From 3d4ebad36f55cc1a26250022b172867fe9d82ce7 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 23 Nov 2023 12:24:11 +0000 Subject: [PATCH] 6.6-stable patches added patches: asoc-codecs-wsa-macro-fix-uninitialized-stack-variables-with-name-prefix.patch cxl-region-do-not-try-to-cleanup-after-cxl_region_setup_targets-fails.patch dmaengine-stm32-mdma-correct-desc-prep-when-channel-running.patch driver-core-release-all-resources-during-unbind-before-updating-device-links.patch fs-use-nth_page-in-place-of-direct-struct-page-manipulation.patch hid-lenovo-resend-all-settings-on-reset_resume-for-compact-keyboards.patch i2c-core-run-atomic-i2c-xfer-when-preemptible.patch i3c-master-cdns-fix-reading-status-register.patch i3c-master-svc-fix-check-wrong-status-register-in-irq-handler.patch i3c-master-svc-fix-ibi-may-not-return-mandatory-data-byte.patch i3c-master-svc-fix-race-condition-in-ibi-work-thread.patch i3c-master-svc-fix-random-hot-join-failure-since-timeout-error.patch i3c-master-svc-fix-sda-keep-low-when-polling-ibiwon-timeout-happen.patch i3c-master-svc-fix-wrong-data-return-when-ibi-happen-during-start-frame.patch jbd2-fix-potential-data-lost-in-recovering-journal-raced-with-synchronizing-fs-bdev.patch kernel-reboot-emergency_restart-set-correct-system_state.patch mcb-fix-error-handling-for-different-scenarios-when-parsing.patch mips-use-nth_page-in-place-of-direct-struct-page-manipulation.patch mm-cma-use-nth_page-in-place-of-direct-struct-page-manipulation.patch mm-hugetlb-use-nth_page-in-place-of-direct-struct-page-manipulation.patch mm-make-pr_mdwe_refuse_exec_gain-an-unsigned-long.patch mm-memory_hotplug-use-pfn-math-in-place-of-direct-struct-page-manipulation.patch mtd-cfi_cmdset_0001-byte-swap-otp-info.patch powerpc-pseries-iommu-enable_ddw-incorrectly-returns-direct-mapping-for-sr-iov-device.patch quota-explicitly-forbid-quota-files-from-being-encrypted.patch s390-cmma-fix-detection-of-dat-pages.patch s390-cmma-fix-handling-of-swapper_pg_dir-and-invalid_pg_dir.patch s390-cmma-fix-initial-kernel-address-space-page-table-walk.patch s390-mm-add-missing-arch_set_page_dat-call-to-gmap-allocations.patch s390-mm-add-missing-arch_set_page_dat-call-to-vmem_crst_alloc.patch scripts-gdb-vmalloc-disable-on-no-mmu.patch selftests-clone3-fix-broken-test-under-config_time_ns.patch selftests-resctrl-fix-feature-checks.patch selftests-resctrl-fix-uninitialized-.sa_flags.patch selftests-resctrl-move-_gnu_source-define-into-makefile.patch selftests-resctrl-reduce-failures-due-to-outliers-in-mba-mbm-tests.patch selftests-resctrl-refactor-feature-check-to-use-resource-and-feature-name.patch selftests-resctrl-remove-duplicate-feature-check-from-cmt-test.patch tracing-have-the-user-copy-of-synthetic-event-address-use-correct-context.patch --- ...zed-stack-variables-with-name-prefix.patch | 36 ++++ ...after-cxl_region_setup_targets-fails.patch | 90 ++++++++ ...rrect-desc-prep-when-channel-running.patch | 48 +++++ ...-unbind-before-updating-device-links.patch | 49 +++++ ...e-of-direct-struct-page-manipulation.patch | 58 +++++ ...n-reset_resume-for-compact-keyboards.patch | 112 ++++++++++ ...run-atomic-i2c-xfer-when-preemptible.patch | 54 +++++ ...ter-cdns-fix-reading-status-register.patch | 49 +++++ ...wrong-status-register-in-irq-handler.patch | 34 +++ ...i-may-not-return-mandatory-data-byte.patch | 52 +++++ ...ix-race-condition-in-ibi-work-thread.patch | 115 ++++++++++ ...hot-join-failure-since-timeout-error.patch | 62 ++++++ ...w-when-polling-ibiwon-timeout-happen.patch | 34 +++ ...n-when-ibi-happen-during-start-frame.patch | 77 +++++++ ...nal-raced-with-synchronizing-fs-bdev.patch | 94 ++++++++ ...ncy_restart-set-correct-system_state.patch | 49 +++++ ...for-different-scenarios-when-parsing.patch | 56 +++++ ...e-of-direct-struct-page-manipulation.patch | 45 ++++ ...e-of-direct-struct-page-manipulation.patch | 59 +++++ ...e-of-direct-struct-page-manipulation.patch | 45 ++++ ...we_refuse_exec_gain-an-unsigned-long.patch | 73 +++++++ ...e-of-direct-struct-page-manipulation.patch | 46 ++++ ...d-cfi_cmdset_0001-byte-swap-otp-info.patch | 75 +++++++ ...rns-direct-mapping-for-sr-iov-device.patch | 68 ++++++ ...bid-quota-files-from-being-encrypted.patch | 64 ++++++ ...s390-cmma-fix-detection-of-dat-pages.patch | 62 ++++++ ...of-swapper_pg_dir-and-invalid_pg_dir.patch | 45 ++++ ...kernel-address-space-page-table-walk.patch | 69 ++++++ ...et_page_dat-call-to-gmap-allocations.patch | 126 +++++++++++ ...set_page_dat-call-to-vmem_crst_alloc.patch | 58 +++++ ...cripts-gdb-vmalloc-disable-on-no-mmu.patch | 78 +++++++ ...fix-broken-test-under-config_time_ns.patch | 68 ++++++ ...selftests-resctrl-fix-feature-checks.patch | 62 ++++++ ...-resctrl-fix-uninitialized-.sa_flags.patch | 51 +++++ ...ove-_gnu_source-define-into-makefile.patch | 50 +++++ ...res-due-to-outliers-in-mba-mbm-tests.patch | 67 ++++++ ...eck-to-use-resource-and-feature-name.patch | 201 ++++++++++++++++++ ...uplicate-feature-check-from-cmt-test.patch | 41 ++++ queue-6.6/series | 39 ++++ ...ic-event-address-use-correct-context.patch | 47 ++++ 40 files changed, 2608 insertions(+) create mode 100644 queue-6.6/asoc-codecs-wsa-macro-fix-uninitialized-stack-variables-with-name-prefix.patch create mode 100644 queue-6.6/cxl-region-do-not-try-to-cleanup-after-cxl_region_setup_targets-fails.patch create mode 100644 queue-6.6/dmaengine-stm32-mdma-correct-desc-prep-when-channel-running.patch create mode 100644 queue-6.6/driver-core-release-all-resources-during-unbind-before-updating-device-links.patch create mode 100644 queue-6.6/fs-use-nth_page-in-place-of-direct-struct-page-manipulation.patch create mode 100644 queue-6.6/hid-lenovo-resend-all-settings-on-reset_resume-for-compact-keyboards.patch create mode 100644 queue-6.6/i2c-core-run-atomic-i2c-xfer-when-preemptible.patch create mode 100644 queue-6.6/i3c-master-cdns-fix-reading-status-register.patch create mode 100644 queue-6.6/i3c-master-svc-fix-check-wrong-status-register-in-irq-handler.patch create mode 100644 queue-6.6/i3c-master-svc-fix-ibi-may-not-return-mandatory-data-byte.patch create mode 100644 queue-6.6/i3c-master-svc-fix-race-condition-in-ibi-work-thread.patch create mode 100644 queue-6.6/i3c-master-svc-fix-random-hot-join-failure-since-timeout-error.patch create mode 100644 queue-6.6/i3c-master-svc-fix-sda-keep-low-when-polling-ibiwon-timeout-happen.patch create mode 100644 queue-6.6/i3c-master-svc-fix-wrong-data-return-when-ibi-happen-during-start-frame.patch create mode 100644 queue-6.6/jbd2-fix-potential-data-lost-in-recovering-journal-raced-with-synchronizing-fs-bdev.patch create mode 100644 queue-6.6/kernel-reboot-emergency_restart-set-correct-system_state.patch create mode 100644 queue-6.6/mcb-fix-error-handling-for-different-scenarios-when-parsing.patch create mode 100644 queue-6.6/mips-use-nth_page-in-place-of-direct-struct-page-manipulation.patch create mode 100644 queue-6.6/mm-cma-use-nth_page-in-place-of-direct-struct-page-manipulation.patch create mode 100644 queue-6.6/mm-hugetlb-use-nth_page-in-place-of-direct-struct-page-manipulation.patch create mode 100644 queue-6.6/mm-make-pr_mdwe_refuse_exec_gain-an-unsigned-long.patch create mode 100644 queue-6.6/mm-memory_hotplug-use-pfn-math-in-place-of-direct-struct-page-manipulation.patch create mode 100644 queue-6.6/mtd-cfi_cmdset_0001-byte-swap-otp-info.patch create mode 100644 queue-6.6/powerpc-pseries-iommu-enable_ddw-incorrectly-returns-direct-mapping-for-sr-iov-device.patch create mode 100644 queue-6.6/quota-explicitly-forbid-quota-files-from-being-encrypted.patch create mode 100644 queue-6.6/s390-cmma-fix-detection-of-dat-pages.patch create mode 100644 queue-6.6/s390-cmma-fix-handling-of-swapper_pg_dir-and-invalid_pg_dir.patch create mode 100644 queue-6.6/s390-cmma-fix-initial-kernel-address-space-page-table-walk.patch create mode 100644 queue-6.6/s390-mm-add-missing-arch_set_page_dat-call-to-gmap-allocations.patch create mode 100644 queue-6.6/s390-mm-add-missing-arch_set_page_dat-call-to-vmem_crst_alloc.patch create mode 100644 queue-6.6/scripts-gdb-vmalloc-disable-on-no-mmu.patch create mode 100644 queue-6.6/selftests-clone3-fix-broken-test-under-config_time_ns.patch create mode 100644 queue-6.6/selftests-resctrl-fix-feature-checks.patch create mode 100644 queue-6.6/selftests-resctrl-fix-uninitialized-.sa_flags.patch create mode 100644 queue-6.6/selftests-resctrl-move-_gnu_source-define-into-makefile.patch create mode 100644 queue-6.6/selftests-resctrl-reduce-failures-due-to-outliers-in-mba-mbm-tests.patch create mode 100644 queue-6.6/selftests-resctrl-refactor-feature-check-to-use-resource-and-feature-name.patch create mode 100644 queue-6.6/selftests-resctrl-remove-duplicate-feature-check-from-cmt-test.patch create mode 100644 queue-6.6/tracing-have-the-user-copy-of-synthetic-event-address-use-correct-context.patch diff --git a/queue-6.6/asoc-codecs-wsa-macro-fix-uninitialized-stack-variables-with-name-prefix.patch b/queue-6.6/asoc-codecs-wsa-macro-fix-uninitialized-stack-variables-with-name-prefix.patch new file mode 100644 index 00000000000..3e7ab114009 --- /dev/null +++ b/queue-6.6/asoc-codecs-wsa-macro-fix-uninitialized-stack-variables-with-name-prefix.patch @@ -0,0 +1,36 @@ +From 72151ad0cba8a07df90130ff62c979520d71f23b Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 3 Oct 2023 17:54:22 +0200 +Subject: ASoC: codecs: wsa-macro: fix uninitialized stack variables with name prefix + +From: Krzysztof Kozlowski + +commit 72151ad0cba8a07df90130ff62c979520d71f23b upstream. + +Driver compares widget name in wsa_macro_spk_boost_event() widget event +callback, however it does not handle component's name prefix. This +leads to using uninitialized stack variables as registers and register +values. Handle gracefully such case. + +Fixes: 2c4066e5d428 ("ASoC: codecs: lpass-wsa-macro: add dapm widgets and route") +Cc: stable@vger.kernel.org +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20231003155422.801160-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/lpass-wsa-macro.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/sound/soc/codecs/lpass-wsa-macro.c ++++ b/sound/soc/codecs/lpass-wsa-macro.c +@@ -1685,6 +1685,9 @@ static int wsa_macro_spk_boost_event(str + boost_path_cfg1 = CDC_WSA_RX1_RX_PATH_CFG1; + reg = CDC_WSA_RX1_RX_PATH_CTL; + reg_mix = CDC_WSA_RX1_RX_PATH_MIX_CTL; ++ } else { ++ dev_warn(component->dev, "Incorrect widget name in the driver\n"); ++ return -EINVAL; + } + + switch (event) { diff --git a/queue-6.6/cxl-region-do-not-try-to-cleanup-after-cxl_region_setup_targets-fails.patch b/queue-6.6/cxl-region-do-not-try-to-cleanup-after-cxl_region_setup_targets-fails.patch new file mode 100644 index 00000000000..9620d5fe918 --- /dev/null +++ b/queue-6.6/cxl-region-do-not-try-to-cleanup-after-cxl_region_setup_targets-fails.patch @@ -0,0 +1,90 @@ +From 0718588c7aaa7a1510b4de972370535b61dddd0d Mon Sep 17 00:00:00 2001 +From: Jim Harris +Date: Wed, 11 Oct 2023 14:51:31 +0000 +Subject: cxl/region: Do not try to cleanup after cxl_region_setup_targets() fails + +From: Jim Harris + +commit 0718588c7aaa7a1510b4de972370535b61dddd0d upstream. + +Commit 5e42bcbc3fef ("cxl/region: decrement ->nr_targets on error in +cxl_region_attach()") tried to avoid 'eiw' initialization errors when +->nr_targets exceeded 16, by just decrementing ->nr_targets when +cxl_region_setup_targets() failed. + +Commit 86987c766276 ("cxl/region: Cleanup target list on attach error") +extended that cleanup to also clear cxled->pos and p->targets[pos]. The +initialization error was incidentally fixed separately by: +Commit 8d4285425714 ("cxl/region: Fix port setup uninitialized variable +warnings") which was merged a few days after 5e42bcbc3fef. + +But now the original cleanup when cxl_region_setup_targets() fails +prevents endpoint and switch decoder resources from being reused: + +1) the cleanup does not set the decoder's region to NULL, which results + in future dpa_size_store() calls returning -EBUSY +2) the decoder is not properly freed, which results in future commit + errors associated with the upstream switch + +Now that the initialization errors were fixed separately, the proper +cleanup for this case is to just return immediately. Then the resources +associated with this target get cleanup up as normal when the failed +region is deleted. + +The ->nr_targets decrement in the error case also helped prevent +a p->targets[] array overflow, so add a new check to prevent against +that overflow. + +Tested by trying to create an invalid region for a 2 switch * 2 endpoint +topology, and then following up with creating a valid region. + +Fixes: 5e42bcbc3fef ("cxl/region: decrement ->nr_targets on error in cxl_region_attach()") +Cc: +Signed-off-by: Jim Harris +Reviewed-by: Jonathan Cameron +Acked-by: Dan Carpenter +Reviewed-by: Dave Jiang +Link: https://lore.kernel.org/r/169703589120.1202031.14696100866518083806.stgit@bgt-140510-bm03.eng.stellus.in +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cxl/core/region.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/cxl/core/region.c ++++ b/drivers/cxl/core/region.c +@@ -1675,6 +1675,12 @@ static int cxl_region_attach(struct cxl_ + return -ENXIO; + } + ++ if (p->nr_targets >= p->interleave_ways) { ++ dev_dbg(&cxlr->dev, "region already has %d endpoints\n", ++ p->nr_targets); ++ return -EINVAL; ++ } ++ + ep_port = cxled_to_port(cxled); + root_port = cxlrd_to_port(cxlrd); + dport = cxl_find_dport_by_dev(root_port, ep_port->host_bridge); +@@ -1767,7 +1773,7 @@ static int cxl_region_attach(struct cxl_ + if (p->nr_targets == p->interleave_ways) { + rc = cxl_region_setup_targets(cxlr); + if (rc) +- goto err_decrement; ++ return rc; + p->state = CXL_CONFIG_ACTIVE; + } + +@@ -1799,12 +1805,6 @@ static int cxl_region_attach(struct cxl_ + } + + return 0; +- +-err_decrement: +- p->nr_targets--; +- cxled->pos = -1; +- p->targets[pos] = NULL; +- return rc; + } + + static int cxl_region_detach(struct cxl_endpoint_decoder *cxled) diff --git a/queue-6.6/dmaengine-stm32-mdma-correct-desc-prep-when-channel-running.patch b/queue-6.6/dmaengine-stm32-mdma-correct-desc-prep-when-channel-running.patch new file mode 100644 index 00000000000..8524acdb0c2 --- /dev/null +++ b/queue-6.6/dmaengine-stm32-mdma-correct-desc-prep-when-channel-running.patch @@ -0,0 +1,48 @@ +From 03f25d53b145bc2f7ccc82fc04e4482ed734f524 Mon Sep 17 00:00:00 2001 +From: Alain Volmat +Date: Mon, 9 Oct 2023 10:24:50 +0200 +Subject: dmaengine: stm32-mdma: correct desc prep when channel running + +From: Alain Volmat + +commit 03f25d53b145bc2f7ccc82fc04e4482ed734f524 upstream. + +In case of the prep descriptor while the channel is already running, the +CCR register value stored into the channel could already have its EN bit +set. This would lead to a bad transfer since, at start transfer time, +enabling the channel while other registers aren't yet properly set. +To avoid this, ensure to mask the CCR_EN bit when storing the ccr value +into the mdma channel structure. + +Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver") +Signed-off-by: Alain Volmat +Signed-off-by: Amelie Delaunay +Cc: stable@vger.kernel.org +Tested-by: Alain Volmat +Link: https://lore.kernel.org/r/20231009082450.452877-1-amelie.delaunay@foss.st.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/stm32-mdma.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/dma/stm32-mdma.c ++++ b/drivers/dma/stm32-mdma.c +@@ -489,7 +489,7 @@ static int stm32_mdma_set_xfer_param(str + src_maxburst = chan->dma_config.src_maxburst; + dst_maxburst = chan->dma_config.dst_maxburst; + +- ccr = stm32_mdma_read(dmadev, STM32_MDMA_CCR(chan->id)); ++ ccr = stm32_mdma_read(dmadev, STM32_MDMA_CCR(chan->id)) & ~STM32_MDMA_CCR_EN; + ctcr = stm32_mdma_read(dmadev, STM32_MDMA_CTCR(chan->id)); + ctbr = stm32_mdma_read(dmadev, STM32_MDMA_CTBR(chan->id)); + +@@ -965,7 +965,7 @@ stm32_mdma_prep_dma_memcpy(struct dma_ch + if (!desc) + return NULL; + +- ccr = stm32_mdma_read(dmadev, STM32_MDMA_CCR(chan->id)); ++ ccr = stm32_mdma_read(dmadev, STM32_MDMA_CCR(chan->id)) & ~STM32_MDMA_CCR_EN; + ctcr = stm32_mdma_read(dmadev, STM32_MDMA_CTCR(chan->id)); + ctbr = stm32_mdma_read(dmadev, STM32_MDMA_CTBR(chan->id)); + cbndtr = stm32_mdma_read(dmadev, STM32_MDMA_CBNDTR(chan->id)); diff --git a/queue-6.6/driver-core-release-all-resources-during-unbind-before-updating-device-links.patch b/queue-6.6/driver-core-release-all-resources-during-unbind-before-updating-device-links.patch new file mode 100644 index 00000000000..5b4e7200306 --- /dev/null +++ b/queue-6.6/driver-core-release-all-resources-during-unbind-before-updating-device-links.patch @@ -0,0 +1,49 @@ +From 2e84dc37920012b458e9458b19fc4ed33f81bc74 Mon Sep 17 00:00:00 2001 +From: Saravana Kannan +Date: Tue, 17 Oct 2023 18:38:50 -0700 +Subject: driver core: Release all resources during unbind before updating device links +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Saravana Kannan + +commit 2e84dc37920012b458e9458b19fc4ed33f81bc74 upstream. + +This commit fixes a bug in commit 9ed9895370ae ("driver core: Functional +dependencies tracking support") where the device link status was +incorrectly updated in the driver unbind path before all the device's +resources were released. + +Fixes: 9ed9895370ae ("driver core: Functional dependencies tracking support") +Cc: stable +Reported-by: Uwe Kleine-König +Closes: https://lore.kernel.org/all/20231014161721.f4iqyroddkcyoefo@pengutronix.de/ +Signed-off-by: Saravana Kannan +Cc: Thierry Reding +Cc: Yang Yingliang +Cc: Andy Shevchenko +Cc: Mark Brown +Cc: Matti Vaittinen +Cc: James Clark +Acked-by: "Rafael J. Wysocki" +Tested-by: Uwe Kleine-König +Acked-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20231018013851.3303928-1-saravanak@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/dd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -1274,8 +1274,8 @@ static void __device_release_driver(stru + if (dev->bus && dev->bus->dma_cleanup) + dev->bus->dma_cleanup(dev); + +- device_links_driver_cleanup(dev); + device_unbind_cleanup(dev); ++ device_links_driver_cleanup(dev); + + klist_remove(&dev->p->knode_driver); + device_pm_check_callbacks(dev); diff --git a/queue-6.6/fs-use-nth_page-in-place-of-direct-struct-page-manipulation.patch b/queue-6.6/fs-use-nth_page-in-place-of-direct-struct-page-manipulation.patch new file mode 100644 index 00000000000..7147a8b880c --- /dev/null +++ b/queue-6.6/fs-use-nth_page-in-place-of-direct-struct-page-manipulation.patch @@ -0,0 +1,58 @@ +From 8db0ec791f7788cd21e7f91ee5ff42c1c458d0e7 Mon Sep 17 00:00:00 2001 +From: Zi Yan +Date: Wed, 13 Sep 2023 16:12:47 -0400 +Subject: fs: use nth_page() in place of direct struct page manipulation + +From: Zi Yan + +commit 8db0ec791f7788cd21e7f91ee5ff42c1c458d0e7 upstream. + +When dealing with hugetlb pages, struct page is not guaranteed to be +contiguous on SPARSEMEM without VMEMMAP. Use nth_page() to handle it +properly. + +Without the fix, a wrong subpage might be checked for HWPoison, causing wrong +number of bytes of a page copied to user space. No bug is reported. The fix +comes from code inspection. + +Link: https://lkml.kernel.org/r/20230913201248.452081-5-zi.yan@sent.com +Fixes: 38c1ddbde6c6 ("hugetlbfs: improve read HWPOISON hugepage") +Signed-off-by: Zi Yan +Reviewed-by: Muchun Song +Cc: David Hildenbrand +Cc: Matthew Wilcox (Oracle) +Cc: Mike Kravetz +Cc: Mike Rapoport (IBM) +Cc: Thomas Bogendoerfer +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/hugetlbfs/inode.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c +index 316c4cebd3f3..60fce26ff937 100644 +--- a/fs/hugetlbfs/inode.c ++++ b/fs/hugetlbfs/inode.c +@@ -295,7 +295,7 @@ static size_t adjust_range_hwpoison(struct page *page, size_t offset, size_t byt + size_t res = 0; + + /* First subpage to start the loop. */ +- page += offset / PAGE_SIZE; ++ page = nth_page(page, offset / PAGE_SIZE); + offset %= PAGE_SIZE; + while (1) { + if (is_raw_hwpoison_page_in_hugepage(page)) +@@ -309,7 +309,7 @@ static size_t adjust_range_hwpoison(struct page *page, size_t offset, size_t byt + break; + offset += n; + if (offset == PAGE_SIZE) { +- page++; ++ page = nth_page(page, 1); + offset = 0; + } + } +-- +2.43.0 + diff --git a/queue-6.6/hid-lenovo-resend-all-settings-on-reset_resume-for-compact-keyboards.patch b/queue-6.6/hid-lenovo-resend-all-settings-on-reset_resume-for-compact-keyboards.patch new file mode 100644 index 00000000000..abfa57a3d9a --- /dev/null +++ b/queue-6.6/hid-lenovo-resend-all-settings-on-reset_resume-for-compact-keyboards.patch @@ -0,0 +1,112 @@ +From 2f2bd7cbd1d1548137b351040dc4e037d18cdfdc Mon Sep 17 00:00:00 2001 +From: Jamie Lentin +Date: Mon, 2 Oct 2023 15:09:14 +0000 +Subject: hid: lenovo: Resend all settings on reset_resume for compact keyboards + +From: Jamie Lentin + +commit 2f2bd7cbd1d1548137b351040dc4e037d18cdfdc upstream. + +The USB Compact Keyboard variant requires a reset_resume function to +restore keyboard configuration after a suspend in some situations. Move +configuration normally done on probe to lenovo_features_set_cptkbd(), then +recycle this for use on reset_resume. + +Without, the keyboard and driver would end up in an inconsistent state, +breaking middle-button scrolling amongst other problems, and twiddling +sysfs values wouldn't help as the middle-button mode won't be set until +the driver is reloaded. + +Tested on a USB and Bluetooth Thinkpad Compact Keyboard. + +CC: stable@vger.kernel.org +Fixes: 94eefa271323 ("HID: lenovo: Use native middle-button mode for compact keyboards") +Signed-off-by: Jamie Lentin +Signed-off-by: Martin Kepplinger +Link: https://lore.kernel.org/r/20231002150914.22101-1-martink@posteo.de +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-lenovo.c | 50 +++++++++++++++++++++++++++++++---------------- + 1 file changed, 34 insertions(+), 16 deletions(-) + +--- a/drivers/hid/hid-lenovo.c ++++ b/drivers/hid/hid-lenovo.c +@@ -526,6 +526,19 @@ static void lenovo_features_set_cptkbd(s + int ret; + struct lenovo_drvdata *cptkbd_data = hid_get_drvdata(hdev); + ++ /* ++ * Tell the keyboard a driver understands it, and turn F7, F9, F11 into ++ * regular keys ++ */ ++ ret = lenovo_send_cmd_cptkbd(hdev, 0x01, 0x03); ++ if (ret) ++ hid_warn(hdev, "Failed to switch F7/9/11 mode: %d\n", ret); ++ ++ /* Switch middle button to native mode */ ++ ret = lenovo_send_cmd_cptkbd(hdev, 0x09, 0x01); ++ if (ret) ++ hid_warn(hdev, "Failed to switch middle button: %d\n", ret); ++ + ret = lenovo_send_cmd_cptkbd(hdev, 0x05, cptkbd_data->fn_lock); + if (ret) + hid_err(hdev, "Fn-lock setting failed: %d\n", ret); +@@ -1148,22 +1161,6 @@ static int lenovo_probe_cptkbd(struct hi + } + hid_set_drvdata(hdev, cptkbd_data); + +- /* +- * Tell the keyboard a driver understands it, and turn F7, F9, F11 into +- * regular keys (Compact only) +- */ +- if (hdev->product == USB_DEVICE_ID_LENOVO_CUSBKBD || +- hdev->product == USB_DEVICE_ID_LENOVO_CBTKBD) { +- ret = lenovo_send_cmd_cptkbd(hdev, 0x01, 0x03); +- if (ret) +- hid_warn(hdev, "Failed to switch F7/9/11 mode: %d\n", ret); +- } +- +- /* Switch middle button to native mode */ +- ret = lenovo_send_cmd_cptkbd(hdev, 0x09, 0x01); +- if (ret) +- hid_warn(hdev, "Failed to switch middle button: %d\n", ret); +- + /* Set keyboard settings to known state */ + cptkbd_data->middlebutton_state = 0; + cptkbd_data->fn_lock = true; +@@ -1286,6 +1283,24 @@ err: + return ret; + } + ++#ifdef CONFIG_PM ++static int lenovo_reset_resume(struct hid_device *hdev) ++{ ++ switch (hdev->product) { ++ case USB_DEVICE_ID_LENOVO_CUSBKBD: ++ case USB_DEVICE_ID_LENOVO_TPIIUSBKBD: ++ if (hdev->type == HID_TYPE_USBMOUSE) ++ lenovo_features_set_cptkbd(hdev); ++ ++ break; ++ default: ++ break; ++ } ++ ++ return 0; ++} ++#endif ++ + static void lenovo_remove_tpkbd(struct hid_device *hdev) + { + struct lenovo_drvdata *data_pointer = hid_get_drvdata(hdev); +@@ -1402,6 +1417,9 @@ static struct hid_driver lenovo_driver = + .raw_event = lenovo_raw_event, + .event = lenovo_event, + .report_fixup = lenovo_report_fixup, ++#ifdef CONFIG_PM ++ .reset_resume = lenovo_reset_resume, ++#endif + }; + module_hid_driver(lenovo_driver); + diff --git a/queue-6.6/i2c-core-run-atomic-i2c-xfer-when-preemptible.patch b/queue-6.6/i2c-core-run-atomic-i2c-xfer-when-preemptible.patch new file mode 100644 index 00000000000..d15481f2061 --- /dev/null +++ b/queue-6.6/i2c-core-run-atomic-i2c-xfer-when-preemptible.patch @@ -0,0 +1,54 @@ +From aa49c90894d06e18a1ee7c095edbd2f37c232d02 Mon Sep 17 00:00:00 2001 +From: Benjamin Bara +Date: Sat, 15 Jul 2023 09:53:24 +0200 +Subject: i2c: core: Run atomic i2c xfer when !preemptible + +From: Benjamin Bara + +commit aa49c90894d06e18a1ee7c095edbd2f37c232d02 upstream. + +Since bae1d3a05a8b, i2c transfers are non-atomic if preemption is +disabled. However, non-atomic i2c transfers require preemption (e.g. in +wait_for_completion() while waiting for the DMA). + +panic() calls preempt_disable_notrace() before calling +emergency_restart(). Therefore, if an i2c device is used for the +restart, the xfer should be atomic. This avoids warnings like: + +[ 12.667612] WARNING: CPU: 1 PID: 1 at kernel/rcu/tree_plugin.h:318 rcu_note_context_switch+0x33c/0x6b0 +[ 12.676926] Voluntary context switch within RCU read-side critical section! +... +[ 12.742376] schedule_timeout from wait_for_completion_timeout+0x90/0x114 +[ 12.749179] wait_for_completion_timeout from tegra_i2c_wait_completion+0x40/0x70 +... +[ 12.994527] atomic_notifier_call_chain from machine_restart+0x34/0x58 +[ 13.001050] machine_restart from panic+0x2a8/0x32c + +Use !preemptible() instead, which is basically the same check as +pre-v5.2. + +Fixes: bae1d3a05a8b ("i2c: core: remove use of in_atomic()") +Cc: stable@vger.kernel.org # v5.2+ +Suggested-by: Dmitry Osipenko +Acked-by: Wolfram Sang +Reviewed-by: Dmitry Osipenko +Tested-by: Nishanth Menon +Signed-off-by: Benjamin Bara +Link: https://lore.kernel.org/r/20230327-tegra-pmic-reboot-v7-2-18699d5dcd76@skidata.com +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/i2c-core.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/i2c-core.h ++++ b/drivers/i2c/i2c-core.h +@@ -29,7 +29,7 @@ int i2c_dev_irq_from_resources(const str + */ + static inline bool i2c_in_atomic_xfer_mode(void) + { +- return system_state > SYSTEM_RUNNING && irqs_disabled(); ++ return system_state > SYSTEM_RUNNING && !preemptible(); + } + + static inline int __i2c_lock_bus_helper(struct i2c_adapter *adap) diff --git a/queue-6.6/i3c-master-cdns-fix-reading-status-register.patch b/queue-6.6/i3c-master-cdns-fix-reading-status-register.patch new file mode 100644 index 00000000000..976c9d2b357 --- /dev/null +++ b/queue-6.6/i3c-master-cdns-fix-reading-status-register.patch @@ -0,0 +1,49 @@ +From 4bd8405257da717cd556f99e5fb68693d12c9766 Mon Sep 17 00:00:00 2001 +From: Joshua Yeong +Date: Wed, 13 Sep 2023 11:17:45 +0800 +Subject: i3c: master: cdns: Fix reading status register + +From: Joshua Yeong + +commit 4bd8405257da717cd556f99e5fb68693d12c9766 upstream. + +IBIR_DEPTH and CMDR_DEPTH should read from status0 instead of status1. + +Cc: stable@vger.kernel.org +Fixes: 603f2bee2c54 ("i3c: master: Add driver for Cadence IP") +Signed-off-by: Joshua Yeong +Reviewed-by: Miquel Raynal +Link: https://lore.kernel.org/r/20230913031743.11439-2-joshua.yeong@starfivetech.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master/i3c-master-cdns.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/i3c/master/i3c-master-cdns.c ++++ b/drivers/i3c/master/i3c-master-cdns.c +@@ -191,7 +191,7 @@ + #define SLV_STATUS1_HJ_DIS BIT(18) + #define SLV_STATUS1_MR_DIS BIT(17) + #define SLV_STATUS1_PROT_ERR BIT(16) +-#define SLV_STATUS1_DA(x) (((s) & GENMASK(15, 9)) >> 9) ++#define SLV_STATUS1_DA(s) (((s) & GENMASK(15, 9)) >> 9) + #define SLV_STATUS1_HAS_DA BIT(8) + #define SLV_STATUS1_DDR_RX_FULL BIT(7) + #define SLV_STATUS1_DDR_TX_FULL BIT(6) +@@ -1623,13 +1623,13 @@ static int cdns_i3c_master_probe(struct + /* Device ID0 is reserved to describe this master. */ + master->maxdevs = CONF_STATUS0_DEVS_NUM(val); + master->free_rr_slots = GENMASK(master->maxdevs, 1); ++ master->caps.ibirfifodepth = CONF_STATUS0_IBIR_DEPTH(val); ++ master->caps.cmdrfifodepth = CONF_STATUS0_CMDR_DEPTH(val); + + val = readl(master->regs + CONF_STATUS1); + master->caps.cmdfifodepth = CONF_STATUS1_CMD_DEPTH(val); + master->caps.rxfifodepth = CONF_STATUS1_RX_DEPTH(val); + master->caps.txfifodepth = CONF_STATUS1_TX_DEPTH(val); +- master->caps.ibirfifodepth = CONF_STATUS0_IBIR_DEPTH(val); +- master->caps.cmdrfifodepth = CONF_STATUS0_CMDR_DEPTH(val); + + spin_lock_init(&master->ibi.lock); + master->ibi.num_slots = CONF_STATUS1_IBI_HW_RES(val); diff --git a/queue-6.6/i3c-master-svc-fix-check-wrong-status-register-in-irq-handler.patch b/queue-6.6/i3c-master-svc-fix-check-wrong-status-register-in-irq-handler.patch new file mode 100644 index 00000000000..63ac4cf235d --- /dev/null +++ b/queue-6.6/i3c-master-svc-fix-check-wrong-status-register-in-irq-handler.patch @@ -0,0 +1,34 @@ +From 225d5ef048c4ed01a475c95d94833bd7dd61072d Mon Sep 17 00:00:00 2001 +From: Frank Li +Date: Mon, 23 Oct 2023 12:16:56 -0400 +Subject: i3c: master: svc: fix check wrong status register in irq handler + +From: Frank Li + +commit 225d5ef048c4ed01a475c95d94833bd7dd61072d upstream. + +svc_i3c_master_irq_handler() wrongly checks register SVC_I3C_MINTMASKED. It +should be SVC_I3C_MSTATUS. + +Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") +Cc: +Reviewed-by: Miquel Raynal +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20231023161658.3890811-5-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master/svc-i3c-master.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -477,7 +477,7 @@ reenable_ibis: + static irqreturn_t svc_i3c_master_irq_handler(int irq, void *dev_id) + { + struct svc_i3c_master *master = (struct svc_i3c_master *)dev_id; +- u32 active = readl(master->regs + SVC_I3C_MINTMASKED); ++ u32 active = readl(master->regs + SVC_I3C_MSTATUS); + + if (!SVC_I3C_MSTATUS_SLVSTART(active)) + return IRQ_NONE; diff --git a/queue-6.6/i3c-master-svc-fix-ibi-may-not-return-mandatory-data-byte.patch b/queue-6.6/i3c-master-svc-fix-ibi-may-not-return-mandatory-data-byte.patch new file mode 100644 index 00000000000..846f2f389e4 --- /dev/null +++ b/queue-6.6/i3c-master-svc-fix-ibi-may-not-return-mandatory-data-byte.patch @@ -0,0 +1,52 @@ +From c85e209b799f12d18a90ae6353b997b1bb1274a5 Mon Sep 17 00:00:00 2001 +From: Frank Li +Date: Mon, 23 Oct 2023 12:16:55 -0400 +Subject: i3c: master: svc: fix ibi may not return mandatory data byte + +From: Frank Li + +commit c85e209b799f12d18a90ae6353b997b1bb1274a5 upstream. + +MSTATUS[RXPEND] is only updated after the data transfer cycle started. This +creates an issue when the I3C clock is slow, and the CPU is running fast +enough that MSTATUS[RXPEND] may not be updated when the code reaches +checking point. As a result, mandatory data can be missed. + +Add a wait for MSTATUS[COMPLETE] to ensure that all mandatory data is +already in FIFO. It also works without mandatory data. + +Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") +Cc: +Reviewed-by: Miquel Raynal +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20231023161658.3890811-4-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master/svc-i3c-master.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -333,6 +333,7 @@ static int svc_i3c_master_handle_ibi(str + struct i3c_ibi_slot *slot; + unsigned int count; + u32 mdatactrl; ++ int ret, val; + u8 *buf; + + slot = i3c_generic_ibi_get_free_slot(data->ibi_pool); +@@ -342,6 +343,13 @@ static int svc_i3c_master_handle_ibi(str + slot->len = 0; + buf = slot->data; + ++ ret = readl_relaxed_poll_timeout(master->regs + SVC_I3C_MSTATUS, val, ++ SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000); ++ if (ret) { ++ dev_err(master->dev, "Timeout when polling for COMPLETE\n"); ++ return ret; ++ } ++ + while (SVC_I3C_MSTATUS_RXPEND(readl(master->regs + SVC_I3C_MSTATUS)) && + slot->len < SVC_I3C_FIFO_SIZE) { + mdatactrl = readl(master->regs + SVC_I3C_MDATACTRL); diff --git a/queue-6.6/i3c-master-svc-fix-race-condition-in-ibi-work-thread.patch b/queue-6.6/i3c-master-svc-fix-race-condition-in-ibi-work-thread.patch new file mode 100644 index 00000000000..83fda4ef6ac --- /dev/null +++ b/queue-6.6/i3c-master-svc-fix-race-condition-in-ibi-work-thread.patch @@ -0,0 +1,115 @@ +From 6bf3fc268183816856c96b8794cd66146bc27b35 Mon Sep 17 00:00:00 2001 +From: Frank Li +Date: Mon, 23 Oct 2023 12:16:53 -0400 +Subject: i3c: master: svc: fix race condition in ibi work thread + +From: Frank Li + +commit 6bf3fc268183816856c96b8794cd66146bc27b35 upstream. + +The ibi work thread operates asynchronously with other transfers, such as +svc_i3c_master_priv_xfers(). Introduce mutex protection to ensure the +completion of the entire i3c/i2c transaction. + +Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") +Cc: +Reviewed-by: Miquel Raynal +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20231023161658.3890811-2-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master/svc-i3c-master.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -175,6 +175,7 @@ struct svc_i3c_regs_save { + * @ibi.slots: Available IBI slots + * @ibi.tbq_slot: To be queued IBI slot + * @ibi.lock: IBI lock ++ * @lock: Transfer lock, protect between IBI work thread and callbacks from master + */ + struct svc_i3c_master { + struct i3c_master_controller base; +@@ -203,6 +204,7 @@ struct svc_i3c_master { + /* Prevent races within IBI handlers */ + spinlock_t lock; + } ibi; ++ struct mutex lock; + }; + + /** +@@ -384,6 +386,7 @@ static void svc_i3c_master_ibi_work(stru + u32 status, val; + int ret; + ++ mutex_lock(&master->lock); + /* Acknowledge the incoming interrupt with the AUTOIBI mechanism */ + writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI | + SVC_I3C_MCTRL_IBIRESP_AUTO, +@@ -460,6 +463,7 @@ static void svc_i3c_master_ibi_work(stru + + reenable_ibis: + svc_i3c_master_enable_interrupts(master, SVC_I3C_MINT_SLVSTART); ++ mutex_unlock(&master->lock); + } + + static irqreturn_t svc_i3c_master_irq_handler(int irq, void *dev_id) +@@ -1204,9 +1208,11 @@ static int svc_i3c_master_send_bdcast_cc + cmd->read_len = 0; + cmd->continued = false; + ++ mutex_lock(&master->lock); + svc_i3c_master_enqueue_xfer(master, xfer); + if (!wait_for_completion_timeout(&xfer->comp, msecs_to_jiffies(1000))) + svc_i3c_master_dequeue_xfer(master, xfer); ++ mutex_unlock(&master->lock); + + ret = xfer->ret; + kfree(buf); +@@ -1250,9 +1256,11 @@ static int svc_i3c_master_send_direct_cc + cmd->read_len = read_len; + cmd->continued = false; + ++ mutex_lock(&master->lock); + svc_i3c_master_enqueue_xfer(master, xfer); + if (!wait_for_completion_timeout(&xfer->comp, msecs_to_jiffies(1000))) + svc_i3c_master_dequeue_xfer(master, xfer); ++ mutex_unlock(&master->lock); + + if (cmd->read_len != xfer_len) + ccc->dests[0].payload.len = cmd->read_len; +@@ -1309,9 +1317,11 @@ static int svc_i3c_master_priv_xfers(str + cmd->continued = (i + 1) < nxfers; + } + ++ mutex_lock(&master->lock); + svc_i3c_master_enqueue_xfer(master, xfer); + if (!wait_for_completion_timeout(&xfer->comp, msecs_to_jiffies(1000))) + svc_i3c_master_dequeue_xfer(master, xfer); ++ mutex_unlock(&master->lock); + + ret = xfer->ret; + svc_i3c_master_free_xfer(xfer); +@@ -1347,9 +1357,11 @@ static int svc_i3c_master_i2c_xfers(stru + cmd->continued = (i + 1 < nxfers); + } + ++ mutex_lock(&master->lock); + svc_i3c_master_enqueue_xfer(master, xfer); + if (!wait_for_completion_timeout(&xfer->comp, msecs_to_jiffies(1000))) + svc_i3c_master_dequeue_xfer(master, xfer); ++ mutex_unlock(&master->lock); + + ret = xfer->ret; + svc_i3c_master_free_xfer(xfer); +@@ -1540,6 +1552,8 @@ static int svc_i3c_master_probe(struct p + + INIT_WORK(&master->hj_work, svc_i3c_master_hj_work); + INIT_WORK(&master->ibi_work, svc_i3c_master_ibi_work); ++ mutex_init(&master->lock); ++ + ret = devm_request_irq(dev, master->irq, svc_i3c_master_irq_handler, + IRQF_NO_SUSPEND, "svc-i3c-irq", master); + if (ret) diff --git a/queue-6.6/i3c-master-svc-fix-random-hot-join-failure-since-timeout-error.patch b/queue-6.6/i3c-master-svc-fix-random-hot-join-failure-since-timeout-error.patch new file mode 100644 index 00000000000..c3803eb960b --- /dev/null +++ b/queue-6.6/i3c-master-svc-fix-random-hot-join-failure-since-timeout-error.patch @@ -0,0 +1,62 @@ +From 9aaeef113c55248ecf3ab941c2e4460aaa8b8b9a Mon Sep 17 00:00:00 2001 +From: Frank Li +Date: Mon, 23 Oct 2023 12:16:58 -0400 +Subject: i3c: master: svc: fix random hot join failure since timeout error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Frank Li + +commit 9aaeef113c55248ecf3ab941c2e4460aaa8b8b9a upstream. + +master side report: + silvaco-i3c-master 44330000.i3c-master: Error condition: MSTATUS 0x020090c7, MERRWARN 0x00100000 + +BIT 20: TIMEOUT error + The module has stalled too long in a frame. This happens when: + - The TX FIFO or RX FIFO is not handled and the bus is stuck in the +middle of a message, + - No STOP was issued and between messages, + - IBI manual is used and no decision was made. + The maximum stall period is 100 μs. + +This can be considered as being just a warning as the system IRQ latency +can easily be greater than 100us. + +Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") +Cc: +Signed-off-by: Frank Li +Reviewed-by: Miquel Raynal +Link: https://lore.kernel.org/r/20231023161658.3890811-7-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master/svc-i3c-master.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -93,6 +93,7 @@ + #define SVC_I3C_MINTMASKED 0x098 + #define SVC_I3C_MERRWARN 0x09C + #define SVC_I3C_MERRWARN_NACK BIT(2) ++#define SVC_I3C_MERRWARN_TIMEOUT BIT(20) + #define SVC_I3C_MDMACTRL 0x0A0 + #define SVC_I3C_MDATACTRL 0x0AC + #define SVC_I3C_MDATACTRL_FLUSHTB BIT(0) +@@ -227,6 +228,14 @@ static bool svc_i3c_master_error(struct + if (SVC_I3C_MSTATUS_ERRWARN(mstatus)) { + merrwarn = readl(master->regs + SVC_I3C_MERRWARN); + writel(merrwarn, master->regs + SVC_I3C_MERRWARN); ++ ++ /* Ignore timeout error */ ++ if (merrwarn & SVC_I3C_MERRWARN_TIMEOUT) { ++ dev_dbg(master->dev, "Warning condition: MSTATUS 0x%08x, MERRWARN 0x%08x\n", ++ mstatus, merrwarn); ++ return false; ++ } ++ + dev_err(master->dev, + "Error condition: MSTATUS 0x%08x, MERRWARN 0x%08x\n", + mstatus, merrwarn); diff --git a/queue-6.6/i3c-master-svc-fix-sda-keep-low-when-polling-ibiwon-timeout-happen.patch b/queue-6.6/i3c-master-svc-fix-sda-keep-low-when-polling-ibiwon-timeout-happen.patch new file mode 100644 index 00000000000..0e2c6ef8f9d --- /dev/null +++ b/queue-6.6/i3c-master-svc-fix-sda-keep-low-when-polling-ibiwon-timeout-happen.patch @@ -0,0 +1,34 @@ +From dfd7cd6aafdb1f5ba93828e97e56b38304b23a05 Mon Sep 17 00:00:00 2001 +From: Frank Li +Date: Mon, 23 Oct 2023 12:16:57 -0400 +Subject: i3c: master: svc: fix SDA keep low when polling IBIWON timeout happen + +From: Frank Li + +commit dfd7cd6aafdb1f5ba93828e97e56b38304b23a05 upstream. + +Upon IBIWON timeout, the SDA line will always be kept low if we don't emit +a stop. Calling svc_i3c_master_emit_stop() there will let the bus return to +idle state. + +Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") +Cc: +Reviewed-by: Miquel Raynal +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20231023161658.3890811-6-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master/svc-i3c-master.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -405,6 +405,7 @@ static void svc_i3c_master_ibi_work(stru + SVC_I3C_MSTATUS_IBIWON(val), 0, 1000); + if (ret) { + dev_err(master->dev, "Timeout when polling for IBIWON\n"); ++ svc_i3c_master_emit_stop(master); + goto reenable_ibis; + } + diff --git a/queue-6.6/i3c-master-svc-fix-wrong-data-return-when-ibi-happen-during-start-frame.patch b/queue-6.6/i3c-master-svc-fix-wrong-data-return-when-ibi-happen-during-start-frame.patch new file mode 100644 index 00000000000..3cad3122f74 --- /dev/null +++ b/queue-6.6/i3c-master-svc-fix-wrong-data-return-when-ibi-happen-during-start-frame.patch @@ -0,0 +1,77 @@ +From 5e5e3c92e748a6d859190e123b9193cf4911fcca Mon Sep 17 00:00:00 2001 +From: Frank Li +Date: Mon, 23 Oct 2023 12:16:54 -0400 +Subject: i3c: master: svc: fix wrong data return when IBI happen during start frame +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Frank Li + +commit 5e5e3c92e748a6d859190e123b9193cf4911fcca upstream. + + ┌─────┐ ┏──┐ ┏──┐ ┏──┐ ┏──┐ ┏──┐ ┏──┐ ┏──┐ ┏──┐ ┌───── +SCL: ┘ └─────┛ └──┛ └──┛ └──┛ └──┛ └──┛ └──┛ └──┛ └──┘ + ───┐ ┌─────┐ ┌─────┐ ┌───────────┐ +SDA: └───────────────────────┘ └─────┘ └─────┘ └───── + xxx╱ ╲╱ ╲╱ ╲╱ ╲╱ ╲ + : xxx╲IBI ╱╲ Addr(0x0a) ╱╲ RW ╱╲NACK╱╲ S ╱ + +If an In-Band Interrupt (IBI) occurs and IBI work thread is not immediately +scheduled, when svc_i3c_master_priv_xfers() initiates the I3C transfer and +attempts to send address 0x7e, the target interprets it as an +IBI handler and returns the target address 0x0a. + +However, svc_i3c_master_priv_xfers() does not handle this case and proceeds +with other transfers, resulting in incorrect data being returned. + +Add IBIWON check in svc_i3c_master_xfer(). In case this situation occurs, +return a failure to the driver. + +Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") +Cc: +Reviewed-by: Miquel Raynal +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20231023161658.3890811-3-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master/svc-i3c-master.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -1011,6 +1011,9 @@ static int svc_i3c_master_xfer(struct sv + u32 reg; + int ret; + ++ /* clean SVC_I3C_MINT_IBIWON w1c bits */ ++ writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS); ++ + writel(SVC_I3C_MCTRL_REQUEST_START_ADDR | + xfer_type | + SVC_I3C_MCTRL_IBIRESP_NACK | +@@ -1028,6 +1031,23 @@ static int svc_i3c_master_xfer(struct sv + ret = -ENXIO; + goto emit_stop; + } ++ ++ /* ++ * According to I3C spec ver 1.1.1, 5.1.2.2.3 Consequence of Controller Starting a Frame ++ * with I3C Target Address. ++ * ++ * The I3C Controller normally should start a Frame, the Address may be arbitrated, and so ++ * the Controller shall monitor to see whether an In-Band Interrupt request, a Controller ++ * Role Request (i.e., Secondary Controller requests to become the Active Controller), or ++ * a Hot-Join Request has been made. ++ * ++ * If missed IBIWON check, the wrong data will be return. When IBIWON happen, return failure ++ * and yield the above events handler. ++ */ ++ if (SVC_I3C_MSTATUS_IBIWON(reg)) { ++ ret = -ENXIO; ++ goto emit_stop; ++ } + + if (rnw) + ret = svc_i3c_master_read(master, in, xfer_len); diff --git a/queue-6.6/jbd2-fix-potential-data-lost-in-recovering-journal-raced-with-synchronizing-fs-bdev.patch b/queue-6.6/jbd2-fix-potential-data-lost-in-recovering-journal-raced-with-synchronizing-fs-bdev.patch new file mode 100644 index 00000000000..b3cb98a3d5a --- /dev/null +++ b/queue-6.6/jbd2-fix-potential-data-lost-in-recovering-journal-raced-with-synchronizing-fs-bdev.patch @@ -0,0 +1,94 @@ +From 61187fce8600e8ef90e601be84f9d0f3222c1206 Mon Sep 17 00:00:00 2001 +From: Zhihao Cheng +Date: Tue, 19 Sep 2023 09:25:25 +0800 +Subject: jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev + +From: Zhihao Cheng + +commit 61187fce8600e8ef90e601be84f9d0f3222c1206 upstream. + +JBD2 makes sure journal data is fallen on fs device by sync_blockdev(), +however, other process could intercept the EIO information from bdev's +mapping, which leads journal recovering successful even EIO occurs during +data written back to fs device. + +We found this problem in our product, iscsi + multipath is chosen for block +device of ext4. Unstable network may trigger kpartx to rescan partitions in +device mapper layer. Detailed process is shown as following: + + mount kpartx irq +jbd2_journal_recover + do_one_pass + memcpy(nbh->b_data, obh->b_data) // copy data to fs dev from journal + mark_buffer_dirty // mark bh dirty + vfs_read + generic_file_read_iter // dio + filemap_write_and_wait_range + __filemap_fdatawrite_range + do_writepages + block_write_full_folio + submit_bh_wbc + >> EIO occurs in disk << + end_buffer_async_write + mark_buffer_write_io_error + mapping_set_error + set_bit(AS_EIO, &mapping->flags) // set! + filemap_check_errors + test_and_clear_bit(AS_EIO, &mapping->flags) // clear! + err2 = sync_blockdev + filemap_write_and_wait + filemap_check_errors + test_and_clear_bit(AS_EIO, &mapping->flags) // false + err2 = 0 + +Filesystem is mounted successfully even data from journal is failed written +into disk, and ext4/ocfs2 could become corrupted. + +Fix it by comparing the wb_err state in fs block device before recovering +and after recovering. + +A reproducer can be found in the kernel bugzilla referenced below. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217888 +Cc: stable@vger.kernel.org +Signed-off-by: Zhihao Cheng +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20230919012525.1783108-1-chengzhihao1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman +--- + fs/jbd2/recovery.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/fs/jbd2/recovery.c ++++ b/fs/jbd2/recovery.c +@@ -289,6 +289,8 @@ int jbd2_journal_recover(journal_t *jour + journal_superblock_t * sb; + + struct recovery_info info; ++ errseq_t wb_err; ++ struct address_space *mapping; + + memset(&info, 0, sizeof(info)); + sb = journal->j_superblock; +@@ -306,6 +308,9 @@ int jbd2_journal_recover(journal_t *jour + return 0; + } + ++ wb_err = 0; ++ mapping = journal->j_fs_dev->bd_inode->i_mapping; ++ errseq_check_and_advance(&mapping->wb_err, &wb_err); + err = do_one_pass(journal, &info, PASS_SCAN); + if (!err) + err = do_one_pass(journal, &info, PASS_REVOKE); +@@ -329,6 +334,9 @@ int jbd2_journal_recover(journal_t *jour + err2 = sync_blockdev(journal->j_fs_dev); + if (!err) + err = err2; ++ err2 = errseq_check_and_advance(&mapping->wb_err, &wb_err); ++ if (!err) ++ err = err2; + /* Make sure all replayed data is on permanent storage */ + if (journal->j_flags & JBD2_BARRIER) { + err2 = blkdev_issue_flush(journal->j_fs_dev); diff --git a/queue-6.6/kernel-reboot-emergency_restart-set-correct-system_state.patch b/queue-6.6/kernel-reboot-emergency_restart-set-correct-system_state.patch new file mode 100644 index 00000000000..8f7430f1538 --- /dev/null +++ b/queue-6.6/kernel-reboot-emergency_restart-set-correct-system_state.patch @@ -0,0 +1,49 @@ +From 60466c067927abbcaff299845abd4b7069963139 Mon Sep 17 00:00:00 2001 +From: Benjamin Bara +Date: Sat, 15 Jul 2023 09:53:23 +0200 +Subject: kernel/reboot: emergency_restart: Set correct system_state + +From: Benjamin Bara + +commit 60466c067927abbcaff299845abd4b7069963139 upstream. + +As the emergency restart does not call kernel_restart_prepare(), the +system_state stays in SYSTEM_RUNNING. + +Since bae1d3a05a8b, this hinders i2c_in_atomic_xfer_mode() from becoming +active, and therefore might lead to avoidable warnings in the restart +handlers, e.g.: + +[ 12.667612] WARNING: CPU: 1 PID: 1 at kernel/rcu/tree_plugin.h:318 rcu_note_context_switch+0x33c/0x6b0 +[ 12.676926] Voluntary context switch within RCU read-side critical section! +... +[ 12.742376] schedule_timeout from wait_for_completion_timeout+0x90/0x114 +[ 12.749179] wait_for_completion_timeout from tegra_i2c_wait_completion+0x40/0x70 +... +[ 12.994527] atomic_notifier_call_chain from machine_restart+0x34/0x58 +[ 13.001050] machine_restart from panic+0x2a8/0x32c + +Avoid these by setting the correct system_state. + +Fixes: bae1d3a05a8b ("i2c: core: remove use of in_atomic()") +Cc: stable@vger.kernel.org # v5.2+ +Reviewed-by: Dmitry Osipenko +Tested-by: Nishanth Menon +Signed-off-by: Benjamin Bara +Link: https://lore.kernel.org/r/20230327-tegra-pmic-reboot-v7-1-18699d5dcd76@skidata.com +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman +--- + kernel/reboot.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/reboot.c ++++ b/kernel/reboot.c +@@ -74,6 +74,7 @@ void __weak (*pm_power_off)(void); + void emergency_restart(void) + { + kmsg_dump(KMSG_DUMP_EMERG); ++ system_state = SYSTEM_RESTART; + machine_emergency_restart(); + } + EXPORT_SYMBOL_GPL(emergency_restart); diff --git a/queue-6.6/mcb-fix-error-handling-for-different-scenarios-when-parsing.patch b/queue-6.6/mcb-fix-error-handling-for-different-scenarios-when-parsing.patch new file mode 100644 index 00000000000..715966ef0f2 --- /dev/null +++ b/queue-6.6/mcb-fix-error-handling-for-different-scenarios-when-parsing.patch @@ -0,0 +1,56 @@ +From 63ba2d07b4be72b94216d20561f43e1150b25d98 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sanju=C3=A1n=20Garc=C3=ADa=2C=20Jorge?= + +Date: Thu, 19 Oct 2023 14:15:34 +0000 +Subject: mcb: fix error handling for different scenarios when parsing + +From: Sanjuán García, Jorge + +commit 63ba2d07b4be72b94216d20561f43e1150b25d98 upstream. + +chameleon_parse_gdd() may fail for different reasons and end up +in the err tag. Make sure we at least always free the mcb_device +allocated with mcb_alloc_dev(). + +If mcb_device_register() fails, make sure to give up the reference +in the same place the device was added. + +Fixes: 728ac3389296 ("mcb: mcb-parse: fix error handing in chameleon_parse_gdd()") +Cc: stable +Reviewed-by: Jose Javier Rodriguez Barbarin +Signed-off-by: Jorge Sanjuan Garcia +Link: https://lore.kernel.org/r/20231019141434.57971-2-jorge.sanjuangarcia@duagon.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mcb/mcb-core.c | 1 + + drivers/mcb/mcb-parse.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c +index 2a4a5e71ad4e..ba4530459de8 100644 +--- a/drivers/mcb/mcb-core.c ++++ b/drivers/mcb/mcb-core.c +@@ -246,6 +246,7 @@ int mcb_device_register(struct mcb_bus *bus, struct mcb_device *dev) + return 0; + + out: ++ put_device(&dev->dev); + + return ret; + } +diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c +index 656b6b71c768..1ae37e693de0 100644 +--- a/drivers/mcb/mcb-parse.c ++++ b/drivers/mcb/mcb-parse.c +@@ -106,7 +106,7 @@ static int chameleon_parse_gdd(struct mcb_bus *bus, + return 0; + + err: +- put_device(&mdev->dev); ++ mcb_free_dev(mdev); + + return ret; + } +-- +2.43.0 + diff --git a/queue-6.6/mips-use-nth_page-in-place-of-direct-struct-page-manipulation.patch b/queue-6.6/mips-use-nth_page-in-place-of-direct-struct-page-manipulation.patch new file mode 100644 index 00000000000..60727218676 --- /dev/null +++ b/queue-6.6/mips-use-nth_page-in-place-of-direct-struct-page-manipulation.patch @@ -0,0 +1,45 @@ +From aa5fe31b6b59210cb4ea28a59e68781f48eeca74 Mon Sep 17 00:00:00 2001 +From: Zi Yan +Date: Wed, 13 Sep 2023 16:12:48 -0400 +Subject: mips: use nth_page() in place of direct struct page manipulation + +From: Zi Yan + +commit aa5fe31b6b59210cb4ea28a59e68781f48eeca74 upstream. + +__flush_dcache_pages() is called during hugetlb migration via +migrate_pages() -> migrate_hugetlbs() -> unmap_and_move_huge_page() -> +move_to_new_folio() -> flush_dcache_folio(). And with hugetlb and without +sparsemem vmemmap, struct page is not guaranteed to be contiguous beyond a +section. Use nth_page() instead. + +Without the fix, a wrong address might be used for data cache page flush. +No bug is reported. The fix comes from code inspection. + +Link: https://lkml.kernel.org/r/20230913201248.452081-6-zi.yan@sent.com +Fixes: 15fa3e8e3269 ("mips: implement the new page table range API") +Signed-off-by: Zi Yan +Cc: David Hildenbrand +Cc: Matthew Wilcox (Oracle) +Cc: Mike Kravetz +Cc: Mike Rapoport (IBM) +Cc: Muchun Song +Cc: Thomas Bogendoerfer +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/mm/cache.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/mips/mm/cache.c ++++ b/arch/mips/mm/cache.c +@@ -117,7 +117,7 @@ void __flush_dcache_pages(struct page *p + * get faulted into the tlb (and thus flushed) anyways. + */ + for (i = 0; i < nr; i++) { +- addr = (unsigned long)kmap_local_page(page + i); ++ addr = (unsigned long)kmap_local_page(nth_page(page, i)); + flush_data_cache_page(addr); + kunmap_local((void *)addr); + } diff --git a/queue-6.6/mm-cma-use-nth_page-in-place-of-direct-struct-page-manipulation.patch b/queue-6.6/mm-cma-use-nth_page-in-place-of-direct-struct-page-manipulation.patch new file mode 100644 index 00000000000..b7443355744 --- /dev/null +++ b/queue-6.6/mm-cma-use-nth_page-in-place-of-direct-struct-page-manipulation.patch @@ -0,0 +1,59 @@ +From 2e7cfe5cd5b6b0b98abf57a3074885979e187c1c Mon Sep 17 00:00:00 2001 +From: Zi Yan +Date: Wed, 13 Sep 2023 16:12:44 -0400 +Subject: mm/cma: use nth_page() in place of direct struct page manipulation + +From: Zi Yan + +commit 2e7cfe5cd5b6b0b98abf57a3074885979e187c1c upstream. + +Patch series "Use nth_page() in place of direct struct page manipulation", +v3. + +On SPARSEMEM without VMEMMAP, struct page is not guaranteed to be +contiguous, since each memory section's memmap might be allocated +independently. hugetlb pages can go beyond a memory section size, thus +direct struct page manipulation on hugetlb pages/subpages might give wrong +struct page. Kernel provides nth_page() to do the manipulation properly. +Use that whenever code can see hugetlb pages. + + +This patch (of 5): + +When dealing with hugetlb pages, manipulating struct page pointers +directly can get to wrong struct page, since struct page is not guaranteed +to be contiguous on SPARSEMEM without VMEMMAP. Use nth_page() to handle +it properly. + +Without the fix, page_kasan_tag_reset() could reset wrong page tags, +causing a wrong kasan result. No related bug is reported. The fix +comes from code inspection. + +Link: https://lkml.kernel.org/r/20230913201248.452081-1-zi.yan@sent.com +Link: https://lkml.kernel.org/r/20230913201248.452081-2-zi.yan@sent.com +Fixes: 2813b9c02962 ("kasan, mm, arm64: tag non slab memory allocated via pagealloc") +Signed-off-by: Zi Yan +Reviewed-by: Muchun Song +Cc: David Hildenbrand +Cc: Matthew Wilcox (Oracle) +Cc: Mike Kravetz +Cc: Mike Rapoport (IBM) +Cc: Thomas Bogendoerfer +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/cma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/cma.c ++++ b/mm/cma.c +@@ -505,7 +505,7 @@ struct page *cma_alloc(struct cma *cma, + */ + if (page) { + for (i = 0; i < count; i++) +- page_kasan_tag_reset(page + i); ++ page_kasan_tag_reset(nth_page(page, i)); + } + + if (ret && !no_warn) { diff --git a/queue-6.6/mm-hugetlb-use-nth_page-in-place-of-direct-struct-page-manipulation.patch b/queue-6.6/mm-hugetlb-use-nth_page-in-place-of-direct-struct-page-manipulation.patch new file mode 100644 index 00000000000..52504b4252f --- /dev/null +++ b/queue-6.6/mm-hugetlb-use-nth_page-in-place-of-direct-struct-page-manipulation.patch @@ -0,0 +1,45 @@ +From 426056efe835cf4864ccf4c328fe3af9146fc539 Mon Sep 17 00:00:00 2001 +From: Zi Yan +Date: Wed, 13 Sep 2023 16:12:45 -0400 +Subject: mm/hugetlb: use nth_page() in place of direct struct page manipulation + +From: Zi Yan + +commit 426056efe835cf4864ccf4c328fe3af9146fc539 upstream. + +When dealing with hugetlb pages, manipulating struct page pointers +directly can get to wrong struct page, since struct page is not guaranteed +to be contiguous on SPARSEMEM without VMEMMAP. Use nth_page() to handle +it properly. + +A wrong or non-existing page might be tried to be grabbed, either +leading to a non freeable page or kernel memory access errors. No bug +is reported. It comes from code inspection. + +Link: https://lkml.kernel.org/r/20230913201248.452081-3-zi.yan@sent.com +Fixes: 57a196a58421 ("hugetlb: simplify hugetlb handling in follow_page_mask") +Signed-off-by: Zi Yan +Reviewed-by: Muchun Song +Cc: David Hildenbrand +Cc: Matthew Wilcox (Oracle) +Cc: Mike Kravetz +Cc: Mike Rapoport (IBM) +Cc: Thomas Bogendoerfer +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/hugetlb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -6520,7 +6520,7 @@ struct page *hugetlb_follow_page_mask(st + } + } + +- page += ((address & ~huge_page_mask(h)) >> PAGE_SHIFT); ++ page = nth_page(page, ((address & ~huge_page_mask(h)) >> PAGE_SHIFT)); + + /* + * Note that page may be a sub-page, and with vmemmap diff --git a/queue-6.6/mm-make-pr_mdwe_refuse_exec_gain-an-unsigned-long.patch b/queue-6.6/mm-make-pr_mdwe_refuse_exec_gain-an-unsigned-long.patch new file mode 100644 index 00000000000..f794a6156d7 --- /dev/null +++ b/queue-6.6/mm-make-pr_mdwe_refuse_exec_gain-an-unsigned-long.patch @@ -0,0 +1,73 @@ +From 0da668333fb07805c2836d5d50e26eda915b24a1 Mon Sep 17 00:00:00 2001 +From: Florent Revest +Date: Mon, 28 Aug 2023 17:08:56 +0200 +Subject: mm: make PR_MDWE_REFUSE_EXEC_GAIN an unsigned long + +From: Florent Revest + +commit 0da668333fb07805c2836d5d50e26eda915b24a1 upstream. + +Defining a prctl flag as an int is a footgun because on a 64 bit machine +and with a variadic implementation of prctl (like in musl and glibc), when +used directly as a prctl argument, it can get casted to long with garbage +upper bits which would result in unexpected behaviors. + +This patch changes the constant to an unsigned long to eliminate that +possibilities. This does not break UAPI. + +I think that a stable backport would be "nice to have": to reduce the +chances that users build binaries that could end up with garbage bits in +their MDWE prctl arguments. We are not aware of anyone having yet +encountered this corner case with MDWE prctls but a backport would reduce +the likelihood it happens, since this sort of issues has happened with +other prctls. But If this is perceived as a backporting burden, I suppose +we could also live without a stable backport. + +Link: https://lkml.kernel.org/r/20230828150858.393570-5-revest@chromium.org +Fixes: b507808ebce2 ("mm: implement memory-deny-write-execute as a prctl") +Signed-off-by: Florent Revest +Suggested-by: Alexey Izbyshev +Reviewed-by: David Hildenbrand +Reviewed-by: Kees Cook +Acked-by: Catalin Marinas +Cc: Anshuman Khandual +Cc: Ayush Jain +Cc: Greg Thelen +Cc: Joey Gouly +Cc: KP Singh +Cc: Mark Brown +Cc: Michal Hocko +Cc: Peter Xu +Cc: Ryan Roberts +Cc: Szabolcs Nagy +Cc: Topi Miettinen +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + include/uapi/linux/prctl.h | 2 +- + tools/include/uapi/linux/prctl.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/include/uapi/linux/prctl.h ++++ b/include/uapi/linux/prctl.h +@@ -283,7 +283,7 @@ struct prctl_mm_map { + + /* Memory deny write / execute */ + #define PR_SET_MDWE 65 +-# define PR_MDWE_REFUSE_EXEC_GAIN 1 ++# define PR_MDWE_REFUSE_EXEC_GAIN (1UL << 0) + + #define PR_GET_MDWE 66 + +--- a/tools/include/uapi/linux/prctl.h ++++ b/tools/include/uapi/linux/prctl.h +@@ -283,7 +283,7 @@ struct prctl_mm_map { + + /* Memory deny write / execute */ + #define PR_SET_MDWE 65 +-# define PR_MDWE_REFUSE_EXEC_GAIN 1 ++# define PR_MDWE_REFUSE_EXEC_GAIN (1UL << 0) + + #define PR_GET_MDWE 66 + diff --git a/queue-6.6/mm-memory_hotplug-use-pfn-math-in-place-of-direct-struct-page-manipulation.patch b/queue-6.6/mm-memory_hotplug-use-pfn-math-in-place-of-direct-struct-page-manipulation.patch new file mode 100644 index 00000000000..22d8a9888e4 --- /dev/null +++ b/queue-6.6/mm-memory_hotplug-use-pfn-math-in-place-of-direct-struct-page-manipulation.patch @@ -0,0 +1,46 @@ +From 1640a0ef80f6d572725f5b0330038c18e98ea168 Mon Sep 17 00:00:00 2001 +From: Zi Yan +Date: Wed, 13 Sep 2023 16:12:46 -0400 +Subject: mm/memory_hotplug: use pfn math in place of direct struct page manipulation + +From: Zi Yan + +commit 1640a0ef80f6d572725f5b0330038c18e98ea168 upstream. + +When dealing with hugetlb pages, manipulating struct page pointers +directly can get to wrong struct page, since struct page is not guaranteed +to be contiguous on SPARSEMEM without VMEMMAP. Use pfn calculation to +handle it properly. + +Without the fix, a wrong number of page might be skipped. Since skip cannot be +negative, scan_movable_page() will end early and might miss a movable page with +-ENOENT. This might fail offline_pages(). No bug is reported. The fix comes +from code inspection. + +Link: https://lkml.kernel.org/r/20230913201248.452081-4-zi.yan@sent.com +Fixes: eeb0efd071d8 ("mm,memory_hotplug: fix scan_movable_pages() for gigantic hugepages") +Signed-off-by: Zi Yan +Reviewed-by: Muchun Song +Acked-by: David Hildenbrand +Cc: Matthew Wilcox (Oracle) +Cc: Mike Kravetz +Cc: Mike Rapoport (IBM) +Cc: Thomas Bogendoerfer +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/memory_hotplug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -1689,7 +1689,7 @@ static int scan_movable_pages(unsigned l + */ + if (HPageMigratable(head)) + goto found; +- skip = compound_nr(head) - (page - head); ++ skip = compound_nr(head) - (pfn - page_to_pfn(head)); + pfn += skip - 1; + } + return -ENOENT; diff --git a/queue-6.6/mtd-cfi_cmdset_0001-byte-swap-otp-info.patch b/queue-6.6/mtd-cfi_cmdset_0001-byte-swap-otp-info.patch new file mode 100644 index 00000000000..43c8c256832 --- /dev/null +++ b/queue-6.6/mtd-cfi_cmdset_0001-byte-swap-otp-info.patch @@ -0,0 +1,75 @@ +From 565fe150624ee77dc63a735cc1b3bff5101f38a3 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Fri, 20 Oct 2023 22:30:29 +0200 +Subject: mtd: cfi_cmdset_0001: Byte swap OTP info + +From: Linus Walleij + +commit 565fe150624ee77dc63a735cc1b3bff5101f38a3 upstream. + +Currently the offset into the device when looking for OTP +bits can go outside of the address of the MTD NOR devices, +and if that memory isn't readable, bad things happen +on the IXP4xx (added prints that illustrate the problem before +the crash): + +cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x00000100 +ixp4xx_copy_from copy from 0x00000100 to 0xc880dd78 +cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x12000000 +ixp4xx_copy_from copy from 0x12000000 to 0xc880dd78 +8<--- cut here --- +Unable to handle kernel paging request at virtual address db000000 +[db000000] *pgd=00000000 +(...) + +This happens in this case because the IXP4xx is big endian and +the 32- and 16-bit fields in the struct cfi_intelext_otpinfo are not +properly byteswapped. Compare to how the code in read_pri_intelext() +byteswaps the fields in struct cfi_pri_intelext. + +Adding a small byte swapping loop for the OTP in read_pri_intelext() +and the crash goes away. + +The problem went unnoticed for many years until I enabled +CONFIG_MTD_OTP on the IXP4xx as well, triggering the bug. + +Cc: stable@vger.kernel.org +Reviewed-by: Nicolas Pitre +Signed-off-by: Linus Walleij +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20231020-mtd-otp-byteswap-v4-1-0d132c06aa9d@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/chips/cfi_cmdset_0001.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/chips/cfi_cmdset_0001.c ++++ b/drivers/mtd/chips/cfi_cmdset_0001.c +@@ -422,9 +422,25 @@ read_pri_intelext(struct map_info *map, + extra_size = 0; + + /* Protection Register info */ +- if (extp->NumProtectionFields) ++ if (extp->NumProtectionFields) { ++ struct cfi_intelext_otpinfo *otp = ++ (struct cfi_intelext_otpinfo *)&extp->extra[0]; ++ + extra_size += (extp->NumProtectionFields - 1) * +- sizeof(struct cfi_intelext_otpinfo); ++ sizeof(struct cfi_intelext_otpinfo); ++ ++ if (extp_size >= sizeof(*extp) + extra_size) { ++ int i; ++ ++ /* Do some byteswapping if necessary */ ++ for (i = 0; i < extp->NumProtectionFields - 1; i++) { ++ otp->ProtRegAddr = le32_to_cpu(otp->ProtRegAddr); ++ otp->FactGroups = le16_to_cpu(otp->FactGroups); ++ otp->UserGroups = le16_to_cpu(otp->UserGroups); ++ otp++; ++ } ++ } ++ } + } + + if (extp->MinorVersion >= '1') { diff --git a/queue-6.6/powerpc-pseries-iommu-enable_ddw-incorrectly-returns-direct-mapping-for-sr-iov-device.patch b/queue-6.6/powerpc-pseries-iommu-enable_ddw-incorrectly-returns-direct-mapping-for-sr-iov-device.patch new file mode 100644 index 00000000000..c1ba9965682 --- /dev/null +++ b/queue-6.6/powerpc-pseries-iommu-enable_ddw-incorrectly-returns-direct-mapping-for-sr-iov-device.patch @@ -0,0 +1,68 @@ +From 3bf983e4e93ce8e6d69e9d63f52a66ec0856672e Mon Sep 17 00:00:00 2001 +From: Gaurav Batra +Date: Mon, 2 Oct 2023 22:08:02 -0500 +Subject: powerpc/pseries/iommu: enable_ddw incorrectly returns direct mapping for SR-IOV device + +From: Gaurav Batra + +commit 3bf983e4e93ce8e6d69e9d63f52a66ec0856672e upstream. + +When a device is initialized, the driver invokes dma_supported() twice - +first for streaming mappings followed by coherent mappings. For an +SR-IOV device, default window is deleted and DDW created. With vPMEM +enabled, TCE mappings are dynamically created for both vPMEM and SR-IOV +device. There are no direct mappings. + +First time when dma_supported() is called with 64 bit mask, DDW is created +and marked as dynamic window. The second time dma_supported() is called, +enable_ddw() finds existing window for the device and incorrectly returns +it as "direct mapping". + +This only happens when size of DDW is big enough to map max LPAR memory. + +This results in streaming TCEs to not get dynamically mapped, since code +incorrently assumes these are already pre-mapped. The adapter initially +comes up but goes down due to EEH. + +Fixes: 381ceda88c4c ("powerpc/pseries/iommu: Make use of DDW for indirect mapping") +Cc: stable@vger.kernel.org # v5.15+ +Signed-off-by: Gaurav Batra +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20231003030802.47914-1-gbatra@linux.vnet.ibm.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/pseries/iommu.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/powerpc/platforms/pseries/iommu.c ++++ b/arch/powerpc/platforms/pseries/iommu.c +@@ -914,7 +914,8 @@ static int remove_ddw(struct device_node + return 0; + } + +-static bool find_existing_ddw(struct device_node *pdn, u64 *dma_addr, int *window_shift) ++static bool find_existing_ddw(struct device_node *pdn, u64 *dma_addr, int *window_shift, ++ bool *direct_mapping) + { + struct dma_win *window; + const struct dynamic_dma_window_prop *dma64; +@@ -927,6 +928,7 @@ static bool find_existing_ddw(struct dev + dma64 = window->prop; + *dma_addr = be64_to_cpu(dma64->dma_base); + *window_shift = be32_to_cpu(dma64->window_shift); ++ *direct_mapping = window->direct; + found = true; + break; + } +@@ -1270,10 +1272,8 @@ static bool enable_ddw(struct pci_dev *d + + mutex_lock(&dma_win_init_mutex); + +- if (find_existing_ddw(pdn, &dev->dev.archdata.dma_offset, &len)) { +- direct_mapping = (len >= max_ram_len); ++ if (find_existing_ddw(pdn, &dev->dev.archdata.dma_offset, &len, &direct_mapping)) + goto out_unlock; +- } + + /* + * If we already went through this for a previous function of diff --git a/queue-6.6/quota-explicitly-forbid-quota-files-from-being-encrypted.patch b/queue-6.6/quota-explicitly-forbid-quota-files-from-being-encrypted.patch new file mode 100644 index 00000000000..cdfcc6deb9d --- /dev/null +++ b/queue-6.6/quota-explicitly-forbid-quota-files-from-being-encrypted.patch @@ -0,0 +1,64 @@ +From d3cc1b0be258191d6360c82ea158c2972f8d3991 Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Mon, 4 Sep 2023 17:32:27 -0700 +Subject: quota: explicitly forbid quota files from being encrypted + +From: Eric Biggers + +commit d3cc1b0be258191d6360c82ea158c2972f8d3991 upstream. + +Since commit d7e7b9af104c ("fscrypt: stop using keyrings subsystem for +fscrypt_master_key"), xfstest generic/270 causes a WARNING when run on +f2fs with test_dummy_encryption in the mount options: + +$ kvm-xfstests -c f2fs/encrypt generic/270 +[...] +WARNING: CPU: 1 PID: 2453 at fs/crypto/keyring.c:240 fscrypt_destroy_keyring+0x1f5/0x260 + +The cause of the WARNING is that not all encrypted inodes have been +evicted before fscrypt_destroy_keyring() is called, which violates an +assumption. This happens because the test uses an external quota file, +which gets automatically encrypted due to test_dummy_encryption. + +Encryption of quota files has never really been supported. On ext4, +ext4_quota_read() does not decrypt the data, so encrypted quota files +are always considered invalid on ext4. On f2fs, f2fs_quota_read() uses +the pagecache, so trying to use an encrypted quota file gets farther, +resulting in the issue described above being possible. But this was +never intended to be possible, and there is no use case for it. + +Therefore, make the quota support layer explicitly reject using +IS_ENCRYPTED inodes when quotaon is attempted. + +Cc: stable@vger.kernel.org +Signed-off-by: Eric Biggers +Signed-off-by: Jan Kara +Message-Id: <20230905003227.326998-1-ebiggers@kernel.org> +Signed-off-by: Greg Kroah-Hartman +--- + fs/quota/dquot.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -2351,6 +2351,20 @@ static int vfs_setup_quota_inode(struct + if (sb_has_quota_loaded(sb, type)) + return -EBUSY; + ++ /* ++ * Quota files should never be encrypted. They should be thought of as ++ * filesystem metadata, not user data. New-style internal quota files ++ * cannot be encrypted by users anyway, but old-style external quota ++ * files could potentially be incorrectly created in an encrypted ++ * directory, hence this explicit check. Some reasons why encrypted ++ * quota files don't work include: (1) some filesystems that support ++ * encryption don't handle it in their quota_read and quota_write, and ++ * (2) cleaning up encrypted quota files at unmount would need special ++ * consideration, as quota files are cleaned up later than user files. ++ */ ++ if (IS_ENCRYPTED(inode)) ++ return -EINVAL; ++ + dqopt->files[type] = igrab(inode); + if (!dqopt->files[type]) + return -EIO; diff --git a/queue-6.6/s390-cmma-fix-detection-of-dat-pages.patch b/queue-6.6/s390-cmma-fix-detection-of-dat-pages.patch new file mode 100644 index 00000000000..c1c4c52bb21 --- /dev/null +++ b/queue-6.6/s390-cmma-fix-detection-of-dat-pages.patch @@ -0,0 +1,62 @@ +From 44d93045247661acbd50b1629e62f415f2747577 Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Tue, 24 Oct 2023 10:15:19 +0200 +Subject: s390/cmma: fix detection of DAT pages + +From: Heiko Carstens + +commit 44d93045247661acbd50b1629e62f415f2747577 upstream. + +If the cmma no-dat feature is available the kernel page tables are walked +to identify and mark all pages which are used for address translation (all +region, segment, and page tables). In a subsequent loop all other pages are +marked as "no-dat" pages with the ESSA instruction. + +This information is visible to the hypervisor, so that the hypervisor can +optimize purging of guest TLB entries. The initial loop however is +incorrect: only the first three of the four pages which belong to segment +and region tables will be marked as being used for DAT. The last page is +incorrectly marked as no-dat. + +This can result in incorrect guest TLB flushes. + +Fix this by simply marking all four pages. + +Cc: +Reviewed-by: Claudio Imbrenda +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/mm/page-states.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/s390/mm/page-states.c ++++ b/arch/s390/mm/page-states.c +@@ -121,7 +121,7 @@ static void mark_kernel_pud(p4d_t *p4d, + continue; + if (!pud_folded(*pud)) { + page = phys_to_page(pud_val(*pud)); +- for (i = 0; i < 3; i++) ++ for (i = 0; i < 4; i++) + set_bit(PG_arch_1, &page[i].flags); + } + mark_kernel_pmd(pud, addr, next); +@@ -142,7 +142,7 @@ static void mark_kernel_p4d(pgd_t *pgd, + continue; + if (!p4d_folded(*p4d)) { + page = phys_to_page(p4d_val(*p4d)); +- for (i = 0; i < 3; i++) ++ for (i = 0; i < 4; i++) + set_bit(PG_arch_1, &page[i].flags); + } + mark_kernel_pud(p4d, addr, next); +@@ -171,7 +171,7 @@ static void mark_kernel_pgd(void) + continue; + if (!pgd_folded(*pgd)) { + page = phys_to_page(pgd_val(*pgd)); +- for (i = 0; i < 3; i++) ++ for (i = 0; i < 4; i++) + set_bit(PG_arch_1, &page[i].flags); + } + mark_kernel_p4d(pgd, addr, next); diff --git a/queue-6.6/s390-cmma-fix-handling-of-swapper_pg_dir-and-invalid_pg_dir.patch b/queue-6.6/s390-cmma-fix-handling-of-swapper_pg_dir-and-invalid_pg_dir.patch new file mode 100644 index 00000000000..aced6b443ac --- /dev/null +++ b/queue-6.6/s390-cmma-fix-handling-of-swapper_pg_dir-and-invalid_pg_dir.patch @@ -0,0 +1,45 @@ +From 84bb41d5df48868055d159d9247b80927f1f70f9 Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Tue, 24 Oct 2023 10:15:20 +0200 +Subject: s390/cmma: fix handling of swapper_pg_dir and invalid_pg_dir + +From: Heiko Carstens + +commit 84bb41d5df48868055d159d9247b80927f1f70f9 upstream. + +If the cmma no-dat feature is available the kernel page tables are walked +to identify and mark all pages which are used for address translation (all +region, segment, and page tables). In a subsequent loop all other pages are +marked as "no-dat" pages with the ESSA instruction. + +This information is visible to the hypervisor, so that the hypervisor can +optimize purging of guest TLB entries. All pages used for swapper_pg_dir +and invalid_pg_dir are incorrectly marked as no-dat, which in turn can +result in incorrect guest TLB flushes. + +Fix this by marking those pages correctly as being used for DAT. + +Cc: +Reviewed-by: Claudio Imbrenda +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/mm/page-states.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/arch/s390/mm/page-states.c ++++ b/arch/s390/mm/page-states.c +@@ -188,6 +188,12 @@ void __init cmma_init_nodat(void) + return; + /* Mark pages used in kernel page tables */ + mark_kernel_pgd(); ++ page = virt_to_page(&swapper_pg_dir); ++ for (i = 0; i < 4; i++) ++ set_bit(PG_arch_1, &page[i].flags); ++ page = virt_to_page(&invalid_pg_dir); ++ for (i = 0; i < 4; i++) ++ set_bit(PG_arch_1, &page[i].flags); + + /* Set all kernel pages not used for page tables to stable/no-dat */ + for_each_mem_pfn_range(i, MAX_NUMNODES, &start, &end, NULL) { diff --git a/queue-6.6/s390-cmma-fix-initial-kernel-address-space-page-table-walk.patch b/queue-6.6/s390-cmma-fix-initial-kernel-address-space-page-table-walk.patch new file mode 100644 index 00000000000..776e388b7e1 --- /dev/null +++ b/queue-6.6/s390-cmma-fix-initial-kernel-address-space-page-table-walk.patch @@ -0,0 +1,69 @@ +From 16ba44826a04834d3eeeda4b731c2ea3481062b7 Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Tue, 17 Oct 2023 21:07:03 +0200 +Subject: s390/cmma: fix initial kernel address space page table walk + +From: Heiko Carstens + +commit 16ba44826a04834d3eeeda4b731c2ea3481062b7 upstream. + +If the cmma no-dat feature is available the kernel page tables are walked +to identify and mark all pages which are used for address translation (all +region, segment, and page tables). In a subsequent loop all other pages are +marked as "no-dat" pages with the ESSA instruction. + +This information is visible to the hypervisor, so that the hypervisor can +optimize purging of guest TLB entries. The initial loop however does not +cover the complete kernel address space. This can result in pages being +marked as not being used for dynamic address translation, even though they +are. In turn guest TLB entries incorrectly may not be purged. + +Fix this by adjusting the end address of the kernel address range being +walked. + +Cc: +Reviewed-by: Claudio Imbrenda +Reviewed-by: Alexander Gordeev +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/mm/page-states.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/arch/s390/mm/page-states.c ++++ b/arch/s390/mm/page-states.c +@@ -151,15 +151,22 @@ static void mark_kernel_p4d(pgd_t *pgd, + + static void mark_kernel_pgd(void) + { +- unsigned long addr, next; ++ unsigned long addr, next, max_addr; + struct page *page; + pgd_t *pgd; + int i; + + addr = 0; ++ /* ++ * Figure out maximum virtual address accessible with the ++ * kernel ASCE. This is required to keep the page table walker ++ * from accessing non-existent entries. ++ */ ++ max_addr = (S390_lowcore.kernel_asce.val & _ASCE_TYPE_MASK) >> 2; ++ max_addr = 1UL << (max_addr * 11 + 31); + pgd = pgd_offset_k(addr); + do { +- next = pgd_addr_end(addr, MODULES_END); ++ next = pgd_addr_end(addr, max_addr); + if (pgd_none(*pgd)) + continue; + if (!pgd_folded(*pgd)) { +@@ -168,7 +175,7 @@ static void mark_kernel_pgd(void) + set_bit(PG_arch_1, &page[i].flags); + } + mark_kernel_p4d(pgd, addr, next); +- } while (pgd++, addr = next, addr != MODULES_END); ++ } while (pgd++, addr = next, addr != max_addr); + } + + void __init cmma_init_nodat(void) diff --git a/queue-6.6/s390-mm-add-missing-arch_set_page_dat-call-to-gmap-allocations.patch b/queue-6.6/s390-mm-add-missing-arch_set_page_dat-call-to-gmap-allocations.patch new file mode 100644 index 00000000000..689c6e59611 --- /dev/null +++ b/queue-6.6/s390-mm-add-missing-arch_set_page_dat-call-to-gmap-allocations.patch @@ -0,0 +1,126 @@ +From 1954da4a2b621a3328a63382cae7e5f5e2af502c Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Fri, 20 Oct 2023 17:26:50 +0200 +Subject: s390/mm: add missing arch_set_page_dat() call to gmap allocations + +From: Heiko Carstens + +commit 1954da4a2b621a3328a63382cae7e5f5e2af502c upstream. + +If the cmma no-dat feature is available all pages that are not used for +dynamic address translation are marked as "no-dat" with the ESSA +instruction. This information is visible to the hypervisor, so that the +hypervisor can optimize purging of guest TLB entries. This also means that +pages which are used for dynamic address translation must not be marked as +"no-dat", since the hypervisor may then incorrectly not purge guest TLB +entries. + +Region, segment, and page tables allocated within the gmap code are +incorrectly marked as "no-dat", since an explicit call to +arch_set_page_dat() is missing, which would remove the "no-dat" mark. + +In order to fix this add a new gmap_alloc_crst() function which should +be used to allocate region and segment tables, and which also calls +arch_set_page_dat(). + +Also add the arch_set_page_dat() call to page_table_alloc_pgste(). + +Cc: +Reviewed-by: Claudio Imbrenda +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/mm/gmap.c | 24 ++++++++++++++++++------ + arch/s390/mm/pgalloc.c | 1 + + 2 files changed, 19 insertions(+), 6 deletions(-) + +--- a/arch/s390/mm/gmap.c ++++ b/arch/s390/mm/gmap.c +@@ -21,10 +21,22 @@ + + #include + #include ++#include + #include + + #define GMAP_SHADOW_FAKE_TABLE 1ULL + ++static struct page *gmap_alloc_crst(void) ++{ ++ struct page *page; ++ ++ page = alloc_pages(GFP_KERNEL_ACCOUNT, CRST_ALLOC_ORDER); ++ if (!page) ++ return NULL; ++ arch_set_page_dat(page, CRST_ALLOC_ORDER); ++ return page; ++} ++ + /** + * gmap_alloc - allocate and initialize a guest address space + * @limit: maximum address of the gmap address space +@@ -67,7 +79,7 @@ static struct gmap *gmap_alloc(unsigned + spin_lock_init(&gmap->guest_table_lock); + spin_lock_init(&gmap->shadow_lock); + refcount_set(&gmap->ref_count, 1); +- page = alloc_pages(GFP_KERNEL_ACCOUNT, CRST_ALLOC_ORDER); ++ page = gmap_alloc_crst(); + if (!page) + goto out_free; + page->index = 0; +@@ -308,7 +320,7 @@ static int gmap_alloc_table(struct gmap + unsigned long *new; + + /* since we dont free the gmap table until gmap_free we can unlock */ +- page = alloc_pages(GFP_KERNEL_ACCOUNT, CRST_ALLOC_ORDER); ++ page = gmap_alloc_crst(); + if (!page) + return -ENOMEM; + new = page_to_virt(page); +@@ -1759,7 +1771,7 @@ int gmap_shadow_r2t(struct gmap *sg, uns + + BUG_ON(!gmap_is_shadow(sg)); + /* Allocate a shadow region second table */ +- page = alloc_pages(GFP_KERNEL_ACCOUNT, CRST_ALLOC_ORDER); ++ page = gmap_alloc_crst(); + if (!page) + return -ENOMEM; + page->index = r2t & _REGION_ENTRY_ORIGIN; +@@ -1843,7 +1855,7 @@ int gmap_shadow_r3t(struct gmap *sg, uns + + BUG_ON(!gmap_is_shadow(sg)); + /* Allocate a shadow region second table */ +- page = alloc_pages(GFP_KERNEL_ACCOUNT, CRST_ALLOC_ORDER); ++ page = gmap_alloc_crst(); + if (!page) + return -ENOMEM; + page->index = r3t & _REGION_ENTRY_ORIGIN; +@@ -1927,7 +1939,7 @@ int gmap_shadow_sgt(struct gmap *sg, uns + + BUG_ON(!gmap_is_shadow(sg) || (sgt & _REGION3_ENTRY_LARGE)); + /* Allocate a shadow segment table */ +- page = alloc_pages(GFP_KERNEL_ACCOUNT, CRST_ALLOC_ORDER); ++ page = gmap_alloc_crst(); + if (!page) + return -ENOMEM; + page->index = sgt & _REGION_ENTRY_ORIGIN; +@@ -2855,7 +2867,7 @@ int s390_replace_asce(struct gmap *gmap) + if ((gmap->asce & _ASCE_TYPE_MASK) == _ASCE_TYPE_SEGMENT) + return -EINVAL; + +- page = alloc_pages(GFP_KERNEL_ACCOUNT, CRST_ALLOC_ORDER); ++ page = gmap_alloc_crst(); + if (!page) + return -ENOMEM; + page->index = 0; +--- a/arch/s390/mm/pgalloc.c ++++ b/arch/s390/mm/pgalloc.c +@@ -146,6 +146,7 @@ struct page *page_table_alloc_pgste(stru + ptdesc = pagetable_alloc(GFP_KERNEL, 0); + if (ptdesc) { + table = (u64 *)ptdesc_to_virt(ptdesc); ++ arch_set_page_dat(virt_to_page(table), 0); + memset64(table, _PAGE_INVALID, PTRS_PER_PTE); + memset64(table + PTRS_PER_PTE, 0, PTRS_PER_PTE); + } diff --git a/queue-6.6/s390-mm-add-missing-arch_set_page_dat-call-to-vmem_crst_alloc.patch b/queue-6.6/s390-mm-add-missing-arch_set_page_dat-call-to-vmem_crst_alloc.patch new file mode 100644 index 00000000000..9d0f0d187f0 --- /dev/null +++ b/queue-6.6/s390-mm-add-missing-arch_set_page_dat-call-to-vmem_crst_alloc.patch @@ -0,0 +1,58 @@ +From 09cda0a400519b1541591c506e54c9c48e3101bf Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Tue, 17 Oct 2023 21:07:04 +0200 +Subject: s390/mm: add missing arch_set_page_dat() call to vmem_crst_alloc() + +From: Heiko Carstens + +commit 09cda0a400519b1541591c506e54c9c48e3101bf upstream. + +If the cmma no-dat feature is available all pages that are not used for +dynamic address translation are marked as "no-dat" with the ESSA +instruction. This information is visible to the hypervisor, so that the +hypervisor can optimize purging of guest TLB entries. This also means that +pages which are used for dynamic address translation must not be marked as +"no-dat", since the hypervisor may then incorrectly not purge guest TLB +entries. + +Region and segment tables allocated via vmem_crst_alloc() are incorrectly +marked as "no-dat", as soon as slab_is_available() returns true. + +Such tables are allocated e.g. when kernel page tables are split, memory is +hotplugged, or a DCSS segment is loaded. + +Fix this by adding the missing arch_set_page_dat() call. + +Cc: +Reviewed-by: Claudio Imbrenda +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/mm/vmem.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/arch/s390/mm/vmem.c ++++ b/arch/s390/mm/vmem.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -45,8 +46,11 @@ void *vmem_crst_alloc(unsigned long val) + unsigned long *table; + + table = vmem_alloc_pages(CRST_ALLOC_ORDER); +- if (table) +- crst_table_init(table, val); ++ if (!table) ++ return NULL; ++ crst_table_init(table, val); ++ if (slab_is_available()) ++ arch_set_page_dat(virt_to_page(table), CRST_ALLOC_ORDER); + return table; + } + diff --git a/queue-6.6/scripts-gdb-vmalloc-disable-on-no-mmu.patch b/queue-6.6/scripts-gdb-vmalloc-disable-on-no-mmu.patch new file mode 100644 index 00000000000..d3f2359d78c --- /dev/null +++ b/queue-6.6/scripts-gdb-vmalloc-disable-on-no-mmu.patch @@ -0,0 +1,78 @@ +From 6620999f0d41e4fd6f047727936a964c3399d249 Mon Sep 17 00:00:00 2001 +From: Ben Wolsieffer +Date: Tue, 31 Oct 2023 16:22:36 -0400 +Subject: scripts/gdb/vmalloc: disable on no-MMU + +From: Ben Wolsieffer + +commit 6620999f0d41e4fd6f047727936a964c3399d249 upstream. + +vmap_area does not exist on no-MMU, therefore the GDB scripts fail to +load: + +Traceback (most recent call last): + File "<...>/vmlinux-gdb.py", line 51, in + import linux.vmalloc + File "<...>/scripts/gdb/linux/vmalloc.py", line 14, in + vmap_area_ptr_type = vmap_area_type.get_type().pointer() + ^^^^^^^^^^^^^^^^^^^^^^^^^ + File "<...>/scripts/gdb/linux/utils.py", line 28, in get_type + self._type = gdb.lookup_type(self._name) + ^^^^^^^^^^^^^^^^^^^^^^^^^^^ +gdb.error: No struct type named vmap_area. + +To fix this, disable the command and add an informative error message if +CONFIG_MMU is not defined, following the example of lx-slabinfo. + +Link: https://lkml.kernel.org/r/20231031202235.2655333-2-ben.wolsieffer@hefring.com +Fixes: 852622bf3616 ("scripts/gdb/vmalloc: add vmallocinfo support") +Signed-off-by: Ben Wolsieffer +Cc: Jan Kiszka +Cc: Kieran Bingham +Cc: Kuan-Ying Lee +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + scripts/gdb/linux/constants.py.in | 1 + + scripts/gdb/linux/vmalloc.py | 8 ++++++-- + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/scripts/gdb/linux/constants.py.in b/scripts/gdb/linux/constants.py.in +index 04c87b570aab..e810e0c27ff1 100644 +--- a/scripts/gdb/linux/constants.py.in ++++ b/scripts/gdb/linux/constants.py.in +@@ -158,3 +158,4 @@ LX_CONFIG(CONFIG_STACKDEPOT) + LX_CONFIG(CONFIG_PAGE_OWNER) + LX_CONFIG(CONFIG_SLUB_DEBUG) + LX_CONFIG(CONFIG_SLAB_FREELIST_HARDENED) ++LX_CONFIG(CONFIG_MMU) +diff --git a/scripts/gdb/linux/vmalloc.py b/scripts/gdb/linux/vmalloc.py +index 48e4a4fae7bb..d3c8a0274d1e 100644 +--- a/scripts/gdb/linux/vmalloc.py ++++ b/scripts/gdb/linux/vmalloc.py +@@ -10,8 +10,9 @@ import gdb + import re + from linux import lists, utils, stackdepot, constants, mm + +-vmap_area_type = utils.CachedType('struct vmap_area') +-vmap_area_ptr_type = vmap_area_type.get_type().pointer() ++if constants.LX_CONFIG_MMU: ++ vmap_area_type = utils.CachedType('struct vmap_area') ++ vmap_area_ptr_type = vmap_area_type.get_type().pointer() + + def is_vmalloc_addr(x): + pg_ops = mm.page_ops().ops +@@ -25,6 +26,9 @@ class LxVmallocInfo(gdb.Command): + super(LxVmallocInfo, self).__init__("lx-vmallocinfo", gdb.COMMAND_DATA) + + def invoke(self, arg, from_tty): ++ if not constants.LX_CONFIG_MMU: ++ raise gdb.GdbError("Requires MMU support") ++ + vmap_area_list = gdb.parse_and_eval('vmap_area_list') + for vmap_area in lists.list_for_each_entry(vmap_area_list, vmap_area_ptr_type, "list"): + if not vmap_area['vm']: +-- +2.43.0 + diff --git a/queue-6.6/selftests-clone3-fix-broken-test-under-config_time_ns.patch b/queue-6.6/selftests-clone3-fix-broken-test-under-config_time_ns.patch new file mode 100644 index 00000000000..4197029b1b7 --- /dev/null +++ b/queue-6.6/selftests-clone3-fix-broken-test-under-config_time_ns.patch @@ -0,0 +1,68 @@ +From fc7f04dc23db50206bee7891516ed4726c3f64cf Mon Sep 17 00:00:00 2001 +From: Tiezhu Yang +Date: Tue, 11 Jul 2023 17:13:34 +0800 +Subject: selftests/clone3: Fix broken test under !CONFIG_TIME_NS + +From: Tiezhu Yang + +commit fc7f04dc23db50206bee7891516ed4726c3f64cf upstream. + +When execute the following command to test clone3 under !CONFIG_TIME_NS: + + # make headers && cd tools/testing/selftests/clone3 && make && ./clone3 + +we can see the following error info: + + # [7538] Trying clone3() with flags 0x80 (size 0) + # Invalid argument - Failed to create new process + # [7538] clone3() with flags says: -22 expected 0 + not ok 18 [7538] Result (-22) is different than expected (0) + ... + # Totals: pass:18 fail:1 xfail:0 xpass:0 skip:0 error:0 + +This is because if CONFIG_TIME_NS is not set, but the flag +CLONE_NEWTIME (0x80) is used to clone a time namespace, it +will return -EINVAL in copy_time_ns(). + +If kernel does not support CONFIG_TIME_NS, /proc/self/ns/time +will be not exist, and then we should skip clone3() test with +CLONE_NEWTIME. + +With this patch under !CONFIG_TIME_NS: + + # make headers && cd tools/testing/selftests/clone3 && make && ./clone3 + ... + # Time namespaces are not supported + ok 18 # SKIP Skipping clone3() with CLONE_NEWTIME + ... + # Totals: pass:18 fail:0 xfail:0 xpass:0 skip:1 error:0 + +Link: https://lkml.kernel.org/r/1689066814-13295-1-git-send-email-yangtiezhu@loongson.cn +Fixes: 515bddf0ec41 ("selftests/clone3: test clone3 with CLONE_NEWTIME") +Signed-off-by: Tiezhu Yang +Suggested-by: Thomas Gleixner +Cc: Christian Brauner +Cc: Shuah Khan +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/clone3/clone3.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/tools/testing/selftests/clone3/clone3.c ++++ b/tools/testing/selftests/clone3/clone3.c +@@ -196,7 +196,12 @@ int main(int argc, char *argv[]) + CLONE3_ARGS_NO_TEST); + + /* Do a clone3() in a new time namespace */ +- test_clone3(CLONE_NEWTIME, 0, 0, CLONE3_ARGS_NO_TEST); ++ if (access("/proc/self/ns/time", F_OK) == 0) { ++ test_clone3(CLONE_NEWTIME, 0, 0, CLONE3_ARGS_NO_TEST); ++ } else { ++ ksft_print_msg("Time namespaces are not supported\n"); ++ ksft_test_result_skip("Skipping clone3() with CLONE_NEWTIME\n"); ++ } + + /* Do a clone3() with exit signal (SIGCHLD) in flags */ + test_clone3(SIGCHLD, 0, -EINVAL, CLONE3_ARGS_NO_TEST); diff --git a/queue-6.6/selftests-resctrl-fix-feature-checks.patch b/queue-6.6/selftests-resctrl-fix-feature-checks.patch new file mode 100644 index 00000000000..7ee6864ee10 --- /dev/null +++ b/queue-6.6/selftests-resctrl-fix-feature-checks.patch @@ -0,0 +1,62 @@ +From 06035f019422ba17e85c11e70d6d8bdbe9fa1afd Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Mon, 2 Oct 2023 12:48:12 +0300 +Subject: selftests/resctrl: Fix feature checks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit 06035f019422ba17e85c11e70d6d8bdbe9fa1afd upstream. + +The MBA and CMT tests expect support of other features to be able to +run. + +When platform only supports MBA but not MBM, MBA test will fail with: +Failed to open total bw file: No such file or directory + +When platform only supports CMT but not CAT, CMT test will fail with: +Failed to open bit mask file '/sys/fs/resctrl/info/L3/cbm_mask': No such file or directory + +It leads to the test reporting test fail (even if no test was run at +all). + +Extend feature checks to cover these two conditions to show these tests +were skipped rather than failed. + +Fixes: ee0415681eb6 ("selftests/resctrl: Use resctrl/info for feature detection") +Signed-off-by: Ilpo Järvinen +Tested-by: Shaopeng Tan +Reviewed-by: Reinette Chatre +Reviewed-by: Shaopeng Tan +Cc: # selftests/resctrl: Refactor feature check to use resource and feature name +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/resctrl/resctrl_tests.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/tools/testing/selftests/resctrl/resctrl_tests.c ++++ b/tools/testing/selftests/resctrl/resctrl_tests.c +@@ -111,7 +111,9 @@ static void run_mba_test(char **benchmar + return; + } + +- if (!validate_resctrl_feature_request("MB", NULL) || (get_vendor() != ARCH_INTEL)) { ++ if (!validate_resctrl_feature_request("MB", NULL) || ++ !validate_resctrl_feature_request("L3_MON", "mbm_local_bytes") || ++ (get_vendor() != ARCH_INTEL)) { + ksft_test_result_skip("Hardware does not support MBA or MBA is disabled\n"); + goto umount; + } +@@ -135,7 +137,8 @@ static void run_cmt_test(char **benchmar + return; + } + +- if (!validate_resctrl_feature_request("L3_MON", "llc_occupancy")) { ++ if (!validate_resctrl_feature_request("L3_MON", "llc_occupancy") || ++ !validate_resctrl_feature_request("L3", NULL)) { + ksft_test_result_skip("Hardware does not support CMT or CMT is disabled\n"); + goto umount; + } diff --git a/queue-6.6/selftests-resctrl-fix-uninitialized-.sa_flags.patch b/queue-6.6/selftests-resctrl-fix-uninitialized-.sa_flags.patch new file mode 100644 index 00000000000..d3e27567612 --- /dev/null +++ b/queue-6.6/selftests-resctrl-fix-uninitialized-.sa_flags.patch @@ -0,0 +1,51 @@ +From beb7f471847663559bd0fe60af1d70e05a1d7c6c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Mon, 2 Oct 2023 12:48:07 +0300 +Subject: selftests/resctrl: Fix uninitialized .sa_flags +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit beb7f471847663559bd0fe60af1d70e05a1d7c6c upstream. + +signal_handler_unregister() calls sigaction() with uninitializing +sa_flags in the struct sigaction. + +Make sure sa_flags is always initialized in signal_handler_unregister() +by initializing the struct sigaction when declaring it. Also add the +initialization to signal_handler_register() even if there are no know +bugs in there because correctness is then obvious from the code itself. + +Fixes: 73c55fa5ab55 ("selftests/resctrl: Commonize the signal handler register/unregister for all tests") +Suggested-by: Reinette Chatre +Signed-off-by: Ilpo Järvinen +Cc: +Reviewed-by: Reinette Chatre +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/resctrl/resctrl_val.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/testing/selftests/resctrl/resctrl_val.c ++++ b/tools/testing/selftests/resctrl/resctrl_val.c +@@ -482,7 +482,7 @@ void ctrlc_handler(int signum, siginfo_t + */ + int signal_handler_register(void) + { +- struct sigaction sigact; ++ struct sigaction sigact = {}; + int ret = 0; + + sigact.sa_sigaction = ctrlc_handler; +@@ -504,7 +504,7 @@ int signal_handler_register(void) + */ + void signal_handler_unregister(void) + { +- struct sigaction sigact; ++ struct sigaction sigact = {}; + + sigact.sa_handler = SIG_DFL; + sigemptyset(&sigact.sa_mask); diff --git a/queue-6.6/selftests-resctrl-move-_gnu_source-define-into-makefile.patch b/queue-6.6/selftests-resctrl-move-_gnu_source-define-into-makefile.patch new file mode 100644 index 00000000000..617d9c091fc --- /dev/null +++ b/queue-6.6/selftests-resctrl-move-_gnu_source-define-into-makefile.patch @@ -0,0 +1,50 @@ +From 3a1e4a91aa454a1c589a9824d54179fdbfccde45 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Mon, 2 Oct 2023 12:48:10 +0300 +Subject: selftests/resctrl: Move _GNU_SOURCE define into Makefile +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit 3a1e4a91aa454a1c589a9824d54179fdbfccde45 upstream. + +_GNU_SOURCE is defined in resctrl.h. Defining _GNU_SOURCE has a large +impact on what gets defined when including headers either before or +after it. This can result in compile failures if .c file decides to +include a standard header file before resctrl.h. + +It is safer to define _GNU_SOURCE in Makefile so it is always defined +regardless of in which order includes are done. + +Signed-off-by: Ilpo Järvinen +Tested-by: Shaopeng Tan +Reviewed-by: Reinette Chatre +Reviewed-by: Shaopeng Tan +Cc: +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/resctrl/Makefile | 2 +- + tools/testing/selftests/resctrl/resctrl.h | 1 - + 2 files changed, 1 insertion(+), 2 deletions(-) + +--- a/tools/testing/selftests/resctrl/Makefile ++++ b/tools/testing/selftests/resctrl/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + +-CFLAGS = -g -Wall -O2 -D_FORTIFY_SOURCE=2 ++CFLAGS = -g -Wall -O2 -D_FORTIFY_SOURCE=2 -D_GNU_SOURCE + CFLAGS += $(KHDR_INCLUDES) + + TEST_GEN_PROGS := resctrl_tests +--- a/tools/testing/selftests/resctrl/resctrl.h ++++ b/tools/testing/selftests/resctrl/resctrl.h +@@ -1,5 +1,4 @@ + /* SPDX-License-Identifier: GPL-2.0 */ +-#define _GNU_SOURCE + #ifndef RESCTRL_H + #define RESCTRL_H + #include diff --git a/queue-6.6/selftests-resctrl-reduce-failures-due-to-outliers-in-mba-mbm-tests.patch b/queue-6.6/selftests-resctrl-reduce-failures-due-to-outliers-in-mba-mbm-tests.patch new file mode 100644 index 00000000000..4804c714695 --- /dev/null +++ b/queue-6.6/selftests-resctrl-reduce-failures-due-to-outliers-in-mba-mbm-tests.patch @@ -0,0 +1,67 @@ +From ef43c30858754d99373a63dff33280a9969b49bc Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Mon, 2 Oct 2023 12:48:13 +0300 +Subject: selftests/resctrl: Reduce failures due to outliers in MBA/MBM tests +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit ef43c30858754d99373a63dff33280a9969b49bc upstream. + +The initial value of 5% chosen for the maximum allowed percentage +difference between resctrl mbm value and IMC mbm value in + +commit 06bd03a57f8c ("selftests/resctrl: Fix MBA/MBM results reporting + format") was "randomly chosen value" (as admitted by the changelog). + +When running tests in our lab across a large number platforms, 5% +difference upper bound for success seems a bit on the low side for the +MBA and MBM tests. Some platforms produce outliers that are slightly +above that, typically 6-7%, which leads MBA/MBM test frequently +failing. + +Replace the "randomly chosen value" with a success bound that is based +on those measurements across large number of platforms by relaxing the +MBA/MBM success bound to 8%. The relaxed bound removes the failures due +the frequent outliers. + +Fixed commit description style error during merge: +Shuah Khan + +Fixes: 06bd03a57f8c ("selftests/resctrl: Fix MBA/MBM results reporting format") +Signed-off-by: Ilpo Järvinen +Tested-by: Shaopeng Tan +Reviewed-by: Reinette Chatre +Reviewed-by: Shaopeng Tan +Cc: +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/resctrl/mba_test.c | 2 +- + tools/testing/selftests/resctrl/mbm_test.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/testing/selftests/resctrl/mba_test.c ++++ b/tools/testing/selftests/resctrl/mba_test.c +@@ -12,7 +12,7 @@ + + #define RESULT_FILE_NAME "result_mba" + #define NUM_OF_RUNS 5 +-#define MAX_DIFF_PERCENT 5 ++#define MAX_DIFF_PERCENT 8 + #define ALLOCATION_MAX 100 + #define ALLOCATION_MIN 10 + #define ALLOCATION_STEP 10 +--- a/tools/testing/selftests/resctrl/mbm_test.c ++++ b/tools/testing/selftests/resctrl/mbm_test.c +@@ -11,7 +11,7 @@ + #include "resctrl.h" + + #define RESULT_FILE_NAME "result_mbm" +-#define MAX_DIFF_PERCENT 5 ++#define MAX_DIFF_PERCENT 8 + #define NUM_OF_RUNS 5 + + static int diff --git a/queue-6.6/selftests-resctrl-refactor-feature-check-to-use-resource-and-feature-name.patch b/queue-6.6/selftests-resctrl-refactor-feature-check-to-use-resource-and-feature-name.patch new file mode 100644 index 00000000000..7647b55d953 --- /dev/null +++ b/queue-6.6/selftests-resctrl-refactor-feature-check-to-use-resource-and-feature-name.patch @@ -0,0 +1,201 @@ +From d56e5da0e0f557a206bace16bbbdad00a5800e34 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Mon, 2 Oct 2023 12:48:11 +0300 +Subject: selftests/resctrl: Refactor feature check to use resource and feature name +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit d56e5da0e0f557a206bace16bbbdad00a5800e34 upstream. + +Feature check in validate_resctrl_feature_request() takes in the test +name string and maps that to what to check per test. + +Pass resource and feature names to validate_resctrl_feature_request() +directly rather than deriving them from the test name inside the +function which makes the feature check easier to extend for new test +cases. + +Use !! in the return statement to make the boolean conversion more +obvious even if it is not strictly necessary from correctness point of +view (to avoid it looking like the function is returning a freed +pointer). + +Signed-off-by: Ilpo Järvinen +Tested-by: Shaopeng Tan +Reviewed-by: Reinette Chatre +Reviewed-by: Shaopeng Tan +Cc: # selftests/resctrl: Remove duplicate feature check from CMT test +Cc: # selftests/resctrl: Move _GNU_SOURCE define into Makefile +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/resctrl/resctrl.h | 6 -- + tools/testing/selftests/resctrl/resctrl_tests.c | 10 ++- + tools/testing/selftests/resctrl/resctrlfs.c | 69 +++++++++--------------- + 3 files changed, 34 insertions(+), 51 deletions(-) + +--- a/tools/testing/selftests/resctrl/resctrl.h ++++ b/tools/testing/selftests/resctrl/resctrl.h +@@ -27,10 +27,6 @@ + #define RESCTRL_PATH "/sys/fs/resctrl" + #define PHYS_ID_PATH "/sys/devices/system/cpu/cpu" + #define INFO_PATH "/sys/fs/resctrl/info" +-#define L3_PATH "/sys/fs/resctrl/info/L3" +-#define MB_PATH "/sys/fs/resctrl/info/MB" +-#define L3_MON_PATH "/sys/fs/resctrl/info/L3_MON" +-#define L3_MON_FEATURES_PATH "/sys/fs/resctrl/info/L3_MON/mon_features" + + #define ARCH_INTEL 1 + #define ARCH_AMD 2 +@@ -85,7 +81,7 @@ int get_resource_id(int cpu_no, int *res + int mount_resctrlfs(void); + int umount_resctrlfs(void); + int validate_bw_report_request(char *bw_report); +-bool validate_resctrl_feature_request(const char *resctrl_val); ++bool validate_resctrl_feature_request(const char *resource, const char *feature); + char *fgrep(FILE *inf, const char *str); + int taskset_benchmark(pid_t bm_pid, int cpu_no); + void run_benchmark(int signum, siginfo_t *info, void *ucontext); +--- a/tools/testing/selftests/resctrl/resctrl_tests.c ++++ b/tools/testing/selftests/resctrl/resctrl_tests.c +@@ -83,7 +83,9 @@ static void run_mbm_test(char **benchmar + return; + } + +- if (!validate_resctrl_feature_request(MBM_STR) || (get_vendor() != ARCH_INTEL)) { ++ if (!validate_resctrl_feature_request("L3_MON", "mbm_total_bytes") || ++ !validate_resctrl_feature_request("L3_MON", "mbm_local_bytes") || ++ (get_vendor() != ARCH_INTEL)) { + ksft_test_result_skip("Hardware does not support MBM or MBM is disabled\n"); + goto umount; + } +@@ -109,7 +111,7 @@ static void run_mba_test(char **benchmar + return; + } + +- if (!validate_resctrl_feature_request(MBA_STR) || (get_vendor() != ARCH_INTEL)) { ++ if (!validate_resctrl_feature_request("MB", NULL) || (get_vendor() != ARCH_INTEL)) { + ksft_test_result_skip("Hardware does not support MBA or MBA is disabled\n"); + goto umount; + } +@@ -133,7 +135,7 @@ static void run_cmt_test(char **benchmar + return; + } + +- if (!validate_resctrl_feature_request(CMT_STR)) { ++ if (!validate_resctrl_feature_request("L3_MON", "llc_occupancy")) { + ksft_test_result_skip("Hardware does not support CMT or CMT is disabled\n"); + goto umount; + } +@@ -159,7 +161,7 @@ static void run_cat_test(int cpu_no, int + return; + } + +- if (!validate_resctrl_feature_request(CAT_STR)) { ++ if (!validate_resctrl_feature_request("L3", NULL)) { + ksft_test_result_skip("Hardware does not support CAT or CAT is disabled\n"); + goto umount; + } +--- a/tools/testing/selftests/resctrl/resctrlfs.c ++++ b/tools/testing/selftests/resctrl/resctrlfs.c +@@ -8,6 +8,8 @@ + * Sai Praneeth Prakhya , + * Fenghua Yu + */ ++#include ++ + #include "resctrl.h" + + static int find_resctrl_mount(char *buffer) +@@ -604,63 +606,46 @@ char *fgrep(FILE *inf, const char *str) + + /* + * validate_resctrl_feature_request - Check if requested feature is valid. +- * @resctrl_val: Requested feature ++ * @resource: Required resource (e.g., MB, L3, L2, L3_MON, etc.) ++ * @feature: Required monitor feature (in mon_features file). Can only be ++ * set for L3_MON. Must be NULL for all other resources. + * +- * Return: True if the feature is supported, else false. False is also +- * returned if resctrl FS is not mounted. ++ * Return: True if the resource/feature is supported, else false. False is ++ * also returned if resctrl FS is not mounted. + */ +-bool validate_resctrl_feature_request(const char *resctrl_val) ++bool validate_resctrl_feature_request(const char *resource, const char *feature) + { ++ char res_path[PATH_MAX]; + struct stat statbuf; +- bool found = false; + char *res; + FILE *inf; + int ret; + +- if (!resctrl_val) ++ if (!resource) + return false; + + ret = find_resctrl_mount(NULL); + if (ret) + return false; + +- if (!strncmp(resctrl_val, CAT_STR, sizeof(CAT_STR))) { +- if (!stat(L3_PATH, &statbuf)) +- return true; +- } else if (!strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR))) { +- if (!stat(MB_PATH, &statbuf)) +- return true; +- } else if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR)) || +- !strncmp(resctrl_val, CMT_STR, sizeof(CMT_STR))) { +- if (!stat(L3_MON_PATH, &statbuf)) { +- inf = fopen(L3_MON_FEATURES_PATH, "r"); +- if (!inf) +- return false; +- +- if (!strncmp(resctrl_val, CMT_STR, sizeof(CMT_STR))) { +- res = fgrep(inf, "llc_occupancy"); +- if (res) { +- found = true; +- free(res); +- } +- } +- +- if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR))) { +- res = fgrep(inf, "mbm_total_bytes"); +- if (res) { +- free(res); +- res = fgrep(inf, "mbm_local_bytes"); +- if (res) { +- found = true; +- free(res); +- } +- } +- } +- fclose(inf); +- } +- } ++ snprintf(res_path, sizeof(res_path), "%s/%s", INFO_PATH, resource); ++ ++ if (stat(res_path, &statbuf)) ++ return false; ++ ++ if (!feature) ++ return true; ++ ++ snprintf(res_path, sizeof(res_path), "%s/%s/mon_features", INFO_PATH, resource); ++ inf = fopen(res_path, "r"); ++ if (!inf) ++ return false; ++ ++ res = fgrep(inf, feature); ++ free(res); ++ fclose(inf); + +- return found; ++ return !!res; + } + + int filter_dmesg(void) diff --git a/queue-6.6/selftests-resctrl-remove-duplicate-feature-check-from-cmt-test.patch b/queue-6.6/selftests-resctrl-remove-duplicate-feature-check-from-cmt-test.patch new file mode 100644 index 00000000000..d589df7ab96 --- /dev/null +++ b/queue-6.6/selftests-resctrl-remove-duplicate-feature-check-from-cmt-test.patch @@ -0,0 +1,41 @@ +From 030b48fb2cf045dead8ee2c5ead560930044c029 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Mon, 2 Oct 2023 12:48:09 +0300 +Subject: selftests/resctrl: Remove duplicate feature check from CMT test +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit 030b48fb2cf045dead8ee2c5ead560930044c029 upstream. + +The test runner run_cmt_test() in resctrl_tests.c checks for CMT +feature and does not run cmt_resctrl_val() if CMT is not supported. +Then cmt_resctrl_val() also check is CMT is supported. + +Remove the duplicated feature check for CMT from cmt_resctrl_val(). + +Signed-off-by: Ilpo Järvinen +Tested-by: Shaopeng Tan +Reviewed-by: Reinette Chatre +Reviewed-by: Shaopeng Tan +Cc: +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/resctrl/cmt_test.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/tools/testing/selftests/resctrl/cmt_test.c ++++ b/tools/testing/selftests/resctrl/cmt_test.c +@@ -76,9 +76,6 @@ int cmt_resctrl_val(int cpu_no, int n, c + int count_of_bits; + int ret; + +- if (!validate_resctrl_feature_request(CMT_STR)) +- return -1; +- + ret = get_cbm_mask("L3", cbm_mask); + if (ret) + return ret; diff --git a/queue-6.6/series b/queue-6.6/series index 451b6be2ba8..00a2e20567f 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -351,3 +351,42 @@ netfilter-nf_tables-remove-catchall-element-in-gc-sy.patch netfilter-nf_tables-split-async-and-sync-catchall-in.patch asoc-soc-dai-add-flag-to-mute-and-unmute-stream-during-trigger.patch asoc-codecs-wsa883x-make-use-of-new-mute_unmute_on_trigger-flag.patch +selftests-resctrl-fix-uninitialized-.sa_flags.patch +selftests-resctrl-remove-duplicate-feature-check-from-cmt-test.patch +selftests-resctrl-move-_gnu_source-define-into-makefile.patch +selftests-resctrl-refactor-feature-check-to-use-resource-and-feature-name.patch +selftests-resctrl-fix-feature-checks.patch +selftests-resctrl-reduce-failures-due-to-outliers-in-mba-mbm-tests.patch +hid-lenovo-resend-all-settings-on-reset_resume-for-compact-keyboards.patch +asoc-codecs-wsa-macro-fix-uninitialized-stack-variables-with-name-prefix.patch +jbd2-fix-potential-data-lost-in-recovering-journal-raced-with-synchronizing-fs-bdev.patch +quota-explicitly-forbid-quota-files-from-being-encrypted.patch +kernel-reboot-emergency_restart-set-correct-system_state.patch +scripts-gdb-vmalloc-disable-on-no-mmu.patch +fs-use-nth_page-in-place-of-direct-struct-page-manipulation.patch +mips-use-nth_page-in-place-of-direct-struct-page-manipulation.patch +i2c-core-run-atomic-i2c-xfer-when-preemptible.patch +selftests-clone3-fix-broken-test-under-config_time_ns.patch +tracing-have-the-user-copy-of-synthetic-event-address-use-correct-context.patch +driver-core-release-all-resources-during-unbind-before-updating-device-links.patch +mcb-fix-error-handling-for-different-scenarios-when-parsing.patch +powerpc-pseries-iommu-enable_ddw-incorrectly-returns-direct-mapping-for-sr-iov-device.patch +dmaengine-stm32-mdma-correct-desc-prep-when-channel-running.patch +s390-mm-add-missing-arch_set_page_dat-call-to-vmem_crst_alloc.patch +s390-mm-add-missing-arch_set_page_dat-call-to-gmap-allocations.patch +s390-cmma-fix-initial-kernel-address-space-page-table-walk.patch +s390-cmma-fix-detection-of-dat-pages.patch +s390-cmma-fix-handling-of-swapper_pg_dir-and-invalid_pg_dir.patch +mm-cma-use-nth_page-in-place-of-direct-struct-page-manipulation.patch +mm-hugetlb-use-nth_page-in-place-of-direct-struct-page-manipulation.patch +mm-memory_hotplug-use-pfn-math-in-place-of-direct-struct-page-manipulation.patch +mm-make-pr_mdwe_refuse_exec_gain-an-unsigned-long.patch +mtd-cfi_cmdset_0001-byte-swap-otp-info.patch +cxl-region-do-not-try-to-cleanup-after-cxl_region_setup_targets-fails.patch +i3c-master-cdns-fix-reading-status-register.patch +i3c-master-svc-fix-race-condition-in-ibi-work-thread.patch +i3c-master-svc-fix-wrong-data-return-when-ibi-happen-during-start-frame.patch +i3c-master-svc-fix-ibi-may-not-return-mandatory-data-byte.patch +i3c-master-svc-fix-check-wrong-status-register-in-irq-handler.patch +i3c-master-svc-fix-sda-keep-low-when-polling-ibiwon-timeout-happen.patch +i3c-master-svc-fix-random-hot-join-failure-since-timeout-error.patch diff --git a/queue-6.6/tracing-have-the-user-copy-of-synthetic-event-address-use-correct-context.patch b/queue-6.6/tracing-have-the-user-copy-of-synthetic-event-address-use-correct-context.patch new file mode 100644 index 00000000000..90dcbf9aa85 --- /dev/null +++ b/queue-6.6/tracing-have-the-user-copy-of-synthetic-event-address-use-correct-context.patch @@ -0,0 +1,47 @@ +From 4f7969bcd6d33042d62e249b41b5578161e4c868 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Google)" +Date: Tue, 31 Oct 2023 15:10:33 -0400 +Subject: tracing: Have the user copy of synthetic event address use correct context + +From: Steven Rostedt (Google) + +commit 4f7969bcd6d33042d62e249b41b5578161e4c868 upstream. + +A synthetic event is created by the synthetic event interface that can +read both user or kernel address memory. In reality, it reads any +arbitrary memory location from within the kernel. If the address space is +in USER (where CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE is set) then +it uses strncpy_from_user_nofault() to copy strings otherwise it uses +strncpy_from_kernel_nofault(). + +But since both functions use the same variable there's no annotation to +what that variable is (ie. __user). This makes sparse complain. + +Quiet sparse by typecasting the strncpy_from_user_nofault() variable to +a __user pointer. + +Link: https://lore.kernel.org/linux-trace-kernel/20231031151033.73c42e23@gandalf.local.home + +Cc: stable@vger.kernel.org +Cc: Masami Hiramatsu +Cc: Mark Rutland +Fixes: 0934ae9977c2 ("tracing: Fix reading strings from synthetic events"); +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202311010013.fm8WTxa5-lkp@intel.com/ +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_events_synth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/trace/trace_events_synth.c ++++ b/kernel/trace/trace_events_synth.c +@@ -452,7 +452,7 @@ static unsigned int trace_string(struct + + #ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE + if ((unsigned long)str_val < TASK_SIZE) +- ret = strncpy_from_user_nofault(str_field, str_val, STR_VAR_LEN_MAX); ++ ret = strncpy_from_user_nofault(str_field, (const void __user *)str_val, STR_VAR_LEN_MAX); + else + #endif + ret = strncpy_from_kernel_nofault(str_field, str_val, STR_VAR_LEN_MAX); -- 2.47.3