscv/defconfig+CONFIG_EFI=n/clang-16/logs/kernel.log +Fixes: 1631ba1259d6 ("riscv: Add support for non-coherent devices using zicbom extension") +Signed-off-by: Conor Dooley +Reviewed-by: Heiko Stuebner +Reviewed-by: Nathan Chancellor +Link: https://lore.kernel.org/r/20221006173520.1785507-2-conor@kernel.org +[Palmer: Check for ld-2.38, not 2.39, as 2.38 no longer errors.] +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/Kconfig | 10 ++++++---- + arch/riscv/Makefile | 3 +-- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig +index cea22ccb57cb..e646298d2d65 100644 +--- a/arch/riscv/Kconfig ++++ b/arch/riscv/Kconfig +@@ -402,14 +402,16 @@ config RISCV_ISA_SVPBMT + + If you don't know what to do here, say Y. + +-config CC_HAS_ZICBOM ++config TOOLCHAIN_HAS_ZICBOM + bool +- default y if 64BIT && $(cc-option,-mabi=lp64 -march=rv64ima_zicbom) +- default y if 32BIT && $(cc-option,-mabi=ilp32 -march=rv32ima_zicbom) ++ default y ++ depends on !64BIT || $(cc-option,-mabi=lp64 -march=rv64ima_zicbom) ++ depends on !32BIT || $(cc-option,-mabi=ilp32 -march=rv32ima_zicbom) ++ depends on LLD_VERSION >= 150000 || LD_VERSION >= 23800 + + config RISCV_ISA_ZICBOM + bool "Zicbom extension support for non-coherent DMA operation" +- depends on CC_HAS_ZICBOM ++ depends on TOOLCHAIN_HAS_ZICBOM + depends on !XIP_KERNEL && MMU + select RISCV_DMA_NONCOHERENT + select RISCV_ALTERNATIVE +diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile +index e7d52a2301e2..d1dbbe0fb0f8 100644 +--- a/arch/riscv/Makefile ++++ b/arch/riscv/Makefile +@@ -59,8 +59,7 @@ toolchain-need-zicsr-zifencei := $(call cc-option-yn, -march=$(riscv-march-y)_zi + riscv-march-$(toolchain-need-zicsr-zifencei) := $(riscv-march-y)_zicsr_zifencei + + # Check if the toolchain supports Zicbom extension +-toolchain-supports-zicbom := $(call cc-option-yn, -march=$(riscv-march-y)_zicbom) +-riscv-march-$(toolchain-supports-zicbom) := $(riscv-march-y)_zicbom ++riscv-march-$(CONFIG_TOOLCHAIN_HAS_ZICBOM) := $(riscv-march-y)_zicbom + + # Check if the toolchain supports Zihintpause extension + toolchain-supports-zihintpause := $(call cc-option-yn, -march=$(riscv-march-y)_zihintpause) +-- +2.35.1 + diff --git a/queue-6.0/riscv-fix-detection-of-toolchain-zihintpause-support.patch b/queue-6.0/riscv-fix-detection-of-toolchain-zihintpause-support.patch new file mode 100644 index 00000000000..47e2045ffd3 --- /dev/null +++ b/queue-6.0/riscv-fix-detection-of-toolchain-zihintpause-support.patch @@ -0,0 +1,81 @@ +From bc9ce3a6f0940c5fa8f9c5007f9d39f27d9939c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Oct 2022 18:35:21 +0100 +Subject: riscv: fix detection of toolchain Zihintpause support + +From: Conor Dooley + +[ Upstream commit aae538cd03bc8fc35979653d9180922d146da0ca ] + +It is not sufficient to check if a toolchain supports a particular +extension without checking if the linker supports that extension +too. For example, Clang 15 supports Zihintpause but GNU bintutils +2.35.2 does not, leading build errors like so: + +riscv64-linux-gnu-ld: -march=rv64i2p0_m2p0_a2p0_c2p0_zihintpause2p0: Invalid or unknown z ISA extension: 'zihintpause' + +Add a TOOLCHAIN_HAS_ZIHINTPAUSE which checks if each of the compiler, +assembler and linker support the extension. Replace the ifdef in the +vdso with one depending on this new symbol. + +Fixes: 8eb060e10185 ("arch/riscv: add Zihintpause support") +Signed-off-by: Conor Dooley +Reviewed-by: Heiko Stuebner +Reviewed-by: Nathan Chancellor +Link: https://lore.kernel.org/r/20221006173520.1785507-3-conor@kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/Kconfig | 7 +++++++ + arch/riscv/Makefile | 3 +-- + arch/riscv/include/asm/vdso/processor.h | 2 +- + 3 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig +index e646298d2d65..9d5b7fa1b622 100644 +--- a/arch/riscv/Kconfig ++++ b/arch/riscv/Kconfig +@@ -426,6 +426,13 @@ config RISCV_ISA_ZICBOM + + If you don't know what to do here, say Y. + ++config TOOLCHAIN_HAS_ZIHINTPAUSE ++ bool ++ default y ++ depends on !64BIT || $(cc-option,-mabi=lp64 -march=rv64ima_zihintpause) ++ depends on !32BIT || $(cc-option,-mabi=ilp32 -march=rv32ima_zihintpause) ++ depends on LLD_VERSION >= 150000 || LD_VERSION >= 23600 ++ + config FPU + bool "FPU support" + default y +diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile +index d1dbbe0fb0f8..e5a608e37f45 100644 +--- a/arch/riscv/Makefile ++++ b/arch/riscv/Makefile +@@ -62,8 +62,7 @@ riscv-march-$(toolchain-need-zicsr-zifencei) := $(riscv-march-y)_zicsr_zifencei + riscv-march-$(CONFIG_TOOLCHAIN_HAS_ZICBOM) := $(riscv-march-y)_zicbom + + # Check if the toolchain supports Zihintpause extension +-toolchain-supports-zihintpause := $(call cc-option-yn, -march=$(riscv-march-y)_zihintpause) +-riscv-march-$(toolchain-supports-zihintpause) := $(riscv-march-y)_zihintpause ++riscv-march-$(CONFIG_TOOLCHAIN_HAS_ZIHINTPAUSE) := $(riscv-march-y)_zihintpause + + KBUILD_CFLAGS += -march=$(subst fd,,$(riscv-march-y)) + KBUILD_AFLAGS += -march=$(riscv-march-y) +diff --git a/arch/riscv/include/asm/vdso/processor.h b/arch/riscv/include/asm/vdso/processor.h +index 1e4f8b4aef79..fa70cfe507aa 100644 +--- a/arch/riscv/include/asm/vdso/processor.h ++++ b/arch/riscv/include/asm/vdso/processor.h +@@ -21,7 +21,7 @@ static inline void cpu_relax(void) + * Reduce instruction retirement. + * This assumes the PC changes. + */ +-#ifdef __riscv_zihintpause ++#ifdef CONFIG_TOOLCHAIN_HAS_ZIHINTPAUSE + __asm__ __volatile__ ("pause"); + #else + /* Encoding of the pause instruction */ +-- +2.35.1 + diff --git a/queue-6.0/riscv-jump_label-mark-arguments-as-const-to-satisfy-.patch b/queue-6.0/riscv-jump_label-mark-arguments-as-const-to-satisfy-.patch new file mode 100644 index 00000000000..ca06741ce04 --- /dev/null +++ b/queue-6.0/riscv-jump_label-mark-arguments-as-const-to-satisfy-.patch @@ -0,0 +1,86 @@ +From 7064ee7fac10c82d1404e269762c24cd6619061f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Oct 2022 22:54:37 +0800 +Subject: riscv: jump_label: mark arguments as const to satisfy asm constraints + +From: Jisheng Zhang + +[ Upstream commit 89fd4a1df829187d4d35f6a520cc531de622e6f0 ] + +Samuel reported that the static branch usage in cpu_relax() breaks +building with CONFIG_CC_OPTIMIZE_FOR_SIZE: + +In file included from : +./arch/riscv/include/asm/jump_label.h: In function 'cpu_relax': +././include/linux/compiler_types.h:285:33: warning: 'asm' operand 0 +probably does not match constraints + 285 | #define asm_volatile_goto(x...) asm goto(x) + | ^~~ +./arch/riscv/include/asm/jump_label.h:41:9: note: in expansion of macro +'asm_volatile_goto' + 41 | asm_volatile_goto( + | ^~~~~~~~~~~~~~~~~ +././include/linux/compiler_types.h:285:33: error: impossible constraint +in 'asm' + 285 | #define asm_volatile_goto(x...) asm goto(x) + | ^~~ +./arch/riscv/include/asm/jump_label.h:41:9: note: in expansion of macro +'asm_volatile_goto' + 41 | asm_volatile_goto( + | ^~~~~~~~~~~~~~~~~ +make[1]: *** [scripts/Makefile.build:249: +arch/riscv/kernel/vdso/vgettimeofday.o] Error 1 +make: *** [arch/riscv/Makefile:128: vdso_prepare] Error 2 + +Maybe "-Os" prevents GCC from detecting that the key/branch arguments +can be treated as constants and used as immediate operands. Inspired +by x86's commit 864b435514b2("x86/jump_label: Mark arguments as const to +satisfy asm constraints"), and as pointed out by Steven: "The "i" +constraint needs to be a constant.", let's do similar modifications to +riscv. + +Tested by CC_OPTIMIZE_FOR_SIZE + gcc and CC_OPTIMIZE_FOR_SIZE + clang. + +Link: https://lore.kernel.org/linux-riscv/20220922060958.44203-1-samuel@sholland.org/ +Link: https://lore.kernel.org/all/20210212094059.5f8d05e8@gandalf.local.home/ +Fixes: 8eb060e10185 ("arch/riscv: add Zihintpause support") +Reported-by: Samuel Holland +Signed-off-by: Jisheng Zhang +Reviewed-by: Andrew Jones +Tested-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20221008145437.491-1-jszhang@kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/jump_label.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/include/asm/jump_label.h b/arch/riscv/include/asm/jump_label.h +index 38af2ec7b9bf..6d58bbb5da46 100644 +--- a/arch/riscv/include/asm/jump_label.h ++++ b/arch/riscv/include/asm/jump_label.h +@@ -14,8 +14,8 @@ + + #define JUMP_LABEL_NOP_SIZE 4 + +-static __always_inline bool arch_static_branch(struct static_key *key, +- bool branch) ++static __always_inline bool arch_static_branch(struct static_key * const key, ++ const bool branch) + { + asm_volatile_goto( + " .option push \n\t" +@@ -35,8 +35,8 @@ static __always_inline bool arch_static_branch(struct static_key *key, + return true; + } + +-static __always_inline bool arch_static_branch_jump(struct static_key *key, +- bool branch) ++static __always_inline bool arch_static_branch_jump(struct static_key * const key, ++ const bool branch) + { + asm_volatile_goto( + " .option push \n\t" +-- +2.35.1 + diff --git a/queue-6.0/riscv-mm-add-missing-memcpy-in-kasan_init.patch b/queue-6.0/riscv-mm-add-missing-memcpy-in-kasan_init.patch new file mode 100644 index 00000000000..b643cd543ef --- /dev/null +++ b/queue-6.0/riscv-mm-add-missing-memcpy-in-kasan_init.patch @@ -0,0 +1,61 @@ +From 49fc7581eda99ed8d727efca4240d2cf6eb5b196 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Oct 2022 16:30:50 +0800 +Subject: riscv: mm: add missing memcpy in kasan_init + +From: Qinglin Pan + +[ Upstream commit 9f2ac64d6ca60db99132e08628ac2899f956a0ec ] + +Hi Atish, + +It seems that the panic is due to the missing memcpy during kasan_init. +Could you please check whether this patch is helpful? + +When doing kasan_populate, the new allocated base_pud/base_p4d should +contain kasan_early_shadow_{pud, p4d}'s content. Add the missing memcpy +to avoid page fault when read/write kasan shadow region. + +Tested on: + - qemu with sv57 and CONFIG_KASAN on. + - qemu with sv48 and CONFIG_KASAN on. + +Signed-off-by: Qinglin Pan +Tested-by: Atish Patra +Fixes: 8fbdccd2b173 ("riscv: mm: Support kasan for sv57") +Link: https://lore.kernel.org/r/20221009083050.3814850-1-panqinglin2020@iscas.ac.cn +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/mm/kasan_init.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/arch/riscv/mm/kasan_init.c b/arch/riscv/mm/kasan_init.c +index a22e418dbd82..e1226709490f 100644 +--- a/arch/riscv/mm/kasan_init.c ++++ b/arch/riscv/mm/kasan_init.c +@@ -113,6 +113,8 @@ static void __init kasan_populate_pud(pgd_t *pgd, + base_pud = pt_ops.get_pud_virt(pfn_to_phys(_pgd_pfn(*pgd))); + } else if (pgd_none(*pgd)) { + base_pud = memblock_alloc(PTRS_PER_PUD * sizeof(pud_t), PAGE_SIZE); ++ memcpy(base_pud, (void *)kasan_early_shadow_pud, ++ sizeof(pud_t) * PTRS_PER_PUD); + } else { + base_pud = (pud_t *)pgd_page_vaddr(*pgd); + if (base_pud == lm_alias(kasan_early_shadow_pud)) { +@@ -173,8 +175,11 @@ static void __init kasan_populate_p4d(pgd_t *pgd, + base_p4d = pt_ops.get_p4d_virt(pfn_to_phys(_pgd_pfn(*pgd))); + } else { + base_p4d = (p4d_t *)pgd_page_vaddr(*pgd); +- if (base_p4d == lm_alias(kasan_early_shadow_p4d)) ++ if (base_p4d == lm_alias(kasan_early_shadow_p4d)) { + base_p4d = memblock_alloc(PTRS_PER_PUD * sizeof(p4d_t), PAGE_SIZE); ++ memcpy(base_p4d, (void *)kasan_early_shadow_p4d, ++ sizeof(p4d_t) * PTRS_PER_P4D); ++ } + } + + p4dp = base_p4d + p4d_index(vaddr); +-- +2.35.1 + diff --git a/queue-6.0/sched-core-fix-comparison-in-sched_group_cookie_matc.patch b/queue-6.0/sched-core-fix-comparison-in-sched_group_cookie_matc.patch new file mode 100644 index 00000000000..3a4bc629e93 --- /dev/null +++ b/queue-6.0/sched-core-fix-comparison-in-sched_group_cookie_matc.patch @@ -0,0 +1,72 @@ +From a52aecf7149c9661d9d80a7602e72818263d9b3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Oct 2022 10:27:09 +0800 +Subject: sched/core: Fix comparison in sched_group_cookie_match() + +From: Lin Shengwang + +[ Upstream commit e705968dd687574b6ca3ebe772683d5642759132 ] + +In commit 97886d9dcd86 ("sched: Migration changes for core scheduling"), +sched_group_cookie_match() was added to help determine if a cookie +matches the core state. + +However, while it iterates the SMT group, it fails to actually use the +RQ for each of the CPUs iterated, use cpu_rq(cpu) instead of rq to fix +things. + +Fixes: 97886d9dcd86 ("sched: Migration changes for core scheduling") +Signed-off-by: Lin Shengwang +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20221008022709.642-1-linshengwang1@huawei.com +Signed-off-by: Sasha Levin +--- + kernel/sched/sched.h | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index e26688d387ae..f34b489636ff 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -1197,6 +1197,14 @@ static inline bool is_migration_disabled(struct task_struct *p) + #endif + } + ++DECLARE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); ++ ++#define cpu_rq(cpu) (&per_cpu(runqueues, (cpu))) ++#define this_rq() this_cpu_ptr(&runqueues) ++#define task_rq(p) cpu_rq(task_cpu(p)) ++#define cpu_curr(cpu) (cpu_rq(cpu)->curr) ++#define raw_rq() raw_cpu_ptr(&runqueues) ++ + struct sched_group; + #ifdef CONFIG_SCHED_CORE + static inline struct cpumask *sched_group_span(struct sched_group *sg); +@@ -1284,7 +1292,7 @@ static inline bool sched_group_cookie_match(struct rq *rq, + return true; + + for_each_cpu_and(cpu, sched_group_span(group), p->cpus_ptr) { +- if (sched_core_cookie_match(rq, p)) ++ if (sched_core_cookie_match(cpu_rq(cpu), p)) + return true; + } + return false; +@@ -1399,14 +1407,6 @@ static inline void update_idle_core(struct rq *rq) + static inline void update_idle_core(struct rq *rq) { } + #endif + +-DECLARE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); +- +-#define cpu_rq(cpu) (&per_cpu(runqueues, (cpu))) +-#define this_rq() this_cpu_ptr(&runqueues) +-#define task_rq(p) cpu_rq(task_cpu(p)) +-#define cpu_curr(cpu) (cpu_rq(cpu)->curr) +-#define raw_rq() raw_cpu_ptr(&runqueues) +- + #ifdef CONFIG_FAIR_GROUP_SCHED + static inline struct task_struct *task_of(struct sched_entity *se) + { +-- +2.35.1 + diff --git a/queue-6.0/selftests-ftrace-fix-dynamic_events-dependency-check.patch b/queue-6.0/selftests-ftrace-fix-dynamic_events-dependency-check.patch new file mode 100644 index 00000000000..272bae76525 --- /dev/null +++ b/queue-6.0/selftests-ftrace-fix-dynamic_events-dependency-check.patch @@ -0,0 +1,55 @@ +From 33c800bbd8a770dc48c83f9e66939ef503671917 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 09:42:07 +0200 +Subject: selftests/ftrace: fix dynamic_events dependency check + +From: Sven Schnelle + +[ Upstream commit cb05c81ada76a30a25a5f79b249375e33473af33 ] + +commit 95c104c378dc ("tracing: Auto generate event name when creating a +group of events") changed the syntax in the ftrace README file which is +used by the selftests to check what features are support. Adjust the +string to make test_duplicates.tc and trigger-synthetic-eprobe.tc work +again. + +Fixes: 95c104c378dc ("tracing: Auto generate event name when creating a group of events") +Signed-off-by: Sven Schnelle +Acked-by: Steven Rostedt (Google) +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + .../testing/selftests/ftrace/test.d/dynevent/test_duplicates.tc | 2 +- + .../test.d/trigger/inter-event/trigger-synthetic-eprobe.tc | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/ftrace/test.d/dynevent/test_duplicates.tc b/tools/testing/selftests/ftrace/test.d/dynevent/test_duplicates.tc +index db522577ff78..d3a79da215c8 100644 +--- a/tools/testing/selftests/ftrace/test.d/dynevent/test_duplicates.tc ++++ b/tools/testing/selftests/ftrace/test.d/dynevent/test_duplicates.tc +@@ -1,7 +1,7 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0 + # description: Generic dynamic event - check if duplicate events are caught +-# requires: dynamic_events "e[:[/]] . []":README ++# requires: dynamic_events "e[:[/][]] . []":README + + echo 0 > events/enable + +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-eprobe.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-eprobe.tc +index 914fe2e5d030..6461c375694f 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-eprobe.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-eprobe.tc +@@ -1,7 +1,7 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0 + # description: event trigger - test inter-event histogram trigger eprobe on synthetic event +-# requires: dynamic_events synthetic_events events/syscalls/sys_enter_openat/hist "e[:[/]] . []":README ++# requires: dynamic_events synthetic_events events/syscalls/sys_enter_openat/hist "e[:[/][]] . []":README + + echo 0 > events/enable + +-- +2.35.1 + diff --git a/queue-6.0/selftests-net-fix-cross-tree-inclusion-of-scripts.patch b/queue-6.0/selftests-net-fix-cross-tree-inclusion-of-scripts.patch new file mode 100644 index 00000000000..ed8ce08c7fc --- /dev/null +++ b/queue-6.0/selftests-net-fix-cross-tree-inclusion-of-scripts.patch @@ -0,0 +1,165 @@ +From 76d8a5a5a38c845a95923103d0c03f18e6268e13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 18:10:41 +0900 +Subject: selftests: net: Fix cross-tree inclusion of scripts + +From: Benjamin Poirier + +[ Upstream commit ae108c48b5d2b34bcef3c4fb5076f42c922c426a ] + +When exporting and running a subset of selftests via kselftest, files from +parts of the source tree which were not exported are not available. A few +tests are trying to source such files. Address the problem by using +symlinks. + +The problem can be reproduced by running: +make -C tools/testing/selftests gen_tar TARGETS="drivers/net/bonding" +[... extract archive ...] +./run_kselftest.sh + +or: +make kselftest KBUILD_OUTPUT=/tmp/kselftests TARGETS="drivers/net/bonding" + +Fixes: bbb774d921e2 ("net: Add tests for bonding and team address list management") +Fixes: eccd0a80dc7f ("selftests: net: dsa: add a stress test for unlocked FDB operations") +Link: https://lore.kernel.org/netdev/40f04ded-0c86-8669-24b1-9a313ca21076@redhat.com/ +Reported-by: Jonathan Toppins +Signed-off-by: Benjamin Poirier +Reviewed-by: Jonathan Toppins +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/drivers/net/bonding/Makefile | 4 +++- + tools/testing/selftests/drivers/net/bonding/dev_addr_lists.sh | 2 +- + .../selftests/drivers/net/bonding/net_forwarding_lib.sh | 1 + + .../selftests/drivers/net/dsa/test_bridge_fdb_stress.sh | 4 ++-- + tools/testing/selftests/drivers/net/team/Makefile | 4 ++++ + tools/testing/selftests/drivers/net/team/dev_addr_lists.sh | 4 ++-- + tools/testing/selftests/drivers/net/team/lag_lib.sh | 1 + + .../testing/selftests/drivers/net/team/net_forwarding_lib.sh | 1 + + tools/testing/selftests/lib.mk | 4 ++-- + 9 files changed, 17 insertions(+), 8 deletions(-) + create mode 120000 tools/testing/selftests/drivers/net/bonding/net_forwarding_lib.sh + create mode 120000 tools/testing/selftests/drivers/net/team/lag_lib.sh + create mode 120000 tools/testing/selftests/drivers/net/team/net_forwarding_lib.sh + +diff --git a/tools/testing/selftests/drivers/net/bonding/Makefile b/tools/testing/selftests/drivers/net/bonding/Makefile +index 1d866658e541..c61299c10e36 100644 +--- a/tools/testing/selftests/drivers/net/bonding/Makefile ++++ b/tools/testing/selftests/drivers/net/bonding/Makefile +@@ -5,6 +5,8 @@ TEST_PROGS := bond-break-lacpdu-tx.sh \ + dev_addr_lists.sh \ + bond-arp-interval-causes-panic.sh + +-TEST_FILES := lag_lib.sh ++TEST_FILES := \ ++ lag_lib.sh \ ++ net_forwarding_lib.sh + + include ../../../lib.mk +diff --git a/tools/testing/selftests/drivers/net/bonding/dev_addr_lists.sh b/tools/testing/selftests/drivers/net/bonding/dev_addr_lists.sh +index e6fa24eded5b..5cfe7d8ebc25 100755 +--- a/tools/testing/selftests/drivers/net/bonding/dev_addr_lists.sh ++++ b/tools/testing/selftests/drivers/net/bonding/dev_addr_lists.sh +@@ -14,7 +14,7 @@ ALL_TESTS=" + REQUIRE_MZ=no + NUM_NETIFS=0 + lib_dir=$(dirname "$0") +-source "$lib_dir"/../../../net/forwarding/lib.sh ++source "$lib_dir"/net_forwarding_lib.sh + + source "$lib_dir"/lag_lib.sh + +diff --git a/tools/testing/selftests/drivers/net/bonding/net_forwarding_lib.sh b/tools/testing/selftests/drivers/net/bonding/net_forwarding_lib.sh +new file mode 120000 +index 000000000000..39c96828c5ef +--- /dev/null ++++ b/tools/testing/selftests/drivers/net/bonding/net_forwarding_lib.sh +@@ -0,0 +1 @@ ++../../../net/forwarding/lib.sh +\ No newline at end of file +diff --git a/tools/testing/selftests/drivers/net/dsa/test_bridge_fdb_stress.sh b/tools/testing/selftests/drivers/net/dsa/test_bridge_fdb_stress.sh +index dca8be6092b9..a1f269ee84da 100755 +--- a/tools/testing/selftests/drivers/net/dsa/test_bridge_fdb_stress.sh ++++ b/tools/testing/selftests/drivers/net/dsa/test_bridge_fdb_stress.sh +@@ -18,8 +18,8 @@ NUM_NETIFS=1 + REQUIRE_JQ="no" + REQUIRE_MZ="no" + NETIF_CREATE="no" +-lib_dir=$(dirname $0)/../../../net/forwarding +-source $lib_dir/lib.sh ++lib_dir=$(dirname "$0") ++source "$lib_dir"/lib.sh + + cleanup() { + echo "Cleaning up" +diff --git a/tools/testing/selftests/drivers/net/team/Makefile b/tools/testing/selftests/drivers/net/team/Makefile +index 642d8df1c137..6a86e61e8bfe 100644 +--- a/tools/testing/selftests/drivers/net/team/Makefile ++++ b/tools/testing/selftests/drivers/net/team/Makefile +@@ -3,4 +3,8 @@ + + TEST_PROGS := dev_addr_lists.sh + ++TEST_FILES := \ ++ lag_lib.sh \ ++ net_forwarding_lib.sh ++ + include ../../../lib.mk +diff --git a/tools/testing/selftests/drivers/net/team/dev_addr_lists.sh b/tools/testing/selftests/drivers/net/team/dev_addr_lists.sh +index debda7262956..9684163949f0 100755 +--- a/tools/testing/selftests/drivers/net/team/dev_addr_lists.sh ++++ b/tools/testing/selftests/drivers/net/team/dev_addr_lists.sh +@@ -11,9 +11,9 @@ ALL_TESTS=" + REQUIRE_MZ=no + NUM_NETIFS=0 + lib_dir=$(dirname "$0") +-source "$lib_dir"/../../../net/forwarding/lib.sh ++source "$lib_dir"/net_forwarding_lib.sh + +-source "$lib_dir"/../bonding/lag_lib.sh ++source "$lib_dir"/lag_lib.sh + + + destroy() +diff --git a/tools/testing/selftests/drivers/net/team/lag_lib.sh b/tools/testing/selftests/drivers/net/team/lag_lib.sh +new file mode 120000 +index 000000000000..e1347a10afde +--- /dev/null ++++ b/tools/testing/selftests/drivers/net/team/lag_lib.sh +@@ -0,0 +1 @@ ++../bonding/lag_lib.sh +\ No newline at end of file +diff --git a/tools/testing/selftests/drivers/net/team/net_forwarding_lib.sh b/tools/testing/selftests/drivers/net/team/net_forwarding_lib.sh +new file mode 120000 +index 000000000000..39c96828c5ef +--- /dev/null ++++ b/tools/testing/selftests/drivers/net/team/net_forwarding_lib.sh +@@ -0,0 +1 @@ ++../../../net/forwarding/lib.sh +\ No newline at end of file +diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk +index 9d4cb94cf437..a3ea3d4a206d 100644 +--- a/tools/testing/selftests/lib.mk ++++ b/tools/testing/selftests/lib.mk +@@ -70,7 +70,7 @@ endef + run_tests: all + ifdef building_out_of_srctree + @if [ "X$(TEST_PROGS)$(TEST_PROGS_EXTENDED)$(TEST_FILES)" != "X" ]; then \ +- rsync -aq $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(OUTPUT); \ ++ rsync -aLq $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(OUTPUT); \ + fi + @if [ "X$(TEST_PROGS)" != "X" ]; then \ + $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) \ +@@ -84,7 +84,7 @@ endif + + define INSTALL_SINGLE_RULE + $(if $(INSTALL_LIST),@mkdir -p $(INSTALL_PATH)) +- $(if $(INSTALL_LIST),rsync -a $(INSTALL_LIST) $(INSTALL_PATH)/) ++ $(if $(INSTALL_LIST),rsync -aL $(INSTALL_LIST) $(INSTALL_PATH)/) + endef + + define INSTALL_RULE +-- +2.35.1 + diff --git a/queue-6.0/selftests-net-fix-netdev-name-mismatch-in-cleanup.patch b/queue-6.0/selftests-net-fix-netdev-name-mismatch-in-cleanup.patch new file mode 100644 index 00000000000..061a757f8f9 --- /dev/null +++ b/queue-6.0/selftests-net-fix-netdev-name-mismatch-in-cleanup.patch @@ -0,0 +1,38 @@ +From f03186b814017427270d1b4ad160184a2b18534b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 18:10:42 +0900 +Subject: selftests: net: Fix netdev name mismatch in cleanup + +From: Benjamin Poirier + +[ Upstream commit b2c0921b926ca69cc399eb356162f35340598112 ] + +lag_lib.sh creates the interfaces dummy1 and dummy2 whereas +dev_addr_lists.sh:destroy() deletes the interfaces dummy0 and dummy1. Fix +the mismatch in names. + +Fixes: bbb774d921e2 ("net: Add tests for bonding and team address list management") +Signed-off-by: Benjamin Poirier +Reviewed-by: Jonathan Toppins +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/drivers/net/team/dev_addr_lists.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/drivers/net/team/dev_addr_lists.sh b/tools/testing/selftests/drivers/net/team/dev_addr_lists.sh +index 9684163949f0..33913112d5ca 100755 +--- a/tools/testing/selftests/drivers/net/team/dev_addr_lists.sh ++++ b/tools/testing/selftests/drivers/net/team/dev_addr_lists.sh +@@ -18,7 +18,7 @@ source "$lib_dir"/lag_lib.sh + + destroy() + { +- local ifnames=(dummy0 dummy1 team0 mv0) ++ local ifnames=(dummy1 dummy2 team0 mv0) + local ifname + + for ifname in "${ifnames[@]}"; do +-- +2.35.1 + diff --git a/queue-6.0/series b/queue-6.0/series index 4b729c5373c..b7aa9a3e929 100644 --- a/queue-6.0/series +++ b/queue-6.0/series @@ -106,3 +106,136 @@ fbdev-core-avoid-uninitialized-read-in-aperture_remove_conflicting_pci_device.pa acpi-pcc-fix-unintentional-integer-overflow.patch powerpc-64s-interrupt-fix-clear-of-paca_irqs_hard_dis-when-returning-to-soft-masked-context.patch net-ieee802154-fix-error-return-code-in-dgram_bind.patch +media-amphion-release-m2m-ctx-when-releasing-vpu-ins.patch +media-v4l2-fix-v4l2_i2c_subdev_set_name-function-doc.patch +media-ar0521-fix-error-return-code-in-ar0521_power_o.patch +media-ov8865-fix-an-error-handling-path-in-ov8865_pr.patch +media-sun6i-mipi-csi2-depend-on-phy_sun6i_mipi_dphy.patch +media-atomisp-prevent-integer-overflow-in-sh_css_set.patch +media-sunxi-fix-some-error-handling-path-of-sun8i_a8.patch +media-sunxi-fix-some-error-handling-path-of-sun6i_mi.patch +media-sun6i-mipi-csi2-add-a-kconfig-dependency-on-re.patch +media-sun8i-a83t-mipi-csi2-add-a-kconfig-dependency-.patch +media-sun6i-csi-add-a-kconfig-dependency-on-reset_co.patch +media-sun4i-csi-add-a-kconfig-dependency-on-reset_co.patch +media-sun8i-di-add-a-kconfig-dependency-on-reset_con.patch +media-sun8i-rotate-add-a-kconfig-dependency-on-reset.patch +media-cedrus-add-a-kconfig-dependency-on-reset_contr.patch +drm-msm-a6xx-replace-kcalloc-with-kvzalloc.patch +drm-msm-dp-add-atomic_check-to-bridge-ops.patch +drm-msm-fix-return-type-of-mdp4_lvds_connector_mode_.patch +drm-msm-dp-cleared-dp_downspread_ctrl-register-befor.patch +kvm-arm64-selftests-fix-multiple-versions-of-gic-cre.patch +asoc-codec-tlv320adc3xxx-add-gpiolib-dependency.patch +kvm-selftests-fix-number-of-pages-for-memory-slot-in.patch +asoc-qcom-lpass-cpu-mark-hdmi-tx-registers-as-volati.patch +drm-msm-a6xx-fix-kvzalloc-vs-state_kcalloc-usage.patch +erofs-fix-illegal-unmapped-accesses-in-z_erofs_fill_.patch +erofs-fix-up-inplace-decompression-success-rate.patch +powerpc-selftests-use-timersub-for-gettimeofday.patch +pinctrl-qcom-avoid-glitching-lines-when-we-first-mux.patch +spi-qup-support-using-gpio-as-chip-select-line.patch +x86-fpu-configure-init_fpstate-attributes-orderly.patch +x86-fpu-fix-the-init_fpstate-size-check-with-the-act.patch +x86-fpu-exclude-dynamic-states-from-init_fpstate.patch +perf-fix-missing-sigtraps.patch +sched-core-fix-comparison-in-sched_group_cookie_matc.patch +bpf-prevent-decl_tag-from-being-referenced-in-func_p.patch +arc-iounmap-arg-is-volatile.patch +mtd-core-add-missing-of_node_get-in-dynamic-partitio.patch +mtd-rawnand-intel-remove-unused-nand_pa-member-from-.patch +mtd-rawnand-intel-use-devm_platform_ioremap_resource.patch +mtd-rawnand-intel-add-missing-of_node_put-in-ebu_nan.patch +pinctrl-ocelot-fix-incorrect-trigger-of-the-interrup.patch +asoc-codecs-tlv320adc3xxx-wrap-adc3xxx_i2c_remove-in.patch +asoc-sof-intel-pci-mtl-fix-firmware-name.patch +selftests-ftrace-fix-dynamic_events-dependency-check.patch +spi-aspeed-fix-window-offset-of-ce1.patch +asoc-qcom-lpass-cpu-mark-hdmi-tx-parity-register-as-.patch +asoc-intel-common-add-acpi-matching-tables-for-rapto.patch +asoc-sof-intel-pci-tgl-use-rpl-specific-firmware-def.patch +asoc-sof-intel-pci-tgl-fix-adl-n-descriptor.patch +alsa-ac97-fix-possible-memory-leak-in-snd_ac97_dev_r.patch +perf-x86-intel-lbr-use-setup_clear_cpu_cap-instead-o.patch +rcu-keep-synchronize_rcu-from-enabling-irqs-in-early.patch +tipc-fix-a-null-ptr-deref-in-tipc_topsrv_accept.patch +net-netsec-fix-error-handling-in-netsec_register_mdi.patch +net-lan966x-fix-the-rx-drop-counter.patch +selftests-net-fix-cross-tree-inclusion-of-scripts.patch +selftests-net-fix-netdev-name-mismatch-in-cleanup.patch +net-hinic-fix-incorrect-assignment-issue-in-hinic_se.patch +net-hinic-fix-memory-leak-when-reading-function-tabl.patch +net-hinic-fix-the-issue-of-cmdq-memory-leaks.patch +net-hinic-fix-the-issue-of-double-release-mbox-callb.patch +net-macb-specify-phy-pm-management-done-by-mac.patch +nfc-virtual_ncidev-fix-memory-leak-in-virtual_nci_se.patch +risc-v-kvm-provide-uapi-for-zicbom-block-size.patch +risc-v-fix-compilation-without-riscv_isa_zicbom.patch +risc-v-kvm-fix-kvm_riscv_vcpu_timer_pending-for-sstc.patch +x86-unwind-orc-fix-unreliable-stack-dump-with-gcov.patch +drm-bridge-ps8640-add-back-the-50-ms-mystery-delay-a.patch +x86-fpu-fix-copy_xstate_to_uabi-to-copy-init-states-.patch +amd-xgbe-yellow-carp-devices-do-not-need-rrc.patch +amd-xgbe-fix-the-sfp-compliance-codes-check-for-dac-.patch +amd-xgbe-add-the-bit-rate-quirk-for-molex-cables.patch +drm-i915-dgfx-keep-pci-autosuspend-control-on-by-def.patch +drm-i915-dp-reset-frl-trained-flag-before-restarting.patch +atlantic-fix-deadlock-at-aq_nic_stop.patch +kcm-annotate-data-races-around-kcm-rx_psock.patch +kcm-annotate-data-races-around-kcm-rx_wait.patch +net-fix-uaf-issue-in-nfqnl_nf_hook_drop-when-ops_ini.patch +net-lantiq_etop-don-t-free-skb-when-returning-netdev.patch +tcp-fix-a-signed-integer-overflow-bug-in-tcp_add_bac.patch +tcp-fix-indefinite-deferral-of-rto-with-sack-renegin.patch +net-memcg-avoid-stalls-when-under-memory-pressure.patch +drm-amdkfd-fix-memory-leak-in-kfd_mem_dmamap_userptr.patch +net-lan966x-stop-replacing-tx-dcbs-and-dcbs_buf-when.patch +mptcp-set-msk-local-address-earlier.patch +can-mscan-mpc5xxx-mpc5xxx_can_probe-add-missing-put_.patch +can-mcp251x-mcp251x_can_probe-add-missing-unregister.patch +pm-hibernate-allow-hybrid-sleep-to-work-with-s2idle.patch +media-vivid-s_fbuf-add-more-sanity-checks.patch +media-vivid-dev-bitmap_cap-wasn-t-freed-in-all-cases.patch +media-v4l2-dv-timings-add-sanity-checks-for-blanking.patch +media-videodev2.h-v4l2_dv_bt_blanking_height-should-.patch +media-vivid-set-num_in-outputs-to-0-if-not-supported.patch +perf-vendor-events-power10-fix-hv-24x7-metric-events.patch +perf-list-fix-pmu-name-pai_crypto-in-perf-list-on-s3.patch +ipv6-ensure-sane-device-mtu-in-tunnels.patch +i40e-fix-ethtool-rx-flow-hash-setting-for-x722.patch +i40e-fix-vf-hang-when-reset-is-triggered-on-another-.patch +i40e-fix-flow-type-by-setting-gl_hash_inset-register.patch +net-ksz884x-fix-missing-pci_disable_device-on-error-.patch +riscv-jump_label-mark-arguments-as-const-to-satisfy-.patch +pm-domains-fix-handling-of-unavailable-disabled-idle.patch +perf-vendor-events-arm64-fix-incorrect-hisi-hip08-l3.patch +net-fec-limit-register-access-on-i.mx6ul.patch +net-ethernet-ave-fix-mac-to-be-in-charge-of-phy-pm.patch +alsa-aoa-i2sbus-fix-possible-memory-leak-in-i2sbus_a.patch +alsa-aoa-fix-i2s-device-accounting.patch +openvswitch-switch-from-warn-to-pr_warn.patch +net-ehea-fix-possible-memory-leak-in-ehea_register_p.patch +net-bcmsysport-indicate-mac-is-in-charge-of-phy-pm.patch +nh-fix-scope-used-to-find-saddr-when-adding-non-gw-n.patch +net-broadcom-bcm4908_enet-update-tx-stats-after-actu.patch +netdevsim-fix-memory-leak-in-nsim_bus_dev_new.patch +netdevsim-fix-memory-leak-in-nsim_drv_probe-when-nsi.patch +netdevsim-remove-dir-in-nsim_dev_debugfs_init-when-c.patch +net-mlx5e-do-not-increment-esn-when-updating-ipsec-e.patch +net-mlx5-wait-for-firmware-to-enable-crs-before-pci_.patch +net-mlx5-dr-fix-matcher-disconnect-error-flow.patch +net-mlx5e-extend-skb-room-check-to-include-ptp-sq.patch +net-mlx5e-update-restore-chain-id-for-slow-path-pack.patch +net-mlx5-aso-create-the-aso-sq-with-the-correct-time.patch +net-mlx5-fix-possible-use-after-free-in-async-comman.patch +net-mlx5e-tc-reject-forwarding-from-internal-port-to.patch +net-mlx5e-tc-fix-cloned-flow-attr-instance-dests-are.patch +net-mlx5-update-fw-fatal-reporter-state-on-pci-handl.patch +net-mlx5-fix-crash-during-sync-firmware-reset.patch +net-do-not-sense-pfmemalloc-status-in-skb_append_pag.patch +kcm-do-not-sense-pfmemalloc-status-in-kcm_sendpage.patch +net-enetc-survive-memory-pressure-without-crashing.patch +riscv-mm-add-missing-memcpy-in-kasan_init.patch +riscv-fix-detection-of-toolchain-zicbom-support.patch +riscv-fix-detection-of-toolchain-zihintpause-support.patch +arm64-add-ampere1-to-the-spectre-bhb-affected-list.patch diff --git a/queue-6.0/spi-aspeed-fix-window-offset-of-ce1.patch b/queue-6.0/spi-aspeed-fix-window-offset-of-ce1.patch new file mode 100644 index 00000000000..f309757d3cf --- /dev/null +++ b/queue-6.0/spi-aspeed-fix-window-offset-of-ce1.patch @@ -0,0 +1,44 @@ +From 592115c785329f9ae9e6d72832bd0c78e281b8f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Oct 2022 17:57:22 +0200 +Subject: spi: aspeed: Fix window offset of CE1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cédric Le Goater + +[ Upstream commit f8aa6c895d482847c9b799dcdac8bbdb56cb8e04 ] + +The offset value of the mapping window in the kernel structure is +calculated using the value of the previous window offset. This doesn't +reflect how the HW is configured and can lead to erroneous setting of +the second flash device (CE1). + +Cc: Chin-Ting Kuo +Fixes: e3228ed92893 ("spi: spi-mem: Convert Aspeed SMC driver to spi-mem") +Signed-off-by: Cédric Le Goater +Reviewed-by: Joel Stanley +Link: https://lore.kernel.org/r/20221016155722.3520802-1-clg@kaod.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-aspeed-smc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-aspeed-smc.c b/drivers/spi/spi-aspeed-smc.c +index 3e891bf22470..5a995b5653f1 100644 +--- a/drivers/spi/spi-aspeed-smc.c ++++ b/drivers/spi/spi-aspeed-smc.c +@@ -398,7 +398,7 @@ static void aspeed_spi_get_windows(struct aspeed_spi *aspi, + windows[cs].cs = cs; + windows[cs].size = data->segment_end(aspi, reg_val) - + data->segment_start(aspi, reg_val); +- windows[cs].offset = cs ? windows[cs - 1].offset + windows[cs - 1].size : 0; ++ windows[cs].offset = data->segment_start(aspi, reg_val) - aspi->ahb_base_phy; + dev_vdbg(aspi->dev, "CE%d offset=0x%.8x size=0x%x\n", cs, + windows[cs].offset, windows[cs].size); + } +-- +2.35.1 + diff --git a/queue-6.0/spi-qup-support-using-gpio-as-chip-select-line.patch b/queue-6.0/spi-qup-support-using-gpio-as-chip-select-line.patch new file mode 100644 index 00000000000..ba1e4eab2ae --- /dev/null +++ b/queue-6.0/spi-qup-support-using-gpio-as-chip-select-line.patch @@ -0,0 +1,47 @@ +From 9506c74f56bccca8bac58f17a03084942ef4a7cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Oct 2022 21:48:19 +0200 +Subject: spi: qup: support using GPIO as chip select line + +From: Robert Marko + +[ Upstream commit b40af6183b685b0cf7870987b858de0d48db9ea0 ] + +Most of the device with QUP SPI adapter are actually using GPIO-s for +chip select. + +However, this stopped working after ("spi: Retire legacy GPIO handling") +as it introduced a check on ->use_gpio_descriptors flag and since spi-qup +driver does not set the flag it meant that all of boards using GPIO-s and +with QUP adapter SPI devices stopped working. + +So, to enable using GPIO-s again set ->use_gpio_descriptors to true and +populate ->max_native_cs. + +Fixes: f48dc6b96649 ("spi: Retire legacy GPIO handling") +Signed-off-by: Robert Marko +Cc: luka.perkov@sartura.hr +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20221006194819.1536932-1-robert.marko@sartura.hr +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-qup.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c +index 7d89510dc3f0..678dc51ef017 100644 +--- a/drivers/spi/spi-qup.c ++++ b/drivers/spi/spi-qup.c +@@ -1057,6 +1057,8 @@ static int spi_qup_probe(struct platform_device *pdev) + else + master->num_chipselect = num_cs; + ++ master->use_gpio_descriptors = true; ++ master->max_native_cs = SPI_NUM_CHIPSELECTS; + master->bus_num = pdev->id; + master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LOOP; + master->bits_per_word_mask = SPI_BPW_RANGE_MASK(4, 32); +-- +2.35.1 + diff --git a/queue-6.0/tcp-fix-a-signed-integer-overflow-bug-in-tcp_add_bac.patch b/queue-6.0/tcp-fix-a-signed-integer-overflow-bug-in-tcp_add_bac.patch new file mode 100644 index 00000000000..fb03f7ee4cc --- /dev/null +++ b/queue-6.0/tcp-fix-a-signed-integer-overflow-bug-in-tcp_add_bac.patch @@ -0,0 +1,48 @@ +From 8c8e5dc4401723160d00f35bde77e51f109a144b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Oct 2022 12:06:22 +0800 +Subject: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() + +From: Lu Wei + +[ Upstream commit ec791d8149ff60c40ad2074af3b92a39c916a03f ] + +The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and +in tcp_add_backlog(), the variable limit is caculated by adding +sk_rcvbuf, sk_sndbuf and 64 * 1024, it may exceed the max value +of int and overflow. This patch reduces the limit budget by +halving the sndbuf to solve this issue since ACK packets are much +smaller than the payload. + +Fixes: c9c3321257e1 ("tcp: add tcp_add_backlog()") +Signed-off-by: Lu Wei +Reviewed-by: Eric Dumazet +Acked-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_ipv4.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 5b019ba2b9d2..fe9a6022db66 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -1853,11 +1853,13 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb, + __skb_push(skb, hdrlen); + + no_coalesce: ++ limit = (u32)READ_ONCE(sk->sk_rcvbuf) + (u32)(READ_ONCE(sk->sk_sndbuf) >> 1); ++ + /* Only socket owner can try to collapse/prune rx queues + * to reduce memory overhead, so add a little headroom here. + * Few sockets backlog are possibly concurrently non empty. + */ +- limit = READ_ONCE(sk->sk_rcvbuf) + READ_ONCE(sk->sk_sndbuf) + 64*1024; ++ limit += 64 * 1024; + + if (unlikely(sk_add_backlog(sk, skb, limit))) { + bh_unlock_sock(sk); +-- +2.35.1 + diff --git a/queue-6.0/tcp-fix-indefinite-deferral-of-rto-with-sack-renegin.patch b/queue-6.0/tcp-fix-indefinite-deferral-of-rto-with-sack-renegin.patch new file mode 100644 index 00000000000..7136dc5dc3e --- /dev/null +++ b/queue-6.0/tcp-fix-indefinite-deferral-of-rto-with-sack-renegin.patch @@ -0,0 +1,65 @@ +From 4ac1337d203898134c3ae6ddbe249078cd36b4db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Oct 2022 17:08:21 +0000 +Subject: tcp: fix indefinite deferral of RTO with SACK reneging + +From: Neal Cardwell + +[ Upstream commit 3d2af9cce3133b3bc596a9d065c6f9d93419ccfb ] + +This commit fixes a bug that can cause a TCP data sender to repeatedly +defer RTOs when encountering SACK reneging. + +The bug is that when we're in fast recovery in a scenario with SACK +reneging, every time we get an ACK we call tcp_check_sack_reneging() +and it can note the apparent SACK reneging and rearm the RTO timer for +srtt/2 into the future. In some SACK reneging scenarios that can +happen repeatedly until the receive window fills up, at which point +the sender can't send any more, the ACKs stop arriving, and the RTO +fires at srtt/2 after the last ACK. But that can take far too long +(O(10 secs)), since the connection is stuck in fast recovery with a +low cwnd that cannot grow beyond ssthresh, even if more bandwidth is +available. + +This fix changes the logic in tcp_check_sack_reneging() to only rearm +the RTO timer if data is cumulatively ACKed, indicating forward +progress. This avoids this kind of nearly infinite loop of RTO timer +re-arming. In addition, this meets the goals of +tcp_check_sack_reneging() in handling Windows TCP behavior that looks +temporarily like SACK reneging but is not really. + +Many thanks to Jakub Kicinski and Neil Spring, who reported this issue +and provided critical packet traces that enabled root-causing this +issue. Also, many thanks to Jakub Kicinski for testing this fix. + +Fixes: 5ae344c949e7 ("tcp: reduce spurious retransmits due to transient SACK reneging") +Reported-by: Jakub Kicinski +Reported-by: Neil Spring +Signed-off-by: Neal Cardwell +Reviewed-by: Eric Dumazet +Cc: Yuchung Cheng +Tested-by: Jakub Kicinski +Link: https://lore.kernel.org/r/20221021170821.1093930-1-ncardwell.kernel@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index bc2ea12221f9..0640453fce54 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2192,7 +2192,8 @@ void tcp_enter_loss(struct sock *sk) + */ + static bool tcp_check_sack_reneging(struct sock *sk, int flag) + { +- if (flag & FLAG_SACK_RENEGING) { ++ if (flag & FLAG_SACK_RENEGING && ++ flag & FLAG_SND_UNA_ADVANCED) { + struct tcp_sock *tp = tcp_sk(sk); + unsigned long delay = max(usecs_to_jiffies(tp->srtt_us >> 4), + msecs_to_jiffies(10)); +-- +2.35.1 + diff --git a/queue-6.0/tipc-fix-a-null-ptr-deref-in-tipc_topsrv_accept.patch b/queue-6.0/tipc-fix-a-null-ptr-deref-in-tipc_topsrv_accept.patch new file mode 100644 index 00000000000..aa1b3116ec5 --- /dev/null +++ b/queue-6.0/tipc-fix-a-null-ptr-deref-in-tipc_topsrv_accept.patch @@ -0,0 +1,98 @@ +From 6726a750e4819e88644e13e3c3c6e13149bbad7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 15:19:50 -0400 +Subject: tipc: fix a null-ptr-deref in tipc_topsrv_accept + +From: Xin Long + +[ Upstream commit 82cb4e4612c633a9ce320e1773114875604a3cce ] + +syzbot found a crash in tipc_topsrv_accept: + + KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] + Workqueue: tipc_rcv tipc_topsrv_accept + RIP: 0010:kernel_accept+0x22d/0x350 net/socket.c:3487 + Call Trace: + + tipc_topsrv_accept+0x197/0x280 net/tipc/topsrv.c:460 + process_one_work+0x991/0x1610 kernel/workqueue.c:2289 + worker_thread+0x665/0x1080 kernel/workqueue.c:2436 + kthread+0x2e4/0x3a0 kernel/kthread.c:376 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 + +It was caused by srv->listener that might be set to null by +tipc_topsrv_stop() in net .exit whereas it's still used in +tipc_topsrv_accept() worker. + +srv->listener is protected by srv->idr_lock in tipc_topsrv_stop(), so add +a check for srv->listener under srv->idr_lock in tipc_topsrv_accept() to +avoid the null-ptr-deref. To ensure the lsock is not released during the +tipc_topsrv_accept(), move sock_release() after tipc_topsrv_work_stop() +where it's waiting until the tipc_topsrv_accept worker to be done. + +Note that sk_callback_lock is used to protect sk->sk_user_data instead of +srv->listener, and it should check srv in tipc_topsrv_listener_data_ready() +instead. This also ensures that no more tipc_topsrv_accept worker will be +started after tipc_conn_close() is called in tipc_topsrv_stop() where it +sets sk->sk_user_data to null. + +Fixes: 0ef897be12b8 ("tipc: separate topology server listener socket from subcsriber sockets") +Reported-by: syzbot+c5ce866a8d30f4be0651@syzkaller.appspotmail.com +Signed-off-by: Xin Long +Acked-by: Jon Maloy +Link: https://lore.kernel.org/r/4eee264380c409c61c6451af1059b7fb271a7e7b.1666120790.git.lucien.xin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tipc/topsrv.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c +index 14fd05fd6107..d92ec92f0b71 100644 +--- a/net/tipc/topsrv.c ++++ b/net/tipc/topsrv.c +@@ -450,12 +450,19 @@ static void tipc_conn_data_ready(struct sock *sk) + static void tipc_topsrv_accept(struct work_struct *work) + { + struct tipc_topsrv *srv = container_of(work, struct tipc_topsrv, awork); +- struct socket *lsock = srv->listener; +- struct socket *newsock; ++ struct socket *newsock, *lsock; + struct tipc_conn *con; + struct sock *newsk; + int ret; + ++ spin_lock_bh(&srv->idr_lock); ++ if (!srv->listener) { ++ spin_unlock_bh(&srv->idr_lock); ++ return; ++ } ++ lsock = srv->listener; ++ spin_unlock_bh(&srv->idr_lock); ++ + while (1) { + ret = kernel_accept(lsock, &newsock, O_NONBLOCK); + if (ret < 0) +@@ -489,7 +496,7 @@ static void tipc_topsrv_listener_data_ready(struct sock *sk) + + read_lock_bh(&sk->sk_callback_lock); + srv = sk->sk_user_data; +- if (srv->listener) ++ if (srv) + queue_work(srv->rcv_wq, &srv->awork); + read_unlock_bh(&sk->sk_callback_lock); + } +@@ -699,8 +706,9 @@ static void tipc_topsrv_stop(struct net *net) + __module_get(lsock->sk->sk_prot_creator->owner); + srv->listener = NULL; + spin_unlock_bh(&srv->idr_lock); +- sock_release(lsock); ++ + tipc_topsrv_work_stop(srv); ++ sock_release(lsock); + idr_destroy(&srv->conn_idr); + kfree(srv); + } +-- +2.35.1 + diff --git a/queue-6.0/x86-fpu-configure-init_fpstate-attributes-orderly.patch b/queue-6.0/x86-fpu-configure-init_fpstate-attributes-orderly.patch new file mode 100644 index 00000000000..c1d6fb47183 --- /dev/null +++ b/queue-6.0/x86-fpu-configure-init_fpstate-attributes-orderly.patch @@ -0,0 +1,77 @@ +From 1df10a9215f550ebebf07c2d115a998fde19ace5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 12:12:21 -0700 +Subject: x86/fpu: Configure init_fpstate attributes orderly + +From: Chang S. Bae + +[ Upstream commit c32d7cab57e3a77af8ecc17cde7a5761a26483b8 ] + +The init_fpstate setup code is spread out and out of order. The init image +is recorded before its scoped features and the buffer size are determined. + +Determine the scope of init_fpstate components and its size before +recording the init state. Also move the relevant code together. + +Signed-off-by: Chang S. Bae +Signed-off-by: Thomas Gleixner +Acked-by: neelnatu@google.com +Link: https://lore.kernel.org/r/20220824191223.1248-2-chang.seok.bae@intel.com +Stable-dep-of: d3e021adac7c ("x86/fpu: Fix the init_fpstate size check with the actual size") +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/fpu/init.c | 8 -------- + arch/x86/kernel/fpu/xstate.c | 6 +++++- + 2 files changed, 5 insertions(+), 9 deletions(-) + +diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c +index 621f4b6cac4a..8946f89761cc 100644 +--- a/arch/x86/kernel/fpu/init.c ++++ b/arch/x86/kernel/fpu/init.c +@@ -210,13 +210,6 @@ static void __init fpu__init_system_xstate_size_legacy(void) + fpstate_reset(¤t->thread.fpu); + } + +-static void __init fpu__init_init_fpstate(void) +-{ +- /* Bring init_fpstate size and features up to date */ +- init_fpstate.size = fpu_kernel_cfg.max_size; +- init_fpstate.xfeatures = fpu_kernel_cfg.max_features; +-} +- + /* + * Called on the boot CPU once per system bootup, to set up the initial + * FPU state that is later cloned into all processes: +@@ -236,5 +229,4 @@ void __init fpu__init_system(struct cpuinfo_x86 *c) + fpu__init_system_xstate_size_legacy(); + fpu__init_system_xstate(fpu_kernel_cfg.max_size); + fpu__init_task_struct_size(); +- fpu__init_init_fpstate(); + } +diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c +index c8340156bfd2..f0ce10620ab0 100644 +--- a/arch/x86/kernel/fpu/xstate.c ++++ b/arch/x86/kernel/fpu/xstate.c +@@ -360,7 +360,7 @@ static void __init setup_init_fpu_buf(void) + + print_xstate_features(); + +- xstate_init_xcomp_bv(&init_fpstate.regs.xsave, fpu_kernel_cfg.max_features); ++ xstate_init_xcomp_bv(&init_fpstate.regs.xsave, init_fpstate.xfeatures); + + /* + * Init all the features state with header.xfeatures being 0x0 +@@ -875,6 +875,10 @@ void __init fpu__init_system_xstate(unsigned int legacy_size) + update_regset_xstate_info(fpu_user_cfg.max_size, + fpu_user_cfg.max_features); + ++ /* Bring init_fpstate size and features up to date */ ++ init_fpstate.size = fpu_kernel_cfg.max_size; ++ init_fpstate.xfeatures = fpu_kernel_cfg.max_features; ++ + setup_init_fpu_buf(); + + /* +-- +2.35.1 + diff --git a/queue-6.0/x86-fpu-exclude-dynamic-states-from-init_fpstate.patch b/queue-6.0/x86-fpu-exclude-dynamic-states-from-init_fpstate.patch new file mode 100644 index 00000000000..13979c2b194 --- /dev/null +++ b/queue-6.0/x86-fpu-exclude-dynamic-states-from-init_fpstate.patch @@ -0,0 +1,81 @@ +From 12a8e22274e22a16b615eec0c89608d7b577e5ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 12:12:23 -0700 +Subject: x86/fpu: Exclude dynamic states from init_fpstate + +From: Chang S. Bae + +[ Upstream commit a401f45e38754953c9d402f8b3bc965707eecc91 ] + +== Background == + +The XSTATE init code initializes all enabled and supported components. +Then, the init states are saved in the init_fpstate buffer that is +statically allocated in about one page. + +The AMX TILE_DATA state is large (8KB) but its init state is zero. And the +feature comes only with the compacted format with these established +dependencies: AMX->XFD->XSAVES. So this state is excludable from +init_fpstate. + +== Problem == + +But the buffer is formatted to include that large state. Then, this can be +the cause of a noisy splat like the below. + +This came from XRSTORS for the task with init_fpstate in its XSAVE buffer. +It is reproducible on AMX systems when the running kernel is built with +CONFIG_DEBUG_PAGEALLOC=y and CONFIG_DEBUG_PAGEALLOC_ENABLE_DEFAULT=y: + + Bad FPU state detected at restore_fpregs_from_fpstate+0x57/0xd0, reinitializing FPU registers. + ... + RIP: 0010:restore_fpregs_from_fpstate+0x57/0xd0 + ? restore_fpregs_from_fpstate+0x45/0xd0 + switch_fpu_return+0x4e/0xe0 + exit_to_user_mode_prepare+0x17b/0x1b0 + syscall_exit_to_user_mode+0x29/0x40 + do_syscall_64+0x67/0x80 + ? do_syscall_64+0x67/0x80 + ? exc_page_fault+0x86/0x180 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +== Solution == + +Adjust init_fpstate to exclude dynamic states. XRSTORS from init_fpstate +still initializes those states when their bits are set in the +requested-feature bitmap. + +Fixes: 2308ee57d93d ("x86/fpu/amx: Enable the AMX feature in 64-bit mode") +Reported-by: Lin X Wang +Signed-off-by: Chang S. Bae +Signed-off-by: Thomas Gleixner +Tested-by: Lin X Wang +Link: https://lore.kernel.org/r/20220824191223.1248-4-chang.seok.bae@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/fpu/xstate.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c +index f5ef78633b4c..e77cabfa802f 100644 +--- a/arch/x86/kernel/fpu/xstate.c ++++ b/arch/x86/kernel/fpu/xstate.c +@@ -857,9 +857,12 @@ void __init fpu__init_system_xstate(unsigned int legacy_size) + update_regset_xstate_info(fpu_user_cfg.max_size, + fpu_user_cfg.max_features); + +- /* Bring init_fpstate size and features up to date */ +- init_fpstate.size = fpu_kernel_cfg.max_size; +- init_fpstate.xfeatures = fpu_kernel_cfg.max_features; ++ /* ++ * init_fpstate excludes dynamic states as they are large but init ++ * state is zero. ++ */ ++ init_fpstate.size = fpu_kernel_cfg.default_size; ++ init_fpstate.xfeatures = fpu_kernel_cfg.default_features; + + if (init_fpstate.size > sizeof(init_fpstate.regs)) { + pr_warn("x86/fpu: init_fpstate buffer too small (%zu < %d), disabling XSAVE\n", +-- +2.35.1 + diff --git a/queue-6.0/x86-fpu-fix-copy_xstate_to_uabi-to-copy-init-states-.patch b/queue-6.0/x86-fpu-fix-copy_xstate_to_uabi-to-copy-init-states-.patch new file mode 100644 index 00000000000..b81782bc760 --- /dev/null +++ b/queue-6.0/x86-fpu-fix-copy_xstate_to_uabi-to-copy-init-states-.patch @@ -0,0 +1,74 @@ +From 32f352d718562d72b43441f4bcbb98056d482f8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Oct 2022 11:58:44 -0700 +Subject: x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly + +From: Chang S. Bae + +[ Upstream commit 471f0aa7fa64e23766a1473b32d9ec3f0718895a ] + +When an extended state component is not present in fpstate, but in init +state, the function copies from init_fpstate via copy_feature(). + +But, dynamic states are not present in init_fpstate because of all-zeros +init states. Then retrieving them from init_fpstate will explode like this: + + BUG: kernel NULL pointer dereference, address: 0000000000000000 + ... + RIP: 0010:memcpy_erms+0x6/0x10 + ? __copy_xstate_to_uabi_buf+0x381/0x870 + fpu_copy_guest_fpstate_to_uabi+0x28/0x80 + kvm_arch_vcpu_ioctl+0x14c/0x1460 [kvm] + ? __this_cpu_preempt_check+0x13/0x20 + ? vmx_vcpu_put+0x2e/0x260 [kvm_intel] + kvm_vcpu_ioctl+0xea/0x6b0 [kvm] + ? kvm_vcpu_ioctl+0xea/0x6b0 [kvm] + ? __fget_light+0xd4/0x130 + __x64_sys_ioctl+0xe3/0x910 + ? debug_smp_processor_id+0x17/0x20 + ? fpregs_assert_state_consistent+0x27/0x50 + do_syscall_64+0x3f/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Adjust the 'mask' to zero out the userspace buffer for the features that +are not available both from fpstate and from init_fpstate. + +The dynamic features depend on the compacted XSAVE format. Ensure it is +enabled before reading XCOMP_BV in init_fpstate. + +Fixes: 2308ee57d93d ("x86/fpu/amx: Enable the AMX feature in 64-bit mode") +Reported-by: Yuan Yao +Suggested-by: Dave Hansen +Signed-off-by: Chang S. Bae +Signed-off-by: Dave Hansen +Tested-by: Yuan Yao +Link: https://lore.kernel.org/lkml/BYAPR11MB3717EDEF2351C958F2C86EED95259@BYAPR11MB3717.namprd11.prod.outlook.com/ +Link: https://lkml.kernel.org/r/20221021185844.13472-1-chang.seok.bae@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/fpu/xstate.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c +index e77cabfa802f..59e543b95a3c 100644 +--- a/arch/x86/kernel/fpu/xstate.c ++++ b/arch/x86/kernel/fpu/xstate.c +@@ -1125,6 +1125,15 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate, + */ + mask = fpstate->user_xfeatures; + ++ /* ++ * Dynamic features are not present in init_fpstate. When they are ++ * in an all zeros init state, remove those from 'mask' to zero ++ * those features in the user buffer instead of retrieving them ++ * from init_fpstate. ++ */ ++ if (fpu_state_size_dynamic()) ++ mask &= (header.xfeatures | xinit->header.xcomp_bv); ++ + for_each_extended_xfeature(i, mask) { + /* + * If there was a feature or alignment gap, zero the space +-- +2.35.1 + diff --git a/queue-6.0/x86-fpu-fix-the-init_fpstate-size-check-with-the-act.patch b/queue-6.0/x86-fpu-fix-the-init_fpstate-size-check-with-the-act.patch new file mode 100644 index 00000000000..33417383b3d --- /dev/null +++ b/queue-6.0/x86-fpu-fix-the-init_fpstate-size-check-with-the-act.patch @@ -0,0 +1,81 @@ +From 31435828c009f8de662aeb83f0b5ffe97de85d18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 12:12:22 -0700 +Subject: x86/fpu: Fix the init_fpstate size check with the actual size + +From: Chang S. Bae + +[ Upstream commit d3e021adac7c51a26d9ede167c789fcc1b878467 ] + +The init_fpstate buffer is statically allocated. Thus, the sanity test was +established to check whether the pre-allocated buffer is enough for the +calculated size or not. + +The currently measured size is not strictly relevant. Fix to validate the +calculated init_fpstate size with the pre-allocated area. + +Also, replace the sanity check function with open code for clarity. The +abstraction itself and the function naming do not tend to represent simply +what it does. + +Fixes: 2ae996e0c1a3 ("x86/fpu: Calculate the default sizes independently") +Signed-off-by: Chang S. Bae +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20220824191223.1248-3-chang.seok.bae@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/fpu/xstate.c | 24 ++++++------------------ + 1 file changed, 6 insertions(+), 18 deletions(-) + +diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c +index f0ce10620ab0..f5ef78633b4c 100644 +--- a/arch/x86/kernel/fpu/xstate.c ++++ b/arch/x86/kernel/fpu/xstate.c +@@ -678,20 +678,6 @@ static unsigned int __init get_xsave_size_user(void) + return ebx; + } + +-/* +- * Will the runtime-enumerated 'xstate_size' fit in the init +- * task's statically-allocated buffer? +- */ +-static bool __init is_supported_xstate_size(unsigned int test_xstate_size) +-{ +- if (test_xstate_size <= sizeof(init_fpstate.regs)) +- return true; +- +- pr_warn("x86/fpu: xstate buffer too small (%zu < %d), disabling xsave\n", +- sizeof(init_fpstate.regs), test_xstate_size); +- return false; +-} +- + static int __init init_xstate_size(void) + { + /* Recompute the context size for enabled features: */ +@@ -717,10 +703,6 @@ static int __init init_xstate_size(void) + kernel_default_size = + xstate_calculate_size(fpu_kernel_cfg.default_features, compacted); + +- /* Ensure we have the space to store all default enabled features. */ +- if (!is_supported_xstate_size(kernel_default_size)) +- return -EINVAL; +- + if (!paranoid_xstate_size_valid(kernel_size)) + return -EINVAL; + +@@ -879,6 +861,12 @@ void __init fpu__init_system_xstate(unsigned int legacy_size) + init_fpstate.size = fpu_kernel_cfg.max_size; + init_fpstate.xfeatures = fpu_kernel_cfg.max_features; + ++ if (init_fpstate.size > sizeof(init_fpstate.regs)) { ++ pr_warn("x86/fpu: init_fpstate buffer too small (%zu < %d), disabling XSAVE\n", ++ sizeof(init_fpstate.regs), init_fpstate.size); ++ goto out_disable; ++ } ++ + setup_init_fpu_buf(); + + /* +-- +2.35.1 + diff --git a/queue-6.0/x86-unwind-orc-fix-unreliable-stack-dump-with-gcov.patch b/queue-6.0/x86-unwind-orc-fix-unreliable-stack-dump-with-gcov.patch new file mode 100644 index 00000000000..f7a04c45329 --- /dev/null +++ b/queue-6.0/x86-unwind-orc-fix-unreliable-stack-dump-with-gcov.patch @@ -0,0 +1,80 @@ +From 767f6f13f1f67828a9277121e214ba9d10dedb1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jul 2022 11:15:06 +0800 +Subject: x86/unwind/orc: Fix unreliable stack dump with gcov + +From: Chen Zhongjin + +[ Upstream commit 230db82413c091bc16acee72650f48d419cebe49 ] + +When a console stack dump is initiated with CONFIG_GCOV_PROFILE_ALL +enabled, show_trace_log_lvl() gets out of sync with the ORC unwinder, +causing the stack trace to show all text addresses as unreliable: + + # echo l > /proc/sysrq-trigger + [ 477.521031] sysrq: Show backtrace of all active CPUs + [ 477.523813] NMI backtrace for cpu 0 + [ 477.524492] CPU: 0 PID: 1021 Comm: bash Not tainted 6.0.0 #65 + [ 477.525295] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-1.fc36 04/01/2014 + [ 477.526439] Call Trace: + [ 477.526854] + [ 477.527216] ? dump_stack_lvl+0xc7/0x114 + [ 477.527801] ? dump_stack+0x13/0x1f + [ 477.528331] ? nmi_cpu_backtrace.cold+0xb5/0x10d + [ 477.528998] ? lapic_can_unplug_cpu+0xa0/0xa0 + [ 477.529641] ? nmi_trigger_cpumask_backtrace+0x16a/0x1f0 + [ 477.530393] ? arch_trigger_cpumask_backtrace+0x1d/0x30 + [ 477.531136] ? sysrq_handle_showallcpus+0x1b/0x30 + [ 477.531818] ? __handle_sysrq.cold+0x4e/0x1ae + [ 477.532451] ? write_sysrq_trigger+0x63/0x80 + [ 477.533080] ? proc_reg_write+0x92/0x110 + [ 477.533663] ? vfs_write+0x174/0x530 + [ 477.534265] ? handle_mm_fault+0x16f/0x500 + [ 477.534940] ? ksys_write+0x7b/0x170 + [ 477.535543] ? __x64_sys_write+0x1d/0x30 + [ 477.536191] ? do_syscall_64+0x6b/0x100 + [ 477.536809] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd + [ 477.537609] + +This happens when the compiled code for show_stack() has a single word +on the stack, and doesn't use a tail call to show_stack_log_lvl(). +(CONFIG_GCOV_PROFILE_ALL=y is the only known case of this.) Then the +__unwind_start() skip logic hits an off-by-one bug and fails to unwind +all the way to the intended starting frame. + +Fix it by reverting the following commit: + + f1d9a2abff66 ("x86/unwind/orc: Don't skip the first frame for inactive tasks") + +The original justification for that commit no longer exists. That +original issue was later fixed in a different way, with the following +commit: + + f2ac57a4c49d ("x86/unwind/orc: Fix inactive tasks with stack pointer in %sp on GCC 10 compiled kernels") + +Fixes: f1d9a2abff66 ("x86/unwind/orc: Don't skip the first frame for inactive tasks") +Signed-off-by: Chen Zhongjin +[jpoimboe: rewrite commit log] +Signed-off-by: Josh Poimboeuf +Signed-off-by: Peter Zijlstra +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/unwind_orc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c +index 0ea57da92940..c059820dfaea 100644 +--- a/arch/x86/kernel/unwind_orc.c ++++ b/arch/x86/kernel/unwind_orc.c +@@ -713,7 +713,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task, + /* Otherwise, skip ahead to the user-specified starting frame: */ + while (!unwind_done(state) && + (!on_stack(&state->stack_info, first_frame, sizeof(long)) || +- state->sp < (unsigned long)first_frame)) ++ state->sp <= (unsigned long)first_frame)) + unwind_next_frame(state); + + return; +-- +2.35.1 +